cartethyia 2.7.9 → 2.8.1

package/src/providers/configured-provider.ts

@@ -3,6 +3,7 @@ import type { CanonicalRequest, WireFamily } from "../protocol/canonical-model";
 import { GatewayError } from "../protocol/gateway-error";
 import { OpenAICompatibleAdapter, withBearerAuthentication } from "./adapters/compatible-adapter";
 import { providerBaseUrl } from "./provider-metadata";
+import type { ProviderModule } from "./provider-registry";
 
 export function ensurePayloadModel(
   payload: Record<string, unknown>,
@@ -15,6 +16,7 @@ export function ensurePayloadModel(
   payload["model"] = model;
   return model;
 }
+
 /**
  * Declarative description of one bearer-authenticated OpenAI-compatible provider.
  *
@@ -98,3 +100,149 @@ export function createApiKeyAdapter(
     }),
   );
 }
+
+function apiKeySpec(
+  providerId: ProviderId,
+  paths: Readonly<Partial<Record<"chat" | "responses", string>>>,
+): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId,
+    endpoint_paths_by_wire_family: paths,
+  };
+}
+
+const BEARER_PATHS = { chat: "/chat/completions", responses: "/responses" } as const;
+
+/**
+ * Builtin providers whose entire adapter contract is "bearer auth against the
+ * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
+ * responses, with endpoint paths declared below the base's version root".
+ */
+export const GENERIC_API_KEY_SPECS = {
+  larprouter: apiKeySpec("larprouter", BEARER_PATHS),
+  mistral: apiKeySpec("mistral", BEARER_PATHS),
+  fireworks: apiKeySpec("fireworks", BEARER_PATHS),
+  nvidia: apiKeySpec("nvidia", BEARER_PATHS),
+  gmi: apiKeySpec("gmi", BEARER_PATHS),
+  ollamacloud: apiKeySpec("ollamacloud", BEARER_PATHS),
+  together: apiKeySpec("together", BEARER_PATHS),
+  siliconflow: apiKeySpec("siliconflow", BEARER_PATHS),
+  siliconflowcn: apiKeySpec("siliconflowcn", BEARER_PATHS),
+  nanogpt: apiKeySpec("nanogpt", BEARER_PATHS),
+  baseten: apiKeySpec("baseten", BEARER_PATHS),
+  synthetic: apiKeySpec("synthetic", BEARER_PATHS),
+  stepfun: apiKeySpec("stepfun", BEARER_PATHS),
+  sakana: apiKeySpec("sakana", BEARER_PATHS),
+  helmcode: apiKeySpec("helmcode", BEARER_PATHS),
+  coralbricks: apiKeySpec("coralbricks", BEARER_PATHS),
+  aiand: apiKeySpec("aiand", BEARER_PATHS),
+  wafer: apiKeySpec("wafer", BEARER_PATHS),
+  coreweave: apiKeySpec("coreweave", BEARER_PATHS),
+  dashscope: apiKeySpec("dashscope", BEARER_PATHS),
+  "qwen-portal": apiKeySpec("qwen-portal", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+export type GenericApiKeyProviderId = keyof typeof GENERIC_API_KEY_SPECS;
+
+export const GENERIC_API_KEY_PROVIDER_IDS = Object.keys(
+  GENERIC_API_KEY_SPECS,
+) as readonly GenericApiKeyProviderId[];
+
+/**
+ * Ids whose base URL already ends at a version segment.
+ */
+export const VERSIONED_ROOT_API_KEY_SPECS = {
+  groq: apiKeySpec("groq", BEARER_PATHS),
+  deepinfra: apiKeySpec("deepinfra", BEARER_PATHS),
+  novita: apiKeySpec("novita", BEARER_PATHS),
+  venice: apiKeySpec("venice", BEARER_PATHS),
+  qianfan: apiKeySpec("qianfan", BEARER_PATHS),
+  zhipucoding: apiKeySpec("zhipucoding", BEARER_PATHS),
+  firepass: apiKeySpec("firepass", BEARER_PATHS),
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+export type VersionedRootApiKeyProviderId =
+  keyof typeof VERSIONED_ROOT_API_KEY_SPECS;
+
+export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = Object.keys(
+  VERSIONED_ROOT_API_KEY_SPECS,
+) as readonly VersionedRootApiKeyProviderId[];
+
+type DiscoveryBackedCapabilities = Pick<
+  ProviderModule,
+  "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
+>;
+
+type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
+export type OpenAIModelDiscoveryFactory = (
+  providerId: string,
+  options?: {
+    readonly headers?: (credential: string) => Readonly<Record<string, string>>;
+  },
+) => ModelDiscoveryFactory;
+
+const DISCOVERY_BACKED_PROVIDER_SPECS = {
+  groq: VERSIONED_ROOT_API_KEY_SPECS.groq,
+  larprouter: GENERIC_API_KEY_SPECS.larprouter,
+  together: GENERIC_API_KEY_SPECS.together,
+  deepinfra: VERSIONED_ROOT_API_KEY_SPECS.deepinfra,
+  siliconflow: GENERIC_API_KEY_SPECS.siliconflow,
+  siliconflowcn: GENERIC_API_KEY_SPECS.siliconflowcn,
+  novita: VERSIONED_ROOT_API_KEY_SPECS.novita,
+  venice: VERSIONED_ROOT_API_KEY_SPECS.venice,
+  nanogpt: GENERIC_API_KEY_SPECS.nanogpt,
+  baseten: GENERIC_API_KEY_SPECS.baseten,
+  synthetic: GENERIC_API_KEY_SPECS.synthetic,
+  stepfun: GENERIC_API_KEY_SPECS.stepfun,
+  sakana: GENERIC_API_KEY_SPECS.sakana,
+  helmcode: GENERIC_API_KEY_SPECS.helmcode,
+  coralbricks: GENERIC_API_KEY_SPECS.coralbricks,
+  aiand: GENERIC_API_KEY_SPECS.aiand,
+  wafer: GENERIC_API_KEY_SPECS.wafer,
+  firepass: VERSIONED_ROOT_API_KEY_SPECS.firepass,
+  zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
+  dashscope: GENERIC_API_KEY_SPECS.dashscope,
+  qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
+} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
+
+type DiscoveryBackedProviderId = keyof typeof DISCOVERY_BACKED_PROVIDER_SPECS;
+
+/** Canonical discovery-backed provider ids, in declaration order. */
+export const DISCOVERY_BACKED_PROVIDER_IDS = Object.keys(
+  DISCOVERY_BACKED_PROVIDER_SPECS,
+) as readonly DiscoveryBackedProviderId[];
+
+export function discoveryBackedCapabilities(
+  providerId: string,
+  spec: ApiKeyProviderSpec,
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): DiscoveryBackedCapabilities {
+  return {
+    ...(spec.endpoint_paths_by_wire_family === undefined
+      ? {}
+      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
+    loadAdapter: async () => createApiKeyAdapter(spec),
+    loadModelDiscovery: openAIModelDiscovery(providerId, {
+      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
+    }),
+  };
+}
+
+/**
+ * Creates the standard provider capability table using the registry's shared
+ * discovery loader, keeping its lazy import and authentication behavior intact.
+ */
+export function createDiscoveryBackedProviderCapabilities(
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): Readonly<Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>> {
+  const capabilities = {} as Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>;
+  for (const providerId of DISCOVERY_BACKED_PROVIDER_IDS) {
+    capabilities[providerId] = discoveryBackedCapabilities(
+      providerId,
+      DISCOVERY_BACKED_PROVIDER_SPECS[providerId],
+      openAIModelDiscovery,
+    );
+  }
+  return capabilities;
+}
+

