cartethyia 2.7.8 → 2.8.0

package/src/providers/default-registry.ts

@@ -4,13 +4,20 @@
 // drag every integration into memory at process start.
 import {
   GENERIC_API_KEY_SPECS,
-} from "./configured-openai-providers";
-import { createDiscoveryBackedProviderCapabilities, discoveryBackedCapabilities } from "./bundled-discovery-providers";
-import { createApiKeyAdapter } from "./configured-provider";
-import type { ApiKeyProviderSpec } from "./configured-provider";
-import { oauthCapability, quotaCapability, type ProviderModuleCapabilities } from "./provider-capabilities";
+  createDiscoveryBackedProviderCapabilities,
+  discoveryBackedCapabilities,
+  createApiKeyAdapter,
+  type ApiKeyProviderSpec,
+} from "./configured-provider";
 import { BUDDY_PROVIDER_CAPABILITIES } from "./integrations/buddy/capabilities";
-import { ProviderRegistry, toRegistration, type ProviderModule } from "./provider-registry";
+import {
+  ProviderRegistry,
+  toRegistration,
+  oauthCapability,
+  quotaCapability,
+  type ProviderModule,
+  type ProviderModuleCapabilities,
+} from "./provider-registry";
 import { BUNDLED_PROVIDER_METADATA, PROVIDER_COMPATIBILITY_PROFILES, providerBaseUrl, providerRequiresAccount, providerUpstreamHost, providerDefaultWireFamily, type BundledProviderId } from "./provider-metadata";
 import { createAnthropicCompatibleAdapter } from "./integrations/anthropic";
 import { defineModel } from "./provider-model-definition";
@@ -31,6 +38,29 @@ function configuredProvider(
   };
 }
 
