cartethyia 2.7.8 → 2.8.0

package/src/console/providers/catalog/contracts.ts

@@ -62,6 +62,72 @@ export const ACCOUNT_STATUSES = ["active", "disabled"] as const;
 /** One operator-settable account status. */
 export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
 
+/** Display-only warning type shared with the dashboard contract mirror. */
+export type { ModelWarning, ModelWarningSeverity } from "../../../providers/provider-model-definition";
+import type { ModelWarning } from "../../../providers/provider-model-definition";
+
+/**
+ * Outcome of one provider-scoped bulk account action (area 02).
+ *
+ * A tenant-scoped action never touches shared (`tenant_id IS NULL`) rows; the
+ * global-admin pair of routes does. `globalSkipped` counts those rows on the
+ * tenant path so the console can say why its visible list and the DB disagree.
+ * `deleted`/`missing` are present on delete; `updated` on disable. Both actions
+ * are idempotent: a second call finds no matching row and reports zero.
+ */
+export interface ProviderAccountBulkActionResult {
+  readonly ok: boolean;
+  readonly updated: number;
+  readonly deleted?: readonly string[];
+  readonly missing?: readonly string[];
+  readonly globalSkipped: number;
+}
+
+/** Cap on one discovery-commit request (D29). Kept pure (no `node:*`) so the dashboard can import it. */
+export { DISCOVER_MODEL_COMMIT_MAX } from "./discover-constants";
+
+/**
+ * One model the provider's own listing advertised, projected for the Add-Model
+ * picker. Read-only: `GET .../models/discover` writes nothing. `models`
+ * metadata here is the fetched `ModelDefinition`, not the static catalog's
+ * guess, so the operator can see exactly what the commit will store.
+ */
+export interface DiscoverModelCandidate {
+  readonly modelId: string;
+  readonly wireFamily: string;
+  readonly serviceKind: string;
+  readonly endpointPath: string;
+  readonly contextLimit: number | null;
+  readonly outputLimit: number | null;
+  readonly modalities: { readonly input: readonly string[]; readonly output: readonly string[] };
+  readonly reasoning: boolean;
+  readonly toolCall: boolean;
+  readonly freeTier?: boolean;
+  readonly proOnly?: boolean;
+  readonly alreadyRegistered: boolean;
+}
+
+/** Result of `GET .../models/discover`. */
+export interface DiscoverModelCandidatesResponse {
+  readonly supported: boolean;
+  readonly candidates: readonly DiscoverModelCandidate[];
+  /** Label of the usable account whose credential fetched the listing (D27). */
+  readonly accountLabel?: string;
+}
+
+/** Body of `POST .../models/discover/commit`. */
+export interface DiscoverModelCommitRequest {
+  readonly modelIds: readonly string[];
+}
+
+/** Outcome of a discovery commit: the ids persisted and the ones skipped. */
+export interface DiscoverModelCommitResult {
+  readonly ok: boolean;
+  readonly committed: readonly string[];
+  readonly skipped: readonly string[];
+  readonly synced: number;
+}
+
 const VALID_WIRE_FAMILIES: Record<WireFamily, true> = {
   chat: true,
   responses: true,
@@ -121,6 +187,16 @@ const ADAPTER_OWNED: Record<string, true> = {
 };
 
