cartethyia 2.8.0 → 2.8.1

package/src/providers/integrations/sensenova/provider.ts

@@ -0,0 +1,144 @@
+// SenseNova providers (CN + Intl) — bearer-authenticated OpenAI-compatible
+// chat + image generation.
+//
+// SenseNova API keys are per-site: keys created on platform.sensenova.cn are
+// rejected by token.sensenova.ai with 401 {"error":{"code":16,"message":"Forbidden"}}
+// (and vice versa), so each deployment is its own provider with its own host
+// and catalog — the same split as CodeBuddy cb/cbcn.
+//
+// Wire facts:
+//   - Chat is OpenAI-compatible `/v1/chat/completions` with Bearer auth.
+//   - Image generation is `/v1/images/generations` (OpenAI-shaped `{model,
+//     prompt, n, size, output_format, response_format, watermark,
+//     prompt_extend}`), answering `{data: [{url|b64_json}]}`.
+//   - Thinking streams under `reasoning` (delta + message) rather than
+//     `reasoning_content`; the shared compatible adapter's chat decoder maps
+//     it onto the canonical reasoning event.
+
+import { defineModel, type ModelDefinition } from "../../provider-model-definition";
+import type { ApiKeyProviderSpec } from "../../configured-provider";
+import {
+  fetchOpenAICompatibleModels,
+} from "../../discovery/openai-model-discovery";
+
+/** Chat path below each realm's `/v1` base root. */
+const SENSENOVA_CHAT_PATH = "/chat/completions";
+/** Image-generation path below each realm's `/v1` base root. */
+const SENSENOVA_IMAGE_PATH = "/images/generations";
+
+export const SENSENOVA_PROVIDER_ID = "sensenova" as const;
+export const SENSENOVA_INTL_PROVIDER_ID = "sensenova-intl" as const;
+
+function sensenovaSpec(providerId: string): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId as ApiKeyProviderSpec["provider_id"],
+    endpoint_paths_by_wire_family: { chat: SENSENOVA_CHAT_PATH },
+  };
+}
+
+/** SenseNova CN adapter spec. */
+export const SENSENOVA_SPEC: ApiKeyProviderSpec = sensenovaSpec(SENSENOVA_PROVIDER_ID);
+
+/** SenseNova Intl adapter spec. */
+export const SENSENOVA_INTL_SPEC: ApiKeyProviderSpec = sensenovaSpec(SENSENOVA_INTL_PROVIDER_ID);
+
+/**
+ * Shared chat roster (both realms expose the same model families; the intl
+ * deployment advertises fewer static rows, and live discovery fills both).
+ *
+ * Image rows are media-generation rows (serviceKind `imageGeneration`), not
+ * chat rows — they answer `/v1/images/generations` and are routed by the
+ * native image route.
+ */
+const SENSENOVA_CHAT_MODELS: readonly string[] = [
+  "sensenova-6.8-flash",
+  "sensenova-6.8-flash-lite",
+  "sensenova-6.7-flash-lite",
+  "deepseek-flash",
+  "deepseek-v4-flash",
+  "glm-5.3",
+  "glm-5.2",
+  "kimi-k3",
+];
+
+function makeChatModels(providerId: string): ModelDefinition[] {
+  return SENSENOVA_CHAT_MODELS.map((id) =>
+    defineModel({
+      id,
+      providerId,
+      wireFamily: "chat",
+      endpoint: SENSENOVA_CHAT_PATH,
+      ctx: 200_000,
+      out: 32_000,
+      reasoning: true,
+      toolCall: true,
+    }),
+  );
+}
+
+function makeImageModels(providerId: string): ModelDefinition[] {
+  return [
+    defineModel({
+      id: "sensenova-u1.5-lite",
+      providerId,
+      wireFamily: "chat",
+      serviceKind: "imageGeneration",
+      endpoint: SENSENOVA_IMAGE_PATH,
+      ctx: null,
+      out: null,
+      toolCall: false,
+      output: ["image"],
+    }),
+    defineModel({
+      id: "sensenova-u1.5-fast",
+      providerId,
+      wireFamily: "chat",
+      serviceKind: "imageGeneration",
+      endpoint: SENSENOVA_IMAGE_PATH,
+      ctx: null,
+      out: null,
+      toolCall: false,
+      output: ["image"],
+    }),
+    defineModel({
+      id: "sensenova-u1-fast",
+      providerId,
+      wireFamily: "chat",
+      serviceKind: "imageGeneration",
+      endpoint: SENSENOVA_IMAGE_PATH,
+      ctx: null,
+      out: null,
+      toolCall: false,
+      output: ["image"],
+    }),
+  ];
+}
+
+/** Full CN catalog: chat + image rows. */
+export const SENSENOVA_MODELS: readonly ModelDefinition[] = [
+  ...makeChatModels(SENSENOVA_PROVIDER_ID),
+  ...makeImageModels(SENSENOVA_PROVIDER_ID),
+];
+
+/** Full Intl catalog: chat + image rows. */
+export const SENSENOVA_INTL_MODELS: readonly ModelDefinition[] = [
+  ...makeChatModels(SENSENOVA_INTL_PROVIDER_ID),
+  ...makeImageModels(SENSENOVA_INTL_PROVIDER_ID),
+];
+
+/** Live `/v1/models` listing for one realm. */
+export function discoverSensenovaModels(options: {
+  readonly baseUrl: string;
+  readonly credential?: string;
+  readonly fetcher?: typeof fetch;
+  readonly providerId: string;
+}): Promise<readonly ModelDefinition[] | null> {
+  return fetchOpenAICompatibleModels({
+    baseUrl: options.baseUrl,
+    providerId: options.providerId,
+    ...(typeof options.credential === "string" && options.credential.trim().length > 0
+      ? { headers: { authorization: `Bearer ${options.credential}` } }
+      : {}),
+    ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }),
+  });
+}

