cartethyia 2.7.5 → 2.7.7

package/src/console/observability/store.ts

@@ -165,6 +165,9 @@ function mapUsageRequestItem(
     // Why the drawer is empty for this request — see the contract field. This is
     // what makes the blank panels diagnosable without server logs.
     ...(event.payloadCaptureState ? { payloadCaptureState: event.payloadCaptureState } : {}),
+    // Degenerate stop (short output ended by an ordinary `stop`) — carried so
+    // the request detail can flag the pattern.
+    ...(event.degenerateStop ? { degenerateStop: true } : {}),
   };
 }
 async function resolveProxyLabel(

package/src/console/providers/catalog/contracts.ts

@@ -935,6 +935,8 @@ export interface ProviderRoutingResponse {
   readonly skipProxy: boolean;
   /** Built-in API-key upstream User-Agent; OAuth and custom providers retain their own identity. */
   readonly userAgent: string;
+  /** Operator-set custom User-Agent override; `null` = no override (native identity is used). */
+  readonly customUserAgent: string | null;
 }
 
 /**
@@ -966,4 +968,6 @@ export interface UpdateProviderRoutingRequest {
   readonly skipProxy?: boolean;
   /** Built-in API-key upstream User-Agent. */
   readonly userAgent?: string;
+  /** Operator-set custom User-Agent override; `null` clears it back to native. */
+  readonly customUserAgent?: string | null;
 }

package/src/console/providers/catalog/routes.ts

@@ -126,6 +126,7 @@ const probeModelBody = t.Object({
   reasoningEffort: t.Optional(literalUnion(PROBE_REASONING_EFFORTS)),
   maxOutputTokens: t.Optional(t.Integer({ minimum: 1, maximum: 131072 })),
   stream: t.Optional(t.Boolean()),
+  surface: t.Optional(literalUnion(["default", "cosy", "grpc", "ide"])),
 });
 const byokConnectionTestBody = t.Object({
   baseUrl: t.String(),

package/src/console/providers/detail/routes.ts

@@ -100,6 +100,13 @@ function createProviderDetailOperations(deps: ProviderDetailConfig) {
       ) {
         throw new ConsoleDomainError("invalid_request", 400, "userAgent must be a header value up to 4096 characters");
       }
+      if (
+        patch.customUserAgent !== undefined &&
+        patch.customUserAgent !== null &&
+        (patch.customUserAgent.length > 4096 || /[\u0000-\u001f\u007f]/.test(patch.customUserAgent))
+      ) {
+        throw new ConsoleDomainError("invalid_request", 400, "customUserAgent must be a header value up to 4096 characters, or null");
+      }
       const updated = await deps.store.updateRouting(providerId, a.tenantId, patch);
       await deps.auditSink?.record({
         access: a,
@@ -157,6 +164,7 @@ const updateRoutingBody = t.Object({
   usageFloorUnit: t.Optional(t.Union([t.Literal("credit"), t.Literal("percent")])),
   skipProxy: t.Optional(t.Boolean()),
   userAgent: t.Optional(t.String({ minLength: 0, maxLength: 4096 })),
+  customUserAgent: t.Optional(t.Nullable(t.String({ minLength: 0, maxLength: 4096 }))),
 });
 
 

package/src/console/providers/detail/store.ts

@@ -41,6 +41,7 @@ function mapRow(row: typeof providerRoutingSettings.$inferSelect): ProviderRouti
     enabled: row.enabled,
     skipProxy: row.skipProxy,
     userAgent: row.userAgent,
+    customUserAgent: row.customUserAgent,
   };
 }
 
