cartethyia 2.7.8 → 2.8.0

package/src/providers/integrations/qoder/claim-qoder-credits.ts

@@ -16,10 +16,14 @@
  */
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
 import type { ValidatedFetch } from "../../../network/outbound-fetch";
-import { getQoderVersion } from "../../operations/client-versions";
 import { qoderRealmForProvider, QODER_REALMS } from "./qoder-realm";
+import { exchangeQoderPatForHost } from "./qoder-auth";
 import {
+  asNumber,
+  asRecord,
   buildCampaignHeaders,
+  normalizeCampaign,
+  safeParse,
 } from "./qoder-checkin";
 import { qoderMachineHeaders } from "./qoder-umid";
 import {
@@ -38,31 +42,6 @@ export const QODER_CREDIT_PROVIDER_IDS = ["qoder", "qodercn"] as const;
 
 const PAT_PREFIX = "pt-";
 
-function asRecord(value: unknown): Record<string, unknown> | null {
-  if (typeof value !== "object" || value === null) return null;
-  return value as Record<string, unknown>;
-}
-
-function asNumber(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value === "string" && value.trim() !== "") {
-    const parsed = Number(value);
-    return Number.isFinite(parsed) ? parsed : null;
-  }
-  return null;
-}
-
-function normalizeCampaign(raw: Record<string, unknown>): Record<string, unknown> {
-  const benefit = asRecord(raw["benefit"]);
-  return {
-    campaign_id: String(raw["campaignId"] ?? raw["campaign_id"] ?? ""),
-    campaign_key: String(raw["campaignKey"] ?? raw["campaign_key"] ?? ""),
-    action_type: String(raw["actionType"] ?? raw["action_type"] ?? ""),
-    claim_status: String(raw["claimStatus"] ?? raw["claim_status"] ?? ""),
-    ...(benefit !== null ? { benefit } : {}),
-  };
-}
-
 /**
  * Exchanges a PAT (`pt-…`) for a job token (`jt-…`) on the realm's openapi
  * host. Returns the job token, or `null` when the exchange fails.
@@ -70,7 +49,8 @@ function normalizeCampaign(raw: Record<string, unknown>): Record<string, unknown
  * The real client binds the machine identity at exchange time
  * (`getMachineIdentityRequestFields`), so `machine_id` + `machine_token` are
  * sent when available — the job token is then bound to that machine. The
- * User-Agent and Cosy version mirror the real client (`qoder/<version>`).
+ * request is the shared `exchangeQoderPatForHost` (same v1 body and client
+ * identity headers as the auth path), parameterized by this site's own host.
  */
 async function exchangePatToJobToken(
   base: string,
@@ -78,30 +58,17 @@ async function exchangePatToJobToken(
   fetcher: ValidatedFetch,
   machine?: { readonly id?: string; readonly token?: string },
 ): Promise<string | null> {
-  try {
-    const body: Record<string, unknown> = { personal_token: pat };
-    if (machine?.id) body.machine_id = machine.id;
-    if (machine?.token) body.machine_token = machine.token;
-    const version = getQoderVersion();
-    const res = await fetcher(`${base}/api/v1/jobToken/exchange`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "User-Agent": `qoder/${version}`,
-        "Cosy-ClientType": "5",
-        "Cosy-Version": version,
-      },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(25_000),
-    });
-    if (!res.ok) return null;
-    const payload: unknown = await res.json().catch(() => null);
-    const rec = asRecord(payload);
-    const token = String(rec?.["token"] ?? rec?.["device_token"] ?? rec?.["access_token"] ?? "");
-    return token.length > 0 ? token : null;
-  } catch {
-    return null;
-  }
+  const exchanged = await exchangeQoderPatForHost({
+    pat,
+    url: `${base}/api/v1/jobToken/exchange`,
+    ...(machine === undefined ? {} : { machine }),
+    fetcher,
+    signal: AbortSignal.timeout(25_000),
+    tokenKeys: ["token", "device_token", "access_token"],
+  });
+  if (exchanged === null) return null;
+  if (!exchanged.response.ok) return null;
+  return exchanged.result?.token ?? null;
 }
 
