cartethyia 2.7.4 → 2.7.5

package/src/providers/bundled-discovery-providers.ts

@@ -10,39 +10,13 @@ import { createApiKeyAdapter, type ApiKeyProviderSpec } from "./configured-provi
  * OpenAI-compatible contract. Providers with static catalogs or additional
  * upstream behavior remain declared beside their special handling.
  */
-export const DISCOVERY_BACKED_PROVIDER_IDS = [
-  "groq",
-  "together",
-  "deepinfra",
-  "siliconflow",
-  "siliconflowcn",
-  "novita",
-  "larprouter",
-  "venice",
-  "nanogpt",
-  "baseten",
-  "synthetic",
-  "stepfun",
-  "sakana",
-  "helmcode",
-  "coralbricks",
-  "aiand",
-  "wafer",
-  "firepass",
-  "zhipucoding",
-  "dashscope",
-  "qianfan",
-] as const;
-
-export type DiscoveryBackedProviderId = (typeof DISCOVERY_BACKED_PROVIDER_IDS)[number];
-
 type DiscoveryBackedCapabilities = Pick<
   ProviderModule,
   "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
 >;
 
 type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
-type OpenAIModelDiscoveryFactory = (
+export type OpenAIModelDiscoveryFactory = (
   providerId: string,
   options?: {
     readonly headers?: (credential: string) => Readonly<Record<string, string>>;
@@ -71,10 +45,12 @@ const DISCOVERY_BACKED_PROVIDER_SPECS = {
   zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
   dashscope: GENERIC_API_KEY_SPECS.dashscope,
   qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
-} satisfies Readonly<Record<DiscoveryBackedProviderId, ApiKeyProviderSpec>>;
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
 
-function discoveryBackedCapabilities(
-  providerId: DiscoveryBackedProviderId,
+type DiscoveryBackedProviderId = keyof typeof DISCOVERY_BACKED_PROVIDER_SPECS;
+
+export function discoveryBackedCapabilities(
+  providerId: string,
   spec: ApiKeyProviderSpec,
   openAIModelDiscovery: OpenAIModelDiscoveryFactory,
 ): DiscoveryBackedCapabilities {

package/src/providers/configured-openai-providers.ts

@@ -1,12 +1,36 @@
 import type { ApiKeyProviderSpec } from "./configured-provider";
 import type { ProviderId } from "./provider-contracts";
 