+/**
+ * Extracts a bearer token from a JSON credential object when the stored secret
+ * is a JSON account export, falling back to the raw secret otherwise. Several
+ * discovery paths accept both a bare token and a JSON export, and each used to
+ * re-implement this same parse + key-pick; this keeps the reading in one place.
+ *
+ * Preserves the exact fallback semantics: an unparseable secret, or a JSON
+ * object with none of the recognized token keys, yields the raw secret.
+ */
+function extractJsonCredentialToken(secret: string): string {
+  if (!secret.startsWith("{")) return secret;
+  try {
+    const parsed = JSON.parse(secret) as Record<string, unknown>;
+    const found = ["accessToken", "access_token", "token"].find(
+      (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
+    );
+    if (found !== undefined) return parsed[found] as string;
+  } catch {
+    // Use the raw secret as the token.
+  }
+  return secret;
+}
+
 /**
  * Qoder's live model list for one realm.
  *
@@ -60,18 +90,7 @@ function traeDiscovery(
     if (secret.length === 0 || fetcher === undefined) {
       return realm === "cn" ? TRAE_CN_MODELS : TRAE_INTL_MODELS;
     }
-    let token = secret;
-    if (secret.startsWith("{")) {
-      try {
-        const parsed = JSON.parse(secret) as Record<string, unknown>;
-        const found = ["accessToken", "access_token", "token"].find(
-          (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
-        );
-        if (found !== undefined) token = parsed[found] as string;
-      } catch {
-        // Use the raw secret as the token.
-      }
-    }
+    const token = extractJsonCredentialToken(secret);
     const region = request.authState?.["region"];
     const rows = await discoverTraeModels({
       realm,
@@ -84,12 +103,15 @@ function traeDiscovery(
     if (rows.length === 0) return realm === "cn" ? TRAE_CN_MODELS : TRAE_INTL_MODELS;
     const fallback = realm === "cn" ? TRAE_CN_MODELS : TRAE_INTL_MODELS;
     const byId = new Map(fallback.map((model) => [model.modelId, model]));
+    // Return everything the upstream picker reports — the live listing is the
+    // truth for the account, including configs absent from the static roster.
+    // The static roster is only the fallback when discovery fails. A config
+    // discovered upstream gets the realm's first row as a template so it is
+    // routable with the shape this provider serves, carrying the window
+    // upstream reported.
     return rows.map((row) => {
       const existing = byId.get(row.id);
       if (existing === undefined) {
-        // Discovered upstream but absent from the static roster: clone the
-        // realm's first row so a new model is routable with the shape this
-        // provider serves, carrying the window upstream reported.
         const template = fallback[0];
         if (template === undefined) return undefined;
         return { ...template, modelId: row.id, contextLimit: row.ctx ?? null };
@@ -315,6 +337,20 @@ export const PROVIDER_CAPABILITIES = {
         ...(fetcher === undefined ? {} : { fetcher }),
       }),
   },
+  devin: {
+    // Devin's chat wire is a Connect-RPC protobuf stream; the path is pinned
+    // here so a probe verifies dispatch actually calls it.
+    endpointPathsByWireFamily: { chat: "/exa.api_server_pb.ApiServerService/GetChatMessage" },
+    loadAdapter: async () => (await import("./integrations/devin/devin")).devinAdapter,
+    loadModels: async () => (await import("./integrations/devin/devin-catalog")).DEVIN_MODELS,
+    loadAuthentication: oauthCapability(() => import("./integrations/devin/devin-auth"), "devinOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/devin/devin-quota"), "fetchDevinQuota"),
+    loadModelDiscovery: async () => async ({ credential, fetcher }) =>
+      (await import("./integrations/devin/devin-catalog")).discoverDevinModels({
+        credential,
+        ...(fetcher === undefined ? {} : { fetcher }),
+      }),
+  },
   cerebras: {
     endpointPathsByWireFamily: { chat: "/chat/completions" },
     loadAdapter: async () => createApiKeyAdapter((await import("./integrations/cerebras")).CEREBRAS_SPEC),
@@ -514,6 +550,40 @@ export const PROVIDER_CAPABILITIES = {
     loadQuotaCollector: quotaCapability(() => import("./integrations/trae/trae-quota"), "fetchTraeCnQuota"),
     loadModelDiscovery: traeDiscovery("cn", "traecn"),
   },
+  freepi: {
+    loadAdapter: async () => (await import("./integrations/freepi/freepi")).createFreepiAdapter(),
+    loadModels: async () => (await import("./integrations/freepi/freepi-catalog")).FREEPI_MODELS,
+    // Free-pi login is a GitHub device flow; the issued JWT is the credential.
+    loadAuthentication: oauthCapability(() => import("./integrations/freepi/freepi-oauth"), "freepiOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/freepi/freepi-quota"), "fetchFreepiQuota"),
+    // Live `/client-version` (Bearer) is the catalog source; the static roster
+    // is the offline fallback.
+    loadModelDiscovery: async () => async (request: Parameters<ProviderModelDiscovery>[0]) => {
