cartethyia 2.7.9 → 2.8.1

package/src/providers/integrations/qoder/qoder-auth.ts

@@ -71,6 +71,7 @@ export function qoderOAuthAuth(
     securityOauthToken: secret,
     refreshToken: "",
     machineId: state.machineId || (accountId ? qoderMachineIdForAccount(accountId) : randomUUID()),
+    ...(state.httpDnsIp !== undefined ? { httpDnsIp: state.httpDnsIp } : {}),
   };
 }
 
@@ -114,6 +115,91 @@ export function qoderSessionId(userId: string, modelId: string): string {
 
 type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
 
+/** The fields a PAT→job-token exchange response carries. */
+export interface ExchangeQoderPatResult {
+  readonly token: string;
+  readonly name?: string;
+  readonly userType?: string;
+  readonly refreshToken?: string;
+  readonly expiresAt?: string;
+}
+
+/**
+ * One PAT→job-token exchange against an explicit endpoint URL. Shared by
+ * `exchangeQoderPat` (auth) and the claim flow: both POST the same v1 body
+ * (`{personal_token, machine_id?, machine_token?}`) with the client identity
+ * headers and parse the same response token. Parameterized by URL so each call
+ * site keeps its own verified host (`center.qoder.sh` vs the openapi host);
+ * the header set is the one verified live against both (2026-11-05/05).
+ * Returns the raw `Response` plus the parsed result (or `null` when the body
+ * carried no usable token); `null` itself means the request failed to reach
+ * upstream. Callers decide how to surface each case (throw vs null).
+ */
+export async function exchangeQoderPatForHost(args: {
+  readonly pat: string;
+  readonly url: string;
+  readonly machine?: { readonly id?: string; readonly token?: string };
+  readonly fetcher: QoderFetcher;
+  readonly signal: AbortSignal;
+  readonly version?: string;
+  /** Response keys to read the job token from, tried in order. Defaults to `["token"]`. */
+  readonly tokenKeys?: readonly string[];
+}): Promise<{ readonly response: Response; readonly result: ExchangeQoderPatResult | null } | null> {
+  const body: Record<string, unknown> = { personal_token: args.pat };
+  if (args.machine?.id) body.machine_id = args.machine.id;
+  if (args.machine?.token) body.machine_token = args.machine.token;
+  const version = args.version ?? getQoderVersion();
+  const tokenKeys = args.tokenKeys ?? ["token"];
+  let response: Response;
+  try {
+    response = await args.fetcher(args.url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": `qoder/${version}`,
+        "X-Request-ID": randomUUID().toUpperCase(),
+        "Cosy-ClientType": "5",
+        "Cosy-Version": version,
+        "Cosy-MachineOS": qoderMachineOs(),
+      },
+      body: JSON.stringify(body),
+      signal: args.signal,
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) return { response, result: null };
+  let responseBody: unknown;
+  try {
+    responseBody = await response.json();
+  } catch {
+    return { response, result: null };
+  }
+  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
+    return { response, result: null };
+  }
+  const rec = responseBody as Record<string, unknown>;
+  let token = "";
+  for (const key of tokenKeys) {
+    if (typeof rec[key] === "string" && (rec[key] as string).length > 0) {
+      token = rec[key] as string;
+      break;
+    }
+  }
+  if (token.length === 0) return { response, result: null };
+  return {
+    response,
+    result: {
+      token,
+      ...(typeof rec["name"] === "string" ? { name: rec["name"] as string } : {}),
+      ...(typeof rec["userType"] === "string" ? { userType: rec["userType"] as string } : {}),
+      ...(typeof rec["refresh_token"] === "string" ? { refreshToken: rec["refresh_token"] as string } : {}),
+      ...(typeof rec["expires_at"] === "string" ? { expiresAt: rec["expires_at"] as string } : {}),
+    },
+  };
+}
+
 /**
  * Exchanges a PAT (`pt-…`) for a short-lived job token (`jt-…`) using the
  * modern v1 endpoint. Verified live (2026-11-05): `POST
@@ -135,41 +221,28 @@ async function exchangeQoderPat(
   realm: QoderRealm = "intl",
 ): Promise<QoderAuth> {
   const machineId = qoderMachineIdFromPat(pat);
-  const response = await fetcher(QODER_REALMS[realm].jobTokenUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      "User-Agent": `qoder/${version}`,
-      "X-Request-ID": randomUUID().toUpperCase(),
-      "Cosy-ClientType": "5",
-      "Cosy-Version": version,
-      "Cosy-MachineOS": qoderMachineOs(),
-    },
-    body: JSON.stringify({ personal_token: pat, machine_id: machineId }),
+  const exchanged = await exchangeQoderPatForHost({
+    pat,
+    url: QODER_REALMS[realm].jobTokenUrl,
+    machine: { id: machineId },
+    fetcher,
     signal,
+    version,
   });
-  if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
-  let responseBody: unknown;
-  try {
-    responseBody = await response.json();
-  } catch {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned invalid JSON (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  if (exchanged === null) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange failed to reach upstream (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
   }
-  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned unexpected response (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
-  }
-  const rec = responseBody as Record<string, unknown>;
-  const token = typeof rec["token"] === "string" ? (rec["token"] as string) : "";
-  if (!token) {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned incomplete credentials (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
+  if (!exchanged.response.ok) throw await mapUpstreamHttpError(exchanged.response, "qoder");
+  const result = exchanged.result;
+  if (result === null) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned no usable token (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
   }
   return {
     userId: machineId,
-    userName: typeof rec["name"] === "string" ? (rec["name"] as string) : "",
-    userType: typeof rec["userType"] === "string" ? (rec["userType"] as string) : "personal_standard",
-    securityOauthToken: token,
-    refreshToken: typeof rec["refresh_token"] === "string" ? (rec["refresh_token"] as string) : "",
+    userName: result.name ?? "",
+    userType: result.userType ?? "personal_standard",
+    securityOauthToken: result.token,
+    refreshToken: result.refreshToken ?? "",
     machineId,
   };
 }
@@ -191,7 +264,13 @@ export async function resolveQoderAuth(input: {
 }): Promise<QoderAuth> {
   const realm = input.realm ?? "intl";
   if (isQoderPat(input.secret)) {
-    return await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
+    const auth = await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
+    // A PAT exchange never returns the account's identity; when the persisted
+    // auth_state also carries the HTTPDNS-route IP, carry it over so the COSY
+    // request mirrors the desktop client's `X-Qoder-HTTPDNS-IP` header.
+    const state = parseQoderOAuthState(input.authState);
+    if (state?.httpDnsIp !== undefined) auth.httpDnsIp = state.httpDnsIp;
+    return auth;
   }
   // Discovery is handed only the secret and the persisted state, so the
   // account id is read from that state — the same place `qoderOAuthAuth` reads