+/**
+ * The shared spec builder for every builtin bearer-AI provider: "bearer auth
+ * against the provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible
+ * chat + responses, with the endpoint paths declared *below* the version root".
+ *
+ * `joinUrl` is plain concatenation and nothing rewrites a declared path, so a
+ * base already rooted at a version (`/openai/v1`, `/v1/openai`, `/v3/openai`,
+ * `/api/v1`, `/v2`, `/inference/v1`) plus a `/v1/…` path would double the
+ * segment and 404 every request. These specs therefore declare the path below
+ * the version root — the provider stating the truth about its own wire, not a
+ * correction applied to it.
+ */
+function apiKeySpec(
+  providerId: ProviderId,
+  paths: Readonly<Partial<Record<"chat" | "responses", string>>>,
+): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId,
+    endpoint_paths_by_wire_family: paths,
+  };
+}
+
+const BEARER_PATHS = { chat: "/chat/completions", responses: "/responses" } as const;
+
 /**
  * Builtin providers whose entire adapter contract is "bearer auth against the
  * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
- * responses, `/v1`-prefixed paths". They carry no catalog, no OAuth, and no
- * provider-specific payload hook, so they share one spec shape rather than
- * one module each.
+ * responses, with endpoint paths declared below the base's version root". They
+ * carry no catalog, no OAuth, and no provider-specific payload hook, so they
+ * share one spec shape rather than one module each.
  *
  * `base_url` is resolved per provider by `providerBaseUrl(provider_id)`.
  *
@@ -14,29 +38,31 @@ import type { ProviderId } from "./provider-contracts";
  * than a static catalog: every one of them republishes an aggregator's whole
  * roster, which changes faster than a committed array can. Each registry row
  * pairs this spec with `openAIModelDiscovery`.
+ *
+ * The id list is derived from the spec record so the two cannot drift apart.
  */
-export const GENERIC_API_KEY_PROVIDER_IDS = [
-  "larprouter",
-  "mistral",
-  "fireworks",
-  "nvidia",
-  "gmi",
-  "ollamacloud",
-  "together",
-  "siliconflow",
-  "siliconflowcn",
-  "nanogpt",
-  "baseten",
-  "synthetic",
-  "stepfun",
-  "sakana",
-  "helmcode",
-  "coralbricks",
-  "aiand",
-  "wafer",
-  "coreweave",
-  "qwen-portal",
-  "dashscope",
+export const GENERIC_API_KEY_SPECS = {
+  larprouter: apiKeySpec("larprouter", BEARER_PATHS),
+  mistral: apiKeySpec("mistral", BEARER_PATHS),
+  fireworks: apiKeySpec("fireworks", BEARER_PATHS),
+  nvidia: apiKeySpec("nvidia", BEARER_PATHS),
+  gmi: apiKeySpec("gmi", BEARER_PATHS),
+  ollamacloud: apiKeySpec("ollamacloud", BEARER_PATHS),
+  together: apiKeySpec("together", BEARER_PATHS),
+  siliconflow: apiKeySpec("siliconflow", BEARER_PATHS),
+  siliconflowcn: apiKeySpec("siliconflowcn", BEARER_PATHS),
+  nanogpt: apiKeySpec("nanogpt", BEARER_PATHS),
+  baseten: apiKeySpec("baseten", BEARER_PATHS),
+  synthetic: apiKeySpec("synthetic", BEARER_PATHS),
+  stepfun: apiKeySpec("stepfun", BEARER_PATHS),
+  sakana: apiKeySpec("sakana", BEARER_PATHS),
+  helmcode: apiKeySpec("helmcode", BEARER_PATHS),
+  coralbricks: apiKeySpec("coralbricks", BEARER_PATHS),
+  aiand: apiKeySpec("aiand", BEARER_PATHS),
+  wafer: apiKeySpec("wafer", BEARER_PATHS),
+  coreweave: apiKeySpec("coreweave", BEARER_PATHS),
+  dashscope: apiKeySpec("dashscope", BEARER_PATHS),
+  "qwen-portal": apiKeySpec("qwen-portal", BEARER_PATHS),
   // `deepseek` is intentionally absent: it dispatches on the Anthropic Messages
   // wire at its `/anthropic` root, not the OpenAI chat/responses wires, so it
   // carries a dedicated entry in `default-registry.ts` instead.
@@ -45,10 +71,24 @@ export const GENERIC_API_KEY_PROVIDER_IDS = [
   // already rooted at a version segment that the `/v1`-prefixed path this shape
   // pins would duplicate (`/openai/v1`, `/v1/openai`, `/v3/openai`, `/api/v1`,
   // `/v2`, and `/inference/v1`), so `joinUrl` would produce
-  // `…/v1/v1/chat/completions`. They use `versionedRootApiKeySpec` instead,
+  // `…/v1/v1/chat/completions`. They use the versioned-root spec instead,
   // which pins the path below the version root — the same reason `cerebras`
   // declares `/chat/completions` explicitly.
-] as const;
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+/**
+ * One id that has both a generic spec and a registry row.
+ *
+ * Exported so the registry can be checked against the spec list rather than
+ * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
+ * row naming a provider with no spec is a compile error instead of an
+ * `undefined` adapter at first dispatch.
+ */
+export type GenericApiKeyProviderId = keyof typeof GENERIC_API_KEY_SPECS;
+
+export const GENERIC_API_KEY_PROVIDER_IDS = Object.keys(
+  GENERIC_API_KEY_SPECS,
+) as readonly GenericApiKeyProviderId[];
 
