cartethyia 2.7.8 → 2.8.0

package/src/providers/integrations/buddy/buddy-chat-shared.ts

@@ -1,7 +1,7 @@
 /**
  * Chat-wire payload and message normalization shared by the Tencent "buddy"
- * family providers — CodeBuddy International (`cb`), CodeBuddy CN (`cbcn`),
- * and WorkBuddy. All three speak the same upstream contract for this part of
+ * family providers — CodeBuddy International (`cb`) and CodeBuddy CN (`cbcn`).
+ * Both speak the same upstream contract for this part of
  * the payload, so the rules live here once instead of being copied per
  * variant:
  *
@@ -21,6 +21,7 @@ import { createHash } from "node:crypto";
 import { completeRequiredSchema } from "../../../protocol/codecs";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { isRecord } from "../../../protocol/codecs";
+import { GatewayError } from "../../../protocol/gateway-error";
 import { applyDeepSeekReasoning, applyOpenAIReasoning, backfillDeepSeekReasoningContent, clampedEffortOutputFloor, ensureChatReasoningReplayPresence } from "../../../protocol/reasoning";
 import { BUDDY_CN_EFFORTS, BUDDY_INTL_EFFORTS, BUDDY_SHARED_RAW } from "./buddy-catalog-shared";
 // Imported for the CN roster only: a CN-only id has no row in the shared
@@ -55,6 +56,123 @@ function normalizedToolName(value: string, index: number, used: Set<string>): st
   return uniqueToolName(base || `tool_${index + 1}`, used);
 }
 
