cartethyia 2.7.9 → 2.8.0

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -167,6 +167,14 @@ export function materializeBuddyDeviceBinding(
  * the operator pinned them in `auth_state` (there is no reliable source to
  * invent them from). An opaque API key carries no uid and yields nothing.
  */
+/** A short printable identity claim from a JWT payload, or `undefined`. */
+function identityClaim(claims: Record<string, unknown> | undefined, name: string): string | undefined {
+  if (claims === undefined) return undefined;
+  const value = claims[name];
+  if (typeof value === "string" && value.trim().length > 0 && value.trim().length <= 128) return value.trim();
+  return undefined;
+}
+
 export function buddyOAuthIdentityHeaders(
   context?: ProviderDispatchContext,
 ): Record<string, string> {
@@ -175,15 +183,20 @@ export function buddyOAuthIdentityHeaders(
   const uid = buddyAccountUid(token) ?? context?.credential.account_id ?? "";
   if (uid.length === 0) return {};
   const enterpriseId = buddyEnterprise(context);
+  // The reference gateway reads `id_source` / `token_source` from the JWT
+  // payload and the account record, not from stored auth state — an account
+  // authorized before either was persisted still carries them on the wire.
+  // Precedence matches the donor (`client_profiles._identity_claim_headers`):
+  // account fields first, then JWT claims, then legacy `auth_state`.
+  const claims = token.length > 0 ? decodeJwtPayload(token) : undefined;
   const state = context?.credential.auth_state;
   const idSource =
-    typeof state?.["idSource"] === "string" && (state["idSource"] as string).trim().length > 0
-      ? (state["idSource"] as string).trim()
-      : undefined;
+    identityClaim(claims, "id_source") ??
+    identityClaim(claims, "idSource") ??
+    identityClaim(state as Record<string, unknown> | undefined, "idSource");
   const method =
-    typeof state?.["authMethod"] === "string" && (state["authMethod"] as string).trim().length > 0
-      ? (state["authMethod"] as string).trim()
-      : undefined;
+    identityClaim(claims, "token_source") ??
+    identityClaim(state as Record<string, unknown> | undefined, "authMethod");
   const headers: Record<string, string> = { "X-User-Id": uid };
   if (method !== undefined) headers["X-Auth-Method"] = method;
   if (idSource !== undefined) headers["X-Id-Source"] = idSource;

package/src/providers/integrations/buddy/capabilities.ts

@@ -1,8 +1,8 @@
 // dynamic-import-ok: lazy per-realm capability map. Each buddy regional
 // product (cb/cbcn) imports its adapter + oauth + discovery on first use so a
 // deployment that only serves one realm never drags the others into memory.
-import type { ProviderModuleCapabilities } from "../../provider-capabilities";
-import { oauthCapability, quotaCapability } from "../../provider-capabilities";
+import type { ProviderModuleCapabilities } from "../../provider-registry";
+import { oauthCapability, quotaCapability } from "../../provider-registry";
 
 type BuddyProviderId = "cb" | "cbcn";
 

package/src/providers/integrations/buddy/codebuddy/cn-provider.ts

@@ -168,6 +168,9 @@ export function createCodeBuddyCnAdapter(fetchImpl?: typeof fetch): ProviderAdap
       baseUrl: CODEBUDDY_CN_BASE_URL,
       variant: "CLI",
       prePayload: codeBuddyCnPrePayload,
+      // The CN CLI profile gzips the chat body (donor behavior). The console
+      // channel fallback is an intl-only recovery; CN has no second endpoint.
+      requestCompression: "gzip",
       ...(fetchImpl ? { fetchImpl } : {}),
     }),
     {

package/src/providers/integrations/buddy/codebuddy/provider.ts

@@ -160,6 +160,10 @@ export function createCodeBuddyAdapter(fetchImpl?: typeof fetch): ProviderAdapte
       variant: "IDE",
       cliIdentity: true,
       prePayload: codeBuddyIntlPrePayload,
+      // The intl CLI profile gzips the chat body and recovers a channel-check
+      // 400 by retrying once on the console chat endpoint (donor behavior).
+      requestCompression: "gzip",
+      channelFallbackPath: "/console/chat/completions",
       ...(fetchImpl ? { fetchImpl } : {}),
     }),
     {

