cartethyia 2.7.4 → 2.7.5

package/src/providers/integrations/cursor/cursor-request.ts

@@ -303,17 +303,6 @@ export function buildHeartbeat(): Uint8Array {
   return encodeMessage("AgentClientMessage", { client_heartbeat: {} });
 }
 
-/**
- * `ACM#5 exec_client_control_message.heartbeat{id}`: Cursor CLI sends one every
- * few seconds for each exec it is still running. A zero id is left out, as
- * proto3 does for a default scalar.
- */
-export function buildExecHeartbeat(execId: number): Uint8Array {
-  return encodeMessage("AgentClientMessage", {
-    exec_client_control_message: { heartbeat: execId === 0 ? {} : { id: execId } },
-  });
-}
-
 /** `ACM#5 exec_client_control_message.stream_close{id}` after an exec result. */
 export function buildExecStreamClose(execId: number, execIdString?: string): Uint8Array {
   return encodeMessage("AgentClientMessage", {
@@ -424,82 +413,6 @@ export function buildMcpResult(input: {
   });
 }
 
-/**
- * `ACM#2 exec_client_message{shell_result|write_result|read_result}` for a host
- * exec the canonical client executed locally.
- *
- * Cursor's executor replies to its own host requests with the variant's typed
- * result frame (the generic `mcp_result` leaves the server unmatched on a frame
- * it did rank), and after every exec result it sends `stream_close` — without
- * it the cloud waits forever on shell execs. `is_error` keeps the failure as
- * the variant's error/failure case rather than a crafted success.
- */
-export type CursorHostExecResultVariant = "shell" | "write" | "read";
-
-export function buildHostExecResult(input: {
-  readonly execId: number;
-  readonly execIdString?: string;
-  readonly variant: CursorHostExecResultVariant;
-  readonly text: string;
-  readonly isError: boolean;
-  readonly host: {
-    readonly command?: string;
-    readonly workingDirectory?: string;
-    readonly path?: string;
-    readonly lines?: number;
-    readonly fileSize?: number;
-  };
-}): Uint8Array[] {
-  const id = { id: input.execId, exec_id: input.execIdString ?? "" };
-  const variant = input.variant;
-  const text = input.text;
-  let result: Record<string, unknown>;
-  if (variant === "shell") {
-    result = {
-      shell_result: input.isError
-        ? { failure: { command: input.host.command ?? "", exit_code: 1, stderr: text } }
-        : {
-            success: {
-              command: input.host.command ?? "",
-              exit_code: 0,
-              stdout: text,
-              ...(input.host.workingDirectory === undefined ? {} : { working_directory: input.host.workingDirectory }),
-            },
-          },
-    };
-  } else if (variant === "write") {
-    result = {
-      write_result: input.isError
-        ? { error: { path: input.host.path ?? "", error: text } }
-        : {
-            success: {
-              path: input.host.path ?? "",
-              lines_created: input.host.lines ?? 0,
-              file_size: input.host.fileSize ?? 0,
-            },
-          },
-    };
-  } else {
-    result = {
-      read_result: input.isError
-        ? { error: { path: input.host.path ?? "", error: text } }
-        : {
-            success: {
-              path: input.host.path ?? "",
-              content: text,
-              total_lines: text.length > 0 ? text.split("\n").length : 0,
-            },
-          },
-    };
-  }
-  return [
-    encodeMessage("AgentClientMessage", { exec_client_message: { ...id, ...result } }),
-    // The real CLI pairs every typed exec result with stream_close — the cloud
-    // waits on it for shell execs specifically.
-    buildExecStreamClose(input.execId, input.execIdString),
-  ];
-}
-
 /**
  * `ACM#2 exec_client_message{mcp_result}` rejecting a tool the client never
  * declared.

package/src/providers/integrations/cursor/cursor-shared.ts

@@ -5,7 +5,6 @@
 // protocol was verified against: they are declared once so the auth flow, the
 // unary catalog calls, and the Run stream cannot drift apart on host, path, or
 // client id.
-import type { WireFamily } from "../../../protocol/canonical-model";
 
 /** Canonical bundled provider id. */
 export const CURSOR_PROVIDER_ID = "cursor";
@@ -72,9 +71,6 @@ export const SESSION_REFRESH_TIMEOUT_MS = 20_000;
  */
 export const RUN_IDLE_TTL_MS = 10 * 60_000;
 