+/**
+ * Schema keywords whose values are schemas (recursed as schema objects).
+ * Mirrors the donor gateway's `upstream_compat._SCHEMA_MAPS/_ARRAYS/CHILDREN`.
+ */
+const RE2_SCHEMA_MAPS: ReadonlySet<string> = new Set([
+  "properties",
+  "patternProperties",
+  "$defs",
+  "definitions",
+  "dependentSchemas",
+  "dependencies",
+]);
+const RE2_SCHEMA_ARRAYS: ReadonlySet<string> = new Set([
+  "allOf",
+  "anyOf",
+  "oneOf",
+  "prefixItems",
+  "items",
+]);
+const RE2_SCHEMA_CHILDREN: ReadonlySet<string> = new Set([
+  "items",
+  "additionalItems",
+  "contains",
+  "unevaluatedItems",
+  "additionalProperties",
+  "unevaluatedProperties",
+  "propertyNames",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contentSchema",
+]);
+
+/**
+ * Removes unescaped backslashes before underscores in one regex pattern. The
+ * CodeBuddy upstream validates tool schemas with RE2, which does not support
+ * `\_` escapes — a client schema that serializes `\_` (a common JSON
+ * representation of a literal underscore) is rejected with a 400. The donor
+ * gateway normalizes this before dispatch; a backslash that escapes a
+ * backslash is preserved.
+ */
+function normalizeRe2Pattern(value: string): string {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if (char === "\\" && value[i + 1] === "\\") {
+      // Escaped backslash: keep the pair so a following `_` stays escaped.
+      out += "\\\\";
+      i += 1;
+      continue;
+    }
+    if (char === "\\" && value[i + 1] === "_") {
+      // `\_` — the upstream's RE2 rejects it; drop the backslash.
+      out += "_";
+      i += 1;
+      continue;
+    }
+    out += char;
+  }
+  return out;
+}
+
+/** Normalizes RE2-incompatible underscore escapes in schema pattern positions. */
+function normalizeRe2SchemaPatterns(schema: unknown): void {
+  if (!isRecord(schema)) return;
+  const pattern = schema["pattern"];
+  if (typeof pattern === "string") schema["pattern"] = normalizeRe2Pattern(pattern);
+  const patternProperties = schema["patternProperties"];
+  if (isRecord(patternProperties)) {
+    const normalized: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(patternProperties)) {
+      const key2 = normalizeRe2Pattern(key);
+      if (key2 in normalized) {
+        normalized[key2] = { allOf: [normalized[key2], value] };
+      } else {
+        normalized[key2] = value;
+      }
+    }
+    schema["patternProperties"] = normalized;
+  }
+  for (const key of RE2_SCHEMA_MAPS) {
+    const map = schema[key];
+    if (!isRecord(map)) continue;
+    for (const child of Object.values(map)) normalizeRe2SchemaPatterns(child);
+  }
+  for (const key of RE2_SCHEMA_ARRAYS) {
+    const list = schema[key];
+    if (!Array.isArray(list)) continue;
+    for (const child of list) normalizeRe2SchemaPatterns(child);
+  }
+  for (const key of RE2_SCHEMA_CHILDREN) {
+    normalizeRe2SchemaPatterns(schema[key]);
+  }
+}
+
+/** JSON-serializes a value to cheaply detect a backslash-before-underscore. */
+function hasUnderscoreEscape(value: unknown): boolean {
+  try {
+    return JSON.stringify(value).includes("\\_");
+  } catch {
+    return true;
+  }
+}
+
+/** Returns the declaration with RE2-safe schema patterns, or the same object. */
+function normalizeRe2Declaration(declaration: Record<string, unknown>): Record<string, unknown> {
+  const parameters = declaration["parameters"];
+  if (!hasUnderscoreEscape(parameters)) return declaration;
+  // Deep-copy only when a rewrite is needed; the shared object must not be
+  // mutated for every dispatch.
+  const out: Record<string, unknown> = { ...declaration };
+  out["parameters"] = structuredClone(parameters);
+  normalizeRe2SchemaPatterns(out["parameters"]);
+  return out;
+}
+
 /**
  * Buddy's Chat Completions wire has no `web_search_preview` hosted tool; its
  * search is an ordinary function named `web_search` with a `{query}` schema.
@@ -102,29 +220,28 @@ export function normalizeBuddyToolNames(payload: Record<string, unknown>): void
     const name = normalizedToolName(sourceName, index, used);
     used.add(name);
     if (!replacements.has(sourceName)) replacements.set(sourceName, name);
-    if (fn !== undefined)
-      return {
-        ...rawTool,
-        function: {
-          ...fn,
-          name,
-          ...(fn["parameters"] === undefined ? {} : { parameters: completeRequiredSchema(fn["parameters"]) }),
-        },
+    if (fn !== undefined) {
+      const fnOut = {
+        ...fn,
+        name,
+        ...(fn["parameters"] === undefined ? {} : { parameters: completeRequiredSchema(fn["parameters"]) }),
       };
-    if (custom !== undefined)
-      return {
-        ...rawTool,
-        custom: {
-          ...custom,
-          name,
-          ...(custom["format"] === undefined ? {} : { format: completeRequiredSchema(custom["format"]) }),
-        },
+      return normalizeRe2Declaration(fnOut);
+    }
+    if (custom !== undefined) {
+      const customOut = {
+        ...custom,
+        name,
+        ...(custom["format"] === undefined ? {} : { format: completeRequiredSchema(custom["format"]) }),
       };
-    return {
+      return { ...rawTool, custom: normalizeRe2Declaration(customOut) };
+    }
+    const bareOut = {
       ...rawTool,
       name,
       ...(rawTool["parameters"] === undefined ? {} : { parameters: completeRequiredSchema(rawTool["parameters"]) }),
     };
+    return normalizeRe2Declaration(bareOut);
   });
   const messages = payload["messages"];
   if (Array.isArray(messages)) {
@@ -138,6 +255,13 @@ export function normalizeBuddyToolNames(payload: Record<string, unknown>): void
       }
     }
   }
+  const responseFormat = payload["response_format"];
+  if (isRecord(responseFormat) && hasUnderscoreEscape(responseFormat)) {
+    const copied = structuredClone(responseFormat) as Record<string, unknown>;
+    const jsonSchema = copied["json_schema"];
+    if (isRecord(jsonSchema)) normalizeRe2SchemaPatterns(jsonSchema["schema"]);
+    payload["response_format"] = copied;
+  }
   const choice = payload["tool_choice"];
   if (!isRecord(choice)) return;
   if (choice["type"] === "allowed_tools" && Array.isArray(choice["tools"])) {
@@ -332,10 +456,10 @@ function buddyTemplatePattern(text: string): RegExp {
   return new RegExp(`(?<!\\w)${buddyTemplateSource(text)}(?!\\w)`, "i");
 }
 
