cartethyia 2.7.8 → 2.7.9

package/src/providers/operations/account-refresh-status.ts

@@ -0,0 +1,284 @@
+/**
+ * Manual account-status observation: refresh an OAuth token on demand and
+ * report the account's status AFTER the attempt — never assume it.
+ *
+ * Area 04 (D21–D26): a refresh is not a health verdict. This module is the
+ * explicit "refresh token" affordance for accounts the OAuth sweep excludes
+ * (`disabled`), and it is where the invariant nobody else had to is held:
+ * `statusAfter` is always re-read from the database, so no caller can ever
+ * report `"active"` just because a refresh succeeded.
+ */
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { healthEvents, providerAccounts, providerOauthStates } from "../../persistence/schema";
+import { pushStructuredConsoleLog } from "../../observability/log-ring";
+import type { OAuthRefreshService, OAuthTokenRefresher } from "../authentication/oauth-refresh-service";
+
+export type RefreshAccountStatusCode =
+  | "ok"
+  | "account_missing"
+  | "not_oauth"
+  | "static_token"
+  | "no_refresher"
+  | "refresh_failed";
+
+export interface RefreshAccountStatusOutcome {
+  readonly ok: boolean;
+  readonly tokenRefreshed: boolean;
+  /**
+   * Account status re-read from the DB after the attempt. Never assumed from
+   * the input row and never `"active"` by fiat — a refresh cannot re-enable.
+   */
+  readonly statusAfter: string;
+  readonly code: RefreshAccountStatusCode;
+  /** IS0 timestamp of the fresh access-token expiry, when known. */
+  readonly expiresAt?: string;
+  /** ISO timestamp of the attempt, when it happened. */
+  readonly refreshedAt?: string;
+  /** Structured reason when `ok` is false (`not_oauth`, `static_token`, …). */
+  readonly error?: string;
+  /** Human detail (failure message) when available. */
+  readonly category?: string;
+}
+
+export interface RefreshAccountStatusDeps {
+  readonly db: CartethyiaDatabase;
+  readonly refreshService: Pick<OAuthRefreshService, "ensureFreshAccessToken">;
+  readonly resolveRefresher: (providerId: string) => Promise<OAuthTokenRefresher | undefined>;
+}
+
+interface LoadedAccount {
+  readonly id: string;
+  readonly providerId: string;
+  readonly credentialKind: string;
+  readonly status: string;
+  readonly staticToken: boolean;
+  readonly refreshCiphertext: Buffer | null;
+  readonly expiresAt: Date | null;
+}
+
+async function loadAccount(
+  db: CartethyiaDatabase,
+  accountId: string,
+): Promise<LoadedAccount | undefined> {
+  const selectBuilder = db
+    .select({
+      id: providerAccounts.id,
+      providerId: providerAccounts.providerId,
+      credentialKind: providerAccounts.credentialKind,
+      status: providerAccounts.status,
+      staticToken: providerAccounts.staticToken,
+      refreshCiphertext: providerOauthStates.refreshCiphertext,
+      expiresAt: providerOauthStates.expiresAt,
+    })
+    .from(providerAccounts);
+  const query =
+    "leftJoin" in selectBuilder
+      ? selectBuilder.leftJoin(
+          providerOauthStates,
+          eq(providerOauthStates.providerAccountId, providerAccounts.id),
+        )
+      : selectBuilder;
+  const rows = await query.where(eq(providerAccounts.id, accountId)).limit(1);
+  return rows[0];
+}
+
+async function readStatusAfter(
+  db: CartethyiaDatabase,
+  accountId: string,
+): Promise<{ status: string; expiresAt: Date | null } | undefined> {
+  const selectBuilder = db
+    .select({
+      status: providerAccounts.status,
+      expiresAt: providerOauthStates.expiresAt,
+    })
+    .from(providerAccounts);
+  const query =
+    "leftJoin" in selectBuilder
+      ? selectBuilder.leftJoin(
+          providerOauthStates,
+          eq(providerOauthStates.providerAccountId, providerAccounts.id),
+        )
+      : selectBuilder;
+  const rows = await query.where(eq(providerAccounts.id, accountId)).limit(1);
+  return rows[0];
+}
+
+/** Non-mutating health event: records the attempt, never changes status. */
+async function writeRefreshHealthEvent(
+  db: CartethyiaDatabase,
+  accountId: string,
+  fromStatus: string,
+  toStatus: string,
+  reason: string,
+): Promise<void> {
+  if (typeof db.insert !== "function") return;
+  await db.insert(healthEvents).values({
+    id: randomUUID(),
+    entityKind: "account",
+    accountId,
+    fromStatus: fromStatus as "active" | "cooldown" | "disabled" | null,
+    toStatus: toStatus as "active" | "cooldown" | "disabled",
+    reason,
+    errorCategory: null,
+    createdAt: new Date(),
+  });
+}
+
+/**
+ * Refreshes an OAuth account's token on demand and reports the resulting
+ * status. Works for any status, `disabled` included — the account stays
+ * `disabled`; only an operator can re-enable it.
