cartethyia 2.8.0 → 2.8.1

package/src/boot/dependencies.ts

@@ -43,12 +43,10 @@ import { InMemoryIpAbuseStore, IpAbuseProtectionService, RedisIpAbuseStore, type
 import { checkReadiness } from "../persistence/readiness";
 import { ProxyRequestPreparer } from "../transport/request/preparer";
 import { DrizzleNetworkPoolLoader } from "../network/pool/loader";
-import {
-  PoolAgentResolver,
-  ValidatedNetworkBindingFactory,
-} from "../network/pool/resolver";
+import { PoolAgentResolver } from "../network/pool/resolver";
+import { ValidatedNetworkBindingFactory } from "../network/egress/factory";
 import { NetworkPoolSelector } from "../network/pool/selector";
-import { restorePoolProbeVerdicts, restoreProviderCooldownMarkers } from "../network/pool-cooldown-store";
+import { restorePoolProbeVerdicts, restoreProviderCooldownMarkers } from "../network/pool/cooldown-store";
 import { ScheduledTaskRegistry } from "../workers/scheduler";
 import { quotaRefreshSweep } from "../workers/quota-refresh-sweep";
 import { registerZcodeGiftClaimTask } from "../workers/zcode-gift-claim";
@@ -67,7 +65,7 @@ import { preferencesReaderFor } from "../persistence/tenant-preferences";
 import { sweepExpiredCooldowns } from "../providers/operations/account-health-service";
 import { DrizzleTelemetryStore } from "../persistence/stores/telemetry-store";
 import { TelemetryPayloadCapture } from "../observability/payload-capture";
-import { sweepExpiredPoolCooldowns } from "../network/pool-health-machine";
+import { sweepExpiredPoolCooldowns } from "../network/pool/health";
 import { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
 import { RuntimeMetricsSampler } from "../observability/runtime-metrics";
 import {

package/src/config/providers.ts

@@ -94,11 +94,12 @@ export function resolveGithubEnterpriseDomain(): string {
 export type GithubCopilotMode = "opencode-copilot" | "vscode-client-real";
 
 /**
- * Which GitHub Copilot wire identity the adapter uses. Defaults to
- * `opencode-copilot` (raw GitHub OAuth token + minimal OpenCode headers),
- * which is the proven-most-stable path (one token, no mint expiry). The
- * `vscode-client-real` mode matches the VS Code reference client exactly but
- * requires a freshly minted Copilot token.
+ * Selects the complete GitHub Copilot profile for OAuth login/refresh,
+ * inference, discovery, and quota identity. `opencode-copilot` is the default
+ * and uses the raw GitHub OAuth token with OpenCode identity. `vscode-client-real`
+ * uses the VS Code OAuth app and a minted Copilot token. Existing accounts must
+ * be re-authenticated after changing profiles; the upstream OAuth app binding
+ * prevents converting credentials between profiles.
  */
 export function resolveGithubCopilotMode(): GithubCopilotMode {
   const raw = readText(

package/src/config/spec.ts

@@ -326,15 +326,15 @@ export const CONFIG_SPEC = {
    */
   CARTETHYIA_GITHUB_ENTERPRISE_DOMAIN: { kind: "text", default: "" },
   /**
-   * Which wire identity the GitHub Copilot Auto/chat path presents to the
-   * upstream:
+   * Selects the complete GitHub Copilot OAuth and wire profile:
    *
-   * - `opencode-copilot` (default): the long-lived GitHub OAuth token + minimal
-   *   OpenCode headers. One token, no mint step, no short-lived minted-token
-   *   expiry. This is the most stable in practice.
-   * - `vscode-client-real`: a freshly minted Copilot token + the full VS Code
-   *   reference headers. Matches the VS Code client exactly, but requires the
-   *   minted token (expires ~25 min) and the reference identity.
+   * - `opencode-copilot` (default): OpenCode OAuth app, raw GitHub token, and
+   *   OpenCode identity for login, refresh, inference, discovery, and quota.
+   * - `vscode-client-real`: VS Code OAuth app, minted Copilot token, and the
+   *   VS Code reference identity for those surfaces.
+   *
+   * Restart after changing this setting and re-authenticate GitHub accounts;
+   * OAuth credentials cannot be converted between the two upstream apps.
    */
   CARTETHYIA_GITHUB_COPILOT_MODE: { kind: "text", default: "opencode-copilot" },
   // Only the literal true opts active ZCode accounts into daily gift claims.

