cartethyia 2.7.4 → 2.7.6

package/src/providers/integrations/qoder/qoder-catalog.ts

@@ -86,6 +86,14 @@ interface QoderModelConfig {
    * `false` marks the model as billed.
    */
   readonly is_free?: boolean;
+  /**
+   * The reasoning effort to send when the caller did not ask for one. The IDE
+   * surface follows the `reasoningEffort` field: a model marked `is_reasoning`
+   * may still stream no reasoning unless an effort is present (verified live:
+   * Sonus streams thinking only when effort is sent; DeepSeek thinks by
+   * default). Set only for models that need the push.
+   */
+  readonly default_reasoning_effort?: string;
 }
 
 /**
@@ -112,13 +120,19 @@ export const QODER_CN_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>>
 };
 
 /**
- * Global/intl roster (17 keys), from the donor's `qoder_catalog_intl.json`.
+ * Global/intl roster (18 keys), from the donor's `qoder_catalog_intl.json`.
  *
  * Note how the shared keys differ from CN — `auto` is non-reasoning here and
  * `qmodel` carries a 1M window. That is why the rosters are not merged.
  */
 export const QODER_INTL_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>> = {
-  auto: { id: "auto", display_name: "Auto", max_input_tokens: 200000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
+  // Every row declares its *maximum selectable* window (1M), not the currently
+  // active one: Qoder publishes a `context_config` of selectable windows per
+  // row (1M/400K/200K/…), and the adapter dispatches the widest
+  // (`qoderMaxContextFor`). The live list's `max_input_tokens` only names the
+  // currently-selected window (often 180K/200K), which is not a ceiling —
+  // declaring that would cap a conversation a 1M-capable account could run.
+  auto: { id: "auto", display_name: "Auto", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
   ultimate: { id: "ultimate", display_name: "Ultimate", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true },
   // `fast` is what the live roster reports today; `performance` is the older
   // key for the same slot. Both are kept so a hand-added model id written
@@ -126,9 +140,12 @@ export const QODER_INTL_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>
   // discovery supersedes it on the first successful fetch.
   fast: { id: "fast", display_name: "Fast", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
   performance: { id: "performance", display_name: "Performance", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
-  efficient: { id: "efficient", display_name: "Efficient", max_input_tokens: 200000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
-  smodel: { id: "smodel", display_name: "Sonus", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true },
-  cmodel: { id: "cmodel", display_name: "Cantus", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true },
+  efficient: { id: "efficient", display_name: "Efficient", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
+  // Sonus/Cantus need an explicit effort on the IDE surface; without it the
+  // upstream streams text only, no reasoning (verified live). DeepSeek-family
+  // models think by default and are left untouched.
+  smodel: { id: "smodel", display_name: "Sonus", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true, default_reasoning_effort: "high" },
+  cmodel: { id: "cmodel", display_name: "Cantus", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true, default_reasoning_effort: "high" },
   qmodel_38max: { id: "qmodel_38max", display_name: "Qwen3.8-Max", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_reasoning: true },
   qfmodel: { id: "qfmodel", display_name: "Qwen3.8-Flash", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_free: true, is_reasoning: true },
   qmodel_latest: { id: "qmodel_latest", display_name: "Qwen3.7-Max", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_reasoning: false },
@@ -141,7 +158,10 @@ export const QODER_INTL_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>
   // Live roster (2026-11-01) reports dfmodel as billed (is_free false); it was
   // previously marked free. Display names are corrected from the same capture.
   dfmodel: { id: "dfmodel", display_name: "DeepSeek-Flash", max_input_tokens: 1000000, max_output_tokens: 384_000, is_vl: true, is_free: false, is_reasoning: true },
-  mmodel: { id: "mmodel", display_name: "MiniMax-M3.1-Flash", max_input_tokens: 1000000, max_output_tokens: 512_000, is_vl: true, is_free: false, is_reasoning: false },
+  mmodel: { id: "mmodel", display_name: "MiniMax-M3.1-Flash", max_input_tokens: 1000000, max_output_tokens: 512_000, is_vl: true, is_free: false, is_reasoning: true },
+  // `lite` is the free-tier plan package: same 1M window and multimodal input
+  // as `qmodel` (Qwen3.7-Plus), capped at 64k output, free tier.
+  lite: { id: "lite", display_name: "Lite-Qwen-3.7-Plus", max_input_tokens: 1000000, max_output_tokens: 65_536, is_vl: true, is_free: true, is_reasoning: false },
 };
 
