cartethyia 2.7.5 → 2.7.7

package/src/providers/integrations/qoder/qoder-adapter.ts

@@ -0,0 +1,275 @@
+/**
+ * Qoder adapter — transport selection, credential resolution, dispatch.
+ *
+ * Surface contract (2026-11-05):
+ * - `grpc` (default, production): `model.chat.ChatService/ChatCompletionStream`
+ *   — the only proven carrier of real 1M-token context (HTTP IDE caps at
+ *   ~256 KiB). Serves billed rows; a free-tier row (`lite`) is refused there
+ *   (`quota exceeded` 116) and must use legacy COSY.
+ * - `cosy` (free/lite + forced legacy): `/algo/.../agent_chat_generation` —
+ *   the only surface that accepts free-tier rows. Signing is the COSY Bearer
+ *   scheme (AES/RSA + alphabet-scrambled body).
+ * - `ide` (`/model/v1/chat/completions`): **probe/testing only — never
+ *   production.** It is the only surface that echoes strategy metadata
+ *   (`raw_usage` → provider_model/target) and it streams immediately, but its
+ *   ~256 KiB body cap cannot carry the 1M window the roster declares. Dispatch
+ *   reaches it only when `probe_surface: "ide"` is set (discovery probes) or
+ *   the option `surface: "ide"` is forced explicitly for local testing.
+ */
+import { randomUUID } from "node:crypto";
+import { GatewayError } from "../../../protocol/gateway-error";
+import type { CanonicalEvent, CanonicalRequest } from "../../../protocol/canonical-model";
+import {
+  assertWireFamily,
+  readCredentialSecret,
+  type ProviderAdapter,
+  type ProviderDispatchContext,
+  type ProviderDispatchTarget,
+  type ProviderId,
+} from "../../provider-contracts";
+import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
+import { getQoderVersion } from "../../operations/client-versions";
+import { qoderMachineHostname, qoderMachineOs } from "../../operations/cli-platform";
+import { mapUpstreamHttpError } from "../../../transport/failure-policy";
+import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS, qoderDiscoveredMaxContexts } from "./qoder-catalog";
+import { isQoderVirtualModel, qoderDispatchModelId } from "./qoder-virtual";
+import { isQoderPat, qoderOAuthAuth, qoderSessionId, resolveQoderAuth } from "./qoder-auth";
+import { buildQoderRequest, callQoder } from "./qoder-chat";
+import { buildQoderGrpcRequest, qoderGrpcMetadata, qoderGrpcToCanonicalEvents } from "./qoder-grpc";
+import { buildQoderIdeRequest, qoderBodyToCanonicalEvents } from "./qoder-ide";
+import {
+  QODER_CHAT_PATH,
+  QODER_PROVIDER_ID,
+  qoderIdeChatUrl,
+  qoderInferenceCandidates,
+  type QoderRealm,
+} from "./qoder-realm";
+import type { QoderModelConfig } from "./qoder-types";
+
+interface QoderAdapterOptions {
+  readonly fetch?: typeof fetch;
+  /** Which deployment this adapter dispatches to. Defaults to intl. */
+  readonly realm?: QoderRealm;
+  /** Bundled provider id, so the adapter's own id matches the route's. */
+  readonly providerId?: string;
+  /**
+   * Which chat transport to dispatch on.
+   *
+   * `grpc` (default) uses the gRPC model-server surface
+   * (`model.chat.ChatService/ChatCompletionStream`) — the only proven carrier
+   * of real 1M-token context (the HTTP IDE surface caps at ~256 KiB). gRPC
+   * serves billed models; a free-tier row (`lite`) is refused there
+   * (`quota exceeded` 116) and must use the legacy COSY surface.
+   *
+   * `cosy` forces only the legacy surface (`/algo/.../agent_chat_generation`)
+   * — the free-tier path and the pre-gRPC behavior.
+   *
+   * `ide` forces the modern `/model/v1` surface — **probe/testing only, never
+   * production** (see module doc).
+   */
+  readonly surface?: "grpc" | "cosy" | "ide";
+}
+
+/** Resolves the transport for one dispatch. Exported for tests. */
+export function resolveQoderTransport(
+  surface: "grpc" | "cosy" | "ide" | undefined,
+  modelConfig: QoderModelConfig,
+): "grpc" | "cosy" | "ide" {
+  const chosen = surface ?? "grpc";
+  // `ide` is an explicit testing override — never auto-selected, and it does
+  // not apply the free-tier rule (a forced IDE call is a test call).