-// DeepSeek Harness (DSH) role identities. DSH is the harness behind WorkBuddy;
-// a history that still carries its self-description reads to the upstream as a
-// foreign channel, so the hardened client rewrites it back to the WorkBuddy
-// identity rather than forwarding a competing one.
+// DeepSeek Harness (DSH) role identities. DSH is the harness behind the buddy
+// family; a history that still carries its self-description reads to the
+// upstream as a foreign channel, so the hardened client rewrites it back to
+// the CodeBuddy identity rather than forwarding a competing one.
 const DSH_CODING_PATTERN = new RegExp(
   `(?<!\\w)${buddyTemplateSource("You are a coding agent powered by the")}` +
     `[\\s${BUDDY_ZWSP}]+([^\\r\\n]{1,200}?)[\\s${BUDDY_ZWSP}]+` +
@@ -350,17 +474,17 @@ const DSH_DIRECT_PATTERN = buddyTemplatePattern("You are DeepSeek Harness");
 const DSH_WEB_GUI_PATTERN = buddyTemplatePattern("DeepSeek Harness Web GUI");
 
 /** The identity DSH role prompts are rewritten to; neutral and minimal. */
-const DSH_WORKBUDDY_IDENTITY = "You are a helpful assistant";
+const DSH_CODEBUDDY_IDENTITY = "You are a helpful assistant";
 
 /**
  * Rewrites DeepSeek Harness role identities in one message's text back to the
- * WorkBuddy identity. Port of the donor gateway's always-on
+ * CodeBuddy identity. Port of the donor gateway's always-on
  * `desensitize_channel_body`, scoped to text the wire actually carries.
  *
  * This normalizes a replayed history (or a surviving system turn) that still
- * claims the DSH harness, so a WorkBuddy request never advertises a competing
+ * claims the DSH harness, so a buddy request never advertises a competing
  * channel identity upstream. The coding persona keeps the model it named:
- * "You are a coding agent powered by the X model" becomes the WorkBuddy
+ * "You are a coding agent powered by the X model" becomes the CodeBuddy
  * identity plus "powered by the X model".
  */
 export function scrubBuddyChannelIdentityText(text: string): string {
@@ -368,13 +492,13 @@ export function scrubBuddyChannelIdentityText(text: string): string {
   const withCodingPersona = text.replace(
     DSH_CODING_PATTERN,
     (_match, model: string) =>
-      `${DSH_WORKBUDDY_IDENTITY}. This conversation is powered by the ${model.trim()} model`,
+      `${DSH_CODEBUDDY_IDENTITY}. This conversation is powered by the ${model.trim()} model`,
   );
   return withCodingPersona
-    .replace(DSH_CHANNEL_IDENTITY_PATTERN, DSH_WORKBUDDY_IDENTITY)
-    .replace(DSH_MINIMAL_PATTERN, DSH_WORKBUDDY_IDENTITY)
-    .replace(DSH_DIRECT_PATTERN, DSH_WORKBUDDY_IDENTITY)
-    .replace(DSH_WEB_GUI_PATTERN, "WorkBuddy Web GUI");
+    .replace(DSH_CHANNEL_IDENTITY_PATTERN, DSH_CODEBUDDY_IDENTITY)
+    .replace(DSH_MINIMAL_PATTERN, DSH_CODEBUDDY_IDENTITY)
+    .replace(DSH_DIRECT_PATTERN, DSH_CODEBUDDY_IDENTITY)
+    .replace(DSH_WEB_GUI_PATTERN, "CodeBuddy Web GUI");
 }
 