 /**
@@ -213,13 +233,24 @@ export function qoderVirtualModels(
         // substitutes the shared unfiled fallback for null — the same marker a
         // hand-added row gets.
         ctx: target.contextLimit ?? null,
-        ...(target.outputLimit === null ? {} : { out: target.outputLimit }),
-        vision: target.modalities.input.includes("image"),
+        // A virtual override wins; otherwise inherit the target's ceiling.
+        ...(virtual.outputLimit !== undefined
+          ? { out: virtual.outputLimit }
+          : target.outputLimit === null
+            ? {}
+            : { out: target.outputLimit }),
+        vision: virtual.vision ?? target.modalities.input.includes("image"),
         reasoning: target.reasoning ?? false,
         toolCall: target.toolCall ?? false,
         // The same model under its caller-facing name belongs to the same tier,
-        // so the pill follows the roster row rather than being restated.
-        ...(target.freeTier === undefined ? {} : { free: target.freeTier, freeTier: target.freeTier }),
+        // so the pill follows the roster row rather than being restated —
+        // unless the virtual card explicitly overrides it (`lite` is a free
+        // plan package over a billed slot).
+        ...(virtual.free !== undefined
+          ? { free: virtual.free, freeTier: virtual.free }
+          : target.freeTier === undefined
+            ? {}
+            : { free: target.freeTier, freeTier: target.freeTier }),
       }),
     );
   }
@@ -274,11 +305,27 @@ export function mapQoderCatalogResponse(raw: unknown): QoderCatalogEntry[] {
   return entries;
 }
 
+/**
+ * The static roster's stated output ceiling for one slot, when the roster
+ * states one.
+ *
+ * Upstream's live `/model/list` rows report no output limit, so a discovered
+ * row cannot read one from the wire. Inheriting the roster's number keeps the
+ * discovered row's `outputLimit` honest — without it `defineModel` falls back
+ * to a base-catalog/majority vote that can sit below the roster's ceiling
+ * (e.g. `qwen3.7-plus` votes 64k while the roster says 131k).
+ */
+function qoderRosterMaxOutputFor(providerId: string, key: string): number | undefined {
+  const configs = providerId === "qodercn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS;
+  return configs[key]?.max_output_tokens;
+}
+
 /** Projects one live catalog row onto a Cartethyia catalog row. */
 export function qoderCatalogModel(
   entry: QoderCatalogEntry,
   providerId: string,
 ): ModelDefinition {
+  const rosterOutput = qoderRosterMaxOutputFor(providerId, entry.key);
   return defineModel({
     id: entry.key,
     providerId,
@@ -295,6 +342,9 @@ export function qoderCatalogModel(
     // a free row bills zero per token and belongs to the provider's free tier.
     free: entry.isFree,
     freeTier: entry.isFree,
+    // The live row carries no output ceiling, so inherit the static roster's
+    // stated one when it exists (see `qoderRosterMaxOutputFor`).
+    ...(rosterOutput === undefined ? {} : { out: rosterOutput }),
   });
 }
 