 export function validateCompatibilityProfile(profile: CompatibilityProfile): void {
+  if (profile.service_kinds !== undefined) {
+    if (!Array.isArray(profile.service_kinds)) {
+      throw new GatewayError("invalid_request", 400, "service_kinds must be an array (request {requestId}). Check the shape of what you sent — then resend 🪞");
+    }
+    for (const kind of profile.service_kinds) {
+      if (!isServiceKind(kind)) {
+        throw new GatewayError("invalid_request", 400, `unknown service kind ${String(kind)} (request {requestId}). Check the shape of what you sent — then resend 🪞`);
+      }
+    }
+  }
   if (profile.cli_identity !== undefined) {
     if (typeof profile.cli_identity !== "boolean") {
       throw new GatewayError("invalid_request", 400, "cli_identity must be boolean (request {requestId}). Check the shape of what you sent — then resend 🪞");
@@ -358,6 +434,8 @@ export interface ModelCatalogEntry {
    * provider's own model directory states it.
    */
   freeTier?: boolean;
+  /** Display-only warnings; `null` in storage means none. */
+  warnings?: readonly ModelWarning[];
 }
 export interface FlatModelCatalogEntry {
   readonly providerId: string;
@@ -407,6 +485,11 @@ export interface ModelMetadataOverride {
   readonly image?: boolean;
   readonly reasoning?: boolean;
   readonly toolCall?: boolean;
+  /**
+   * Display-only warnings, editable only on non-builtin rows. `null` clears
+   * the stored value; absence leaves it alone.
+   */
+  readonly warnings?: readonly ModelWarning[] | null;
 }
 
 /** Register payload: model ids plus optional operator metadata. */
@@ -484,6 +567,27 @@ export interface UpdateProviderAccountRequest {
    */
   staticToken?: boolean;
 }
+/**
+ * Response of `POST /providers/:providerId/accounts/:accountId/refresh-token`
+ * (area 04). The refresh never changes `status`: `statusAfter` is re-read from
+ * the database after the attempt and is never `"active"` by fiat — a disabled
+ * account stays disabled, only an operator can re-enable it.
+ */
+export interface RefreshAccountTokenResponse {
+  readonly ok: boolean;
+  readonly statusAfter: string;
+  /** True when an upstream token refresh actually minted a fresh token. */
+  readonly tokenRefreshed?: boolean;
+  /** ISO timestamp of the fresh access-token expiry, when known. */
+  readonly expiresAt?: string;
+  /** ISO timestamp of the refresh attempt. */
+  readonly refreshedAt?: string;
+  /** Structured reason when `ok` is false (`not_oauth`, `static_token`, …). */
+  readonly error?: string;
+  /** Human detail (failure message) when available. */
+  readonly category?: string;
+}
+
 export interface ProviderAccountTokenUsage {
   readonly requests: number;
   readonly errors: number;
@@ -786,6 +890,7 @@ export interface ProviderCatalogStore {
   probeAllModels(
     tenantId: string,
     providerId: string,
+    mode?: ProbeModelRequest["mode"],
   ): Promise<ProbeAllModelsResult>;
   probeAllAccounts(
     tenantId: string,
@@ -817,6 +922,20 @@ export interface ProviderCatalogStore {
     request: UpdateModelMetadataRequest,
   ): Promise<boolean>;
   syncModels(tenantId: string, providerId: string): Promise<{ synced: number }>;
+  /**
+   * Read-only `/models` discovery. Never persists. `supported: false` names a
+   * provider with no listing endpoint so the UI can fall back to manual add.
+   */
+  listDiscoveryCandidates(
+    tenantId: string,
+    providerId: string,
+  ): Promise<{ readonly supported: boolean; readonly candidates: readonly DiscoverModelCandidate[]; readonly accountLabel?: string }>;
+  /** Persists a verified subset of a fresh discovery as `source="manual"`. */
+  commitDiscoveredModels(
+    tenantId: string,
+    providerId: string,
+    modelIds: readonly string[],
+  ): Promise<{ readonly committed: readonly string[]; readonly skipped: readonly string[]; readonly synced: number }>;
   listAccounts(tenantId: string, providerId: string): Promise<readonly ProviderAccountResponse[]>;
   listAllAccounts(tenantId: string): Promise<readonly ProviderAccountResponse[]>;
   /**
@@ -891,6 +1010,10 @@ export interface ProviderCatalogStore {
     dayKey: string,
   ): Promise<readonly BuddyGrowthTaskLedgerEntry[]>;
   recoverAccount(tenantId: string, providerId: string, accountId: string): Promise<boolean>;
+  /** One UPDATE over this tenant's cooling accounts (D07/D08); evidence kept. */
+  disableCooldowns(tenantId: string, providerId: string): Promise<ProviderAccountBulkActionResult>;
+  /** One DELETE over this tenant's banned accounts (D12); idempotent. */
+  deleteBanned(tenantId: string, providerId: string): Promise<ProviderAccountBulkActionResult>;
 }
 