+      const { discoverFreepiModels } = await import("./integrations/freepi/freepi-discovery");
+      const { FREEPI_MODELS } = await import("./integrations/freepi/freepi-catalog");
+      const secret = request.credential.trim();
+      const fetcher = request.fetcher as unknown as typeof fetch | undefined;
+      if (secret.length === 0 || fetcher === undefined) return FREEPI_MODELS;
+      const token = extractJsonCredentialToken(secret);
+      const rows = await discoverFreepiModels({ token, fetcher });
+      if (rows.length === 0) return FREEPI_MODELS;
+      return rows;
+    },
+  },
+  perch: {
+    loadAdapter: async () => (await import("./integrations/perch/perch")).createPerchAdapter(),
+    loadModels: async () => (await import("./integrations/perch/perch-catalog")).PERCH_MODELS,
+    // Perch login is Supabase PKCE (Google/GitHub); the session blob
+    // (access/refresh token) is the credential, and the CLI refreshes it.
+    loadAuthentication: oauthCapability(() => import("./integrations/perch/perch-oauth"), "perchOAuthClient", { withRefresher: true }),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/perch/perch-quota"), "fetchPerchQuota"),
+    // The hosted API exposes no public model list — Roost tiers are the only
+    // surface the CLI accepts, so discovery returns the static roster.
+    loadModelDiscovery: async () => async () => {
+      const { PERCH_MODELS } = await import("./integrations/perch/perch-catalog");
+      return PERCH_MODELS;
+    },
+  },
   inferhub: {
     loadAdapter: async () => (await import("./integrations/inferhub")).createInferhubAdapter(),
     // Live `/v1/models` is the primary source: the marketplace republishes its
@@ -527,6 +597,9 @@ export const PROVIDER_CAPABILITIES = {
   hermes: {
     loadAdapter: async () => createApiKeyAdapter((await import("./integrations/hermes")).HERMES_SPEC),
     loadModels: async () => (await import("./integrations/hermes")).HERMES_MODELS,
+    // Hermes accepts both API keys and the Nous Portal device-code OAuth flow
+    // (subscription route). The OAuth client is refreshable.
+    loadAuthentication: oauthCapability(() => import("./integrations/hermes/hermes-oauth"), "hermesOAuthClient", { withRefresher: true }),
     // `/v1/models` is open and states each row's real limits, so the free
     // allowance tracks upstream instead of a hand-kept list. The static list
     // above stays as the offline fallback for a fetch that fails.
@@ -605,9 +678,7 @@ export const PROVIDER_CAPABILITIES = {
     // dressed ZCode client request (see the integration). The credential is a
     // ZCode login JWT — pasted, or minted by the sign-in flow below.
     loadAdapter: async () =>
-      createApiKeyAdapter(
-        (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_SPEC,
-      ),
+      (await import("./integrations/zcode-start-plan/provider")).createZcodeStartPlanAdapter(),
     loadModels: async () =>
       (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_MODELS,
     // The device flow stores the issued ZCode login JWT, not a Coding Plan key.
@@ -718,10 +789,29 @@ export const PROVIDER_CAPABILITIES = {
       responses: "/responses",
     },
     loadAdapter: async () => createApiKeyAdapter(GENERIC_API_KEY_SPECS.ollamacloud),
-    loadModels: async () => (await import("./integrations/ollamacloud-models")).OLLAMACLOUD_MODELS,
-    loadQuotaCollector: quotaCapability(() => import("./integrations/ollamacloud-quota"), "fetchOllamaQuota"),
+    loadModels: async () => (await import("./integrations/ollamacloud")).OLLAMACLOUD_MODELS,
+    loadQuotaCollector: quotaCapability(() => import("./integrations/ollamacloud"), "fetchOllamaQuota"),
     loadModelDiscovery: openAIModelDiscovery("ollamacloud", { headers: (credential) => ({ authorization: `Bearer ${credential}` }) }),
   },
+  freebuff: {
+    // Freebuff chat is OpenAI-compatible on `/api/v1/chat/completions`, but the
+    // adapter runs a stateful preflight (session admission + agent-runs START)
+    // and a device-signature header set — see the integration.
+    endpointPathsByWireFamily: { chat: "/api/v1/chat/completions" },
+    loadAdapter: async () => (await import("./integrations/freebuff/freebuff")).createFreebuffAdapter(),
+    loadModels: async () => (await import("./integrations/freebuff/freebuff-catalog")).FREEBUFF_MODELS,
+    loadAuthentication: oauthCapability(() => import("./integrations/freebuff/freebuff-oauth"), "freebuffOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/freebuff/freebuff-quota"), "fetchFreebuffQuota"),
+    loadModelDiscovery: async () =>
+      (await import("./integrations/freebuff/freebuff-discovery")).freebuffModelDiscovery(),
+  },
+  zro: {
+    endpointPathsByWireFamily: { messages: "/v1/messages" },
+    loadAdapter: async () => (await import("./integrations/zro/zro")).createZroAdapter(),
+    loadModels: async () => (await import("./integrations/zro/zro")).ZRO_MODELS,
+    loadQuotaCollector: quotaCapability(() => import("./integrations/zro/zro"), "fetchZroQuota"),
+    loadModelDiscovery: async () => (await import("./integrations/zro/zro")).zroModelDiscovery()(),
+  },
 