+  if (chosen === "ide") return "ide";
+  // Free-tier rows (`lite`) are refused on gRPC with `quota exceeded` (116);
+  // they must use the legacy COSY surface.
+  if (chosen === "grpc" && modelConfig.is_free === true) return "cosy";
+  return chosen;
+}
+
+/**
+ * The widest selectable context window for one model key (from the live list's
+ * `context_config`; falls back to the static roster's stated window).
+ */
+function qoderMaxContextFor(modelId: string, modelConfig: QoderModelConfig, realm: QoderRealm): number {
+  const discovered = qoderDiscoveredMaxContexts(realm).get(modelId);
+  if (discovered !== undefined) return discovered;
+  return modelConfig.max_input_tokens;
+}
+
+class QoderAdapter implements ProviderAdapter {
+  readonly provider_id: ProviderId;
+  private readonly realm: QoderRealm;
+  private readonly surface: "grpc" | "cosy" | "ide";
+  private readonly fetchFn: typeof fetch;
+
+  constructor(options: QoderAdapterOptions = {}) {
+    this.provider_id = (options.providerId ?? QODER_PROVIDER_ID) as ProviderId;
+    this.realm = options.realm ?? "intl";
+    this.surface = options.surface ?? "grpc";
+    this.fetchFn = options.fetch ?? globalThis.fetch;
+  }
+
+  /**
+   * The static roster for this adapter's realm.
+   *
+   * A single merged table advertised CN-only keys to global accounts and vice
+   * versa, so a request was routed to a deployment that refuses it.
+   */
+  #modelConfigs(): Record<string, QoderModelConfig> {
+    return (this.realm === "cn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS) as Record<
+      string,
+      QoderModelConfig
+    >;
+  }
+
+  async *dispatch(
+    request: CanonicalRequest,
+    candidate: ProviderDispatchTarget,
+    context: ProviderDispatchContext,
+  ): AsyncIterable<CanonicalEvent> {
+    if (candidate.wire_family !== "chat") {
+      assertWireFamily(candidate, "chat", "qoder");
+    }
+    const secret = readCredentialSecret(context.credential, "Qoder credential is required");
+
+    /**
+     * A caller-facing virtual name is translated to its roster key here.
+     *
+     * The translation has to happen before the config lookup and before the
+     * request body: the body carries the roster key, and looking up the
+     * virtual id in the config table would fall through to the synthetic
+     * default and silently dispatch under-declared capabilities.
+     */
+    const requestedModelId = candidate.model_id || request.model;
+    if (isQoderVirtualModel(requestedModelId) && !this.#modelConfigs()[qoderDispatchModelId(requestedModelId)]) {
+      throw new GatewayError(
+        "model_not_found",
+        404,
+        `Qoder virtual model ${requestedModelId} resolves to a roster key this realm does not serve (request {requestId}). Try another model — this one's off the menu 📚`,
+        { virtual_model: requestedModelId, target: qoderDispatchModelId(requestedModelId) },
+        "upstream",
+      );
+    }
+    const modelId = qoderDispatchModelId(requestedModelId);
+    const modelConfig = this.#modelConfigs()[modelId] ?? {
+      id: modelId,
+      display_name: modelId,
+      max_input_tokens: 180_000,
+      is_vl: true,
+      is_reasoning: false,
+    };
+
+    const lifecycle = createUpstreamDeadlineLifecycle(context);
+
+    // Outbound fetch respects SSRF binding when provided
+    const outboundFetch: typeof fetch = (context.outbound_fetch as unknown as typeof fetch) ?? this.fetchFn;
+
+    const fetcher: (url: string, init: RequestInit) => Promise<Response> = (url, init) =>
+      outboundFetch(url, { ...init, signal: lifecycle.signal } as RequestInit) as Promise<Response>;
+
+    try {
+      const version = getQoderVersion();
+      // Dual mode like Cline: a pasted PAT is exchanged for a job token per
+      // request, while an OAuth device token is used directly with the
+      // identity the login persisted.
