cartethyia 2.7.4 → 2.7.6

package/src/providers/integrations/buddy/codebuddy/shared.ts

@@ -3,7 +3,15 @@ import type { CanonicalRequest } from "../../../../protocol/canonical-model";
 import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
 import { resolveInboundSessionId } from "../../../operations/session-resolution";
 import { buddyConversationHeaders } from "../buddy-conversation-headers";
-import { buddyEnterprise, buddyUserId, resolveBuddyDeviceBinding, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buddyAgentPurpose,
+  buddyEnterprise,
+  buddyOAuthIdentityHeaders,
+  buddyPrivateData,
+  buddyUserId,
+  resolveBuddyDeviceBinding,
+  resolveBuddyIdentity,
+} from "../buddy-identity";
 import { buildCodeBuddyUserAgent, getCodeBuddyCnVersion, getCodeBuddyVersion } from "../../../operations/client-versions";
 import { buddyDeviceTokenHeaders } from "../workbuddy/shared";
 import { CODEBUDDY_TURING_CONFIG } from "../turing-device-token";
@@ -40,6 +48,13 @@ export async function codebuddyHeaders(
     ...(conversationId === undefined ? {} : { conversationId }),
   });
   if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
+    const purpose = buddyAgentPurpose(context, request);
+    // Root/parent conversation context is forwarded only when the caller
+    // actually supplied it — the reference emits these conditionally for
+    // subagent/root chains and never invents them.
+    const inbound = context?.request_headers;
+    const rootRequestId = inbound?.["x-root-request-id"]?.trim();
+    const parentConversationId = inbound?.["x-parent-conversation-id"]?.trim();
     return {
       // The CLI sends `Accept: application/json` and no device token. It keeps
       // the request-shape markers (`X-Requested-With`, `X-CodeBuddy-Request`)
@@ -55,19 +70,24 @@ export async function codebuddyHeaders(
       "X-Domain": codebuddyDomain(variant),
       "x-requested-with": "XMLHttpRequest",
       "x-codebuddy-request": "1",
-      // The conversation purpose the reference client states. Not required —
-      // verified against the live API that a request succeeds without it — but
-      // it is part of the client's real request, and matching the client is the
-      // defence against a channel check tightening later.
-      "X-Agent-Purpose": "conversation",
+      ...(purpose === undefined ? {} : { "X-Agent-Purpose": purpose }),
       ...conversation,
+      ...(rootRequestId === undefined ? {} : { "X-Root-Request-ID": rootRequestId }),
+      ...(parentConversationId === undefined
+        ? {}
+        : { "X-Parent-Conversation-ID": parentConversationId }),
       ...buddyCliTraceHeaders(conversation),
+      // The CLI's OAuth identity family: X-User-Id from the JWT sub plus the
+      // base64 X-Userinfo envelope when identity fields exist.
+      ...buddyOAuthIdentityHeaders(context),
       ...buddyCliHeaders({
         userId: buddyUserId(context),
         enterpriseId: buddyEnterprise(context),
+        privateData: buddyPrivateData(context),
       }),
     };
   }
+  const purpose = buddyAgentPurpose(context, request);
   return {
     accept: "text/event-stream",
     "User-Agent": ua,
@@ -81,9 +101,10 @@ export async function codebuddyHeaders(
     "X-Domain": codebuddyDomain(variant),
     "x-requested-with": "XMLHttpRequest",
     "x-codebuddy-request": "1",
-    // Same value the CLI branch sends, for the same reason: part of the
-    // client's real request, harmless when the channel check does not read it.
-    "X-Agent-Purpose": "conversation",
+    // The effective agent purpose, matching the reference's dynamic value.
+    // The reference does not invent `conversation`; it sends the purpose only
+    // when one exists.
+    ...(purpose === undefined ? {} : { "X-Agent-Purpose": purpose }),
     // Same family WorkBuddy sends: the upstream's channel check reads the
     // turn-level aggregation key, and a chat request without it is refused for a
     // missing conversation id.

