cartethyia 2.8.0 → 2.8.1

package/src/providers/operations/client-versions.ts

@@ -19,16 +19,16 @@ import {
 /**
  * Newest Trae IDE version from the official changelog.
  *
- * Trae publishes no npm package and no release API, so the changelog is the
+ * Trae publishes no npm package and no release API, so the changelog was the
  * only machine-readable source of the current client version. It matters
  * upstream: intl `llm_raw_chat` answers `4015` unless the request carries the
  * *current* client version, so a stale pin is an outage, not a cosmetic drift.
  *
- * The page embeds its content as JSON, and its newest entry is the first dated
- * heading — not the highest semver, because this vendor's hotfix line numbers
- * past its feature line (3.5.104 shipped after 3.5.97). Taking `max(semver)`
- * would report an old build as current, so this walks the document in order and
- * returns the first version following a dated release heading.
+ * The page is now an SPA (2026-11-11): its HTML no longer embeds the release
+ * data, so this parser returns null and the pinned fallback carries the wire
+ * identity until a machine-readable feed exists again (see
+ * `VERSION_SOURCES.trae`). The parser is kept for when the page re-exposes
+ * its entries.
  */
 async function traeVersion(response: Response): Promise<string | null> {
   try {
@@ -179,11 +179,24 @@ const KIRO_SYSTEM_VERSION = "win32#10.0.22631";
 /** Node version the observed Kiro client reports (Electron's bundled Node). */
 const KIRO_NODE_VERSION = "24.18.0";
 