 function scrubBuddyMessageText(message: Record<string, unknown>, field: string): void {
@@ -477,6 +601,10 @@ export function buddyPrePayloadCommon(
   normalizeBuddyImageUrl(payload);
   // developer role → system (buddy whitelist rejects developer, 11128)
   normalizeBuddyRoles(payload);
+  // Validate the *caller's* thinking controls before the DeepSeek contract may
+  // inject its own `thinking` (an injected `{type:"enabled"}` has no budget and
+  // must not be rejected as a malformed client shape).
+  validateBuddyThinking(payload);
   applyOpenAIReasoning(payload, request);
   applyDeepSeekReasoning(payload);
   // sol family defaults to high reasoning like reference thinking.go defaultDeepSeekEffort — sol without effort gets 500/invoke error otherwise
@@ -504,8 +632,8 @@ export function buddyPrePayloadCommon(
     cleanupBuddyOrphanToolPairs(arr);
     coalesceConsecutiveAssistantMessages(arr);
     // Normalize a replayed harness history before the blocked-code rewrite
-    // below: DSH role identities are replaced with the WorkBuddy identity, so
-    // a WorkBuddy-family request never forwards a competing channel identity.
+    // below: DSH role identities are replaced with the CodeBuddy identity, so
+    // a buddy-family request never forwards a competing channel identity.
     scrubBuddyChannelIdentity(arr);
     // After every merge: a quoted `11128` in any surviving text blocks the
     // whole request, and the merges above are what produce the final text.
@@ -516,6 +644,34 @@ export function buddyPrePayloadCommon(
   delete payload["agent_prompt"];
 }
 
+/**
+ * Validates the reasoning controls the CodeBuddy Chat wire accepts, mirroring
+ * the donor gateway's `map_reasoning_controls`. The upstream rejects the whole
+ * request for shapes it does not model, so a client that sends an unsupported
+ * `thinking` shape is failed here with a 400 that names the field — instead of
+ * an opaque upstream error.
+ */
+function validateBuddyThinking(payload: Record<string, unknown>): void {
+  const thinking = isRecord(payload["thinking"]) ? payload["thinking"] : undefined;
+  if (thinking === undefined) return;
+  const mode = typeof thinking["type"] === "string" ? (thinking["type"] as string) : "";
+  if (mode !== "enabled" && mode !== "adaptive" && mode !== "disabled") {
+    throw new GatewayError("invalid_request", 400, `CodeBuddy thinking.type must be enabled, adaptive or disabled (got ${JSON.stringify(mode)}) (request {requestId}). Check the shape of what you sent — then resend 🪞`);
+  }
+  if (mode === "enabled") {
+    const budget = thinking["budget_tokens"];
+    if (typeof budget !== "number" || !Number.isInteger(budget) || budget < 1024) {
+      throw new GatewayError("invalid_request", 400, "CodeBuddy thinking.budget_tokens must be an integer >= 1024 (request {requestId}). Check the shape of what you sent — then resend 🪞");
+    }
+  } else if (thinking["budget_tokens"] !== undefined) {
+    throw new GatewayError("invalid_request", 400, "CodeBuddy thinking.budget_tokens requires thinking.type=enabled (request {requestId}). Check the shape of what you sent — then resend 🪞");
+  }
+  const display = thinking["display"];
+  if (display !== undefined && display !== null && display !== "summarized") {
+    throw new GatewayError("invalid_request", 400, "CodeBuddy thinking.display supports only summarized (request {requestId}). Check the shape of what you sent — then resend 🪞");
+  }
+}
+
 function injectSolReasoningDefault(payload: Record<string, unknown>): void {
   const model = typeof payload["model"] === "string" ? (payload["model"] as string) : "";
   const isSol = model.toLowerCase().includes("sol");
@@ -1138,7 +1294,7 @@ export interface BuddyMessageFinalizeOptions {
  * The single authoritative buddy message-shape pipeline. Every variant runs
  * the same sequence — coalesce, drop empty turns, guarantee the leading system
  * turn, omit content on tool_calls-only assistant turns, then auto-cache — so
- * the wire shape cannot drift between CodeBuddy intl, CN, and WorkBuddy.
+ * the wire shape cannot drift between CodeBuddy intl and CN.
  */
 export function finalizeBuddyMessages(
   messages: Array<Record<string, unknown>>,

package/src/providers/integrations/buddy/buddy-checkin.ts

@@ -1,7 +1,7 @@
 import { asCoercedNumber as sharedAsNumber, asRecord as sharedAsRecord } from "../../../shared/coerce";
 