package/src/providers/integrations/buddy/workbuddy/provider.ts

@@ -56,15 +56,11 @@ export const WORKBUDDY_BASE_URL = providerBaseUrl("workbuddy");
  * channel"`. So this prompt is a wire contract, not merely a product choice —
  * see the sibling in `codebuddy.ts`.
  *
- * The text is WorkBuddy's own leading prompt, matching what the official client
- * (and the donor gateway's `prepend` prompt mode) sends, so a proxied request
- * carries the real client's identity instead of a neutral stand-in. A previous
- * neutral persona was accepted but diverged from every request the official
- * desktop client emits.
+ * The text is deliberately neutral: a simple helpful-assistant persona with no
+ * client/CLI branding, kept minimal so it reads naturally to any model and
+ * does not advertise a channel identity upstream.
  */
-export const WORKBUDDY_SYSTEM_PROMPT =
-  "You are WorkBuddy, a powerful AI assistant.\n\n" +
-  "Your main goal is to follow the USER's instructions at each message, denoted by the <user_query> tag.";
+export const WORKBUDDY_SYSTEM_PROMPT = "You are a helpful assistant.";
 
 /**
  * Reconstructs generic function declarations when a later tool-history turn
@@ -156,7 +152,7 @@ export function workbuddyPrePayload(
 // declared reasoning-effort scale.
 const WORKBUDDY_RAW: readonly BuddyRawEntry[] = BUDDY_SHARED_RAW;
 
-export function makeWorkBuddyModels(providerId: "workbuddy" | "workbuddycn"): readonly ModelDefinition[] {
+function makeWorkBuddyModels(providerId: "workbuddy" | "workbuddycn"): readonly ModelDefinition[] {
   return [
     ...WORKBUDDY_RAW.filter(
       (entry) => !BUDDY_IMAGE_MODEL_ID_SET.has(entry[0]) && !BUDDY_VIDEO_MODEL_ID_SET.has(entry[0]),

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -8,7 +8,15 @@ import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from
 import { resolveInboundSessionId } from "../../../operations/session-resolution";
 import { buddyConversationHeaders } from "../buddy-conversation-headers";
 import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
-import { buddyEnterprise, buddyUserId, resolveBuddyDeviceBinding, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buddyAgentPurpose,
+  buddyEnterprise,
+  buddyOAuthIdentityHeaders,
+  buddyPrivateData,
+  buddyUserId,
+  resolveBuddyDeviceBinding,
+  resolveBuddyIdentity,
+} from "../buddy-identity";
 import {
   buildWorkBuddyUserAgent,
   getWorkBuddyClientVersion,
@@ -86,7 +94,11 @@ export async function workbuddyHeaders(
     messageIdStyle: identity === "desktop" ? "uuid" : "hex",
   });
   const accountId = context?.credential.account_id;
+  const purpose = buddyAgentPurpose(context, request);
   if (identity === "cli") {
+    const inbound = context?.request_headers;
+    const rootRequestId = inbound?.["x-root-request-id"]?.trim();
+    const parentConversationId = inbound?.["x-parent-conversation-id"]?.trim();
     // The reference CLI: issued by the OpenAI Node SDK, so no browser
     // *transport* header (origin/referer/accept-language) and no device token,
     // and the machine/session device pair does not exist — only `X-User-Id`,
@@ -99,17 +111,23 @@ export async function workbuddyHeaders(
       "x-requested-with": "XMLHttpRequest",
       "x-codebuddy-request": "1",
       "x-domain": domain,
-      "x-agent-purpose": "conversation",
+      ...(purpose === undefined ? {} : { "x-agent-purpose": purpose }),
       "x-ide-name": "CLI",
       "x-ide-type": "CLI",
       "x-ide-version": getWorkBuddyCliVersion(),
       "x-product": "SaaS",
       "x-no-enterprise-id": "1",
       ...conversation,
+      ...(rootRequestId === undefined ? {} : { "x-root-request-id": rootRequestId }),
+      ...(parentConversationId === undefined
+        ? {}
+        : { "x-parent-conversation-id": parentConversationId }),
       ...buddyCliTraceHeaders(conversation),
+      ...buddyOAuthIdentityHeaders(context),
       ...buddyCliHeaders({
         userId: buddyUserId(context),
         enterpriseId: buddyEnterprise(context),
+        privateData: buddyPrivateData(context),
       }),
     };
   }
@@ -122,7 +140,7 @@ export async function workbuddyHeaders(
     "x-requested-with": "XMLHttpRequest",
     "x-codebuddy-request": "1",
     "x-domain": domain,
-    "x-agent-purpose": "conversation",
+    ...(purpose === undefined ? {} : { "x-agent-purpose": purpose }),
     "x-ide-name": "WorkBuddy",
     "x-ide-type": "WorkBuddy",
     "x-ide-version": clientVersion,