   ...createDiscoveryBackedProviderCapabilities(openAIModelDiscovery),
 
@@ -770,7 +860,7 @@ export const PROVIDER_CAPABILITIES = {
   // the provider usable before anyone syncs.
   dashscope: {
     ...discoveryBackedCapabilities("dashscope", GENERIC_API_KEY_SPECS.dashscope, openAIModelDiscovery),
-    loadModels: async () => (await import("./integrations/dashscope-models")).DASHSCOPE_MODELS,
+    loadModels: async () => (await import("./integrations/alibabacp/dashscope-models")).DASHSCOPE_MODELS,
   },
 
 // Anthropic-Messages providers reached with a plain key. The wire path is

package/src/providers/discovery/discovery-types.ts

@@ -58,6 +58,11 @@ export const PROBE_REASONING_EFFORTS = ["auto", "minimal", "low", "medium", "hig
 /** One accepted probe reasoning effort. `auto` means "send no reasoning intent". */
 export type ProbeReasoningEffort = (typeof PROBE_REASONING_EFFORTS)[number];
 
+/** Modelprobe modes as a runtime tuple, so the route schema projects one list. */
+export const PROBE_MODES = ["fast", "detail"] as const;
+/** `detail` is the default when `mode` is absent (D39). */
+export type ProbeMode = (typeof PROBE_MODES)[number];
+
 /** Request accepted for a one-shot model connectivity test. `route`
  * disambiguates when a model id is registered under multiple endpoint
  * paths; omit it to probe against the model's already-registered wire
@@ -85,6 +90,13 @@ export interface ProbeModelRequest {
    * result the richest available source of truth.
    */
   surface?: "default" | "cosy" | "grpc" | "ide";
+  /**
+   * `fast` is a cheap liveness check: 32 output tokens, a 10s timeout, no
+   * retry, no payload-body capture, compact telemetry, and an 80-char sample.
+   * `detail` (the default when absent) is the full diagnostic probe.
+   * Health recording is identical in both modes.
+   */
+  mode?: ProbeMode;
 }
 export interface ProbeModelResult {
   accountId?: string;

package/src/providers/discovery/probe-phases.ts

@@ -23,7 +23,8 @@ import type {
   WireFamily,
 } from "../../protocol/canonical-model";
 import type { CompatibilityProfile } from "../provider-metadata";
-import type { ProbeModelRequest } from "./discovery-types";
+import type { ProbeModelRequest, ProbeMode } from "./discovery-types";
+import type { ModelProbeMode } from "../../console/settings/contracts";
 import {
   constrainWireFamily,
   discoveryPathsFor,
@@ -471,8 +472,9 @@ export async function selectProbeAccount(args: {
  * back to the generic OpenAI-compatible adapter so probe/dispatch still works.
  * The low-level compatible adapter is used directly to avoid importing concrete
  * integrations from discovery (which would violate the provider-architecture
- * layering test). `loadOne` returning `undefined` means "no bundled adapter";
- * a throw is a registry failure and propagates rather than being reported as
+ * layering test). `resolve(..., { force: true })` rebuilds the bundled adapter
+ * against the current registration; `undefined` means "no bundled adapter"; a
+ * throw is a registry failure and propagates rather than being reported as
  * "no adapter registered".
  */
 export async function resolveProbeAdapter(args: {
@@ -481,7 +483,7 @@ export async function resolveProbeAdapter(args: {
   readonly providerWireRow: ProbeProviderRow | undefined;
 }): Promise<ProviderAdapter | undefined> {
   const { providerRegistry, providerId, providerWireRow } = args;
-  let adapter = await providerRegistry.loadOne(providerId);
+  let adapter = await providerRegistry.resolve(providerId, { force: true });
   if (!adapter) {
     try {
       if (providerWireRow?.baseUrl) {
@@ -509,9 +511,26 @@ export interface ProbeReasoning {
   summary_mode: "auto" | "concise" | "detailed";
 }
 
