cartethyia 2.7.9 → 2.8.1

package/src/providers/integrations/muse/muse-oauth.ts

@@ -131,25 +131,25 @@ export class MuseCodeOAuthClient extends OAuthDeviceFlow {
   protected override readonly tokenUrl = MUSE_CODE_DEVICE_TOKEN_URL;
   protected override readonly scopes = "";
 
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
     return this.startGenericDeviceAuth({
       tokenUrl: MUSE_CODE_DEVICE_TOKEN_URL,
       deviceAuthUrl: MUSE_CODE_DEVICE_AUTHORIZE_URL,
       clientId: MUSE_CODE_CLIENT_ID,
       formHeaders: metaHeaders,
-    });
+    }, context);
   }
 
   override async pollDeviceAuth(
     deviceAuthId: string,
-    _context?: OAuthDeviceFlowContext,
+    context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDevicePollResult> {
     const result = await this.pollGenericDeviceAuth(deviceAuthId, {
       tokenUrl: MUSE_CODE_DEVICE_TOKEN_URL,
       deviceAuthUrl: MUSE_CODE_DEVICE_AUTHORIZE_URL,
       clientId: MUSE_CODE_CLIENT_ID,
       formHeaders: metaHeaders,
-    });
+    }, context);
     if (result.status !== "complete") return result;
     const accessToken = result.result.access;
     // The key mint runs after approval: a 429, a payment gate, or a transient
@@ -157,7 +157,7 @@ export class MuseCodeOAuthClient extends OAuthDeviceFlow {
     // exception that escapes the dashboard's poll request.
     let keyPayload;
     try {
-      keyPayload = await requestMuseCodeKey(accessToken, this.fetchFn);
+      keyPayload = await requestMuseCodeKey(accessToken, this.fetchFor(context));
     } catch (error) {
       return { status: "failed", reason: error instanceof Error ? error.message : "Muse Code key exchange failed" };
     }

package/src/providers/integrations/ollamacloud/index.ts

@@ -0,0 +1,2 @@
+export * from "./models";
+export * from "./quota";

package/src/providers/integrations/{ollamacloud-models.ts → ollamacloud/models.ts}

@@ -16,8 +16,8 @@
  * All six serve the chat wire (none is a Responses-native id), and all report
  * `supported_in_api: true` on the live roster.
  */
-import { defineModel } from "../provider-model-definition";
-import type { ModelDefinition } from "../provider-model-definition";
+import { defineModel } from "../../provider-model-definition";
+import type { ModelDefinition } from "../../provider-model-definition";
 
 export const OLLAMACLOUD_PROVIDER_ID = "ollamacloud" as const;
 

package/src/providers/integrations/{ollamacloud-quota.ts → ollamacloud/quota.ts}

@@ -1,6 +1,6 @@
-import type { FetchLike, ProviderQuotaResult } from "../quota/quota-contracts";
-import { getJson, record, text } from "../quota/quota-contracts";
-import { parseQuotaWindows } from "../quota/quota-window-parser";
+import type { FetchLike, ProviderQuotaResult } from "../../quota/quota-contracts";
+import { getJson, record, text } from "../../quota/quota-contracts";
+import { parseQuotaWindows } from "../../quota/quota-window-parser";
 
 async function fetchPlan(fetcher: FetchLike, headers: Record<string, string>): Promise<string> {
   try {

package/src/providers/integrations/opencode/fingerprint.ts

@@ -9,7 +9,7 @@ import { createHash, randomBytes } from "node:crypto";
  * can pin the exact identity sent before discovery resolves. Keep both in
  * lockstep when the CLI releases.
  */
-export const OPENCODE_CLIENT_VERSION = "2.2.6";
+export const OPENCODE_CLIENT_VERSION = "2.2.7";
 
 let lastTimestamp = 0;
 let sequenceCounter = 0;

package/src/providers/integrations/opencode/opencode-go-quota.ts

@@ -1,5 +1,6 @@
 import {
   getJson,
+  isoDate,
   type FetchLike,
   type ProviderQuotaResult,
   type ProviderQuotaWindow,
@@ -42,13 +43,6 @@ function labelFor(kind: string): string {
   return kind.charAt(0).toUpperCase() + kind.slice(1);
 }
 