package/src/providers/integrations/claude/claude-cch.ts

@@ -1,148 +1,148 @@
-import { createHash } from "node:crypto";
-
-const MASK = 0xffffffffffffffffn;
-const PRIME1 = 0x9e3779b185ebca87n;
-const PRIME2 = 0xc2b2ae3d27d4eb4fn;
-const PRIME3 = 0x165667b19e3779f9n;
-const PRIME4 = 0x85ebca77c2b2ae63n;
-const PRIME5 = 0x27d4eb2f165667c5n;
-const CCH_SEED = 0x4d659218e32a3268n;
-const PLACEHOLDER = "cch=00000";
-const encoder = new TextEncoder();
-
-function round(acc: bigint, input: bigint): bigint {
-  let value = (acc + input * PRIME2) & MASK;
-  value = ((value << 31n) | (value >> 33n)) & MASK;
-  return (value * PRIME1) & MASK;
-}
-
-function mergeRound(acc: bigint, value: bigint): bigint {
-  let result = acc ^ round(0n, value);
-  return (result * PRIME1 + PRIME4) & MASK;
-}
-
-function read32(bytes: Uint8Array, offset: number): bigint {
-  return (
-    BigInt(bytes[offset] ?? 0) |
-    (BigInt(bytes[offset + 1] ?? 0) << 8n) |
-    (BigInt(bytes[offset + 2] ?? 0) << 16n) |
-    (BigInt(bytes[offset + 3] ?? 0) << 24n)
-  );
-}
-
-function read64(bytes: Uint8Array, offset: number): bigint {
-  let value = 0n;
-  for (let index = 0; index < 8; index += 1)
-    value |= BigInt(bytes[offset + index] ?? 0) << BigInt(index * 8);
-  return value;
-}
-
-function xxHash64(bytes: Uint8Array, seed: bigint): bigint {
-  let offset = 0;
-  let hash: bigint;
-  if (bytes.length >= 32) {
-    let v1 = (seed + PRIME1 + PRIME2) & MASK;
-    let v2 = (seed + PRIME2) & MASK;
-    let v3 = seed & MASK;
-    let v4 = (seed - PRIME1) & MASK;
-    while (offset <= bytes.length - 32) {
-      v1 = round(v1, read64(bytes, offset));
-      v2 = round(v2, read64(bytes, offset + 8));
-      v3 = round(v3, read64(bytes, offset + 16));
-      v4 = round(v4, read64(bytes, offset + 24));
-      offset += 32;
-    }
-    hash =
-      (((v1 << 1n) | (v1 >> 63n)) +
-        ((v2 << 7n) | (v2 >> 57n)) +
-        ((v3 << 12n) | (v3 >> 52n)) +
-        ((v4 << 18n) | (v4 >> 46n))) &
-      MASK;
-    hash = mergeRound(hash, v1);
-    hash = mergeRound(hash, v2);
-    hash = mergeRound(hash, v3);
-    hash = mergeRound(hash, v4);
-  } else hash = (seed + PRIME5) & MASK;
-  hash = (hash + BigInt(bytes.length)) & MASK;
-  while (offset <= bytes.length - 8) {
-    const value = round(0n, read64(bytes, offset));
-    hash ^= value;
-    hash = (((hash << 27n) | (hash >> 37n)) * PRIME1 + PRIME4) & MASK;
-    offset += 8;
-  }
-  if (offset <= bytes.length - 4) {
-    hash ^= (read32(bytes, offset) * PRIME1) & MASK;
-    hash = (((hash << 23n) | (hash >> 41n)) * PRIME2 + PRIME3) & MASK;
-    offset += 4;
-  }
-  while (offset < bytes.length) {
-    hash ^= (BigInt(bytes[offset] ?? 0) * PRIME5) & MASK;
-    hash = (((hash << 11n) | (hash >> 53n)) * PRIME1) & MASK;
-    offset += 1;
-  }
-  hash ^= hash >> 33n;
-  hash = (hash * PRIME2) & MASK;
-  hash ^= hash >> 29n;
-  hash = (hash * PRIME3) & MASK;
-  return (hash ^ (hash >> 32n)) & MASK;
-}
-
-/** Computes Claude Code's five-hex-digit CCH from the exact outgoing body bytes. */
-export function computeClaudeCch(body: Uint8Array): string {
-  return (xxHash64(body, CCH_SEED) & 0xfffffn).toString(16).padStart(5, "0");
-}
-
-/** Replaces the anchored Claude billing placeholder in a mutable body before sending. */
-export function patchClaudeCch(body: Uint8Array): boolean {
-  const marker = encoder.encode('"system":[{"type":"text","text":"x-anthropic-billing-header:');
-  const placeholder = encoder.encode(PLACEHOLDER);
-  let markerIndex = -1;
-  outer: for (let index = 0; index <= body.length - marker.length; index += 1) {
-    for (let j = 0; j < marker.length; j += 1) if (body[index + j] !== marker[j]) continue outer;