+ *
+ * Rejections are structured (`{ ok: false, code: "not_oauth" | "static_token" |
+ * ... }`), and every outcome carries `statusAfter` re-read from the DB.
+ */
+export async function refreshAccountStatus(
+  deps: RefreshAccountStatusDeps,
+  accountId: string,
+  opts: { readonly origin?: "ui" | "sweep" | "dispatch" } = {},
+): Promise<RefreshAccountStatusOutcome> {
+  const origin = opts.origin ?? "ui";
+  const account = await loadAccount(deps.db, accountId);
+  if (!account) {
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter: "disabled",
+      code: "account_missing",
+      error: "Account not found",
+    };
+  }
+  const statusBefore = account.status;
+
+  if (account.credentialKind !== "oauth") {
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter: statusBefore,
+      code: "not_oauth",
+      error: "not_oauth",
+    };
+  }
+  if (account.staticToken || account.refreshCiphertext == null) {
+    // No refresh grant (or an explicit static marker): there is nothing to
+    // re-mint, and forcing the service to try would mutate the row into a
+    // static token. Refuse instead of changing the account.
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter: statusBefore,
+      code: "static_token",
+      error: "static_token",
+      ...(account.refreshCiphertext == null && !account.staticToken
+        ? { category: "No refresh token on record" }
+        : {}),
+    };
+  }
+
+  const refresher = await deps.resolveRefresher(account.providerId);
+  if (!refresher) {
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter: statusBefore,
+      code: "no_refresher",
+      error: "no_refresher",
+    };
+  }
+
+  // `ensureFreshAccessToken` deliberately swallows a failing refresher and
+  // returns null (it must not break a dispatch). For this explicit affordance
+  // the operator needs the reason, so keep the last failure message here
+  // rather than generalizing it — same "message as-is" rule as area 08.
+  let refreshFailureMessage: string | undefined;
+  const reportingRefresher: OAuthTokenRefresher = {
+    refresh: async (...args) => {
+      try {
+        return await refresher.refresh(...args);
+      } catch (error) {
+        refreshFailureMessage = error instanceof Error ? error.message : String(error);
+        throw error;
+      }
+    },
+  };
+
+  const startedAt = new Date();
+  try {
+    const refreshed = await deps.refreshService.ensureFreshAccessToken(accountId, reportingRefresher, {
+      force: true,
+      origin,
+    });
+    // D25: status is always re-read after the attempt — never assumed.
+    const after = await readStatusAfter(deps.db, accountId);
+    const statusAfter = after?.status ?? statusBefore;
+    if (refreshed !== null) {
+      pushStructuredConsoleLog("info", "OAuth token refreshed", {
+        event: "token_refresh",
+        accountId,
+        providerId: account.providerId,
+        details: {
+          origin,
+          statusBefore,
+          statusAfter,
+          expiresAt: after?.expiresAt?.toISOString() ?? "",
+        },
+      });
+      await writeRefreshHealthEvent(
+        deps.db,
+        accountId,
+        statusBefore,
+        statusAfter,
+        "Token refreshed — status unchanged",
+      );
+      return {
+        ok: true,
+        tokenRefreshed: true,
+        statusAfter,
+        code: "ok",
+        ...(after?.expiresAt ? { expiresAt: after.expiresAt.toISOString() } : {}),
+        refreshedAt: startedAt.toISOString(),
+      };
+    }
+    // `ensureFreshAccessToken` returned null: the refresh failed (transient
+    // upstream error, lease loss) or the credential became static mid-flight.