+/** Clixad gateway's own CLI version: `cli_latest` on `/v1/models`. */
+async function clixadVersion(response: Response): Promise<string | null> {
+  const body = await response.text().catch(() => "");
+  if (body.length === 0) return null;
+  try {
+    const parsed = JSON.parse(body) as { cli_latest?: unknown };
+    const candidate = parsed.cli_latest;
+    return typeof candidate === "string" && isSemverish(candidate) ? candidate.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Ordered upstream sources and pinned fallbacks for every client version. */
 export const VERSION_SOURCES = {
   antigravity: {
     key: "antigravity",
-    fallback: "2.29.0",
+    fallback: "2.31.0",
     sources: [
       {
         url: "https://antigravity-hub-auto-updater-974169037036.us-central1.run.app/manifest/latest-arm64-mac.yml",
@@ -207,7 +220,7 @@ export const VERSION_SOURCES = {
     // under `@opencode/cli`, and this feed is what its own installer reads.
     // Fallback = the current latest release; raise it whenever the package
     // moves so a cold process does not present a stale client build.
-    fallback: "2.2.6",
+    fallback: "2.2.7",
     minVersion: "2.0.0",
     sources: [{ url: "https://opencode.ai/update/api/latest/cli/npm" }],
   },
@@ -247,7 +260,7 @@ export const VERSION_SOURCES = {
   },
   codex: {
     key: "codex",
-    fallback: "0.167.0",
+    fallback: "0.167.1",
     sources: [{ url: "https://registry.npmjs.org/@openai/codex/latest" }],
   },
   kimiCli: {
@@ -257,7 +270,7 @@ export const VERSION_SOURCES = {
   },
   kiro: {
     key: "kiro",
-    fallback: "1.4.121",
+    fallback: "1.4.154",
     sources: [
       {
         // Kiro's downloads page exposes no stable version string. Homebrew
@@ -270,7 +283,7 @@ export const VERSION_SOURCES = {
   },
   codebuddy: {
     key: "codebuddy",
-    fallback: "2.181.0",
+    fallback: "2.183.0",
     sources: [
       { url: "https://registry.npmjs.org/@tencent-ai/codebuddy-code/latest" },
       { url: "https://registry.npmmirror.com/@tencent-ai/codebuddy-code/latest" },
@@ -278,7 +291,7 @@ export const VERSION_SOURCES = {
   },
   codebuddyCn: {
     key: "codebuddy-cn",
-    fallback: "4.12.3.42658816",
+    fallback: "4.12.4.43368774",
     sources: [
       {
         // Official CN builds are listed by Homebrew's maintained cask feed;
@@ -293,7 +306,7 @@ export const VERSION_SOURCES = {
     // Current `@anthropic-ai/claude-code` release, so the billing
     // `cc_version=` suffix and the `claude-cli/` User-Agent stay on what
     // upstream ships.
-    fallback: "2.1.319",
+    fallback: "2.1.322",
     sources: [{ url: "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" }],
   },
   claudeSdk: {
@@ -320,21 +333,22 @@ export const VERSION_SOURCES = {
   },
   kilo: {
     key: "kilo-code",
-    fallback: "7.8.27",
+    fallback: "7.8.28",
     sources: [{ url: "https://open-vsx.org/api/kilocode/kilo-code" }],
   },
   muse: {
     key: "muse-code",
-    fallback: "1.4.14-R7309.1",
+    fallback: "1.4.15-R8339.1",
     sources: [{ url: "https://api.meta.ai/muse-code/channels/muse-stable" }],
   },
   trae: {
     key: "trae",
-    // Fallback = the newest release the changelog names, which is the *high*
-    // end of its newest line ("TRAE v3.6.1 ~ 3.6.4"). Discovery replaces it
-    // within one monitor tick; it is only what a cold process sends before
-    // the first successful fetch.
-    fallback: "3.6.4",
+    // Fallback = the current desktop release per the official winget manifest
+    // (ByteDance.Trae 3.6.13). The docs changelog renders as an SPA and no
+    // longer exposes its newest entries to the parser below, so it is not a
+    // reliable discovery source right now — raise this pin when the desktop
+    // build moves.
+    fallback: "3.6.13",
     sources: [
       {
         url: "https://docs.trae.ai/ide/changelog?_lang=en",
@@ -345,24 +359,63 @@ export const VERSION_SOURCES = {
   freepi: {
     key: "freepi",
     // The free-pi CLI version — the `x-client-version` the gateway reports.
-    // Fallback = the unpacked 0.6.14 bundle; npm discovery replaces it.
-    fallback: "0.6.14",
+    // Fallback = the current npm latest (0.6.19 as of 2026-11-12); a cold
+    // process sends it until the monitor's first successful discovery.
+    fallback: "0.6.19",
     sources: [{ url: "https://registry.npmjs.org/free-pi-cli/latest" }],
   },
   perch: {
     key: "perch",
     // The official Perch CLI, spawned by the adapter for hosted inference.
-    fallback: "2.4.125",
+    // Fallback = the current npm latest (2.4.128 as of 2026-11-11); a cold
+    // process sends it until the monitor's first successful discovery.
+    fallback: "2.4.128",