package/src/console/backup/nine-router.ts

@@ -23,6 +23,7 @@ import type { BackupPayload, BackupRow } from "./contracts";
 import { BACKUP_APP, BACKUP_VERSION } from "./contracts";
 import { isRecord } from "../../protocol/codecs";
 import { hashSecret } from "../../security/crypto";
+import { resolveGithubCopilotMode, resolveGithubEnterpriseDomain } from "../../config/providers";
 import {
   AUTH_STATE_KEYS,
   COMBO_STRATEGIES,
@@ -100,6 +101,24 @@ interface ResolvedConnectionCredential {
   readonly value: string;
   readonly kind: "api_key" | "oauth";
 }
+
+/** The provider-specific rebinding a router export may need before it becomes our envelope. */
+export interface ImportedProviderCredential {
+  readonly credential: string;
+  readonly profile: "opencode-copilot" | "vscode-client-real";
+  readonly refreshToken?: string;
+  readonly expiresAt: Date;
+  readonly requiresRefresh: boolean;
+  readonly warnings: readonly string[];
+}
+
+export type ImportedProviderCredentialBinder = (
+  value: string,
+  refreshValue: string | null | undefined,
+  profile: "opencode-copilot" | "vscode-client-real",
+  domain: string,
+  expiresAt?: Date,
+) => ImportedProviderCredential;
 function credentialOf(entry: Row, provider: string): ResolvedConnectionCredential | null {
   const apiKey = text(entry.apiKey);
   const accessToken = text(entry.accessToken);
@@ -128,7 +147,7 @@ function credentialOf(entry: Row, provider: string): ResolvedConnectionCredentia
  * we have no such provider — a set entry with no provider behind it would
  * classify a row that can never import.
  */
-const OAUTH_PROVIDERS = new Set(["claude", "codex", "antigravity", "kimi", "cline"]);
+const OAUTH_PROVIDERS = new Set(["claude", "codex", "antigravity", "kimi", "cline", "github"]);
 
