cartethyia 2.7.9 → 2.8.1

package/src/providers/integrations/freepi/freepi-discovery.ts

@@ -19,12 +19,12 @@
 import { defineModel, type ModelDefinition } from "../../provider-model-definition";
 import {
   FREEPI_CHAT_PATH,
-  FREEPI_CLI_VERSION,
   FREEPI_CONTEXT_WINDOW,
   FREEPI_DEFAULT_MODEL,
   FREEPI_MAX_OUTPUT_TOKENS,
   FREEPI_PROVIDER_ID,
 } from "./freepi-realm";
+import { getFreepiVersion } from "../../operations/client-versions";
 
 /** Catalog id → canonical roster id for one model. */
 const CATALOG_ID_REMAP: Readonly<Record<string, string>> = {
@@ -44,7 +44,7 @@ export async function discoverFreepiModels(input: {
     headers: {
       authorization: `Bearer ${input.token}`,
       accept: "application/json",
-      "x-client-version": FREEPI_CLI_VERSION,
+      "x-client-version": getFreepiVersion(),
     },
     ...(input.signal ? { signal: input.signal } : {}),
   });

package/src/providers/integrations/freepi/freepi-headers.ts

@@ -4,7 +4,7 @@
 // CLI version) on the chat wire, and uses `application/json`. There is no
 // device fingerprint — the JWT is the whole identity.
 
-import { FREEPI_CLI_VERSION } from "./freepi-realm";
+import { getFreepiVersion } from "../../operations/client-versions";
 
 /** Builds the header set for one free-pi request. */
 export function buildFreepiHeaders(jwt: string, stream = false, sessionId?: string): Record<string, string> {
@@ -12,7 +12,7 @@ export function buildFreepiHeaders(jwt: string, stream = false, sessionId?: stri
     authorization: `Bearer ${jwt}`,
     "content-type": "application/json",
     accept: stream ? "text/event-stream" : "application/json",
-    "x-client-version": FREEPI_CLI_VERSION,
+    "x-client-version": getFreepiVersion(),
   };
   if (sessionId !== undefined && sessionId.length > 0) {
     headers["x-session-id"] = sessionId;

package/src/providers/integrations/freepi/freepi-protocol.ts

@@ -194,8 +194,8 @@ export async function* parseFreepiSse(
           }
         } else if (line.startsWith(":")) {
           continue;
-        } else if (line.startsWith("data")) {
-          let value = line.slice(4);
+        } else if (line === "data" || line.startsWith("data:")) {
+          let value = line === "data" ? "" : line.slice(5);
           if (value.startsWith(" ")) value = value.slice(1);
           data.push(value);
         }
@@ -238,5 +238,14 @@ export function throwFreepiUpstreamError(code: unknown, message: unknown): never
   if (codeStr === "upstream_error") {
     throw new GatewayError("platform_unavailable", 502, `${msg} (request {requestId}). The upstream model host errored. 🌙`, { upstream_code: codeStr }, "upstream");
   }
+  // A connection-bound session refusal: the caller's transcript carries native
+  // items (tool_call_id) from a session this x-session-id does not own. Named
+  // distinctly so the adapter can rotate the session and rebase the history.
+  // The upstream also reports it as a free-form message with only a generic
+  // code, so match the wording too (donor: "does not belong to this connection").
+  const ownershipRefusal = /(?:does not|doesn't|not) belong to|belongs to (?:another|a different)/i.test(msg);
+  if (codeStr === "session_mismatch" || codeStr === "invalid_session" || codeStr === "stale_session" || ownershipRefusal) {
+    throw new GatewayError("upstream_conflict", 409, `Free-pi session ownership refused: ${msg} (request {requestId}). Rebasing onto a fresh session 🔄`, { upstream_code: codeStr, freepi_session_mismatch: true }, "upstream");
+  }
   throw new GatewayError("platform_unavailable", 502, `${msg} (request {requestId}). The free-pi upstream refused the request. 🌙`, { upstream_code: codeStr }, "upstream");
 }

package/src/providers/integrations/freepi/freepi-realm.ts

@@ -16,9 +16,6 @@ export const FREEPI_CHAT_PATH = "/v1/chat/completions";
 export const FREEPI_AD_NEXT_PATH = "/ads/next";
 export const FREEPI_AD_IMPRESSION_PATH = "/ads/impression";
 
