cartethyia 2.7.8 → 2.8.0

package/src/providers/integrations/qoder/qoder-identity-cache.ts

@@ -0,0 +1,184 @@
+/**
+ * Disk cache + majority vote for Qoder native machine identities.
+ *
+ * Adopted from the donor reference implementation (`qoder_accounts.py`
+ * §native_machine_identity):
+ *
+ *  - **Disk cache** (`machine_identity.json` per data dir): the runtime-info
+ *    bridge outputs a machine-level identity derived from a seed file
+ *    (`~/.config/.locale_cfg`). Re-running the bridge frequently returns the
+ *    same identity, but container rebuilds/upgrades would discard the seed —
+ *    a disk cache keeps the device identity stable across restarts. Cache
+ *    wins: when a valid cache entry exists for the realm, the bridge is not
+ *    re-run.
+ *  - **Majority vote**: the bridge's VM classification jitters (1.5–10% of
+ *    runs flip between branches). A single sample can permanently fix a user
+ *    to the minority branch, so the first uncached acquisition samples the
+ *    bridge 3 times and takes the majority (extending to 5 on disagreement).
+ *  - **Expired-cache fallback**: when the bridge fails (missing glibc
+ *    loader, removed component), fall back to the cached identity even if
+ *    expired — a real identity is better than a generated one.
+ *
+ * The cache is per-realm (intl vs cn use different env codes and produce
+ * different identities). It is machine-global, not per-account: the seed is
+ * machine-scoped, and per-account isolation stays in the database
+ * (`provider_accounts.native_identity`).
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { resolveDataDir } from "../../../persistence/db-mode";
+import { log } from "../../../observability/logger";
+
+/** Cache record shape, one per realm. */
+export interface MachineIdentityCacheEntry {
+  readonly machineToken: string;
+  readonly machineType: string;
+  readonly machineCode: string;
+  readonly isVm: boolean;
+  readonly source: string;
+  /** The env code the identity was minted under (`3` intl desktop, `0` cn). */
+  readonly environment: string;
+  /** Unix seconds when this entry was written. */
+  readonly cachedAt: number;
+}
+
+/** Written cache document. */
+interface MachineIdentityCacheDoc {
+  readonly version: 1;
+  readonly realm: Record<string, MachineIdentityCacheEntry | undefined>;
+}
+
+const CACHE_VERSION = 1 as const;
+const NATIVE_IDENTITY_TTL_MS = 30 * 60 * 1000; // 1800s, matches the donor
+const VOTE_EXTEND_ROUNDS = 2;
+
+/** Path to the machine-identity cache file. */
+export function machineIdentityCachePath(env: NodeJS.ProcessEnv = process.env): string {
+  return join(resolveDataDir(env), "machine_identity.json");
+}
+
+function readCacheDoc(path: string): MachineIdentityCacheDoc {
+  try {
+    if (!existsSync(path)) return { version: CACHE_VERSION, realm: {} };
+    const raw = JSON.parse(readFileSync(path, "utf8")) as Partial<MachineIdentityCacheDoc>;
+    if (raw.version !== CACHE_VERSION || typeof raw.realm !== "object" || raw.realm === null) {
+      return { version: CACHE_VERSION, realm: {} };
+    }
+    return { version: CACHE_VERSION, realm: raw.realm as MachineIdentityCacheDoc["realm"] };
+  } catch {
+    return { version: CACHE_VERSION, realm: {} };
+  }
+}
+
+function writeCacheDoc(path: string, doc: MachineIdentityCacheDoc): void {
+  try {
+    mkdirSync(join(path, ".."), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(doc, null, 2), { encoding: "utf8", mode: 0o600 });
+    // Atomic replace so a crash never leaves a half-written cache.
+    renameSync(tmp, path);
+  } catch (error) {
+    log.warn("[qoder] machine identity cache write failed", error as Error);
+  }
+}
+
+function entryExpired(entry: MachineIdentityCacheEntry, now: number): boolean {
+  return now - entry.cachedAt >= NATIVE_IDENTITY_TTL_MS;
+}
+
+/** Reads the cached identity for a realm, or `null` when absent/expired. */
+export function readMachineIdentityCache(realm: string, env: NodeJS.ProcessEnv = process.env): MachineIdentityCacheEntry | null {