-/** Chat wire is the declared default; the adapter owns the native protocol. */
-export const CURSOR_WIRE_FAMILY: WireFamily = "chat";
-
 /**
  * Any HTTPS subdomain of `cursor.sh` is an acceptable Run host: the region
  * Cursor routes an account to varies (`agentn.*`, `agent.*`, `api5`, …).

package/src/providers/integrations/cursor/cursor.ts

@@ -27,6 +27,7 @@ import type {
 } from "../../../protocol/canonical-model";
 import { resolveImageSource, splitDataUrl } from "../../../protocol/codecs";
 import { IMAGE_CLAMP_MAX_BYTES } from "../../../protocol/image-clamp";
+import { applyCacheMode } from "../../provider-usage";
 import type { ProviderAdapter, ProviderDispatchContext, ProviderDispatchTarget } from "../../provider-contracts";
 import { readCredentialSecret } from "../../provider-contracts";
 import type { Http2BidiEndReason, ValidatedHttp2BidiStream } from "../../../network/http2-bidi";
@@ -62,6 +63,7 @@ import { defaultParameterValues, fetchCursorModels } from "./cursor-catalog";
 import type { CursorModelInfo } from "./cursor-catalog";
 import { decodeValueToJson, decodeStructEntriesToJson } from "./protocol/struct";
 import { cursorVariantForExecArgs } from "./protocol/tool-canonical";
+import { fnv1a32 } from "../shared/hash";
 
 /**
  * Client-heartbeat cadence for every Cursor Run.
@@ -81,8 +83,38 @@ const CURSOR_HEARTBEAT_INTERVAL_MS = 5_000;
  * every dispatch.
  */
 const CURSOR_ROSTER_TTL_MS = 300_000;
-/** credential → { roster, fetchedAt } for the parameter lookup. */
+/**
+ * credential → { roster, fetchedAt } for the parameter lookup.
+ *
+ * Keyed by an FNV-1a digest of the credential rather than the raw token so a
+ * long-lived map does not hold live credentials as keys. Bounded by
+ * `ROSTER_CACHE_MAX` with oldest-first eviction: the TTL is only checked on
+ * read, so without a cap rotated tokens would grow the map without bound.
+ */
+const ROSTER_CACHE_MAX = 1024;
 const rosterCache = new Map<string, { roster: readonly CursorModelInfo[]; fetchedAt: number }>();
+
+function rosterCacheSet(credential: string, roster: readonly CursorModelInfo[]): void {
+  const key = String(fnv1a32(credential));
+  rosterCache.delete(key); // re-set moves the entry to newest position
+  rosterCache.set(key, { roster, fetchedAt: Date.now() });
+  while (rosterCache.size > ROSTER_CACHE_MAX) {
+    const oldest = rosterCache.keys().next().value;
+    if (oldest === undefined) break;
+    rosterCache.delete(oldest);
+  }
+}
+
+/**
+ * Test-only access to the roster cache (cap/eviction/TTL behavior is covered
+ * by `test/providers/cursor-roster-cache.test.ts` without a full dispatch).
+ */
+export const rosterCacheForTests = {
+  size: (): number => rosterCache.size,
+  set: rosterCacheSet,
+  get: (credential: string): { roster: readonly CursorModelInfo[]; fetchedAt: number } | undefined =>
+    rosterCache.get(String(fnv1a32(credential))),
+};
 /** Client-heartbeat cadence the Cursor edge expects (donor `heartbeatMs`). */
 const CURSOR_HEARTBEAT_INTERVAL_OVERRIDE = (() => {
   const raw = process.env.CARTETHYIA_CURSOR_HEARTBEAT_MS?.trim();
@@ -249,7 +281,7 @@ function usageFromTurnEnded(turnEnded: Record<string, unknown>): UsageRecord {
   const input = count(turnEnded["input_tokens"]);
   const output = count(turnEnded["output_tokens"]);
   const cacheRead = count(turnEnded["cache_read"]);
-  return {
+  return applyCacheMode({
     input_tokens: input,
     cached_input_tokens: cacheRead,
     cache_write_tokens: count(turnEnded["cache_write"]),
@@ -258,7 +290,7 @@ function usageFromTurnEnded(turnEnded: Record<string, unknown>): UsageRecord {
     reasoning_tokens: count(turnEnded["reasoning_tokens"]),
     estimated_cost: null,
     total_tokens: input + output,
-  };
+  });
 }
 