-// Buddy-family daily check-in (daily login credit claim), shared by all three
-// variants (`cb`, `cbcn`, `workbuddy`): same Tencent billing facade, same
+// Buddy-family daily check-in (daily login credit claim), shared by both
+// variants (`cb`, `cbcn`): same Tencent billing facade, same
 // status/claim contract — only the endpoint base and identity headers differ
 // per variant, and those already live in each provider's own modules.
 //
@@ -22,15 +22,8 @@ import { asCoercedNumber as sharedAsNumber, asRecord as sharedAsRecord } from ".
 
 import { providerBaseUrl } from "../../provider-metadata";
 import { sleep } from "../../../shared/sleep";
-import { WORKBUDDY_DOMAIN } from "./workbuddy/shared";
 import { BUDDY_PROVIDER_IDS } from "../../provider-metadata";
 import { QODER_CHECKIN_PROVIDER_IDS } from "../qoder/qoder-checkin";
-import {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCnClientVersion,
-  getWorkBuddyCliVersion,
-} from "../../operations/client-versions";
 import { buildCodeBuddyUserAgent } from "../../operations/client-versions";
 import { codebuddyDomain, type CodeBuddyVariant } from "./codebuddy/shared";
 /** Providers whose billing facade exposes the daily check-in routes. */
@@ -186,8 +179,8 @@ export function buildActivityReportEvent(args: {
  * chat send. A single event did not move the growth tasks; four events per
  * batch, sent twice with a pause between the rounds, is what does. The pause
  * is what keeps the two rounds from landing as one burst. Both numbers apply
- * to every buddy variant — the request is built the same way for `cb`,
- * `cbcn`, and `workbuddy`, so none of them can drift back to a single shot.
+ * to every buddy variant — the request is built the same way for `cb` and
+ * `cbcn`, so neither can drift back to a single shot.
  */
 export const ACTIVITY_REPORT_EVENTS_PER_BATCH = 4;
 export const ACTIVITY_REPORT_ROUNDS = 2;
@@ -196,8 +189,8 @@ export const ACTIVITY_REPORT_ROUND_DELAY_MS = 1_500;
 /**
  * Sends the growth-activity report (`POST {base}/v2/report`, the versioned
  * billing-meter path joined the same way as the status/claim routes:
- * `VERSION_SEGMENT` supplies `/v2` for the bare `workbuddy` base and nothing
- * for `cb`/`cbcn`, which already end in it).
+ * `VERSION_SEGMENT` supplies nothing for `cb`/`cbcn`, which already end in
+ * `/v2`).
  *
  * Two rounds of four events, paused between rounds. Each event carries its
  * own conversation and request id: the facade drops a repeated id as a
@@ -290,13 +283,10 @@ const CLAIM_RETRY_DELAYS_MS = [1_000, 2_000] as const;
 /**
  * Check-in paths are joined onto the provider's manifest base URL, which does
  * NOT carry a consistent version segment: `cb`/`cbcn` already end in `/v2`,
- * while WorkBuddy variants are bare and need `/v2` prepended. This map keeps that
- * join aligned with each provider's own quota collector, so the three
- * gateways cannot drift apart.
+ * so no segment is prepended. This map keeps the join aligned with each
+ * provider's own quota collector, so the gateways cannot drift apart.
  */
 const VERSION_SEGMENT: Readonly<Record<string, string>> = {
-  workbuddy: "/v2",
-  workbuddycn: "/v2",
   cb: "",
   cbcn: "",
 };
@@ -311,10 +301,9 @@ function claimUrl(providerId: string): string {
 