 /**
@@ -139,7 +106,7 @@ export async function claimQoderCredits(args: {
   const store = new DrizzleQoderNativeIdentityStore(db);
   let bound = await store.get(providerId, accountId);
   if (!bound) {
-    const minted = await allocateQoderNativeIdentity(store, providerId, accountId);
+    const minted = await allocateQoderNativeIdentity(store, providerId, accountId, { realm });
     if (!minted) return { state: "error", amount: 0, detail: "Could not mint a UMID identity for this account." };
     bound = minted;
   }
@@ -248,11 +215,3 @@ export async function claimQoderCredits(args: {
     return { state: "error", amount: 0, detail: "Claim request failed." };
   }
 }
-
-function safeParse(raw: string): unknown {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}

package/src/providers/integrations/qoder/qoder-adapter.ts

@@ -1,14 +1,13 @@
 /**
  * Qoder adapter — transport selection, credential resolution, dispatch.
  *
- * Surface contract (2026-11-05):
- * - `grpc` (default, production): `model.chat.ChatService/ChatCompletionStream`
- *   — the only proven carrier of real 1M-token context (HTTP IDE caps at
- *   ~256 KiB). Serves billed rows; a free-tier row (`lite`) is refused there
- *   (`quota exceeded` 116) and must use legacy COSY.
- * - `cosy` (free/lite + forced legacy): `/algo/.../agent_chat_generation` —
- *   the only surface that accepts free-tier rows. Signing is the COSY Bearer
- *   scheme (AES/RSA + alphabet-scrambled body).
+ * Surface contract (2026-11-07):
+ * - `cosy` (default, production): `/algo/.../agent_chat_generation` on
+ *   `api1` → `api2` → `api3.qoder.sh` (legacy COSY) — the only surface
+ *   verified alive. Accepts free-tier rows (`lite`).
+ * - `grpc` (`model.chat.ChatService/ChatCompletionStream`): **not the
+ *   default anymore** — its host (`api2-v2.qoder.sh`) is NXDOMAIN since
+ *   2026-11-07. Kept as an explicit override for probes.
  * - `ide` (`/model/v1/chat/completions`): **probe/testing only — never
  *   production.** It is the only surface that echoes strategy metadata
  *   (`raw_usage` → provider_model/target) and it streams immediately, but its
@@ -31,12 +30,13 @@ import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operat
 import { getQoderVersion } from "../../operations/client-versions";
 import { qoderMachineHostname, qoderMachineOs } from "../../operations/cli-platform";
 import { mapUpstreamHttpError } from "../../../transport/failure-policy";
-import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS, qoderDiscoveredMaxContexts } from "./qoder-catalog";
+import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS } from "./qoder-catalog";
 import { isQoderVirtualModel, qoderDispatchModelId } from "./qoder-virtual";
 import { isQoderPat, qoderOAuthAuth, qoderSessionId, resolveQoderAuth } from "./qoder-auth";
 import { buildQoderRequest, callQoder } from "./qoder-chat";
 import { buildQoderGrpcRequest, qoderGrpcMetadata, qoderGrpcToCanonicalEvents } from "./qoder-grpc";
 import { buildQoderIdeRequest, qoderBodyToCanonicalEvents } from "./qoder-ide";
+import { estimateQoderSessionCache } from "./qoder-cache";
 import {
   QODER_CHAT_PATH,
   QODER_PROVIDER_ID,
@@ -55,17 +55,16 @@ interface QoderAdapterOptions {
   /**
    * Which chat transport to dispatch on.
    *
-   * `grpc` (default) uses the gRPC model-server surface
-   * (`model.chat.ChatService/ChatCompletionStream`) — the only proven carrier
-   * of real 1M-token context (the HTTP IDE surface caps at ~256 KiB). gRPC
-   * serves billed models; a free-tier row (`lite`) is refused there
-   * (`quota exceeded` 116) and must use the legacy COSY surface.
+   * `cosy` (default) = legacy COSY (`/algo/.../agent_chat_generation`) on
+   * `api1` → `api2` → `api3.qoder.sh` — the only surface verified alive
+   * (2026-11-07; the `api2-v2` model-server host is NXDOMAIN). This path also
+   * accepts free-tier rows (`lite`).
    *
-   * `cosy` forces only the legacy surface (`/algo/.../agent_chat_generation`)
-   * — the free-tier path and the pre-gRPC behavior.
+   * `grpc` forces the gRPC surface (`model.chat.ChatService/ChatCompletionStream`)
+   * — **no longer the default**; its host is not verified alive.
    *
-   * `ide` forces the modern `/model/v1` surface — **probe/testing only, never
-   * production** (see module doc).
+   * `ide` forces `/model/v1` — **probe/testing only, never production**
+   * (see module doc).
    */
   readonly surface?: "grpc" | "cosy" | "ide";
 }
@@ -75,7 +74,7 @@ export function resolveQoderTransport(
   surface: "grpc" | "cosy" | "ide" | undefined,
   modelConfig: QoderModelConfig,
 ): "grpc" | "cosy" | "ide" {
-  const chosen = surface ?? "grpc";
+  const chosen = surface ?? "cosy";
   // `ide` is an explicit testing override — never auto-selected, and it does
   // not apply the free-tier rule (a forced IDE call is a test call).
   if (chosen === "ide") return "ide";
@@ -85,16 +84,6 @@ export function resolveQoderTransport(
   return chosen;
 }
 
