cartethyia 2.7.9 → 2.8.0

package/src/providers/configured-provider.ts

@@ -3,6 +3,7 @@ import type { CanonicalRequest, WireFamily } from "../protocol/canonical-model";
 import { GatewayError } from "../protocol/gateway-error";
 import { OpenAICompatibleAdapter, withBearerAuthentication } from "./adapters/compatible-adapter";
 import { providerBaseUrl } from "./provider-metadata";
+import type { ProviderModule } from "./provider-registry";
 
 export function ensurePayloadModel(
   payload: Record<string, unknown>,
@@ -15,6 +16,7 @@ export function ensurePayloadModel(
   payload["model"] = model;
   return model;
 }
+
 /**
  * Declarative description of one bearer-authenticated OpenAI-compatible provider.
  *
@@ -98,3 +100,149 @@ export function createApiKeyAdapter(
     }),
   );
 }
+
+function apiKeySpec(
+  providerId: ProviderId,
+  paths: Readonly<Partial<Record<"chat" | "responses", string>>>,
+): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId,
+    endpoint_paths_by_wire_family: paths,
+  };
+}
+
+const BEARER_PATHS = { chat: "/chat/completions", responses: "/responses" } as const;
+
+/**
+ * Builtin providers whose entire adapter contract is "bearer auth against the
+ * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
+ * responses, with endpoint paths declared below the base's version root".
+ */
+export const GENERIC_API_KEY_SPECS = {
+  larprouter: apiKeySpec("larprouter", BEARER_PATHS),
+  mistral: apiKeySpec("mistral", BEARER_PATHS),
+  fireworks: apiKeySpec("fireworks", BEARER_PATHS),
+  nvidia: apiKeySpec("nvidia", BEARER_PATHS),
+  gmi: apiKeySpec("gmi", BEARER_PATHS),
+  ollamacloud: apiKeySpec("ollamacloud", BEARER_PATHS),
+  together: apiKeySpec("together", BEARER_PATHS),
+  siliconflow: apiKeySpec("siliconflow", BEARER_PATHS),
+  siliconflowcn: apiKeySpec("siliconflowcn", BEARER_PATHS),
+  nanogpt: apiKeySpec("nanogpt", BEARER_PATHS),
+  baseten: apiKeySpec("baseten", BEARER_PATHS),
+  synthetic: apiKeySpec("synthetic", BEARER_PATHS),
+  stepfun: apiKeySpec("stepfun", BEARER_PATHS),
+  sakana: apiKeySpec("sakana", BEARER_PATHS),
+  helmcode: apiKeySpec("helmcode", BEARER_PATHS),
+  coralbricks: apiKeySpec("coralbricks", BEARER_PATHS),
+  aiand: apiKeySpec("aiand", BEARER_PATHS),
+  wafer: apiKeySpec("wafer", BEARER_PATHS),
+  coreweave: apiKeySpec("coreweave", BEARER_PATHS),
+  dashscope: apiKeySpec("dashscope", BEARER_PATHS),
+  "qwen-portal": apiKeySpec("qwen-portal", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+export type GenericApiKeyProviderId = keyof typeof GENERIC_API_KEY_SPECS;
+
+export const GENERIC_API_KEY_PROVIDER_IDS = Object.keys(
+  GENERIC_API_KEY_SPECS,
+) as readonly GenericApiKeyProviderId[];
+
+/**
+ * Ids whose base URL already ends at a version segment.
+ */
+export const VERSIONED_ROOT_API_KEY_SPECS = {
+  groq: apiKeySpec("groq", BEARER_PATHS),
+  deepinfra: apiKeySpec("deepinfra", BEARER_PATHS),
+  novita: apiKeySpec("novita", BEARER_PATHS),
+  venice: apiKeySpec("venice", BEARER_PATHS),
+  qianfan: apiKeySpec("qianfan", BEARER_PATHS),
+  zhipucoding: apiKeySpec("zhipucoding", BEARER_PATHS),
+  firepass: apiKeySpec("firepass", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+export type VersionedRootApiKeyProviderId =