@@ -94,6 +95,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
       enabled: false,
       skipProxy: defaultSkipProxy(providerId),
       userAgent: buildClaudeCliUserAgent(),
+      customUserAgent: null,
     };
   }
   async updateRouting(
@@ -116,6 +118,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
       enabled: patch.enabled ?? false,
       skipProxy: patch.skipProxy ?? defaultSkipProxy(providerId),
       userAgent: patch.userAgent ?? buildClaudeCliUserAgent(),
+      customUserAgent: patch.customUserAgent ?? null,
     };
     const setClause: Record<string, unknown> = {};
     if (patch.strategy !== undefined) setClause.strategy = patch.strategy;
@@ -128,6 +131,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
     if (patch.enabled !== undefined) setClause.enabled = patch.enabled;
     if (patch.skipProxy !== undefined) setClause.skipProxy = patch.skipProxy;
     if (patch.userAgent !== undefined) setClause.userAgent = patch.userAgent;
+    if (patch.customUserAgent !== undefined) setClause.customUserAgent = patch.customUserAgent;
     const upserted = await this.db
       .insert(providerRoutingSettings)
       .values(values)

package/src/console/quota/account-quota-tenant.ts

@@ -48,6 +48,11 @@ import {
   fetchQoderDailyCheckin,
   isQoderCheckinProvider,
 } from "../../providers/integrations/qoder/qoder-checkin";
+import {
+  claimQoderCredits,
+  QODER_CREDIT_PROVIDER_IDS,
+  type QoderCreditClaimResult,
+} from "../../providers/integrations/qoder/claim-qoder-credits";
 import {
   DrizzleQoderNativeIdentityStore,
   type QoderNativeIdentityStore,
@@ -1136,6 +1141,75 @@ export function registerAccountQuotaTenantRoutes(
                 : (result.detail ?? "Claim it in the ZCode app"),
       };
     })
+    // Qoder daily-credits claim is likewise an explicit operator action: the
+    // CREDITS campaign only surfaces with the real UMID headers, so the claim
+    // mints/binds a native identity first (same store the check-in worker uses).
+    .post("/accounts/:id/claim-qoder-credits", async ({ request, params, set }) => {
+      const access = requireTenantScope(accessResolver(request), "dashboard:write");
+      const rows = await db
+        .select()
+        .from(providerAccounts)
+        .where(
+          and(eq(providerAccounts.id, params.id), eq(providerAccounts.tenantId, access.tenantId)),
+        )
+        .limit(1);
+      const account = rows[0];
+      if (!account) {
+        set.status = 404;
+        return { error: `Account ${params.id} not found`, code: "not_found" };
+      }
+      if (!QODER_CREDIT_PROVIDER_IDS.includes(account.providerId as (typeof QODER_CREDIT_PROVIDER_IDS)[number])) {
+        set.status = 400;
+        return {
+          error: "Daily credits are only claimable for qoder accounts",
+          code: "qoder_credits_unsupported",
+        };
+      }
+      let result: QoderCreditClaimResult;
+      try {
+        const credential = await refreshDeps.resolveCredential(account.providerId as ProviderId, account.id);
+        const fetcher = networkBindingFactory
+          ? await dailyCheckinEgressForPass({ db, networkBindingFactory })(account.id, access.tenantId)
+          : globalThis.fetch;
+        result = await claimQoderCredits({ db, providerId: account.providerId, accountId: account.id, credential, fetcher });
+      } catch {
+        set.status = 502;
+        return {
+          ok: false, status: 502,
+          data: { id: account.id, state: "error", amount: 0, detail: "Qoder credit claim request failed" },
+          message: "Qoder credit claim request failed", code: "qoder_credit_claim_failed",
+        };
+      }
+      if (result.state === "claimed") {
+        // Cold readers must not resurrect the balance from before the grant.
+        await db.update(providerAccounts).set({ quotaSnapshot: null }).where(
+          and(eq(providerAccounts.id, account.id), eq(providerAccounts.tenantId, access.tenantId)),
+        );
+        await invalidateQuotaCacheForAccount(account.id, redis);
+        await snapshotInvalidator?.invalidate();
+      }
+      if (result.state === "error") {
+        set.status = 502;
+        return {
+          ok: false,
+          status: 502,
+          data: { id: account.id, ...result },
+          message: result.detail ?? "Qoder credit claim failed",
+          code: "qoder_credit_claim_failed",
+        };
+      }
+      return {
+        ok: true,
+        status: 200,
+        data: { id: account.id, ...result },
+        message:
+          result.state === "nothing"
+            ? "No CREDITS campaign to claim"
+            : result.state === "claimed"
+              ? `Claimed ${result.amount} credits`
+              : "CREDITS campaign already claimed",
+      };
+    })
     .post("/accounts/:id/activity-report", async ({ request, params, set }) => {
       const access = requireTenantScope(accessResolver(request), "dashboard:write");
       const rows = await db