package/src/providers/default-registry.ts

@@ -4,13 +4,20 @@
 // drag every integration into memory at process start.
 import {
   GENERIC_API_KEY_SPECS,
-} from "./configured-openai-providers";
-import { createDiscoveryBackedProviderCapabilities, discoveryBackedCapabilities } from "./bundled-discovery-providers";
-import { createApiKeyAdapter } from "./configured-provider";
-import type { ApiKeyProviderSpec } from "./configured-provider";
-import { oauthCapability, quotaCapability, type ProviderModuleCapabilities } from "./provider-capabilities";
+  createDiscoveryBackedProviderCapabilities,
+  discoveryBackedCapabilities,
+  createApiKeyAdapter,
+  type ApiKeyProviderSpec,
+} from "./configured-provider";
 import { BUDDY_PROVIDER_CAPABILITIES } from "./integrations/buddy/capabilities";
-import { ProviderRegistry, toRegistration, type ProviderModule } from "./provider-registry";
+import {
+  ProviderRegistry,
+  toRegistration,
+  oauthCapability,
+  quotaCapability,
+  type ProviderModule,
+  type ProviderModuleCapabilities,
+} from "./provider-registry";
 import { BUNDLED_PROVIDER_METADATA, PROVIDER_COMPATIBILITY_PROFILES, providerBaseUrl, providerRequiresAccount, providerUpstreamHost, providerDefaultWireFamily, type BundledProviderId } from "./provider-metadata";
 import { createAnthropicCompatibleAdapter } from "./integrations/anthropic";
 import { defineModel } from "./provider-model-definition";
@@ -31,6 +38,29 @@ function configuredProvider(
   };
 }
 