+      const auth = isQoderPat(secret)
+        ? await resolveQoderAuth({ secret, authState: context.credential.auth_state, signal: lifecycle.signal, fetcher, realm: this.realm })
+        : qoderOAuthAuth(secret, context.credential.auth_state, context.credential.account_id);
+
+      // Transport selection — see module doc for the surface contract.
+      const forceIde = this.surface === "ide" || candidate.probe_surface === "ide";
+      const useGrpc = !forceIde && resolveQoderTransport(this.surface, modelConfig) === "grpc";
+
+      if (forceIde) {
+        const ideUrl = qoderIdeChatUrl(this.realm);
+        const ideBody = buildQoderIdeRequest(modelId, request, modelConfig, auth, this.realm, version);
+        // Header fingerprint mirrors the desktop client's IDE surface (`PFn` /
+        // `Hc`): X-Request-ID normalized to uppercase, Cosy-Version, real
+        // machine OS, and the sanitized hostname on infer SSE requests. The
+        // User-Agent is the real IDE client's (`Bun/1.4.4`, live capture) and
+        // `X-Session-ID` matches the body's session id (sha256 userId:model).
+        const ideHostname = qoderMachineHostname();
+        const res = await fetcher(ideUrl, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${auth.securityOauthToken}`,
+            "Content-Type": "application/json",
+            Accept: "text/event-stream",
+            "User-Agent": "Bun/1.4.4",
+            "X-Request-ID": randomUUID().toUpperCase(),
+            "X-Session-ID": qoderSessionId(auth.userId, modelId),
+            "Cosy-Version": version,
+            "Cosy-ClientType": "5",
+            "Cosy-MachineOS": qoderMachineOs(),
+            ...(ideHostname.length > 0 ? { "Cosy-MachineHostname": ideHostname } : {}),
+          },
+          body: JSON.stringify(ideBody),
+        });
+        if (!res.ok) throw await mapUpstreamHttpError(res, "qoder");
+        if (!res.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+        lifecycle.release();
+        yield* qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId);
+        return;
+      }
+
+      if (useGrpc) {
+        // The gRPC request mirrors the HTTP surfaces' OpenAI-shaped body, so
+        // the shared builder supplies the messages, tool declarations, and
+        // tool-choice knobs both surfaces expect. Without the `tools` array
+        // the upstream sees no toolset and answers with a DSML text block (or
+        // claims no tool exists) instead of a structured `tool_calls`.
+        const legacy = buildQoderRequest(modelId, request, modelConfig, auth, this.realm);
+        const grpcRequest = buildQoderGrpcRequest(
+          modelId,
+          request,
+          auth.userId,
+          qoderMaxContextFor(modelId, modelConfig, this.realm),
+          {
+            messages: legacy.messages as Array<Record<string, unknown>>,
+            tools: legacy.tools as Array<Record<string, unknown>>,
+            ...(legacy.parameters === undefined
+              ? {}
+              : { parameters: legacy.parameters as Record<string, unknown> }),
+          },
+        );
+        const grpcMetadata = qoderGrpcMetadata(auth);
+        lifecycle.release();
+        yield* qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal);
+        return;
+      }
+
+      const cosyUrl = candidate.endpoint_path?.startsWith("http")
+        ? candidate.endpoint_path
+        : `${qoderInferenceCandidates(this.realm, auth.securityOauthToken)[0] ?? ""}${QODER_CHAT_PATH}`;
+      const cosyRequest = () =>
+        callQoder(cosyUrl, buildQoderRequest(modelId, request, modelConfig, auth, this.realm), modelId, auth, lifecycle.signal, fetcher, version);
+      const response = await cosyRequest();
+      if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
+      if (!response.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+      // Headers arrived: the pre-stream deadline has served its purpose.
+      // From here the gateway stall/first-chunk watchdog (propagated via
+      // context.abort_signal) governs the body. Keeping this timer armed
+      // would kill healthy long streams at the stale pre-stream deadline.
+      lifecycle.release();
+      yield* qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model);
+    } catch (err: unknown) {
+      const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
+      if (abortError) throw abortError;
+      throw err;
+    } finally {
+      lifecycle.release();
+    }
+  }
+}
+
+export function createQoderAdapter(options: QoderAdapterOptions = {}): ProviderAdapter {
+  return new QoderAdapter(options);
+}
+
+/**
+ * Adapter for the China deployment.