     sources: [{ url: "https://registry.npmjs.org/perchai-cli/latest" }],
   },
+  clixad: {
+    key: "clixad",
+    // The Clixad gateway publishes the CLI build it is paired with as
+    // `cli_latest` on `/v1/models` (unauthenticated). Fallback = the version
+    // the 0.0.1-beta.50 bundle shipped (verified live 2026-11-11); a cold
+    // process sends it until the monitor's first successful discovery.
+    fallback: "0.0.1-beta.50",
+    sources: [
+      {
+        url: "https://clixad.onrender.com/v1/models",
+        extract: clixadVersion,
+      },
+    ],
+  },
+  freebuff: {
+    key: "freebuff",
+    // No machine-readable public feed exists for Freebuff Desktop. GitHub
+    // releases only publish Codecane (a separate CLI line) staging builds,
+    // npm `freebuff` is the CLI (a different product), and the site's
+    // download links are client-rendered with no stable asset path.
+    // Fallback = the version unpacked from the official Windows installer
+    // during the wire audit (2026-11-09, Freebuff Desktop 0.0.201). Raise it
+    // when the next installer bundle is audited.
+    fallback: "0.0.201",
+    sources: [],
+  },
+  deepai: {
+    key: "deepai",
+    // No machine-readable public feed exists for the DeepAI Code desktop app
+    // (macOS/Windows only, no npm/CLI line). Fallback = the version unpacked
+    // from the audited bundle (2026-11-11, DeepAI Code 0.3.35). Raise it
+    // when the next bundle is audited. Pinned-only by design for the same
+    // reason as `freebuff`.
+    fallback: "0.3.35",
+    sources: [],
+  },
   cursor: {
     key: "cursor",
-    // Fallback = the last observed wire version (CLI ~2026.11.07-306d153).
-    // Discovery replaces it within one monitor tick; it is only what a cold
-    // process sends before the first successful fetch. Kept equal to
-    // `FALLBACK_CLIENT_VERSION` in the cursor adapter so the badge and the
-    // request header always send one identity.
-    fallback: "cli-3.29.9-306d153",
+    // Fallback = the newest stable build from the official download API
+    // (cli-3.29.15-86776fc). Discovery replaces it within one monitor tick; it
+    // is only what a cold process sends before the first successful fetch.
+    // Kept equal to `FALLBACK_CLIENT_VERSION` in the cursor adapter so the
+    // badge and the request header always send one identity.
+    fallback: "cli-3.29.15-86776fc",
     sources: [
       {
         url: "https://cursor.com/api/download?platform=win32-x64-user&releaseTrack=stable",
@@ -376,7 +429,7 @@ export const VERSION_SOURCES = {
     // comment this replaced claimed no semver existed and pinned a date tag
     // (`v2026.9.24`) as the version — a tag, not a release, and not the
     // identity the client sends.
-    fallback: "0.23.0",
+    fallback: "0.23.1",
     sources: [
       {
         url: "https://api.github.com/repos/NousResearch/hermes-agent/releases/latest",
@@ -403,6 +456,9 @@ const resolvers = {
   trae: createClientVersionResolver({ ...VERSION_SOURCES.trae, client: "trae" }),
   freepi: createClientVersionResolver({ ...VERSION_SOURCES.freepi, client: "freepi" }),
   perch: createClientVersionResolver({ ...VERSION_SOURCES.perch, client: "perch" }),
+  clixad: createClientVersionResolver({ ...VERSION_SOURCES.clixad, client: "clixad" }),
+  freebuff: createClientVersionResolver({ ...VERSION_SOURCES.freebuff, client: "freebuff" }),
+  deepai: createClientVersionResolver({ ...VERSION_SOURCES.deepai, client: "deepai" }),
   cursor: createClientVersionResolver({ ...VERSION_SOURCES.cursor, client: "cursor" }),
   opencode: createClientVersionResolver({ ...VERSION_SOURCES.opencode, client: "opencode" }),
   commandcode: createClientVersionResolver({ ...VERSION_SOURCES.commandcode, client: "command-code" }),
@@ -424,6 +480,11 @@ const resolvers = {
 } satisfies Record<keyof typeof VERSION_SOURCES, ClientVersionResolver>;
 const PROVIDER_VERSION_RESOLVERS: Readonly<Record<string, ClientVersionResolver>> = {
   antigravity: resolvers.antigravity,
+  freepi: resolvers.freepi,
+  perch: resolvers.perch,
+  clixad: resolvers.clixad,
+  freebuff: resolvers.freebuff,
+  deepai: resolvers.deepai,
   grok: resolvers.grok,
   xai: resolvers.grok,
   opencode: resolvers.opencode,
@@ -537,6 +598,10 @@ export const getQoderVersion = accessor("qoder").get;
 export const getHermesVersion = accessor("hermes").get;
 export const getTraeVersion = accessor("trae").get;
 export const getAntigravityVersion = accessor("antigravity").get;
+export const getFreepiVersion = accessor("freepi").get;
+export const getPerchVersion = accessor("perch").get;
+export const getFreebuffVersion = accessor("freebuff").get;
+export const getDeepAIVersion = accessor("deepai").get;
 