package/src/providers/integrations/qoder/qoder-catalog.ts

@@ -322,7 +322,7 @@ export function mapQoderCatalogResponse(raw: unknown): QoderCatalogEntry[] {
  * to a base-catalog/majority vote that can sit below the roster's ceiling
  * (e.g. `qwen3.7-plus` votes 64k while the roster says 131k).
  */
-function qoderRosterMaxOutputFor(providerId: string, key: string): number | undefined {
+export function qoderRosterMaxOutput(providerId: string, key: string): number | undefined {
   const configs = providerId === "qodercn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS;
   return configs[key]?.max_output_tokens;
 }
@@ -332,7 +332,7 @@ export function qoderCatalogModel(
   entry: QoderCatalogEntry,
   providerId: string,
 ): ModelDefinition {
-  const rosterOutput = qoderRosterMaxOutputFor(providerId, entry.key);
+  const rosterOutput = qoderRosterMaxOutput(providerId, entry.key);
   return defineModel({
     id: entry.key,
     providerId,
@@ -350,7 +350,7 @@ export function qoderCatalogModel(
     free: entry.isFree,
     freeTier: entry.isFree,
     // The live row carries no output ceiling, so inherit the static roster's
-    // stated one when it exists (see `qoderRosterMaxOutputFor`).
+    // stated one when it exists (see `qoderRosterMaxOutput`).
     ...(rosterOutput === undefined ? {} : { out: rosterOutput }),
     warnings: QODER_PROVIDER_WARNINGS,
   });
@@ -390,7 +390,7 @@ export type QoderSigner = (url: string, body: string) => Promise<Record<string,
  * `fetcher` is optional in the type but required at runtime, and there is
  * deliberately no global-`fetch` default: a test cannot reach the network by
  * accident, and production is forced through the SSRF-validated egress
- * (`network/outbound-fetch.ts`). That egress is a `node:http` path, which is
+ * (`network/egress/fetch.ts`). That egress is a `node:http` path, which is
  * also the only way a body reaches the wire on a GET — `fetch` itself rejects
  * `GET` + `body` with "request with GET/HEAD method cannot have body".
  */
@@ -446,6 +446,21 @@ export function qoderDiscoveredMaxContexts(realm: QoderRealm): ReadonlyMap<strin
   return discoveryMaxContextByKey.get(realm) ?? new Map();
 }
 