 /**
  * Per-provider billing headers. The Buddy gateways share the Tencent billing
- * facade but each risk-gates on its own client identity: WorkBuddy wants the
- * desktop brand, CodeBuddy intl wants the `IDE` identity, and CN wants `CLI`
- * (plus its own `X-Domain`). Sending the wrong one trips a 403 the same way
- * the chat surface does.
+ * facade but each risk-gates on its own client identity: CodeBuddy intl
+ * wants the `IDE` identity, and CN wants `CLI` (plus its own `X-Domain`).
+ * Sending the wrong one trips a 403 the same way the chat surface does.
  */
 async function checkinHeaders(providerId: string): Promise<Record<string, string>> {
   const common = {
@@ -324,24 +313,13 @@ async function checkinHeaders(providerId: string): Promise<Record<string, string
     "Content-Type": "application/json",
     Accept: "application/json",
   };
-  if (providerId === "cb" || providerId === "cbcn") {
-    const variant: CodeBuddyVariant = providerId === "cb" ? "IDE" : "CLI";
-    return {
-      ...common,
-      "User-Agent": buildCodeBuddyUserAgent(variant),
-      "X-IDE-Type": variant,
-      "X-IDE-Name": variant,
-      "X-Domain": codebuddyDomain(variant),
-    };
-  }
-  const clientVersion = providerId === "workbuddycn"
-    ? getWorkBuddyCnClientVersion()
-    : getWorkBuddyClientVersion();
+  const variant: CodeBuddyVariant = providerId === "cb" ? "IDE" : "CLI";
   return {
     ...common,
-    "User-Agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
-    "X-Domain": providerId === "workbuddycn" ? "www.workbuddy.cn" : WORKBUDDY_DOMAIN,
-    "Accept-Language": "en-US",
+    "User-Agent": buildCodeBuddyUserAgent(variant),
+    "X-IDE-Type": variant,
+    "X-IDE-Name": variant,
+    "X-Domain": codebuddyDomain(variant),
   };
 }
 
@@ -392,7 +370,7 @@ function envelopeCode(payload: unknown): number | null {
 }
 
 /**
- * Unwraps the check-in payload. WorkBuddy returns a flat `{ code, data }`,
+ * Unwraps the check-in payload. The gateway returns a flat `{ code, data }`,
  * while the CodeBuddy billing facade nests Tencent's `data.Response.Data`
  * (the same double wrap its quota endpoint uses), so both shapes resolve.
  */

package/src/providers/integrations/buddy/buddy-conversation-headers.ts

@@ -62,9 +62,9 @@ export interface BuddyConversationIds {
    * Wire format for the two message-scoped ids (`x-conversation-message-id`,
    * `x-request-id`).
    *
-   * The reference emits these as dashed UUIDs on the WorkBuddy desktop product
+   * The reference emits these as dashed UUIDs on the desktop product
    * and as 32-hex on CLI traffic (`build_attempt_headers` converts only the
-   * message/request ids, and only for the WorkBuddy profiles). The turn
+   * message/request ids, and only for the desktop profiles). The turn
    * aggregation key (`x-conversation-request-id` / `x-root-request-id`) and the
    * B3/W3C trace ids stay hex in both styles, because B3's spec accepts only
    * hex. Default `"hex"`.

package/src/providers/integrations/buddy/buddy-discovery-shared.ts

@@ -1,10 +1,10 @@
 import { asNumber as sharedAsNumber, asRecord } from "../../../shared/coerce";
 
 /**
- * Model discovery for the buddy family (CodeBuddy intl / CN, WorkBuddy).
+ * Model discovery for the buddy family (CodeBuddy intl / CN).
  *
- * The three sites are protocol-isomorphic but NOT path-isomorphic, and the
- * difference is load-bearing: the international sites answer
+ * The two sites are protocol-isomorphic but NOT path-isomorphic, and the
+ * difference is load-bearing: the international site answers
  * `/v2/enterprises/personal/models`, while the CN site answers
  * `/console/enterprises/personal/models`. Probing the CN path on an
  * international host returns HTTP 500 from the edge (APISIX) rather than 404 —
@@ -34,8 +34,8 @@ import { buddyAccountUid } from "./buddy-oauth-shared";
 export const BUDDY_CN_MODELS_PATH = "/console/enterprises/personal/models" as const;
 
 /**
- * Console directory path on the international sites (`codebuddy.ai`,
- * `workbuddy.ai`). The CN path above answers 500 on these hosts.
+ * Console directory path on the international site (`codebuddy.ai`). The CN
+ * path above answers 500 on these hosts.
  */
 export const BUDDY_INTL_MODELS_PATH = "/v2/enterprises/personal/models" as const;
 