-/** Client version the gateway reports via `x-client-version`. */
-export const FREEPI_CLI_VERSION = "0.6.14";
-
 /** Consent version shipped in 0.6.14. */
 export const FREEPI_CONSENT_VERSION = "4";
 

package/src/providers/integrations/freepi/freepi-session.ts

@@ -0,0 +1,158 @@
+// Free-pi session identity and connection-bound history repair.
+//
+// Free-pi binds a conversation's native items (tool_call_id / assistant tool
+// calls) to the `x-session-id` that opened it. Reusing one session id across
+// unrelated conversations, or carrying a stale affinity onto a new account,
+// makes the upstream answer "does not belong to this session". The donor's
+// rule for connection-bound history (oh-my-pi's Copilot compat) is to rebuild
+// prior turns from message content when the connection changes.
+//
+// So: one session per (credential, affinity) — a changed affinity *is* a fresh
+// session — and on a session-ownership refusal, rotate the session and rebase
+// the transcript into plain messages before one bounded retry.
+import { createHash, randomUUID } from "node:crypto";
+import type { CanonicalRequest, CanonicalMessage, ContentPart } from "../../../protocol/canonical-model";
+import { resolvePromptCacheKey } from "../../operations/session-resolution";
+import type { ProviderDispatchContext } from "../../provider-contracts";
+
+/** Stable, non-reversible identity of one free-pi session owner. */
+export interface FreepiSessionOwner {
+  readonly credential: string;
+  readonly affinity: string | undefined;
+  /** Account id is part of the scope: a new account must never inherit a session. */
+  readonly accountId: string;
+  readonly modelId: string;
+  /** Digest of the owner, used as the bounded map key (no live JWT in keys). */
+  readonly key: string;
+}
+
+/** Builds one session owner from the dispatch inputs. */
+export function freepiSessionOwner(input: {
+  readonly secret: string;
+  readonly context: ProviderDispatchContext;
+  readonly request: CanonicalRequest;
+  readonly modelId: string;
+}): FreepiSessionOwner {
+  const affinity = resolvePromptCacheKey(input.request, input.context) ?? input.context.conversation_affinity;
+  const accountId = input.context.credential.account_id ?? "";
+  const key = createHash("sha256")
+    .update(JSON.stringify([input.secret, accountId, input.modelId, affinity ?? ""]))
+    .digest("hex")
+    .slice(0, 32);
+  return { credential: input.secret, affinity, accountId, modelId: input.modelId, key };
+}
+
+/** Returns a new owner whose affinity (and thus session key) cannot collide. */
+export function withFreshFreepiAffinity(owner: FreepiSessionOwner): FreepiSessionOwner {
+  const affinity = `fresh-${randomUUID()}`;
+  const key = createHash("sha256")
+    .update(JSON.stringify([owner.credential, owner.accountId, owner.modelId, affinity]))
+    .digest("hex")
+    .slice(0, 32);
+  return { ...owner, affinity, key };
+}
+
+/** Bounded, per-owner sessions. */
+export interface FreepiSessionEntry {
+  readonly sessionId: string;
+  readonly owner: FreepiSessionOwner;
+  /** True until the session's ad registration has been attempted once. */
+  fresh: boolean;
+}
+
+const FREEPI_SESSION_CACHE_MAX = 256;
+
+export class FreepiSessionRegistry {
+  readonly #sessions = new Map<string, FreepiSessionEntry>();
+
+  /** Existing session for this owner, or a freshly minted one. */
+  get(owner: FreepiSessionOwner): FreepiSessionEntry {
+    const existing = this.#sessions.get(owner.key);
+    if (existing !== undefined) {
+      // Touch for LRU: the map is small, but a long-lived process must not
+      // pin a stale affinity forever.
+      this.#sessions.delete(owner.key);
+      const touched: FreepiSessionEntry = { ...existing, fresh: false };