+    // Either way the account's own status is the truth, re-read above.
+    pushStructuredConsoleLog("warn", "OAuth token refresh did not complete", {
+      event: "token_refresh",
+      accountId,
+      providerId: account.providerId,
+      errorCode: "refresh_failed",
+      details: { origin, statusBefore, statusAfter },
+    });
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter,
+      code: "refresh_failed",
+      error: "refresh_failed",
+      ...(refreshFailureMessage
+        ? { category: refreshFailureMessage.slice(0, 500) }
+        : { category: "Token refresh did not complete" }),
+    };
+  } catch (error) {
+    const after = await readStatusAfter(deps.db, accountId);
+    const statusAfter = after?.status ?? statusBefore;
+    const message = error instanceof Error ? error.message : String(error);
+    pushStructuredConsoleLog("error", "OAuth token refresh failed", {
+      event: "token_refresh",
+      accountId,
+      providerId: account.providerId,
+      errorCode: "refresh_failed",
+      details: { origin, statusBefore, statusAfter, error: message.slice(0, 500) },
+    });
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter,
+      code: "refresh_failed",
+      error: "refresh_failed",
+      category: message.slice(0, 500),
+    };
+  }
+}

package/src/providers/operations/account-tier.ts

@@ -0,0 +1,67 @@
+/**
+ * Account tier derivation from the plan string the quota collector reported.
+ *
+ * The plan string (`provider_accounts.quota_plan`) is a raw, per-provider
+ * label; this module normalizes it to the three-tier taxonomy the cooldown
+ * rules consume (`free | paid | pro | null`, D14). It is a pure function of
+ * the provider id and the plan text — no database access, no state.
+ *
+ * The mapping is deliberately conservative, following the same posture as
+ * `plan-gate.ts`: a tier is only claimed when the string proves it. "free"
+ * requires a free marker in the string, "pro" requires a team/enterprise/org
+ * signal, and "paid" is only assigned for providers whose plan strings are
+ * evidenced (Trae, the buddy family, Cursor). Everything else — an unknown
+ * provider, an unrecognized plan, a `null` plan — resolves to `null`, which
+ * keeps the legacy behavior intact (unknown tier ⇒ no rule applies ⇒ the old
+ * constants drive the cooldown).
+ */
+
+/** The three-tier taxonomy for cooldown rules. `null` = unknown. */
+export type AccountTier = "free" | "paid" | "pro" | null;
+
+const TRAE_PROVIDER_IDS: ReadonlySet<string> = new Set(["trae", "traecn"]);
+const BUDDY_PROVIDER_IDS: ReadonlySet<string> = new Set([
+  "cb",
+  "cbcn",
+]);
+const QODER_PROVIDER_IDS: ReadonlySet<string> = new Set(["qoder", "qodercn"]);
+
+/** Team/enterprise/org signals that prove a "pro" tier. */
+const PRO_PLAN_MARKERS: readonly string[] = ["team", "enterprise", "org", "pro"];
+
+/**
+ * Maps a provider's plan string to a tier.
+ *
+ * `providerId` is normalized case-insensitively; a `null`/empty plan is
+ * unknown (`null`). The "free" check runs before any provider branch because a
+ * proven-free label is the strongest signal (e.g. CodeBuddy's
+ * `personal_free_user`, Trae's `"Free Plan Subscription"`).
+ */
+export function mapPlanToTier(providerId: string, plan: string | null): AccountTier {
+  const lower = (plan ?? "").trim().toLowerCase();
+  if (lower.length === 0) return null;
+  // Free is only claimed when the string proves it — the same marker set the
+  // routing plan-gate uses, so the two cannot disagree about an account.
+  if (lower.includes("free")) return "free";
+
+  if (QODER_PROVIDER_IDS.has(providerId.toLowerCase())) {
+    // Qoder's `userType` is `personal_standard` by default; team/enterprise/
+    // org suffixes prove a higher tier. `personal_standard` itself is not
+    // verified against the taxonomy, so it stays unknown rather than guessed.