+  const doc = readCacheDoc(machineIdentityCachePath(env));
+  const entry = doc.realm[realm];
+  if (!entry) return null;
+  const now = Date.now();
+  if (entryExpired(entry, now)) return null;
+  return entry;
+}
+
+/** Reads the cached identity for a realm, permitting an expired entry. */
+export function readMachineIdentityCacheEvenExpired(realm: string, env: NodeJS.ProcessEnv = process.env): MachineIdentityCacheEntry | null {
+  const doc = readCacheDoc(machineIdentityCachePath(env));
+  const entry = doc.realm[realm];
+  return entry ?? null;
+}
+
+/** Writes the identity for a realm into the disk cache. */
+export function writeMachineIdentityCache(realm: string, entry: Omit<MachineIdentityCacheEntry, "cachedAt">, env: NodeJS.ProcessEnv = process.env): void {
+  const path = machineIdentityCachePath(env);
+  const doc = readCacheDoc(path);
+  doc.realm[realm] = { ...entry, cachedAt: Date.now() };
+  writeCacheDoc(path, doc);
+}
+
+/**
+ * Samples a native identity from the bridge, taking a majority vote to
+ * stabilize the VM-classification jitter. `sample` runs the bridge once
+ * (with the account id); it is called 3 times and, on disagreement, extended
+ * to 5. Returns the majority identity, or `null` when every sample failed.
+ */
+export function sampleIdentityWithVote(
+  sample: (accountId: string) => {
+    identity: { machineToken: string; machineType: string; machineCode: string; isVm: boolean; source: "runtime-info" | "generated" | "os" };
+    seed: string;
+  } | null,
+  accountId: string,
+): {
+  identity: { machineToken: string; machineType: string; machineCode: string; isVm: boolean; source: "runtime-info" | "generated" | "os" };
+  seed: string;
+} | null {
+  const take = (count: number): Array<NonNullable<ReturnType<typeof sample>>> => {
+    const out: Array<NonNullable<ReturnType<typeof sample>>> = [];
+    for (let i = 0; i < count; i += 1) {
+      const s = sample(accountId);
+      if (s) out.push(s);
+    }
+    return out;
+  };
+
+  // Sample progressively and abort as soon as two consecutive samples show a
+  // *different* machine token: the bridge is either a deterministic fake
+  // minter or its seed changed between runs, so voting has nothing to
+  // stabilize. This keeps the per-allocation bridge cost at 1-2 samples for
+  // unstable identities instead of always paying the full vote.
+  const samples: Array<NonNullable<ReturnType<typeof sample>>> = [];
+  const first = take(1)[0];
+  if (!first) return null;
+  samples.push(first);
+  const second = take(1)[0];
+  if (!second) return first;
+  samples.push(second);
+  if (second.identity.machineToken !== first.identity.machineToken) return first;
+  const third = take(1)[0];
+  if (!third) return first;
+  samples.push(third);
+  if (samples.length === 0) return null;
+
+  // Vote key: the machine token alone distinguishes identities; VM branch is
+  // part of the identity but the token is the stable anchor.
+  const tally = new Map<string, Array<NonNullable<ReturnType<typeof sample>>>>();
+  for (const s of samples) {
+    const key = s.identity.machineToken;
+    const arr = tally.get(key) ?? [];
+    arr.push(s);
+    tally.set(key, arr);
+  }
+  // Every sample produced a *different* token (e.g. a deterministic fake
+  // minter, or a bridge whose seed changed each run). Voting cannot pick a
+  // majority; take the first sample, matching the donor's "no majority →
+  // use first sample" fallback.
+  if (tally.size === samples.length) return samples[0]!;
+  if (tally.size === 1) return samples[0]!;
+
+  const extended = samples.concat(take(VOTE_EXTEND_ROUNDS));
+  const tally2 = new Map<string, Array<NonNullable<ReturnType<typeof sample>>>>();
+  for (const s of extended) {
+    const key = s.identity.machineToken;
+    const arr = tally2.get(key) ?? [];
+    arr.push(s);
+    tally2.set(key, arr);
+  }
+  const topKey = [...tally2.entries()].sort((a, b) => b[1].length - a[1].length)[0];
+  if (!topKey) return samples[0]!;
+  return topKey[1][0] ?? samples[0]!;
+}

