cartethyia 2.7.7 → 2.7.9

package/src/providers/integrations/qoder/qoder-adapter.ts

@@ -1,14 +1,13 @@
 /**
  * Qoder adapter — transport selection, credential resolution, dispatch.
  *
- * Surface contract (2026-11-05):
- * - `grpc` (default, production): `model.chat.ChatService/ChatCompletionStream`
- *   — the only proven carrier of real 1M-token context (HTTP IDE caps at
- *   ~256 KiB). Serves billed rows; a free-tier row (`lite`) is refused there
- *   (`quota exceeded` 116) and must use legacy COSY.
- * - `cosy` (free/lite + forced legacy): `/algo/.../agent_chat_generation` —
- *   the only surface that accepts free-tier rows. Signing is the COSY Bearer
- *   scheme (AES/RSA + alphabet-scrambled body).
+ * Surface contract (2026-11-07):
+ * - `cosy` (default, production): `/algo/.../agent_chat_generation` on
+ *   `api1` → `api2` → `api3.qoder.sh` (legacy COSY) — the only surface
+ *   verified alive. Accepts free-tier rows (`lite`).
+ * - `grpc` (`model.chat.ChatService/ChatCompletionStream`): **not the
+ *   default anymore** — its host (`api2-v2.qoder.sh`) is NXDOMAIN since
+ *   2026-11-07. Kept as an explicit override for probes.
  * - `ide` (`/model/v1/chat/completions`): **probe/testing only — never
  *   production.** It is the only surface that echoes strategy metadata
  *   (`raw_usage` → provider_model/target) and it streams immediately, but its
@@ -37,6 +36,7 @@ import { isQoderPat, qoderOAuthAuth, qoderSessionId, resolveQoderAuth } from "./
 import { buildQoderRequest, callQoder } from "./qoder-chat";
 import { buildQoderGrpcRequest, qoderGrpcMetadata, qoderGrpcToCanonicalEvents } from "./qoder-grpc";
 import { buildQoderIdeRequest, qoderBodyToCanonicalEvents } from "./qoder-ide";
+import { estimateQoderSessionCache } from "./qoder-cache";
 import {
   QODER_CHAT_PATH,
   QODER_PROVIDER_ID,
@@ -55,17 +55,16 @@ interface QoderAdapterOptions {
   /**
    * Which chat transport to dispatch on.
    *
-   * `grpc` (default) uses the gRPC model-server surface
-   * (`model.chat.ChatService/ChatCompletionStream`) — the only proven carrier
-   * of real 1M-token context (the HTTP IDE surface caps at ~256 KiB). gRPC
-   * serves billed models; a free-tier row (`lite`) is refused there
-   * (`quota exceeded` 116) and must use the legacy COSY surface.
+   * `cosy` (default) = legacy COSY (`/algo/.../agent_chat_generation`) on
+   * `api1` → `api2` → `api3.qoder.sh` — the only surface verified alive
+   * (2026-11-07; the `api2-v2` model-server host is NXDOMAIN). This path also
+   * accepts free-tier rows (`lite`).
    *
-   * `cosy` forces only the legacy surface (`/algo/.../agent_chat_generation`)
-   * — the free-tier path and the pre-gRPC behavior.
+   * `grpc` forces the gRPC surface (`model.chat.ChatService/ChatCompletionStream`)
+   * — **no longer the default**; its host is not verified alive.
    *
-   * `ide` forces the modern `/model/v1` surface — **probe/testing only, never
-   * production** (see module doc).
+   * `ide` forces `/model/v1` — **probe/testing only, never production**
+   * (see module doc).
    */
   readonly surface?: "grpc" | "cosy" | "ide";
 }
@@ -75,7 +74,7 @@ export function resolveQoderTransport(
   surface: "grpc" | "cosy" | "ide" | undefined,
   modelConfig: QoderModelConfig,
 ): "grpc" | "cosy" | "ide" {
-  const chosen = surface ?? "grpc";
+  const chosen = surface ?? "cosy";
   // `ide` is an explicit testing override — never auto-selected, and it does
   // not apply the free-tier rule (a forced IDE call is a test call).
   if (chosen === "ide") return "ide";
@@ -104,7 +103,14 @@ class QoderAdapter implements ProviderAdapter {
   constructor(options: QoderAdapterOptions = {}) {
     this.provider_id = (options.providerId ?? QODER_PROVIDER_ID) as ProviderId;
     this.realm = options.realm ?? "intl";
-    this.surface = options.surface ?? "grpc";
+    // The legacy COSY surface is the production default (2026-11-07): the
+    // gRPC host is NXDOMAIN and the IDE surface is probe-only. The constructor
+    // must default to it too, or every billed model dispatches to the dead
+    // gRPC path while free-tier rows get cosy via the is_free rule — the
+    // mismatch that made `deepseek-v4.1-flash` fail while `qwen3.8-flash`
+    // passed. This is the same default `resolveQoderTransport(undefined)`
+    // already returns.
+    this.surface = options.surface ?? "cosy";
     this.fetchFn = options.fetch ?? globalThis.fetch;
   }
 