package/src/console/share/share-stats.ts

@@ -371,11 +371,9 @@ async function computeFamilyStatsBody(
       .where(eq(apiKeys.id, templateKeyId))
       .limit(1),
   ]);
-  // Cumulative family spend: the template's own counter plus the telemetry
-  // total. The counter is a manually-configured seed (an operator limit), not
-  // traffic, and it is never reset; azmetry rows for revoked/deleted children
-  // likewise stay counted, so the running total is monotonic and consistent
-  // across the overview, the share dialog, and this page.
+  // Cumulative family spend: the template's own counter is the live
+  // accumulator (updated by every recipient commit), so it IS the total.
+  // Telemetry still drives the bounded daily/monthly windows below.
   const templateLifetime = Number(template[0]?.lifetime ?? 0);
 
   // The ranked tables need real events, bounded to the 24-hour window. The
@@ -398,10 +396,10 @@ async function computeFamilyStatsBody(
   });
   rollup.totals = {
     ...rollup.totals,
-    // The template counter is the seed on the running total, not a distinct
-    // bucket: daily/monthly windows are telemetry-only (the counter has no
-    // time axis), so those keep their own sums.
-    totalTokens: templateLifetime + kpi.tokens,
+    // The template counter IS the running family total (live accumulator).
+    // Daily/monthly windows stay telemetry-only (the counter has no time
+    // axis), so those keep their own sums.
+    totalTokens: templateLifetime,
     todayTokens,
     monthTokens,
     // Lifetime counts come from the durable rollup, not the page: a family

package/src/observability/event-log.ts

@@ -57,6 +57,12 @@ export interface TelemetryEventRecord {
   readonly lastEventAtMs: number | null;
   /** Why the drawer payloads are empty, or `captured`; absent when unrecorded. */
   readonly payloadCaptureState?: string | null;
+  /**
+   * True for a completed request whose output was far smaller than the model's
+   * ceiling and which ended with an ordinary `stop` (a "degenerate stop").
+   * NULL/unset for everything else.
+   */
+  readonly degenerateStop?: boolean;
 }
 
 function asString(value: unknown): string | null {
@@ -109,6 +115,7 @@ function normalize(raw: Record<string, unknown>): TelemetryEventRecord | undefin
     tokensPerSec: asNumber(raw["tokensPerSec"]),
     firstContentDeltaAtMs: asNumber(raw["firstContentDeltaAtMs"]),
     lastEventAtMs: asNumber(raw["lastEventAtMs"]),
+    ...(raw["degenerateStop"] === true ? { degenerateStop: true } : {}),
   };
 }
 

package/src/observability/event-query.ts

@@ -184,6 +184,7 @@ function eventRecordFromRow(row: {
   readonly firstContentDeltaAtMs: number | null;
   readonly lastEventAtMs: number | null;
   readonly payloadCaptureState: string | null;
+  readonly degenerateStop: boolean | null;
 }): TelemetryEventRecord {
   return {
     id: row.id ?? row.requestId,
@@ -219,6 +220,7 @@ function eventRecordFromRow(row: {
     firstContentDeltaAtMs: row.firstContentDeltaAtMs,
     lastEventAtMs: row.lastEventAtMs,
     payloadCaptureState: row.payloadCaptureState,
+    ...(row.degenerateStop === true ? { degenerateStop: true } : {}),
   };
 }
 

package/src/observability/telemetry-buffer.ts

@@ -65,6 +65,12 @@ export interface TelemetryEventInput {
    * list instead of needing the server's logs.
    */
   readonly payloadCaptureState?: string;
+  /**
+   * True for a completed request whose output was far smaller than the model's
+   * ceiling and which ended with an ordinary `stop` (a "degenerate stop").
+   * Carried onto the telemetry row so this pattern can be measured.
+   */
+  readonly degenerateStop?: boolean;
 }
 