+/**
+ * Extracts a bearer token from a JSON credential object when the stored secret
+ * is a JSON account export, falling back to the raw secret otherwise. Several
+ * discovery paths accept both a bare token and a JSON export, and each used to
+ * re-implement this same parse + key-pick; this keeps the reading in one place.
+ *
+ * Preserves the exact fallback semantics: an unparseable secret, or a JSON
+ * object with none of the recognized token keys, yields the raw secret.
+ */
+function extractJsonCredentialToken(secret: string): string {
+  if (!secret.startsWith("{")) return secret;
+  try {
+    const parsed = JSON.parse(secret) as Record<string, unknown>;
+    const found = ["accessToken", "access_token", "token"].find(
+      (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
+    );
+    if (found !== undefined) return parsed[found] as string;
+  } catch {
+    // Use the raw secret as the token.
+  }
+  return secret;
+}
+
 /**
  * Qoder's live model list for one realm.
  *
@@ -60,18 +90,7 @@ function traeDiscovery(
     if (secret.length === 0 || fetcher === undefined) {
       return realm === "cn" ? TRAE_CN_MODELS : TRAE_INTL_MODELS;
     }
-    let token = secret;
-    if (secret.startsWith("{")) {
-      try {
-        const parsed = JSON.parse(secret) as Record<string, unknown>;
-        const found = ["accessToken", "access_token", "token"].find(
-          (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
-        );
-        if (found !== undefined) token = parsed[found] as string;
-      } catch {
-        // Use the raw secret as the token.
-      }
-    }
+    const token = extractJsonCredentialToken(secret);
     const region = request.authState?.["region"];
     const rows = await discoverTraeModels({
       realm,
@@ -545,18 +564,7 @@ export const PROVIDER_CAPABILITIES = {
       const secret = request.credential.trim();
       const fetcher = request.fetcher as unknown as typeof fetch | undefined;
       if (secret.length === 0 || fetcher === undefined) return FREEPI_MODELS;
-      let token = secret;
-      if (secret.startsWith("{")) {
-        try {
-          const parsed = JSON.parse(secret) as Record<string, unknown>;
-          const found = ["accessToken", "access_token", "token"].find(
-            (key) => typeof parsed[key] === "string" && (parsed[key] as string).length > 0,
-          );
-          if (found !== undefined) token = parsed[found] as string;
-        } catch {
-          // Use the raw secret as the token.
-        }
-      }
+      const token = extractJsonCredentialToken(secret);
       const rows = await discoverFreepiModels({ token, fetcher });
       if (rows.length === 0) return FREEPI_MODELS;
       return rows;
@@ -576,6 +584,43 @@ export const PROVIDER_CAPABILITIES = {
       return PERCH_MODELS;
     },
   },
+  clixad: {
+    loadAdapter: async () => createApiKeyAdapter((await import("./integrations/clixad/provider")).CLIXAD_SPEC),
+    loadModels: async () => (await import("./integrations/clixad/provider")).CLIXAD_DEFAULT_MODELS,
+    // Clixad login is a GitHub device flow; the issued token (adg_...) is the
+    // credential. The device flow is the only supported login path.
+    loadAuthentication: oauthCapability(() => import("./integrations/clixad/clixad-oauth"), "clixadOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/clixad/clixad-quota"), "fetchClixadQuota"),
+    // `/v1/models` is unauthenticated and lists all rows; the static roster
+    // carries the live-verified free tier and discovery keeps the list current.
+    loadModelDiscovery: async () => async (request: Parameters<ProviderModelDiscovery>[0]) => {
+      const { discoverClixadModels, CLIXAD_DEFAULT_MODELS } = await import("./integrations/clixad/provider");
