cartethyia 2.8.0 → 2.8.1

package/src/providers/integrations/hermes/hermes.ts

@@ -4,7 +4,7 @@ import type { ApiKeyProviderSpec } from "../../configured-provider";
 import { isRecord } from "../../../protocol/codecs";
 import { boundedUpstreamArray, boundedUpstreamNumber, sanitizeUpstreamLabel } from "../../provider-sanitize";
 import { getHermesVersion } from "../../operations/client-versions";
-import { clineReasoningReplayPrepares } from "../buddy/buddy-chat-shared";
+import { clineReasoningReplayPrepares } from "../buddy/chat";
 
 const HERMES_PROVIDER_ID = "hermes" as const;
 
@@ -85,10 +85,16 @@ export const HERMES_MODELS: readonly ModelDefinition[] = [
   // entirely and dispatching it answers 404 "This model's free period has
   // ended" — a retired row, not a capacity blip, so it cannot be left in.
   //
-  // `poolside/laguna-s-2.1:free`, `poolside/laguna-xs-2.1:free`, and
-  // `stepfun/step-3.7-flash:free` are removed too: they fail at dispatch.
+  // `poolside/laguna-s-2.1:free` and `poolside/laguna-xs-2.1:free` are
+  // removed: they fail at dispatch.
+  //
+  // `stepfun/step-3.7-flash:free` is kept with a corrected output cap: the
+  // upstream serves a 256k context total (input + output), so the catalog's
+  // 256k `max_completion_tokens` makes every request exceed the endpoint and
+  // fail with "you requested about 259137 tokens". Clamped to 128k output the
+  // row fits the endpoint.
+  defineModel({ id: "stepfun/step-3.7-flash:free", ctx: 256_000, out: 128_000, reasoning: true, free: true, freeTier: true }),
   defineModel({ id: "upstage/solar-mini4:free", ctx: 524288, out: 131072, reasoning: true, free: true, freeTier: true }),
-  defineModel({ id: "reflection/beam-1.0-501b-a23b:free", ctx: 262144, out: 131072, reasoning: true, free: true, freeTier: true }),
   // Vision-corrected against the live catalog: `architecture.input_modalities`
   // lists `image` for this row, so it was published without vision it has.
   defineModel({ id: "meituan/longcat-2.5:free", ctx: 1048576, out: 131072, vision: true, reasoning: true, free: true, freeTier: true }),
@@ -162,16 +168,39 @@ export async function discoverHermesFreeModels(options: {
   if (rows === undefined) return null;
 
   const byId = new Map<string, ModelDefinition>();
+  // Ids the live catalog still lists as free but that fail at dispatch (404,
+  // retired, or a context window the catalog mis-states) — never surfaced as
+  // cards again.
+  const blockedIds = new Set([
+    "tencent/hy3:free",
+    "upstage/solar-pro4:free",
+    "meituan/longcat-2.0:free",
+    "stepfun/step-5-preview:free",
+    "poolside/laguna-s-2.1:free",
+    "poolside/laguna-xs-2.1:free",
+    "reflection/beam-1.0-501b-a23b:free",
+  ]);
   for (const entry of rows) {
     if (!isRecord(entry)) continue;
     const id = sanitizeUpstreamLabel(entry["id"]);
     if (id === undefined) continue;
+    if (blockedIds.has(id)) continue;
     if (!isFreePriced(entry)) continue;
 
     const context = boundedUpstreamNumber(entry["context_length"], { min: 1, max: 1_000_000_000 }) ?? undefined;
     const topProvider = isRecord(entry["top_provider"]) ? entry["top_provider"] : undefined;
-    const output =
+    const rawOutput =
       boundedUpstreamNumber(topProvider?.["max_completion_tokens"], { min: 1, max: 1_000_000_000 }) ?? undefined;
+    // The upstream's `max_completion_tokens` is a total budget on some rows
+    // (e.g. `stepfun/step-3.7-flash:free` rejects any request above its 256k
+    // context). The gateway's output cap is a per-request token allowance, so
+    // clamp it under the context window to keep requests admissible.
+    const output =
+      rawOutput === undefined
+        ? undefined
+        : context === undefined || rawOutput < context
+          ? rawOutput
+          : Math.max(1, Math.floor(context * 0.75));
     const architecture = isRecord(entry["architecture"]) ? entry["architecture"] : undefined;
     const inputs = boundedUpstreamArray(architecture?.["input_modalities"]) ?? [];
     const hasImage = inputs.includes("image");