 function tokenCountToInt(value: number | "unavailable" | undefined): number | undefined {
@@ -147,7 +153,8 @@ function telemetryEventRow(event: TelemetryEventInput) {
       event.usage?.estimated_cost === null || event.usage === undefined
         ? null
         : String(event.usage.estimated_cost),
-    // Buddy-meter credit; NULL when the upstream reported no credit field.
+    // Provider-billed credit (Tencent buddy-meter `credit`, Qoder `credits`);
+    // NULL when the upstream reported no credit field.
     // Numeric columns are string-typed in Drizzle, like `estimatedCostUsd`.
     creditUsed: event.usage?.credit_used != null ? String(event.usage.credit_used) : null,
     resolveMs: event.resolveMs ?? null,
@@ -155,6 +162,7 @@ function telemetryEventRow(event: TelemetryEventInput) {
     firstContentDeltaAtMs: event.firstContentDeltaAtMs ?? null,
     lastEventAtMs: event.lastEventAtMs ?? null,
     payloadCaptureState: event.payloadCaptureState ?? null,
+    degenerateStop: event.degenerateStop ?? null,
   };
 }
 

package/src/persistence/boot.ts

@@ -11,18 +11,27 @@ import { applySqlMigrations, createPgHandle, getPool, isPgHandle } from "./db-pg
 import { applySqliteMigrations, buildSqliteHandle, createSqliteDatabase } from "./db-sqlite";
 
 /**
- * True when `error` is a Postgres unique-violation (SQLSTATE 23505).
+ * True when `error` is a unique-violation from either supported dialect:
+ *
+ * - Postgres: SQLSTATE 23505 (`code: "23505"`).
+ * - SQLite: `UNIQUE constraint failed: <index>` (message text) or the
+ *   driver's `SQLITE_CONSTRAINT_UNIQUE` code (19).
  *
  * Lives at the persistence boundary because it is a fact about the driver's
  * error shape, not about any one domain. It walks a bounded `cause` chain
- * because Drizzle wraps driver errors, so the SQLSTATE is not always on the
- * error the caller catches.
+ * because Drizzle wraps driver errors, so the code/message is not always on
+ * the error the caller catches.
  */
 export function isUniqueViolation(error: unknown): boolean {
   let current: unknown = error;
   for (let depth = 0; depth < 3; depth += 1) {
     if (typeof current !== "object" || current === null) return false;
-    if ("code" in current && current.code === "23505") return true;
+    const record = current as { code?: unknown; message?: unknown };
+    const code = typeof record.code === "string" ? record.code : "";
+    const message = typeof record.message === "string" ? record.message : "";
+    if (code === "23505" || code === "SQLITE_CONSTRAINT_UNIQUE") return true;
+    if (message.includes("UNIQUE constraint failed:")) return true;
+    if (code === "19" && message.includes("constraint")) return true;
     if (!("cause" in current)) return false;
     current = current.cause;
   }

package/src/persistence/schema.ts

@@ -793,6 +793,12 @@ export const providerRoutingSettings = pgTable(
     // row that never set one is `buildClaudeCliUserAgent()` in
     // providers/operations/custom-cli-headers.ts, which this mirrors.
     userAgent: text("user_agent").notNull().default("claude-cli/2.1.293 (external, cli)"),
+    // Operator-set custom User-Agent, stored separately from the provider's
+    // native client identity (`user_agent`). NULL = no override — dispatch
+    // uses the native identity. A non-NULL value is an explicit override
+    // applied at the request edge, even when the provider would otherwise
+    // stamp its own identity.
+    customUserAgent: text("custom_user_agent"),
     // When true, this provider's requests always dial direct. When false,
     // dispatch automatically selects among every active network pool the
     // tenant owns (least-loaded/non-cooldown) — never an admin-pinned pool.
@@ -1458,7 +1464,7 @@ export const telemetryEvents = pgTable(
     outputTokens: integer("output_tokens"),
     reasoningTokens: integer("reasoning_tokens"),
     estimatedCostUsd: numeric("estimated_cost_usd", { precision: 12, scale: 6 }),
-    /** Provider-billed credits (Tencent buddy-meter `credit`); NULL when unreported. */
+    /** Provider-billed credits (Tencent buddy-meter `credit`, Qoder `credits`); NULL when unreported. */
     creditUsed: numeric("credit_used", { precision: 12, scale: 4 }),
     /**
      * Gateway-side time before the upstream dispatch began: routing,
@@ -1483,6 +1489,14 @@ export const telemetryEvents = pgTable(
      * tell "not configured" from "broken".
      */
     payloadCaptureState: text("payload_capture_state"),
+    /**
+     * Set for a completed request whose output is far smaller than what the
+     * model can produce AND which the model ended with an ordinary `stop`
+     * (a "degenerate stop"). Introduced to measure how often a model
+     * truncates itself on a cached prefix — the pattern that surfaced as
+     * short, cut-off chat replies. NULL/unset for everything else.
+     */
+    degenerateStop: boolean("degenerate_stop"),
   },
   (table) => [
     index("telemetry_events_created_at_idx").on(table.createdAt),