@@ -457,7 +507,40 @@ export async function discoverQoderModels(input: {
         lastError = new Error("Qoder model list returned no usable models");
         continue;
       }
-      const models = enabled.map((entry) => qoderCatalogModel(entry, providerId));
+      const models = enabled.flatMap((entry) => {
+        // Publish caller-facing virtual ids (`sonus`, `lite-qwen-3.7-plus`, …)
+        // instead of the opaque roster keys (`smodel`, `qmodel`, …). A discovery
+        // row must look like what the UI offers and what a caller can type;
+        // keeping the raw key here made live-synced rows appear under names
+        // nobody can route to by display, and hid overridden cards like `lite`.
+        // More than one virtual may share a slot (`lite-qwen-3.7-plus` and
+        // `qwen3.7-plus` both dispatch to `qmodel`), so every match on the slot
+        // is published.
+        const virtuals = QODER_VIRTUAL_MODELS.filter((virtual) => virtual.target === entry.key);
+        if (virtuals.length === 0) return [qoderCatalogModel(entry, providerId)];
+        const rosterOutput = qoderRosterMaxOutputFor(providerId, entry.key);
+        return virtuals.map((virtual) =>
+          defineModel({
+            id: virtual.id,
+            providerId,
+            wireFamily: "chat",
+            endpoint: QODER_CHAT_PATH,
+            ctx: entry.maxInputTokens ?? null,
+            vision: virtual.vision ?? entry.isVl,
+            reasoning: entry.isReasoning,
+            // A virtual override wins; otherwise inherit the static roster's
+            // ceiling for the slot instead of a base-catalog/majority estimate
+            // (see `qoderRosterMaxOutputFor`).
+            ...(virtual.outputLimit !== undefined
+              ? { out: virtual.outputLimit }
+              : rosterOutput === undefined
+                ? {}
+                : { out: rosterOutput }),
+            free: virtual.free ?? entry.isFree,
+            freeTier: virtual.free ?? entry.isFree,
+          }),
+        );
+      });
       // Index the widest selectable window per key (from `context_config`,
       // already computed into `maxInputTokens` by `mapQoderCatalogResponse`) so
       // dispatch can send the maximum rather than the currently active one.

package/src/providers/integrations/qoder/qoder-oauth.ts

@@ -8,14 +8,16 @@
  * the same endpoints as the upstream client.
  *
  * The issued token is used directly at dispatch: `dt-...` tokens skip the
- * PAT→jobToken exchange. There is no working refresh grant —
- * the upstream refresh endpoint answers 403 for this flow — so no refresher
- * is registered and the token is used exactly as issued until the operator
- * re-runs login. The account's Qoder user id and machine id travel in
- * `auth_state`, because the token itself carries neither and every dispatch
- * needs both for COSY signing.
+ * PAT→jobToken exchange. Refresh uses the deviceToken refresh endpoint
+ * (`POST /api/v1/deviceToken/refresh` with `{refresh_token, machine_id,
+ * machine_token}`), verified live 2026-11-02 — it returns a fresh `dt-…`
+ * and a rotated `drt-…`. The account's Qoder user id and machine id travel
+ * in `auth_state`, because the token itself carries neither and every
+ * dispatch needs both for COSY signing.
  */
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { execSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { QODER_REALMS, type QoderRealm } from "./qoder-realm";
 import {
   base64UrlEncode,
@@ -28,7 +30,7 @@ import type {
   OAuthDeviceStartResult,
   OAuthExchangeResult,
 } from "../../authentication/oauth-flow-store";
-import type { OAuthTokenRefreshResult } from "../../authentication/oauth-refresh-service";
+import type { OAuthTokenRefreshResult, OAuthRefreshContext } from "../../authentication/oauth-refresh-service";
 import { OAuthDeviceFlow } from "../../authentication/oauth-device-flow";
 
 /** One Qoder account profile, as much of it as the gateway uses. */
@@ -109,9 +111,7 @@ export function readQoderUserInfo(body: Record<string, unknown>): QoderUserInfo
 }
 
 /** Global/intl endpoints. Kept as the default realm's values, unchanged. */
-export const QODER_LOGIN_URL = "https://qoder.com/device/selectAccounts" as const;
 export const QODER_DEVICE_TOKEN_URL = "https://openapi.qoder.sh/api/v1/deviceToken/poll" as const;
-export const QODER_USERINFO_URL = "https://openapi.qoder.sh/api/v1/userinfo" as const;
 