-/**
- * The widest selectable context window for one model key (from the live list's
- * `context_config`; falls back to the static roster's stated window).
- */
-function qoderMaxContextFor(modelId: string, modelConfig: QoderModelConfig, realm: QoderRealm): number {
-  const discovered = qoderDiscoveredMaxContexts(realm).get(modelId);
-  if (discovered !== undefined) return discovered;
-  return modelConfig.max_input_tokens;
-}
-
 class QoderAdapter implements ProviderAdapter {
   readonly provider_id: ProviderId;
   private readonly realm: QoderRealm;
@@ -104,7 +93,14 @@ class QoderAdapter implements ProviderAdapter {
   constructor(options: QoderAdapterOptions = {}) {
     this.provider_id = (options.providerId ?? QODER_PROVIDER_ID) as ProviderId;
     this.realm = options.realm ?? "intl";
-    this.surface = options.surface ?? "grpc";
+    // The legacy COSY surface is the production default (2026-11-07): the
+    // gRPC host is NXDOMAIN and the IDE surface is probe-only. The constructor
+    // must default to it too, or every billed model dispatches to the dead
+    // gRPC path while free-tier rows get cosy via the is_free rule — the
+    // mismatch that made `deepseek-v4.1-flash` fail while `qwen3.8-flash`
+    // passed. This is the same default `resolveQoderTransport(undefined)`
+    // already returns.
+    this.surface = options.surface ?? "cosy";
     this.fetchFn = options.fetch ?? globalThis.fetch;
   }
 
@@ -121,6 +117,30 @@ class QoderAdapter implements ProviderAdapter {
     >;
   }
 
+  /**
+   * Wraps an upstream event stream and applies the local session-cache
+   * estimate to every `usage` record (and terminal-carried usage).
+   *
+   * Qoder's upstream never reports prompt-cache hits (verified live on both
+   * gRPC and IDE HTTP surfaces), so the gap is closed the same way Trae and
+   * Kiro do: estimate the cached prefix from this session's request history.
+   */
+  async *#withSessionCacheEstimate(
+    events: AsyncIterable<CanonicalEvent>,
+    request: CanonicalRequest,
+    sessionId: string | undefined,
+  ): AsyncGenerator<CanonicalEvent> {
+    for await (const event of events) {
+      if (event.type === "usage") {
+        yield { ...event, usage: estimateQoderSessionCache(event.usage, sessionId, request.messages) };
+      } else if (event.type === "terminal" && event.usage !== undefined) {
+        yield { ...event, usage: estimateQoderSessionCache(event.usage, sessionId, request.messages) };
+      } else {
+        yield event;
+      }
+    }
+  }
+
   async *dispatch(
     request: CanonicalRequest,
     candidate: ProviderDispatchTarget,
@@ -207,7 +227,11 @@ class QoderAdapter implements ProviderAdapter {
         if (!res.ok) throw await mapUpstreamHttpError(res, "qoder");
         if (!res.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
         lifecycle.release();
-        yield* qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId);
+        yield* this.#withSessionCacheEstimate(
+          qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId),
+          request,
+          qoderSessionId(auth.userId, modelId),
+        );
         return;
       }
 