package/src/providers/integrations/kilo/kilo-oauth.ts

@@ -109,8 +109,8 @@ export class KiloOAuthClient extends OAuthDeviceFlow {
     super(fetchFn);
   }
 
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
-    const response = await this.fetchFn(KILO_DEVICE_CODES_URL, {
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
+    const response = await this.fetchFor(context)(KILO_DEVICE_CODES_URL, {
       method: "POST",
       headers: { "content-type": "application/json", accept: "application/json" },
     });
@@ -141,7 +141,7 @@ export class KiloOAuthClient extends OAuthDeviceFlow {
     context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDevicePollResult> {
     const pollKey = context?.providerState ?? deviceAuthId;
-    const response = await this.fetchFn(`${KILO_DEVICE_CODES_URL}/${encodeURIComponent(pollKey)}`, {
+    const response = await this.fetchFor(context)(`${KILO_DEVICE_CODES_URL}/${encodeURIComponent(pollKey)}`, {
       headers: { accept: "application/json" },
     });
     if (response.status === 202) return { status: "pending" };
@@ -165,7 +165,7 @@ export class KiloOAuthClient extends OAuthDeviceFlow {
     if (nonEmptyTrimmedString(payload.status) !== "approved" || accessToken === undefined) {
       return { status: "pending" };
     }
-    const orgId = await fetchOrganizationId(this.fetchFn, accessToken, AbortSignal.timeout(10_000));
+    const orgId = await fetchOrganizationId(this.fetchFor(context), accessToken, AbortSignal.timeout(10_000));
     const label = accountLabelFrom(payload);
     const result: OAuthExchangeResult = {
       access: encodeKiloCredential(accessToken, orgId),

package/src/providers/integrations/kilo/kilo.ts

@@ -24,7 +24,7 @@ import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { OpenAICompatibleAdapter, withBearerAuthentication } from "../../adapters/compatible-adapter";
 import { providerBaseUrl } from "../../provider-metadata";
 import { decodeKiloCredential } from "../../../security/credential-codec";
-import { clineReasoningReplayPrepares } from "../buddy/buddy-chat-shared";
+import { clineReasoningReplayPrepares } from "../buddy/chat";
 
 export const KILO_PROVIDER_ID = "kilo" as const;
 export const KILO_BASE_URL = providerBaseUrl("kilo");

package/src/providers/integrations/kimi/kimi-oauth.ts

@@ -123,13 +123,13 @@ export class KimiCodeOAuthClient extends OAuthDeviceFlow {
     super(fetchFn);
   }
 
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult & { providerState: string }> {
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult & { providerState: string }> {
     const deviceId = createKimiDeviceId();
     // The Kimi device-authorization endpoint only parses
     // `application/x-www-form-urlencoded` bodies — JSON `client_id` is
     // rejected with `client_id is required`.
     const body = new URLSearchParams({ client_id: KIMI_CODE_CLIENT_ID });
-    const response = await this.fetchFn(KIMI_CODE_DEVICE_AUTHORIZE_URL, {
+    const response = await this.fetchFor(context)(KIMI_CODE_DEVICE_AUTHORIZE_URL, {
       method: "POST",
       headers: { ...jsonHeaders(deviceId), "content-type": "application/x-www-form-urlencoded" },
       body,
@@ -158,7 +158,7 @@ export class KimiCodeOAuthClient extends OAuthDeviceFlow {
       device_code: deviceAuthId,
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
     });
-    const response = await this.fetchFn(KIMI_CODE_TOKEN_URL, {
+    const response = await this.fetchFor(context)(KIMI_CODE_TOKEN_URL, {
       method: "POST",
       headers: { ...jsonHeaders(deviceId), "content-type": "application/x-www-form-urlencoded" },
       body,