 export const getOpenCodeVersion = accessor("opencode").get;
 

package/src/providers/operations/oauth-refresh-lead.ts

@@ -1,22 +1,43 @@
 /**
  * Per-provider proactive OAuth refresh lead.
  *
- * A single global "refresh 5 minutes before expiry" window is wrong for two
- * reasons. Some providers issue short-lived tokens that a 5-minute lead can
- * miss entirely under a loaded sweep, while others issue long-lived tokens
- * where re-minting every few minutes is pointless traffic. And some providers
- * (Google-backed) rate-limit the token endpoint aggressively, so refreshing
- * only when genuinely close to expiry matters more than reacting fast.
+ * The lead is how long *before* expiry a token becomes eligible for the
+ * scheduled refresh sweep. It exists so the sweep re-mints a token before it
+ * dies — never to push refreshes any more often than that.
  *
- * The lead is how long *before* expiry the token becomes eligible for
- * proactive refresh. It is a floor: a caller may pass a larger `skewMs`
- * explicitly, and `DEFAULT_REFRESH_LEAD_MS` applies to any provider not listed.
+ * Buckets are deliberately coarse. A single global "5 minutes before expiry"
+ * window is wrong: some providers issue short-lived tokens that a 5-minute
+ * lead can miss under a loaded sweep, while others issue very long-lived
+ * tokens where re-minting days early is pointless traffic. Three buckets cover
+ * both ends without a hand-tuned value per provider:
  *
- * Values mirror the leads published by the upstream clients these providers
- * model (Claude Code ~4h, Codex ~5 days, Antigravity/Kimi ~5 min), so a token
- * is re-minted on the same schedule the first-party tooling uses.
+ *   - daily (default): tokens that live hours to days — refresh once a day at
+ *     most, or when the sweep sees the token enter its final 24h.
+ *   - 3 days: multi-day tokens — refresh at most ~3 days before expiry.
+ *   - 7 weeks: very long-lived tokens — refresh ~7 weeks before expiry, so a
+ *     ~6-month token is touched roughly once a quarter.
+ *
+ * Short-lived tokens (below the daily bucket) keep tighter leads because the
+ * invariant is "never let the token expire": a lead larger than the token
+ * lifetime would make the token permanently due and the sweep would re-mint it
+ * on every tick, which is the wasteful behavior these buckets exist to remove.
+ *
+ * Real expiries (from the first-party clients these providers model):
+ *   - Google-backed (Antigravity): access tokens live ~1h; 5 min lead.
+ *   - Claude Code: CLI session tokens live ~8h; 4h lead keeps one work
+ *     session on a single token.
+ *   - xAI/Grok CLI and Kimi: short-lived tokens; 5 min lead.
+ *   - ChatGPT/Codex: access tokens live ~5 days; 3-day lead re-mints ~2 days
+ *     before expiry.
+ *   - iFlow: very long-lived tokens; 7-week lead.
  */
-export const DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
+export const DEFAULT_REFRESH_LEAD_MS = 24 * 60 * 60 * 1000;
+
+/** 3-day lead for multi-day tokens. */
+export const REFRESH_LEAD_3DAY_MS = 3 * 24 * 60 * 60 * 1000;
+
+/** 7-week lead for very long-lived tokens. */
+export const REFRESH_LEAD_7WEEK_MS = 7 * 7 * 24 * 60 * 60 * 1000;
 
 /**
  * Per-provider refresh lead in milliseconds. Providers absent here use
@@ -24,19 +45,22 @@ export const DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
  * `provider_accounts.provider_id`.
  */
 export const REFRESH_LEAD_MS: Readonly<Record<string, number>> = Object.freeze({
-  // Google-backed token endpoints throttle; a wide lead with infrequent
-  // refreshes is safer than a tight one that retries often.
+  // Google-backed token endpoints throttle, and the access token itself lives
+  // only ~1h — a tight lead (below the token lifetime) is what keeps the
+  // sweep from re-minting on every tick.
   antigravity: 5 * 60 * 1000,
-  // Claude Code access tokens live ~8h and the CLI re-mints well ahead of
-  // expiry; 4h keeps a full work session on one token.
+  // Claude Code access tokens live ~8h; 4h keeps a full work session on one
+  // token without permanent due-state.
   claude: 4 * 60 * 60 * 1000,
-  // Codex/ChatGPT access tokens live for days; refresh on a 5-day lead.
-  codex: 5 * 24 * 60 * 60 * 1000,
-  // xAI/Grok CLI and Kimi both re-mint on a 5-minute lead.
+  // xAI/Grok CLI and Kimi re-mint on a 5-minute lead (short-lived tokens).
   grok: 5 * 60 * 1000,
   kimi: 5 * 60 * 1000,
-  // iFlow tokens are long-lived; a 1-day lead avoids pointless churn.
-  iflow: 24 * 60 * 60 * 1000,
+  // ChatGPT/Codex access tokens live ~5 days; a 3-day lead re-mints ~2 days
+  // before expiry — one refresh per weekend, not per request.
+  codex: REFRESH_LEAD_3DAY_MS,
+  // iFlow tokens are very long-lived; a 7-week lead avoids pointless churn
+  // while still re-minting well before expiry.
+  iflow: REFRESH_LEAD_7WEEK_MS,
 });
 