+ *
+ * Same wire, different gateway host and roster — see `qoder-realm.ts`.
+ */
+export function createQoderCnAdapter(options: QoderAdapterOptions = {}): ProviderAdapter {
+  return new QoderAdapter({ ...options, realm: "cn", providerId: "qodercn" });
+}

package/src/providers/integrations/qoder/qoder-auth.ts

@@ -0,0 +1,201 @@
+/**
+ * Qoder credential resolution & PAT→jobToken exchange.
+ *
+ * Device tokens (`dt-…`) from OAuth login are used directly; a PAT
+ * (`pt-…`) must be exchanged for a short-lived job token (`jt-…`) on the
+ * realm's job-token endpoint before it can authenticate any surface.
+ *
+ * The exchange is the modern v1 endpoint (`/api/v1/jobToken/exchange`) with
+ * a plain JSON body — verified live (2026-11-05): `POST
+ * center.qoder.sh/api/v1/jobToken/exchange` with `{personal_token, machine_id}`
+ * returns `{token: jt-…, refresh_token: jrt-…, expires_at}`. The old v3
+ * scrambled-COSY endpoint is retired. `X-Request-ID` is sent uppercase and
+ * the User-Agent is `qoder/<version>` — both mirror the real client.
+ *
+ * The v1 response does not include the account's user id, so `userId`
+ * falls back to the machine id (decision 2026-11-05). That is sufficient
+ * for Bearer surfaces (gRPC / IDE); COSY signing (free/lite PAT) uses it
+ * as the identity placeholder until the user id is sourced another way.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { GatewayError } from "../../../protocol/gateway-error";
+import { mapUpstreamHttpError } from "../../../transport/failure-policy";
+import { getQoderVersion } from "../../operations/client-versions";
+import { qoderMachineOs } from "../../operations/cli-platform";
+import { parseQoderOAuthState } from "./qoder-oauth";
+import { QODER_REALMS, type QoderRealm } from "./qoder-realm";
+import type { QoderAuth } from "./qoder-types";
+
+/** A PAT (`pt-…`) must be exchanged for a job token before use. */
+export function isQoderPat(secret: string): boolean {
+  return secret.startsWith("pt-");
+}
+
+/**
+ * Stable per-account machine id for OAuth dispatches. Derived from the
+ * account id (not minted per request) so pooled accounts keep one device
+ * fingerprint across restarts instead of looking like a new device every
+ * time, while staying distinct per account.
+ */
+export function qoderMachineIdForAccount(accountId: string): string {
+  const hex = createHash("sha256").update(`qoder-machine-v1:${accountId}`).digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+
+/**
+ * Builds dispatch auth from an OAuth device token. The token is used
+ * directly as the COSY identity's oauth token; the user id and machine id
+ * come from the `auth_state` the login persisted. Fails closed with a
+ * reconnect prompt when the identity is absent (e.g. an account created
+ * before `auth_state` existed, or an import that dropped the field) instead
+ * of signing with a guessed id. The message names the missing field so an
+ * operator can fix the export instead of re-logging blind.
+ */
+export function qoderOAuthAuth(
+  secret: string,
+  authState: unknown,
+  accountId: string | undefined,
+): QoderAuth {
+  const state = parseQoderOAuthState(authState);
+  if (state === undefined) {
+    throw new GatewayError(
+      "authentication_failed",
+      401,
+      "Qoder OAuth account is missing its user identity (request {requestId}) (auth_state.userId/machineId absent or empty — re-login, or re-export with authState included); sign in again. Wrong key, right door — check the credential 🔑",
+    );
+  }
+  return {
+    userId: state.userId,
+    userName: "",
+    userType: "personal_standard",
+    securityOauthToken: secret,
+    refreshToken: "",
+    machineId: state.machineId || (accountId ? qoderMachineIdForAccount(accountId) : randomUUID()),
+  };
+}
+
+const QODER_MACHINE_ID_TTL_MS = 60 * 60 * 1000;
+const QODER_MAX_MACHINE_IDS = 1_024;
+const qoderMachineIds = new Map<string, { id: string; expiresAt: number }>();
+
+/**
+ * Stable pseudo-device id per PAT for the whole hour (pool-friendly): a PAT
+ * keeps one machine id across requests within the TTL instead of minting a
+ * fresh device each time.