-function resetIso(value: string | null | undefined): string | null {
-  if (typeof value !== "string" || value.trim() === "") return null;
-  const parsed = Date.parse(value);
-  if (!Number.isFinite(parsed)) return null;
-  return new Date(parsed).toISOString();
-}
-
 /**
  * One window, or `undefined` when the upstream omitted what makes it usable.
  *
@@ -75,7 +69,7 @@ function windowFor(
     accounting: "independent",
     usedPercent: percent,
     remainingPercent: 100 - percent,
-    resetsAt: resetIso(raw.resetsAt),
+    resetsAt: isoDate(raw.resetsAt),
   };
 }
 

package/src/providers/integrations/openrouter/provider.ts

@@ -5,7 +5,7 @@ import { providerBaseUrl } from "../../provider-metadata";
 import type { DiscoveryInput } from "../../discovery/discovery-types";
 import { defineModel } from "../../provider-model-definition";
 import { openrouterFreeRoster } from "../../discovery/openrouter-free-roster";
-import { clineReasoningReplayPrepares } from "../buddy/buddy-chat-shared";
+import { clineReasoningReplayPrepares } from "../buddy/chat";
 
 const OPENROUTER_PROVIDER_ID = "openrouter" as const;
 

package/src/providers/integrations/perch/perch-credential.ts

@@ -0,0 +1,25 @@
+// Perch credential-envelope parsing.
+//
+// Perch accounts authenticate via Supabase OAuth (PKCE), and the stored secret
+// is the OAuth envelope JSON with `accessToken` (or `access_token`). Both the
+// dispatch adapter and the quota collector need the access token out of that
+// envelope; the parse is shared here and each surface keeps its own fallback
+// for a secret that is not an envelope.
+
+/**
+ * Reads the access token out of a stored Perch OAuth envelope.
+ *
+ * Returns the token when the secret parses as JSON and carries `accessToken`
+ * (or `access_token`) as a string; `null` when it is not such an envelope
+ * (not JSON, or JSON without a token field). The caller decides what a
+ * `null` means for its surface.
+ */
+export function parsePerchCredentialToken(secret: string): string | null {
+  try {
+    const parsed = JSON.parse(secret) as Record<string, unknown>;
+    const found = parsed["accessToken"] ?? parsed["access_token"];
+    return typeof found === "string" ? found : null;
+  } catch {
+    return null;
+  }
+}

package/src/providers/integrations/perch/perch-protocol.ts

@@ -27,12 +27,6 @@ import { PERCH_STARTER_PINS } from "./perch-realm";
 /** Default hosted model id when the account endpoint is unreachable. */
 export const PERCH_DEFAULT_CHAT_MODEL = "wandb-kimi-k2-6";
 
-/** App origin (model-call + ticket + account + plan endpoints). */
-export const PERCH_APP_URL = "https://app.perchai.app";
-
-/** The CLI user-agent the upstream recognizes as a CLI surface. */
-export const PERCH_CLI_USER_AGENT = "perchai-cli/unknown";
-
 export interface PerchTurnContext {
   readonly userId: string | null;
   readonly workspaceId: string | null;

package/src/providers/integrations/perch/perch-quota.ts

@@ -11,21 +11,7 @@ import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../
 import { cleanError, percentWindow, text } from "../../quota/quota-contracts";
 import type { QuotaCollectionContext } from "../../quota/quota-support";
 import { PERCH_APP_URL } from "./perch-realm";
-
-interface PerchSessionCredential {
-  readonly accessToken?: string;
-  readonly access_token?: string;
-}
-
-function credentialToken(credential: string): string {
-  try {
-    const parsed = JSON.parse(credential) as PerchSessionCredential;
-    const found = parsed.accessToken ?? parsed.access_token;
-    return typeof found === "string" ? found : "";
-  } catch {
-    return credential.trim();
-  }
-}
+import { parsePerchCredentialToken } from "./perch-credential";
 
 async function readAccount(
   baseUrl: string,
@@ -61,7 +47,7 @@ export async function fetchPerchQuota(
   _context?: QuotaCollectionContext,
 ): Promise<ProviderQuotaResult> {
   try {
-    const token = credentialToken(credential);
+    const token = parsePerchCredentialToken(credential) ?? "";
     const account = await readAccount(PERCH_APP_URL, token, fetcher);
     if (!account) {
       return { source: "perch", plan: null, windows: [], error: "Perch account endpoint unavailable" };