+    if (PRO_PLAN_MARKERS.some((marker) => lower.includes(marker))) return "pro";
+    return null;
+  }
+
+  if (BUDDY_PROVIDER_IDS.has(providerId.toLowerCase())) {
+    if (lower.includes("enterprise") || lower.includes("team")) return "pro";
+    return "paid";
+  }
+
+  // Trae (paid plans other than the free subscription) and Cursor (a non-free
+  // `membershipType`/`planName` is a paying plan by construction).
+  if (TRAE_PROVIDER_IDS.has(providerId.toLowerCase())) return "paid";
+  if (providerId.toLowerCase() === "cursor") return "paid";
+
+  // Unknown provider: no claim. Legacy behavior applies.
+  return null;
+}

package/src/providers/operations/client-versions.ts

@@ -77,7 +77,7 @@ async function clineClientVersion(response: Response): Promise<string | null> {
  * spells it.
  *
  * Cursor's `x-cursor-client-version` is not the IDE semver on its own: the wire
- * value is `cli-<version>-<sha7>` (observed live as `cli-2026.10.19-6bbf2c4`).
+ * value is `cli-<version>-<sha7>` (observed live as `cli-2026.11.05-86047df`).
  * The download API is the only source that returns both halves — `version` and
  * `commitSha` — so they are joined here rather than guessed. A semver alone
  * would be a different identity than the one the IDE sends.
@@ -109,18 +109,6 @@ async function kimiVersion(response: Response): Promise<string | null> {
   return isSemverish(data.info?.version) ? data.info.version.trim() : null;
 }
 
-async function workbuddyDesktopVersion(response: Response): Promise<string | null> {
-  try {
-    const data = (await response.json()) as { version?: unknown; productVersion?: unknown };
-    const candidate = data.productVersion ?? data.version;
-    return typeof candidate === "string" && /^\d+\.\d+\.\d+(?:\.\d+)?(?:[-+][\w.-]+)?$/.test(candidate.trim())
-      ? candidate.trim()
-      : null;
-  } catch {
-    return null;
-  }
-}
-
 async function kiroCaskVersion(response: Response): Promise<string | null> {
   try {
     const data = (await response.json()) as { version?: unknown };
@@ -232,7 +220,7 @@ const KIRO_NODE_VERSION = "24.18.0";
 export const VERSION_SOURCES = {
   antigravity: {
     key: "antigravity",
-    fallback: "2.28.2",
+    fallback: "2.29.0",
     sources: [
       {
         url: "https://antigravity-hub-auto-updater-974169037036.us-central1.run.app/manifest/latest-arm64-mac.yml",
@@ -261,21 +249,21 @@ export const VERSION_SOURCES = {
     // under `@opencode/cli`, and this feed is what its own installer reads.
     // Fallback = the current latest release; raise it whenever the package
     // moves so a cold process does not present a stale client build.
-    fallback: "2.2.5",
+    fallback: "2.2.6",
     minVersion: "2.0.0",
     sources: [{ url: "https://opencode.ai/update/api/latest/cli/npm" }],
   },
   commandcode: {
     key: "commandcode",
-    // npm `command-code` latest as of 2026-10-30. The CLI sends this as
+    // npm `command-code` latest as of 2026-11-07. The CLI sends this as
     // `x-command-code-version`, so a stale fallback presents a client build
     // the upstream no longer ships — raise it whenever the package moves.