package/src/providers/integrations/trae/trae-quota.ts

@@ -317,6 +317,13 @@ function logTraeQuotaMiss(errors: readonly string[]): void {
   log.warn(`[quota] trae surfaces unavailable: ${errors.join("; ")}`);
 }
 
+/** Only this exact response from both quota surfaces on both realms is terminal auth evidence. */
+function isTraeAuthInvalidation(errors: readonly string[]): boolean {
+  return errors.length === 4 && errors.every((error) =>
+    /HTTP 401\s+\{[^}]*"code"\s*:\s*1001\b/i.test(error),
+  );
+}
+
 /**
  * Reads one Trae account's quota.
  *
@@ -421,7 +428,14 @@ export async function fetchTraeQuota(
     // The detail is kept for the log instead, where it cannot be read as a
     // balance.
     logTraeQuotaMiss(errors);
-    return { source: "trae", plan: null, windows: [], error: null };
+    const authInvalidated = isTraeAuthInvalidation(errors);
+    return {
+      source: "trae",
+      plan: null,
+      windows: [],
+      error: authInvalidated ? errors.join("; ") : null,
+      ...(authInvalidated ? { authInvalidated: true } : {}),
+    };
   }
   return {
     source: "trae",

package/src/providers/integrations/vercel/provider.ts

@@ -0,0 +1,117 @@
+// Vercel AI Gateway provider — TypeScript, Vercel AI Gateway, Bun gateway.
+//
+// Vercel AI Gateway is an OpenAI-compatible routing front for 500+ models
+// across providers. The API key (`vck_...`) is bearer-authenticated against
+// `https://ai-gateway.vercel.sh/v1`.
+//
+// Verified live 2026-11-11 with a free-tier key:
+//   - GET /v1/models            → 200, 506 rows (OpenRouter-shaped list)
+//   - POST /v1/chat/completions → 200 for nvidia/nemotron-3.5-lightning-free
+//   - POST /v1/chat/completions → 403 `no_providers_available` for the other
+//     zero-priced rows (reflection/beam*, humansand/ampersand-v0.1,
+//     stealth/glyph-cluster) — listed at $0 but gated behind a paid/Pro plan.
+//   - GET /v1/credits           → { balance, token_pass, total_used }
+//
+// The static roster below carries the five $0-priced rows, so the free section
+// is populated before any fetch. Four of them are marked `proOnly` because the
+// upstream refuses them on a free plan (verified live); discovery still finds
+// them and the badge tracks the upstream's own listing.
+
+import type { ApiKeyProviderSpec } from "../../configured-provider";
+import { fetchOpenAICompatibleModels } from "../../discovery/openai-model-discovery";
+import { defineModel, type ModelDefinition } from "../../provider-model-definition";
+
+const VERCEL_PROVIDER_ID = "vercel" as const;
+
+/** Chat path below the `/v1` base root. */
+const VERCEL_CHAT_PATH = "/chat/completions";
+
+/**
+ * Vercel AI Gateway adapter spec: plain bearer, OpenAI-compatible chat.
+ *
+ * The gateway accepts standard OpenAI fields (`max_tokens`, `temperature`,
+ * `stop`, `tools`, `tool_choice`, `reasoning`, `response_format`, …) and
+ * reports usage/cost in extended `provider_metadata`. No bespoke headers are