 /**

package/src/console/providers/catalog/discover-constants.ts

@@ -0,0 +1,6 @@
+/**
+ * Pure discovery constants, kept free of any `node:*` imports so the
+ * dashboard can import them without dragging Node crypto into the browser
+ * bundle — the same reason `ban-constants.ts` and `usage-dimensions.ts` exist.
+ */
+export const DISCOVER_MODEL_COMMIT_MAX = 100;

package/src/console/providers/catalog/model-operations.ts

@@ -11,7 +11,17 @@
 import type { AccessDecision } from "../../../security/access-control";
 import { ConsoleDomainError, requireScope, requireTenantAnyScope } from "../../shared/errors";
 import { GatewayError } from "../../../protocol/gateway-error";
-import { MODEL_READ_SCOPES, MODEL_WRITE_SCOPES } from "./contracts";
+import {
+  DISCOVER_MODEL_COMMIT_MAX,
+  MODEL_READ_SCOPES,
+  MODEL_WRITE_SCOPES,
+} from "./contracts";
+import type { DiscoverModelCandidatesResponse, DiscoverModelCommitResult } from "./contracts";
+import {
+  MODEL_WARNING_KIND_MAX_LENGTH,
+  MODEL_WARNING_MESSAGE_MAX_LENGTH,
+  MODEL_WARNING_SEVERITIES,
+} from "../../../providers/provider-model-definition";
 import type {
   ByokConnectionTestRequest,
   ByokConnectionTestResult,
@@ -47,6 +57,60 @@ function validateModelMetadata(metadata: ModelMetadataOverride | undefined): voi
         `${field} must be a positive integer, or null for unknown`,
       );
   }
+  // `null` clears the stored blob; an absent field leaves it alone. Only a
+  // non-builtin row can actually carry an edit — the store enforces that
+  // invariant. Bounds here stop a hostile payload from persisting a multi-MB
+  // display banner; severity is a closed whitelist.
+  if (metadata.warnings === null || metadata.warnings === undefined) return;
+  if (!Array.isArray(metadata.warnings)) {
+    throw new ConsoleDomainError("invalid_request", 400, "warnings must be an array or null");
+  }
+  for (const [index, warning] of metadata.warnings.entries()) {
+    if (warning === null || typeof warning !== "object" || Array.isArray(warning)) {
+      throw new ConsoleDomainError("invalid_request", 400, `warnings[${index}] must be an object`);
+    }
+    const kind = (warning as { kind?: unknown }).kind;
+    const message = (warning as { message?: unknown }).message;
+    const severity = (warning as { severity?: unknown }).severity;
+    if (typeof kind !== "string" || kind.trim().length === 0 || kind.length > MODEL_WARNING_KIND_MAX_LENGTH) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `warnings[${index}].kind must be a non-empty string up to ${MODEL_WARNING_KIND_MAX_LENGTH} chars`,
+      );
+    }
+    if (typeof message !== "string" || message.trim().length === 0 || message.length > MODEL_WARNING_MESSAGE_MAX_LENGTH) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `warnings[${index}].message must be a non-empty string up to ${MODEL_WARNING_MESSAGE_MAX_LENGTH} chars`,
+      );
+    }
+    if (
+      severity !== undefined &&
+      (typeof severity !== "string" ||
+        !(MODEL_WARNING_SEVERITIES as readonly string[]).includes(severity))
+    ) {
+      throw new ConsoleDomainError(
+        "invalid_request",
+        400,
+        `warnings[${index}].severity must be one of ${MODEL_WARNING_SEVERITIES.join(", ")}`,
+      );
+    }
+  }
+}
+
+/**
+ * Discovery lives in the provider layer and raises `GatewayError`; the console
+ * speaks `ConsoleDomainError`. Keeping the exact code/status/message lets the
+ * dashboard toast name the real upstream reason rather than a generic failure.
+ */
+function translateDiscoveryError(error: unknown): unknown {
+  if (error instanceof ConsoleDomainError) return error;
+  if (error instanceof GatewayError) {
+    return new ConsoleDomainError(error.code, error.status, error.message);
+  }
+  return error;
 }
 