 /** The refresh lead for `providerId`, falling back to the shared default. */

package/src/providers/operations/provider-caches.ts

@@ -7,7 +7,7 @@ import { trackModelCatalogLoad } from "../../observability/performance-metrics";
 import { resolveRedisClient } from "../../persistence/redis";
 import { cachedRead } from "../../console/shared/read-through-cache";
 import { TtlCacheFamily } from "../../persistence/ttl-cache";
-import { retryWithBackoff } from "../../network/retry";
+import { retryWithBackoff } from "../../network/util/retry";
 
 /* -------------------------------------------------------------------------- */
 /* 1. Model Catalog Cache                                                     */

package/src/providers/operations/provider-credential-service.ts

@@ -161,6 +161,8 @@ export interface AccountWithOauthStateRow {
 export interface LoadAccountWithOauthStateOptions {
   /** Select `status` from providerAccounts. */
   readonly includeStatus?: boolean;
+  /** Select the last health category from providerAccounts. */
+  readonly includeLastErrorCategory?: boolean;
   /** Select `expiresAt` from providerOauthStates. */
   readonly includeExpiry?: boolean;
   /** Also compute the skew-adjusted OAuth due time (see `loadAccountWithFreshness`). */
@@ -174,6 +176,7 @@ export interface LoadedAccountWithOauthState {
   readonly id: string;
   readonly providerId: string;
   readonly credentialKind: CredentialKind;
+  readonly lastErrorCategory?: string | null;
   readonly credentialCiphertext: Buffer | null;
   readonly refreshCiphertext: Buffer | null;
   readonly authState: unknown;
@@ -209,6 +212,9 @@ export async function loadAccountWithOauthState(
       clientSecretCiphertext: providerOauthStates.clientSecretCiphertext,
       staticToken: providerAccounts.staticToken,
       ...(options.includeStatus === true ? { status: providerAccounts.status } : {}),
+      ...(options.includeLastErrorCategory === true
+        ? { lastErrorCategory: providerAccounts.lastErrorCategory }
+        : {}),
       ...(options.includeExpiry === true || options.includeDueAt === true
         ? { expiresAt: providerOauthStates.expiresAt }
         : {}),
@@ -225,14 +231,12 @@ export async function loadAccountWithOauthState(
   if (!row) return undefined;
   if (options.includeDueAt !== true) return row;
   const lead = options.skewMs ?? refreshLeadMs(row.providerId);
-  // A refresh-capable OAuth account with no stored expiry is unknown-liveness:
-  // we have no evidence the access token still works. Marking the token due
-  // immediately refreshes it on first use; the sweep handles the normal case
-  // where `expires_at` is populated.
-  const hasRefreshGrant = row.refreshCiphertext != null;
-  const kindOauth = row.credentialKind === "oauth";
-  const unknownExpiryButRefreshable =
-    kindOauth && !row.staticToken && hasRefreshGrant && row.expiresAt == null;
+  // A refresh-capable OAuth account with no stored expiry has an unknown
+  // liveness, but the scheduled sweep is the only refresher: marking it due
+  // here would refresh on every load, and the dispatch path deliberately no
+  // longer refreshes inline. Unknown expiry therefore means "not due yet" —
+  // if the token actually died, the upstream's 401 triggers the dispatch
+  // retry refresh (see `attempt-loop.ts`).
   // A static token is never "due": it is used as issued and there is no
   // refresh to run, so the dispatch path must not treat it as stale.
   const dueAt =
@@ -240,9 +244,7 @@ export async function loadAccountWithOauthState(
       ? undefined
       : row.expiresAt != null
         ? row.expiresAt.getTime() - lead
-        : unknownExpiryButRefreshable
-          ? 0
-          : undefined;
+        : undefined;
   return {
     ...row,
     ...(dueAt === undefined ? {} : { dueAt }),
@@ -293,7 +295,7 @@ export async function resolveCredentialForAccount(
   db: CartethyiaDatabase,
   providerId: string,
   accountId: string,
-  oauth?: ResolveCredentialOAuth,
+  _oauth?: ResolveCredentialOAuth,
 ): Promise<ResolvedCredential> {
   // Cache hit: skip DB round-trip + AES-GCM decrypt.
   // Don't cache OAuth credentials whose token is due for refresh soon —
@@ -338,19 +340,14 @@ export async function resolveCredentialForAccount(
       );
     }
   }
-  if (row.credentialKind === "oauth" && oauth && dueAt !== undefined && dueAt <= Date.now()) {
-    const refresher = await oauth.resolveRefresher(row.providerId);
-    if (refresher) {
-      // Try to refresh. If it fails (refresh grant dead, upstream unreachable,
-      // etc.) keep the already-decrypted stale secret rather than wiping it:
-      // dispatch then sends the token we have, and the upstream's own 401 is
-      // the authoritative verdict. Wiping it here turned "token expired" into
-      // a credential-less GatewayError before the request ever left, which is
-      // worse than letting the server say so.
-      const refreshed = await oauth.refreshService.ensureFreshAccessToken(accountId, refresher);
-      if (refreshed) secret = refreshed;
-    }
-  }
+  // No inline refresh on the request path. OAuth tokens are kept fresh by the
+  // scheduled refresh sweep (`oauth-refresh-sweep`, due by `refreshLeadMs`),
+  // and a token that still expired before its sweep turn is answered by the
+  // upstream's own 401, which the dispatch attempt-loop turns into a forced
+  // refresh (see `attempt-loop.ts`). Refreshing here blocked a client request
+  // on the token endpoint — a hung endpoint held the request for the full 30 s
+  // refresh timeout — and re-minted tokens on every expired request instead of
+  // once per schedule.
 