package/src/providers/integrations/perch/perch.ts

@@ -27,9 +27,8 @@ import {
   type ProviderId,
 } from "../../provider-contracts";
 import { usageFromProvider } from "../../provider-usage";
+import { getPerchVersion } from "../../operations/client-versions";
 import {
-  PERCH_APP_URL,
-  PERCH_CLI_USER_AGENT,
   PERCH_SAFFRON_SYSTEM_PROMPT,
   buildPerchModelCallBody,
   parsePerchSse,
@@ -39,7 +38,8 @@ import {
   PERCH_MODEL_PINS,
   PERCH_MODEL_ROOST_TIERS,
 } from "./perch-catalog";
-import { PERCH_PROVIDER_ID } from "./perch-realm";
+import { PERCH_APP_URL, PERCH_PROVIDER_ID } from "./perch-realm";
+import { parsePerchCredentialToken } from "./perch-credential";
 
 interface PerchAdapterOptions {
   readonly providerId?: string;
@@ -96,7 +96,7 @@ export class PerchAdapter implements ProviderAdapter {
       headers: {
         authorization: `Bearer ${access}`,
         "content-type": "application/json",
-        "user-agent": PERCH_CLI_USER_AGENT,
+        "user-agent": `perchai-cli/${getPerchVersion()}`,
         "x-perch-locale": "en",
       },
       body: JSON.stringify({ surface: "cli", profile: "standard" }),
@@ -126,7 +126,7 @@ export class PerchAdapter implements ProviderAdapter {
     }
     const secret = readCredentialSecret(context.credential, "Perch credential is required");
     const modelId = candidate.model_id || request.model || "standard";
-    const access = secret.startsWith("{") ? parseAccessToken(secret) : secret.trim();
+    const access = parsePerchCredentialToken(secret) ?? secret.trim();
     // Probes pass a validated outbound fetch (with capture wrapped around it);
     // live dispatch passes one too. `globalThis.fetch` here silently split the
     // probe from the route's egress policy and left Request Detail empty.
@@ -164,7 +164,7 @@ export class PerchAdapter implements ProviderAdapter {
           authorization: `Bearer ${access}`,
           "content-type": "application/json",
           accept: "text/event-stream",
-          "user-agent": PERCH_CLI_USER_AGENT,
+          "user-agent": `perchai-cli/${getPerchVersion()}`,
           "x-perch-locale": "en",
           "x-perch-call-delta": "1",
           "x-perch-turn-ticket": ticket.ticket,
@@ -281,16 +281,6 @@ function normalizePerchUsage(usage: Record<string, unknown>): Record<string, unk
   return out;
 }
 
-function parseAccessToken(secret: string): string {
-  try {
-    const parsed = JSON.parse(secret) as Record<string, unknown>;
-    const found = parsed["accessToken"] ?? parsed["access_token"];
-    return typeof found === "string" ? found : secret.trim();
-  } catch {
-    return secret.trim();
-  }
-}
-
 /**
  * Builds an upstream verdict for the Perch surface. `origin: "upstream"` is
  * what lets the account health machine see the failure: `attempt-finalize`

package/src/providers/integrations/qoder/claim-qoder-credits.ts

@@ -15,11 +15,15 @@
  *   401; verified live 2026-11-04).
  */
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
-import type { ValidatedFetch } from "../../../network/outbound-fetch";
-import { getQoderVersion } from "../../operations/client-versions";
+import type { ValidatedFetch } from "../../../network/egress/fetch";
 import { qoderRealmForProvider, QODER_REALMS } from "./qoder-realm";
+import { exchangeQoderPatForHost } from "./qoder-auth";
 import {
+  asNumber,
+  asRecord,
   buildCampaignHeaders,
+  normalizeCampaign,
+  safeParse,
 } from "./qoder-checkin";
 import { qoderMachineHeaders } from "./qoder-umid";
 import {
@@ -38,31 +42,6 @@ export const QODER_CREDIT_PROVIDER_IDS = ["qoder", "qodercn"] as const;
 
 const PAT_PREFIX = "pt-";
 