-    markerIndex = index;
-    break;
-  }
-  if (markerIndex < 0) return false;
-  const start = markerIndex + marker.length;
-  const end = Math.min(body.length - placeholder.length, start + 150);
-  for (let index = start; index <= end; index += 1) {
-    let found = true;
-    for (let j = 0; j < placeholder.length; j += 1)
-      if (body[index + j] !== placeholder[j]) {
-        found = false;
-        break;
-      }
-    if (!found) continue;
-    const cch = encoder.encode(computeClaudeCch(body));
-    body.set(cch, index + 4);
-    return true;
-  }
-  return false;
-}
-
-/** Harness identity instruction, sent on OAuth dispatch. */
-export const CLAUDE_CODE_SYSTEM_INSTRUCTION =
-  "You are Claude Code, Anthropic's official CLI for Claude.";
-
-/**
- * Builds the billing header text with the captured version suffix:
- * `cc_version={ver}.{sha256("59cf53e54c78" + chars + ver)[0:3]}` where
- * chars are the 5th/8th/21st chars of the first user text (or "0" when
- * absent). `cc_entrypoint=cli` matches the harness UA `(external, cli)`;
- * an older snapshot used `claude-desktop`, which is unverified from local
- * evidence, so cli is kept with this note.
- */
-export function createClaudeBillingText(userText: string, version: string): string {
-  const chars = [4, 7, 20].map((index) => userText[index] ?? "0").join("");
-  const suffix = createHash("sha256")
-    .update(`59cf53e54c78${chars}${version}`)
-    .digest("hex")
-    .slice(0, 3);
-  return `x-anthropic-billing-header: cc_version=${version}.${suffix}; cc_entrypoint=cli; cch=00000;`;
-}
-
-/** Patches a string request body and returns its encoded bytes, or undefined when no billing block exists. */
-export function patchClaudeCchBody(body: string): Uint8Array | undefined {
-  const bytes = encoder.encode(body);
-  return patchClaudeCch(bytes) ? bytes : undefined;
-}
+import { createHash } from "node:crypto";
+
+const MASK = 0xffffffffffffffffn;
+const PRIME1 = 0x9e3779b185ebca87n;
+const PRIME2 = 0xc2b2ae3d27d4eb4fn;
+const PRIME3 = 0x165667b19e3779f9n;
+const PRIME4 = 0x85ebca77c2b2ae63n;
+const PRIME5 = 0x27d4eb2f165667c5n;
+const CCH_SEED = 0x4d659218e32a3268n;
+const PLACEHOLDER = "cch=00000";
+const encoder = new TextEncoder();
+
+function round(acc: bigint, input: bigint): bigint {
+  let value = (acc + input * PRIME2) & MASK;
+  value = ((value << 31n) | (value >> 33n)) & MASK;
+  return (value * PRIME1) & MASK;
+}
+
+function mergeRound(acc: bigint, value: bigint): bigint {
+  let result = acc ^ round(0n, value);
+  return (result * PRIME1 + PRIME4) & MASK;
+}
+
+function read32(bytes: Uint8Array, offset: number): bigint {
+  return (
+    BigInt(bytes[offset] ?? 0) |
+    (BigInt(bytes[offset + 1] ?? 0) << 8n) |
+    (BigInt(bytes[offset + 2] ?? 0) << 16n) |
+    (BigInt(bytes[offset + 3] ?? 0) << 24n)
+  );
+}
+
+function read64(bytes: Uint8Array, offset: number): bigint {
+  let value = 0n;
+  for (let index = 0; index < 8; index += 1)
+    value |= BigInt(bytes[offset + index] ?? 0) << BigInt(index * 8);
+  return value;
+}
+
+function xxHash64(bytes: Uint8Array, seed: bigint): bigint {
+  let offset = 0;
+  let hash: bigint;
+  if (bytes.length >= 32) {
+    let v1 = (seed + PRIME1 + PRIME2) & MASK;
+    let v2 = (seed + PRIME2) & MASK;
+    let v3 = seed & MASK;
+    let v4 = (seed - PRIME1) & MASK;
+    while (offset <= bytes.length - 32) {
+      v1 = round(v1, read64(bytes, offset));
+      v2 = round(v2, read64(bytes, offset + 8));
+      v3 = round(v3, read64(bytes, offset + 16));
+      v4 = round(v4, read64(bytes, offset + 24));
+      offset += 32;
+    }
+    hash =
+      (((v1 << 1n) | (v1 >> 63n)) +