 /** The non-secret per-account config, as our `auth_state` bag. */
 function authStateOf(entry: Row): Record<string, unknown> {
@@ -223,7 +242,11 @@ function modelReference(
  * leaving them null would make them global, i.e. visible to every tenant, which
  * an import must never do implicitly.
  */
-export function convert9RouterBackup(input: unknown, tenantId: string): ConversionResult {
+export function convert9RouterBackup(
+  input: unknown,
+  tenantId: string,
+  importBinders: Readonly<Record<string, ImportedProviderCredentialBinder>> = {},
+): ConversionResult {
   if (typeof input !== "object" || input === null || Array.isArray(input)) {
     throw new Error("router backup must be a JSON object");
   }
@@ -273,6 +296,32 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
     }
     const accountId = crypto.randomUUID();
     const kind = credential.kind;
+    const specific = isRecord(entry.providerSpecificData) ? entry.providerSpecificData : {};
+    const importedRefresh = text(entry.refreshToken);
+    const sourceExpiry = typeof entry.expiresAt === "string" && Number.isFinite(Date.parse(entry.expiresAt))
+      ? new Date(entry.expiresAt)
+      : undefined;
+    const importBinder = provider === "github" && kind === "oauth" ? importBinders.github : undefined;
+    let githubBinding: ImportedProviderCredential | undefined;
+    if (importBinder !== undefined) {
+      try {
+        githubBinding = importBinder(
+          credential.value,
+          importedRefresh,
+          resolveGithubCopilotMode(),
+          resolveGithubEnterpriseDomain() || "github.com",
+          sourceExpiry,
+        );
+      } catch (error) {
+        // One malformed row must not take the rest of the backup down with it.
+        // The row is reported and left out; the operator can re-authenticate it.
+        skipped.push(`${label}: GitHub Copilot credential could not be bound: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+      }
+    }
+    const storedCredential = githubBinding?.credential ?? credential.value;
+    const storedRefresh = githubBinding?.refreshToken ?? importedRefresh;
+    const storedAuthState = authStateOf(entry).auth_state;
     accounts.push({
       id: accountId,
       provider_id: provider,
@@ -282,7 +331,7 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
       // `SEALED_COLUMNS`. The store re-seals it under this instance's key on the
       // way in; sealing it here would put ciphertext in a payload whose only
       // portable form is the plaintext, and the restore would drop it.
-      access_token: credential.value,
+      access_token: storedCredential,
       credential_kind: kind,
       status: bool(entry.isActive, true) ? "active" : "disabled",
       consecutive_failures: 0,
@@ -292,29 +341,41 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
       // rather than invented — a lower number means the operator wants it used
       // first, and the column means the same thing.
       sort_index: typeof entry.priority === "number" && Number.isFinite(entry.priority) ? entry.priority : 0,
-      ...(authStateOf(entry)),
+      ...(githubBinding === undefined
+        ? (storedAuthState === undefined ? {} : { auth_state: storedAuthState })
+        : {
+            auth_state: {
+              ...(isRecord(storedAuthState) ? storedAuthState : {}),
+              github_copilot_profile: githubBinding.profile,
+            },
+          }),
       ...(emailOf(entry)),
       created_at: { __date: isoDate(entry.createdAt, now) },
     });
     connectedProviders.add(provider);
     // The refresh token is a second secret on the same account, so it gets its
     // own sealed row rather than being folded into the credential.
-    const specific = isRecord(entry.providerSpecificData) ? entry.providerSpecificData : {};
-    const refresh = text(entry.refreshToken);
     const clientSecret = text(specific.clientSecret);
-    if (refresh !== null || clientSecret !== null) {
+    for (const warning of githubBinding?.warnings ?? []) {
+      warnings.push(`account "${label}": ${warning}`);
+    }
+    if (storedRefresh !== null || clientSecret !== null || githubBinding?.requiresRefresh === true) {
       // A companion secret authorizes a refresh, so on its own it has nothing to
       // authorize. It is still carried rather than dropped, and the report says
       // why it is inert — a secret lost without a word is how an operator
       // discovers the loss from a failed refresh days later.
-      if (clientSecret !== null && refresh === null) {
+      if (clientSecret !== null && storedRefresh === null) {
         warnings.push(`account "${label}": carried a client secret with no refresh token; it cannot authorize a refresh`);
       }
       oauthStates.push({
         provider_account_id: accountId,
-        ...(refresh === null ? {} : { refresh_token: refresh }),
+        ...(storedRefresh === null ? {} : { refresh_token: storedRefresh }),
         ...(clientSecret === null ? {} : { client_secret: clientSecret }),
-        ...(typeof entry.expiresAt === "string" ? { expires_at: { __date: isoDate(entry.expiresAt, now) } } : {}),
+        ...(githubBinding !== undefined
+          ? { expires_at: { __date: githubBinding.expiresAt.toISOString() } }
+          : typeof entry.expiresAt === "string"
+            ? { expires_at: { __date: isoDate(entry.expiresAt, now) } }
+            : {}),
       });
     }
   });

package/src/console/backup/service.ts

@@ -311,7 +311,14 @@ export class BackupService {
     }
 
     if (detected.kind === "nine_router") {
-      const { payload: converted, report } = convert9RouterBackup(detected.payload, tenantId);
+      // dynamic-import: lazy OAuth graph — pulling the Github OAuth client into
+      // the console boot graph would make every console route pay for it.
+      const { bindImportedGithubCredential } = await import(
+        "../../providers/integrations/github/github-oauth"
+      );
+      const { payload: converted, report } = convert9RouterBackup(detected.payload, tenantId, {
+        github: bindImportedGithubCredential,
+      });
       const result = await this.apply(converted, tenantId, selection);
       return { ...result, report, format: "nine_router" };
     }