@@ -222,7 +246,6 @@ class QoderAdapter implements ProviderAdapter {
           modelId,
           request,
           auth.userId,
-          qoderMaxContextFor(modelId, modelConfig, this.realm),
           {
             messages: legacy.messages as Array<Record<string, unknown>>,
             tools: legacy.tools as Array<Record<string, unknown>>,
@@ -233,16 +256,39 @@ class QoderAdapter implements ProviderAdapter {
         );
         const grpcMetadata = qoderGrpcMetadata(auth);
         lifecycle.release();
-        yield* qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal);
+        yield* this.#withSessionCacheEstimate(
+          qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal, context.provider_capture),
+          request,
+          qoderSessionId(auth.userId, modelId),
+        );
         return;
       }
 
-      const cosyUrl = candidate.endpoint_path?.startsWith("http")
-        ? candidate.endpoint_path
-        : `${qoderInferenceCandidates(this.realm, auth.securityOauthToken)[0] ?? ""}${QODER_CHAT_PATH}`;
-      const cosyRequest = () =>
-        callQoder(cosyUrl, buildQoderRequest(modelId, request, modelConfig, auth, this.realm), modelId, auth, lifecycle.signal, fetcher, version);
-      const response = await cosyRequest();
+      // Legacy COSY hosts are tried in order (api1 → api2 → api3) with the
+      // endpoint path from discovery when present. A network-level failure on
+      // one host falls through to the next; an HTTP error response surfaces as-is.
+      const cosyCandidates = candidate.endpoint_path?.startsWith("http")
+        ? [candidate.endpoint_path]
+        : qoderInferenceCandidates(this.realm, auth.securityOauthToken).map(
+            (host) => `${host}${QODER_CHAT_PATH}`,
+          );
+      let response: Response | undefined;
+      let lastError: unknown;
+      for (const cosyUrl of cosyCandidates) {
+        try {
+          const attempt = () =>
+            callQoder(cosyUrl, buildQoderRequest(modelId, request, modelConfig, auth, this.realm), modelId, auth, lifecycle.signal, fetcher, version);
+          response = await attempt();
+          break;
+        } catch (err: unknown) {
+          lastError = err;
+        }
+      }
+      if (response === undefined) {
+        throw lastError instanceof Error
+          ? lastError
+          : new GatewayError("transport_unavailable", 502, "Qoder legacy COSY hosts are unreachable (request {requestId}). The connection ghosted us — come back in a moment 👻", {}, "upstream");
+      }
       if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
       if (!response.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
       // Headers arrived: the pre-stream deadline has served its purpose.
@@ -250,7 +296,11 @@ class QoderAdapter implements ProviderAdapter {
       // context.abort_signal) governs the body. Keeping this timer armed
       // would kill healthy long streams at the stale pre-stream deadline.
       lifecycle.release();
-      yield* qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model);
+      yield* this.#withSessionCacheEstimate(
+        qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model),
+        request,
+        qoderSessionId(auth.userId, modelId),
+      );
     } catch (err: unknown) {
       const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
       if (abortError) throw abortError;

package/src/providers/integrations/qoder/qoder-auth.ts

@@ -114,6 +114,91 @@ export function qoderSessionId(userId: string, modelId: string): string {
 