   const authState = jsonbRecord(row.authState);
   const alternative: CredentialAlternative = {

package/src/providers/operations/session-resolution.ts

@@ -13,13 +13,29 @@ const SESSION_HEADERS = [
   "session-id",
 ] as const;
 
+/** Ceiling for a session id, mirroring the OpenCode free tier's 256-char cap. */
+const MAX_INBOUND_SESSION_LENGTH = 256;
+
+/**
+ * Normalize an inbound session id the same way the OpenCode CLI does: trim,
+ * reject empty strings, and cap pathological lengths so a defective header can
+ * never become a cache key or a sticky-routing key hundreds of bytes long.
+ * Returns undefined when the value is unusable.
+ */
+export function normalizeInboundSessionId(value: string | undefined): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_INBOUND_SESSION_LENGTH) return undefined;
+  return trimmed;
+}
+
 export function resolveInboundSessionId(
   context?: ProviderDispatchContext,
   request?: CanonicalRequest,
 ): string | undefined {
   const headers = context?.request_headers;
   for (const name of SESSION_HEADERS) {
-    const value = headers?.[name]?.trim();
+    const value = normalizeInboundSessionId(headers?.[name]);
     if (value) return value;
   }
   const conversationId = request?.conversation?.conversation_id;

package/src/providers/provider-contracts.ts

@@ -5,7 +5,7 @@
 import type { CanonicalEvent, CanonicalRequest, WireFamily } from "../protocol/canonical-model";
 import { GatewayError } from "../protocol/gateway-error";
 import { BUNDLED_PROVIDER_METADATA, type BundledProviderId } from "./provider-metadata";
-import type { ValidatedOutboundHttp2Bidi } from "../network/http2-bidi";
+import type { ValidatedOutboundHttp2Bidi } from "../network/bidi";
 