package/src/providers/integrations/buddy/codebuddy/shared.ts

@@ -87,7 +87,7 @@ export async function codebuddyHeaders(
     };
   }
   const purpose = buddyAgentPurpose(context, request);
-  return {
+  const headers: Record<string, string> = {
     accept: "text/event-stream",
     "User-Agent": ua,
     "X-Product": "SaaS",
@@ -100,28 +100,29 @@ export async function codebuddyHeaders(
     "X-Domain": codebuddyDomain(variant),
     "x-requested-with": "XMLHttpRequest",
     "x-codebuddy-request": "1",
-    // The effective agent purpose, matching the reference's dynamic value.
-    // The reference does not invent `conversation`; it sends the purpose only
-    // when one exists.
-    ...(purpose === undefined ? {} : { "X-Agent-Purpose": purpose }),
-    // The upstream's channel check reads the turn-level aggregation key, and a
-    // chat request without it is refused for a missing conversation id.
-    ...conversation,
-    // Per-account device binding (qimei36) — distinct device per account.
-    ...(() => {
-      const binding = resolveBuddyDeviceBinding(context);
-      return binding === undefined ? {} : { "X-Device-Id-List": JSON.stringify({ qimei36: binding }) };
-    })(),
-    // The desktop client sends the device-token pair on both realms. Captured
-    // token (auth_state / device-token file) when present, otherwise the
-    // official failure placeholder. (CLI branch above already returned without
-    // device headers.)
-    ...(await buddyDeviceTokenHeaders({
-      realm: identity === "IDE" ? "intl" : "cn",
-      context,
-      cliIdentity,
-    })),
   };
+  // The effective agent purpose, matching the reference's dynamic value.
+  // The reference does not invent `conversation`; it sends the purpose only
+  // when one exists.
+  if (purpose !== undefined) headers["X-Agent-Purpose"] = purpose;
+  // The upstream's channel check reads the turn-level aggregation key, and a
+  // chat request without it is refused for a missing conversation id.
+  Object.assign(headers, conversation);
+  // Per-account device binding (qimei36) — distinct device per account.
+  const binding = resolveBuddyDeviceBinding(context);
+  if (binding !== undefined) {
+    headers["X-Device-Id-List"] = JSON.stringify({ qimei36: binding });
+  }
+  // The desktop client sends the device-token pair on both realms. Captured
+  // token (auth_state / device-token file) when present, otherwise the
+  // official failure placeholder. (CLI branch above already returned without
+  // device headers.)
+  Object.assign(headers, await buddyDeviceTokenHeaders({
+    realm: identity === "IDE" ? "intl" : "cn",
+    context,
+    cliIdentity,
+  }));
+  return headers;
 }
 
 /**
@@ -140,6 +141,14 @@ export function codebuddyAdapterConfig(args: {
   ) => void;
   fetchImpl?: typeof fetch;
   cliIdentity?: boolean;
+  /**
+   * Body compression for chat dispatches. The CodeBuddy CLI contract (donor
+   * `codebuddy2api`) gzips the JSON body for the CLI profiles and sends
+   * `Accept-Encoding: identity`. `"json"` (default) keeps plain JSON.
+   */
+  requestCompression?: "json" | "gzip";
+  /** When set, retry a channel-check 400 against this path (console fallback). */
+  channelFallbackPath?: string;
 }): OpenAICompatibleAdapterConfig {
   return withBearerAuthentication({
     provider_id: args.providerId,
@@ -147,6 +156,12 @@ export function codebuddyAdapterConfig(args: {
     buildExtraHeaders: (context, request) =>
       codebuddyHeaders(args.variant, context, request, args.cliIdentity),
     prePayload: args.prePayload,
+    ...(args.requestCompression === undefined
+      ? {}
+      : { request_compression: args.requestCompression }),
+    ...(args.channelFallbackPath === undefined
+      ? {}
+      : { channel_fallback_path: args.channelFallbackPath }),
     ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
   });
 }