+        ((v2 << 7n) | (v2 >> 57n)) +
+        ((v3 << 12n) | (v3 >> 52n)) +
+        ((v4 << 18n) | (v4 >> 46n))) &
+      MASK;
+    hash = mergeRound(hash, v1);
+    hash = mergeRound(hash, v2);
+    hash = mergeRound(hash, v3);
+    hash = mergeRound(hash, v4);
+  } else hash = (seed + PRIME5) & MASK;
+  hash = (hash + BigInt(bytes.length)) & MASK;
+  while (offset <= bytes.length - 8) {
+    const value = round(0n, read64(bytes, offset));
+    hash ^= value;
+    hash = (((hash << 27n) | (hash >> 37n)) * PRIME1 + PRIME4) & MASK;
+    offset += 8;
+  }
+  if (offset <= bytes.length - 4) {
+    hash ^= (read32(bytes, offset) * PRIME1) & MASK;
+    hash = (((hash << 23n) | (hash >> 41n)) * PRIME2 + PRIME3) & MASK;
+    offset += 4;
+  }
+  while (offset < bytes.length) {
+    hash ^= (BigInt(bytes[offset] ?? 0) * PRIME5) & MASK;
+    hash = (((hash << 11n) | (hash >> 53n)) * PRIME1) & MASK;
+    offset += 1;
+  }
+  hash ^= hash >> 33n;
+  hash = (hash * PRIME2) & MASK;
+  hash ^= hash >> 29n;
+  hash = (hash * PRIME3) & MASK;
+  return (hash ^ (hash >> 32n)) & MASK;
+}
+
+/** Computes Claude Code's five-hex-digit CCH from the exact outgoing body bytes. */
+export function computeClaudeCch(body: Uint8Array): string {
+  return (xxHash64(body, CCH_SEED) & 0xfffffn).toString(16).padStart(5, "0");
+}
+
+/** Replaces the anchored Claude billing placeholder in a mutable body before sending. */
+export function patchClaudeCch(body: Uint8Array): boolean {
+  const marker = encoder.encode('"system":[{"type":"text","text":"x-anthropic-billing-header:');
+  const placeholder = encoder.encode(PLACEHOLDER);
+  let markerIndex = -1;
+  outer: for (let index = 0; index <= body.length - marker.length; index += 1) {
+    for (let j = 0; j < marker.length; j += 1) if (body[index + j] !== marker[j]) continue outer;
+    markerIndex = index;
+    break;
+  }
+  if (markerIndex < 0) return false;
+  const start = markerIndex + marker.length;
+  const end = Math.min(body.length - placeholder.length, start + 150);
+  for (let index = start; index <= end; index += 1) {
+    let found = true;
+    for (let j = 0; j < placeholder.length; j += 1)
+      if (body[index + j] !== placeholder[j]) {
+        found = false;
+        break;
+      }
+    if (!found) continue;
+    const cch = encoder.encode(computeClaudeCch(body));
+    body.set(cch, index + 4);
+    return true;
+  }
+  return false;
+}
+
+/** Harness identity instruction, sent on OAuth dispatch. */
+export const CLAUDE_CODE_SYSTEM_INSTRUCTION =
+  "You are Claude Code, Anthropic's official CLI for Claude.";
+
+/**
+ * Builds the billing header text with the captured version suffix:
+ * `cc_version={ver}.{sha256("59cf53e54c78" + chars + ver)[0:3]}` where
+ * chars are the 5th/8th/21st chars of the first user text (or "0" when
+ * absent). `cc_entrypoint=cli` matches the harness UA `(external, cli)`;
+ * an older snapshot used `claude-desktop`, which is unverified from local
+ * evidence, so cli is kept with this note.
+ */
+export function createClaudeBillingText(userText: string, version: string): string {
+  const chars = [4, 7, 20].map((index) => userText[index] ?? "0").join("");
+  const suffix = createHash("sha256")
+    .update(`59cf53e54c78${chars}${version}`)
+    .digest("hex")
+    .slice(0, 3);
+  return `x-anthropic-billing-header: cc_version=${version}.${suffix}; cc_entrypoint=cli; cch=00000;`;
+}
+
+/** Patches a string request body and returns its encoded bytes, or undefined when no billing block exists. */
+export function patchClaudeCchBody(body: string): Uint8Array | undefined {
+  const bytes = encoder.encode(body);
+  return patchClaudeCch(bytes) ? bytes : undefined;
+}