 /**
  * Per-realm device endpoints, derived from `QODER_REALMS`.
@@ -221,6 +221,82 @@ function parseDeviceState(value: string | undefined): QoderDeviceState | undefin
   return { verifier, machineId };
 }
 
+/**
+ * Random PKCE verifier in the exact alphabet the desktop IDE uses.
+ *
+ * The IDE's `startDeviceFlow` draws the verifier from
+ * `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`. Using
+ * the same alphabet keeps the login byte-for-byte identical to the desktop
+ * client, which the approval server may use to fingerprint the requesting
+ * client. Length is fixed at 64 — RFC 7636 §4.1 requires [43,128]; a fixed
+ * length avoids a non-cryptographic length while the content comes entirely
+ * from the CSPRNG (`randomBytes`) below.
+ */
+function qoderIdeVerifier(): string {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  // RFC 7636 §4.1: verifier length must be within [43,128]; fixed here. Content
+  // comes from the CSPRNG (randomBytes) below. `67` (alphabet length) does not
+  // divide 256, so the `%` mapping has a negligible modulo bias (~21/256 per
+  // char) — irrelevant for a 64-char secret with ~388 bits of input entropy.
+  const length = 64;
+  const bytes = randomBytes(length);
+  let out = "";
+  for (let i = 0; i < length; i += 1) {
+    out += alphabet[bytes[i]! % alphabet.length];
+  }
+  return out;
+}
+
+/**
+ * The hardware machine id the desktop IDE reports for the device flow.
+ *
+ * The IDE's `getMachineId` is platform-hardware-derived: Windows reads
+ * `MachineGuid` from `HKLM\SOFTWARE\Microsoft\Cryptography`, macOS reads the
+ * `IOPlatformUUID` from IORegistry, Linux reads `/etc/machine-id`. The device
+ * login sends it as `machine_id`, and the upstream correlates the approved
+ * device to the account. A random UUID instead registers a different device,
+ * which is the observable difference between an IDE login that chats and a
+ * gateway login that is refused with quota errors.
+ *
+ * Returns the hardware id when it can be read, else `""` so callers fall back
+ * to a random UUID exactly like the IDE does on an unreadable machine.
+ */
+export function qoderHardwareMachineId(): string {
+  try {
+    if (process.platform === "win32") {
+      const out = execSync('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid', {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 5000,
+      });
+      const m = /MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]+)/.exec(out);
+      return m?.[1]?.trim() ?? "";
+    }
+    if (process.platform === "darwin") {
+      const out = execSync("ioreg -rd1 -c IOPlatformExpertDevice", {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 5000,
+      });
+      const m = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out);
+      return m?.[1]?.trim() ?? "";
+    }
+    if (process.platform === "linux") {
+      for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        try {
+          const v = readFileSync(p, "utf8").trim();
+          if (v) return v;
+        } catch {
+          // try the next candidate
+        }
+      }
+    }
+  } catch {
+    // fall through to the caller's random fallback
+  }
+  return "";
+}
+
 export class QoderOAuthClient extends OAuthDeviceFlow {
   override readonly supportsDeviceCode = true;
   override readonly supportsBrowserCode = false;
@@ -254,25 +330,35 @@ export class QoderOAuthClient extends OAuthDeviceFlow {
   override async startDeviceAuth(
     _context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDeviceStartResult> {
-    const verifier = base64UrlEncode(randomBytes(32));
+    // 1:1 with the desktop IDE device flow (unpacked worker `startDeviceFlow`):
+    // the verifier is random from the IDE's own alphabet (`A-Za-z0-9-._~`,
+    // 43–128 chars), the challenge is PKCE S256, the nonce is a full UUID
+    // (dashes included), and the client id is ALWAYS sent — intl uses the
+    // same id the realm table carries, CN uses its own. Sending no client id
+    // (or stripping the UUID dashes) makes the approval screen classify the
+    // device differently and can produce an account the model server later
+    // refuses with quota/entitlement errors.
+    //
+    // The machine id defaults to the hardware id (same source the IDE reads),
+    // but an operator may pass `machine_id`/`machine_token` through
+    // `context.parameters` to reuse a device identity the IDE already holds
+    // (e.g. `aicoding.loginMachineIdentity.v1.qoder.local`) — the upstream
+    // correlates the approved device to the account, so matching the IDE's
+    // device is how a gateway login chats on the same account the IDE does.
+    const overrideMachineId = nonEmptyTrimmedString(_context?.parameters?.["machine_id"]);
+    const overrideMachineToken = nonEmptyTrimmedString(_context?.parameters?.["machine_token"]);
+    const verifier = qoderIdeVerifier();
     const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
-    // CN carries a dashed nonce and additionally states the client id and
-    // native redirect; intl stays on the 32-hex nonce and the two params it
-    // has always sent. Both shapes are upstream fact from the donor, and only
-    // the CN branch is new, so the working intl URL is untouched.
-    const nonce = this.realm === "cn" ? randomUUID() : randomUUID().replaceAll("-", "");
-    const machineId = randomUUID();
+    const nonce = randomUUID();
+    const machineId = overrideMachineId ?? (qoderHardwareMachineId() || randomUUID());
     const params = new URLSearchParams({
       challenge,
       challenge_method: "S256",
-      machine_id: machineId,
       nonce,
+      machine_id: machineId,
+      client_id: QODER_REALMS[this.realm].clientId,
     });
-    if (this.realm === "cn") {
-      const config = QODER_REALMS.cn;
-      params.set("client_id", config.clientId);
-      params.set("redirect_uri", config.redirectUri);
-    }
+    if (overrideMachineToken !== undefined) params.set("machine_token", overrideMachineToken);
     return {
       verificationUri: `${qoderOAuthUrls(this.realm).loginUrl}?${params.toString()}`,
       // This flow shows no user code: approval happens against the
@@ -395,10 +481,64 @@ export class QoderOAuthClient extends OAuthDeviceFlow {
   }
 