package/src/persistence/stores/api-key-store.ts

@@ -1,6 +1,6 @@
 // Persisted API-key store: the console API-key domain and gateway authentication both consume this boundary.
 
-import { and, asc, count, desc, eq, inArray, isNotNull, isNull, lte, or, sql, type SQL } from "drizzle-orm";
+import { and, asc, count, desc, eq, gt, inArray, isNotNull, isNull, lte, or, sql, type SQL } from "drizzle-orm";
 import { nextSortIndex, reorderSortIndex, type SortOrderDb } from "../sort-order";
 import { getDbHandle } from "../boot";
 import type { CartethyiaDatabase } from "../db-handle";
@@ -253,6 +253,8 @@ async function writeSharePopup(
 /** Explicit persistence boundary. Production must provide this; there is no fallback store. */
 export interface ApiKeyStore {
   list(tenantId: string): Promise<readonly ApiKeyRecord[]>;
+  /** Active, non-revoked bans for one tenant, including share children. */
+  listActiveBanned(tenantId: string): Promise<readonly ApiKeyRecord[]>;
   get(tenantId: string, keyId: string): Promise<ApiKeyRecord | undefined>;
   listChildren(tenantId: string, parentKeyId: string): Promise<readonly ApiKeyRecord[]>;
   revokeChildrenByScope(
@@ -382,6 +384,22 @@ export class DrizzleApiKeyStore implements ApiKeyStore {
       .limit(1000);
     return this.withPopups(this.db, rows);
   }
+  async listActiveBanned(tenantId: string): Promise<readonly ApiKeyRecord[]> {
+    const now = new Date();
+    const rows = await this.db
+      .select()
+      .from(apiKeys)
+      .where(
+        and(
+          eq(apiKeys.tenantId, tenantId),
+          isNotNull(apiKeys.bannedAt),
+          isNull(apiKeys.revokedAt),
+          or(isNull(apiKeys.bannedUntil), gt(apiKeys.bannedUntil, now)),
+        ),
+      )
+      .orderBy(desc(apiKeys.bannedAt), apiKeys.id);
+    return rows.map((row) => this.map(row));
+  }
 
   /** Rewrites the list order for one tenant; `keyIds` is the full order. */
   async reorder(tenantId: string, keyIds: readonly string[]): Promise<void> {

package/src/protocol/canonical-model.ts

@@ -370,6 +370,13 @@ export interface CanonicalTerminalEvent {
   readonly response_id?: string;
   /** Event timestamp in milliseconds since epoch (optional for profiling). */
   readonly timestamp?: number;
+  /**
+   * Provider-specific upstream metadata about the model that actually served
+   * the turn — its native model id, supply target, tier, etc. Not a client
+   * surface: probes read it to report what the upstream really ran when the
+   * transport's model echo is an opaque id.
+   */
+  readonly provider_metadata?: Record<string, unknown>;
   /**
    * Set by an adapter whose turn is not finished: the stream ended because the
    * model asked for a tool the client must answer, and the provider's