+/**
+ * The widest selectable context window for one model key.
+ *
+ * The live list's `context_config` is the authority when discovery has run:
+ * it names every window the account can switch to, and the widest one is what
+ * a dispatch should send (`model_config.max_input_tokens`) so a conversation is
+ * never capped at the *currently active* window (often 180k) when the account
+ * can use 1M. Falls back to the static roster's stated window otherwise.
+ */
+export function qoderMaxContextFor(modelId: string, modelConfig: QoderModelConfig, realm: QoderRealm): number {
+  const discovered = qoderDiscoveredMaxContexts(realm).get(modelId);
+  if (discovered !== undefined) return discovered;
+  return modelConfig.max_input_tokens;
+}
+
 export async function discoverQoderModels(input: {
   readonly realm: QoderRealm;
   /** Account secret the injected signer signs with; blank fails fast. */
@@ -526,7 +541,7 @@ export async function discoverQoderModels(input: {
         // is published.
         const virtuals = QODER_VIRTUAL_MODELS.filter((virtual) => virtual.target === entry.key);
         if (virtuals.length === 0) return [qoderCatalogModel(entry, providerId)];
-        const rosterOutput = qoderRosterMaxOutputFor(providerId, entry.key);
+        const rosterOutput = qoderRosterMaxOutput(providerId, entry.key);
         return virtuals.map((virtual) =>
           defineModel({
             id: virtual.id,
@@ -538,7 +553,7 @@ export async function discoverQoderModels(input: {
             reasoning: entry.isReasoning,
             // A virtual override wins; otherwise inherit the static roster's
             // ceiling for the slot instead of a base-catalog/majority estimate
-            // (see `qoderRosterMaxOutputFor`).
+            // (see `qoderRosterMaxOutput`).
             ...(virtual.outputLimit !== undefined
               ? { out: virtual.outputLimit }
               : rosterOutput === undefined