 function nonEmptyStringOf(value: unknown): string | undefined {
@@ -846,7 +878,8 @@ class CursorAdapter implements ProviderAdapter {
     credential: string,
     context: ProviderDispatchContext,
   ): Promise<readonly CursorModelInfo[]> {
-    const cached = rosterCache.get(credential);
+    const key = String(fnv1a32(credential));
+    const cached = rosterCache.get(key);
     if (cached !== undefined && Date.now() - cached.fetchedAt < CURSOR_ROSTER_TTL_MS) {
       return cached.roster;
     }
@@ -858,7 +891,7 @@ class CursorAdapter implements ProviderAdapter {
           : { fetcher: context.outbound_fetch as unknown as typeof fetch }),
         signal: context.abort_signal,
       });
-      rosterCache.set(credential, { roster, fetchedAt: Date.now() });
+      rosterCacheSet(credential, roster);
       return roster;
     } catch {
       return cached?.roster ?? [];

package/src/providers/integrations/cursor/protocol/framing.ts

@@ -71,59 +71,3 @@ export function* streamFrames(buffer: Uint8Array): Generator<Frame, void, void>
     offset = start + len
   }
 }
-
-export async function* asyncStreamFrames(
-  stream: ReadableStream<Uint8Array>,
-): AsyncGenerator<Frame, void, void> {
-  const reader = stream.getReader()
-  const chunks: Uint8Array[] = []
-  let pendingLength = 0
-
-  try {
-    while (true) {
-      const { done, value } = await reader.read()
-      if (done && chunks.length === 0) return
-      if (value) {
-        chunks.push(value)
-        pendingLength += value.length
-      }
-
-      // Try to parse frames from accumulated data
-      const merged = mergeChunks(chunks)
-      const frames = Array.from(streamFrames(merged))
-      const consumed = frames.reduce((sum, f) => sum + 5 + f.payload.length, 0)
-
-      if (frames.length > 0) {
-        for (const frame of frames) {
-          yield frame
-        }
-        // Keep any trailing bytes for next iteration
-        const remaining = merged.subarray(consumed)
-        chunks.length = 0
-        if (remaining.length > 0) {
-          chunks.push(remaining)
-          pendingLength = remaining.length
-        } else {
-          pendingLength = 0
-        }
-      }
-
-      if (done) return
-    }
-  } finally {
-    reader.releaseLock()
-  }
-}
-
-function mergeChunks(chunks: Uint8Array[]): Uint8Array {
-  const first = chunks[0]
-  if (chunks.length === 1 && first !== undefined) return first
-  const total = chunks.reduce((s, c) => s + c.length, 0)
-  const merged = new Uint8Array(total)
-  let offset = 0
-  for (const c of chunks) {
-    merged.set(c, offset)
-    offset += c.length
-  }
-  return merged
-}