 export function createModelCatalogOperations(config: ProviderCatalogConfig) {
@@ -164,14 +228,7 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
           await config.snapshotInvalidator?.invalidate();
           return result;
         } catch (error) {
-          // Discovery runs in the provider layer and raises `GatewayError`; the
-          // console speaks `ConsoleDomainError`. Translating here keeps the
-          // upstream-vs-operator distinction and the status code intact, so the
-          // dashboard toast names the real reason instead of a generic failure.
-          if (error instanceof GatewayError) {
-            throw new ConsoleDomainError(error.code, error.status, error.message);
-          }
-          throw error;
+          throw translateDiscoveryError(error);
         }
       }
       /** Manually registers additional model ids on an existing provider (tenant-bound, no upstream call). */,
@@ -247,9 +304,10 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
     async probeAllModels(
         access: AccessDecision | undefined,
         providerId: string,
+        mode?: ProbeModelRequest["mode"],
       ): Promise<ProbeAllModelsResult> {
         const a = requireTenantAnyScope(access, MODEL_WRITE_SCOPES);
-        return config.store.probeAllModels(a.tenantId, providerId);
+        return config.store.probeAllModels(a.tenantId, providerId, mode);
       },
       async probeAllAccounts(
         access: AccessDecision | undefined,
@@ -299,6 +357,60 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
         await config.snapshotInvalidator?.invalidate();
         return { success: true };
       },
+    /**
+     * `GET .../models/discover`: fetch the provider's own listing without any
+     * write (D30). A provider with no listing endpoint answers `supported:false`
+     * so the UI can fall back to manual add instead of showing an error.
+     */
+    async listDiscoveryCandidates(
+      access: AccessDecision | undefined,
+      providerId: string,
+    ): Promise<DiscoverModelCandidatesResponse> {
+      const a = requireTenantAnyScope(access, MODEL_READ_SCOPES);
+      try {
+        return await config.store.listDiscoveryCandidates(a.tenantId, providerId);
+      } catch (error) {
+        throw translateDiscoveryError(error);
+      }
+    },
+    /**
+     * `POST .../models/discover/commit`: the store re-fetches the roster and
+     * rejects ids outside it (D31), so no hand-forged id can be persisted.
+     */
+    async commitDiscoveredModels(
+      access: AccessDecision | undefined,
+      providerId: string,
+      modelIds: readonly string[],
+    ): Promise<DiscoverModelCommitResult> {
+      const a = requireTenantAnyScope(access, MODEL_WRITE_SCOPES);
+      if (modelIds.some((id) => typeof id !== "string" || id.trim().length === 0)) {
+        throw new ConsoleDomainError(
+          "invalid_request",
+          400,
+          "modelIds must be non-empty model ids",
+        );
+      }
+      if (modelIds.length === 0 || modelIds.length > DISCOVER_MODEL_COMMIT_MAX) {
+        throw new ConsoleDomainError(
+          "invalid_request",
+          400,
+          `modelIds must contain 1-${DISCOVER_MODEL_COMMIT_MAX} entries`,
+        );
+      }
+      try {
+        const result = await config.store.commitDiscoveredModels(a.tenantId, providerId, modelIds);
+        await config.auditSink?.record({
+          access: a,
+          action: "provider.models.registered",
+          target: providerId,
+          detail: { modelIds: result.committed, source: "discover-commit" },
+        });
+        await config.snapshotInvalidator?.invalidate();
+        return { ok: true, ...result };
+      } catch (error) {
+        throw translateDiscoveryError(error);
+      }
+    },
     async deleteModelsBulk(
         access: AccessDecision | undefined,
         providerId: string,