package/src/providers/integrations/qoder/qoder-chat.ts

@@ -4,8 +4,9 @@
  * `buildQoderRequest` translates one canonical request into the legacy
  * `/algo/.../agent_chat_generation` body (and, by reuse, the messages/tools
  * shared by the IDE and gRPC surfaces). `callQoder` signs and sends it over
- * the COSY surface with the real client's headers (Bun UA, machine identity,
- * `x-model-key/source`, SSE accept).
+ * the COSY surface with the app/worker's headers (undici UA, machine
+ * identity, business/scene app profile, `x-model-key/source`, SSE accept)
+ * and a zstd-compressed body (capture 2026-11-11).
  */
 import { createHash, randomUUID } from "node:crypto";
 import type {
@@ -14,10 +15,11 @@ import type {
 } from "../../../protocol/canonical-model";
 import { toolResultParts, toolCallParts } from "../../../protocol/canonical-model";
 import { reasoningEffortFromIntent } from "../../../protocol/reasoning";
+import { reasoningTextForReplay } from "../../../protocol/reasoning-text";
 import { resolveImageSource } from "../../../protocol/codecs";
 import { getQoderVersion } from "../../operations/client-versions";
-import { qoderDiscoveredMaxContexts, QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS } from "./qoder-catalog";
-import { transformQoderBody, qoderBuildCosyHeaders } from "./qoder-cosy";
+import { qoderMaxContextFor, qoderRosterMaxOutput } from "./qoder-catalog";
+import { transformQoderBody, qoderBuildCosyHeaders, type QoderCosyProfile } from "./qoder-cosy";
 import { qoderSessionId } from "./qoder-auth";
 import { flattenCanonicalContent, qoderToolChoice, qoderTools } from "./qoder-body";
 import type { QoderRealm } from "./qoder-realm";
@@ -69,12 +71,6 @@ function qoderStableRecordId(modelId: string, messages: CanonicalRequest["messag
  * never capped at the *currently active* window (often 180k) when the account
  * can use 1M. Falls back to the static roster's stated window otherwise.
  */
-function qoderMaxContextFor(modelId: string, modelConfig: QoderModelConfig, realm: QoderRealm): number {
-  const discovered = qoderDiscoveredMaxContexts(realm).get(modelId);
-  if (discovered !== undefined) return discovered;
-  return modelConfig.max_input_tokens;
-}
-
 function qoderRequestedMaxTokens(
   request: CanonicalRequest,
   modelConfig: QoderModelConfig,
@@ -91,7 +87,7 @@ function qoderRequestedMaxTokens(
   const configured =
     typeof modelConfig.max_output_tokens === "number"
       ? modelConfig.max_output_tokens
-      : qoderRosterMaxOutput(modelConfig.id, realm) ?? 65_536;
+      : qoderRosterMaxOutput(realm === "cn" ? "qodercn" : "qoder", modelConfig.id) ?? 65_536;
   const controls = request.generation_controls as Record<string, unknown>;
   const requested =
     typeof controls["max_tokens"] === "number"
@@ -102,17 +98,6 @@ function qoderRequestedMaxTokens(
   return typeof requested === "number" && requested > 0 ? Math.min(requested, configured) : configured;
 }
 
-/**
- * The static roster's stated output ceiling for one key, when the roster states
- * one. Dispatch builds a live-discovered model's config without an output limit
- * (upstream's model list reports none); this lookup restores the roster's
- * ceiling so such a model is not capped at the 65_536 last resort.
- */
-function qoderRosterMaxOutput(modelId: string, realm: QoderRealm): number | undefined {
-  const configs = realm === "cn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS;
-  return configs[modelId]?.max_output_tokens;
-}
-
 /**
  * Whether this model needs the prior turn's reasoning echoed back.
  *
@@ -159,7 +144,9 @@ function qoderReasoningEcho(
     return hasReasoningTrace ? { reasoning_content: "" } : {};
   }
   const text = reasoning
-    .map((part) => (part.kind === "reasoning" ? (part.summary ?? part.payload ?? "") : ""))
+    .map((part) =>
+      part.kind === "reasoning" ? (reasoningTextForReplay(part) ?? part.payload ?? "") : "",
+    )
     .join("");
   return { reasoning_content: text };
 }
@@ -448,7 +435,7 @@ export function buildQoderRequest(
       // for every model alike, so the request would declare a cap the catalog
       // does not publish. A discovered model's config carries no output limit,
       // so consult the roster for the key before the 65_536 last resort.
-      max_output_tokens: modelConfig.max_output_tokens ?? qoderRosterMaxOutput(modelId, realm) ?? 65_536,
+      max_output_tokens: modelConfig.max_output_tokens ?? qoderRosterMaxOutput(realm === "cn" ? "qodercn" : "qoder", modelId) ?? 65_536,
       source: modelConfig.source ?? "system",
     },
     messages: qoderMessages,
@@ -483,8 +470,11 @@ type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
 