+      this.#sessions.set(owner.key, touched);
+      return touched;
+    }
+    const entry: FreepiSessionEntry = { sessionId: randomUUID(), owner, fresh: true };
+    this.#sessions.set(owner.key, entry);
+    if (this.#sessions.size > FREEPI_SESSION_CACHE_MAX) {
+      const oldest = this.#sessions.keys().next();
+      if (!oldest.done) this.#sessions.delete(oldest.value);
+    }
+    return entry;
+  }
+
+  /** Drops one owner's session; the next call mints a fresh one. */
+  rotate(owner: FreepiSessionOwner): FreepiSessionEntry {
+    this.#sessions.delete(owner.key);
+    return this.get(owner);
+  }
+
+  /** Test seam. */
+  get size(): number {
+    return this.#sessions.size;
+  }
+}
+
+/** Upstream refusal shapes that say a native item/session belongs elsewhere. */
+const SESSION_OWNERSHIP_REFUSAL = /(?:does not|doesn't|not) belong to|belongs to (?:another|a different)|session (?:mismatch|expired|invalid)|invalid session|unknown session|stale session|tool_call_id.*(?:unknown|invalid|mismatch)|not (?:found|valid) for (?:this )?session/i;
+
+/** True when an upstream error is a session/connection ownership refusal. */
+export function isFreepiSessionOwnershipError(error: unknown): boolean {
+  if (!(error instanceof Error)) return false;
+  const details = (error as Error & { details?: Readonly<Record<string, unknown>> }).details;
+  if (details?.["freepi_session_mismatch"] === true) return true;
+  const raw = typeof details?.["raw"] === "string" ? details["raw"] : "";
+  const message = `${error.message} ${raw}`;
+  return SESSION_OWNERSHIP_REFUSAL.test(message);
+}
+
+/**
+ * Rebases a connection-bound transcript into plain messages: a fresh session
+ * has never seen the old `tool_call_id`s, so replaying them verbatim is exactly
+ * what the upstream refuses. Prior tool calls and their results become text in
+ * the same conversation order (the donor's cold-session rebuild rule).
+ */
+export function rebaseFreepiRequest(request: CanonicalRequest): CanonicalRequest {
+  const messages: CanonicalMessage[] = [];
+  for (const message of request.messages) {
+    const parts: ContentPart[] = [];
+    let native = false;
+    for (const part of message.content) {
+      if (part.kind === "toolCall") {
+        native = true;
+        const args = typeof part.arguments === "string" ? part.arguments : JSON.stringify(part.arguments ?? {});
+        parts.push({ kind: "text", text: `[Earlier tool call ${part.name}: ${args}]` });
+        continue;
+      }
+      if (part.kind === "toolResult") {
+        native = true;
+        const text = typeof part.content === "string"
+          ? part.content
+          : part.content.map((child) => (child.kind === "text" ? child.text : "")).join("\n");
+        parts.push({ kind: "text", text: `[Earlier tool result: ${text}]` });
+        continue;
+      }
+      parts.push(part);
+    }
+    // Keep the role, but collapse a native tool message onto a user/assistant
+    // text turn so no orphan `tool_call_id` reaches the fresh session.
+    const role = native && message.role === "tool" ? "user" : message.role;
+    messages.push({ ...message, role, content: parts });
+  }
+  return {
+    ...request,
+    messages,
+    generation_controls: {
+      ...request.generation_controls,
+      // The old cache affinity is bound to the old session: drop it so the
+      // fresh session starts with a clean prefix.
+      "extension:prompt_cache_key": undefined,
+      "extension:responses.prompt_cache_key": undefined,
+      "extension:metadata_user_id": undefined,
+    },
+  };
+}

package/src/providers/integrations/freepi/freepi.ts

@@ -5,7 +5,6 @@
 // `/v1/chat/completions` and translates the OpenAI-style SSE stream into
 // canonical events.
 