 /**
  * Ids whose base URL already ends at a version segment.
@@ -59,77 +99,22 @@ export const GENERIC_API_KEY_PROVIDER_IDS = [
  * version root. That is the provider stating the truth about its own wire, not
  * a correction applied to it: a wrong path now reaches the operator as the
  * wrong URL instead of being quietly rewritten into a different address.
- */
-export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = [
-  "groq",
-  "deepinfra",
-  "novita",
-  "venice",
-  "qianfan",
-  "zhipucoding",
-  "firepass",
-] as const;
-
-export type VersionedRootApiKeyProviderId =
-  (typeof VERSIONED_ROOT_API_KEY_PROVIDER_IDS)[number];
-
-function versionedRootApiKeySpec(providerId: ProviderId): ApiKeyProviderSpec {
-  return {
-    provider_id: providerId,
-    endpoint_paths_by_wire_family: {
-      chat: "/chat/completions",
-      responses: "/responses",
-    },
-  };
-}
-
-export const VERSIONED_ROOT_API_KEY_SPECS = {
-  groq: versionedRootApiKeySpec("groq"),
-  deepinfra: versionedRootApiKeySpec("deepinfra"),
-  novita: versionedRootApiKeySpec("novita"),
-  venice: versionedRootApiKeySpec("venice"),
-  qianfan: versionedRootApiKeySpec("qianfan"),
-  zhipucoding: versionedRootApiKeySpec("zhipucoding"),
-  firepass: versionedRootApiKeySpec("firepass"),
-} satisfies Readonly<Record<VersionedRootApiKeyProviderId, ApiKeyProviderSpec>>;
-
-/**
- * One id that has both a generic spec and a registry row.
  *
- * Exported so the registry can be checked against the spec list rather than
- * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
- * row naming a provider with no spec is a compile error instead of an
- * `undefined` adapter at first dispatch.
+ * The id list is derived from the spec record so the two cannot drift apart.
  */
-export type GenericApiKeyProviderId = (typeof GENERIC_API_KEY_PROVIDER_IDS)[number];
+export const VERSIONED_ROOT_API_KEY_SPECS = {
+  groq: apiKeySpec("groq", BEARER_PATHS),
+  deepinfra: apiKeySpec("deepinfra", BEARER_PATHS),
+  novita: apiKeySpec("novita", BEARER_PATHS),
+  venice: apiKeySpec("venice", BEARER_PATHS),
+  qianfan: apiKeySpec("qianfan", BEARER_PATHS),
+  zhipucoding: apiKeySpec("zhipucoding", BEARER_PATHS),
+  firepass: apiKeySpec("firepass", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
 
-function genericApiKeySpec(providerId: GenericApiKeyProviderId): ApiKeyProviderSpec {
-  // These roots are *not* bare hosts — every one of them already ends at `/v1`
-  // — so the path is declared below that root. Both spec shapes declare the same
-  // thing, so this is the one implementation.
-  return versionedRootApiKeySpec(providerId);
-}
+export type VersionedRootApiKeyProviderId =
+  keyof typeof VERSIONED_ROOT_API_KEY_SPECS;
 
-export const GENERIC_API_KEY_SPECS = {
-  larprouter: genericApiKeySpec("larprouter"),
-  mistral: genericApiKeySpec("mistral"),
-  fireworks: genericApiKeySpec("fireworks"),
-  nvidia: genericApiKeySpec("nvidia"),
-  gmi: genericApiKeySpec("gmi"),
-  ollamacloud: genericApiKeySpec("ollamacloud"),
-  together: genericApiKeySpec("together"),
-  siliconflow: genericApiKeySpec("siliconflow"),
-  siliconflowcn: genericApiKeySpec("siliconflowcn"),
-  nanogpt: genericApiKeySpec("nanogpt"),
-  baseten: genericApiKeySpec("baseten"),
-  synthetic: genericApiKeySpec("synthetic"),
-  stepfun: genericApiKeySpec("stepfun"),
-  sakana: genericApiKeySpec("sakana"),
-  helmcode: genericApiKeySpec("helmcode"),
-  coralbricks: genericApiKeySpec("coralbricks"),
-  aiand: genericApiKeySpec("aiand"),
-  wafer: genericApiKeySpec("wafer"),
-  coreweave: genericApiKeySpec("coreweave"),
-  dashscope: genericApiKeySpec("dashscope"),
-  "qwen-portal": genericApiKeySpec("qwen-portal"),
-} satisfies Readonly<Record<GenericApiKeyProviderId, ApiKeyProviderSpec>>;
+export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = Object.keys(
+  VERSIONED_ROOT_API_KEY_SPECS,
+) as readonly VersionedRootApiKeyProviderId[];

package/src/providers/default-registry.ts

@@ -5,7 +5,7 @@
 import {
   GENERIC_API_KEY_SPECS,
 } from "./configured-openai-providers";
-import { createDiscoveryBackedProviderCapabilities } from "./bundled-discovery-providers";
+import { createDiscoveryBackedProviderCapabilities, discoveryBackedCapabilities } from "./bundled-discovery-providers";
 import { createApiKeyAdapter } from "./configured-provider";
 import type { ApiKeyProviderSpec } from "./configured-provider";
 import { oauthCapability, quotaCapability, type ProviderModuleCapabilities } from "./provider-capabilities";
@@ -131,39 +131,6 @@ function qoderDiscovery(
 }
 