 /**
  * Signs and sends one legacy COSY chat request. The body is alphabet-scrambled
- * before signing; headers come from `qoderBuildCosyHeaders` plus the modern
- * `x-model-key`/`x-model-source` and SSE accepts.
+ * then zstd-compressed (as the desktop worker does on the wire, capture
+ * 2026-11-11) before signing; headers come from `qoderBuildCosyHeaders` plus
+ * the modern `x-model-key`/`x-model-source` and SSE accepts. When the runtime
+ * lacks zstd the scrambled body is sent uncompressed, matching the older CLI
+ * wire.
  */
 export async function callQoder(
   url: string,
@@ -494,21 +484,34 @@ export async function callQoder(
   signal: AbortSignal,
   fetcher: QoderFetcher,
   version = getQoderVersion(),
+  profile: QoderCosyProfile = "app",
 ): Promise<Response> {
   const encoded = transformQoderBody(JSON.stringify(body));
   const modelConfig = (body["model_config"] as Record<string, unknown> | null) ?? null;
+  // The desktop worker compresses the scrambled body with zstd and stamps
+  // `Content-Encoding: zstd` (capture 2026-11-11), but the COSY signature is
+  // verified over the *scrambled* body — the server decompresses before
+  // verifying (proven live 2026-11-11: signing over the zstd bytes returns
+  // `403 Signature invalid`). The CLI sends the plain scrambled body. Fall
+  // back to the plain scrambled body (no encoding header) when the runtime
+  // lacks zstd.
+  const compressed =
+    profile === "app" && typeof Bun?.zstdCompressSync === "function"
+      ? (Bun.zstdCompressSync(Buffer.from(encoded)) as Uint8Array<ArrayBuffer>)
+      : undefined;
+  const wireBody = (compressed ?? encoded) as unknown as Uint8Array;
   return fetcher(url, {
     method: "POST",
     headers: {
-      ...qoderBuildCosyHeaders(encoded, url, auth, version),
+      ...qoderBuildCosyHeaders(encoded, url, auth, version, profile),
       ...(MODERN_PROFILE.sendModelSourceHeaders
         ? { "x-model-key": modelId, "x-model-source": typeof modelConfig?.["source"] === "string" ? (modelConfig["source"] as string) : "system" }
         : {}),
       Accept: "text/event-stream",
       "Cache-Control": "no-cache",
-      "Accept-Encoding": "identity",
+      ...(compressed === undefined ? {} : { "Content-Encoding": "zstd" }),
     },
-    body: encoded as unknown as BodyInit,
+    body: wireBody as unknown as BodyInit,
     signal,
   });
 }

package/src/providers/integrations/qoder/qoder-checkin.ts

@@ -32,7 +32,7 @@ import { log } from "../../../observability/logger";
 
 /** Structural fetch bound; Bun's own fetch type carries extra host props. */
 type Fetcher = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-import type { DailyCheckinResult, DailyCheckinState } from "../buddy/buddy-checkin";
+import type { DailyCheckinResult, DailyCheckinState } from "../buddy/lifecycle";
 
 export const QODER_CHECKIN_PROVIDER_IDS: readonly string[] = ["qoder", "qodercn"];
 
@@ -79,12 +79,12 @@ function campaignHeaders(credential: string): Record<string, string> {
   return buildCampaignHeaders(credential);
 }
 
-function asRecord(value: unknown): Record<string, unknown> | null {
+export function asRecord(value: unknown): Record<string, unknown> | null {
   if (typeof value !== "object" || value === null) return null;
   return value as Record<string, unknown>;
 }
 
-function asNumber(value: unknown): number | null {
+export function asNumber(value: unknown): number | null {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim() !== "") {
     const parsed = Number(value);
@@ -93,7 +93,7 @@ function asNumber(value: unknown): number | null {
   return null;
 }
 