-    fallback: "1.88.2",
+    fallback: "1.88.5",
     sources: [{ url: "https://registry.npmjs.org/command-code/latest" }],
   },
   grok: {
     key: "grok",
-    fallback: "1.0.70",
+    fallback: "1.0.77",
     sources: [
       { url: "https://storage.googleapis.com/grok-build-public-artifacts/cli/stable" },
       { url: "https://registry.npmjs.org/@xai-official/grok/latest" },
@@ -304,45 +292,9 @@ export const VERSION_SOURCES = {
   },
   codex: {
     key: "codex",
-    fallback: "0.166.0",
+    fallback: "0.167.0",
     sources: [{ url: "https://registry.npmjs.org/@openai/codex/latest" }],
   },
-  workbuddyClient: {
-    key: "workbuddy-client",
-    fallback: "5.9.4.42593613",
-    sources: [
-      {
-        url: "https://www.workbuddy.ai/v2/update?platform=workbuddy-win32-x64-user",
-        extract: workbuddyDesktopVersion,
-      },
-      {
-        url: "https://www.workbuddy.ai/v2/update?platform=workbuddy-darwin-arm64",
-        extract: workbuddyDesktopVersion,
-      },
-    ],
-  },
-  workbuddyCnClient: {
-    key: "workbuddy-cn-client",
-    fallback: "5.9.3.42398134",
-    sources: [
-      {
-        url: "https://www.workbuddy.cn/v2/update?platform=workbuddy-win32-x64-user",
-        extract: workbuddyDesktopVersion,
-      },
-      {
-        url: "https://www.workbuddy.cn/v2/update?platform=workbuddy-darwin-arm64",
-        extract: workbuddyDesktopVersion,
-      },
-    ],
-  },
-  workbuddyCli: {
-    key: "workbuddy",
-    fallback: "2.178.1",
-    sources: [
-      { url: "https://registry.npmjs.org/@tencent-ai/codebuddy-code/latest" },
-      { url: "https://registry.npmmirror.com/@tencent-ai/codebuddy-code/latest" },
-    ],
-  },
   kimiCli: {
     key: "kimi-cli",
     fallback: "1.52.0",
@@ -350,7 +302,7 @@ export const VERSION_SOURCES = {
   },
   kiro: {
     key: "kiro",
-    fallback: "1.4.62",
+    fallback: "1.4.121",
     sources: [
       {
         // Kiro's downloads page exposes no stable version string. Homebrew
@@ -364,7 +316,7 @@ export const VERSION_SOURCES = {
   },
   codebuddy: {
     key: "codebuddy",
-    fallback: "2.178.1",
+    fallback: "2.181.0",
     sources: [
       { url: "https://registry.npmjs.org/@tencent-ai/codebuddy-code/latest" },
       { url: "https://registry.npmmirror.com/@tencent-ai/codebuddy-code/latest" },
@@ -372,7 +324,7 @@ export const VERSION_SOURCES = {
   },
   codebuddyCn: {
     key: "codebuddy-cn",
-    fallback: "4.12.2.41207131",
+    fallback: "4.12.3.42658816",
     sources: [
       {
         // Official CN builds are listed by Homebrew's maintained cask feed;
@@ -387,7 +339,7 @@ export const VERSION_SOURCES = {
     // Current `@anthropic-ai/claude-code` release, so the billing
     // `cc_version=` suffix and the `claude-cli/` User-Agent stay on what
     // upstream ships.
-    fallback: "2.1.314",
+    fallback: "2.1.319",
     sources: [{ url: "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" }],
   },
   claudeSdk: {
@@ -404,7 +356,7 @@ export const VERSION_SOURCES = {
   },
   github: {
     key: "github-copilot-chat",
-    fallback: "0.43.0",
+    fallback: "0.43.2026040705",
     sources: [
       {
         url: "https://api.github.com/repos/microsoft/vscode-copilot-chat/releases/latest",
@@ -414,7 +366,7 @@ export const VERSION_SOURCES = {
   },
   kilo: {
     key: "kilo-code",
-    fallback: "7.8.25",
+    fallback: "7.8.27",
     sources: [{ url: "https://open-vsx.org/api/kilocode/kilo-code" }],
   },
   muse: {
@@ -436,12 +388,27 @@ export const VERSION_SOURCES = {
       },
     ],
   },
+  freepi: {
+    key: "freepi",
+    // The free-pi CLI version — the `x-client-version` the gateway reports.
+    // Fallback = the unpacked 0.6.14 bundle; npm discovery replaces it.
+    fallback: "0.6.14",
+    sources: [{ url: "https://registry.npmjs.org/free-pi-cli/latest" }],
+  },
+  perch: {
+    key: "perch",
+    // The official Perch CLI, spawned by the adapter for hosted inference.
+    fallback: "2.4.125",
+    sources: [{ url: "https://registry.npmjs.org/perchai-cli/latest" }],
+  },
   cursor: {
     key: "cursor",
-    // Fallback = the last observed wire version. Discovery replaces it within
-    // one monitor tick; it is only what a cold process sends before the first
-    // successful fetch.
-    fallback: "cli-3.27.22-b1aa50c",
+    // Fallback = the last observed wire version (CLI ~2026.11.07-306d153).