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -1,5 +1,6 @@
 import type { ProviderDispatchContext } from "../../provider-contracts";
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { decodeJwtPayload } from "../../authentication/oauth-flow-store";
 import { buddyAccountUid } from "./buddy-oauth-shared";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
@@ -166,6 +167,14 @@ export function materializeBuddyDeviceBinding(
  * the operator pinned them in `auth_state` (there is no reliable source to
  * invent them from). An opaque API key carries no uid and yields nothing.
  */
+/** A short printable identity claim from a JWT payload, or `undefined`. */
+function identityClaim(claims: Record<string, unknown> | undefined, name: string): string | undefined {
+  if (claims === undefined) return undefined;
+  const value = claims[name];
+  if (typeof value === "string" && value.trim().length > 0 && value.trim().length <= 128) return value.trim();
+  return undefined;
+}
+
 export function buddyOAuthIdentityHeaders(
   context?: ProviderDispatchContext,
 ): Record<string, string> {
@@ -174,15 +183,20 @@ export function buddyOAuthIdentityHeaders(
   const uid = buddyAccountUid(token) ?? context?.credential.account_id ?? "";
   if (uid.length === 0) return {};
   const enterpriseId = buddyEnterprise(context);
+  // The reference gateway reads `id_source` / `token_source` from the JWT
+  // payload and the account record, not from stored auth state — an account
+  // authorized before either was persisted still carries them on the wire.
+  // Precedence matches the donor (`client_profiles._identity_claim_headers`):
+  // account fields first, then JWT claims, then legacy `auth_state`.
+  const claims = token.length > 0 ? decodeJwtPayload(token) : undefined;
   const state = context?.credential.auth_state;
   const idSource =
-    typeof state?.["idSource"] === "string" && (state["idSource"] as string).trim().length > 0
-      ? (state["idSource"] as string).trim()
-      : undefined;
+    identityClaim(claims, "id_source") ??
+    identityClaim(claims, "idSource") ??
+    identityClaim(state as Record<string, unknown> | undefined, "idSource");
   const method =
-    typeof state?.["authMethod"] === "string" && (state["authMethod"] as string).trim().length > 0
-      ? (state["authMethod"] as string).trim()
-      : undefined;
+    identityClaim(claims, "token_source") ??
+    identityClaim(state as Record<string, unknown> | undefined, "authMethod");
   const headers: Record<string, string> = { "X-User-Id": uid };
   if (method !== undefined) headers["X-Auth-Method"] = method;
   if (idSource !== undefined) headers["X-Id-Source"] = idSource;
@@ -228,3 +242,72 @@ export function buddyAgentPurpose(
   if (typeof fromRequest === "string" && fromRequest.trim().length > 0) return fromRequest.trim();
   return undefined;
 }
+
+/**
+ * Desktop risk token, sent only when the account actually has one.
+ *
+ * The account's own `auth_state` wins. When it carries none, a file the
+ * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
+ * `/app/data/device_token`) is read instead — cached for five minutes, and
+ * ignored when it is larger than 1 KB, because a token file that size is not
+ * a token. A missing file is the normal case and reads as "no token".
+ */
+const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
+const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
+let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
+
+export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
+  const state = context?.credential.auth_state;
+  const value = state?.["deviceToken"] ?? state?.["device_token"];
+  if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  return readDeviceTokenFile();
+}
+
+/**
+ * The reference `X-Device-Token` pair, per the official desktop app.
+ *
+ * The desktop client always presents one of the
+ * two on chat traffic — a real token from the TuringShield SDK, or an
+ * `X-Device-Token-Error` when the SDK cannot produce one. It never omits both,
+ * and it sends the header on every realm (Intl and CN alike).
+ *
+ * The TuringShield SDK was a proprietary native addon shipped under
+ * `vendor/turing-sdk/`; it has been removed. The fallback path below is the
+ * captured token (auth_state / `CARTETHYIA_DEVICE_TOKEN_FILE`) and then the
+ * official failure state.
+ *
+ * - Legacy token (auth_state/file) → used when no SDK is available.
+ * - CLI identity never carries a device token (the CLI has no device).
+ */
+export async function buddyDeviceTokenHeaders(args: {
+  realm: "intl" | "cn";
+  context: ProviderDispatchContext | undefined;
+  cliIdentity: boolean | undefined;
+}): Promise<Record<string, string>> {
+  const { context, cliIdentity } = args;
+  void args.realm; // the desktop client sends the token on both realms
+  if (resolveBuddyIdentity(context, cliIdentity) === "cli") return {};
+  const token = readBuddyDeviceToken(context);
+  if (token !== undefined) return { "x-device-token": token };
+  return { "x-device-token-error": "sdk_not_initialized" };
+}
+
+function readDeviceTokenFile(): string | undefined {
+  const now = Date.now();
+  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
+    return deviceTokenFileCache.value;
+  }
+  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
+  let value: string | undefined;
+  try {
+    const raw = readFileSync(path);
+    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
+      const text = raw.toString("utf8").trim();
+      if (text.length > 0) value = text;
+    }
+  } catch {
+    value = undefined;
+  }
+  deviceTokenFileCache = { value, readAt: now };
+  return value;
+}