package/src/providers/integrations/claude/claude-quota.ts

@@ -102,9 +102,13 @@ export async function fetchClaudeQuota(
   credential: string,
   fetcher: FetchLike,
 ): Promise<ProviderQuotaResult> {
+  // No module-local quota cache: the shared two-tier quota cache owns
+  // cross-call dedup, and a local tier keyed by credential only is never
+  // invalidated by `debitCachedQuota`, so a sweep within its TTL could
+  // resurrect a spent balance over the shared cache. Every call here is a
+  // fresh upstream read; the shared cache's in-flight dedup prevents
+  // duplicate traffic.
   const key = sha256Hex(credential);
-  const cached = quotaCache.get(key);
-  if (cached !== undefined) return cached;
   if (quotaCooldown.get(key) !== undefined) {
     throw new Error("Quota endpoint rejected request: rate limited (cooled down)");
   }
@@ -131,9 +135,7 @@ export async function fetchClaudeQuota(
       },
       observing,
     );
-    const result = parseClaudeQuota(body);
-    quotaCache.set(key, result);
-    return result;
+    return parseClaudeQuota(body);
   } catch (error: unknown) {
     // Hammering the usage endpoint on every call is its own rate-limit
     // risk: back off briefly after a 429 instead of retrying into it.
@@ -143,21 +145,16 @@ export async function fetchClaudeQuota(
 }
 
 /**
- * Bounded per-credential quota cache (5 min) plus a short 429 cooldown
- * (3 min). Keys are credential hashes, never raw secrets; both caches are
+ * Short 429 cooldown (3 min). Keys are credential hashes, never raw secrets;
  * capped so credential fan-out cannot pin memory.
+ *
+ * The cooldown is an absolute window (`until = now + QUOTA_COOLDOWN_MS`), not a
+ * TTL from read time, so it is a sentinel whose own TTL *is* that window: the
+ * entry lives for exactly the cooldown and is gone the moment it closes.
  */
-const QUOTA_CACHE_TTL_MS = 5 * 60_000;
 const QUOTA_COOLDOWN_MS = 3 * 60_000;
-const QUOTA_CACHE_MAX_ENTRIES = 256;
-const quotaCache = new TtlCache<ProviderQuotaResult>({
-  ttlMs: QUOTA_CACHE_TTL_MS,
-  maxEntries: QUOTA_CACHE_MAX_ENTRIES,
-});
-// The cooldown is an absolute window (`until = now + QUOTA_COOLDOWN_MS`), not a
-// TTL from read time, so it is a sentinel whose own TTL *is* that window: the
-// entry lives for exactly the cooldown and is gone the moment it closes.
+const QUOTA_COOLDOWN_MAX_ENTRIES = 256;
 const quotaCooldown = new TtlCache<true>({
   ttlMs: QUOTA_COOLDOWN_MS,
-  maxEntries: QUOTA_CACHE_MAX_ENTRIES,
+  maxEntries: QUOTA_COOLDOWN_MAX_ENTRIES,
 });

package/src/providers/integrations/cline/cline.ts

@@ -1,12 +1,12 @@
 import { createApiKeyAdapter } from "../../configured-provider";
 import type { ProviderDispatchTarget, ProviderAdapter, ProviderDispatchContext } from "../../provider-contracts";
 import type { ModelDefinition } from "../../provider-model-definition";
-import { unwrapProviderToken } from "../../provider-credential-envelope";
+import { unwrapProviderToken } from "../../provider-credentials";
 import { GatewayError } from "../../../protocol/gateway-error";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { completeRequiredSchema, isRecord } from "../../../protocol/codecs";
 import { providerBaseUrl } from "../../provider-metadata";
-import { getCachedModelDiscovery } from "../../operations/model-discovery-cache";
+import { getCachedModelDiscovery } from "../../operations/provider-caches";
 import { defineModel } from "../../provider-model-definition";
 import { clineReasoningReplayPrepares } from "../buddy/buddy-chat-shared";
 import { clinePlatform, clinePlatformVersion } from "../../operations/cli-platform";

package/src/providers/integrations/commandcode/quota.ts

@@ -15,6 +15,8 @@
  * independent: retain the balance or subscription when the other is unavailable.
  */
 import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../quota/quota-contracts";
+import { isoDate } from "../../quota/quota-contracts";
+import { asCoercedNumber, asRecord } from "../../../shared/coerce";
 
 const COMMANDCODE_API_BASE = "https://api.commandcode.ai" as const;
 const REQUEST_TIMEOUT_MS = 15_000;
@@ -73,29 +75,21 @@ async function readJson(
   }
 }
 