-function safeParse(raw: string): unknown {
+export function safeParse(raw: string): unknown {
   try {
     return JSON.parse(raw);
   } catch {
@@ -127,7 +127,7 @@ function asState(state: string, today: string, lastClaimedAt: unknown): { active
  * consumes. The API returns camelCase keys (`campaignId`, `actionType`,
  * `claimStatus`); the fixtures and the donor hub use snake_case — accept both.
  */
-function normalizeCampaign(raw: Record<string, unknown>): Record<string, unknown> {
+export function normalizeCampaign(raw: Record<string, unknown>): Record<string, unknown> {
   const benefit = asRecord(raw["benefit"]);
   return {
     campaign_id: String(raw["campaignId"] ?? raw["campaign_id"] ?? ""),

package/src/providers/integrations/qoder/qoder-cosy.ts

@@ -7,14 +7,22 @@
  * Header values mirror live captures of the real client (v1.1.83,
  * 2026-11-05): `User-Agent: Bun/1.4.2`, machine identity headers from the
  * UMID (`cosy-machineid/token/type/code/os/hostname`), business headers,
- * and the static `signature` md5 chain.
+ * and the static `signature` md5 chain. The business/scene/clienttype values
+ * were updated to the desktop-worker capture (2026-11-11, v0.5.7 /
+ * 1.1.79-hotfix.19): `cosy-clienttype: 10`, `cosy-business-product: app`,
+ * `cosy-scene: app`, plus `traceparent`, `sec-fetch-mode: cors`, and
+ * `accept-language: *`. The `profile` switch selects the identity: `app`
+ * (default, desktop worker) or `cli` (qodercli).
  */
-import { constants, createCipheriv, createHash, publicEncrypt, randomUUID } from "node:crypto";
+import { constants, createCipheriv, createHash, publicEncrypt, randomBytes, randomUUID } from "node:crypto";
 import { getQoderVersion } from "../../operations/client-versions";
 import { qoderMachineHostname, qoderMachineOs } from "../../operations/cli-platform";
-import { QODER_UA_CLI } from "./qoder-realm";
+import { QODER_UA_APP, QODER_UA_CLI } from "./qoder-realm";
 import type { QoderAuth } from "./qoder-types";
 
+/** Which Qoder client identity a COSY request presents. */
+export type QoderCosyProfile = "app" | "cli";
+
 const QODER_APPCODE = "cosy";
 const QODER_SIG_SECRET = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
 const QODER_STANDARD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
@@ -83,6 +91,7 @@ export function qoderBuildCosyHeaders(
   url: string,
   auth: QoderAuth,
   version = getQoderVersion(),
+  profile: QoderCosyProfile = "app",
 ): Record<string, string> {
   const key = randomUUID().replaceAll("-", "").slice(0, 16);
   const identity = qoderJsonSortedCompact({
@@ -104,12 +113,17 @@ export function qoderBuildCosyHeaders(
   ).toString("base64");
   const date = String(Math.floor(Date.now() / 1000));
   const signature = qoderMd5(`${payload}\n${cosyKey}\n${date}\n${Buffer.from(body).toString("latin1")}\n${qoderPathSignature(url)}`);
+  const traceId = randomBytes(16).toString("hex");
+  const spanId = randomBytes(8).toString("hex");
+  const app = profile === "app";
   return {
     authorization: `Bearer COSY.${payload}.${signature}`,
     "cosy-data-policy": "agree",
     "cosy-machinetype": auth.machineType ?? "5",
     "cosy-machineos": qoderMachineOs(),
-    "cosy-clienttype": "5",
+    // Desktop-worker capture (2026-11-11): `cosy-clienttype: 10` identifies
+    // the app/worker client; the CLI used `5`.
+    "cosy-clienttype": app ? "10" : "5",
     "cosy-date": date,
     "cosy-user": auth.userId,
     "cosy-key": cosyKey,
@@ -123,19 +137,32 @@ export function qoderBuildCosyHeaders(
     "cosy-organization-id": "",
     "cosy-organization-tags": "",
     "x-request-id": randomUUID(),
-    "cosy-business-product": "cli",
+    ...(auth.httpDnsIp !== undefined && auth.httpDnsIp.length > 0
+      ? { "X-Qoder-HTTPDNS-IP": auth.httpDnsIp }
+      : {}),
+    // Desktop-worker capture (2026-11-11): `cosy-business-product: app` and
+    // `cosy-scene: app` mirror the app/worker surface; the CLI used
+    // `cli`/`assistant`.
+    "cosy-business-product": app ? "app" : "cli",
     "cosy-business-type": "agent",
     "cosy-business-version": version,
-    "cosy-scene": "assistant",
+    "cosy-scene": app ? "app" : "assistant",
     "cosy-version": version,
     "login-version": "v2",
     appcode: QODER_APPCODE,
     accept: "application/json",
-    "accept-encoding": "identity",
+    // Desktop-worker capture (2026-11-11): `br, gzip, deflate`. The CLI
+    // sends `identity`.
+    "accept-encoding": app ? "br, gzip, deflate" : "identity",
+    "accept-language": app ? "*" : "",
+    "sec-fetch-mode": app ? "cors" : "",
+    // W3C trace context, as the worker's undici fetch emits it (capture
+    // 2026-11-11): `00-<traceid>-<spanid>-01`.
+    ...(app ? { traceparent: `00-${traceId}-${spanId}-01` } : {}),
     date: new Date().toUTCString(),
     signature: qoderMd5(`${QODER_APPCODE}&${QODER_SIG_SECRET}&${new Date().toUTCString()}`),
     "content-type": "application/json",
-    "user-agent": QODER_UA_CLI,
+    "user-agent": app ? QODER_UA_APP : QODER_UA_CLI,
   };
 }
 