-import { randomUUID } from "node:crypto";
 import type {
   CanonicalEvent,
   CanonicalRequest,
@@ -23,10 +22,17 @@ import {
 } from "../../provider-contracts";
 import { mapUpstreamHttpError } from "../../../transport/failure-policy";
 import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
-import { resolvePromptCacheKey } from "../../operations/session-resolution";
 import { usageFromProvider } from "../../provider-usage";
 import { buildFreepiChatBody, parseFreepiSse, throwFreepiUpstreamError } from "./freepi-protocol";
 import { buildFreepiHeaders } from "./freepi-headers";
+import {
+  FreepiSessionRegistry,
+  freepiSessionOwner,
+  isFreepiSessionOwnershipError,
+  rebaseFreepiRequest,
+  withFreshFreepiAffinity,
+  type FreepiSessionOwner,
+} from "./freepi-session";
 import {
   FREEPI_AD_IMPRESSION_PATH,
   FREEPI_AD_NEXT_PATH,
@@ -51,12 +57,13 @@ export class FreepiAdapter implements ProviderAdapter {
   readonly provider_id: ProviderId;
   private readonly fetchFn: typeof fetch;
   /**
-   * One stable ad-registered session id per account credential, so repeated
-   * chats reuse a session the upstream knows has shown ads. The session must
-   * exist for the chat wire: without it the server answers `ads_required`
-   * ("Ads aren't showing for this account, so free completions are paused").
+   * One ad-registered session per (credential, account, model, affinity).
+   * A changed affinity is a fresh session by construction: free-pi binds
+   * native tool_call ids to the session that opened them, and reusing a
+   * session across conversations/accounts is what answers "does not belong
+   * to this session".
    */
-  #sessionByCredential = new Map<string, string>();
+  readonly #sessions = new FreepiSessionRegistry();
 
   constructor(options: FreepiAdapterOptions = {}) {
     this.provider_id = (options.providerId ?? FREEPI_PROVIDER_ID) as ProviderId;
@@ -64,24 +71,19 @@ export class FreepiAdapter implements ProviderAdapter {
   }
 
   /**
-   * Ensures a session id exists for this credential and that the session has
+   * Ensures a session id exists for this owner and that the session has
    * registered at least one ad impression (banner + inline). The upstream
    * refuses the chat wire with `ads_required` until a session has shown ads,
-   * so the first call per credential pays the two ad-registration requests.
-   *
-   * Returns the session id to send as `x-session-id`. Falls back to a fresh
-   * random id when registration fails — a broken ad surface must not block
-   * chat entirely, and the error is caught upstream anyway.
+   * so a freshly minted session pays the two ad-registration requests.
    */
-  async #ensureSession(secret: string, outboundFetch: typeof fetch): Promise<string> {
-    const existing = this.#sessionByCredential.get(secret);
-    if (existing !== undefined) return existing;
-    const sessionId = randomUUID();
+  async #ensureSession(secret: string, owner: FreepiSessionOwner, outboundFetch: typeof fetch): Promise<string> {
+    const entry = this.#sessions.get(owner);
+    if (!entry.fresh) return entry.sessionId;
     try {
       for (const slot of ["banner", "inline"] as const) {
         const next = await outboundFetch(new URL(`${FREEPI_AD_NEXT_PATH}?slot=${slot}`, FREEPI_BASE_URL), {
           method: "GET",
-          headers: buildFreepiHeaders(secret, false, sessionId),
+          headers: buildFreepiHeaders(secret, false, entry.sessionId),
           signal: AbortSignal.timeout(15_000),
         });
         if (!next.ok || next.status === 204) continue;
@@ -91,7 +93,7 @@ export class FreepiAdapter implements ProviderAdapter {
         if (typeof adId !== "string" || typeof clickToken !== "string") continue;
         await outboundFetch(new URL(FREEPI_AD_IMPRESSION_PATH, FREEPI_BASE_URL), {
           method: "POST",
-          headers: buildFreepiHeaders(secret, false, sessionId),
+          headers: buildFreepiHeaders(secret, false, entry.sessionId),
           body: JSON.stringify({ ad_id: adId, click_token: clickToken, imp_fired: true }),
           signal: AbortSignal.timeout(15_000),
         });
@@ -99,8 +101,7 @@ export class FreepiAdapter implements ProviderAdapter {
     } catch {
       // The ad surface is best-effort; chat may still work or fail upstream.
     }
-    this.#sessionByCredential.set(secret, sessionId);
-    return sessionId;
+    return entry.sessionId;
   }
 