-function asRecord(value: unknown): Record<string, unknown> | null {
-  if (typeof value !== "object" || value === null) return null;
-  return value as Record<string, unknown>;
-}
-
-function asNumber(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value === "string" && value.trim() !== "") {
-    const parsed = Number(value);
-    return Number.isFinite(parsed) ? parsed : null;
-  }
-  return null;
-}
-
-function normalizeCampaign(raw: Record<string, unknown>): Record<string, unknown> {
-  const benefit = asRecord(raw["benefit"]);
-  return {
-    campaign_id: String(raw["campaignId"] ?? raw["campaign_id"] ?? ""),
-    campaign_key: String(raw["campaignKey"] ?? raw["campaign_key"] ?? ""),
-    action_type: String(raw["actionType"] ?? raw["action_type"] ?? ""),
-    claim_status: String(raw["claimStatus"] ?? raw["claim_status"] ?? ""),
-    ...(benefit !== null ? { benefit } : {}),
-  };
-}
-
 /**
  * Exchanges a PAT (`pt-…`) for a job token (`jt-…`) on the realm's openapi
  * host. Returns the job token, or `null` when the exchange fails.
@@ -70,7 +49,8 @@ function normalizeCampaign(raw: Record<string, unknown>): Record<string, unknown
  * The real client binds the machine identity at exchange time
  * (`getMachineIdentityRequestFields`), so `machine_id` + `machine_token` are
  * sent when available — the job token is then bound to that machine. The
- * User-Agent and Cosy version mirror the real client (`qoder/<version>`).
+ * request is the shared `exchangeQoderPatForHost` (same v1 body and client
+ * identity headers as the auth path), parameterized by this site's own host.
  */
 async function exchangePatToJobToken(
   base: string,
@@ -78,30 +58,17 @@ async function exchangePatToJobToken(
   fetcher: ValidatedFetch,
   machine?: { readonly id?: string; readonly token?: string },
 ): Promise<string | null> {
-  try {
-    const body: Record<string, unknown> = { personal_token: pat };
-    if (machine?.id) body.machine_id = machine.id;
-    if (machine?.token) body.machine_token = machine.token;
-    const version = getQoderVersion();
-    const res = await fetcher(`${base}/api/v1/jobToken/exchange`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "User-Agent": `qoder/${version}`,
-        "Cosy-ClientType": "5",
-        "Cosy-Version": version,
-      },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(25_000),
-    });
-    if (!res.ok) return null;
-    const payload: unknown = await res.json().catch(() => null);
-    const rec = asRecord(payload);
-    const token = String(rec?.["token"] ?? rec?.["device_token"] ?? rec?.["access_token"] ?? "");
-    return token.length > 0 ? token : null;
-  } catch {
-    return null;
-  }
+  const exchanged = await exchangeQoderPatForHost({
+    pat,
+    url: `${base}/api/v1/jobToken/exchange`,
+    ...(machine === undefined ? {} : { machine }),
+    fetcher,
+    signal: AbortSignal.timeout(25_000),
+    tokenKeys: ["token", "device_token", "access_token"],
+  });
+  if (exchanged === null) return null;
+  if (!exchanged.response.ok) return null;
+  return exchanged.result?.token ?? null;
 }
 
 /**
@@ -248,11 +215,3 @@ export async function claimQoderCredits(args: {
     return { state: "error", amount: 0, detail: "Claim request failed." };
   }
 }
-
-function safeParse(raw: string): unknown {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}