package/src/console/console-router.ts

@@ -33,7 +33,7 @@ import { DrizzleCliToolSecretSource } from "./cli-tools/secret-source";
 import type { ShareLinkStore } from "../persistence/stores/share-store";
 import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
-import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../network/egress/factory";
 import type { TrustedProxyBoundary } from "../config/network";
 import type { IpAbuseStore } from "../security/abuse";
 import { gzipResponse } from "./response-compression";

package/src/console/domain-registration.ts

@@ -65,7 +65,7 @@ import {
 } from "../persistence/stores/share-store";
 import { createShareUsagePort } from "./share/share-usage";
 import { resolveSsrfPolicy } from "../config/network";
-import { createValidatedFetch } from "../network/outbound-fetch";
+import { createValidatedFetch } from "../network/egress/fetch";
 import type { AuditRecorder } from "./auth/audit-recorder";
 import type { CliToolService } from "./cli-tools/service";
 import type { NetworkPoolSelector } from "../network/pool/selector";
@@ -77,7 +77,7 @@ import { resolveRedisBackend } from "../persistence/redis";
 import type { RedisClient } from "../persistence/redis";
 import type { ProviderRegistry } from "../providers/provider-registry";
 import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
-import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../network/egress/factory";
 import type { CartethyiaDatabase } from "../persistence/db-handle";
 import type { ConsoleAccessResolver } from "./auth/access";
 
@@ -434,6 +434,11 @@ export function registerConsoleDomains(
     accessResolver: ctx.accessResolver,
     snapshotInvalidator: ctx.routeSnapshotService,
     callbackListener: oauthCallbackListener,
+    deviceEgress: {
+      db: ctx.db,
+      poolSelector: ctx.poolSelector,
+      networkBindingFactory: ctx.networkBindingFactory,
+    },
   };
   console.use(createOAuthLoginRoutes(oauthConfig));
 }

package/src/console/inferhub/client.ts

@@ -13,7 +13,7 @@
  *   and a failure returns `undefined` — never a half-parsed object that a route
  *   would render as if it were good.
  */
-import { createValidatedFetch, type ValidatedFetch } from "../../network/outbound-fetch";
+import { createValidatedFetch, type ValidatedFetch } from "../../network/egress/fetch";
 
 export const INFERHUB_API_BASE = "https://inferhub.dev/api";
 

package/src/console/observability/live.ts

@@ -29,8 +29,8 @@ import type { NetworkPoolSelector } from "../../network/pool/selector";
 import { eq } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { networkPools } from "../../persistence/schema";
-import { subscribePoolHealth } from "../../network/pool-health-machine";
-import { poolByteSnapshot } from "../../network/pool/byte-accounting";
+import { subscribePoolHealth } from "../../network/pool/health";
+import { poolByteSnapshot } from "../../network/pool/accounting";
 import { consoleSseResponse, createConsoleSseStream } from "./sse";
 import { subscribeRequestCompleted } from "../../observability/request-notify";
 

package/src/console/providers/catalog/contracts.ts

@@ -83,9 +83,6 @@ export interface ProviderAccountBulkActionResult {
   readonly globalSkipped: number;
 }
 
-/** Cap on one discovery-commit request (D29). Kept pure (no `node:*`) so the dashboard can import it. */
-export { DISCOVER_MODEL_COMMIT_MAX } from "./discover-constants";
-
 /**
  * One model the provider's own listing advertised, projected for the Add-Model
  * picker. Read-only: `GET .../models/discover` writes nothing. `models`
@@ -610,6 +607,9 @@ export interface ProviderAccountResponse {
   providerId: string;
   tenantId: string | null;
   label: string;
+  /** Structured identity learned from an OAuth login, when the provider exposed one. */
+  accountEmail?: string;
+  accountName?: string;
   credentialKind: CredentialKind;
   credentialMode?: CredentialMode;
   /**
@@ -1056,6 +1056,10 @@ export interface ProviderRoutingResponse {
    * default to skipping because their transport can't route through an HTTP
    * CONNECT proxy; it stays a real, per-tenant-overridable setting. */
   readonly skipProxy: boolean;
+  /** How device-code OAuth flows choose their egress: `random` (default)
+   * routes start+poll through a randomly selected active network pool so the
+   * upstream sees a rotating IP; `direct` always dials direct egress. */
+  readonly deviceFlowProxy: "random" | "direct";
   /** Built-in API-key upstream User-Agent; OAuth and custom providers retain their own identity. */
   readonly userAgent: string;
   /** Operator-set custom User-Agent override; `null` = no override (native identity is used). */
@@ -1089,6 +1093,8 @@ export interface UpdateProviderRoutingRequest {
   readonly enabled?: boolean;
   /** When true, this provider's requests always dial direct. */
   readonly skipProxy?: boolean;
+  /** How device-code OAuth flows choose their egress; absent = keep current. */
+  readonly deviceFlowProxy?: "random" | "direct";
   /** Built-in API-key upstream User-Agent. */
   readonly userAgent?: string;
   /** Operator-set custom User-Agent override; `null` clears it back to native. */