@@ -121,6 +127,30 @@ class QoderAdapter implements ProviderAdapter {
     >;
   }
 
+  /**
+   * Wraps an upstream event stream and applies the local session-cache
+   * estimate to every `usage` record (and terminal-carried usage).
+   *
+   * Qoder's upstream never reports prompt-cache hits (verified live on both
+   * gRPC and IDE HTTP surfaces), so the gap is closed the same way Trae and
+   * Kiro do: estimate the cached prefix from this session's request history.
+   */
+  async *#withSessionCacheEstimate(
+    events: AsyncIterable<CanonicalEvent>,
+    request: CanonicalRequest,
+    sessionId: string | undefined,
+  ): AsyncGenerator<CanonicalEvent> {
+    for await (const event of events) {
+      if (event.type === "usage") {
+        yield { ...event, usage: estimateQoderSessionCache(event.usage, sessionId, request.messages) };
+      } else if (event.type === "terminal" && event.usage !== undefined) {
+        yield { ...event, usage: estimateQoderSessionCache(event.usage, sessionId, request.messages) };
+      } else {
+        yield event;
+      }
+    }
+  }
+
   async *dispatch(
     request: CanonicalRequest,
     candidate: ProviderDispatchTarget,
@@ -207,7 +237,11 @@ class QoderAdapter implements ProviderAdapter {
         if (!res.ok) throw await mapUpstreamHttpError(res, "qoder");
         if (!res.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
         lifecycle.release();
-        yield* qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId);
+        yield* this.#withSessionCacheEstimate(
+          qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId),
+          request,
+          qoderSessionId(auth.userId, modelId),
+        );
         return;
       }
 
@@ -233,16 +267,39 @@ class QoderAdapter implements ProviderAdapter {
         );
         const grpcMetadata = qoderGrpcMetadata(auth);
         lifecycle.release();
-        yield* qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal);
+        yield* this.#withSessionCacheEstimate(
+          qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal, context.provider_capture),
+          request,
+          qoderSessionId(auth.userId, modelId),
+        );
         return;
       }
 