   override async refresh(
-    _refreshToken: string,
-    _signal?: AbortSignal,
+    refreshToken: string,
+    signal?: AbortSignal,
+    context?: OAuthRefreshContext,
   ): Promise<OAuthTokenRefreshResult> {
-    throw new Error("Qoder does not support token refresh; sign in again");
+    // The deviceToken refresh endpoint is the one working refresh grant for this
+    // flow (verified live 2026-11-02: POST /api/v1/deviceToken/refresh with
+    // `{refresh_token, machine_id, machine_token}` returns 200 with a fresh
+    // `device_token` + rotated `refresh_token`). The abstract OAuth refresh
+    // endpoint answers 403 for this flow, so we post to the deviceToken one.
+    const authState = record(context?.auth_state);
+    const machineId = authState === undefined ? undefined : nonEmptyTrimmedString(authState.machineId);
+    if (machineId === undefined) {
+      throw new Error("Qoder refresh requires auth_state.machineId");
+    }
+    const response = await this.fetchFn(
+      `${qoderOAuthUrls(this.realm).deviceTokenUrl}/refresh`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json",
+          "user-agent": "Go-http-client/2.0",
+        },
+        body: JSON.stringify({
+          refresh_token: refreshToken,
+          machine_id: machineId,
+          machine_token: machineId,
+        }),
+        ...(signal === undefined ? {} : { signal }),
+      },
+    );
+    const raw = await response.text();
+    let payload: unknown;
+    try {
+      payload = JSON.parse(raw);
+    } catch {
+      throw new Error(`Qoder token refresh returned invalid JSON (${response.status})`);
+    }
+    if (!response.ok) {
+      const message = record(payload);
+      throw new Error(
+        nonEmptyTrimmedString(message?.message) ??
+          nonEmptyTrimmedString(message?.errorMessage) ??
+          `Qoder token refresh failed (${response.status})`,
+      );
+    }
+    const body = record(payload);
+    const deviceToken = body === undefined ? undefined : nonEmptyTrimmedString(body.device_token);
+    if (deviceToken === undefined) {
+      throw new Error("Qoder token refresh response omitted device_token");
+    }
+    const nextRefresh = nonEmptyTrimmedString(body?.refresh_token);
+    const expiresAt = new Date(parseQoderExpiry(body?.expires_at, body?.expires_in));
+    return {
+      access: deviceToken,
+      ...(nextRefresh === undefined ? {} : { refresh: nextRefresh }),
+      expiresAt,
+    };
   }
 }
 