-function recordValue(value: unknown): Record<string, unknown> | undefined {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : undefined;
-}
-
+/** Numeric value coerced via the shared helper, or `null` (shared sentinel). */
 function numberOrNull(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value === "string" && value.trim() && Number.isFinite(Number(value))) {
-    return Number(value);
-  }
-  return null;
+  return asCoercedNumber(value) ?? null;
 }
 
+/**
+ * ISO timestamp from a numeric epoch (seconds vs ms via the 1e12 boundary) or
+ * a parseable date string, else `null` — the shared `isoDate` semantics. The
+ * one local delta kept: a non-positive numeric is `null` (no deadline) rather
+ * than an epoch 0/negative instant.
+ */
 function isoTimestamp(value: unknown): string | null {
   const numeric = numberOrNull(value);
-  if (numeric !== null) {
-    if (numeric <= 0) return null;
-    const date = new Date(numeric > 1_000_000_000_000 ? numeric : numeric * 1000);
-    return Number.isFinite(date.getTime()) ? date.toISOString() : null;
-  }
-  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) return null;
-  return new Date(value).toISOString();
+  if (numeric !== null && numeric <= 0) return null;
+  return isoDate(value);
 }
 
 function withQuery(path: string, params: Readonly<Record<string, string | null>>): string {
@@ -149,8 +143,8 @@ function windowLimits(
   limits: Record<string, unknown>,
 ): readonly ProviderQuotaWindow[] {
   const out: ProviderQuotaWindow[] = [];
-  const fiveHour = recordValue(limits["fiveHour"]);
-  const weekly = recordValue(limits["weekly"]);
+  const fiveHour = asRecord(limits["fiveHour"]);
+  const weekly = asRecord(limits["weekly"]);
   const push = (source: Record<string, unknown> | undefined, kind: string, label: string) => {
     if (source === undefined) return;
     const used = numberOrNull(source["used"]) ?? 0;
@@ -191,9 +185,9 @@ export async function fetchCommandCodeQuota(
     };
   }
 
-  const whoamiBody = whoami.ok ? recordValue(whoami.value) : undefined;
-  const user = recordValue(whoamiBody?.["user"]);
-  const organization = recordValue(whoamiBody?.["org"]);
+  const whoamiBody = whoami.ok ? asRecord(whoami.value) : undefined;
+  const user = asRecord(whoamiBody?.["user"]);
+  const organization = asRecord(whoamiBody?.["org"]);
   const orgId = typeof organization?.["id"] === "string" ? organization["id"] : null;
   const accountLabel =
     (typeof user?.["email"] === "string" && user["email"]) ||
@@ -215,8 +209,8 @@ export async function fetchCommandCodeQuota(
     };
   }
 
-  const subscriptionBody = subscriptionRaw.ok ? recordValue(subscriptionRaw.value) : undefined;
-  const planRecord = recordValue(subscriptionBody?.["data"]);
+  const subscriptionBody = subscriptionRaw.ok ? asRecord(subscriptionRaw.value) : undefined;
+  const planRecord = asRecord(subscriptionBody?.["data"]);
   const planId = typeof planRecord?.["planId"] === "string" ? planRecord["planId"] : null;
   const parsedPlan = planId === null ? null : commandCodePlan(planId);
   const plan =
@@ -225,12 +219,12 @@ export async function fetchCommandCodeQuota(
     (creditsRaw.ok ? "Credits" : null);
   const periodEnd = isoTimestamp(planRecord?.["currentPeriodEnd"]);
 