 type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
 
+/** The fields a PAT→job-token exchange response carries. */
+export interface ExchangeQoderPatResult {
+  readonly token: string;
+  readonly name?: string;
+  readonly userType?: string;
+  readonly refreshToken?: string;
+  readonly expiresAt?: string;
+}
+
+/**
+ * One PAT→job-token exchange against an explicit endpoint URL. Shared by
+ * `exchangeQoderPat` (auth) and the claim flow: both POST the same v1 body
+ * (`{personal_token, machine_id?, machine_token?}`) with the client identity
+ * headers and parse the same response token. Parameterized by URL so each call
+ * site keeps its own verified host (`center.qoder.sh` vs the openapi host);
+ * the header set is the one verified live against both (2026-11-05/05).
+ * Returns the raw `Response` plus the parsed result (or `null` when the body
+ * carried no usable token); `null` itself means the request failed to reach
+ * upstream. Callers decide how to surface each case (throw vs null).
+ */
+export async function exchangeQoderPatForHost(args: {
+  readonly pat: string;
+  readonly url: string;
+  readonly machine?: { readonly id?: string; readonly token?: string };
+  readonly fetcher: QoderFetcher;
+  readonly signal: AbortSignal;
+  readonly version?: string;
+  /** Response keys to read the job token from, tried in order. Defaults to `["token"]`. */
+  readonly tokenKeys?: readonly string[];
+}): Promise<{ readonly response: Response; readonly result: ExchangeQoderPatResult | null } | null> {
+  const body: Record<string, unknown> = { personal_token: args.pat };
+  if (args.machine?.id) body.machine_id = args.machine.id;
+  if (args.machine?.token) body.machine_token = args.machine.token;
+  const version = args.version ?? getQoderVersion();
+  const tokenKeys = args.tokenKeys ?? ["token"];
+  let response: Response;
+  try {
+    response = await args.fetcher(args.url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": `qoder/${version}`,
+        "X-Request-ID": randomUUID().toUpperCase(),
+        "Cosy-ClientType": "5",
+        "Cosy-Version": version,
+        "Cosy-MachineOS": qoderMachineOs(),
+      },
+      body: JSON.stringify(body),
+      signal: args.signal,
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) return { response, result: null };
+  let responseBody: unknown;
+  try {
+    responseBody = await response.json();
+  } catch {
+    return { response, result: null };
+  }
+  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
+    return { response, result: null };
+  }
+  const rec = responseBody as Record<string, unknown>;
+  let token = "";
+  for (const key of tokenKeys) {
+    if (typeof rec[key] === "string" && (rec[key] as string).length > 0) {
+      token = rec[key] as string;
+      break;
+    }
+  }
+  if (token.length === 0) return { response, result: null };
+  return {
+    response,
+    result: {
+      token,
+      ...(typeof rec["name"] === "string" ? { name: rec["name"] as string } : {}),
+      ...(typeof rec["userType"] === "string" ? { userType: rec["userType"] as string } : {}),
+      ...(typeof rec["refresh_token"] === "string" ? { refreshToken: rec["refresh_token"] as string } : {}),
+      ...(typeof rec["expires_at"] === "string" ? { expiresAt: rec["expires_at"] as string } : {}),
+    },
+  };
+}
+
 /**
  * Exchanges a PAT (`pt-…`) for a short-lived job token (`jt-…`) using the
  * modern v1 endpoint. Verified live (2026-11-05): `POST
@@ -135,41 +220,28 @@ async function exchangeQoderPat(
   realm: QoderRealm = "intl",
 ): Promise<QoderAuth> {
   const machineId = qoderMachineIdFromPat(pat);
-  const response = await fetcher(QODER_REALMS[realm].jobTokenUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      "User-Agent": `qoder/${version}`,
-      "X-Request-ID": randomUUID().toUpperCase(),
-      "Cosy-ClientType": "5",
-      "Cosy-Version": version,
-      "Cosy-MachineOS": qoderMachineOs(),
-    },
-    body: JSON.stringify({ personal_token: pat, machine_id: machineId }),
+  const exchanged = await exchangeQoderPatForHost({
+    pat,
+    url: QODER_REALMS[realm].jobTokenUrl,
+    machine: { id: machineId },
+    fetcher,
     signal,
+    version,
   });
-  if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
-  let responseBody: unknown;
-  try {
-    responseBody = await response.json();
-  } catch {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned invalid JSON (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  if (exchanged === null) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange failed to reach upstream (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
   }
-  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned unexpected response (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
-  }
-  const rec = responseBody as Record<string, unknown>;
-  const token = typeof rec["token"] === "string" ? (rec["token"] as string) : "";
-  if (!token) {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned incomplete credentials (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  if (!exchanged.response.ok) throw await mapUpstreamHttpError(exchanged.response, "qoder");
+  const result = exchanged.result;
+  if (result === null) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned no usable token (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
   }
   return {
     userId: machineId,
-    userName: typeof rec["name"] === "string" ? (rec["name"] as string) : "",
-    userType: typeof rec["userType"] === "string" ? (rec["userType"] as string) : "personal_standard",
-    securityOauthToken: token,
-    refreshToken: typeof rec["refresh_token"] === "string" ? (rec["refresh_token"] as string) : "",
+    userName: result.name ?? "",
+    userType: result.userType ?? "personal_standard",
+    securityOauthToken: result.token,
+    refreshToken: result.refreshToken ?? "",
     machineId,
   };
 }