+  keyof typeof VERSIONED_ROOT_API_KEY_SPECS;
+
+export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = Object.keys(
+  VERSIONED_ROOT_API_KEY_SPECS,
+) as readonly VersionedRootApiKeyProviderId[];
+
+type DiscoveryBackedCapabilities = Pick<
+  ProviderModule,
+  "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
+>;
+
+type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
+export type OpenAIModelDiscoveryFactory = (
+  providerId: string,
+  options?: {
+    readonly headers?: (credential: string) => Readonly<Record<string, string>>;
+  },
+) => ModelDiscoveryFactory;
+
+const DISCOVERY_BACKED_PROVIDER_SPECS = {
+  groq: VERSIONED_ROOT_API_KEY_SPECS.groq,
+  larprouter: GENERIC_API_KEY_SPECS.larprouter,
+  together: GENERIC_API_KEY_SPECS.together,
+  deepinfra: VERSIONED_ROOT_API_KEY_SPECS.deepinfra,
+  siliconflow: GENERIC_API_KEY_SPECS.siliconflow,
+  siliconflowcn: GENERIC_API_KEY_SPECS.siliconflowcn,
+  novita: VERSIONED_ROOT_API_KEY_SPECS.novita,
+  venice: VERSIONED_ROOT_API_KEY_SPECS.venice,
+  nanogpt: GENERIC_API_KEY_SPECS.nanogpt,
+  baseten: GENERIC_API_KEY_SPECS.baseten,
+  synthetic: GENERIC_API_KEY_SPECS.synthetic,
+  stepfun: GENERIC_API_KEY_SPECS.stepfun,
+  sakana: GENERIC_API_KEY_SPECS.sakana,
+  helmcode: GENERIC_API_KEY_SPECS.helmcode,
+  coralbricks: GENERIC_API_KEY_SPECS.coralbricks,
+  aiand: GENERIC_API_KEY_SPECS.aiand,
+  wafer: GENERIC_API_KEY_SPECS.wafer,
+  firepass: VERSIONED_ROOT_API_KEY_SPECS.firepass,
+  zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
+  dashscope: GENERIC_API_KEY_SPECS.dashscope,
+  qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+type DiscoveryBackedProviderId = keyof typeof DISCOVERY_BACKED_PROVIDER_SPECS;
+
+/** Canonical discovery-backed provider ids, in declaration order. */
+export const DISCOVERY_BACKED_PROVIDER_IDS = Object.keys(
+  DISCOVERY_BACKED_PROVIDER_SPECS,
+) as readonly DiscoveryBackedProviderId[];
+
+export function discoveryBackedCapabilities(
+  providerId: string,
+  spec: ApiKeyProviderSpec,
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): DiscoveryBackedCapabilities {
+  return {
+    ...(spec.endpoint_paths_by_wire_family === undefined
+      ? {}
+      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
+    loadAdapter: async () => createApiKeyAdapter(spec),
+    loadModelDiscovery: openAIModelDiscovery(providerId, {
+      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
+    }),
+  };
+}
+
+/**
+ * Creates the standard provider capability table using the registry's shared
+ * discovery loader, keeping its lazy import and authentication behavior intact.
+ */
+export function createDiscoveryBackedProviderCapabilities(
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): Readonly<Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>> {
+  const capabilities = {} as Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>;
+  for (const providerId of DISCOVERY_BACKED_PROVIDER_IDS) {
+    capabilities[providerId] = discoveryBackedCapabilities(
+      providerId,
+      DISCOVERY_BACKED_PROVIDER_SPECS[providerId],
+      openAIModelDiscovery,
+    );
+  }
+  return capabilities;
+}
+