package/src/providers/integrations/qoder/qoder-native-identity-store.ts

@@ -17,10 +17,15 @@ import { and, eq, isNotNull, ne } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
 import { providerAccounts, type NativeIdentityRecord } from "../../../persistence/schema";
 import {
-  mintQoderNativeIdentity,
-  replayQoderNativeIdentity,
+  mintQoderOsIdentity,
   type QoderNativeIdentity,
 } from "./qoder-umid";
+import {
+  readMachineIdentityCache,
+  readMachineIdentityCacheEvenExpired,
+  sampleIdentityWithVote,
+  writeMachineIdentityCache,
+} from "./qoder-identity-cache";
 
 /** Stateful read/write boundary for bound native identities. */
 export interface QoderNativeIdentityStore {
@@ -91,11 +96,11 @@ function withAllocationLock<T>(work: () => Promise<T>): Promise<T> {
 }
 
 /** Identity minting injected for tests; defaults to the real bridge. */
-export type NativeIdentityMinter = (accountId: string) => { identity: QoderNativeIdentity; seed: string } | null;
-export type NativeIdentityReplayer = (seed: string, accountId: string) => QoderNativeIdentity | null;
+export type NativeIdentityMinter = (accountId?: string) => { identity: QoderNativeIdentity; seed: string } | null;
+export type NativeIdentityReplayer = (seed: string, accountId?: string) => QoderNativeIdentity | null;
 
-const defaultMinter: NativeIdentityMinter = (accountId) => mintQoderNativeIdentity(accountId);
-const defaultReplayer: NativeIdentityReplayer = (seed, accountId) => replayQoderNativeIdentity(seed, accountId);
+const defaultMinter: NativeIdentityMinter = (accountId = "") => ({ identity: mintQoderOsIdentity(accountId), seed: "" });
+const defaultReplayer: NativeIdentityReplayer = () => null;
 
 /**
  * Mints and binds a fresh device identity for an account: runs the bridge
@@ -104,6 +109,12 @@ const defaultReplayer: NativeIdentityReplayer = (seed, accountId) => replayQoder
  *
  * `avoidToken` optionally excludes the account's own current token so a
  * regenerate moves to a *different* device.
+ *
+ * The disk cache (per realm) is checked first — a cached native identity is
+ * reused without re-running the bridge, so container rebuilds keep the same
+ * device. When no cache exists, a majority vote stabilizes the bridge's VM
+ * jitter. If the bridge fails entirely, the cached identity (even expired)
+ * is preferred over a generated one.
  */
 export function allocateQoderNativeIdentity(
   store: QoderNativeIdentityStore,
@@ -113,27 +124,81 @@ export function allocateQoderNativeIdentity(
     readonly avoidToken?: string;
     readonly mint?: NativeIdentityMinter;
     readonly replayer?: NativeIdentityReplayer;
+    readonly realm?: string;
+    readonly env?: NodeJS.ProcessEnv;
   } = {},
 ): Promise<NativeIdentityRecord | null> {
   const mint = options.mint ?? defaultMinter;
+  const realm = options.realm ?? "intl";
+  const env = options.env ?? process.env;
   return withAllocationLock(async () => {
-    const occupied = await store.occupied(accountId);
-    for (let i = 0; i < 6; i += 1) {
-      const minted = mint(accountId);
-      if (!minted) return null;
-      const token = minted.identity.machineToken;
-      if (occupied.has(token)) continue; // collision (rare) → mint again
-      if (token === options.avoidToken) continue;
+    // 1. Disk cache first — reuse the stable device identity across restarts.
+    //    But the cache is machine-global: a token already bound to another
+    //    account (unique index) must not be reused, so skip the cache and
+    //    mint fresh when the cached token is occupied.
+    const cached = readMachineIdentityCache(realm, env);
+    if (cached) {
+      const occupied = await store.occupied(accountId);
+      if (cached.machineToken !== options.avoidToken && !occupied.has(cached.machineToken)) {
+        const existing = await store.get(providerId, accountId);
+        if (existing && existing.machineToken === cached.machineToken) return existing;
+        const record: NativeIdentityRecord = {
+          machineToken: cached.machineToken,
+          machineType: cached.machineType,
+          machineCode: cached.machineCode,
+          source: cached.source === "generated" ? "generated" : cached.source === "os" ? "os" : "runtime-info",
+        };
+        await store.bind(providerId, accountId, record);
+        return record;
+      }
+    }
+
+    // 2. No valid cache — sample with a majority vote (stabilizes VM jitter).
+    const voted = sampleIdentityWithVote(mint, accountId);
+    if (voted) {
+      const occupied = await store.occupied(accountId);
+      for (let i = 0; i < 6; i += 1) {
+        const minted = i === 0 ? voted : mint(accountId);
+        if (!minted) return null;
+        const token = minted.identity.machineToken;
+        if (occupied.has(token)) continue; // collision (rare) → mint again
+        if (token === options.avoidToken) continue;
+        const record: NativeIdentityRecord = {
+          machineToken: token,
+          machineType: minted.identity.machineType,
+          machineCode: minted.identity.machineCode,
+          ...(minted.seed ? { seed: minted.seed } : {}),
+          source: minted.identity.source,
+        };
+        await store.bind(providerId, accountId, record);
+        // Persist the bound token to the disk cache so future runs reuse it.
+        writeMachineIdentityCache(realm, {
+          machineToken: token,
+          machineType: minted.identity.machineType,
+          machineCode: minted.identity.machineCode,
+          isVm: minted.identity.isVm,
+          source: minted.identity.source,
+          environment: realm === "cn" ? "0" : "3",
+        }, env);
+        return record;
+      }
+      return null;
+    }
+
+    // 3. Bridge failed entirely — fall back to the cached identity even if
+    //    expired. A real identity is better than a generated one.
+    const evenExpired = readMachineIdentityCacheEvenExpired(realm, env);
+    if (evenExpired) {
       const record: NativeIdentityRecord = {
-        machineToken: token,
-        machineType: minted.identity.machineType,
-        machineCode: minted.identity.machineCode,
-        ...(minted.seed ? { seed: minted.seed } : {}),
-        source: minted.identity.source,
+        machineToken: evenExpired.machineToken,
+        machineType: evenExpired.machineType,
+        machineCode: evenExpired.machineCode,
+        source: evenExpired.source === "generated" ? "generated" : evenExpired.source === "os" ? "os" : "runtime-info",
       };
       await store.bind(providerId, accountId, record);
       return record;
     }
+
     return null;
   });
 }