+ * required beyond the bearer, so the generic API-key adapter serves it.
+ */
+export const VERCEL_SPEC: ApiKeyProviderSpec = {
+  provider_id: VERCEL_PROVIDER_ID,
+  endpoint_paths_by_wire_family: {},
+};
+
+/**
+ * Default rows for the Vercel AI Gateway provider (2026-11-11).
+ *
+ * Verified live with a free-tier key: only
+ * `nvidia/nemotron-3.5-lightning-free` is served on a free plan; the other
+ * zero-priced listing rows are refused with 403 `no_providers_available`, so
+ * they are not seeded. The two billed rows (`meituan/longcat-2.5`,
+ * `inception/mercury-3`) are the operator's picks and carry the capabilities
+ * the upstream itself declares — LongCat is the vision-capable coding row,
+ * Mercury 3 is the diffusion row. Everything else comes from live discovery.
+ */
+export const VERCEL_DEFAULT_MODELS: readonly ModelDefinition[] = [
+  defineModel({
+    id: "nvidia/nemotron-3.5-lightning-free",
+    wireFamily: "chat",
+    endpoint: VERCEL_CHAT_PATH,
+    ctx: 1_000_000,
+    out: 65_000,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+  }),
+  defineModel({
+    id: "meituan/longcat-2.5",
+    wireFamily: "chat",
+    endpoint: VERCEL_CHAT_PATH,
+    ctx: 1_048_576,
+    out: 131_072,
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "inception/mercury-3",
+    wireFamily: "chat",
+    endpoint: VERCEL_CHAT_PATH,
+    ctx: 1_000_000,
+    out: 131_072,
+    reasoning: true,
+    toolCall: true,
+  }),
+];
+
+/**
+ * Live `/v1/models` listing.
+ *
+ * The listing requires the API key, so the credential is forwarded when
+ * present; an unauthenticated fetch fails cleanly and the static roster stays
+ * authoritative. Every fetched row is kept as the shared reader resolved it
+ * (limits/modalities/reasoning/tool flags come from the upstream's own JSON).
+ *
+ * A fetched id the static roster already knows keeps the roster row whole, not
+ * the listing's fields: the upstream does not publish `reasoning`/`tool_call`
+ * keys or tier flags, so the shared reader would overwrite the roster's
+ * reasoning/tool/freeTier/proOnly statements with its conservative defaults.
+ * The roster is the canonical metadata for the models we know; the listing only
+ * adds genuinely new ids.
+ */
+export async function discoverVercelModels(options: {
+  readonly baseUrl: string;
+  readonly credential?: string;
+  readonly fetcher?: typeof fetch;
+}): Promise<readonly ModelDefinition[] | null> {
+  const listed = await fetchOpenAICompatibleModels({
+    baseUrl: options.baseUrl,
+    providerId: "vercel",
+    ...(typeof options.credential === "string" && options.credential.trim().length > 0
+      ? { headers: { authorization: `Bearer ${options.credential}` } }
+      : {}),
+    ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }),
+  });
+  if (listed === null) return null;
+  const known = new Map(VERCEL_DEFAULT_MODELS.map((model) => [model.modelId, model]));
+  return listed.map((model) => known.get(model.modelId) ?? model);
+}