package/src/providers/default-registry.ts

@@ -4,13 +4,20 @@
 // drag every integration into memory at process start.
 import {
   GENERIC_API_KEY_SPECS,
-} from "./configured-openai-providers";
-import { createDiscoveryBackedProviderCapabilities, discoveryBackedCapabilities } from "./bundled-discovery-providers";
-import { createApiKeyAdapter } from "./configured-provider";
-import type { ApiKeyProviderSpec } from "./configured-provider";
-import { oauthCapability, quotaCapability, type ProviderModuleCapabilities } from "./provider-capabilities";
+  createDiscoveryBackedProviderCapabilities,
+  discoveryBackedCapabilities,
+  createApiKeyAdapter,
+  type ApiKeyProviderSpec,
+} from "./configured-provider";
 import { BUDDY_PROVIDER_CAPABILITIES } from "./integrations/buddy/capabilities";
-import { ProviderRegistry, toRegistration, type ProviderModule } from "./provider-registry";
+import {
+  ProviderRegistry,
+  toRegistration,
+  oauthCapability,
+  quotaCapability,
+  type ProviderModule,
+  type ProviderModuleCapabilities,
+} from "./provider-registry";
 import { BUNDLED_PROVIDER_METADATA, PROVIDER_COMPATIBILITY_PROFILES, providerBaseUrl, providerRequiresAccount, providerUpstreamHost, providerDefaultWireFamily, type BundledProviderId } from "./provider-metadata";
 import { createAnthropicCompatibleAdapter } from "./integrations/anthropic";
 import { defineModel } from "./provider-model-definition";
@@ -31,6 +38,29 @@ function configuredProvider(
   };
 }
 