-      const cosyUrl = candidate.endpoint_path?.startsWith("http")
-        ? candidate.endpoint_path
-        : `${qoderInferenceCandidates(this.realm, auth.securityOauthToken)[0] ?? ""}${QODER_CHAT_PATH}`;
-      const cosyRequest = () =>
-        callQoder(cosyUrl, buildQoderRequest(modelId, request, modelConfig, auth, this.realm), modelId, auth, lifecycle.signal, fetcher, version);
-      const response = await cosyRequest();
+      // Legacy COSY hosts are tried in order (api1 → api2 → api3) with the
+      // endpoint path from discovery when present. A network-level failure on
+      // one host falls through to the next; an HTTP error response surfaces as-is.
+      const cosyCandidates = candidate.endpoint_path?.startsWith("http")
+        ? [candidate.endpoint_path]
+        : qoderInferenceCandidates(this.realm, auth.securityOauthToken).map(
+            (host) => `${host}${QODER_CHAT_PATH}`,
+          );
+      let response: Response | undefined;
+      let lastError: unknown;
+      for (const cosyUrl of cosyCandidates) {
+        try {
+          const attempt = () =>
+            callQoder(cosyUrl, buildQoderRequest(modelId, request, modelConfig, auth, this.realm), modelId, auth, lifecycle.signal, fetcher, version);
+          response = await attempt();
+          break;
+        } catch (err: unknown) {
+          lastError = err;
+        }
+      }
+      if (response === undefined) {
+        throw lastError instanceof Error
+          ? lastError
+          : new GatewayError("transport_unavailable", 502, "Qoder legacy COSY hosts are unreachable (request {requestId}). The connection ghosted us — come back in a moment 👻", {}, "upstream");
+      }
       if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
       if (!response.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
       // Headers arrived: the pre-stream deadline has served its purpose.
@@ -250,7 +307,11 @@ class QoderAdapter implements ProviderAdapter {
       // context.abort_signal) governs the body. Keeping this timer armed
       // would kill healthy long streams at the stale pre-stream deadline.
       lifecycle.release();
-      yield* qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model);
+      yield* this.#withSessionCacheEstimate(
+        qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model),
+        request,
+        qoderSessionId(auth.userId, modelId),
+      );
     } catch (err: unknown) {
       const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
       if (abortError) throw abortError;

package/src/providers/integrations/qoder/qoder-cache.ts

@@ -0,0 +1,32 @@
+// Qoder session-cache estimation.
+//
+// The Qoder upstream never reports prompt-cache hits: neither the gRPC surface
+// (used `prompt_tokens_details` absent on every chunk — verified live
+// 2026-11-05, `scripts/provider-probing/qoder/direct/direct-cache-hit.ts`) nor
+// the IDE HTTP surface (`usage: null` / `raw_usage` absent — `direct-cache-hit-ide.ts`)
+// carries a cached-token counter. The underlying models do cache byte-identical
+// prefixes, so for the same conversation we ESTIMATE the hit locally from the
+// request history — exactly how the Trae and Kiro adapters bridge the same gap.
+// This only fills the gap when upstream reports nothing (0 or unavailable); a
+// genuine upstream report (>0) is trusted and left untouched.
+//
+// The state lives in a factory-created instance, so Qoder's sessions are fully
+// isolated from Trae's/Kiro's (and any other consumer of the shared factory).
+
+import type { CanonicalMessage, UsageRecord } from "../../../protocol/canonical-model";
+import { createSessionCache, estimateSessionCache, resetSessionCacheForTesting } from "../shared/session-cache";
+
+const cache = createSessionCache();
+
+export function estimateQoderSessionCache(
+  record: UsageRecord,
+  sessionId: string | undefined,
+  messages: readonly CanonicalMessage[] | undefined,
+): UsageRecord {
+  return estimateSessionCache(cache, record, sessionId, messages);
+}
+
+/** Drops all tracked sessions. Test-only. */
+export function resetQoderSessionCacheForTesting(): void {
+  resetSessionCacheForTesting(cache);
+}

package/src/providers/integrations/qoder/qoder-catalog.ts

@@ -12,7 +12,7 @@ import { GatewayError } from "../../../protocol/gateway-error";
 import { defineModel } from "../../provider-model-definition";
 import type { ModelDefinition } from "../../provider-model-definition";
 import { QODER_CHAT_PATH, QODER_MODELS_PATH, qoderGatewayCandidates, type QoderRealm } from "./qoder-realm";
-import { qoderVirtualIdFor, QODER_VIRTUAL_MODELS } from "./qoder-virtual";
+import { qoderVirtualIdFor, QODER_PROVIDER_WARNINGS, QODER_VIRTUAL_MODELS } from "./qoder-virtual";
 