package/src/providers/integrations/qoder/qoder-realm.ts

@@ -74,22 +74,25 @@ export const QODER_MODELS_PATH = "/algo/api/v2/model/list?Encode=1";
  */
 export const QODER_IDE_CHAT_PATH = "/model/v1/chat/completions";
 
-/** The model-server host for one realm (intl: `api2-v2`, cn: gateway). */
+/** The model-server host for one realm (intl: `api1`, cn: gateway). */
 export function qoderIdeChatUrl(realm: QoderRealm): string {
   return realm === "cn"
     ? `https://gateway.qoder.com.cn${QODER_IDE_CHAT_PATH}`
-    : `https://api2-v2.qoder.sh${QODER_IDE_CHAT_PATH}`;
+    : `https://api1.qoder.sh${QODER_IDE_CHAT_PATH}`;
 }
 
 /**
  * The gRPC model-server host for one realm.
  *
- * Matches the desktop client's prod host (`wYA` in `qoder-worker-runtime.mjs`:
- * intl `api2-v2.qoder.sh`, CN `gateway.qoder.com.cn`). The gRPC service path
- * is `/model.chat.ChatService/ChatCompletionStream` on port 443.
+ * Intl default is `api1.qoder.sh` (first host from `qoderInferenceCandidates`;
+ * the old `api2-v2.qoder.sh` has been NXDOMAIN since 2026-11-07 — see
+ * `documentation/research/qoder/live/
+ * 2026-11-07-qoder-host-inference-fallback.md`). The gRPC service is no
+ * longer verified alive on any host that resolves (UNIMPLEMENTED); this host
+ * is kept as the target so probes/gRPC still have an address.
  */
 export function qoderGrpcHost(realm: QoderRealm): string {
-  return realm === "cn" ? "gateway.qoder.com.cn" : "api2-v2.qoder.sh";
+  return realm === "cn" ? "gateway.qoder.com.cn" : "api1.qoder.sh";
 }
 
 /**