package/src/console/providers/catalog/provider-operations.ts

@@ -15,6 +15,7 @@ import {
   ConsoleDomainError,
   requireGlobalAdmin,
   requireTenantAnyScope,
+  requireTenantScope,
 } from "../../shared/errors";
 import { cachedReadWithEtag, conditionalResponse } from "../../shared/read-through-cache";
 import type { RedisClient } from "../../../persistence/redis";
@@ -24,10 +25,11 @@ import { isBundledProviderId } from "../../../providers/provider-contracts";
 import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { getProviderClientVersion, getRouteIdentityVersions } from "../../../providers/operations/client-versions";
 import type { OAuthLoginField } from "../../../providers/authentication/oauth-flow-store";
-import { providerCredentialHint, providerCredentialUrl, providerDisplayName, providerHasAdapterUserAgent, providerOperatorNotice, providerServiceKinds, type CompatibilityProfile } from "../../../providers/provider-metadata";
+import { providerCredentialHint, providerCredentialUrl, providerDisplayName, providerHasAdapterUserAgent, providerOperatorNotice, providerServiceKinds, customProviderServiceKinds, type CompatibilityProfile } from "../../../providers/provider-metadata";
 import type { AccountHealthEventRecord } from "../../../providers/operations/account-health-service";
 import { healthEventBuffer } from "../../../persistence/health-event-flush";
-import { CREDENTIAL_MODES, PROVIDER_READ_SCOPES, PROVIDER_WRITE_SCOPES, type BuddyGrowthTaskLedgerEntry } from "./contracts";
+import { CREDENTIAL_MODES, PROVIDER_READ_SCOPES, PROVIDER_WRITE_SCOPES, type BuddyGrowthTaskLedgerEntry, type ProviderAccountBulkActionResult, type RefreshAccountTokenResponse } from "./contracts";
+import type { RefreshAccountStatusOutcome } from "../../../providers/operations/account-refresh-status";
 import { enqueueCheckin } from "../../../workers/daily-checkin";
 import {
   isWireFamily,
@@ -87,12 +89,16 @@ export function sanitizeProviderResponse(
   const credentialHint = providerCredentialHint(p.providerId);
   const operatorNotice = providerOperatorNotice(p.providerId);
   const clientVersion = getProviderClientVersion(p.providerId);
+  const compatibilityProfile = p.compatibilityProfile as CompatibilityProfile | undefined;
+  const isBuiltIn = (p.isBuiltIn as boolean | undefined) ?? false;
   const response: ProviderResponse = {
     providerId: p.providerId,
-    serviceKinds: providerServiceKinds(p.providerId),
+    serviceKinds: isBuiltIn
+      ? providerServiceKinds(p.providerId)
+      : customProviderServiceKinds(compatibilityProfile),
     displayName: providerDisplayName(p.providerId),
     enabled: (p.enabled as boolean | undefined) ?? true,
-    isBuiltIn: (p.isBuiltIn as boolean | undefined) ?? false,
+    isBuiltIn,
     requiresAccount: (p.requiresAccount as boolean | undefined) ?? true,
     hasAdapterUserAgent: providerHasAdapterUserAgent(p.providerId),
     // No model advertises search; see the note in provider-metadata.ts.
@@ -102,7 +108,7 @@ export function sanitizeProviderResponse(
     ...(operatorNotice === undefined ? {} : { operatorNotice }),
     ...(clientVersion === undefined ? {} : { clientVersion }),
     routeIdentityVersions: getRouteIdentityVersions(),