 /** One upstream catalog row, as `/algo/api/v2/model/list` reports it. */
 export interface QoderCatalogEntry {
@@ -199,6 +199,8 @@ function qoderModels(
       // Only an explicit `true` marks the row free; an unstated flag is left
       // unset so nothing claims a tier the roster did not state.
       ...(cfg.is_free === undefined ? {} : { free: cfg.is_free, freeTier: cfg.is_free }),
+      // Provider-level caveats, not per-model claims (D37).
+      warnings: QODER_PROVIDER_WARNINGS,
     }),
   );
 }
@@ -255,6 +257,7 @@ export function qoderVirtualModels(
           : target.freeTier === undefined
             ? {}
             : { free: target.freeTier, freeTier: target.freeTier }),
+        warnings: QODER_PROVIDER_WARNINGS,
       }),
     );
   }
@@ -349,6 +352,7 @@ export function qoderCatalogModel(
     // The live row carries no output ceiling, so inherit the static roster's
     // stated one when it exists (see `qoderRosterMaxOutputFor`).
     ...(rosterOutput === undefined ? {} : { out: rosterOutput }),
+    warnings: QODER_PROVIDER_WARNINGS,
   });
 }
 
@@ -542,6 +546,7 @@ export async function discoverQoderModels(input: {
                 : { out: rosterOutput }),
             free: virtual.free ?? entry.isFree,
             freeTier: virtual.free ?? entry.isFree,
+            warnings: QODER_PROVIDER_WARNINGS,
           }),
         );
       });

package/src/providers/integrations/qoder/qoder-checkin.ts

@@ -1,6 +1,6 @@
 /**
  * Qoder daily check-in (streak / 100 Credits per day), ported from the
- * reference bridge (`qoder_accounts.py` in `qoder2api-hub`).
+ * reference bridge (`qoder_accounts.py` in the donor hub).
  *
  * Two upstream surfaces, tried in order:
  *
@@ -443,7 +443,7 @@ export async function fetchQoderDailyCheckin(args: {
     }
   }
   if (!bound && store) {
-    const minted = await allocateQoderNativeIdentity(store, providerId, accountId);
+    const minted = await allocateQoderNativeIdentity(store, providerId, accountId, { realm });
     if (minted) {
       boundRecord = minted;
       bound = {

package/src/providers/integrations/qoder/qoder-grpc.ts

@@ -20,7 +20,8 @@ import { join } from "node:path";
 import * as grpc from "@grpc/grpc-js";
 import * as protoLoader from "@grpc/proto-loader";
 import { GatewayError } from "../../../protocol/gateway-error";
-import type { CanonicalEvent, CanonicalRequest, CanonicalStopReason } from "../../../protocol/canonical-model";
+import type { CanonicalEvent, CanonicalRequest, CanonicalStopReason, UsageRecord } from "../../../protocol/canonical-model";
+import type { ProviderCaptureExchange } from "../../provider-contracts";
 import { usageFromProvider } from "../../provider-usage";
 import { getQoderVersion } from "../../operations/client-versions";
 import { qoderMachineOs, qoderMachineHostname } from "../../operations/cli-platform";
@@ -440,6 +441,65 @@ export function qoderGrpcMetadata(auth: QoderAuth, modelId = ""): grpc.Metadata
   return metadata;
 }
 