@@ -150,9 +177,10 @@ export function qoderBuildCosyHeaders(
 export function qoderSignerFor(
   auth: QoderAuth,
   version = getQoderVersion(),
+  profile: QoderCosyProfile = "app",
 ): (url: string, body: string) => Record<string, string> {
   return (url: string, body: string): Record<string, string> =>
-    qoderBuildCosyHeaders(Buffer.from(body, "latin1"), url, auth, version);
+    qoderBuildCosyHeaders(Buffer.from(body, "latin1"), url, auth, version, profile);
 }
 
 /** Qoder's own base64 alphabet transform, for a request body. */

package/src/providers/integrations/qoder/qoder-oauth.ts

@@ -146,6 +146,12 @@ const EXPIRY_FALLBACK_MS = 30 * 24 * 60 * 60 * 1000;
 export interface QoderOAuthState {
   readonly userId: string;
   readonly machineId: string;
+  /**
+   * Resolved egress IP for the HTTPDNS-managed route, when the login stored
+   * it. Mirrors the worker's `networkMode=httpdns` state; the request then
+   * carries `X-Qoder-HTTPDNS-IP`.
+   */
+  readonly httpDnsIp?: string;
 }
 
 /** Reads the persisted Qoder identity; `undefined` when the account predates it. */
@@ -166,7 +172,8 @@ export function parseQoderOAuthState(value: unknown): QoderOAuthState | undefine
   const userId = nonEmptyTrimmedString(root.userId);
   const machineId = nonEmptyTrimmedString(root.machineId);
   if (userId === undefined || machineId === undefined) return undefined;
-  return { userId, machineId };
+  const httpDnsIp = nonEmptyTrimmedString(root.httpDnsIp);
+  return httpDnsIp === undefined ? { userId, machineId } : { userId, machineId, httpDnsIp };
 }
 
 
@@ -382,7 +389,7 @@ export class QoderOAuthClient extends OAuthDeviceFlow {
       `&verifier=${encodeURIComponent(state.verifier)}&challenge_method=S256`;
     let response: Response;
     try {
-      response = await this.fetchFn(url, {
+      response = await this.fetchFor(context)(url, {
         method: "GET",
         headers: { accept: "application/json", "user-agent": QODER_UA_CLI },
         signal: AbortSignal.timeout(POLL_TIMEOUT_MS),