+ */
+function qoderMachineIdFromPat(pat: string): string {
+  const key = createHash("sha256").update(pat).digest("hex");
+  const now = Date.now();
+  const existing = qoderMachineIds.get(key);
+  if (existing && existing.expiresAt > now) return existing.id;
+  const id = randomUUID();
+  qoderMachineIds.delete(key);
+  qoderMachineIds.set(key, { id, expiresAt: now + QODER_MACHINE_ID_TTL_MS });
+  for (const [candidate, value] of qoderMachineIds) {
+    if (value.expiresAt <= now) qoderMachineIds.delete(candidate);
+  }
+  while (qoderMachineIds.size > QODER_MAX_MACHINE_IDS) {
+    const oldest = qoderMachineIds.keys().next();
+    if (oldest.done) break;
+    qoderMachineIds.delete(oldest.value);
+  }
+  return id;
+}
+
+/**
+ * Stable 32-hex session id for one user+model conversation. Mirrors the
+ * live IDE surface (`X-Session-ID` = sha256(userId:model), 32 hex) and is
+ * shared by the HTTP and gRPC transports so body `session_id` matches the
+ * transport-level session header.
+ */
+export function qoderSessionId(userId: string, modelId: string): string {
+  return createHash("sha256").update(`qoder-session:${userId}:${modelId}`).digest("hex").slice(0, 32);
+}
+
+type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
+
+/**
+ * Exchanges a PAT (`pt-…`) for a short-lived job token (`jt-…`) using the
+ * modern v1 endpoint. Verified live (2026-11-05): `POST
+ * center.qoder.sh/api/v1/jobToken/exchange` with a plain JSON body returns
+ * `{token: jt-…, refresh_token: jrt-…, expires_at}`. `X-Request-ID` is
+ * sent uppercase and the User-Agent is `qoder/<version>` — both mirror the
+ * real client.
+ *
+ * The v1 response does not include the account's user id, so `userId`
+ * falls back to the machine id (decision 2026-11-05). That is sufficient
+ * for Bearer surfaces (gRPC / IDE); COSY signing (free/lite PAT) uses it
+ * as the identity placeholder until the user id is sourced another way.
+ */
+async function exchangeQoderPat(
+  pat: string,
+  signal: AbortSignal,
+  fetcher: QoderFetcher,
+  version = getQoderVersion(),
+  realm: QoderRealm = "intl",
+): Promise<QoderAuth> {
+  const machineId = qoderMachineIdFromPat(pat);
+  const response = await fetcher(QODER_REALMS[realm].jobTokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": `qoder/${version}`,
+      "X-Request-ID": randomUUID().toUpperCase(),
+      "Cosy-ClientType": "5",
+      "Cosy-Version": version,
+      "Cosy-MachineOS": qoderMachineOs(),
+    },
+    body: JSON.stringify({ personal_token: pat, machine_id: machineId }),
+    signal,
+  });
+  if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
+  let responseBody: unknown;
+  try {
+    responseBody = await response.json();
+  } catch {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned invalid JSON (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  }
+  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned unexpected response (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  }
+  const rec = responseBody as Record<string, unknown>;
+  const token = typeof rec["token"] === "string" ? (rec["token"] as string) : "";
+  if (!token) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned incomplete credentials (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  }
+  return {
+    userId: machineId,
+    userName: typeof rec["name"] === "string" ? (rec["name"] as string) : "",
+    userType: typeof rec["userType"] === "string" ? (rec["userType"] as string) : "personal_standard",
+    securityOauthToken: token,
+    refreshToken: typeof rec["refresh_token"] === "string" ? (rec["refresh_token"] as string) : "",
+    machineId,
+  };
+}
+
+/**
+ * Resolves the dispatch identity for one Qoder credential.
+ *
+ * Shared by the adapter and by discovery: both need the same `QoderAuth` the
+ * COSY signature is built from, and duplicating the PAT-vs-OAuth branch would
+ * let the two drift.