+/**
+ * gRPC metadata headers safe to persist in the provider-request panel.
+ *
+ * Mirrors the HTTP capture allowlist (`CAPTURED_REQUEST_HEADERS` in
+ * `transport/dispatch/attempt-finalize.ts`): session/identity framing is kept,
+ * but credentials are never stored. `authorization` (the Bearer job token) is
+ * deliberately excluded — the HTTP wrapper never captures it, and the gRPC
+ * capture must not either.
+ */
+const GRPC_CAPTURED_HEADERS = [
+  "x-request-id",
+  "x-session-id",
+  "cosy-version",
+  "cosy-clienttype",
+  "cosy-machineos",
+  "cosy-machinehostname",
+  "x-opencode-client",
+  "x-opencode-session",
+  "x-opencode-session-id",
+  "x-opencode-parent-session-id",
+  "x-opencode-request",
+  "x-opencode-project",
+  "x-conversation-id",
+  "x-conversation-request-id",
+  "x-conversation-message-id",
+  "x-root-request-id",
+  "x-trace-id",
+  "traceparent",
+  "b3",
+] as const;
+
+/**
+ * A gRPC exchange is not a `fetch`, so the HTTP capture wrapper never sees it.
+ * The adapter fills the sink directly with a faithful rendering of the proto
+ * call: the request line (grpc method, host, allowlisted metadata, and the
+ * translated body) and a deferred response that resolves to the collected
+ * stream summary.
+ */
+export function captureQoderGrpcRequest(
+  request: Record<string, unknown>,
+  metadata: grpc.Metadata,
+  realm: QoderRealm,
+): Record<string, unknown> {
+  const host = qoderGrpcHost(realm);
+  const map = metadata.getMap() as Record<string, string | string[]>;
+  const headers: Record<string, string> = {};
+  for (const name of GRPC_CAPTURED_HEADERS) {
+    const value = map[name];
+    if (value === undefined) continue;
+    headers[name] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  return {
+    method: "POST",
+    url: `grpc://${host}/model.chat.ChatService/ChatCompletionStream`,
+    headers,
+    body: request,
+  };
+}
+
 /** Maps a proto `finish_reason` to the canonical stop reason. */
 function mapFinishReason(raw: string | undefined): CanonicalStopReason | undefined {
   switch (raw) {
@@ -450,6 +510,10 @@ function mapFinishReason(raw: string | undefined): CanonicalStopReason | undefin
       return "tool_use";
     case "length":
       return "length";
+    case "error":
+      return "error";
+    case "refusal":
+      return "refusal";
     default:
       return undefined;
   }
@@ -466,6 +530,7 @@ export async function* qoderGrpcToCanonicalEvents(
   metadata: grpc.Metadata,
   realm: QoderRealm,
   signal: AbortSignal,
+  capture?: ProviderCaptureExchange,
 ): AsyncGenerator<CanonicalEvent> {
   const ChatService = qoderGrpcClient();
   const host = qoderGrpcHost(realm);
@@ -483,6 +548,122 @@ export async function* qoderGrpcToCanonicalEvents(
     // clients reject content after the finish reason. A second terminal is
     // skipped too (the upstream can re-emit the finish frame).
     let finished = false;
+    // Last usage chunk seen; attached to the terminal event (the upstream
+    // streams usage after the finish-reason chunk, and a standalone `usage`
+    // event after terminal breaks strict Messages encoders).
+    let pendingUsage: UsageRecord | undefined;
+    /** Whether the terminal already carried the pending usage. */
+    let terminalEmitted = false;
+    // Capture sinks fed from the same `for await` loop that drives production
+    // events (see `feedCapture`). Declared here so the loop below can call
+    // them; they are assigned when capture is enabled.
+    let feedCapture: ((chunk: unknown) => void) | undefined;
+    let flushToolCalls: (() => void) | undefined;
+    if (capture !== undefined) {
+      capture.request = captureQoderGrpcRequest(request, metadata, realm);
+      capture.response = new Promise((resolve) => {
+        const summary: Record<string, unknown> = {
+          transport: "grpc",
+          chunks: 0,
+          answer_chars: 0,
+          reasoning_chars: 0,
+          tool_calls: 0,
+          models: [] as string[],
+          usage: undefined,
+          stop_reason: undefined,
+          status_code: 0,
+          // Materialized response content (bounded): the text the model
+          // emitted, the reasoning trace, and the tool calls that were
+          // announced. This is what Request Detail shows instead of a bare
+          // statistics block.
+          text: "",
+          reasoning: "",
+          toolCalls: [] as Array<{ index: number; id?: string; name?: string; arguments?: string }>,
+        };