package/src/providers/integrations/qoder/qoder-quota.ts

@@ -1,8 +1,10 @@
 // Qoder quota.
 //
-// `GET /api/v2/quota/usage` on the **openapi** host, with a plain bearer token
-// — no COSY signature on this surface, which is the one place the business API
-// differs from inference.
+// `GET /api/v2/quota/usage` on the **openapi** host, with a bearer token — no
+// COSY signature on this surface, which is the one place the business API
+// differs from inference. Device tokens (`dt-…`) are used directly; a PAT
+// (`pt-…`) is exchanged for a job token (`jt-…`) first, because the business
+// API rejects a raw PAT with 401 `TOKEN_EXPIRE`.
 //
 // The response carries two quota objects and they are not interchangeable:
 //
@@ -36,6 +38,7 @@ import {
 import type { QuotaCollectionContext } from "../../quota/quota-support";
 import { log } from "../../../observability/logger";
 import { QODER_REALMS, type QoderRealm } from "./qoder-realm";
+import { isQoderPat, resolveQoderAuth } from "./qoder";
 
 /** Paths on the realm's openapi host. */
 const QUOTA_PATH = "/api/v2/quota/usage";
@@ -75,7 +78,29 @@ function creditWindow(
 ): ProviderQuotaWindow | null {
   if (remaining === null && limit === null) return null;
   const used = remaining !== null && limit !== null ? limit - remaining : null;
-  return percentWindow(kind, label, null, resetsAt, used, limit, "pooled");
+  // Give pooled windows a percentage so the console can render a real bar and
+  // tone instead of an uncolored "quota-only" row (which is what a null
+  // percent produced: every Qoder account was grey, and "enable available
+  // accounts" could never match a window). A ceiling of 0 with nothing left is
+  // a spent balance — report 0% remaining rather than a null percent.
+  let usedPercent: number | null = null;
+  if (remaining !== null && limit !== null) {
+    if (limit > 0) usedPercent = ((limit - remaining) / limit) * 100;
+    else if (remaining <= 0) usedPercent = 100;
+  }
+  return percentWindow(kind, label, usedPercent, resetsAt, used, limit, "pooled");
+}
+
+/**
+ * The business API answers "never resets" with a far-future sentinel
+ * (`9999-12-31T00:00:00.000Z`). Keeping it on the wire makes the console show
+ * a 7978-year countdown. Any date at or beyond year 9999 means no reset.
+ */
+function normalizeQoderReset(resetsAt: string | null): string | null {
+  if (resetsAt === null) return null;
+  const date = new Date(resetsAt);
+  if (!Number.isFinite(date.getTime())) return null;
+  return date.getUTCFullYear() >= 9999 ? null : resetsAt;
 }
 
 /**
@@ -103,11 +128,28 @@ export async function fetchQoderQuota(
 
   let payload: unknown;
   try {
+    // A PAT (`pt-…`) is not an active bearer on the business API: it is a
+    // minted credential that must be exchanged for a short-lived job token
+    // (`jt-…`) first. Verified live 2026-11-02: a raw `pt-…` bearer answers
+    // 401 `TOKEN_EXPIRE` while the exchanged `jt-…` answers 200. Device
+    // tokens (`dt-…`) are used directly. A failed exchange — expired/revoked
+    // PAT — is an unreadable balance, not an error that cools the account.
+    let bearer = credential;
+    if (isQoderPat(credential)) {
+      const auth = await resolveQoderAuth({
+        secret: credential,
+        authState: raw,
+        signal: AbortSignal.timeout(15_000),
+        fetcher,
+        realm,
+      });
+      bearer = auth.securityOauthToken;
+    }
     const response = await fetcher(url, {
       method: "GET",
       headers: {
         accept: "application/json",
-        authorization: `Bearer ${credential}`,
+        authorization: `Bearer ${bearer}`,
         "user-agent": config.userAgent,
       },
     });
@@ -148,7 +190,7 @@ export async function fetchQoderQuota(
     return { source: "qoder", plan: null, windows: [], error: null };
   }
 