+ */
+export async function resolveQoderAuth(input: {
+  readonly secret: string;
+  readonly authState: unknown;
+  readonly signal: AbortSignal;
+  readonly fetcher: (url: string, init: RequestInit) => Promise<Response>;
+  /** Which deployment mints the job token; a PAT is realm-bound. */
+  readonly realm?: QoderRealm;
+}): Promise<QoderAuth> {
+  const realm = input.realm ?? "intl";
+  if (isQoderPat(input.secret)) {
+    return await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
+  }
+  // Discovery is handed only the secret and the persisted state, so the
+  // account id is read from that state — the same place `qoderOAuthAuth` reads
+  // it — rather than being a separate field callers can pass wrongly.
+  const state = parseQoderOAuthState(input.authState);
+  return qoderOAuthAuth(input.secret, input.authState, state?.userId);
+}

package/src/providers/integrations/qoder/qoder-body.ts

@@ -0,0 +1,78 @@
+/**
+ * Shared canonical→Qoder message helpers.
+ *
+ * Kept in a separate module so both transports (`qoder.ts` HTTP and
+ * `qoder-grpc.ts`) build and flatten message content the same way.
+ */
+import type { ContentPart, ToolChoice, ToolDefinition } from "../../../protocol/canonical-model";
+
+/** Joins text/tool-result content of one canonical message into plain text. */
+export function flattenCanonicalContent(content: readonly ContentPart[]): string {
+  return content
+    .filter((b) => b.kind === "text" || b.kind === "toolResult")
+    .map((b) => {
+      if (b.kind === "text") return b.text;
+      if (b.kind === "toolResult") return typeof b.content === "string" ? b.content : JSON.stringify(b.content);
+      return "";
+    })
+    .join("\n");
+}
+
+/**
+ * Projects the canonical tools onto Qoder's chat-completions `tools` array
+ * (the same OpenAI-shaped declaration both the HTTP and the gRPC surface
+ * expect).
+ *
+ * Without this the upstream is never told a tool exists, so a model that wants
+ * one improvises markup in its prose (`<Read file_path="..." />`) instead of
+ * emitting a structured call — the call is then neither runnable nor
+ * recoverable, because it never was a call on either side.
+ *
+ * Only `function` tools are representable upstream. Anything else is dropped
+ * rather than forwarded: Qoder rejects an unknown variant during
+ * deserialization and fails the whole turn, which is worse than omitting a
+ * tool the model could not have used anyway.
+ */
+export function qoderTools(
+  tools: readonly ToolDefinition[] | undefined,
+): Array<Record<string, unknown>> {
+  const out: Array<Record<string, unknown>> = [];
+  for (const tool of tools ?? []) {
+    if (tool.tool_type !== undefined && tool.tool_type !== "function") continue;
+    // The upstream requires `tools[].function` to be an object. A flat
+    // declaration naming the tool at the top level is rejected outright with
+    // "'function' is a required property, expected an object", which fails the
+    // whole request rather than just this tool.
+    out.push({
+      type: "function",
+      function: {
+        name: tool.name,
+        ...(tool.description === undefined ? { description: "" } : { description: tool.description }),
+        parameters: tool.jsonSchema ?? { type: "object", properties: {} },
+        ...(tool.strict === undefined ? {} : { strict: tool.strict }),
+      },
+    });
+  }
+  return out;
+}
+
+/**
+ * Projects the canonical tool choice onto the upstream's field.
+ *
+ * The upstream only accepts a string here (both surfaces). Given the object
+ * form `{type:"function",function:{name}}` it ignores the field, and the model
+ * then calls the tool with no arguments filled in.
+ *
+ * `allowed_tools` has no chat-completions equivalent, so it collapses to the
+ * direction it already names rather than being dropped: a caller that asked for
+ * `required` must not silently get `auto`.
+ */
+export function qoderToolChoice(choice: ToolChoice | undefined): unknown {
+  if (choice === undefined) return undefined;
+  if (typeof choice === "string") return choice;
+  if (choice.type === "tool" || choice.type === "custom") {
+    const name = choice.name.trim();
+    return name.length > 0 ? name : "auto";
+  }
+  return choice.mode;
+}

package/src/providers/integrations/qoder/qoder-catalog.ts

@@ -126,7 +126,13 @@ export const QODER_CN_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>>
  * `qmodel` carries a 1M window. That is why the rosters are not merged.