package/src/providers/integrations/qoder/qoder-cache.ts

@@ -0,0 +1,32 @@
+// Qoder session-cache estimation.
+//
+// The Qoder upstream never reports prompt-cache hits: neither the gRPC surface
+// (used `prompt_tokens_details` absent on every chunk — verified live
+// 2026-11-05, `scripts/provider-probing/qoder/direct/direct-cache-hit.ts`) nor
+// the IDE HTTP surface (`usage: null` / `raw_usage` absent — `direct-cache-hit-ide.ts`)
+// carries a cached-token counter. The underlying models do cache byte-identical
+// prefixes, so for the same conversation we ESTIMATE the hit locally from the
+// request history — exactly how the Trae and Kiro adapters bridge the same gap.
+// This only fills the gap when upstream reports nothing (0 or unavailable); a
+// genuine upstream report (>0) is trusted and left untouched.
+//
+// The state lives in a factory-created instance, so Qoder's sessions are fully
+// isolated from Trae's/Kiro's (and any other consumer of the shared factory).
+
+import type { CanonicalMessage, UsageRecord } from "../../../protocol/canonical-model";
+import { createSessionCache, estimateSessionCache, resetSessionCacheForTesting } from "../shared/session-cache";
+
+const cache = createSessionCache();
+
+export function estimateQoderSessionCache(
+  record: UsageRecord,
+  sessionId: string | undefined,
+  messages: readonly CanonicalMessage[] | undefined,
+): UsageRecord {
+  return estimateSessionCache(cache, record, sessionId, messages);
+}
+
+/** Drops all tracked sessions. Test-only. */
+export function resetQoderSessionCacheForTesting(): void {
+  resetSessionCacheForTesting(cache);
+}

package/src/providers/integrations/qoder/qoder-catalog.ts

@@ -12,7 +12,7 @@ import { GatewayError } from "../../../protocol/gateway-error";
 import { defineModel } from "../../provider-model-definition";
 import type { ModelDefinition } from "../../provider-model-definition";
 import { QODER_CHAT_PATH, QODER_MODELS_PATH, qoderGatewayCandidates, type QoderRealm } from "./qoder-realm";
-import { qoderVirtualIdFor, QODER_VIRTUAL_MODELS } from "./qoder-virtual";
+import { qoderVirtualIdFor, QODER_PROVIDER_WARNINGS, QODER_VIRTUAL_MODELS } from "./qoder-virtual";
 