+        // Per-index tool-call fragments (the upstream streams one call at a
+        // time: id + empty args, then argument fragments, index always 0).
+        const toolCallsByIndex = new Map<number, { id?: string; name?: string; arguments?: string }>();
+        const MAX_TEXT_CHARS = 16_000;
+        const MAX_TOOL_CALLS = 50;
+        const MAX_TOOL_ARGS_CHARS = 2_000;
+        // The summary is fed from the SAME `for await` loop that drives the
+        // production event stream (see `feedCapture` below) — a separate
+        // `data` listener raced the iterator and saw nothing (or a different
+        // decode), so tool calls and text never made it into the capture.
+        feedCapture = (chunk: unknown) => {
+          const rec = chunk as Record<string, unknown>;
+          summary["chunks"] = (summary["chunks"] as number) + 1;
+          const model = rec["model"];
+          if (typeof model === "string" && model.length > 0) {
+            const models = summary["models"] as string[];
+            if (!models.includes(model)) models.push(model);
+          }
+          const usage = rec["usage"];
+          if (usage !== undefined && typeof usage === "object") summary["usage"] = usage;
+          const choices = Array.isArray(rec["choices"]) ? (rec["choices"] as Array<Record<string, unknown>>) : [];
+          for (const choice of choices) {
+            const delta = choice["delta"] as Record<string, unknown> | undefined;
+            const content = delta?.["content"];
+            if (typeof content === "string" && content.length > 0) {
+              summary["answer_chars"] = (summary["answer_chars"] as number) + content.length;
+              const text = summary["text"] as string;
+              if (text.length < MAX_TEXT_CHARS) {
+                summary["text"] = (text + content).slice(0, MAX_TEXT_CHARS);
+              }
+            }
+            const reasoning = delta?.["reasoning_content"];
+            if (typeof reasoning === "string" && reasoning.length > 0) {
+              summary["reasoning_chars"] = (summary["reasoning_chars"] as number) + reasoning.length;
+              const reasoningText = summary["reasoning"] as string;
+              if (reasoningText.length < MAX_TEXT_CHARS) {
+                summary["reasoning"] = (reasoningText + reasoning).slice(0, MAX_TEXT_CHARS);
+              }
+            }
+            const calls = delta?.["tool_calls"];
+            if (Array.isArray(calls) && calls.length > 0) {
+              summary["tool_calls"] = (summary["tool_calls"] as number) + calls.length;
+              for (const rawTc of calls) {
+                const tc = fromProtoStruct(rawTc);
+                const index = typeof tc["index"] === "number" ? (tc["index"] as number) : 0;
+                const entry = toolCallsByIndex.get(index) ?? {};
+                const declaredId = tc["id"];
+                if (typeof declaredId === "string" && declaredId.trim().length > 0) entry.id = declaredId.trim();
+                const fn = (tc["function"] ?? {}) as Record<string, unknown>;
+                const name = fn["name"];
+                if (typeof name === "string" && name.trim().length > 0) entry.name = name.trim();
+                const args = fn["arguments"];
+                if (typeof args === "string" && args.length > 0) {
+                  entry.arguments = ((entry.arguments ?? "") + args).slice(0, MAX_TOOL_ARGS_CHARS);
+                }
+                toolCallsByIndex.set(index, entry);
+              }
+            }
+            const finish = choice["finish_reason"];
+            if (typeof finish === "string" && finish.length > 0) summary["stop_reason"] = finish;
+          }
+        };
+        flushToolCalls = () => {
+          const entries = [...toolCallsByIndex.entries()]
+            .sort((a, b) => a[0] - b[0])
+            .slice(0, MAX_TOOL_CALLS)
+            .map(([index, entry]) => ({ index, ...entry }));
+          if (entries.length > 0) summary["toolCalls"] = entries;
+        };
+        stream.on("status", (s: { code?: number; details?: string }) => {
+          summary["status_code"] = s.code ?? 0;
+          summary["grpc_message"] = s.details ?? "";
+        });
+        stream.on("error", (err: Error) => {
+          summary["error"] = err.message;
+          flushToolCalls?.();
+          resolve(summary);
+        });
+        stream.on("end", () => {
+          flushToolCalls?.();
+          resolve(summary);
+        });
+      });
+    }
 