package/src/protocol/dsml.ts

@@ -3,21 +3,11 @@
  *
  * DeepSeek-family models occasionally write their tool calls as XML-like DSML
  * markup inside the plain-text content stream instead of the structured
- * `tool_calls` field. Two upstream families in this gateway see it:
+ * `tool_calls` field. The gateway sees it from one upstream family:
  *
  * - CodeBuddy/WorkBuddy emit strict blocks (`<｜DSML｜ calls>…</｜DSML｜ calls>`)
  *   that must be parsed exactly, with declared-tool allowlisting.
- * - Qoder emits looser blocks (`<[^>]*DSML[^>]*calls>…`) that tolerate any
- *   intermediate characters in the tag, and its parameter values are plain
- *   strings.
- *
- * The two share the same recovery idea, so the mechanics live here once and
- * each caller picks its dialect through options. The defaults reproduce the
- * CodeBuddy dialect exactly (`app/dsml.py` in codebuddy2api); Qoder passes
- * `fuzzy: true` and its id factory, mirroring `qoder_proxy.py`.
  */
-import { randomUUID } from "node:crypto";
-
 export interface DsmlToolCall {
   readonly id: string;
   readonly name: string;
@@ -34,19 +24,15 @@ export interface DsmlParseOptions {
   readonly separators?: readonly string[];
   /** Block names a strict opener may name. */
   readonly blockNames?: readonly string[];
-  /** When true, match the Qoder fuzzy form (`<[^>]*DSML[^>]*…`). */
-  readonly fuzzy?: boolean;
-  /** How parameter values decode: `json` (CodeBuddy) or `string` (Qoder). */
+  /** How parameter values decode: `json` (CodeBuddy) or `string`. */
   readonly params?: "json" | "string";
-  /** Call id factory. Defaults to sequential for strict, uuid for fuzzy. */
+  /** Call id factory. Defaults to sequential. */
   readonly id?: (call: { readonly name: string }, index: number, seq: number) => string;
   /** Non-empty allowlist makes the strict dialect reject undeclared names. */
   readonly allowedNames?: ReadonlySet<string>;
   /**
    * When true, JSON stringifies argument objects with recursively sorted keys,
-   * matching the reference bridge (`json.dumps(..., sort_keys=True)`). The
-   * strict dialect defaults to true; the fuzzy dialect never sorts, matching
-   * its reference's `json.dumps(params)`.
+   * matching the reference bridge (`json.dumps(..., sort_keys=True)`).
    */
   readonly sortKeys?: boolean;
   /**
@@ -75,10 +61,6 @@ function sequentialId(_call: { readonly name: string }, _index: number, seq: num
   return `call_dsml_${seq}_${_call.name}`;
 }
 
-function uuidId(_call: { readonly name: string }, _index: number, _seq: number): string {
-  return `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-}
-
 interface DsmlParseResult {
   readonly text: string;
   readonly calls: readonly DsmlToolCall[];
@@ -257,63 +239,11 @@ function normalizeForSort(value: unknown): unknown {
   return out;
 }
 