  */
 export const QODER_INTL_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>> = {
-  auto: { id: "auto", display_name: "Auto", max_input_tokens: 200000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
+  // Every row declares its *maximum selectable* window (1M), not the currently
+  // active one: Qoder publishes a `context_config` of selectable windows per
+  // row (1M/400K/200K/…), and the adapter dispatches the widest
+  // (`qoderMaxContextFor`). The live list's `max_input_tokens` only names the
+  // currently-selected window (often 180K/200K), which is not a ceiling —
+  // declaring that would cap a conversation a 1M-capable account could run.
+  auto: { id: "auto", display_name: "Auto", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
   ultimate: { id: "ultimate", display_name: "Ultimate", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true },
   // `fast` is what the live roster reports today; `performance` is the older
   // key for the same slot. Both are kept so a hand-added model id written
@@ -134,14 +140,18 @@ export const QODER_INTL_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>
   // discovery supersedes it on the first successful fetch.
   fast: { id: "fast", display_name: "Fast", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
   performance: { id: "performance", display_name: "Performance", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
-  efficient: { id: "efficient", display_name: "Efficient", max_input_tokens: 200000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
+  efficient: { id: "efficient", display_name: "Efficient", max_input_tokens: 1000000, max_output_tokens: 64_000, is_vl: true, is_reasoning: false },
   // Sonus/Cantus need an explicit effort on the IDE surface; without it the
   // upstream streams text only, no reasoning (verified live). DeepSeek-family
   // models think by default and are left untouched.
   smodel: { id: "smodel", display_name: "Sonus", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true, default_reasoning_effort: "high" },
   cmodel: { id: "cmodel", display_name: "Cantus", max_input_tokens: 1000000, max_output_tokens: 128_000, is_vl: true, is_free: false, is_reasoning: true, default_reasoning_effort: "high" },
   qmodel_38max: { id: "qmodel_38max", display_name: "Qwen3.8-Max", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_reasoning: true },
-  qfmodel: { id: "qfmodel", display_name: "Qwen3.8-Flash", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_free: true, is_reasoning: true },
+  // `qfmodel` is billed, not free: upstream's live `is_free: true` for this
+  // slot is a plan-tier flag, not a zero-cost tier — a free account gets
+  // `quota exceeded` (116) when dispatching it. The only truly free slot is
+  // `lite`. Do not re-add `is_free` here.
+  qfmodel: { id: "qfmodel", display_name: "Qwen3.8-Flash", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_reasoning: true },
   qmodel_latest: { id: "qmodel_latest", display_name: "Qwen3.7-Max", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_reasoning: false },
   qmodel: { id: "qmodel", display_name: "Qwen3.7-Plus", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_reasoning: false },
   kmodel_latest: { id: "kmodel_latest", display_name: "Kimi-K3.1-Pro", max_input_tokens: 1000000, max_output_tokens: 131_072, is_vl: true, is_free: false, is_reasoning: false },
@@ -152,7 +162,7 @@ export const QODER_INTL_MODEL_CONFIGS: Readonly<Record<string, QoderModelConfig>
   // Live roster (2026-11-01) reports dfmodel as billed (is_free false); it was
   // previously marked free. Display names are corrected from the same capture.
   dfmodel: { id: "dfmodel", display_name: "DeepSeek-Flash", max_input_tokens: 1000000, max_output_tokens: 384_000, is_vl: true, is_free: false, is_reasoning: true },
-  mmodel: { id: "mmodel", display_name: "MiniMax-M3.1-Flash", max_input_tokens: 1000000, max_output_tokens: 512_000, is_vl: true, is_free: false, is_reasoning: false },
+  mmodel: { id: "mmodel", display_name: "MiniMax-M3.1-Flash", max_input_tokens: 1000000, max_output_tokens: 512_000, is_vl: true, is_free: false, is_reasoning: true },
   // `lite` is the free-tier plan package: same 1M window and multimodal input
   // as `qmodel` (Qwen3.7-Plus), capped at 64k output, free tier.
   lite: { id: "lite", display_name: "Lite-Qwen-3.7-Plus", max_input_tokens: 1000000, max_output_tokens: 65_536, is_vl: true, is_free: true, is_reasoning: false },