     const abortHandler = () => {
       aborted = true;
@@ -502,6 +683,8 @@ export async function* qoderGrpcToCanonicalEvents(
       const fragmentState: QoderToolFragmentState = {};
       for await (const chunk of stream) {
         if (aborted || signal.aborted) break;
+        // Feed the capture summary from this same chunk (single consumer).
+        feedCapture?.(chunk);
         // The upstream names the model it actually ran in the chunk's `model`
         // field. Surface it once as `response_start` so probes and telemetry
         // can report the real echoed model (the gRPC surface has no HTTP body
@@ -599,24 +782,45 @@ export async function* qoderGrpcToCanonicalEvents(
               yield {
                 type: "terminal",
                 sequence_number: nextSeq(),
-                state: stop === "stop" || stop === "tool_use" ? "complete" : "failed",
+                // `tool_use` and `refusal` are *successful* terminal verdicts:
+                // the model decided to call a tool / declined to answer, but the
+                // response itself is valid — `complete`, never `failed`. A
+                // `failed` state here made attempt-finalize treat a healthy tool
+                // turn as an upstream failure ("empty-handed") and replay it.
+                // A key `error` (or `length`) is the failed case.
+                state: stop === "stop" || stop === "tool_use" || stop === "refusal" ? "complete" : "failed",
                 stop_reason: stop,
                 provider_stop_reason: choice.finish_reason,
+                // The upstream streams `usage` in a trailing chunk *after* the
+                // finish-reason chunk. A separate `usage` event after the
+                // terminal is rejected by strict Anthropic Messages encoders
+                // (the 2.7.8 regression), so the usage is carried here on the
+                // terminal instead — exactly like the IDE surface does.
+                ...(pendingUsage === undefined ? {} : { usage: pendingUsage }),
               };
+              if (pendingUsage !== undefined) terminalEmitted = true;
             }
           }
         }
         if (chunk.usage) {
           const usage = usageFromProvider(chunk.usage);
           if (usage !== undefined) {
-            yield { type: "usage", sequence_number: nextSeq(), usage };
+            // Keep the last usage chunk; it is attached to the terminal above
+            // (and only if no terminal ever arrives, emitted as a standalone
+            // event at stream end).
+            pendingUsage = usage;
           }
         }
       }
       // Tool-call deltas are emitted as they arrive — there is no end-of-stream
       // buffer to flush; the terminal event is yielded by the finish-reason
       // branch above (or synthesized by the caller if the stream ends without
-      // one).
+      // one). If no terminal carried the pending usage (the stream ended
+      // without a finish reason), emit it as a standalone event so telemetry
+      // still sees the upstream's numbers.
+      if (!terminalEmitted && pendingUsage !== undefined) {
+        yield { type: "usage", sequence_number: nextSeq(), usage: pendingUsage };
+      }
     } catch (err: any) {
       const status = err?.code;
       const details = err?.details ?? err?.message ?? "";
@@ -644,7 +848,7 @@ export async function* qoderGrpcToCanonicalEvents(
             "quota_exceeded",
             429,
             "Qoder quota exhausted on the gRPC surface (request {requestId})",
-            {},
+            { providerCode: "quota_exceeded" },
             "upstream",
           );
         }

package/src/providers/integrations/qoder/qoder-ide.ts

@@ -163,6 +163,8 @@ function mapQoderFinishReason(raw: unknown): CanonicalStopReason | undefined {
   if (raw === "length") return "length";
   if (raw === "tool_calls") return "tool_use";
   if (raw === "content_filter") return "content_filter";
+  if (raw === "error") return "error";
+  if (raw === "refusal") return "refusal";
   return undefined;
 }
 
@@ -402,7 +404,9 @@ export async function* qoderBodyToCanonicalEvents(
   yield {
     type: "terminal",
     sequence_number: seq++,
-    state: "complete",
+    // `error` is a failed terminal; every other stop (stop, tool_use,
+    // refusal, content_filter, length) is a complete turn.
+    state: stopReason === "error" ? "failed" : "complete",
     ...(stopReason === undefined ? {} : { stop_reason: stopReason }),
     ...(_providerStop === undefined ? {} : { provider_stop_reason: _providerStop }),
     usage: usageFromProvider(rawUsage),