-  const creditsBody = creditsRaw.ok ? recordValue(creditsRaw.value) : undefined;
+  const creditsBody = creditsRaw.ok ? asRecord(creditsRaw.value) : undefined;
   const windows: ProviderQuotaWindow[] = [];
   if (creditsBody !== undefined) {
-    const credits = recordValue(creditsBody["credits"]);
+    const credits = asRecord(creditsBody["credits"]);
     if (credits !== undefined) windows.push(...creditWindows(credits, parsedPlan?.cap ?? null, periodEnd));
-    const limits = recordValue(creditsBody["windowLimits"]);
+    const limits = asRecord(creditsBody["windowLimits"]);
     if (limits !== undefined) windows.push(...windowLimits(limits));
   }
 

package/src/providers/integrations/cursor/cursor-auth.ts

@@ -41,7 +41,6 @@ import {
   CURSOR_WEBSITE_URL,
   SESSION_REFRESH_TIMEOUT_MS,
   SIGN_IN_POLICY_VIOLATION,
-  TOKEN_EXPIRY_THRESHOLD_S,
   isExchangeableApiKey,
 } from "./cursor-shared";
 
@@ -92,13 +91,6 @@ export function decodeJwtExpiryMs(token: string): number | undefined {
   return exp * 1000;
 }
 
-/** True when a JWT expires within the refresh threshold. */
-export function isExpiringSoon(token: string, thresholdSeconds = TOKEN_EXPIRY_THRESHOLD_S): boolean {
-  const expiry = decodeJwtExpiryMs(token);
-  if (expiry === undefined) return false;
-  return expiry - Date.now() < thresholdSeconds * 1000;
-}
-
 /**
  * The account identity Cursor itself asserts, from the access token's `sub`.
  *

package/src/providers/integrations/cursor/cursor-exec.ts

@@ -389,15 +389,22 @@ function globFiles(args: Record<string, unknown>, root: string): Record<string,
   return { files: out };
 }
 
-/** Minimal glob matcher: `*` (within a segment), `**` (any depth), `?`. */
+/**
+ * Minimal glob matcher: `*` (within a segment), `**` (any depth), `?`.
+ * The value is normalized to forward slashes first, so a Windows `\` path
+ * matches exactly like a POSIX `/` path — otherwise `*.ts` matches
+ * `src\a.ts` on Windows but not `src/a.ts`, and the same pattern behaves
+ * differently depending on which separator `relative()` happened to emit.
+ */
 function simpleGlobMatch(pattern: string, value: string): boolean {
+  const normalized = value.replace(/\\/g, "/");
   const re = pattern
     .replace(/[.+^${}()|[\]\\]/g, "\\$&")
     .replace(/\*\*/g, "__GLOBSTAR__")
     .replace(/\*/g, "[^/]*")
     .replace(/__GLOBSTAR__/g, ".*")
     .replace(/\?/g, ".");
-  return new RegExp(`^${re}$`).test(value);
+  return new RegExp(`^${re}$`).test(normalized);
 }
 
 function grepFiles(args: Record<string, unknown>, root: string, pi: boolean): Record<string, unknown> {