package/src/providers/integrations/kiro/kiro-oauth.ts

@@ -504,7 +504,7 @@ export class KiroOAuthClient extends OAuthDeviceFlow {
     const region = assertAwsRegion(registration.region);
     let response: Response;
     try {
-      response = await this.fetchFn(`https://oidc.${region}.amazonaws.com/token`, {
+      response = await this.fetchFor(context)(`https://oidc.${region}.amazonaws.com/token`, {
         method: "POST",
         headers: ssoOidcHeaders(),
         body: JSON.stringify({
@@ -548,7 +548,7 @@ export class KiroOAuthClient extends OAuthDeviceFlow {
     // token is opaque, so ask the usage surface for the account email.
     if (label === kiroDefaultLabel(registration.authMethod)) {
       try {
-        const quota = await fetchKiroQuota(access, this.fetchFn, { auth_state: authStateOf(authState) });
+        const quota = await fetchKiroQuota(access, this.fetchFor(context), { auth_state: authStateOf(authState) });
         if (quota.accountLabel !== undefined && quota.accountLabel.trim().length > 0) {
           label = quota.accountLabel;
         }

package/src/providers/integrations/muse/muse-oauth.ts

@@ -131,25 +131,25 @@ export class MuseCodeOAuthClient extends OAuthDeviceFlow {
   protected override readonly tokenUrl = MUSE_CODE_DEVICE_TOKEN_URL;
   protected override readonly scopes = "";
 
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
     return this.startGenericDeviceAuth({
       tokenUrl: MUSE_CODE_DEVICE_TOKEN_URL,
       deviceAuthUrl: MUSE_CODE_DEVICE_AUTHORIZE_URL,
       clientId: MUSE_CODE_CLIENT_ID,
       formHeaders: metaHeaders,
-    });
+    }, context);
   }
 
   override async pollDeviceAuth(
     deviceAuthId: string,
-    _context?: OAuthDeviceFlowContext,
+    context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDevicePollResult> {
     const result = await this.pollGenericDeviceAuth(deviceAuthId, {
       tokenUrl: MUSE_CODE_DEVICE_TOKEN_URL,
       deviceAuthUrl: MUSE_CODE_DEVICE_AUTHORIZE_URL,
       clientId: MUSE_CODE_CLIENT_ID,
       formHeaders: metaHeaders,
-    });
+    }, context);
     if (result.status !== "complete") return result;
     const accessToken = result.result.access;
     // The key mint runs after approval: a 429, a payment gate, or a transient
@@ -157,7 +157,7 @@ export class MuseCodeOAuthClient extends OAuthDeviceFlow {
     // exception that escapes the dashboard's poll request.
     let keyPayload;
     try {
-      keyPayload = await requestMuseCodeKey(accessToken, this.fetchFn);
+      keyPayload = await requestMuseCodeKey(accessToken, this.fetchFor(context));
     } catch (error) {
       return { status: "failed", reason: error instanceof Error ? error.message : "Muse Code key exchange failed" };
     }

package/src/providers/integrations/opencode/fingerprint.ts

@@ -9,7 +9,7 @@ import { createHash, randomBytes } from "node:crypto";
  * can pin the exact identity sent before discovery resolves. Keep both in
  * lockstep when the CLI releases.
  */
-export const OPENCODE_CLIENT_VERSION = "2.2.6";
+export const OPENCODE_CLIENT_VERSION = "2.2.7";
 
 let lastTimestamp = 0;
 let sequenceCounter = 0;