+      const fetcher = request.fetcher as unknown as typeof fetch | undefined;
+      if (fetcher === undefined) return CLIXAD_DEFAULT_MODELS;
+      const rows = await discoverClixadModels({ baseUrl: request.baseUrl, fetcher });
+      if (rows === null || rows.length === 0) return CLIXAD_DEFAULT_MODELS;
+      return rows;
+    },
+  },
+  deepai: {
+    loadAdapter: async () => createApiKeyAdapter((await import("./integrations/deepai/provider")).DEEPAI_SPEC),
+    loadModels: async () => (await import("./integrations/deepai/deepai-catalog")).DEEPAI_DEFAULT_MODELS,
+    // DeepAI login is a browser loopback flow; the exchange returns an opaque
+    // api_key (the credential). Pasting an api_key is supported via
+    // importCredential.
+    loadAuthentication: oauthCapability(() => import("./integrations/deepai/deepai-oauth"), "deepAIOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/deepai/deepai-quota"), "fetchDeepAIQuota"),
+    // `/deepai_code/models` is unauthenticated; the static roster carries the
+    // live-verified free tier and discovery keeps the list current.
+    loadModelDiscovery: async () => async (request: Parameters<ProviderModelDiscovery>[0]) => {
+      const { discoverDeepAIModels, DEEPAI_DEFAULT_MODELS } = await import("./integrations/deepai/deepai-catalog");
+      const fetcher = request.fetcher as unknown as typeof fetch | undefined;
+      if (fetcher === undefined) return DEEPAI_DEFAULT_MODELS;
+      const rows = await discoverDeepAIModels({ baseUrl: request.baseUrl, fetcher });
+      if (rows === null || rows.length === 0) return DEEPAI_DEFAULT_MODELS;
+      return rows;
+    },
+  },
   inferhub: {
     loadAdapter: async () => (await import("./integrations/inferhub")).createInferhubAdapter(),
     // Live `/v1/models` is the primary source: the marketplace republishes its
@@ -618,6 +663,32 @@ export const PROVIDER_CAPABILITIES = {
         ...(fetcher === undefined ? {} : { fetcher }),
       }),
   },
+  sensenova: {
+    loadAdapter: async () => createApiKeyAdapter((await import("./integrations/sensenova/provider")).SENSENOVA_SPEC),
+    loadModels: async () => (await import("./integrations/sensenova/provider")).SENSENOVA_MODELS,
+    loadModelDiscovery: async () => async (input) =>
+      (await import("./integrations/sensenova/provider")).discoverSensenovaModels({
+        baseUrl: input.baseUrl,
+        providerId: "sensenova",
+        ...(typeof input.credential === "string" && input.credential.trim().length > 0
+          ? { credential: input.credential }
+          : {}),
+        ...(input.fetcher === undefined ? {} : { fetcher: input.fetcher }),
+      }),
+  },
+  "sensenova-intl": {
+    loadAdapter: async () => createApiKeyAdapter((await import("./integrations/sensenova/provider")).SENSENOVA_INTL_SPEC),
+    loadModels: async () => (await import("./integrations/sensenova/provider")).SENSENOVA_INTL_MODELS,
+    loadModelDiscovery: async () => async (input) =>
+      (await import("./integrations/sensenova/provider")).discoverSensenovaModels({
+        baseUrl: input.baseUrl,
+        providerId: "sensenova-intl",
+        ...(typeof input.credential === "string" && input.credential.trim().length > 0
+          ? { credential: input.credential }
+          : {}),
+        ...(input.fetcher === undefined ? {} : { fetcher: input.fetcher }),
+      }),
+  },
   openrouter: {
     loadAdapter: async () => createApiKeyAdapter((await import("./integrations/openrouter/provider")).OPENROUTER_SPEC),
     // One dynamic import for both halves: this registry lazy-loads every
@@ -645,6 +716,19 @@ export const PROVIDER_CAPABILITIES = {
     // why the same adapter serves the pasted-key and signed-in cases.