package/src/providers/integrations/cursor/protocol/messages.ts

@@ -2282,99 +2282,3 @@ export function decodeMessage<T = Record<string, unknown>>(
   const decoded = type.decode(data)
   return type.toObject(decoded, { defaults: true, json: true, longs: Number }) as T
 }
-
-/** Decode without inventing absent proto defaults (used for byte-stable snapshots). */
-export function decodeMessageSparse<T = Record<string, unknown>>(
-  typeName: string,
-  data: Uint8Array,
-): T {
-  const root = getMessageTypes()
-  const type = root.lookupType(typeName)
-  const decoded = type.decode(data)
-  return type.toObject(decoded, { json: true, longs: Number }) as T
-}
-
-type RawField = {
-  field: number
-  wireType: number
-  varint?: string
-  fixed?: number | string
-  bytes?: Uint8Array
-}
-
-/** Schema-free walk of one message's top-level wire fields (no nested descent). */
-function readRawFields(buf: Uint8Array): RawField[] {
-  const reader = protobuf.Reader.create(buf)
-  const fields: RawField[] = []
-  while (reader.pos < reader.len) {
-    const tag = reader.uint32()
-    const field = tag >>> 3
-    const wireType = tag & 7
-    switch (wireType) {
-      case 0:
-        fields.push({ field, wireType, varint: reader.uint64().toString() })
-        break
-      case 1:
-        fields.push({ field, wireType, fixed: reader.fixed64().toString() })
-        break
-      case 2:
-        fields.push({ field, wireType, bytes: reader.bytes() })
-        break
-      case 5:
-        fields.push({ field, wireType, fixed: reader.fixed32() })
-        break
-      default:
-        // Groups (3/4) aren't used on this wire; bail rather than desync the reader.
-        return fields
-    }
-  }
-  return fields
-}
-
-/**
- * Diagnostic-only: walk AgentServerMessage.interaction_update(1).turn_ended(14)
- * without going through our hand-written TurnEnded schema, so a `cache_write`/
- * `reasoning_tokens` question can be checked against the raw wire instead of
- * guessed. Confirmed field ids 1-5 (input/output/cache_read/cache_write/
- * reasoning) decode correctly. Live captures routinely include `f4` explicitly
- * as `0` while `f3` (cache_read) and `f5` (reasoning) are non-zero — Cursor's
- * agent TurnEnded populates the field but does not report write counts here.
- */
-export function debugWalkTurnEnded(payload: Uint8Array): string {
-  try {
-    const top = readRawFields(payload)
-    const iuField = top.find((f) => f.field === 1 && f.wireType === 2)
-    if (!iuField?.bytes) return "(no interaction_update field)"
-    const iu = readRawFields(iuField.bytes)
-    const teField = iu.find((f) => f.field === 14 && f.wireType === 2)
-    if (!teField?.bytes) return "(no turn_ended field in interaction_update)"
-    const te = readRawFields(teField.bytes)
-    return te
-      .map(
-        (f) =>
-          `f${f.field}:wt${f.wireType}=${f.varint ?? f.fixed ?? (f.bytes ? `bytes[${f.bytes.length}]` : "?")}`,
-      )
-      .join(" ")
-  } catch (e) {
-    return `(walk failed: ${(e as Error).message})`
-  }
-}
-
-/**
- * Decode a protobuf sub-message from a frame payload that wraps it in
- * a top-level field key + length varint.  Skips the outer wrapper and
- * decodes the inner body as `typeName`.
- */
-export function decodeWrappedMessage<T = Record<string, unknown>>(
-  typeName: string,
-  data: Uint8Array,
-): T {
-  let offset = 1 // skip field key
-  // skip varint length
-  while (offset < data.length) {
-    const b = data[offset] ?? 0
-    offset++
-    if (!(b & 0x80)) break
-  }
-  return decodeMessage<T>(typeName, data.subarray(offset))
-}

package/src/providers/integrations/factory/factory.ts

@@ -106,7 +106,7 @@ function factoryClientHeaders(orgId: string): Record<string, string> {
  * (`packages/ai/src/providers/factory-droid.ts:271` — `"x-api-provider":
  * input.upstream`), so a value outside it has no meaning on this wire.
  */
-export const FACTORY_DROID_UPSTREAMS = [
+const FACTORY_DROID_UPSTREAMS = [
   "fireworks",
   "baseten",
   "mistral",
@@ -123,7 +123,7 @@ export const FACTORY_DROID_UPSTREAMS = [
   "databricks",
 ] as const;
 
-export type FactoryDroidUpstream = (typeof FACTORY_DROID_UPSTREAMS)[number];
+type FactoryDroidUpstream = (typeof FACTORY_DROID_UPSTREAMS)[number];
 
 const FACTORY_DROID_UPSTREAM_SET: ReadonlySet<string> = new Set(FACTORY_DROID_UPSTREAMS);
 