+/** Default fast-probe timeout, in seconds (D39/D40). */
+export const PROBE_FAST_DEFAULT_TIMEOUT_SECONDS = 10;
+/** Default fast-probe output allowance, in tokens (D40). */
+export const PROBE_FAST_MAX_OUTPUT_TOKENS = 64;
+/** Fast-probe default prompt: a neutral greeting, not an identity question. */
+export const PROBE_FAST_DEFAULT_PROMPT = "ping";
+/** Fast-probe sample bound, in characters (D40). */
+export const PROBE_FAST_SAMPLE_MAX_CHARS = 80;
+
 /** Tenant probe preferences that shape the request and telemetry. */
 export interface ProbePreferences {
   readonly probeReasoning: ProbeReasoning | undefined;
+  /** Effective probe mode: an explicit request wins over the tenant default. */
+  readonly mode: ProbeMode;
+  /** Timeout in ms for `fast`; `undefined` keeps `detail`'s 30s budget. */
+  readonly timeoutMs: number | undefined;
+  /** Token allowance for the canonical request; only `fast` overrides it. */
+  readonly maxOutputTokens: number | undefined;
+  /** `fast` suppresses payload-body capture and trims telemetry. */
+  readonly compactTelemetry: boolean;
   /**
    * The tenant's resolved capture policy for the probe, through the same
    * `resolvePayloadCapture` path every dispatched request uses.
@@ -545,6 +564,8 @@ export async function loadProbePreferences(args: {
 }): Promise<ProbePreferences> {
   const { db, tenantId, wireFamily, request } = args;
   let probeReasoning: ProbeReasoning | undefined;
+  let configuredMode: ModelProbeMode = "detail";
+  let configuredFastTimeoutSeconds = PROBE_FAST_DEFAULT_TIMEOUT_SECONDS;
   let payloadCapture: ProbePreferences["payloadCapture"] = {
     enabled: false,
     mode: "none",
@@ -568,6 +589,14 @@ export async function loadProbePreferences(args: {
     const raw = preferences?.responsesReasoningSummary;
     const mode: "auto" | "concise" | "detailed" =
       raw === "auto" || raw === "concise" || raw === "detailed" ? raw : "detailed";
+    // The tenant's settings default is `detail` when unset (D39); an explicit
+    // per-request `mode` still wins below.
+    configuredMode = preferences?.modelProbeMode === "fast" ? "fast" : "detail";
+    const configuredTimeout = preferences?.modelProbeFastTimeoutSeconds;
+    configuredFastTimeoutSeconds =
+      typeof configuredTimeout === "number" && Number.isFinite(configuredTimeout)
+        ? Math.min(Math.max(configuredTimeout, 1), 120)
+        : PROBE_FAST_DEFAULT_TIMEOUT_SECONDS;
     // Unset matches the settings default: off. Only an explicit choice
     // captures, and at the tenant's own depth/retention — the same resolution
     // `resolvePayloadCapture` performs for dispatched requests, read from the
@@ -599,31 +628,22 @@ export async function loadProbePreferences(args: {
       };
     }
   }
-  return { probeReasoning, payloadCapture };
-}
-
-/**
- * The probe's default identity prompt (`What model are you...`) works for
- * every Qoder roster row except `cmodel` (virtual id `cantus`): that row's
- * gRPC surface answers the identity question with `406 Upstream error [stream]`
- * from the upstream proxy (verified live 2026-11-04; dmodel/qmodel/smodel all
- * accept it). Returns the neutral replacement prompt when the probe targets
- * that row with no explicit prompt, `undefined` otherwise.
- *
- * The replacement prompt must never *ask* an identity question: the upstream
- * guardrail is content-based and swallows the reply (empty sample) for any
- * phrasing that interrogates identity — even indirect ones (`what would you
- * call yourself`, `which model are you`, `perkenalkan dirimu`). A plain
- * greeting that *asserts* the wrong identity (`halo gpt`) makes the model
- * correct us on its own, and returns a sample 3/3 runs (verified live
- * 2026-11-04). We keep that phrasing — it is 100% consistent and the model
- * names itself ("saya Claude... buatan Anthropic") without us ever asking.
- */
-export function qoderCmodelProbePrompt(providerId: string, modelId: string, prompt: string | undefined): string | undefined {
-  if (prompt !== undefined) return undefined;
-  if (providerId !== "qoder" && providerId !== "qodercn") return undefined;
-  if (modelId !== "cmodel" && modelId !== "cantus") return undefined;
-  return "halo gpt";
+  const effectiveMode: ProbeMode = request.mode ?? configuredMode;
+  const fast = effectiveMode === "fast";
+  return {
+    probeReasoning,
+    mode: effectiveMode,
+    // `detail` keeps its exact 30s budget; `fast` uses the tenant's setting.
+    ...(fast ? { timeoutMs: configuredFastTimeoutSeconds * 1000 } : { timeoutMs: undefined }),
+    ...(fast ? { maxOutputTokens: PROBE_FAST_MAX_OUTPUT_TOKENS } : { maxOutputTokens: undefined }),
+    compactTelemetry: fast,
+    // `fast` never tees provider payload bodies (D40). The reported-model read
+    // still needs the exchange wrapper, so capture mode, not the wrapper, is
+    // what changes.
+    payloadCapture: fast
+      ? { enabled: false, mode: "none", depth: "minimum", retentionMs: payloadRetentionMs() }
+      : payloadCapture,
+  };
 }
 