package/src/providers/integrations/claude/fallback-credit.ts

@@ -27,6 +27,7 @@
  */
 
 import { GatewayError } from "../../../protocol/gateway-error";
+import { fnv1a32 } from "../shared/hash";
 
 const CREDIT_TTL_MS = 5 * 60 * 1000; // 5 minutes
 const MAX_CACHE_SIZE = 64;
@@ -122,15 +123,10 @@ export class FallbackCreditCache {
 
 /**
  * Compute a simple hash of the request body for cache keying.
- * Uses FNV-1a — fast, deterministic, sufficient for cache identity.
+ * FNV-1a — fast, deterministic, sufficient for cache identity.
  */
 export function hashBody(body: string): string {
-  let hash = 0x811c9dc5;
-  for (let i = 0; i < body.length; i++) {
-    hash ^= body.charCodeAt(i);
-    hash = Math.imul(hash, 0x01000193);
-  }
-  return (hash >>> 0).toString(36);
+  return fnv1a32(body).toString(36);
 }
 
 // Shared process-wide cache instance

package/src/providers/integrations/cline/cline.ts

@@ -28,7 +28,7 @@ const CLINE_MODELS_CATALOG_PATH = "/ai/cline/models" as const;
 
 
 
-export function workosToken(token: string): string {
+function workosToken(token: string): string {
   return token.startsWith("workos:") ? token : `workos:${token}`;
 }