   async *dispatch(
@@ -113,45 +114,70 @@ export class FreepiAdapter implements ProviderAdapter {
     }
     const secret = readCredentialSecret(context.credential, "Free-pi credential is required");
     const modelId = candidate.model_id || request.model;
-    const lifecycle = createUpstreamDeadlineLifecycle(context);
     const outboundFetch =
       (context.outbound_fetch as unknown as typeof fetch | undefined) ?? this.fetchFn;
-
-    const body = buildFreepiChatBody(modelId, request, candidate.output_limit ?? undefined);
-
-    const sessionKey = resolvePromptCacheKey(request, context);
-    const cacheSessionKey = sessionKey === undefined ? undefined : `${modelId}:${sessionKey}`;
-
-    const sessionId = await this.#ensureSession(secret, outboundFetch);
-    const headers = buildFreepiHeaders(secret, true, sessionId);
+    const owner = freepiSessionOwner({ secret, context, request, modelId });
     const url = `${FREEPI_BASE_URL}${FREEPI_CHAT_PATH}`;
 
-    try {
-      const response = await outboundFetch(url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body),
-        signal: lifecycle.signal,
-      });
-      if (!response.ok) throw await mapUpstreamHttpError(response, this.provider_id);
-      if (!response.body) {
-        throw new GatewayError("platform_unavailable", 502, "Free-pi returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+    // Two attempts at most: a connection-bound refusal rotates the session and
+    // rebases the transcript (dropping native tool_call ids the fresh session
+    // never saw) before one retry. Anything after that is terminal.
+    let activeRequest = request;
+    let activeOwner = owner;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const sessionId = await this.#ensureSession(secret, activeOwner, outboundFetch);
+      const body = buildFreepiChatBody(modelId, activeRequest, candidate.output_limit ?? undefined);
+      const lifecycle = createUpstreamDeadlineLifecycle(context);
+      let events: CanonicalEvent[] = [];
+      try {
+        const response = await outboundFetch(url, {
+          method: "POST",
+          headers: buildFreepiHeaders(secret, true, sessionId),
+          body: JSON.stringify(body),
+          signal: lifecycle.signal,
+        });
+        if (!response.ok) throw await mapUpstreamHttpError(response, this.provider_id);
+        if (!response.body) {
+          throw new GatewayError("platform_unavailable", 502, "Free-pi returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+        }
+        lifecycle.release();
+        // Buffered until the stream proves it carries no session-ownership
+        // refusal: an SSE 200 `{"error":{...}}` can arrive after the first
+        // delta, and yielding events before that would make a retry replay
+        // half an answer to the client. Free-pi turns are short; correctness
+        // of the tool loop wins over one RTT of time-to-first-token.
+        events = [];
+        for await (const event of this.#events(
+          response.body as ReadableStream<Uint8Array>,
+          lifecycle.signal,
+          request.model,
+          `${modelId}:${activeOwner.affinity ?? "fresh"}`,
+          activeRequest.messages,
+        )) {
+          events.push(event);
+        }
+      } catch (err: unknown) {
+        const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
+        if (abortError) throw abortError;
+        if (attempt === 0 && isFreepiSessionOwnershipError(err)) {
+          const rebased = rebaseFreepiRequest(request);
+          // A fresh affinity = a fresh session by construction. The old
+          // owner's session is dropped so it can never be reused by a later
+          // turn that still carries the stale tool_call ids.
+          this.#sessions.rotate(owner);
+          activeRequest = rebased;
+          activeOwner = withFreshFreepiAffinity(owner);
+          lifecycle.release();
+          continue;
+        }
+        throw err;
+      } finally {
+        lifecycle.release();
       }
-      lifecycle.release();
-      yield* this.#events(
-        response.body as ReadableStream<Uint8Array>,
-        lifecycle.signal,
-        request.model,
-        cacheSessionKey,
-        request.messages,
-      );
-    } catch (err: unknown) {
-      const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
-      if (abortError) throw abortError;
-      throw err;
-    } finally {
-      lifecycle.release();
+      yield* events;
+      return;
     }
+    throw new GatewayError("upstream_conflict", 409, "Free-pi still refused the session after a rebase (request {requestId}). Resend the complete conversation 🔌", { providerId: this.provider_id }, "upstream");
   }
 