     loadAuthentication: oauthCapability(() => import("./integrations/openrouter/oauth"), "openrouterOAuthClient"),
   },
+  vercel: {
+    loadAdapter: async () => createApiKeyAdapter((await import("./integrations/vercel/provider")).VERCEL_SPEC),
+    loadModels: async () => (await import("./integrations/vercel/provider")).VERCEL_DEFAULT_MODELS,
+    loadModelDiscovery: async () => async (input) =>
+      (await import("./integrations/vercel/provider")).discoverVercelModels({
+        baseUrl: input.baseUrl,
+        ...(typeof input.credential === "string" && input.credential.trim().length > 0
+          ? { credential: input.credential }
+          : {}),
+        ...(input.fetcher === undefined ? {} : { fetcher: input.fetcher }),
+      }),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/vercel/vercel-quota"), "fetchVercelQuota"),
+  },
   xiaomipg: {
     loadAdapter: async () => createApiKeyAdapter((await import("./integrations/xiaomi-mimo/xiaomi")).XIAOMIPG_SPEC),
     loadModels: async () => (await import("./integrations/xiaomi-mimo/xiaomi")).XIAOMI_MODELS,
@@ -670,9 +754,7 @@ export const PROVIDER_CAPABILITIES = {
     // dressed ZCode client request (see the integration). The credential is a
     // ZCode login JWT — pasted, or minted by the sign-in flow below.
     loadAdapter: async () =>
-      createApiKeyAdapter(
-        (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_SPEC,
-      ),
+      (await import("./integrations/zcode-start-plan/provider")).createZcodeStartPlanAdapter(),
     loadModels: async () =>
       (await import("./integrations/zcode-start-plan/provider")).ZCODE_START_PLAN_MODELS,
     // The device flow stores the issued ZCode login JWT, not a Coding Plan key.
@@ -783,10 +865,29 @@ export const PROVIDER_CAPABILITIES = {
       responses: "/responses",
     },
     loadAdapter: async () => createApiKeyAdapter(GENERIC_API_KEY_SPECS.ollamacloud),
-    loadModels: async () => (await import("./integrations/ollamacloud-models")).OLLAMACLOUD_MODELS,
-    loadQuotaCollector: quotaCapability(() => import("./integrations/ollamacloud-quota"), "fetchOllamaQuota"),
+    loadModels: async () => (await import("./integrations/ollamacloud")).OLLAMACLOUD_MODELS,
+    loadQuotaCollector: quotaCapability(() => import("./integrations/ollamacloud"), "fetchOllamaQuota"),
     loadModelDiscovery: openAIModelDiscovery("ollamacloud", { headers: (credential) => ({ authorization: `Bearer ${credential}` }) }),
   },
+  freebuff: {
+    // Freebuff chat is OpenAI-compatible on `/api/v1/chat/completions`, but the
+    // adapter runs a stateful preflight (session admission + agent-runs START)
+    // and a device-signature header set — see the integration.
+    endpointPathsByWireFamily: { chat: "/api/v1/chat/completions" },
+    loadAdapter: async () => (await import("./integrations/freebuff/freebuff")).createFreebuffAdapter(),
+    loadModels: async () => (await import("./integrations/freebuff/freebuff-catalog")).FREEBUFF_MODELS,
+    loadAuthentication: oauthCapability(() => import("./integrations/freebuff/freebuff-oauth"), "freebuffOAuthClient"),
+    loadQuotaCollector: quotaCapability(() => import("./integrations/freebuff/freebuff-quota"), "fetchFreebuffQuota"),
+    loadModelDiscovery: async () =>
+      (await import("./integrations/freebuff/freebuff-discovery")).freebuffModelDiscovery(),
+  },
+  zro: {
+    endpointPathsByWireFamily: { messages: "/v1/messages" },
+    loadAdapter: async () => (await import("./integrations/zro/zro")).createZroAdapter(),
+    loadModels: async () => (await import("./integrations/zro/zro")).ZRO_MODELS,
+    loadQuotaCollector: quotaCapability(() => import("./integrations/zro/zro"), "fetchZroQuota"),
+    loadModelDiscovery: async () => (await import("./integrations/zro/zro")).zroModelDiscovery()(),
+  },
 