package/src/providers/integrations/cursor/cursor-request.ts

@@ -219,7 +219,9 @@ export function systemPromptFrom(request: CanonicalRequest): string | undefined
  */
 export function historyFromRequest(request: CanonicalRequest): CursorHistoryEntry[] {
   const entries: CursorHistoryEntry[] = [];
-  for (const message of request.messages) {
+  const liveIndex = lastLiveUserMessageIndex(request);
+  for (const [index, message] of request.messages.entries()) {
+    if (index === liveIndex) continue;
     const text = messageText(message);
     if (text.trim().length === 0) continue;
     if (message.role === "assistant") entries.push({ role: "assistant", content: text });
@@ -235,9 +237,6 @@ export function buildRunRequest(input: {
   readonly text: string;
   readonly modelId: string;
   readonly conversationId: string;
-  /** Stable parent group; unlike the conversation id it survives a rebase. */
-  readonly conversationGroupId?: string;
-  readonly runId?: string;
   readonly messageId?: string;
   readonly history?: readonly CursorHistoryEntry[];
   /** Cursor-declared parameter tuple (effort/context/fast) for this model. */
@@ -277,12 +276,17 @@ export function buildRunRequest(input: {
   userMessageAction["request_context"] = requestContext;
   const runRequest: Record<string, unknown> = {
     conversation_id: input.conversationId,
-    conversation_group_id: input.conversationGroupId ?? input.conversationId,
-    run_id: input.runId ?? messageId,
     action:
       input.action === "resume"
         ? { resume_action: { request_context: requestContext } }
         : { user_message_action: userMessageAction },
+    // `model_details` (#3) carries the safe wire id; `requested_model` (#9)
+    // carries the parameter tuple. Matches `agent.proto` exactly — the old
+    // schema invented extra fields that have no wire meaning.
+    model_details: {
+      model_id: input.modelId,
+      max_mode: input.maxMode ?? false,
+    },
     requested_model: {
       model_id: input.modelId,
       max_mode: input.maxMode ?? false,
@@ -290,8 +294,6 @@ export function buildRunRequest(input: {
     },
     conversation_state: seeded ? buildSeedConversationState() : input.conversationState,
     mcp_tools: { mcp_tools: [] },
-    unknown_flag: 0,
-    field_12: 0,
   };
   return encodeMessage("AgentClientMessage", { run_request: runRequest });
 }
@@ -309,9 +311,12 @@ export function buildExecStreamClose(execId: number, execIdString?: string): Uin
 }
 
 /** Stops the live Run, as Cursor CLI does before closing the stream. */
-export function buildCancelAction(reason: string): Uint8Array {
+export function buildCancelAction(_reason: string): Uint8Array {
+  // `agent.proto` CancelAction is empty — the oneof presence is the signal,
+  // and the reason travels out-of-band (stream close). Sending a `reason`
+  // field would encode bytes the server does not expect.
   return encodeMessage("AgentClientMessage", {
-    conversation_action: { cancel_action: { reason } },
+    conversation_action: { cancel_action: {} },
   });
 }
 
@@ -530,12 +535,21 @@ function toolResultText(part: Extract<ContentPart, { kind: "toolResult" }>): str
  * only the current prompt.
  */
 export function liveUserText(request: CanonicalRequest): string {
+  const index = lastLiveUserMessageIndex(request);
+  if (index === -1) return "";
+  const message = request.messages[index];
+  if (message === undefined) return "";
+  return messageText(message);
+}
+
+/** Index of the current user/tool turn Cursor should send as the live prompt. */
+function lastLiveUserMessageIndex(request: CanonicalRequest): number {
   for (let index = request.messages.length - 1; index >= 0; index -= 1) {
     const message = request.messages[index];
     if (message === undefined) continue;
     if (message.role !== "user" && message.role !== "tool") continue;
     const text = messageText(message);
-    if (text.trim().length > 0) return text;
+    if (text.trim().length > 0) return index;
   }
-  return "";
+  return -1;
 }

package/src/providers/integrations/cursor/cursor-shared.ts

@@ -83,11 +83,14 @@ export const SESSION_REFRESH_TIMEOUT_MS = 20_000;
 
 /**
  * How long a live Cursor Run is held open waiting for the client's next
- * tool-result request. Matches the donor's continuation default: a tool round
- * the client never answers must not hold an HTTP/2 stream, an account lease, or
- * a pool slot for the life of the process.
+ * tool-result request. Matches the donor's relay hold (`CURSOR_RELAY_IDLE_
+ * TIMEOUT_MS` in oh-my-pi: 30 minutes): a tool round the client never answers
+ * must not hold an HTTP/2 stream, an account lease, or a pool slot for the life
+ * of the process, but a human-approved tool round often takes longer than ten
+ * minutes — a shorter TTL expired the Run mid-approval and forced the client to
+ * resend the whole conversation.
  */
-export const RUN_IDLE_TTL_MS = 10 * 60_000;
+export const RUN_IDLE_TTL_MS = 30 * 60_000;
 
 /**
  * Any HTTPS subdomain of `cursor.sh` is an acceptable Run host: the region