-/** The Qoder fuzzy block scanner, mirroring the reference bridge's regexes. */
-const FUZZY_CALLS_RE = /<[^>]*DSML[^>]*calls>([\s\S]*?)<\/[^>]*DSML[^>]*calls>/;
-const FUZZY_INVOKE_RE = /<[^>]*DSML[^>]*invoke\s+name=["']([^"']+)["']>([\s\S]*?)<\/[^>]*invoke>/g;
-const FUZZY_PARAM_RE = /<[^>]*DSML[^>]*parameter\s+name=["']([^"']+)["'][^>]*>([\s\S]*?)<\/[^>]*parameter>/g;
-
-function parseFuzzyDsml(text: string, options: DsmlParseOptions): DsmlRecovery {
-  const id = options.id ?? uuidId;
-  if (text.length === 0 || !text.includes("DSML")) return { calls: [], clean: text };
-
-  const callsMatch = FUZZY_CALLS_RE.exec(text);
-  let block: string;
-  let clean: string;
-
-  if (callsMatch) {
-    block = callsMatch[1] ?? "";
-    const before = text.slice(0, callsMatch.index).trimEnd();
-    const after = text.slice(callsMatch.index + callsMatch[0].length).trimStart();
-    clean = (before + " " + after).trim();
-  } else {
-    // No <calls> wrapper (issue #51): find bare <invoke> blocks in the whole
-    // text, then cut the prose off at the last `<` before the first invoke —
-    // exclusive of the invoke's own tag start, exactly like the reference's
-    // `text.rfind("<", 0, first_index)`.
-    FUZZY_INVOKE_RE.lastIndex = 0;
-    const first = FUZZY_INVOKE_RE.exec(text);
-    if (!first) return { calls: [], clean: text };
-    block = text;
-    const cut = text.lastIndexOf("<", first.index - 1);
-    clean = text.slice(0, cut >= 0 ? cut : first.index).trim();
-  }
-
-  const calls: DsmlToolCall[] = [];
-  FUZZY_INVOKE_RE.lastIndex = 0;
-  let inv: RegExpExecArray | null;
-  let seq = 0;
-  while ((inv = FUZZY_INVOKE_RE.exec(block)) !== null) {
-    const params: Record<string, string> = {};
-    FUZZY_PARAM_RE.lastIndex = 0;
-    let par: RegExpExecArray | null;
-    while ((par = FUZZY_PARAM_RE.exec(inv[2] ?? "")) !== null) {
-      params[par[1] ?? ""] = (par[2] ?? "").trim();
-    }
-    const call = { name: inv[1] ?? "", arguments: JSON.stringify(params) };
-    calls.push({ ...call, id: id(call, calls.length, seq++) });
-  }
-
-  return { calls, clean };
-}
-
 /**
- * Recovers DSML tool calls from one plain-text string. The dialect is chosen
- * by `options.fuzzy`; each dialect keeps its exact public shape:
+ * Recovers DSML tool calls from one plain-text string.
  *
  * - strict (CodeBuddy): returns `{ text, calls }`, with `text` the clean
  *   prose; `undefined` when nothing was recovered.
- * - fuzzy (Qoder): returns `{ clean, calls }`, with no-DSML input returning
- *   `{ calls: [], clean: text }`.
  *
  * Callers that need the streaming strict parser use {@link DsmlStreamParser}.
  */
@@ -321,7 +251,6 @@ export function parseDsmlToolCalls(
   text: string,
   options: DsmlParseOptions = {},
 ): DsmlRecovery | DsmlParseResult | undefined {
-  if (options.fuzzy === true) return parseFuzzyDsml(text, options);
   if (!text.includes("DSML")) return undefined;
   const parser = new DsmlStreamParser(options);
   const first = parser.push(text);

package/src/protocol/request/gemini.ts

@@ -287,7 +287,26 @@ export function buildGeminiPayload(
     });
   const payload: Record<string, unknown> = { contents };
   if (systemParts.length > 0) payload["systemInstruction"] = { role: "user", parts: systemParts };
-  const functionTools = (request.tools ?? []).filter((t) => t.name);
+  // Gemini's native hosted tools are declared as bare object keys, not
+  // function declarations: `{ googleSearch: {} }` (and codeExecution/urlContext)
+  // enable Google-backed grounding. Accept both spellings the gateway's search
+  // adapters use (`web_search` tool_type and `googleSearch` name) and map them
+  // to the native declaration so the upstream actually grounds the query.
+  const HOSTED_TOOL_NAMES = new Set(["googleSearch", "codeExecution", "urlContext"]);
+  const hostedTools: Record<string, Record<string, unknown>>[] = [];
+  for (const tool of request.tools ?? []) {
+    if (tool.name === "googleSearch" || tool.tool_type === "web_search") {
+      hostedTools.push({ googleSearch: {} });
+    } else if (tool.name === "codeExecution") {
+      hostedTools.push({ codeExecution: {} });
+    } else if (tool.name === "urlContext") {
+      hostedTools.push({ urlContext: {} });
+    }
+  }
+  const functionTools = (request.tools ?? []).filter(
+    (t) => t.name && !HOSTED_TOOL_NAMES.has(t.name) && t.tool_type !== "web_search",
+  );
+  if (hostedTools.length > 0) payload["tools"] = hostedTools;
   if (functionTools.length > 0) {
     payload["tools"] = [
       {