+/**
+ * Extracts a bearer token from a JSON credential object when the stored secret
+ * is a JSON account export, falling back to the raw secret otherwise. Several
+ * discovery paths accept both a bare token and a JSON export, and each used to
+ * re-implement this same parse + key-pick; this keeps the reading in one place.
+ *
+ * Preserves the exact fallback semantics: an unparseable secret, or a JSON
+ * object with none of the recognized token keys, yields the raw secret.
+ */
+function extractJsonCredentialToken(secret: string): string {
+  if (!secret.startsWith("{")) return secret;
+  try {
+    const parsed = JSON.parse(secret) as Record<string, unknown>;
+    const found = ["accessToken", "access_token", "token"].find(
+      (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
+    );
+    if (found !== undefined) return parsed[found] as string;
+  } catch {
+    // Use the raw secret as the token.
+  }
+  return secret;
+}
+
 /**
  * Qoder's live model list for one realm.
  *
@@ -60,18 +90,7 @@ function traeDiscovery(
     if (secret.length === 0 || fetcher === undefined) {
       return realm === "cn" ? TRAE_CN_MODELS : TRAE_INTL_MODELS;
     }
-    let token = secret;
-    if (secret.startsWith("{")) {
-      try {
-        const parsed = JSON.parse(secret) as Record<string, unknown>;
-        const found = ["accessToken", "access_token", "token"].find(
-          (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
-        );
-        if (found !== undefined) token = parsed[found] as string;
-      } catch {
-        // Use the raw secret as the token.
-      }
-    }
+    const token = extractJsonCredentialToken(secret);
     const region = request.authState?.["region"];
     const rows = await discoverTraeModels({
       realm,
@@ -545,18 +564,7 @@ export const PROVIDER_CAPABILITIES = {
       const secret = request.credential.trim();
       const fetcher = request.fetcher as unknown as typeof fetch | undefined;
       if (secret.length === 0 || fetcher === undefined) return FREEPI_MODELS;
-      let token = secret;
-      if (secret.startsWith("{")) {
-        try {
-          const parsed = JSON.parse(secret) as Record<string, unknown>;
-          const found = ["accessToken", "access_token", "token"].find(
-            (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
-          );
-          if (found !== undefined) token = parsed[found] as string;
-        } catch {
-          // Use the raw secret as the token.
-        }
-      }
+      const token = extractJsonCredentialToken(secret);
       const rows = await discoverFreepiModels({ token, fetcher });
       if (rows.length === 0) return FREEPI_MODELS;
       return rows;
@@ -670,9 +678,7 @@ export const PROVIDER_CAPABILITIES = {
     // dressed ZCode client request (see the integration). The credential is a
     // ZCode login JWT — pasted, or minted by the sign-in flow below.
     loadAdapter: async () =>
-      createApiKeyAdapter(
-        (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_SPEC,
-      ),
+      (await import("./integrations/zcode-start-plan/provider")).createZcodeStartPlanAdapter(),
     loadModels: async () =>
       (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_MODELS,
     // The device flow stores the issued ZCode login JWT, not a Coding Plan key.
@@ -783,10 +789,29 @@ export const PROVIDER_CAPABILITIES = {
       responses: "/responses",
     },
     loadAdapter: async () => createApiKeyAdapter(GENERIC_API_KEY_SPECS.ollamacloud),
-    loadModels: async () => (await import("./integrations/ollamacloud-models")).OLLAMACLOUD_MODELS,
-    loadQuotaCollector: quotaCapability(() => import("./integrations/ollamacloud-quota"), "fetchOllamaQuota"),
+    loadModels: async () => (await import("./integrations/ollamacloud")).OLLAMACLOUD_MODELS,
+    loadQuotaCollector: quotaCapability(() => import("./integrations/ollamacloud"), "fetchOllamaQuota"),
     loadModelDiscovery: openAIModelDiscovery("ollamacloud", { headers: (credential) => ({ authorization: `Bearer ${credential}` }) }),
   },
+  freebuff: {
+    // Freebuff chat is OpenAI-compatible on `/api/v1/chat/completions`, but the
+    // adapter runs a stateful preflight (session admission + agent-runs START)
+    // and a device-signature header set — see the integration.
+    endpointPathsByWireFamily: { chat: "/api/v1/chat/completions" },
+    loadAdapter: async () => (await import("./integrations/freebuff/freebuff")).createFreebuffAdapter(),
+    loadModels: async () => (await import("./integrations/freebuff/freebuff-catalog")).FREEBUFF_MODELS,
+    loadAuthentication: oauthCapability(() => import("./integrations/freebuff/freebuff-oauth"), "freebuffOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/freebuff/freebuff-quota"), "fetchFreebuffQuota"),
+    loadModelDiscovery: async () =>
+      (await import("./integrations/freebuff/freebuff-discovery")).freebuffModelDiscovery(),
+  },
+  zro: {
+    endpointPathsByWireFamily: { messages: "/v1/messages" },
+    loadAdapter: async () => (await import("./integrations/zro/zro")).createZroAdapter(),
+    loadModels: async () => (await import("./integrations/zro/zro")).ZRO_MODELS,
+    loadQuotaCollector: quotaCapability(() => import("./integrations/zro/zro"), "fetchZroQuota"),
+    loadModelDiscovery: async () => (await import("./integrations/zro/zro")).zroModelDiscovery()(),
+  },
 
   ...createDiscoveryBackedProviderCapabilities(openAIModelDiscovery),
 
@@ -835,7 +860,7 @@ export const PROVIDER_CAPABILITIES = {
   // the provider usable before anyone syncs.
   dashscope: {
     ...discoveryBackedCapabilities("dashscope", GENERIC_API_KEY_SPECS.dashscope, openAIModelDiscovery),
-    loadModels: async () => (await import("./integrations/dashscope-models")).DASHSCOPE_MODELS,
+    loadModels: async () => (await import("./integrations/alibabacp/dashscope-models")).DASHSCOPE_MODELS,
   },
 