+    // Discovery replaces it within one monitor tick; it is only what a cold
+    // process sends before the first successful fetch. Kept equal to
+    // `FALLBACK_CLIENT_VERSION` in the cursor adapter so the badge and the
+    // request header always send one identity.
+    fallback: "cli-3.29.9-306d153",
     sources: [
       {
         url: "https://cursor.com/api/download?platform=win32-x64-user&releaseTrack=stable",
@@ -455,7 +422,7 @@ export const VERSION_SOURCES = {
     // comment this replaced claimed no semver existed and pinned a date tag
     // (`v2026.9.24`) as the version — a tag, not a release, and not the
     // identity the client sends.
-    fallback: "0.22.5",
+    fallback: "0.23.0",
     sources: [
       {
         url: "https://api.github.com/repos/NousResearch/hermes-agent/releases/latest",
@@ -465,7 +432,7 @@ export const VERSION_SOURCES = {
   },
   zcode: {
     key: "zcode",
-    fallback: "3.14.3",
+    fallback: "3.17.2",
     sources: [
       {
         url: "https://api.github.com/repos/zai-org/ZCode/releases/latest",
@@ -480,6 +447,8 @@ const resolvers = {
   qoder: createClientVersionResolver({ ...VERSION_SOURCES.qoder, client: "qoder" }),
   hermes: createClientVersionResolver({ ...VERSION_SOURCES.hermes, client: "hermes" }),
   trae: createClientVersionResolver({ ...VERSION_SOURCES.trae, client: "trae" }),
+  freepi: createClientVersionResolver({ ...VERSION_SOURCES.freepi, client: "freepi" }),
+  perch: createClientVersionResolver({ ...VERSION_SOURCES.perch, client: "perch" }),
   cursor: createClientVersionResolver({ ...VERSION_SOURCES.cursor, client: "cursor" }),
   opencode: createClientVersionResolver({ ...VERSION_SOURCES.opencode, client: "opencode" }),
   commandcode: createClientVersionResolver({ ...VERSION_SOURCES.commandcode, client: "command-code" }),
@@ -488,9 +457,6 @@ const resolvers = {
   clineSdk: createClientVersionResolver({ ...VERSION_SOURCES.clineSdk, client: "cline-sdk" }),
   clineCli: createClientVersionResolver({ ...VERSION_SOURCES.clineCli, client: "cline-cli" }),
   codex: createClientVersionResolver({ ...VERSION_SOURCES.codex, client: "codex" }),
-  workbuddyClient: createClientVersionResolver({ ...VERSION_SOURCES.workbuddyClient, client: "workbuddy" }),
-  workbuddyCnClient: createClientVersionResolver({ ...VERSION_SOURCES.workbuddyCnClient, client: "workbuddy-cn" }),
-  workbuddyCli: createClientVersionResolver({ ...VERSION_SOURCES.workbuddyCli, client: "codebuddy" }),
   kimiCli: createClientVersionResolver({ ...VERSION_SOURCES.kimiCli, client: "kimi" }),
   codebuddy: createClientVersionResolver({ ...VERSION_SOURCES.codebuddy, client: "codebuddy" }),
   codebuddyCn: createClientVersionResolver({ ...VERSION_SOURCES.codebuddyCn, client: "codebuddy" }),
@@ -520,8 +486,6 @@ const PROVIDER_VERSION_RESOLVERS: Readonly<Record<string, ClientVersionResolver>
   traecn: resolvers.trae,
   cursor: resolvers.cursor,
   commandcode: resolvers.commandcode,
-  workbuddy: resolvers.workbuddyClient,
-  workbuddycn: resolvers.workbuddyCnClient,
   cb: resolvers.codebuddy,
   cbcn: resolvers.codebuddyCn,
   kimi: resolvers.kimiCli,
@@ -641,37 +605,11 @@ export const _resetClineCliVersionCache = accessor("clineCli").reset;
 
 export const getCodexVersion = accessor("codex").get;
 
-export const getWorkBuddyClientVersion = accessor("workbuddyClient").get;
-export const getWorkBuddyCnClientVersion = accessor("workbuddyCnClient").get;
-export const getWorkBuddyCliVersion = accessor("workbuddyCli").get;
-
-export function buildWorkBuddyUserAgent(
-  identity = "WB",
-  clientVersion = getWorkBuddyClientVersion(),
-  cliVersion = getWorkBuddyCliVersion(),
-): string {
-  // 1:1 with codebuddy2api. The CLI profile is `CLI/<v> CodeBuddy/<v>` and the
-  // WorkBuddy profile is `WorkBuddy/<wb> workbuddy-ai/<wb> CLI/<cli>`, which
-  // sends NO SDK headers — two separate profiles, not one string with a switch.