package/src/providers/integrations/openrouter/provider.ts

@@ -5,7 +5,7 @@ import { providerBaseUrl } from "../../provider-metadata";
 import type { DiscoveryInput } from "../../discovery/discovery-types";
 import { defineModel } from "../../provider-model-definition";
 import { openrouterFreeRoster } from "../../discovery/openrouter-free-roster";
-import { clineReasoningReplayPrepares } from "../buddy/buddy-chat-shared";
+import { clineReasoningReplayPrepares } from "../buddy/chat";
 
 const OPENROUTER_PROVIDER_ID = "openrouter" as const;
 

package/src/providers/integrations/perch/perch-protocol.ts

@@ -27,9 +27,6 @@ import { PERCH_STARTER_PINS } from "./perch-realm";
 /** Default hosted model id when the account endpoint is unreachable. */
 export const PERCH_DEFAULT_CHAT_MODEL = "wandb-kimi-k2-6";
 
-/** The CLI user-agent the upstream recognizes as a CLI surface. */
-export const PERCH_CLI_USER_AGENT = "perchai-cli/unknown";
-
 export interface PerchTurnContext {
   readonly userId: string | null;
   readonly workspaceId: string | null;

package/src/providers/integrations/perch/perch.ts

@@ -27,8 +27,8 @@ import {
   type ProviderId,
 } from "../../provider-contracts";
 import { usageFromProvider } from "../../provider-usage";
+import { getPerchVersion } from "../../operations/client-versions";
 import {
-  PERCH_CLI_USER_AGENT,
   PERCH_SAFFRON_SYSTEM_PROMPT,
   buildPerchModelCallBody,
   parsePerchSse,
@@ -96,7 +96,7 @@ export class PerchAdapter implements ProviderAdapter {
       headers: {
         authorization: `Bearer ${access}`,
         "content-type": "application/json",
-        "user-agent": PERCH_CLI_USER_AGENT,
+        "user-agent": `perchai-cli/${getPerchVersion()}`,
         "x-perch-locale": "en",
       },
       body: JSON.stringify({ surface: "cli", profile: "standard" }),
@@ -164,7 +164,7 @@ export class PerchAdapter implements ProviderAdapter {
           authorization: `Bearer ${access}`,
           "content-type": "application/json",
           accept: "text/event-stream",
-          "user-agent": PERCH_CLI_USER_AGENT,
+          "user-agent": `perchai-cli/${getPerchVersion()}`,
           "x-perch-locale": "en",
           "x-perch-call-delta": "1",
           "x-perch-turn-ticket": ticket.ticket,

package/src/providers/integrations/qoder/claim-qoder-credits.ts

@@ -15,7 +15,7 @@
  *   401; verified live 2026-11-04).
  */
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
-import type { ValidatedFetch } from "../../../network/outbound-fetch";
+import type { ValidatedFetch } from "../../../network/egress/fetch";
 import { qoderRealmForProvider, QODER_REALMS } from "./qoder-realm";
 import { exchangeQoderPatForHost } from "./qoder-auth";
 import {