 // Anthropic-Messages providers reached with a plain key. The wire path is

package/src/providers/discovery/probe-phases.ts

@@ -472,8 +472,9 @@ export async function selectProbeAccount(args: {
  * back to the generic OpenAI-compatible adapter so probe/dispatch still works.
  * The low-level compatible adapter is used directly to avoid importing concrete
  * integrations from discovery (which would violate the provider-architecture
- * layering test). `loadOne` returning `undefined` means "no bundled adapter";
- * a throw is a registry failure and propagates rather than being reported as
+ * layering test). `resolve(..., { force: true })` rebuilds the bundled adapter
+ * against the current registration; `undefined` means "no bundled adapter"; a
+ * throw is a registry failure and propagates rather than being reported as
  * "no adapter registered".
  */
 export async function resolveProbeAdapter(args: {
@@ -482,7 +483,7 @@ export async function resolveProbeAdapter(args: {
   readonly providerWireRow: ProbeProviderRow | undefined;
 }): Promise<ProviderAdapter | undefined> {
   const { providerRegistry, providerId, providerWireRow } = args;
-  let adapter = await providerRegistry.loadOne(providerId);
+  let adapter = await providerRegistry.resolve(providerId, { force: true });
   if (!adapter) {
     try {
       if (providerWireRow?.baseUrl) {
@@ -665,8 +666,16 @@ export function buildProbeCanonicalRequest(args: {
    * probe.
    */
   readonly providerSystemPrompt?: string | undefined;
+  /**
+   * A provider-specific default probe prompt, used when the operator sent no
+   * prompt. Lets a provider whose policy gate flags repeated identical probes
+   * (Freebuff: `prompt_policy_refused` / "same message sent over and over")
+   * receive a minimal, per-model-varying probe instead of the shared identity
+   * question every provider otherwise sends.
+   */
+  readonly defaultPromptOverride?: string | undefined;
 }): CanonicalRequest {
-  const { modelId, request, probeReasoning, sourceSurface, maxOutputTokens, providerSystemPrompt } = args;
+  const { modelId, request, probeReasoning, sourceSurface, maxOutputTokens, providerSystemPrompt, defaultPromptOverride } = args;
   const fast = maxOutputTokens === PROBE_FAST_MAX_OUTPUT_TOKENS;
   return {
     model: modelId,
@@ -681,6 +690,7 @@ export function buildProbeCanonicalRequest(args: {
             kind: "text",
             text:
               request.prompt ??
+              defaultPromptOverride ??
               (fast ? PROBE_FAST_DEFAULT_PROMPT : "What model are you, and what is your knowledge cutoff date? Answer in one sentence."),
           },
         ],

package/src/providers/discovery/probing-service.ts

@@ -56,7 +56,7 @@ import {
   wireContextFrom,
   type ProbeProviderRow,
 } from "./probe-phases";
-import { createProbeFetch } from "../operations/probe-fetch";
+import { createProbeFetch } from "../provider-probe";
 import { authHeaders } from "../adapters/compatible-adapter";
 import {
   byokAuthHeaderShape,
@@ -263,7 +263,20 @@ export class ProviderProbingService {
       ...(preferences.maxOutputTokens === undefined
         ? {}
         : { maxOutputTokens: preferences.maxOutputTokens }),
-      ...(typeof adapter?.systemPrompt === "function"
+      // Freebuff's admission policy gate flags repeated identical probes as
+      // automated farming (`prompt_policy_refused` / "same message sent over
+      // and over"). Its probe must be minimal and always distinct per model —
+      // no worker system template, no shared identity question. `ping` is the
+      // same minimal greeting the fast-probe path already uses; the model id
+      // keeps every probe distinct so the "same message over and over" gate
+      // cannot flag a batch run.
+      ...(providerId === "freebuff"
+        ? {
+            defaultPromptOverride: `ping ${modelId}`,
+            providerSystemPrompt: undefined,
+          }
+        : {}),
+      ...(typeof adapter?.systemPrompt === "function" && providerId !== "freebuff"
         ? { providerSystemPrompt: adapter.systemPrompt() }
         : {}),
     });

package/src/providers/integrations/alibabacp/alibabacp-models.ts

@@ -19,8 +19,7 @@
  */
 import { defineModel } from "../../provider-model-definition";
 import type { ModelDefinition } from "../../provider-model-definition";
-
-export const ALIBABACP_PROVIDER_ID = "alibabacp" as const;
+import { ALIBABACP_PROVIDER_ID } from "./alibabacp";
 