   ...createDiscoveryBackedProviderCapabilities(openAIModelDiscovery),
 
@@ -835,7 +936,7 @@ export const PROVIDER_CAPABILITIES = {
   // the provider usable before anyone syncs.
   dashscope: {
     ...discoveryBackedCapabilities("dashscope", GENERIC_API_KEY_SPECS.dashscope, openAIModelDiscovery),
-    loadModels: async () => (await import("./integrations/dashscope-models")).DASHSCOPE_MODELS,
+    loadModels: async () => (await import("./integrations/alibabacp/dashscope-models")).DASHSCOPE_MODELS,
   },
 
 // Anthropic-Messages providers reached with a plain key. The wire path is

package/src/providers/discovery/discovery-types.ts

@@ -74,6 +74,13 @@ export interface ProbeModelRequest {
   route?: string;
   wireFamily?: string;
   accountId?: string;
+  /**
+   * Restrict a batched probe (`probeAllAccounts`) to these account ids.
+   * Absent means every account of the provider. The dashboard's Grok
+   * "Test 407" uses it when the operator selected accounts: only the
+   * selection is probed then, instead of every active account.
+   */
+  accountIds?: readonly string[];
   prompt?: string;
   /** Omit or `auto` to probe without any reasoning intent. */
   reasoningEffort?: ProbeReasoningEffort;

