cartethyia 2.7.3 → 2.7.5

package/src/providers/integrations/qoder/qoder-umid.ts

@@ -1,11 +1,10 @@
 /**
  * Qoder native machine identity (UMID) — the genuine SG bridge via umidpack.
  *
- * Research record (2026-10-30): the daily-credit campaign gates its CREDITS
- * grant on a *genuine* Alibaba SG-produced identity. Deterministic/generated
- * tokens do not reveal the grant on a fresh account; the `runtime-info`
- * bridge does. Primary path therefore runs the real bridge binary from
- * `vendor/qoder-umid/umidpack/`, auto-picked per host OS.
+ * Research record (2026-10-30): same-account controls found that the daily
+ * CREDITS campaign does not gate grants on machine identity. This module
+ * prefers the vendor bridge for stable native identity and seed replay, with
+ * a deterministic generated fallback when no bridge is available.
  *
  * Seed semantics (verified live): the Linux ELF resolves the user home via
  * the passwd entry — it ignores `$HOME`/`XDG_CONFIG_HOME`, so the seed file
@@ -18,15 +17,14 @@
  *
  * Platform behavior:
  *   win32  — the exe is hardware-bound: one identity per machine, no seed.
- *            Still a genuine SG identity (accepted by the campaign surface).
  *   linux  — direct spawn of the umidpack ELF, serialized seed file.
  *   darwin — the Mach-O runs directly; seed path is the macOS user home.
  *   win32 + WSL (this repo's primary deployment) — the ELF runs via WSL with
  *            flock serialization; the bridge binary is staged into /tmp once.
  *
- * The generated path remains a fallback for hosts with no usable bridge: it
- * produces well-shaped but *not* SG-signed tokens — fine for non-campaign
- * endpoints, will not surface the daily grant.
+ * The generated path remains a fallback for hosts with no usable bridge. It
+ * produces deterministic, well-shaped tokens but is not an SG identity. Live
+ * controls showed that machine identity does not gate daily CREDITS grants.
  *
  * Bridge CLI (donor-verified):
  *   linux : runtime-info <env>
@@ -35,13 +33,10 @@
  */
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { log } from "../../../observability/logger";
 
-/** Valid environment codes (kept for validation/console surface). */
-export const QODER_ENV_CODES = ["0", "3", "4", "5", "6", "7"] as const;
-
 /** Environment code: an upstream "region/flavor", not a device identity. */
 const ENV_CODE = "3";
 
@@ -93,11 +88,6 @@ function pickBridge(): Bridge | null {
   return existsSync(join(umidpackDir(), "elf-x86_64", "runtime-info")) ? { kind: "elf" } : null;
 }
 
-/** True when a genuine bridge can run on this host. */
-export function hasGenuineBridge(): boolean {
-  return pickBridge() !== null;
-}
-
 /** Generated (software) identity — deterministic per account id, NOT SG-signed. */
 export function mintQoderGeneratedIdentity(accountId: string): QoderNativeIdentity {
   const first = createHash("sha256").update(accountId).digest("base64url");
@@ -146,6 +136,22 @@ function wsl(script: string, timeout = 120_000): string {
   return String(r.stdout ?? "");
 }
 
+/**
+ * Best-effort make a POSIX bridge binary executable before spawning it. The
+ * umidpack binaries are committed without the exec bit (git mode 100644) and
+ * nothing else in the delivery path sets it — a Docker image or a fresh clone
+ * on Linux/macOS would otherwise fail to spawn them (EACCES -> "[qoder] elf
+ * mint failed"). Idempotent; if it cannot set the bit, `spawnSync` reports
+ * the real failure as before.
+ */
+export function ensurePosixExecutable(file: string): void {
+  try {
+    chmodSync(file, 0o755);
+  } catch {
+    /* spawn will report the actual error */
+  }
+}
+
 /** Run the bridge inside WSL under flock; returns the identity or null. */
 
 function seedPath(): string {
@@ -155,15 +161,16 @@ function seedPath(): string {
 }
 
 /**
- * Mints a fresh genuine identity: wipe the seed (under the lock), run the
+ * Mints a fresh native identity: wipe the seed (under the lock), run the
  * bridge, capture the identity AND the seed it wrote. The seed is required
- * for later replay of this same identity. Returns `null` when the bridge
- * fails; falls back to the generated identity only when no bridge exists.
+ * for later replay of this same native identity. Returns `null` when the
+ * bridge fails; falls back to the generated identity only when no bridge
+ * exists.
  */
 export function mintQoderNativeIdentity(accountId: string): { identity: QoderNativeIdentity; seed: string } | null {
   const bridge = pickBridge();
   if (!bridge) {
-    log.warn("[qoder] no genuine bridge for this host — generated fallback (campaign grant will not surface)");
+    log.warn("[qoder] no native bridge for this host — using generated identity fallback");
     return { identity: mintQoderGeneratedIdentity(accountId), seed: "" };
   }
 