package/src/providers/integrations/qoder/qoder-adapter.ts

@@ -1,21 +1,17 @@
 /**
  * Qoder adapter — transport selection, credential resolution, dispatch.
  *
- * Surface contract (2026-11-07):
+ * Surface contract (2026-11-07, verified live 2026-11-11):
  * - `cosy` (default, production): `/algo/.../agent_chat_generation` on
- *   `api1` → `api2` → `api3.qoder.sh` (legacy COSY) — the only surface
- *   verified alive. Accepts free-tier rows (`lite`).
- * - `grpc` (`model.chat.ChatService/ChatCompletionStream`): **not the
- *   default anymore** — its host (`api2-v2.qoder.sh`) is NXDOMAIN since
- *   2026-11-07. Kept as an explicit override for probes.
- * - `ide` (`/model/v1/chat/completions`): **probe/testing only — never
- *   production.** It is the only surface that echoes strategy metadata
- *   (`raw_usage` → provider_model/target) and it streams immediately, but its
- *   ~256 KiB body cap cannot carry the 1M window the roster declares. Dispatch
- *   reaches it only when `probe_surface: "ide"` is set (discovery probes) or
- *   the option `surface: "ide"` is forced explicitly for local testing.
+ *   the realm's token-kind-specific gateway set (legacy COSY) — the only
+ *   surface verified alive. A PAT is exchanged to a job token first; job
+ *   tokens use `api2` → `api1` only, since `api3` rejects them with
+ *   `105 Login expired` (403). Accepts free-tier rows (`lite`).
+ * - The gRPC surface (`model.chat.ChatService/ChatCompletionStream`) and the
+ *   IDE surface (`/model/v1/chat/completions`) are dead on every host that
+ *   resolves (gRPC: UNIMPLEMENTED; IDE: 404) since 2026-11-07 and are not
+ *   dispatched anymore.
  */
-import { randomUUID } from "node:crypto";
 import { GatewayError } from "../../../protocol/gateway-error";
 import type { CanonicalEvent, CanonicalRequest } from "../../../protocol/canonical-model";
 import {
@@ -28,19 +24,16 @@ import {
 } from "../../provider-contracts";
 import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
 import { getQoderVersion } from "../../operations/client-versions";
-import { qoderMachineHostname, qoderMachineOs } from "../../operations/cli-platform";
 import { mapUpstreamHttpError } from "../../../transport/failure-policy";
 import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS } from "./qoder-catalog";
 import { isQoderVirtualModel, qoderDispatchModelId } from "./qoder-virtual";
 import { isQoderPat, qoderOAuthAuth, qoderSessionId, resolveQoderAuth } from "./qoder-auth";
 import { buildQoderRequest, callQoder } from "./qoder-chat";
-import { buildQoderGrpcRequest, qoderGrpcMetadata, qoderGrpcToCanonicalEvents } from "./qoder-grpc";
-import { buildQoderIdeRequest, qoderBodyToCanonicalEvents } from "./qoder-ide";
+import { qoderBodyToCanonicalEvents } from "./qoder-sse";
 import { estimateQoderSessionCache } from "./qoder-cache";
 import {
   QODER_CHAT_PATH,
   QODER_PROVIDER_ID,
-  qoderIdeChatUrl,
   qoderInferenceCandidates,
   type QoderRealm,
 } from "./qoder-realm";
@@ -56,38 +49,23 @@ interface QoderAdapterOptions {
    * Which chat transport to dispatch on.
    *
    * `cosy` (default) = legacy COSY (`/algo/.../agent_chat_generation`) on
-   * `api1` → `api2` → `api3.qoder.sh` — the only surface verified alive
-   * (2026-11-07; the `api2-v2` model-server host is NXDOMAIN). This path also
-   * accepts free-tier rows (`lite`).
-   *
-   * `grpc` forces the gRPC surface (`model.chat.ChatService/ChatCompletionStream`)
-   * — **no longer the default**; its host is not verified alive.
-   *
-   * `ide` forces `/model/v1` — **probe/testing only, never production**
-   * (see module doc).
+   * the realm's gateway candidates (device tokens: `api1` → `api2` → `api3`;
+   * job tokens minted from a PAT: `api2` → `api1` only — `api3` answers
+   * `105 Login expired`). The `api2-v2` model-server host is NXDOMAIN, and
+   * the gRPC service is UNIMPLEMENTED on every host that resolves. This path
+   * also accepts free-tier rows (`lite`).
    */
-  readonly surface?: "grpc" | "cosy" | "ide";
+  readonly surface?: "cosy";
 }
 