package/src/providers/integrations/qoder/qoder-adapter.ts

@@ -1,21 +1,17 @@
 /**
  * Qoder adapter — transport selection, credential resolution, dispatch.
  *
- * Surface contract (2026-11-07):
+ * Surface contract (2026-11-07, verified live 2026-11-11):
  * - `cosy` (default, production): `/algo/.../agent_chat_generation` on
- *   `api1` → `api2` → `api3.qoder.sh` (legacy COSY) — the only surface
- *   verified alive. Accepts free-tier rows (`lite`).
- * - `grpc` (`model.chat.ChatService/ChatCompletionStream`): **not the
- *   default anymore** — its host (`api2-v2.qoder.sh`) is NXDOMAIN since
- *   2026-11-07. Kept as an explicit override for probes.
- * - `ide` (`/model/v1/chat/completions`): **probe/testing only — never
- *   production.** It is the only surface that echoes strategy metadata
- *   (`raw_usage` → provider_model/target) and it streams immediately, but its
- *   ~256 KiB body cap cannot carry the 1M window the roster declares. Dispatch
- *   reaches it only when `probe_surface: "ide"` is set (discovery probes) or
- *   the option `surface: "ide"` is forced explicitly for local testing.
+ *   the realm's token-kind-specific gateway set (legacy COSY) — the only
+ *   surface verified alive. A PAT is exchanged to a job token first; job
+ *   tokens use `api2` → `api1` only, since `api3` rejects them with
+ *   `105 Login expired` (403). Accepts free-tier rows (`lite`).
+ * - The gRPC surface (`model.chat.ChatService/ChatCompletionStream`) and the
+ *   IDE surface (`/model/v1/chat/completions`) are dead on every host that
+ *   resolves (gRPC: UNIMPLEMENTED; IDE: 404) since 2026-11-07 and are not
+ *   dispatched anymore.
  */
-import { randomUUID } from "node:crypto";
 import { GatewayError } from "../../../protocol/gateway-error";
 import type { CanonicalEvent, CanonicalRequest } from "../../../protocol/canonical-model";
 import {
@@ -28,19 +24,16 @@ import {
 } from "../../provider-contracts";
 import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
 import { getQoderVersion } from "../../operations/client-versions";
-import { qoderMachineHostname, qoderMachineOs } from "../../operations/cli-platform";
 import { mapUpstreamHttpError } from "../../../transport/failure-policy";
-import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS, qoderDiscoveredMaxContexts } from "./qoder-catalog";
+import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS } from "./qoder-catalog";
 import { isQoderVirtualModel, qoderDispatchModelId } from "./qoder-virtual";
 import { isQoderPat, qoderOAuthAuth, qoderSessionId, resolveQoderAuth } from "./qoder-auth";
 import { buildQoderRequest, callQoder } from "./qoder-chat";
-import { buildQoderGrpcRequest, qoderGrpcMetadata, qoderGrpcToCanonicalEvents } from "./qoder-grpc";
-import { buildQoderIdeRequest, qoderBodyToCanonicalEvents } from "./qoder-ide";
+import { qoderBodyToCanonicalEvents } from "./qoder-sse";
 import { estimateQoderSessionCache } from "./qoder-cache";
 import {
   QODER_CHAT_PATH,
   QODER_PROVIDER_ID,
-  qoderIdeChatUrl,
   qoderInferenceCandidates,
   type QoderRealm,
 } from "./qoder-realm";
@@ -56,48 +49,23 @@ interface QoderAdapterOptions {
    * Which chat transport to dispatch on.
    *
    * `cosy` (default) = legacy COSY (`/algo/.../agent_chat_generation`) on
-   * `api1` → `api2` → `api3.qoder.sh` — the only surface verified alive
-   * (2026-11-07; the `api2-v2` model-server host is NXDOMAIN). This path also
-   * accepts free-tier rows (`lite`).
-   *
-   * `grpc` forces the gRPC surface (`model.chat.ChatService/ChatCompletionStream`)
-   * — **no longer the default**; its host is not verified alive.
-   *
-   * `ide` forces `/model/v1` — **probe/testing only, never production**
-   * (see module doc).
+   * the realm's gateway candidates (device tokens: `api1` → `api2` → `api3`;
+   * job tokens minted from a PAT: `api2` → `api1` only — `api3` answers
+   * `105 Login expired`). The `api2-v2` model-server host is NXDOMAIN, and
+   * the gRPC service is UNIMPLEMENTED on every host that resolves. This path
+   * also accepts free-tier rows (`lite`).
    */
-  readonly surface?: "grpc" | "cosy" | "ide";
+  readonly surface?: "cosy";
 }
 
 /** Resolves the transport for one dispatch. Exported for tests. */
-export function resolveQoderTransport(
-  surface: "grpc" | "cosy" | "ide" | undefined,
-  modelConfig: QoderModelConfig,
-): "grpc" | "cosy" | "ide" {
-  const chosen = surface ?? "cosy";
-  // `ide` is an explicit testing override — never auto-selected, and it does
-  // not apply the free-tier rule (a forced IDE call is a test call).
-  if (chosen === "ide") return "ide";
-  // Free-tier rows (`lite`) are refused on gRPC with `quota exceeded` (116);
-  // they must use the legacy COSY surface.
-  if (chosen === "grpc" && modelConfig.is_free === true) return "cosy";
-  return chosen;
-}
-
-/**
- * The widest selectable context window for one model key (from the live list's
- * `context_config`; falls back to the static roster's stated window).
- */
-function qoderMaxContextFor(modelId: string, modelConfig: QoderModelConfig, realm: QoderRealm): number {
-  const discovered = qoderDiscoveredMaxContexts(realm).get(modelId);
-  if (discovered !== undefined) return discovered;
-  return modelConfig.max_input_tokens;
+export function resolveQoderTransport(): "cosy" {
+  return "cosy";
 }
 
 class QoderAdapter implements ProviderAdapter {
   readonly provider_id: ProviderId;
   private readonly realm: QoderRealm;
-  private readonly surface: "grpc" | "cosy" | "ide";
   private readonly fetchFn: typeof fetch;
 
   constructor(options: QoderAdapterOptions = {}) {
@@ -110,7 +78,6 @@ class QoderAdapter implements ProviderAdapter {
     // mismatch that made `deepseek-v4.1-flash` fail while `qwen3.8-flash`
     // passed. This is the same default `resolveQoderTransport(undefined)`
     // already returns.
-    this.surface = options.surface ?? "cosy";
     this.fetchFn = options.fetch ?? globalThis.fetch;
   }
 