-  const resetsAt = isoDate(root["expiresAt"] ?? root["expireAt"] ?? root["expires_at"]);
+  const resetsAt = normalizeQoderReset(isoDate(root["expiresAt"] ?? root["expireAt"] ?? root["expires_at"]));
   const windows: ProviderQuotaWindow[] = [];
   const plan = creditWindow("qoder:plan", "Plan credits", number(userQuota?.["remaining"]), number(userQuota?.["total"]), resetsAt);
   if (plan) windows.push(plan);

package/src/providers/integrations/qoder/qoder-realm.ts

@@ -41,9 +41,13 @@ export const QODER_MODELS_PATH = "/algo/api/v2/model/list?Encode=1";
 
 /**
  * The modern model-server surface used by the IDE / QoderWake (OpenAI-shaped
- * chunks, plain bearer auth). This surface streams immediately — the legacy
- * `/algo` chat endpoint answers `10605 isQueued` and parks requests in a
- * server-side queue, so dispatch prefers this surface when it is available.
+ * chunks, plain bearer auth). This surface streams immediately and echoes the
+ * real model key — the legacy `/algo` chat endpoint answers
+ * `10605 isQueued` (parking requests in a server-side queue) and echoes a
+ * fixed `"auto"` model. Dispatch tries this surface first, and falls back to
+ * legacy COSY only when it refuses the account on entitlement grounds (HTTP
+ * 402 / `{"code":116}`) AND the dispatched model is a free-tier row — for a
+ * billed model the same code is genuine quota exhaustion and must surface.
  */
 export const QODER_IDE_CHAT_PATH = "/model/v1/chat/completions";
 
@@ -76,7 +80,9 @@ export const QODER_REALMS: Readonly<Record<QoderRealm, QoderRealmConfig>> = {
     gatewayFallbacks: [],
     openapi: "https://openapi.qoder.com.cn",
     website: "https://qoder.com.cn",
-    clientId: "1c5e33e1-364d-4ce6-b02c-acaa81274a5c",
+    // 1:1 with the desktop IDE's device flow (`Hfl` in the unpacked worker):
+    // the client id the IDE registers for the CN deployment.
+    clientId: "e93fe488-5778-4c35-a6fc-0f54ed7b3139",
     redirectUri: "qoder-work-cn://",
     userAgent: "QoderWork/1.1.64",
   },
@@ -112,30 +118,3 @@ export function qoderInferenceCandidates(
   }
   return [config.gateway, ...config.gatewayFallbacks];
 }
-
-/**
- * Model keys that exist in exactly one realm.
- *
- * From the donor's `INTL_EXCLUSIVE` / `CN_EXCLUSIVE` tables. A request for one
- * of these on the wrong realm does not degrade — it is refused — so the roster
- * each realm publishes is the authority, not a union.
- */
-export const QODER_INTL_EXCLUSIVE: ReadonlySet<string> = new Set([
-  "fast",
-  "efficient",
-  "cmodel",
-  "smodel",
-  "ultimate",
-  "performance",
-]);
-
-export const QODER_CN_EXCLUSIVE: ReadonlySet<string> = new Set([
-  "q37fmodel",
-  "gm51model",
-]);
-
-/** True when this model key is served only by the other realm. */
-export function isForeignQoderModel(realm: QoderRealm, modelId: string): boolean {
-  const foreign = realm === "cn" ? QODER_INTL_EXCLUSIVE : QODER_CN_EXCLUSIVE;
-  return foreign.has(modelId.trim().toLowerCase());
-}