 /** Chat path below the region's `/compatible-mode/v1` base. */
 const CHAT_ENDPOINT = "/chat/completions";

package/src/providers/integrations/{dashscope-models.ts → alibabacp/dashscope-models.ts}

@@ -17,8 +17,8 @@
  * does not publish yet arrives through the sync control instead of being
  * asserted ahead of the upstream.
  */
-import { defineModel } from "../provider-model-definition";
-import type { ModelDefinition } from "../provider-model-definition";
+import { defineModel } from "../../provider-model-definition";
+import type { ModelDefinition } from "../../provider-model-definition";
 
 export const DASHSCOPE_PROVIDER_ID = "dashscope" as const;
 

package/src/providers/integrations/antigravity/antigravity-protocol.ts

@@ -400,7 +400,11 @@ export function dropAntigravityUnsignedReasoning(
     if (message.role !== "assistant") return message;
     const content = message.content.filter((part) => {
       if (part.kind !== "reasoning") return true;
-      if (part.signature !== undefined) return true;
+      // A present-but-empty signature is still unsigned: upstream rejects a
+      // `thinking` part whose `signature` is missing *or* empty with
+      // `400 messages.N.content.0.thinking.signature: Field required`. Only a
+      // non-empty signature is a real one.
+      if (typeof part.signature === "string" && part.signature.length > 0) return true;
       changed = true;
       return false;
     });

package/src/providers/integrations/buddy/buddy-chat-shared.ts

@@ -21,6 +21,7 @@ import { createHash } from "node:crypto";
 import { completeRequiredSchema } from "../../../protocol/codecs";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { isRecord } from "../../../protocol/codecs";
+import { GatewayError } from "../../../protocol/gateway-error";
 import { applyDeepSeekReasoning, applyOpenAIReasoning, backfillDeepSeekReasoningContent, clampedEffortOutputFloor, ensureChatReasoningReplayPresence } from "../../../protocol/reasoning";
 import { BUDDY_CN_EFFORTS, BUDDY_INTL_EFFORTS, BUDDY_SHARED_RAW } from "./buddy-catalog-shared";
 // Imported for the CN roster only: a CN-only id has no row in the shared
@@ -55,6 +56,123 @@ function normalizedToolName(value: string, index: number, used: Set<string>): st
   return uniqueToolName(base || `tool_${index + 1}`, used);
 }
 