package/src/providers/discovery/probe-phases.ts

@@ -117,14 +117,18 @@ export function grok407ProbeFailure(args: {
   const providerStatus =
     typeof priorDetails.providerStatus === "number" ? priorDetails.providerStatus : undefined;
   const returned202 = normalizedSample === "202" || providerStatus === 202;
+  // The sample is the model's literal final answer — that is the "original
+  // response" an operator wants to see in the health log, not just the
+  // classification. Quote it so the health-event reason records what the
+  // upstream actually said.
   const detail =
     returned202
-      ? "Grok 407 feature probe returned 202 instead of 407"
+      ? `Grok 407 feature probe returned "202" instead of "407"`
       : args.dispatchError instanceof Error
         ? `Grok 407 feature probe failed: ${args.dispatchError.message}`
         : sample === undefined
           ? "Grok 407 feature probe returned no exact 407 response"
-          : `Grok 407 feature probe returned ${sample}`;
+          : `Grok 407 feature probe returned "${sample}" (expected "407")`;
   return new GatewayError(
     "quota_exceeded",
     429,
@@ -472,8 +476,9 @@ export async function selectProbeAccount(args: {
  * back to the generic OpenAI-compatible adapter so probe/dispatch still works.
  * The low-level compatible adapter is used directly to avoid importing concrete
  * integrations from discovery (which would violate the provider-architecture
- * layering test). `loadOne` returning `undefined` means "no bundled adapter";
- * a throw is a registry failure and propagates rather than being reported as
+ * layering test). `resolve(..., { force: true })` rebuilds the bundled adapter
+ * against the current registration; `undefined` means "no bundled adapter"; a
+ * throw is a registry failure and propagates rather than being reported as
  * "no adapter registered".
  */
 export async function resolveProbeAdapter(args: {
@@ -482,7 +487,7 @@ export async function resolveProbeAdapter(args: {
   readonly providerWireRow: ProbeProviderRow | undefined;
 }): Promise<ProviderAdapter | undefined> {
   const { providerRegistry, providerId, providerWireRow } = args;
-  let adapter = await providerRegistry.loadOne(providerId);
+  let adapter = await providerRegistry.resolve(providerId, { force: true });
   if (!adapter) {
     try {
       if (providerWireRow?.baseUrl) {
@@ -665,8 +670,16 @@ export function buildProbeCanonicalRequest(args: {
    * probe.
    */
   readonly providerSystemPrompt?: string | undefined;
+  /**
+   * A provider-specific default probe prompt, used when the operator sent no
+   * prompt. Lets a provider whose policy gate flags repeated identical probes
+   * (Freebuff: `prompt_policy_refused` / "same message sent over and over")
+   * receive a minimal, per-model-varying probe instead of the shared identity
+   * question every provider otherwise sends.
+   */
+  readonly defaultPromptOverride?: string | undefined;
 }): CanonicalRequest {
-  const { modelId, request, probeReasoning, sourceSurface, maxOutputTokens, providerSystemPrompt } = args;
+  const { modelId, request, probeReasoning, sourceSurface, maxOutputTokens, providerSystemPrompt, defaultPromptOverride } = args;
   const fast = maxOutputTokens === PROBE_FAST_MAX_OUTPUT_TOKENS;
   return {
     model: modelId,
@@ -681,6 +694,7 @@ export function buildProbeCanonicalRequest(args: {
             kind: "text",
             text:
               request.prompt ??
+              defaultPromptOverride ??
               (fast ? PROBE_FAST_DEFAULT_PROMPT : "What model are you, and what is your knowledge cutoff date? Answer in one sentence."),
           },
         ],

package/src/providers/discovery/probing-service.ts

@@ -56,7 +56,7 @@ import {
   wireContextFrom,
   type ProbeProviderRow,
 } from "./probe-phases";
-import { createProbeFetch } from "../operations/probe-fetch";
+import { createProbeFetch } from "../provider-probe";
 import { authHeaders } from "../adapters/compatible-adapter";
 import {
   byokAuthHeaderShape,
@@ -263,7 +263,20 @@ export class ProviderProbingService {
       ...(preferences.maxOutputTokens === undefined
         ? {}
         : { maxOutputTokens: preferences.maxOutputTokens }),
-      ...(typeof adapter?.systemPrompt === "function"
+      // Freebuff's admission policy gate flags repeated identical probes as
+      // automated farming (`prompt_policy_refused` / "same message sent over
+      // and over"). Its probe must be minimal and always distinct per model —
+      // no worker system template, no shared identity question. `ping` is the
+      // same minimal greeting the fast-probe path already uses; the model id
+      // keeps every probe distinct so the "same message over and over" gate
+      // cannot flag a batch run.
+      ...(providerId === "freebuff"
+        ? {
+            defaultPromptOverride: `ping ${modelId}`,
+            providerSystemPrompt: undefined,
+          }
+        : {}),
+      ...(typeof adapter?.systemPrompt === "function" && providerId !== "freebuff"
         ? { providerSystemPrompt: adapter.systemPrompt() }
         : {}),
     });
@@ -1247,6 +1260,13 @@ export class ProviderProbingService {
         and(
           eq(providerAccounts.providerId, providerId),
           globalOrOwnedBy(providerAccounts.tenantId, tenantId),
+          // `accountIds` absent means every account; when present (even
+          // empty) only those ids are probed — the dashboard's "Test 407"
+          // sends the selection and falls back to all when nothing is
+          // selected.
+          ...(request.accountIds !== undefined
+            ? [inArray(providerAccounts.id, request.accountIds)]
+            : []),
         ),
       );
     // Sliding worker pool: workers claim the next account as soon as their