-    supportsModelDiscovery: (p.supportsModelDiscovery as boolean | undefined) ?? !p.isBuiltIn,
+    supportsModelDiscovery: (p.supportsModelDiscovery as boolean | undefined) ?? !isBuiltIn,
     ...(typeof p.createdAt === "string" ? { createdAt: p.createdAt } : {}),
     ...(typeof p.updatedAt === "string" ? { updatedAt: p.updatedAt } : {}),
   };
@@ -182,6 +188,15 @@ export interface ProviderCatalogConfig {
     providerId: string,
     accountId: string,
   ) => Promise<{ readonly accessToken: string; readonly refreshToken?: string }>;
+  /**
+   * One-shot manual OAuth token refresh (area 04). Provided by the composition
+   * root; when absent the refresh-token route answers 501 rather than silently
+   * reporting success.
+   */
+  readonly refreshAccountStatus?: (
+    accountId: string,
+    opts?: { readonly origin?: "ui" | "sweep" | "dispatch" },
+  ) => Promise<RefreshAccountStatusOutcome>;
 }
 async function attachProviderCapabilities(
   response: ProviderResponse,
@@ -715,6 +730,101 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
         await config.snapshotInvalidator?.invalidate();
         return { success: true };
       },
+    /**
+     * One UPDATE over the tenant's cooling accounts, with `cooldownUntil` and
+     * `modelCooldowns` preserved as evidence (D07/D08). Shared rows are not
+     * writable here: the platform-admin pair of routes owns them (D10).
+     */
+    async disableCooldowns(
+      access: AccessDecision | undefined,
+      providerId: string,
+    ): Promise<ProviderAccountBulkActionResult> {
+      const a = requireTenantAnyScope(access, PROVIDER_WRITE_SCOPES);
+      const result = await config.store.disableCooldowns(a.tenantId, providerId);
+      await config.auditSink?.record({
+        access: a,
+        action: "provider_account.bulk_disabled_cooldowns",
+        target: providerId,
+        detail: { providerId, updated: result.updated, globalSkipped: result.globalSkipped },
+      });
+      await config.snapshotInvalidator?.invalidate();
+      return { ok: true, updated: result.updated, globalSkipped: result.globalSkipped };
+    },
+    /**
+     * One DELETE over the tenant's strictly banned accounts (D12). Empty
+     * matches are a successful no-op, so a second click is idempotent.
+     */
+    async deleteBanned(
+      access: AccessDecision | undefined,
+      providerId: string,
+    ): Promise<ProviderAccountBulkActionResult> {
+      const a = requireTenantAnyScope(access, PROVIDER_WRITE_SCOPES);
+      const result = await config.store.deleteBanned(a.tenantId, providerId);
+      await config.auditSink?.record({
+        access: a,
+        action: "provider_account.bulk_deleted_banned",
+        target: providerId,
+        detail: {
+          providerId,
+          deleted: result.deleted ?? [],
+          missing: result.missing ?? [],
+          globalSkipped: result.globalSkipped,
+        },
+      });
+      await config.snapshotInvalidator?.invalidate();
+      return {
+        ok: true,
+        updated: 0,
+        deleted: result.deleted ?? [],
+        missing: result.missing ?? [],
+        globalSkipped: result.globalSkipped,
+      };
+    },
+    async refreshAccountToken(
+        access: AccessDecision | undefined,