 /** Resolves the transport for one dispatch. Exported for tests. */
-export function resolveQoderTransport(
-  surface: "grpc" | "cosy" | "ide" | undefined,
-  modelConfig: QoderModelConfig,
-): "grpc" | "cosy" | "ide" {
-  const chosen = surface ?? "cosy";
-  // `ide` is an explicit testing override — never auto-selected, and it does
-  // not apply the free-tier rule (a forced IDE call is a test call).
-  if (chosen === "ide") return "ide";
-  // Free-tier rows (`lite`) are refused on gRPC with `quota exceeded` (116);
-  // they must use the legacy COSY surface.
-  if (chosen === "grpc" && modelConfig.is_free === true) return "cosy";
-  return chosen;
+export function resolveQoderTransport(): "cosy" {
+  return "cosy";
 }
 
 class QoderAdapter implements ProviderAdapter {
   readonly provider_id: ProviderId;
   private readonly realm: QoderRealm;
-  private readonly surface: "grpc" | "cosy" | "ide";
   private readonly fetchFn: typeof fetch;
 
   constructor(options: QoderAdapterOptions = {}) {
@@ -100,7 +78,6 @@ class QoderAdapter implements ProviderAdapter {
     // mismatch that made `deepseek-v4.1-flash` fail while `qwen3.8-flash`
     // passed. This is the same default `resolveQoderTransport(undefined)`
     // already returns.
-    this.surface = options.surface ?? "cosy";
     this.fetchFn = options.fetch ?? globalThis.fetch;
   }
 
@@ -180,7 +157,7 @@ class QoderAdapter implements ProviderAdapter {
 
     const lifecycle = createUpstreamDeadlineLifecycle(context);
 
-    // Outbound fetch respects SSRF binding when provided
+    // Outbound fetch respects SSRF binding when provided.
     const outboundFetch: typeof fetch = (context.outbound_fetch as unknown as typeof fetch) ?? this.fetchFn;
 
     const fetcher: (url: string, init: RequestInit) => Promise<Response> = (url, init) =>
@@ -196,77 +173,6 @@ class QoderAdapter implements ProviderAdapter {
         : qoderOAuthAuth(secret, context.credential.auth_state, context.credential.account_id);
 
       // Transport selection — see module doc for the surface contract.
-      const forceIde = this.surface === "ide" || candidate.probe_surface === "ide";
-      const useGrpc = !forceIde && resolveQoderTransport(this.surface, modelConfig) === "grpc";
-
-      if (forceIde) {
-        const ideUrl = qoderIdeChatUrl(this.realm);
-        const ideBody = buildQoderIdeRequest(modelId, request, modelConfig, auth, this.realm, version);
-        // Header fingerprint mirrors the desktop client's IDE surface (`PFn` /
-        // `Hc`): X-Request-ID normalized to uppercase, Cosy-Version, real
-        // machine OS, and the sanitized hostname on infer SSE requests. The
-        // User-Agent is the real IDE client's (`Bun/1.4.4`, live capture) and
-        // `X-Session-ID` matches the body's session id (sha256 userId:model).
-        const ideHostname = qoderMachineHostname();
-        const res = await fetcher(ideUrl, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${auth.securityOauthToken}`,
-            "Content-Type": "application/json",
-            Accept: "text/event-stream",
-            "User-Agent": "Bun/1.4.4",
-            "X-Request-ID": randomUUID().toUpperCase(),
-            "X-Session-ID": qoderSessionId(auth.userId, modelId),
-            "Cosy-Version": version,
-            "Cosy-ClientType": "5",
-            "Cosy-MachineOS": qoderMachineOs(),
-            ...(ideHostname.length > 0 ? { "Cosy-MachineHostname": ideHostname } : {}),
-          },
-          body: JSON.stringify(ideBody),
-        });
-        if (!res.ok) throw await mapUpstreamHttpError(res, "qoder");
-        if (!res.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
-        lifecycle.release();
-        yield* this.#withSessionCacheEstimate(
-          qoderBodyToCanonicalEvents(res.body as ReadableStream<Uint8Array>, lifecycle.signal, modelId),
-          request,
-          qoderSessionId(auth.userId, modelId),
-        );
-        return;
-      }
-
-      if (useGrpc) {
-        // The gRPC request mirrors the HTTP surfaces' OpenAI-shaped body, so
-        // the shared builder supplies the messages, tool declarations, and
-        // tool-choice knobs both surfaces expect. Without the `tools` array
-        // the upstream sees no toolset and answers with a DSML text block (or
-        // claims no tool exists) instead of a structured `tool_calls`.
-        const legacy = buildQoderRequest(modelId, request, modelConfig, auth, this.realm);
-        const grpcRequest = buildQoderGrpcRequest(
-          modelId,
-          request,
-          auth.userId,
-          {
-            messages: legacy.messages as Array<Record<string, unknown>>,
-            tools: legacy.tools as Array<Record<string, unknown>>,
-            ...(legacy.parameters === undefined
-              ? {}
-              : { parameters: legacy.parameters as Record<string, unknown> }),
-          },
-        );
-        const grpcMetadata = qoderGrpcMetadata(auth);
-        lifecycle.release();
-        yield* this.#withSessionCacheEstimate(
-          qoderGrpcToCanonicalEvents(grpcRequest, grpcMetadata, this.realm, lifecycle.signal, context.provider_capture),
-          request,
-          qoderSessionId(auth.userId, modelId),
-        );
-        return;
-      }
-
-      // Legacy COSY hosts are tried in order (api1 → api2 → api3) with the
-      // endpoint path from discovery when present. A network-level failure on
-      // one host falls through to the next; an HTTP error response surfaces as-is.
       const cosyCandidates = candidate.endpoint_path?.startsWith("http")
         ? [candidate.endpoint_path]
         : qoderInferenceCandidates(this.realm, auth.securityOauthToken).map(