+/**
+ * Schema keywords whose values are schemas (recursed as schema objects).
+ * Mirrors the donor gateway's `upstream_compat._SCHEMA_MAPS/_ARRAYS/CHILDREN`.
+ */
+const RE2_SCHEMA_MAPS: ReadonlySet<string> = new Set([
+  "properties",
+  "patternProperties",
+  "$defs",
+  "definitions",
+  "dependentSchemas",
+  "dependencies",
+]);
+const RE2_SCHEMA_ARRAYS: ReadonlySet<string> = new Set([
+  "allOf",
+  "anyOf",
+  "oneOf",
+  "prefixItems",
+  "items",
+]);
+const RE2_SCHEMA_CHILDREN: ReadonlySet<string> = new Set([
+  "items",
+  "additionalItems",
+  "contains",
+  "unevaluatedItems",
+  "additionalProperties",
+  "unevaluatedProperties",
+  "propertyNames",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contentSchema",
+]);
+
+/**
+ * Removes unescaped backslashes before underscores in one regex pattern. The
+ * CodeBuddy upstream validates tool schemas with RE2, which does not support
+ * `\_` escapes — a client schema that serializes `\_` (a common JSON
+ * representation of a literal underscore) is rejected with a 400. The donor
+ * gateway normalizes this before dispatch; a backslash that escapes a
+ * backslash is preserved.
+ */
+function normalizeRe2Pattern(value: string): string {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if (char === "\\" && value[i + 1] === "\\") {
+      // Escaped backslash: keep the pair so a following `_` stays escaped.
+      out += "\\\\";
+      i += 1;
+      continue;
+    }
+    if (char === "\\" && value[i + 1] === "_") {
+      // `\_` — the upstream's RE2 rejects it; drop the backslash.
+      out += "_";
+      i += 1;
+      continue;
+    }
+    out += char;
+  }
+  return out;
+}
+
+/** Normalizes RE2-incompatible underscore escapes in schema pattern positions. */
+function normalizeRe2SchemaPatterns(schema: unknown): void {
+  if (!isRecord(schema)) return;
+  const pattern = schema["pattern"];
+  if (typeof pattern === "string") schema["pattern"] = normalizeRe2Pattern(pattern);
+  const patternProperties = schema["patternProperties"];
+  if (isRecord(patternProperties)) {
+    const normalized: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(patternProperties)) {
+      const key2 = normalizeRe2Pattern(key);
+      if (key2 in normalized) {
+        normalized[key2] = { allOf: [normalized[key2], value] };
+      } else {
+        normalized[key2] = value;
+      }
+    }
+    schema["patternProperties"] = normalized;
+  }
+  for (const key of RE2_SCHEMA_MAPS) {
+    const map = schema[key];
+    if (!isRecord(map)) continue;
+    for (const child of Object.values(map)) normalizeRe2SchemaPatterns(child);
+  }
+  for (const key of RE2_SCHEMA_ARRAYS) {
+    const list = schema[key];
+    if (!Array.isArray(list)) continue;
+    for (const child of list) normalizeRe2SchemaPatterns(child);
+  }
+  for (const key of RE2_SCHEMA_CHILDREN) {
+    normalizeRe2SchemaPatterns(schema[key]);
+  }
+}
+
+/** JSON-serializes a value to cheaply detect a backslash-before-underscore. */
+function hasUnderscoreEscape(value: unknown): boolean {
+  try {
+    return JSON.stringify(value).includes("\\_");
+  } catch {
+    return true;
+  }
+}
+
+/** Returns the declaration with RE2-safe schema patterns, or the same object. */
+function normalizeRe2Declaration(declaration: Record<string, unknown>): Record<string, unknown> {
+  const parameters = declaration["parameters"];
+  if (!hasUnderscoreEscape(parameters)) return declaration;
+  // Deep-copy only when a rewrite is needed; the shared object must not be
+  // mutated for every dispatch.
+  const out: Record<string, unknown> = { ...declaration };
+  out["parameters"] = structuredClone(parameters);
+  normalizeRe2SchemaPatterns(out["parameters"]);
+  return out;
+}
+
 /**
  * Buddy's Chat Completions wire has no `web_search_preview` hosted tool; its
  * search is an ordinary function named `web_search` with a `{query}` schema.
@@ -102,29 +220,28 @@ export function normalizeBuddyToolNames(payload: Record<string, unknown>): void
     const name = normalizedToolName(sourceName, index, used);
     used.add(name);
     if (!replacements.has(sourceName)) replacements.set(sourceName, name);
-    if (fn !== undefined)
-      return {
-        ...rawTool,
-        function: {
-          ...fn,
-          name,
-          ...(fn["parameters"] === undefined ? {} : { parameters: completeRequiredSchema(fn["parameters"]) }),
-        },
+    if (fn !== undefined) {
+      const fnOut = {
+        ...fn,
+        name,
+        ...(fn["parameters"] === undefined ? {} : { parameters: completeRequiredSchema(fn["parameters"]) }),
       };
-    if (custom !== undefined)
-      return {
-        ...rawTool,
-        custom: {
-          ...custom,
-          name,
-          ...(custom["format"] === undefined ? {} : { format: completeRequiredSchema(custom["format"]) }),
-        },
+      return normalizeRe2Declaration(fnOut);
+    }
+    if (custom !== undefined) {
+      const customOut = {
+        ...custom,
+        name,
+        ...(custom["format"] === undefined ? {} : { format: completeRequiredSchema(custom["format"]) }),
       };
-    return {
+      return { ...rawTool, custom: normalizeRe2Declaration(customOut) };
+    }
+    const bareOut = {
       ...rawTool,
       name,
       ...(rawTool["parameters"] === undefined ? {} : { parameters: completeRequiredSchema(rawTool["parameters"]) }),
     };
+    return normalizeRe2Declaration(bareOut);
   });
   const messages = payload["messages"];
   if (Array.isArray(messages)) {
@@ -138,6 +255,13 @@ export function normalizeBuddyToolNames(payload: Record<string, unknown>): void
       }
     }
   }
+  const responseFormat = payload["response_format"];
+  if (isRecord(responseFormat) && hasUnderscoreEscape(responseFormat)) {
+    const copied = structuredClone(responseFormat) as Record<string, unknown>;
+    const jsonSchema = copied["json_schema"];
+    if (isRecord(jsonSchema)) normalizeRe2SchemaPatterns(jsonSchema["schema"]);
+    payload["response_format"] = copied;
+  }
   const choice = payload["tool_choice"];
   if (!isRecord(choice)) return;
   if (choice["type"] === "allowed_tools" && Array.isArray(choice["tools"])) {
@@ -477,6 +601,10 @@ export function buddyPrePayloadCommon(
   normalizeBuddyImageUrl(payload);
   // developer role → system (buddy whitelist rejects developer, 11128)
   normalizeBuddyRoles(payload);
+  // Validate the *caller's* thinking controls before the DeepSeek contract may
+  // inject its own `thinking` (an injected `{type:"enabled"}` has no budget and
+  // must not be rejected as a malformed client shape).
+  validateBuddyThinking(payload);
   applyOpenAIReasoning(payload, request);
   applyDeepSeekReasoning(payload);
   // sol family defaults to high reasoning like reference thinking.go defaultDeepSeekEffort — sol without effort gets 500/invoke error otherwise
@@ -516,6 +644,34 @@ export function buddyPrePayloadCommon(
   delete payload["agent_prompt"];
 }
 