@@ -154,7 +154,7 @@ function logDroppedUpstream(reason: string, value: string): void {
  * unmapped failure. Omitting falls back to Factory's default routing, which is
  * the behavior a request that names no upstream already gets.
  */
-export function factoryApiProviderHeader(
+function factoryApiProviderHeader(
   options: Readonly<Record<string, unknown>> | undefined,
 ): Record<string, string> {
   const value = options?.["factory_api_provider"];
@@ -179,7 +179,7 @@ export function factoryApiProviderHeader(
  * `/api/cli/whoami` reported. An account with no recorded residency is the
  * global host, which is Factory's default.
  */
-export function factoryBaseUrl(context: ProviderDispatchContext): string {
+function factoryBaseUrl(context: ProviderDispatchContext): string {
   const region = context.credential.auth_state?.["region"];
   return region === "eu" ? FACTORY_DROID_EU_BASE_URL : FACTORY_DROID_BASE_URL;
 }
@@ -200,7 +200,7 @@ export function factoryBaseUrl(context: ProviderDispatchContext): string {
  * operator wrote into `auth_state`. The two-axis read is kept because the donor
  * needs it, not because we currently populate the second axis.
  */
-export function factoryInferenceRegion(
+function factoryInferenceRegion(
   context: ProviderDispatchContext,
 ): "global" | "us" | "eu" {
   const state = context.credential.auth_state;
@@ -266,7 +266,7 @@ const REGION_UPSTREAMS: Readonly<Record<"global" | "us" | "eu", readonly Factory
  * is, which is a property of the route rather than of the request. The donor's
  * own message text is preserved as the `reason` so the mapping is traceable.
  */
-export function factoryRegionUnavailable(modelId: string, region: string): GatewayError {
+function factoryRegionUnavailable(modelId: string, region: string): GatewayError {
   return new GatewayError(
     "capability_unsupported",
     400,
@@ -294,7 +294,7 @@ export function factoryRegionUnavailable(modelId: string, region: string): Gatew
  * Sending `configured_order` without that discovery would claim a rotation we
  * never resolved.
  */
-export function factoryRoutingSourceHeader(request: CanonicalRequest): Record<string, string> {
+function factoryRoutingSourceHeader(request: CanonicalRequest): Record<string, string> {
   const continuing = request.messages.some((message) => message.role === "assistant");
   return { "x-provider-routing-source": continuing ? "session_lock" : "registry_default" };
 }
@@ -313,7 +313,7 @@ export function factoryRoutingSourceHeader(request: CanonicalRequest): Record<st
  * donor's own region-unavailable error rather than an upstream 4xx this layer
  * cannot explain.
  */
-export function factoryRegionCheckedApiProviderHeader(
+function factoryRegionCheckedApiProviderHeader(
   request: CanonicalRequest,
   context: ProviderDispatchContext,
 ): Record<string, string> {
@@ -330,7 +330,7 @@ export function factoryRegionCheckedApiProviderHeader(
 }
 
 /** The two routing headers together, as every Factory wire sends them. */
-export function factoryRoutingHeaders(
+function factoryRoutingHeaders(
   request: CanonicalRequest,
   context: ProviderDispatchContext,
 ): Record<string, string> {

package/src/providers/integrations/github/github-discovery.ts

@@ -29,6 +29,7 @@ import {
   GITHUB_PROVIDER_ID,
   GITHUB_ENDPOINT_PATH,
   GITHUB_RESPONSES_ENDPOINT_PATH,
+  GITHUB_MESSAGES_ENDPOINT_PATH,
   GITHUB_AUTO_MODELS,
   recordGithubModelRoutes,
 } from "./github";
@@ -47,12 +48,11 @@ function positiveLimit(value: unknown): number | undefined {
  * The surfaces a row answers on, normalized to the canonical paths this
  * gateway registers.
  *
- * A row that supports neither chat nor responses is skipped rather than
- * defaulted: Copilot also serves a native Anthropic `/v1/messages` surface for
- * some SKUs, and this adapter speaks only the OpenAI wire. Registering such a
- * row as chat would publish a route that fails on first dispatch.
+ * Copilot serves three OpenAI/Anthropic surfaces: `/chat/completions`,
+ * `/responses`, and `/v1/messages`. A row that supports none of them is
+ * skipped rather than defaulted.
  */
-function wireFamilyFor(entry: Record<string, unknown>): "chat" | "responses" | undefined {
+function wireFamilyFor(entry: Record<string, unknown>): "chat" | "responses" | "messages" | undefined {
   const declared = boundedUpstreamArray(entry.supported_endpoints);
   if (!declared) return "chat";
   const endpoints = new Set<string>();
@@ -60,11 +60,12 @@ function wireFamilyFor(entry: Record<string, unknown>): "chat" | "responses" | u
     const label = sanitizeUpstreamLabel(value);
     if (label !== undefined) endpoints.add(label.replace(/^\/v1(?=\/)/, ""));
   }
-  // Chat is preferred when a row supports both: it is the surface every
-  // OpenAI-compatible client already speaks, and the upstream answers it for
-  // the same SKU. Responses is used only when chat is absent.
+  // Chat is preferred when a row supports it: it is the surface every
+  // OpenAI-compatible client already speaks. Responses and Messages are used
+  // only when chat is absent, in that order.
   if (endpoints.has("/chat/completions")) return "chat";
   if (endpoints.has("/responses")) return "responses";
+  if (endpoints.has("/messages")) return "messages";
   return undefined;
 }
 
@@ -75,6 +76,34 @@ function supports(entry: Record<string, unknown>, key: string): boolean {
   return declared?.[key] === true;
 }
 