package/src/protocol/tool-identity.ts

@@ -73,9 +73,23 @@ export function trackToolCall(
   fallbackIndex?: number,
 ): { index: number; isFirst: boolean; state: ToolCallState } {
   const priorIndex = tracker.indexById.get(tool.id);
+  // A wire index is only honored when this id already owns it, or when it is
+  // not yet claimed by another call. Upstream Qoder parallel calls frequently
+  // repeat the same wire index (0,0) for different ids, which would otherwise
+  // collapse two calls into one at the encoder (`Map` keyed by index). When
+  // the wire index collides with another id, synthesize a fresh index so every
+  // logical call keeps a distinct wire position.
   const index =
     tool.index !== undefined && Number.isInteger(tool.index) && tool.index >= 0
-      ? tool.index
+      ? (() => {
+          if (priorIndex !== undefined) return priorIndex;
+          for (const [id, assigned] of tracker.indexById) {
+            if (id !== tool.id && assigned === tool.index) {
+              return tracker.nextIndex++;
+            }
+          }
+          return tool.index;
+        })()
       : (priorIndex ?? fallbackIndex ?? tracker.nextIndex++);
   tracker.indexById.set(tool.id, index);
   tracker.nextIndex = Math.max(tracker.nextIndex, index + 1);

package/src/providers/adapters/compatible-adapter.ts

@@ -28,6 +28,19 @@ import {
 } from "../../protocol/codecs";
 const TEXT_DECODER = new TextDecoder("utf-8", { fatal: false });
 
+/**
+ * Provider ids that understand the OpenAI-style `service_tier` control. Only
+ * these upstreams accept the field; every other OpenAI-compatible provider
+ * either ignores it or rejects the whole request with `unsupported_value`
+ * (measured: GitHub Copilot returns 400). `service_tier` is advisory on the
+ * providers that do support it, so dropping it elsewhere is lossless.
+ */
+const SERVICE_TIER_SUPPORTED_PROVIDERS: ReadonlySet<string> = new Set([
+  "openai",
+  "codex",
+  "anthropic",
+]);
+
 /**
  * The subset of a canonical request a native-service header hook may read.
  *
@@ -279,6 +292,18 @@ export class OpenAICompatibleAdapter extends BaseProviderAdapter {
       }
     }
     this.config.prePayload?.(payload, effectiveRequest, candidate, context);
+    // `service_tier` is an OpenAI-style control that only a small set of
+    // upstreams understand. Every other OpenAI-compatible provider either
+    // ignores it silently or rejects the whole request with
+    // `unsupported_value` (measured: GitHub Copilot returns 400). Since the
+    // field is purely advisory on the providers that support it, dropping it
+    // everywhere else is safe and prevents avoidable upstream 400s.
+    if (
+      payload["service_tier"] !== undefined &&
+      !SERVICE_TIER_SUPPORTED_PROVIDERS.has(candidate.provider_id)
+    ) {
+      delete payload["service_tier"];
+    }
     return payload;
   }
 
@@ -429,12 +454,15 @@ export class OpenAICompatibleAdapter extends BaseProviderAdapter {
       // the absence of every completion shape so a provider that merely
       // echoes an `error` field alongside real output is not misread.
       const envelopeError = json["error"];
+      const startPlanError = this.provider_id === "zcode-start" &&
+        (json["success"] === false || (json["code"] !== undefined &&
+          ![0, 200, "0", "200"].includes(json["code"] as string | number)));
       const hasCompletionShape =
         json["choices"] !== undefined ||
         json["output"] !== undefined ||
         json["content"] !== undefined ||
         json["candidates"] !== undefined;
-      if (envelopeError !== undefined && envelopeError !== null && !hasCompletionShape) {
+      if (((envelopeError !== undefined && envelopeError !== null) || startPlanError) && !hasCompletionShape) {
         const errorObject = isRecord(envelopeError) ? envelopeError : json;
         const identifier = upstreamErrorIdentifier(json);
         const providerStatus = [