@@ -190,7 +157,7 @@ class QoderAdapter implements ProviderAdapter {
 
     const lifecycle = createUpstreamDeadlineLifecycle(context);
 
-    // Outbound fetch respects SSRF binding when provided
+    // Outbound fetch respects SSRF binding when provided.
     const outboundFetch: typeof fetch = (context.outbound_fetch as unknown as typeof fetch) ?? this.fetchFn;
 
     const fetcher: (url: string, init: RequestInit) => Promise<Response> = (url, init) =>
@@ -206,78 +173,6 @@ class QoderAdapter implements ProviderAdapter {
         : qoderOAuthAuth(secret, context.credential.auth_state, context.credential.account_id);
 
       // Transport selection — see module doc for the surface contract.
-      const forceIde = this.surface === "ide" || candidate.probe_surface === "ide";
-      const useGrpc = !forceIde && resolveQoderTransport(this.surface, modelConfig) === "grpc";
-
-      if (forceIde) {
-        const ideUrl = qoderIdeChatUrl(this.realm);
-        const ideBody = buildQoderIdeRequest(modelId, request, modelConfig, auth, this.realm, version);
-        // Header fingerprint mirrors the desktop client's IDE surface (`PFn` /
-        // `Hc`): X-Request-ID normalized to uppercase, Cosy-Version, real
-        // machine OS, and the sanitized hostname on infer SSE requests. The
-        // User-Agent is the real IDE client's (`Bun/1.4.4`, live capture) and
-        // `X-Session-ID` matches the body's session id (sha256 userId:model).
-        const ideHostname = qoderMachineHostname();
-        const res = await fetcher(ideUrl, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${auth.securityOauthToken}`,
-            "Content-Type": "application/json",
-            Accept: "text/event-stream",
-            "User-Agent": "Bun/1.4.4",
-            "X-Request-ID": randomUUID().toUpperCase(),
-            "X-Session-ID": qoderSessionId(auth.userId, modelId),
-            "Cosy-Version": version,
-            "Cosy-ClientType": "5",
-            "Cosy-MachineOS": qoderMachineOs(),
-            ...(ideHostname.length > 0 ? { "Cosy-MachineHostname": ideHostname } : {}),
-          },
-          body: JSON.stringify(ideBody),
-        });
-        if (!res.ok) throw await mapUpstreamHttpError(res, "qoder");
-        if (!res.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
-        lifecycle.release();
-        yield* this.#withSessionCacheEstimate(
-          qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId),
-          request,
-          qoderSessionId(auth.userId, modelId),
-        );
-        return;
-      }
-
-      if (useGrpc) {
-        // The gRPC request mirrors the HTTP surfaces' OpenAI-shaped body, so
-        // the shared builder supplies the messages, tool declarations, and
-        // tool-choice knobs both surfaces expect. Without the `tools` array
-        // the upstream sees no toolset and answers with a DSML text block (or
-        // claims no tool exists) instead of a structured `tool_calls`.
-        const legacy = buildQoderRequest(modelId, request, modelConfig, auth, this.realm);
-        const grpcRequest = buildQoderGrpcRequest(
-          modelId,
-          request,
-          auth.userId,
-          qoderMaxContextFor(modelId, modelConfig, this.realm),
-          {
-            messages: legacy.messages as Array<Record<string, unknown>>,
-            tools: legacy.tools as Array<Record<string, unknown>>,
-            ...(legacy.parameters === undefined
-              ? {}
-              : { parameters: legacy.parameters as Record<string, unknown> }),
-          },
-        );
-        const grpcMetadata = qoderGrpcMetadata(auth);
-        lifecycle.release();
-        yield* this.#withSessionCacheEstimate(
-          qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal, context.provider_capture),
-          request,
-          qoderSessionId(auth.userId, modelId),
-        );
-        return;
-      }
-
-      // Legacy COSY hosts are tried in order (api1 → api2 → api3) with the
-      // endpoint path from discovery when present. A network-level failure on
-      // one host falls through to the next; an HTTP error response surfaces as-is.
       const cosyCandidates = candidate.endpoint_path?.startsWith("http")
         ? [candidate.endpoint_path]
         : qoderInferenceCandidates(this.realm, auth.securityOauthToken).map(