+/**
+ * Validates the reasoning controls the CodeBuddy Chat wire accepts, mirroring
+ * the donor gateway's `map_reasoning_controls`. The upstream rejects the whole
+ * request for shapes it does not model, so a client that sends an unsupported
+ * `thinking` shape is failed here with a 400 that names the field — instead of
+ * an opaque upstream error.
+ */
+function validateBuddyThinking(payload: Record<string, unknown>): void {
+  const thinking = isRecord(payload["thinking"]) ? payload["thinking"] : undefined;
+  if (thinking === undefined) return;
+  const mode = typeof thinking["type"] === "string" ? (thinking["type"] as string) : "";
+  if (mode !== "enabled" && mode !== "adaptive" && mode !== "disabled") {
+    throw new GatewayError("invalid_request", 400, `CodeBuddy thinking.type must be enabled, adaptive or disabled (got ${JSON.stringify(mode)}) (request {requestId}). Check the shape of what you sent — then resend 🪞`);
+  }
+  if (mode === "enabled") {
+    const budget = thinking["budget_tokens"];
+    if (typeof budget !== "number" || !Number.isInteger(budget) || budget < 1024) {
+      throw new GatewayError("invalid_request", 400, "CodeBuddy thinking.budget_tokens must be an integer >= 1024 (request {requestId}). Check the shape of what you sent — then resend 🪞");
+    }
+  } else if (thinking["budget_tokens"] !== undefined) {
+    throw new GatewayError("invalid_request", 400, "CodeBuddy thinking.budget_tokens requires thinking.type=enabled (request {requestId}). Check the shape of what you sent — then resend 🪞");
+  }
+  const display = thinking["display"];
+  if (display !== undefined && display !== null && display !== "summarized") {
+    throw new GatewayError("invalid_request", 400, "CodeBuddy thinking.display supports only summarized (request {requestId}). Check the shape of what you sent — then resend 🪞");
+  }
+}
+
 function injectSolReasoningDefault(payload: Record<string, unknown>): void {
   const model = typeof payload["model"] === "string" ? (payload["model"] as string) : "";
   const isSol = model.toLowerCase().includes("sol");