package/src/providers/integrations/qoder/qoder-auth.ts

@@ -71,6 +71,7 @@ export function qoderOAuthAuth(
     securityOauthToken: secret,
     refreshToken: "",
     machineId: state.machineId || (accountId ? qoderMachineIdForAccount(accountId) : randomUUID()),
+    ...(state.httpDnsIp !== undefined ? { httpDnsIp: state.httpDnsIp } : {}),
   };
 }
 
@@ -263,7 +264,13 @@ export async function resolveQoderAuth(input: {
 }): Promise<QoderAuth> {
   const realm = input.realm ?? "intl";
   if (isQoderPat(input.secret)) {
-    return await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
+    const auth = await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
+    // A PAT exchange never returns the account's identity; when the persisted
+    // auth_state also carries the HTTPDNS-route IP, carry it over so the COSY
+    // request mirrors the desktop client's `X-Qoder-HTTPDNS-IP` header.
+    const state = parseQoderOAuthState(input.authState);
+    if (state?.httpDnsIp !== undefined) auth.httpDnsIp = state.httpDnsIp;
+    return auth;
   }
   // Discovery is handed only the secret and the persisted state, so the
   // account id is read from that state — the same place `qoderOAuthAuth` reads

package/src/providers/integrations/qoder/qoder-catalog.ts

@@ -390,7 +390,7 @@ export type QoderSigner = (url: string, body: string) => Promise<Record<string,
  * `fetcher` is optional in the type but required at runtime, and there is
  * deliberately no global-`fetch` default: a test cannot reach the network by
  * accident, and production is forced through the SSRF-validated egress
- * (`network/outbound-fetch.ts`). That egress is a `node:http` path, which is
+ * (`network/egress/fetch.ts`). That egress is a `node:http` path, which is
  * also the only way a body reaches the wire on a GET — `fetch` itself rejects
  * `GET` + `body` with "request with GET/HEAD method cannot have body".
  */