 
-/**
- * Builds the `loadAdapter` + `loadModelDiscovery` pair every plain bearer
- * provider needs.
- *
- * Only the base URL differs between them, so both halves are shared: the
- * adapter is the generic spec and the discovery call is a bearer
- * `GET {base}/models`. Keeping them in one function is what stops the pairing
- * from drifting — registering a provider with one half and not the other is
- * exactly how `gmi`, `nvidia`, and `fireworks` came to ship with no catalog
- * *and* no discovery, which is a provider that lists zero models with no way to
- * fetch any. `test/providers/generic-provider-completeness.test.ts` holds both.
- */
-function discoveryBacked(
-  providerId: string,
-  spec: ApiKeyProviderSpec,
-): ProviderModuleCapabilities {
-  return {
-    // The registry map is what discovery and probing read
-    // (`discoveryPathsFor`), while the spec's copy is what the adapter
-    // dispatches on. Setting only the spec leaves a discovered model resolving
-    // its wire from the generic default instead of the path the adapter will
-    // actually call, which is how a probe verifies one endpoint while dispatch
-    // hits another.
-    ...(spec.endpoint_paths_by_wire_family === undefined
-      ? {}
-      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
-    loadAdapter: async () => createApiKeyAdapter(spec),
-    loadModelDiscovery: openAIModelDiscovery(providerId, {
-      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
-    }),
-  };
-}
-
 function openAIModelDiscovery(
   providerId: string,
   options?: {
@@ -617,6 +584,27 @@ export const PROVIDER_CAPABILITIES = {
     // and Z.AI publishes no refresh grant for it (`refresh "none"` upstream).
     loadAuthentication: oauthCapability(() => import("./integrations/zcode/oauth"), "zcodeOAuthClient"),
   },
+  "zcode-start": {
+    // Free plan surface: an Anthropic-Messages endpoint that only accepts the
+    // dressed ZCode client request (see the integration). The credential is a
+    // ZCode login JWT — pasted, or minted by the sign-in flow below.
+    loadAdapter: async () =>
+      createApiKeyAdapter(
+        (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_SPEC,
+      ),
+    loadModels: async () =>
+      (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_MODELS,
+    // The device flow stores the issued ZCode login JWT, not a Coding Plan key.
+    loadAuthentication: oauthCapability(
+      () => import("./integrations/zcode-start-plan/oauth"),
+      "zcodeStartPlanOAuthClient",
+    ),
+    // Keep each reported entitlement and activation/reset window separate.
+    loadQuotaCollector: quotaCapability(
+      () => import("./integrations/zcode-start-plan/quota"),
+      "fetchZcodeStartPlanQuota",
+    ),
+  },
   "factory": {
     loadAdapter: async () => (await import("./integrations/factory/factory")).factoryAdapter,
     // Factory publishes no model-listing endpoint — the roster is a client-side
@@ -765,7 +753,7 @@ export const PROVIDER_CAPABILITIES = {
   // synced account sees whatever the plan currently serves. The catalog keeps
   // the provider usable before anyone syncs.
   dashscope: {
-    ...discoveryBacked("dashscope", GENERIC_API_KEY_SPECS.dashscope),
+    ...discoveryBackedCapabilities("dashscope", GENERIC_API_KEY_SPECS.dashscope, openAIModelDiscovery),
     loadModels: async () => (await import("./integrations/dashscope-models")).DASHSCOPE_MODELS,
   },
 

package/src/providers/discovery/catalog/catalog-format.ts

@@ -420,13 +420,24 @@ export class PackedCatalog {
     return metadata;
   }
 
-  /** Stated context limit, or `null`. */
+  /**
+   * Stated context limit, or `null`.
+   *
+   * Stored in a `Uint32Array` column; the generator
+   * (`scripts/tools/generate-models.ts`) refuses to write a value ≥ 2^31
+   * (`checkedPackedLimit`), so no row here can wrap modulo 2^32 and decode as a
+   * garbage limit.
+   */
   rowContext(index: number): number | null {
     const value = this.u32At(this.layout.ctx + index * 4);
     return value > 0 ? value : null;
   }
 