+        providerId: string,
+        accountId: string,
+      ): Promise<RefreshAccountTokenResponse> {
+        // The refresh changes no routing state and is a per-account operator
+        // action, so the browser session's own write scope is sufficient.
+        const a = requireTenantScope(access, "dashboard:write");
+        // 404 unless the account exists and belongs to this provider/tenant.
+        const accounts = await config.store.listAccounts(a.tenantId, providerId);
+        const owned = accounts.find((account) => account.id === accountId && account.tenantId === a.tenantId);
+        if (!owned)
+          throw new ConsoleDomainError("account_not_found", 404, `Account ${accountId} not found`);
+        // 409 for a static token (nothing to re-mint), 400 for non-OAuth —
+        // before calling the refresher, so the row is never touched on a
+        // rejectable request.
+        if (owned.staticToken === true)
+          throw new ConsoleDomainError("static_token", 409, "Account carries a static token that cannot be refreshed");
+        if (owned.credentialKind !== "oauth")
+          throw new ConsoleDomainError("not_oauth", 400, "Account is not OAuth; token refresh is not applicable");
+        if (!config.refreshAccountStatus)
+          throw new ConsoleDomainError("refresh_unavailable", 501, "Token refresh is not configured on this host");
+        const outcome = await config.refreshAccountStatus(accountId, { origin: "ui" });
+        await config.auditSink?.record({
+          access: a,
+          action: "provider_account.token_refreshed",
+          target: accountId,
+          detail: {
+            providerId,
+            ok: outcome.ok,
+            statusAfter: outcome.statusAfter,
+            ...(outcome.error === undefined ? {} : { error: outcome.error }),
+          },
+        });
+        await config.snapshotInvalidator?.invalidate();
+        return {
+          ok: outcome.ok,
+          statusAfter: outcome.statusAfter,
+          ...(outcome.tokenRefreshed ? { tokenRefreshed: true } : {}),
+          ...(outcome.expiresAt === undefined ? {} : { expiresAt: outcome.expiresAt }),
+          ...(outcome.refreshedAt === undefined ? {} : { refreshedAt: outcome.refreshedAt }),
+          ...(outcome.error === undefined ? {} : { error: outcome.error }),
+          ...(outcome.category === undefined ? {} : { category: outcome.category }),
+        };
+      },
     /**
      * Exports the requested accounts with their decrypted credentials.
      *
@@ -778,9 +888,7 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
                 // channel check (11128) rejects the imported account.
                 const materialized =
                   account.providerId === "cb" ||
-                  account.providerId === "cbcn" ||
-                  account.providerId === "workbuddy" ||
-                  account.providerId === "workbuddycn"
+                  account.providerId === "cbcn"
                     // dynamic-import: B-02 lazy graph — buddy device-binding materializer, buddy-family only.
                     // The buddy-identity graph is lazy-loaded: the device-binding
                     // materializer only runs for buddy-family accounts (B-02).