-  // Whether SDK headers ride along is decided by `workbuddyHeaders`, not here, so
-  // this builder only decides the UA text.
-  //
-  // The second token is the wire spelling `workbuddy-ai`, NOT the display
-  // brand `WorkBuddy AI`. This is what an official client actually sends; the
-  // product is branded with a space in the UI and in docs, and copying that
-  // branding into the header produced a UA no real client emits — which the
-  // intl gateway answers with 403 `11140`, the same refusal it gives a
-  // wrong-brand header. Product name ≠ wire token.
-  if (identity === "CLI") return `CLI/${cliVersion} CodeBuddy/${cliVersion}`;
-  return `WorkBuddy/${clientVersion} workbuddy-ai/${clientVersion} CLI/${cliVersion}`;
-}
-
-export const _resetWorkBuddyCnClientVersionCache = accessor("workbuddyCnClient").reset;
-
 export const getKimiCliVersion = accessor("kimiCli").get;
 
 export const getCodeBuddyVersion = accessor("codebuddy").get;
 export const getCodeBuddyCnVersion = accessor("codebuddyCn").get;
+
 /**
  * The CodeBuddy User-Agent.
  *

package/src/providers/operations/cooldown-rules.ts

@@ -0,0 +1,61 @@
+/**
+ * Static in-code registry of provider × category × tier cooldown rules (D19).
+ *
+ * The registry ships empty by default: before a rule is filled in, behavior is
+ * byte-identical to the old hardcoded constants. Rules are keyed by
+ * `(providerId, category, tier)` and, when present, replace the provider's old
+ * cooldown constant for that combination — they sit between the provider-stated
+ * window (which always wins, D18) and the old constant/env fallback.
+ *
+ * The initial content is the example from the approved proposal (part 03):
+ * Trae's daily-quota verdict (`model_unreachable`, upstream 4008) cools a free
+ * account for a full day and a paid/pro account for 15 minutes (D17 — `paid`
+ * never gets `0`, which would hammer the upstream on a wrong verdict).
+ */
+import type { AccountErrorCategory } from "./account-error-classification";
+import type { AccountTier } from "./account-tier";
+
+export type CooldownRuleKey = {
+  readonly providerId: string;
+  readonly category: AccountErrorCategory;
+  readonly tier: AccountTier;
+};
+
+type TierRules = Partial<Record<NonNullable<AccountTier>, number>>;
+type CategoryRules = Partial<Record<AccountErrorCategory, TierRules>>;
+type ProviderRules = Record<string, CategoryRules>;
+
+const DAY = 24 * 60 * 60 * 1000;
+const MINUTE = 60 * 1000;
+
+const COOLDOWN_RULES: ProviderRules = {
+  trae: {
+    model_unreachable: {
+      free: DAY,
+      paid: 15 * MINUTE,
+      pro: 15 * MINUTE,
+    },
+  },
+  // Trae CN is the same upstream product under a second realm id — the
+  // classifier already treats the two identically (trae-region-unavailable,
+  // trae-quota-exhausted), so the rules mirror.
+  traecn: {
+    model_unreachable: {
+      free: DAY,
+      paid: 15 * MINUTE,
+      pro: 15 * MINUTE,
+    },
+  },
+};
+
+/**
+ * Resolves a cooldown rule for `(providerId, category, tier)`.
+ *
+ * Returns `undefined` when no rule exists — for an unknown provider, an
+ * unstored category, or an unknown tier — which is the signal to keep the old
+ * constant/fallback behavior.
+ */
+export function resolveCooldownRule(key: CooldownRuleKey): number | undefined {
+  if (key.tier === null || key.tier === undefined) return undefined;
+  return COOLDOWN_RULES[key.providerId.toLowerCase()]?.[key.category]?.[key.tier];
+}