+/**
+ * Price deltas from the account's `/models` row when it publishes `token_prices`
+ * (dollars per 1M tokens). This is the real per-account price Copilot serves,
+ * which the shared models.dev catalog cannot know; when absent the base-catalog
+ * estimate is used instead.
+ */
+function copilotCost(entry: Record<string, unknown>): ModelDefinition["cost"] {
+  const billing = isRecord(entry.billing) ? entry.billing : undefined;
+  const prices = isRecord(billing?.token_prices) ? billing.token_prices : undefined;
+  const defaultTier = isRecord(prices?.default) ? prices.default : undefined;
+  const input = positiveLimit(defaultTier?.input_price);
+  const output = positiveLimit(defaultTier?.output_price);
+  if (input === undefined && output === undefined) {
+    return modelsDevCatalog.costFor(GITHUB_PROVIDER_ID, String(entry.id ?? ""));
+  }
+  return {
+    input: input ?? null,
+    output: output ?? null,
+    ...(typeof (defaultTier as Record<string, unknown> | undefined)?.cache_read_price === "number"
+      ? { cache_read: (defaultTier as { cache_read_price?: number }).cache_read_price }
+      : {}),
+    ...(typeof (defaultTier as Record<string, unknown> | undefined)?.cache_write_price === "number"
+      ? { cache_write: (defaultTier as { cache_write_price?: number }).cache_write_price }
+      : {}),
+    pricing_model: "pay-per-use",
+  };
+}
+
 function toModelDefinition(entry: Record<string, unknown>): ModelDefinition | undefined {
   const modelId = sanitizeUpstreamLabel(entry.id);
   if (modelId === undefined) return undefined;
@@ -89,16 +118,32 @@ function toModelDefinition(entry: Record<string, unknown>): ModelDefinition | un
   // clamped the same way every other catalog row is.
   const outputLimit = Math.min(declaredOutput, contextLimit);
   const vision = supports(entry, "vision");
+  // `reasoning_effort` is a list (e.g. ["low","medium","high","xhigh","max"])
+  // when the model supports effort levels; absence means the model does not
+  // expose an effort knob. Carrying it lets routing clamp to the model's real
+  // ladder instead of the provider-wide `max→high` cap.
+  const supportsObj = isRecord(capabilities?.supports) ? capabilities.supports : undefined;
+  const reasoningEfforts = Array.isArray(supportsObj?.reasoning_effort)
+    ? (supportsObj.reasoning_effort as unknown[])
+        .filter((level): level is string => typeof level === "string" && level.length > 0)
+    : undefined;
+  const cost = copilotCost(entry);
   return {
     modelId,
     wireFamily,
-    endpointPath: wireFamily === "responses" ? GITHUB_RESPONSES_ENDPOINT_PATH : GITHUB_ENDPOINT_PATH,
+    endpointPath:
+      wireFamily === "responses"
+        ? GITHUB_RESPONSES_ENDPOINT_PATH
+        : wireFamily === "messages"
+          ? GITHUB_MESSAGES_ENDPOINT_PATH
+          : GITHUB_ENDPOINT_PATH,
     contextLimit,
     outputLimit,
     modalities: { input: vision ? ["text", "image"] : ["text"], output: ["text"] },
     reasoning: true,
+    ...(reasoningEfforts === undefined ? {} : { reasoningEfforts }),
     toolCall: true,
-    cost: modelsDevCatalog.costFor(GITHUB_PROVIDER_ID, modelId),
+    cost,
   };
 }
 

package/src/providers/integrations/github/github-oauth.ts

@@ -43,13 +43,14 @@ export const GITHUB_DEFAULT_API_HOST = "api.individual.githubcopilot.com" as con
  * The API rejects a request that does not identify a Copilot client, so these
  * are a protocol requirement rather than cosmetic fingerprinting — unlike the
  * Codex/Claude CLI identities elsewhere in this repository, which exist to look
- * like a first-party client. The version pair is the Copilot Chat extension's,
- * which is what the upstream expects for this client id.
+ * like a first-party client. The version pair is the Copilot Chat extension's
+ * (0.72.0 on VS Code 1.144), which is what the upstream expects for this
+ * client id.
  */
 export const GITHUB_REQUEST_HEADERS: Readonly<Record<string, string>> = Object.freeze({
-  "user-agent": "GitHubCopilotChat/0.70.0",
-  "editor-version": "vscode/1.142.0",
-  "editor-plugin-version": "copilot-chat/0.70.0",
+  "user-agent": "GitHubCopilotChat/0.72.0",
+  "editor-version": "vscode/1.144.0",
+  "editor-plugin-version": "copilot-chat/0.72.0",
   "copilot-integration-id": "vscode-chat",
   "x-github-api-version": "2026-08-01",
 });