-  /** Stated output limit, or `null`. */
+  /**
+   * Stated output limit, or `null`.
+   *
+   * Same u32 storage contract as `rowContext` — see the generator guard.
+   */
   rowOutput(index: number): number | null {
     const value = this.u32At(this.layout.out + index * 4);
     return value > 0 ? value : null;

package/src/providers/discovery/discovery-types.ts

@@ -1,7 +1,6 @@
 import type { FetchLike } from "../quota/quota-contracts";
 import type { ModelDefinition } from "../provider-model-definition";
 import type { ServiceKind } from "../../protocol/canonical-model";
-
 /**
  * Credential-scoped model-discovery input.
  *

package/src/providers/discovery/openai-model-discovery.ts

@@ -3,6 +3,7 @@ import { isRecord } from "../../protocol/codecs";
 import { boundedUpstreamArray, boundedUpstreamNumber, sanitizeUpstreamLabel } from "../provider-sanitize";
 import { modelsDevCatalog } from "./models-dev-catalog";
 import { isResponsesNativeModelId } from "../provider-model-definition";
+import { composeAbortSignal } from "../authentication/oauth-flow-store";
 interface FetchModelsOptions {
   readonly baseUrl: string;
   /**
@@ -27,8 +28,7 @@ export async function fetchOpenAICompatibleModels(
 ): Promise<readonly ModelDefinition[] | null> {
   const fetcher = options.fetcher ?? fetch;
   const url = `${options.baseUrl.replace(/\/+$/, "")}/models`;
-  const timeoutSignal = AbortSignal.timeout(10_000);
-  const signal = options.signal === undefined ? timeoutSignal : AbortSignal.any([options.signal, timeoutSignal]);
+  const signal = composeAbortSignal(options.signal, 10_000);
   try {
     const response = await fetcher(url, {
       headers: {

package/src/providers/discovery/probe-phases.ts

@@ -74,8 +74,24 @@ export function wireContextFrom(
   };
 }
 
-/** Grok's account feature probe intentionally uses the same Responses request as live traffic. */
-export const GROK_407_PROBE_PROMPT = "reply my message with exact number 407";
+/**
+ * Grok's account feature probe intentionally uses the same Responses request as
+ * live traffic.
+ *
+ * The prompt must make the model actually reply `407` — that literal is the
+ * healthy-account signal the probe verdict keys on. Naive phrasing refused by
+ * the model ("I can't reply with only a specific number", "I won't comply
+ * with a demand to output only an exact phrase") are listed above; verified
+ * live 2026-11-02 (grok-4.7) that this prompt returns exactly `407`:
+ *
+ *   "Type the number 407."      → "407"
+ *   "Echo the diagnostic code 407." → "407"
+ *   "Print the number 407 and nothing else." → "407"
+ *
+ * The verdict normalizes away Grok's trailing confidence annotation
+ * (`407 \confidence{100}`), so the match is on the bare number.
+ */
+export const GROK_407_PROBE_PROMPT = "Type the number 407.";
 
 /**
  * Converts a failed/mismatched Grok feature probe into a quota-shaped upstream
@@ -91,8 +107,10 @@ export function grok407ProbeFailure(args: {
   if (args.providerId !== "grok" || args.prompt !== GROK_407_PROBE_PROMPT) return undefined;
   const sample = extractSample(args.events);
   const normalizedSample = sample?.replace(/\\confidence\{\d+\}\s*$/i, "").trim();
-  // A valid Grok answer may carry the provider's confidence annotation after
-  // the numeric result, and a terminal metadata error may arrive after text.
+  // A healthy account answers exactly `407` (optionally with Grok's trailing
+  // confidence annotation). The model refuses some phrasings of the same ask,
+  // but the probe prompt above is engineered to pass, so any other sample is a
+  // failure — quota-shaped, not a payload bug.
   if (normalizedSample === "407") return undefined;
   const priorDetails = args.dispatchError instanceof GatewayError ? args.dispatchError.details : {};
   const providerStatus =
@@ -348,6 +366,30 @@ export type ProbeAccountSelection =
   | { readonly ok: true; readonly accountId: string | undefined }
   | { readonly ok: false; readonly error: string };
 