package/src/providers/integrations/qoder/qoder-chat.ts

@@ -4,8 +4,9 @@
  * `buildQoderRequest` translates one canonical request into the legacy
  * `/algo/.../agent_chat_generation` body (and, by reuse, the messages/tools
  * shared by the IDE and gRPC surfaces). `callQoder` signs and sends it over
- * the COSY surface with the real client's headers (Bun UA, machine identity,
- * `x-model-key/source`, SSE accept).
+ * the COSY surface with the app/worker's headers (undici UA, machine
+ * identity, business/scene app profile, `x-model-key/source`, SSE accept)
+ * and a zstd-compressed body (capture 2026-11-11).
  */
 import { createHash, randomUUID } from "node:crypto";
 import type {
@@ -18,7 +19,7 @@ import { reasoningTextForReplay } from "../../../protocol/reasoning-text";
 import { resolveImageSource } from "../../../protocol/codecs";
 import { getQoderVersion } from "../../operations/client-versions";
 import { qoderMaxContextFor, qoderRosterMaxOutput } from "./qoder-catalog";
-import { transformQoderBody, qoderBuildCosyHeaders } from "./qoder-cosy";
+import { transformQoderBody, qoderBuildCosyHeaders, type QoderCosyProfile } from "./qoder-cosy";
 import { qoderSessionId } from "./qoder-auth";
 import { flattenCanonicalContent, qoderToolChoice, qoderTools } from "./qoder-body";
 import type { QoderRealm } from "./qoder-realm";
@@ -469,8 +470,11 @@ type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
 
 /**
  * Signs and sends one legacy COSY chat request. The body is alphabet-scrambled
- * before signing; headers come from `qoderBuildCosyHeaders` plus the modern
- * `x-model-key`/`x-model-source` and SSE accepts.
+ * then zstd-compressed (as the desktop worker does on the wire, capture
+ * 2026-11-11) before signing; headers come from `qoderBuildCosyHeaders` plus
+ * the modern `x-model-key`/`x-model-source` and SSE accepts. When the runtime
+ * lacks zstd the scrambled body is sent uncompressed, matching the older CLI
+ * wire.
  */
 export async function callQoder(
   url: string,
@@ -480,21 +484,34 @@ export async function callQoder(
   signal: AbortSignal,
   fetcher: QoderFetcher,
   version = getQoderVersion(),
+  profile: QoderCosyProfile = "app",
 ): Promise<Response> {
   const encoded = transformQoderBody(JSON.stringify(body));
   const modelConfig = (body["model_config"] as Record<string, unknown> | null) ?? null;
+  // The desktop worker compresses the scrambled body with zstd and stamps
+  // `Content-Encoding: zstd` (capture 2026-11-11), but the COSY signature is
+  // verified over the *scrambled* body — the server decompresses before
+  // verifying (proven live 2026-11-11: signing over the zstd bytes returns
+  // `403 Signature invalid`). The CLI sends the plain scrambled body. Fall
+  // back to the plain scrambled body (no encoding header) when the runtime
+  // lacks zstd.
+  const compressed =
+    profile === "app" && typeof Bun?.zstdCompressSync === "function"
+      ? (Bun.zstdCompressSync(Buffer.from(encoded)) as Uint8Array<ArrayBuffer>)
+      : undefined;
+  const wireBody = (compressed ?? encoded) as unknown as Uint8Array;
   return fetcher(url, {
     method: "POST",
     headers: {
-      ...qoderBuildCosyHeaders(encoded, url, auth, version),
+      ...qoderBuildCosyHeaders(encoded, url, auth, version, profile),
       ...(MODERN_PROFILE.sendModelSourceHeaders
         ? { "x-model-key": modelId, "x-model-source": typeof modelConfig?.["source"] === "string" ? (modelConfig["source"] as string) : "system" }
         : {}),
       Accept: "text/event-stream",
       "Cache-Control": "no-cache",
-      "Accept-Encoding": "identity",
+      ...(compressed === undefined ? {} : { "Content-Encoding": "zstd" }),
     },
-    body: encoded as unknown as BodyInit,
+    body: wireBody as unknown as BodyInit,
     signal,
   });
 }

package/src/providers/integrations/qoder/qoder-checkin.ts

@@ -32,7 +32,7 @@ import { log } from "../../../observability/logger";
 
 /** Structural fetch bound; Bun's own fetch type carries extra host props. */
 type Fetcher = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-import type { DailyCheckinResult, DailyCheckinState } from "../buddy/buddy-checkin";
+import type { DailyCheckinResult, DailyCheckinState } from "../buddy/lifecycle";
 
 export const QODER_CHECKIN_PROVIDER_IDS: readonly string[] = ["qoder", "qodercn"];