@@ -180,6 +187,7 @@ export function mintQoderNativeIdentity(accountId: string): { identity: QoderNat
 
   if (bridge.kind === "elf") {
     const exe = join(umidpackDir(), process.arch === "arm64" ? "elf-aarch64" : "elf-x86_64", "runtime-info");
+    ensurePosixExecutable(exe);
     const seed = seedPath();
     const dir = seed.slice(0, seed.lastIndexOf("/"));
     mkdirSync(dir, { recursive: true });
@@ -193,6 +201,7 @@ export function mintQoderNativeIdentity(accountId: string): { identity: QoderNat
   if (bridge.kind === "macho") {
     const arch = process.arch === "arm64" ? "macho-arm64" : "macho-x86_64";
     const exe = join(umidpackDir(), arch, "runtime-info");
+    ensurePosixExecutable(exe);
     const seed = seedPath();
     const dir = seed.slice(0, seed.lastIndexOf("/"));
     mkdirSync(dir, { recursive: true });
@@ -237,6 +246,7 @@ export function replayQoderNativeIdentity(seed: string, accountId: string): Qode
 
   if (bridge.kind === "elf") {
     const exe = join(umidpackDir(), process.arch === "arm64" ? "elf-aarch64" : "elf-x86_64", "runtime-info");
+    ensurePosixExecutable(exe);
     const seed = seedPath();
     writeFileSync(seed, seed, "utf8");
     const r = spawnSync(exe, [ENV_CODE], { encoding: "utf8", timeout: 25_000 });
@@ -246,6 +256,7 @@ export function replayQoderNativeIdentity(seed: string, accountId: string): Qode
   if (bridge.kind === "macho") {
     const arch = process.arch === "arm64" ? "macho-arm64" : "macho-x86_64";
     const exe = join(umidpackDir(), arch, "runtime-info");
+    ensurePosixExecutable(exe);
     const seedPathStr = seedPath();
     writeFileSync(seedPathStr, seed, "utf8");
     const r = spawnSync(exe, [ENV_CODE, "--account-stdin"], {
@@ -259,17 +270,6 @@ export function replayQoderNativeIdentity(seed: string, accountId: string): Qode
   return null; // pe: cannot replay a seed on a hardware-bound identity
 }
 
-/** Reads the current seed file content (diagnostics). */
-export function readCurrentQoderSeed(): string {
-  const path = seedPath();
-  try {
-    if (process.platform === "win32") return wsl(`cat ${WSL_SEED} 2>/dev/null`);
-    return existsSync(path) ? readFileSync(path, "utf8") : "";
-  } catch {
-    return "";
-  }
-}
-
 /** The six native machine headers for one identity. */
 export function qoderMachineHeaders(identity: QoderNativeIdentity): Record<string, string> {
   return {
@@ -281,8 +281,3 @@ export function qoderMachineHeaders(identity: QoderNativeIdentity): Record<strin
     "cosy-machinehostname": "DESKTOP-QODER",
   };
 }
-
-/** For tests: force re-mint (identities are pure functions of their seed). */
-export function resetQoderNativeIdentityCache(): void {
-  // no persistent in-process identity cache remains
-}

package/src/providers/integrations/qoder/qoder-virtual.ts

@@ -18,6 +18,15 @@ export interface QoderVirtualModel {
   readonly target: string;
   /** Name shown where a human picks a model. */
   readonly displayName: string;
+  /**
+   * Tier/limit overrides for a virtual row whose upstream slot reports
+   * different numbers than the caller-facing card should show. `lite` is a
+   * free plan package over `qmodel` (Qwen3.7-Plus): same model, smaller
+   * output ceiling, free tier, and the full multimodal input set.
+   */
+  readonly free?: boolean;
+  readonly outputLimit?: number;
+  readonly vision?: boolean;
 }
 
 /**
@@ -37,11 +46,14 @@ export const QODER_VIRTUAL_MODELS: readonly QoderVirtualModel[] = [
   { id: "qwen3.8-flash", target: "qfmodel", displayName: "Qwen3.8-Flash" },
   { id: "qwen3.7-max", target: "qmodel_latest", displayName: "Qwen3.7-Max" },
   { id: "qwen3.7-plus", target: "qmodel", displayName: "Qwen3.7-Plus" },
-  { id: "kimi-k3", target: "kmodel_latest", displayName: "Kimi-K3" },
+  { id: "kimi-k3", target: "kmodel_latest", displayName: "Kimi-K3.1-Pro" },
   { id: "kimi-k2.8-preview", target: "kmodel", displayName: "Kimi-K2.8-Preview" },
   { id: "glm-5.3", target: "gmodel", displayName: "GLM-5.3" },
   { id: "glm-5.3-flash", target: "gfmodel", displayName: "GLM-5.3-Flash" },
-  { id: "minimax-m3", target: "mmodel", displayName: "MiniMax-M3" },
+  { id: "minimax-m3", target: "mmodel", displayName: "MiniMax-M3.1-Flash" },
+  // `lite` is the free-tier plan package over `qmodel` (Qwen3.7-Plus):
+  // same 1M window and multimodal input, capped at 64k output, free tier.
+  { id: "lite-qwen-3.7-plus", target: "lite", displayName: "Lite-Qwen-3.7-Plus", free: true, outputLimit: 65536, vision: true },
 ];
 
 /** Virtual id → roster key. */