package/src/console/providers/catalog/model-operations.ts

@@ -12,7 +12,6 @@ import type { AccessDecision } from "../../../security/access-control";
 import { ConsoleDomainError, requireScope, requireTenantAnyScope } from "../../shared/errors";
 import { GatewayError } from "../../../protocol/gateway-error";
 import {
-  DISCOVER_MODEL_COMMIT_MAX,
   MODEL_READ_SCOPES,
   MODEL_WRITE_SCOPES,
 } from "./contracts";
@@ -390,11 +389,11 @@ export function createModelCatalogOperations(config: ProviderCatalogConfig) {
           "modelIds must be non-empty model ids",
         );
       }
-      if (modelIds.length === 0 || modelIds.length > DISCOVER_MODEL_COMMIT_MAX) {
+      if (modelIds.length === 0) {
         throw new ConsoleDomainError(
           "invalid_request",
           400,
-          `modelIds must contain 1-${DISCOVER_MODEL_COMMIT_MAX} entries`,
+          "modelIds must contain at least one entry",
         );
       }
       try {

package/src/console/providers/catalog/provider-operations.ts

@@ -892,7 +892,7 @@ export function createProviderCatalogOperations(config: ProviderCatalogConfig) {
                     // dynamic-import: B-02 lazy graph — buddy device-binding materializer, buddy-family only.
                     // The buddy-identity graph is lazy-loaded: the device-binding
                     // materializer only runs for buddy-family accounts (B-02).
-                    ? (await import("../../../providers/integrations/buddy/buddy-identity"))
+                    ? (await import("../../../providers/integrations/buddy/headers"))
                         .materializeBuddyDeviceBinding(account.id, authState)
                     : undefined;
                 const effectiveAuthState = materialized ?? authState;

package/src/console/providers/catalog/routes.ts

@@ -5,7 +5,6 @@ import { SERVICE_KINDS, WIRE_FAMILIES } from "../../../protocol/canonical-model"
 import { PROBE_MODES, PROBE_REASONING_EFFORTS } from "../../../providers/discovery/discovery-types";
 import {
   ACCOUNT_STATUSES,
-  DISCOVER_MODEL_COMMIT_MAX,
   CREDENTIAL_KINDS,
   CREDENTIAL_MODES,
 } from "./contracts";
@@ -133,7 +132,7 @@ const registerModelsBody = t.Object({
   metadata: t.Optional(modelMetadataOverrideBody),
 });
 const discoverCommitBody = t.Object({
-  modelIds: t.Array(t.String(), { minItems: 1, maxItems: DISCOVER_MODEL_COMMIT_MAX }),
+  modelIds: t.Array(t.String(), { minItems: 1 }),
 });
 const probeModelBody = t.Object({
   modelId: t.String(),
@@ -141,6 +140,7 @@ const probeModelBody = t.Object({
   route: t.Optional(t.String()),
   wireFamily: t.Optional(t.String()),
   accountId: t.Optional(t.String()),
+  accountIds: t.Optional(t.Array(t.String(), { maxItems: 100 })),
   prompt: t.Optional(t.String()),
   reasoningEffort: t.Optional(literalUnion(PROBE_REASONING_EFFORTS)),
   maxOutputTokens: t.Optional(t.Integer({ minimum: 1, maximum: 131072 })),