   async *#events(

package/src/providers/integrations/github/github-discovery.ts

@@ -24,6 +24,7 @@ import { isRecord } from "../../../protocol/codecs";
 import { boundedUpstreamArray, boundedUpstreamNumber, sanitizeUpstreamLabel } from "../../provider-sanitize";
 import { modelsDevCatalog } from "../../discovery/models-dev-catalog";
 import type { DiscoveryInput } from "../../discovery/discovery-types";
+import { resolveGithubCopilotMode } from "../../../config/providers";
 import {
   GITHUB_EXCLUDED_MODEL_IDS,
   GITHUB_PROVIDER_ID,
@@ -33,7 +34,13 @@ import {
   GITHUB_AUTO_MODELS,
   recordGithubModelRoutes,
 } from "./github";
-import { GITHUB_REQUEST_HEADERS, githubCopilotClientIds, parseGithubCredential } from "./github-oauth";
+import {
+  GITHUB_REQUEST_HEADERS,
+  copilotGitHubDomain,
+  githubCopilotApiHostForProfile,
+  githubCopilotClientIds,
+  parseGithubCredential,
+} from "./github-oauth";
 import { createHash } from "node:crypto";
 
 /** A context window above this is unsatisfiable headroom, not a real limit. */
@@ -165,7 +172,8 @@ function toModelDefinition(entry: Record<string, unknown>): ModelDefinition | un
 export async function discoverGithubModels(
   input: DiscoveryInput,
 ): Promise<readonly ModelDefinition[] | null> {
-  const { access, apiHost } = parseGithubCredential(input.credential);
+  const credential = parseGithubCredential(input.credential);
+  const { access, apiHost, profile } = credential;
   const fetcher = input.fetcher ?? fetch;
   const timeoutSignal = AbortSignal.timeout(15_000);
   const signal =
@@ -176,17 +184,26 @@ export async function discoverGithubModels(
     // Machine id is per-account — see `githubCopilotClientIds`.
     const accountKey = createHash("sha256").update(`${apiHost}:${access}`).digest("hex");
     const { sessionId, machineId } = await githubCopilotClientIds(accountKey);
-    const response = await fetcher(`https://${apiHost}/models`, {
-      headers: {
-        accept: "application/json",
-        authorization: `Bearer ${access}`,
-        ...GITHUB_REQUEST_HEADERS,
-        "VScode-SessionId": sessionId,
-        "VScode-MachineId": machineId,
-        "editor-device-id": machineId,
-      },
-      signal,
-    });
+    if (profile !== resolveGithubCopilotMode()) return null;
+    const headers: Record<string, string> = profile === "opencode-copilot"
+      ? {
+          accept: "application/json",
+          authorization: `Bearer ${credential.github ?? access}`,
+          "user-agent": "opencode/0.1.0",
+          "x-github-api-version": "2026-08-01",
+        }
+      : {
+          accept: "application/json",
+          authorization: `Bearer ${access}`,
+          ...GITHUB_REQUEST_HEADERS,
+          "VScode-SessionId": sessionId,
+          "VScode-MachineId": machineId,
+          "editor-device-id": machineId,
+        };
+    const discoveryHost = profile === "opencode-copilot"
+      ? githubCopilotApiHostForProfile(profile, copilotGitHubDomain())
+      : apiHost;
+    const response = await fetcher(`https://${discoveryHost}/models`, { headers, signal });
     if (!response.ok) return null;
     const payload: unknown = await response.json();
     if (!isRecord(payload)) return null;