package/src/console/providers/catalog/routes.ts

@@ -2,9 +2,10 @@ import { consoleErrorHandler } from "../../shared/errors";
 import { literalUnion } from "../../shared/elysia-schema";
 import { Elysia, t, type AnyElysia } from "elysia";
 import { SERVICE_KINDS, WIRE_FAMILIES } from "../../../protocol/canonical-model";
-import { PROBE_REASONING_EFFORTS } from "../../../providers/discovery/discovery-types";
+import { PROBE_MODES, PROBE_REASONING_EFFORTS } from "../../../providers/discovery/discovery-types";
 import {
   ACCOUNT_STATUSES,
+  DISCOVER_MODEL_COMMIT_MAX,
   CREDENTIAL_KINDS,
   CREDENTIAL_MODES,
 } from "./contracts";
@@ -18,6 +19,7 @@ import type {
   ByokConnectionTestRequest,
   CreateProviderAccountRequest,
   CreateProviderRequest,
+  DiscoverModelCommitRequest,
   ProbeModelRequest,
   RegisterModelsRequest,
   SetModelEnabledRequest,
@@ -42,6 +44,7 @@ const compatibilityProfileSchema = t.Object({
       }),
     ),
   ),
+  service_kinds: t.Optional(t.Array(literalUnion(SERVICE_KINDS))),
   streaming_usage_mode: t.Optional(t.Union([t.Literal("include_usage"), t.Literal("none")])),
   structured_output: t.Optional(
     t.Object({
@@ -110,12 +113,28 @@ const modelMetadataOverrideBody = t.Object({
   image: t.Optional(t.Boolean()),
   reasoning: t.Optional(t.Boolean()),
   toolCall: t.Optional(t.Boolean()),
+  warnings: t.Optional(
+    t.Union([
+      t.Null(),
+      t.Array(
+        t.Object({
+          kind: t.String(),
+          message: t.String(),
+          severity: t.Optional(literalUnion(["info", "warn", "critical"])),
+          updatedAt: t.Optional(t.String()),
+        }),
+      ),
+    ]),
+  ),
 });
 const registerModelsBody = t.Object({
   modelIds: t.Array(t.String()),
   wireFamily: t.Optional(t.String()),
   metadata: t.Optional(modelMetadataOverrideBody),
 });
+const discoverCommitBody = t.Object({
+  modelIds: t.Array(t.String(), { minItems: 1, maxItems: DISCOVER_MODEL_COMMIT_MAX }),
+});
 const probeModelBody = t.Object({
   modelId: t.String(),
   serviceKind: t.Optional(literalUnion(SERVICE_KINDS)),
@@ -127,6 +146,7 @@ const probeModelBody = t.Object({
   maxOutputTokens: t.Optional(t.Integer({ minimum: 1, maximum: 131072 })),
   stream: t.Optional(t.Boolean()),
   surface: t.Optional(literalUnion(["default", "cosy", "grpc", "ide"])),
+  mode: t.Optional(literalUnion(PROBE_MODES)),
 });
 const byokConnectionTestBody = t.Object({
   baseUrl: t.String(),
@@ -275,9 +295,42 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): AnyE
         );
 },
     )
-    .post("/:providerId/models/test-models", async ({ request, params }) => {
-      return await modelFactory.probeAllModels(config.accessResolver(request), params.providerId);
-})
+    .post(
+      "/:providerId/models/test-models",
+      { body: t.Optional(t.Object({ mode: t.Optional(literalUnion(PROBE_MODES)) })) },
+      async ({ request, params, body }) => {
+        return await modelFactory.probeAllModels(
+          config.accessResolver(request),
+          params.providerId,
+          body?.mode,
+        );
+      },
+    )
+    // Discovery must be declared before `/:providerId/models/discover/commit`
+    // would be shadowed by a dynamic segment; Elysia resolves both here.
+    .get("/:providerId/models/discover", async ({ request, params }) => {
+      return await modelFactory.listDiscoveryCandidates(
+        config.accessResolver(request),
+        params.providerId,
+      );
+    })
+    .post(
+      "/:providerId/models/discover/commit",
+      { body: discoverCommitBody },
+      async ({ request, params, body }) => {
+        return await modelFactory.commitDiscoveredModels(
+          config.accessResolver(request),
+          params.providerId,
+          (body as DiscoverModelCommitRequest).modelIds,
+        );
+      },
+    )
+    .post("/:providerId/accounts/actions/disable-cooldowns", async ({ request, params }) => {
+      return await factory.disableCooldowns(config.accessResolver(request), params.providerId);
+    })
+    .post("/:providerId/accounts/actions/delete-banned", async ({ request, params }) => {
+      return await factory.deleteBanned(config.accessResolver(request), params.providerId);
+    })
     .post(
       "/:providerId/accounts/probe",
       { body: probeModelBody },
@@ -408,6 +461,14 @@ export function createProviderCatalogRoutes(config: ProviderCatalogConfig): AnyE
         params.accountId,
       );
       return recovered;
+})
+    .post("/:providerId/accounts/:accountId/refresh-token", async ({ request, params }) => {
+      const refreshed = await factory.refreshAccountToken(
+        config.accessResolver(request),
+        params.providerId,
+        params.accountId,
+      );
+      return refreshed;
 })
     .post(
       "/:providerId/accounts/export",