package/src/providers/integrations/vercel/vercel-quota.ts

@@ -0,0 +1,96 @@
+// Vercel AI Gateway quota collector.
+//
+// Reads `GET /v1/credits` (Bearer) — the gateway's credit surface. It returns
+// a remaining balance (`balance`, USD string), an optional `token_pass`, and
+// the total spend (`total_used`, USD string). No ceiling is reported (balance
+// is remaining, not a limit), so the window carries absolute remaining/used
+// values and no percent — the pooled credit sum still works. Never throws: a
+// failed read returns a null-result so the router treats it as unknown rather
+// than dead.
+
+import type {
+  FetchLike,
+  ProviderQuotaResult,
+  ProviderQuotaWindow,
+} from "../../quota/quota-contracts";
+import {
+  cleanError,
+  number,
+  unsupportedQuota,
+} from "../../quota/quota-contracts";
+import type { QuotaCollectionContext } from "../../quota/quota-support";
+
+const VERCEL_CREDITS_URL = "https://ai-gateway.vercel.sh/v1/credits";
+
+function readCredits(
+  credential: string,
+  fetcher: FetchLike,
+): Promise<Record<string, unknown> | null> {
+  return fetcher(VERCEL_CREDITS_URL, {
+    method: "GET",
+    headers: {
+      authorization: `Bearer ${credential}`,
+      accept: "application/json",
+    },
+    signal: AbortSignal.timeout(15_000),
+  })
+    .then(async (res) => {
+      if (!res.ok) return null;
+      try {
+        return (await res.json()) as Record<string, unknown>;
+      } catch {
+        return null;
+      }
+    })
+    .catch(() => null);
+}
+
+/** Reads the Vercel AI Gateway credit balance and returns a normalized result. */
+export async function fetchVercelQuota(
+  credential: string,
+  fetcher: FetchLike,
+  _context?: QuotaCollectionContext,
+): Promise<ProviderQuotaResult> {
+  try {
+    const credits = await readCredits(credential, fetcher);
+    if (!credits) {
+      return unsupportedQuota("vercel");
+    }
+    const balance = number(credits["balance"]);
+    const totalUsed = number(credits["total_used"]);
+    if (balance === null && totalUsed === null) {
+      return {
+        source: "vercel",
+        plan: null,
+        windows: [],
+        error: "Vercel AI Gateway /v1/credits returned no usable numbers",
+      };
+    }
+    const windows: ProviderQuotaWindow[] = [
+      {
+        kind: "credits",
+        label: "AI Gateway credits",
+        accounting: "pooled",
+        usedPercent: null,
+        remainingPercent: null,
+        resetsAt: null,
+        used: totalUsed,
+        limit: null,
+        remaining: balance,
+      },
+    ];
+    return {
+      source: "vercel",
+      plan: null,
+      windows,
+      error: null,
+    };
+  } catch (error) {
+    return {
+      source: "vercel",
+      plan: null,
+      windows: [],
+      error: cleanError(error),
+    };
+  }
+}

package/src/providers/integrations/xai/xai-oauth.ts

@@ -135,8 +135,8 @@ export class XaiOAuthClient extends OAuthDeviceFlow {
   protected override readonly tokenUrl = XAI_TOKEN_URL;
   protected override readonly scopes = XAI_SCOPE;
 
-  override async startDeviceAuth(_context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
-    const response = await this.fetchFn(XAI_DEVICE_URL, {
+  override async startDeviceAuth(context?: OAuthDeviceFlowContext): Promise<OAuthDeviceStartResult> {
+    const response = await this.fetchFor(context)(XAI_DEVICE_URL, {
       method: "POST",
       headers: formHeaders(),
       body: new URLSearchParams({ client_id: XAI_CLIENT_ID, scope: XAI_SCOPE }),
@@ -157,9 +157,9 @@ export class XaiOAuthClient extends OAuthDeviceFlow {
 
   override async pollDeviceAuth(
     deviceAuthId: string,
-    _context?: OAuthDeviceFlowContext,
+    context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDevicePollResult> {
-    const response = await this.fetchFn(XAI_TOKEN_URL, {
+    const response = await this.fetchFor(context)(XAI_TOKEN_URL, {
       method: "POST",
       headers: formHeaders(),
       body: new URLSearchParams({
@@ -203,7 +203,7 @@ export class XaiOAuthClient extends OAuthDeviceFlow {
       };
     }
     const result = this.parseTokenResponse(payload);
-    const identity = await fetchXaiIdentity(result.access, this.fetchFn);
+    const identity = await fetchXaiIdentity(result.access, this.fetchFor(context));
     const authState = xaiAuthState(identity);
     return {
       status: "complete",

package/src/providers/integrations/zcode-start-plan/gifts.ts

@@ -22,7 +22,7 @@
 import { createHash } from "node:crypto";
 import { sleep } from "../../../shared/sleep";
 import { asRecord, asTrimmedString } from "../../../shared/coerce";
-import type { ValidatedFetch } from "../../../network/outbound-fetch";
+import type { ValidatedFetch } from "../../../network/egress/fetch";
 
 const ZCODE = "https://zcode.z.ai";
 const BILLING = `${ZCODE}/api/v1/zcode-plan/billing`;