+/**
+ * Selects the first usable account row: status ≠ disabled, cooldown elapsed
+ * (unless `allowCoolingAccount`), preferring a tenant-owned account over a
+ * shared global one. Shared by the discovery and probing paths so both
+ * agree on which account a provider answers as.
+ */
+export function selectUsableAccount<T extends {
+  readonly tenantId: string | null;
+  readonly status: string;
+  readonly cooldownUntil: Date | null;
+}>(
+  rows: readonly T[],
+  allowCoolingAccount = false,
+  now = Date.now(),
+): T | undefined {
+  return rows
+    .filter(
+      (row) =>
+        row.status !== "disabled" &&
+        (allowCoolingAccount || row.cooldownUntil === null || row.cooldownUntil.getTime() <= now),
+    )
+    .sort((left, right) => Number(right.tenantId !== null) - Number(left.tenantId !== null))[0];
+}
+
 /**
  * Phase 2 — pick the account the probe runs as. Snapshot-equivalent health
  * filtering: disabled accounts and live cooldowns never route, so probes must
@@ -388,15 +430,8 @@ export async function selectProbeAccount(args: {
           ),
         )
     : [];
-  const now = Date.now();
-  const usableAccounts = accountRows
-    .filter(
-      (row) =>
-        row.status !== "disabled" &&
-        (allowCoolingAccount || row.cooldownUntil === null || row.cooldownUntil.getTime() <= now),
-    )
-    .sort((left, right) => Number(right.tenantId !== null) - Number(left.tenantId !== null));
-  const accountId = requestedAccountId ?? usableAccounts[0]?.id;
+  const usableAccount = selectUsableAccount(accountRows, allowCoolingAccount);
+  const accountId = requestedAccountId ?? usableAccount?.id;
   if (!accountId && requiresAccount) {
     return {
       ok: false,

package/src/providers/discovery/probing-service.ts

@@ -50,6 +50,7 @@ import {
   resolveProbeAdapter,
   resolveProbeTarget,
   selectProbeAccount,
+  selectUsableAccount,
   wireContextFrom,
   type ProbeProviderRow,
 } from "./probe-phases";
@@ -915,6 +916,9 @@ export class ProviderProbingService {
         source: discDef?.freeTier === true ? "auto_free" : "discovered",
         sourceUpdatedAt,
         enabled: true,
+        ...(discDef?.dialect === undefined && knownDefinition?.dialect === undefined
+          ? {}
+          : { dialect: discDef?.dialect ?? knownDefinition?.dialect }),
       });
     }
     // One statement per chunk (500, the account-health batch step) instead of
@@ -936,6 +940,7 @@ export class ProviderProbingService {
             cost: sql`excluded.cost`,
             proOnly: sql`excluded.pro_only`,
             freeTier: sql`excluded.free_tier`,
+            dialect: sql`excluded.dialect`,
             // The proposed row's own source, not a constant: a free-tier
             // discovery and an ordinary one write the same upsert, and pinning
             // this to `discovered` would relabel every free-tier row on the
@@ -1000,14 +1005,7 @@ export class ProviderProbingService {
           globalOrOwnedBy(providerAccounts.tenantId, tenantId),
         ),
       );
-    const now = Date.now();
-    const usable = rows
-      .filter(
-        (row) =>
-          row.status !== "disabled" &&
-          (row.cooldownUntil === null || row.cooldownUntil.getTime() <= now),
-      )
-      .sort((left, right) => Number(right.tenantId !== null) - Number(left.tenantId !== null))[0];
+    const usable = selectUsableAccount(rows);
     if (!usable?.credentialCiphertext) return undefined;
     const authState = isRecord(usable.authState) ? usable.authState as Readonly<Record<string, unknown>> : undefined;
     return {

package/src/providers/integrations/agentrouter/agentrouter.ts

@@ -16,9 +16,19 @@ import { readCredentialSecret, assertWireFamily, type ProviderDispatchTarget, ty
 import { providerBaseUrl } from "../../provider-metadata";
 import { buildClaudeMessagesRequest } from "../shared/claude-messages";
 import { sendClaudeMessagesRequest } from "../../../protocol/upstream/send-claude-messages";
+import { ANTHROPIC_BETA_CAPABILITIES } from "../claude/claude-betas";
 
 export const AGENTROUTER_PROVIDER_ID = "agentrouter" as const;
-export const AGENTROUTER_BASE_URL = `${providerBaseUrl("agentrouter")}/v1/messages?beta=true`;
+const AGENTROUTER_BASE_URL = `${providerBaseUrl("agentrouter")}/v1/messages?beta=true`;
+
+/** The CLI beta set, typed against the canonical Anthropic beta vocabulary. */
+const AGENTROUTER_ANTHROPIC_BETAS: ReadonlyArray<
+  keyof typeof ANTHROPIC_BETA_CAPABILITIES
+> = [
+  "claude-code-20250219",
+  "interleaved-thinking-2025-05-14",
+  "effort-2025-11-24",
+];
 