 /** One upstream catalog row, as `/algo/api/v2/model/list` reports it. */
 export interface QoderCatalogEntry {
@@ -199,6 +199,8 @@ function qoderModels(
       // Only an explicit `true` marks the row free; an unstated flag is left
       // unset so nothing claims a tier the roster did not state.
       ...(cfg.is_free === undefined ? {} : { free: cfg.is_free, freeTier: cfg.is_free }),
+      // Provider-level caveats, not per-model claims (D37).
+      warnings: QODER_PROVIDER_WARNINGS,
     }),
   );
 }
@@ -255,6 +257,7 @@ export function qoderVirtualModels(
           : target.freeTier === undefined
             ? {}
             : { free: target.freeTier, freeTier: target.freeTier }),
+        warnings: QODER_PROVIDER_WARNINGS,
       }),
     );
   }
@@ -319,7 +322,7 @@ export function mapQoderCatalogResponse(raw: unknown): QoderCatalogEntry[] {
  * to a base-catalog/majority vote that can sit below the roster's ceiling
  * (e.g. `qwen3.7-plus` votes 64k while the roster says 131k).
  */
-function qoderRosterMaxOutputFor(providerId: string, key: string): number | undefined {
+export function qoderRosterMaxOutput(providerId: string, key: string): number | undefined {
   const configs = providerId === "qodercn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS;
   return configs[key]?.max_output_tokens;
 }
@@ -329,7 +332,7 @@ export function qoderCatalogModel(
   entry: QoderCatalogEntry,
   providerId: string,
 ): ModelDefinition {
-  const rosterOutput = qoderRosterMaxOutputFor(providerId, entry.key);
+  const rosterOutput = qoderRosterMaxOutput(providerId, entry.key);
   return defineModel({
     id: entry.key,
     providerId,
@@ -347,8 +350,9 @@ export function qoderCatalogModel(
     free: entry.isFree,
     freeTier: entry.isFree,
     // The live row carries no output ceiling, so inherit the static roster's
-    // stated one when it exists (see `qoderRosterMaxOutputFor`).
+    // stated one when it exists (see `qoderRosterMaxOutput`).
     ...(rosterOutput === undefined ? {} : { out: rosterOutput }),
+    warnings: QODER_PROVIDER_WARNINGS,
   });
 }
 
@@ -442,6 +446,21 @@ export function qoderDiscoveredMaxContexts(realm: QoderRealm): ReadonlyMap<strin
   return discoveryMaxContextByKey.get(realm) ?? new Map();
 }
 
+/**
+ * The widest selectable context window for one model key.
+ *
+ * The live list's `context_config` is the authority when discovery has run:
+ * it names every window the account can switch to, and the widest one is what
+ * a dispatch should send (`model_config.max_input_tokens`) so a conversation is
+ * never capped at the *currently active* window (often 180k) when the account
+ * can use 1M. Falls back to the static roster's stated window otherwise.
+ */
+export function qoderMaxContextFor(modelId: string, modelConfig: QoderModelConfig, realm: QoderRealm): number {
+  const discovered = qoderDiscoveredMaxContexts(realm).get(modelId);
+  if (discovered !== undefined) return discovered;
+  return modelConfig.max_input_tokens;
+}
+
 export async function discoverQoderModels(input: {
   readonly realm: QoderRealm;
   /** Account secret the injected signer signs with; blank fails fast. */
@@ -522,7 +541,7 @@ export async function discoverQoderModels(input: {
         // is published.
         const virtuals = QODER_VIRTUAL_MODELS.filter((virtual) => virtual.target === entry.key);
         if (virtuals.length === 0) return [qoderCatalogModel(entry, providerId)];
-        const rosterOutput = qoderRosterMaxOutputFor(providerId, entry.key);
+        const rosterOutput = qoderRosterMaxOutput(providerId, entry.key);
         return virtuals.map((virtual) =>
           defineModel({
             id: virtual.id,
@@ -534,7 +553,7 @@ export async function discoverQoderModels(input: {
             reasoning: entry.isReasoning,
             // A virtual override wins; otherwise inherit the static roster's
             // ceiling for the slot instead of a base-catalog/majority estimate
-            // (see `qoderRosterMaxOutputFor`).
+            // (see `qoderRosterMaxOutput`).
             ...(virtual.outputLimit !== undefined
               ? { out: virtual.outputLimit }
               : rosterOutput === undefined
@@ -542,6 +561,7 @@ export async function discoverQoderModels(input: {
                 : { out: rosterOutput }),
             free: virtual.free ?? entry.isFree,
             freeTier: virtual.free ?? entry.isFree,
+            warnings: QODER_PROVIDER_WARNINGS,
           }),
         );
       });