package/src/providers/integrations/buddy/buddy-media.ts

@@ -1,13 +1,12 @@
 /**
  * Buddy-family media generation: image and video.
  *
- * CodeBuddy (intl) and WorkBuddy serve media through the same facade, so shared
- * request shaping lives here. Their image endpoint can differ by provider;
+ * CodeBuddy (intl + CN) serves media through the same facade, so shared
+ * request shaping lives here. Their image endpoint can differ by realm;
  * identity headers come from {@link codebuddyHeaders} keyed on the variant.
  *
- * Two image paths are supported: CodeBuddy can use its native
- * `/images/generations` API, while WorkBuddy keeps its chat-completion image
- * path. The configured provider path selects the wire format.
+ * The image path is CodeBuddy's native `/images/generations` API. The
+ * configured provider path selects the wire format.
  *
  * - **Video** (`seedance-2.5`) is implemented as an async task: submission
  *   expects a task ID, then the adapter polls a sibling task URL until a clip

package/src/providers/integrations/buddy/buddy-oauth-shared.ts

@@ -1,5 +1,5 @@
 /**
- * The buddy-family device-login mechanism (`cb`, `cbcn`, `workbuddy`).
+ * The buddy-family device-login mechanism (`cb`, `cbcn`).
  *
  * All three complete device login against the same plugin auth endpoints: a
  * state POST, a token poll that answers the pending code `11217` until the user
@@ -64,7 +64,7 @@ export function strictResponseCode(payload: unknown): number | undefined {
 }
 
 /**
- * Reads the envelope `code` through `Number()`, which is how the WorkBuddy
+ * Reads the envelope `code` through `Number()`, which is how the buddy
  * gateway is read. Looser than `strictResponseCode` on a malformed payload: a
  * `null` code coerces to `0`, i.e. success, and `true` to `1`. Kept verbatim
  * rather than tightened because nothing here shows what that gateway sends for

package/src/providers/integrations/buddy/buddy-quota-shared.ts

@@ -2,7 +2,7 @@ import { asNumber as sharedAsNumber } from "../../../shared/coerce";
 
 /**
  * Shared Tencent billing-meter parsing for the CodeBuddy family
- * (`cb`, `cbcn`, `workbuddy`).
+ * (`cb`, `cbcn`).
  *
  * All three read the same endpoint shape — POST
  * `{base}/v2/billing/meter/get-user-resource` answering

package/src/providers/integrations/buddy/buddy-usage-shared.ts

@@ -1,7 +1,5 @@
 /**
- * Real credit deductions for the Tencent "buddy" family (`cb`, `cbcn`,
- * `workbuddy`, `workbuddycn`).
- *
+ * Real credit deductions for the Tencent "buddy" family (`cb`, `cbcn`). *
  * Every provider in the family reads the same usage-detail endpoint —
  * `POST {billingHost}/billing/meter/get-user-request-usage` — which answers the
  * actual per-request deductions the billing meter recorded: when the request