 /**
  * The AgentRouter CLI fingerprint headers. Every value is part of the
@@ -29,7 +39,7 @@ export const AGENTROUTER_BASE_URL = `${providerBaseUrl("agentrouter")}/v1/messag
  */
 function agentRouterFingerprintHeaders(stream: boolean): Record<string, string> {
   return {
-    "anthropic-beta": "claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24",
+    "anthropic-beta": AGENTROUTER_ANTHROPIC_BETAS.join(","),
     "anthropic-dangerous-direct-browser-access": "true",
     "x-app": "cli",
     "user-agent": "claude-cli/2.1.195 (external, sdk-cli)",

package/src/providers/integrations/antigravity/antigravity-oauth.ts

@@ -212,4 +212,3 @@ export class AntigravityOAuthClient extends OAuthClient {
 }
 
 export const antigravityOAuthClient = new AntigravityOAuthClient();
-export { exchangeCodeForToken };

package/src/providers/integrations/antigravity/antigravity-protocol.ts

@@ -257,8 +257,6 @@ export function normalizeAntigravityToolSchemas(request: CanonicalRequest): Cano
 const lastGoodEndpoints = new Map<string, string>();
 const LAST_GOOD_ENDPOINT_MAX = 256;
 
-const DEFAULT_ORDER_INDEX = Number.MAX_SAFE_INTEGER;
-
 /**
  * Records the endpoint that just served a successful turn. Call this with the
  * `endpoint` reported by empty-stream recovery (or the URL that produced a
@@ -301,18 +299,6 @@ export function orderAntigravityEndpoints(
   return [sticky, ...endpoints.slice(0, index), ...endpoints.slice(index + 1)];
 }
 
-/**
- * Position of `endpoint` in the caller's own endpoint order, used to log a
- * failover without the caller re-deriving the list.
- */
-export function antigravityEndpointOrderIndex(
-  endpoints: readonly string[],
-  endpoint: string,
-): number {
-  const index = endpoints.indexOf(endpoint);
-  return index < 0 ? DEFAULT_ORDER_INDEX : index;
-}
-
 // Model discovery (`v1internal:fetchAvailableModels`) — live catalog.
 
 const ANTIGRAVITY_DISCOVERY_PATH = "/v1internal:fetchAvailableModels";

package/src/providers/integrations/antigravity/antigravity.ts

@@ -758,7 +758,7 @@ export class AntigravitySessionStore {
  * `"-" + (sha256(first-user-text)[0:8] & INT63 | random <9e18)`.
  * A positive or hyphenated-UUID value here is a one-glance synthetic signal.
  */
-export function signedAntigravitySessionId(seed?: string): string {
+function signedAntigravitySessionId(seed?: string): string {
   if (seed !== undefined && /^-?\d+$/.test(seed)) return seed;
   const text = seed !== undefined && seed.length > 0 ? seed : randomUUID();
   const head = BigInt(`0x${createHash("sha256").update(text).digest("hex").slice(0, 8)}`);
@@ -769,7 +769,7 @@ export function signedAntigravitySessionId(seed?: string): string {
 }
 
 /** Thinking budget per wire model, matching the client's effort tiers. */
-export function antigravityThinkingBudget(modelId: string): number | undefined {
+function antigravityThinkingBudget(modelId: string): number | undefined {
   if (!modelId.includes("claude") && !modelId.includes("gemini-3")) return undefined;
   if (modelId.endsWith("-low")) return 1_000;
   if (modelId.endsWith("-medium")) return 4_000;

package/src/providers/integrations/buddy/buddy-catalog-shared.ts

@@ -160,7 +160,7 @@ export function makeBuddyCnImageModels(
  * plan rather than about the model. A pro account serves all six. The pill is
  * therefore a hint about a free account, and a dispatch is what settles it.
  *
- * @see `.skills/cartethyia-reverse-engineering/references/codebuddy-dispatch-headers.md`
+ * @see `documentation/research/codebuddy/2026-10-19-codebuddy-chat-dispatch-headers.md`
  */
 export const BUDDY_PRO_ONLY_MODEL_IDS: ReadonlySet<string> = new Set([
   "primary-model",