package/src/providers/integrations/qoder/qoder-realm.ts

@@ -53,48 +53,23 @@ export interface QoderRealmConfig {
  * - CLI / legacy COSY chat + device flow: `Bun/1.4.2` (flow 218/030, v1.1.83)
  * - IDE surface `/model/v1`: `Bun/1.4.4` (flow 219)
  * - job-token exchange: `qoder/<version>` (capture, e.g. `qoder/1.1.83`)
+ *
+ * The desktop app (0.5.7) hosts an Electron Node worker
+ * (`qoder-worker-runtime.obf.mjs --sdk`) whose fetch stack is undici; its
+ * chat/worker requests carry `User-Agent: undici` (capture 2026-11-11).
+ * The gateway mirrors the app wire on the COSY chat surface, so chat uses
+ * `QODER_UA_APP`; the CLI/device-flow surfaces keep `QODER_UA_CLI`.
  */
 export const QODER_UA_CLI = "Bun/1.4.2";
 export const QODER_UA_IDE = "Bun/1.4.4";
+export const QODER_UA_APP = "undici";
 
 /** Chat + model-list paths, identical across realms. */
 export const QODER_CHAT_PATH =
   "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1";
 export const QODER_MODELS_PATH = "/algo/api/v2/model/list?Encode=1";
 
-/**
- * The modern model-server surface used by the IDE / QoderWake (OpenAI-shaped
- * chunks, plain bearer auth). This surface streams immediately and echoes the
- * real model key — the legacy `/algo` chat endpoint answers
- * `10605 isQueued` (parking requests in a server-side queue) and echoes a
- * fixed `"auto"` model. Dispatch tries this surface first, and falls back to
- * legacy COSY only when it refuses the account on entitlement grounds (HTTP
- * 402 / `{"code":116}`) AND the dispatched model is a free-tier row — for a
- * billed model the same code is genuine quota exhaustion and must surface.
- */
-export const QODER_IDE_CHAT_PATH = "/model/v1/chat/completions";
-
 /** The model-server host for one realm (intl: `api1`, cn: gateway). */
-export function qoderIdeChatUrl(realm: QoderRealm): string {
-  return realm === "cn"
-    ? `https://gateway.qoder.com.cn${QODER_IDE_CHAT_PATH}`
-    : `https://api1.qoder.sh${QODER_IDE_CHAT_PATH}`;
-}
-
-/**
- * The gRPC model-server host for one realm.
- *
- * Intl default is `api1.qoder.sh` (first host from `qoderInferenceCandidates`;
- * the old `api2-v2.qoder.sh` has been NXDOMAIN since 2026-11-07 — see
- * `documentation/research/qoder/live/
- * 2026-11-07-qoder-host-inference-fallback.md`). The gRPC service is no
- * longer verified alive on any host that resolves (UNIMPLEMENTED); this host
- * is kept as the target so probes/gRPC still have an address.
- */
-export function qoderGrpcHost(realm: QoderRealm): string {
-  return realm === "cn" ? "gateway.qoder.com.cn" : "api1.qoder.sh";
-}
-
 /**
  * Realm → deployment.
  *
@@ -142,8 +117,9 @@ export function qoderGatewayCandidates(realm: QoderRealm): readonly string[] {
  * Inference hosts for one realm, ordered by token kind — mirrors the donor's
  * `qoderInferenceBase` (donor hub): job tokens (`jt-...`) are served by `api2`
  * and get rejected by `api3` with "Login expired" (403), while device tokens
- * (`dt-...`) and everything else use the ordinary gateway set. CN has a
- * single gateway and serves every token kind.
+ * (`dt-...`) and everything else use the ordinary gateway set. The job-token
+ * set therefore excludes `api3` entirely; CN has a single gateway and serves
+ * every token kind.
  */
 export function qoderInferenceCandidates(
   realm: QoderRealm,
@@ -152,8 +128,9 @@ export function qoderInferenceCandidates(
   const config = QODER_REALMS[realm];
   if (realm === "cn") return [config.gateway];
   if (token !== undefined && token.startsWith("jt-")) {
-    const fallbacks = config.gatewayFallbacks.filter((h) => h !== "https://api2.qoder.sh");
-    return ["https://api2.qoder.sh", config.gateway, ...fallbacks];
+    // api3 rejects job tokens (Login expired, 403); only api2 and api1 can
+    // serve them.
+    return ["https://api2.qoder.sh", config.gateway];
   }
   return [config.gateway, ...config.gatewayFallbacks];
 }