package/src/providers/integrations/zcode-start-plan/oauth.ts

@@ -62,10 +62,10 @@ export class ZcodeStartPlanOAuthClient extends OAuthDeviceFlow {
   }
 
   override async startDeviceAuth(
-    _context?: OAuthDeviceFlowContext,
+    context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDeviceStartResult & { providerState: string }> {
     const pollToken = crypto.randomBytes(32).toString("hex");
-    const response = await this.fetchFn(INIT_URL, {
+    const response = await this.fetchFor(context)(INIT_URL, {
       method: "POST",
       headers: { ...JSON_HEADERS, authorization: `Bearer ${pollToken}` },
       body: JSON.stringify({ provider: "zai" }),
@@ -95,7 +95,7 @@ export class ZcodeStartPlanOAuthClient extends OAuthDeviceFlow {
     if (!pollToken) {
       return { status: "failed", reason: "sign-in session lost its poll token" };
     }
-    const response = await this.fetchFn(`${POLL_BASE}/${encodeURIComponent(deviceAuthId)}`, {
+    const response = await this.fetchFor(context)(`${POLL_BASE}/${encodeURIComponent(deviceAuthId)}`, {
       headers: { ...JSON_HEADERS, authorization: `Bearer ${pollToken}` },
     });
     if (response.status === 404) {

package/src/providers/integrations/zro/zro.ts

@@ -45,7 +45,6 @@ const ZRO_MODELS_RAW: readonly {
 }[] = [
   { id: "deepseek-v4-flash-0731", contextLimit: 1_048_576, outputLimit: 64_000 },
   { id: "deepseek-v4.1-flash", contextLimit: 1_048_576, outputLimit: 64_000 },
-  { id: "glm-5.3-flash", contextLimit: 1_048_576, outputLimit: 64_000 },
 ] as const;
 
 export const ZRO_MODELS: readonly ModelDefinition[] = ZRO_MODELS_RAW.map((row) =>
@@ -79,6 +78,8 @@ export const ZRO_MODELS: readonly ModelDefinition[] = ZRO_MODELS_RAW.map((row) =
  */
 export function zroModelDiscovery(): () => Promise<ProviderModelDiscovery> {
   return async () => async (input) => {
+    // dynamic-import: cycle-break — model discovery is only imported at call time,
+    // so a provider that never runs discovery never pays for the OpenAI discovery graph.
     const { fetchOpenAICompatibleModels } = await import("../../discovery/openai-model-discovery");
     const base = input.baseUrl.replace(/\/+$/, "");
     const models = await fetchOpenAICompatibleModels({

package/src/providers/operations/account-refresh-status.ts

@@ -21,6 +21,7 @@ export type RefreshAccountStatusCode =
   | "not_oauth"
   | "static_token"
   | "no_refresher"
+  | "auth_invalidated"
   | "refresh_failed";
 
 export interface RefreshAccountStatusOutcome {
@@ -54,6 +55,7 @@ interface LoadedAccount {
   readonly credentialKind: string;
   readonly status: string;
   readonly staticToken: boolean;
+  readonly lastErrorCategory: string | null;
   readonly refreshCiphertext: Buffer | null;
   readonly expiresAt: Date | null;
 }
@@ -64,6 +66,7 @@ async function loadAccount(
 ): Promise<LoadedAccount | undefined> {
   const loaded = await loadAccountWithOauthState(db, accountId, {
     includeStatus: true,
+    includeLastErrorCategory: true,
     includeExpiry: true,
   });
   if (!loaded || loaded.status === undefined || loaded.expiresAt === undefined) return undefined;
@@ -73,6 +76,7 @@ async function loadAccount(
     credentialKind: loaded.credentialKind,
     status: loaded.status,
     staticToken: loaded.staticToken,
+    lastErrorCategory: loaded.lastErrorCategory ?? null,
     refreshCiphertext: loaded.refreshCiphertext,
     expiresAt: loaded.expiresAt,
   };
@@ -137,6 +141,16 @@ export async function refreshAccountStatus(
   }
   const statusBefore = account.status;
 
+  if (account.status === "disabled" && account.lastErrorCategory === "auth_invalidated") {
+    return {
+      ok: false,
+      tokenRefreshed: false,
+      statusAfter: statusBefore,
+      code: "auth_invalidated",
+      error: "auth_invalidated",
+      category: "This account was rejected by the provider and requires re-authentication; automatic refresh is disabled.",
+    };
+  }
   if (account.credentialKind !== "oauth") {
     return {
       ok: false,