package/src/providers/integrations/alibabacp/alibabacp-models.ts

@@ -19,8 +19,7 @@
  */
 import { defineModel } from "../../provider-model-definition";
 import type { ModelDefinition } from "../../provider-model-definition";
-
-export const ALIBABACP_PROVIDER_ID = "alibabacp" as const;
+import { ALIBABACP_PROVIDER_ID } from "./alibabacp";
 
 /** Chat path below the region's `/compatible-mode/v1` base. */
 const CHAT_ENDPOINT = "/chat/completions";

package/src/providers/integrations/{dashscope-models.ts → alibabacp/dashscope-models.ts}

@@ -17,8 +17,8 @@
  * does not publish yet arrives through the sync control instead of being
  * asserted ahead of the upstream.
  */
-import { defineModel } from "../provider-model-definition";
-import type { ModelDefinition } from "../provider-model-definition";
+import { defineModel } from "../../provider-model-definition";
+import type { ModelDefinition } from "../../provider-model-definition";
 
 export const DASHSCOPE_PROVIDER_ID = "dashscope" as const;
 

package/src/providers/integrations/antigravity/antigravity-protocol.ts

@@ -166,6 +166,16 @@ const ANTIGRAVITY_MODEL_WIRE_PROFILES: Readonly<
     modelEnum: "MODEL_PLACEHOLDER_M322",
     maxOutputTokens: 65536,
   },
+  // Gemini 4 Argon effort tiers (real deployment names).
+  "gemini-4-argon-low": {
+    maxOutputTokens: 65536,
+  },
+  "gemini-4-argon-medium": {
+    maxOutputTokens: 65536,
+  },
+  "gemini-4-argon-high": {
+    maxOutputTokens: 65536,
+  },
   // GPT-OSS via Antigravity (verified live).
   "gpt-oss-120b-medium": {
     modelEnum: "MODEL_OPENAI_GPT_OSS_120B_MEDIUM",
@@ -199,6 +209,7 @@ export function antigravityWireModelId(modelId: string): string {
   if (modelId === "gemini-3.6-flash") return "gemini-3.6-flash-low";
   if (modelId === "gemini-3.7-flash") return "gemini-3.7-flash-low";
   if (modelId === "gemini-3.8-flash") return "gemini-3.8-flash-low";
+  if (modelId === "gemini-4-argon") return "gemini-4-argon-low";
   if (modelId === "gpt-oss-120b") return "gpt-oss-120b-medium";
   return modelId;
 }
@@ -400,7 +411,11 @@ export function dropAntigravityUnsignedReasoning(
     if (message.role !== "assistant") return message;
     const content = message.content.filter((part) => {
       if (part.kind !== "reasoning") return true;
-      if (part.signature !== undefined) return true;
+      // A present-but-empty signature is still unsigned: upstream rejects a
+      // `thinking` part whose `signature` is missing *or* empty with
+      // `400 messages.N.content.0.thinking.signature: Field required`. Only a
+      // non-empty signature is a real one.
+      if (typeof part.signature === "string" && part.signature.length > 0) return true;
       changed = true;
       return false;
     });