 /**
@@ -638,10 +658,30 @@ export function buildProbeCanonicalRequest(args: {
   readonly request: ProbeModelRequest;
   readonly probeReasoning: ProbeReasoning | undefined;
   readonly sourceSurface: SourceSurface;
+  /** `fast` overrides the token allowance without changing the prompt (D42). */
+  readonly maxOutputTokens?: number;
+  /**
+   * Provider-mandated system prompt (adapter `systemPrompt()`), injected as
+   * the probe's system turn so upstreams that fingerprint it accept the
+   * probe.
+   */
+  readonly providerSystemPrompt?: string | undefined;
+  /**
+   * A provider-specific default probe prompt, used when the operator sent no
+   * prompt. Lets a provider whose policy gate flags repeated identical probes
+   * (Freebuff: `prompt_policy_refused` / "same message sent over and over")
+   * receive a minimal, per-model-varying probe instead of the shared identity
+   * question every provider otherwise sends.
+   */
+  readonly defaultPromptOverride?: string | undefined;
 }): CanonicalRequest {
-  const { modelId, request, probeReasoning, sourceSurface } = args;
+  const { modelId, request, probeReasoning, sourceSurface, maxOutputTokens, providerSystemPrompt, defaultPromptOverride } = args;
+  const fast = maxOutputTokens === PROBE_FAST_MAX_OUTPUT_TOKENS;
   return {
     model: modelId,
+    ...(providerSystemPrompt && providerSystemPrompt.trim()
+      ? { system: [{ kind: "text", text: providerSystemPrompt }] }
+      : {}),
     messages: [
       {
         role: "user",
@@ -650,7 +690,8 @@ export function buildProbeCanonicalRequest(args: {
             kind: "text",
             text:
               request.prompt ??
-              "What model are you, and what is your knowledge cutoff date? Answer in one sentence.",
+              defaultPromptOverride ??
+              (fast ? PROBE_FAST_DEFAULT_PROMPT : "What model are you, and what is your knowledge cutoff date? Answer in one sentence."),
           },
         ],
       },
@@ -662,8 +703,8 @@ export function buildProbeCanonicalRequest(args: {
       // class of refusal that answers `400 request illegal`. Matching the
       // caller's own small budget keeps the probe the same shape as the traffic
       // it is meant to predict.
-      max_tokens: request.maxOutputTokens ?? 256,
-      max_output_tokens: request.maxOutputTokens ?? 256,
+      max_tokens: request.maxOutputTokens ?? maxOutputTokens ?? 256,
+      max_output_tokens: request.maxOutputTokens ?? maxOutputTokens ?? 256,
       // No temperature. A real dispatch forwards whatever the client sent, and
       // the client rarely sends one; pinning 0.2 here made the probe a
       // different request from the traffic it is supposed to predict. The