 /** Closed union of every shipped provider ID. */
 export const BUNDLED_PROVIDER_IDS: ReadonlySet<BundledProviderId> = new Set(
@@ -134,7 +134,7 @@ export type ValidatedOutboundWebSocket = (
 /**
  * The dialer contract handed to a provider adapter.
  *
- * Declared in `network/http2-bidi.ts` — the transport owns the contract — and
+ * Declared in `network/bidi.ts` — the transport owns the contract — and
  * re-exported here so provider code keeps one import site.
  */
 export type { ValidatedOutboundHttp2Bidi };

package/src/providers/provider-metadata.ts

@@ -172,6 +172,14 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
   { id: "opencode-go", displayName: "OpenCode Go", baseUrl: "https://opencode.ai", credentialUrl: "https://opencode.ai/auth" },
   { id: "cerebras", displayName: "Cerebras", baseUrl: "https://api.cerebras.ai/v1", credentialUrl: "https://cloud.cerebras.ai/platform" },
   { id: "openrouter", displayName: "OpenRouter", baseUrl: "https://openrouter.ai/api/v1", credentialUrl: "https://openrouter.ai/settings/keys" },
+  {
+    id: "vercel",
+    displayName: "Vercel AI Gateway",
+    baseUrl: "https://ai-gateway.vercel.sh/v1",
+    defaultSkipProxy: true,
+    credentialUrl: "https://vercel.com/dashboard/ai",
+    credentialHint: "Create an AI Gateway API key (`vercel ai-gateway api-keys create`) or paste an existing `vck_` key. The key is bearer-authenticated against the OpenAI-compatible /v1 surface.",
+  },
   { id: "mistral", displayName: "Mistral AI", baseUrl: "https://api.mistral.ai/v1", credentialUrl: "https://console.mistral.ai/api-keys" },
   { id: "fireworks", displayName: "Fireworks AI", baseUrl: "https://api.fireworks.ai/inference/v1", credentialUrl: "https://fireworks.ai/account/api-keys" },
   { id: "nvidia", displayName: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1", credentialUrl: "https://build.nvidia.com/settings/api-keys" },
@@ -180,6 +188,22 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
   // and the registry pins the Messages endpoint separately.
   { id: "deepseek", displayName: "DeepSeek", baseUrl: "https://api.deepseek.com", wireFamilyDefault: "messages", credentialUrl: "https://platform.deepseek.com/api_keys" },
   { id: "gmi", displayName: "GMI Cloud", baseUrl: "https://api.gmi-serving.com/v1", credentialUrl: "https://console.gmicloud.ai" },
+  {
+    id: "clixad",
+    displayName: "Clixad",
+    baseUrl: "https://clixad.onrender.com/v1",
+    requiresAccount: true,
+    credentialUrl: "https://clixad.io",
+    credentialHint: "Sign in with GitHub (device flow) or paste a Clixad token (adg_...). Model calls draw from the account balance and a daily free tier (120k credits/day).",
+  },
+  {
+    id: "deepai",
+    displayName: "DeepAI",
+    baseUrl: "https://api.deepai.org",
+    requiresAccount: true,
+    credentialUrl: "https://deepai.org",
+    credentialHint: "Sign in via the DeepAI desktop flow (loopback exchange → api_key) or paste a DeepAI api_key. Model calls are authenticated with the Api-Key header; the daily free allowance is 50 Theos and 11 models draw nothing from it.",
+  },
 
   // OpenAI-compatible bearer aggregators. Each is a bare host already rooted at
   // its own version prefix, so the `/v1`-prefixed wire paths stay pinned by the
@@ -198,6 +222,12 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
   { id: "synthetic", displayName: "Synthetic", baseUrl: "https://api.synthetic.new/v1", credentialUrl: "https://app.synthetic.new/api-keys" },
   { id: "stepfun", displayName: "StepFun", baseUrl: "https://api.stepfun.com/v1", credentialUrl: "https://platform.stepfun.com/console/keys" },
   { id: "sakana", displayName: "Sakana AI", baseUrl: "https://api.sakana.ai/v1", credentialUrl: "https://console.sakana.ai/api-keys" },
+  // SenseNova keys are per-site: China keys (token.sensenova.cn) and
+  // international keys (token.sensenova.ai) reject each other with 401
+  // "Forbidden", so the two deployments are separate providers with separate
+  // hosts and catalogs — the same split as CodeBuddy cb/cbcn.
+  { id: "sensenova", displayName: "SenseNova", baseUrl: "https://token.sensenova.cn/v1", serviceKinds: ["llm", "imageGeneration"], credentialUrl: "https://token.sensenova.cn", credentialHint: "Paste a SenseNova API key created on platform.sensenova.cn. International accounts use SenseNova (Intl)." },
+  { id: "sensenova-intl", displayName: "SenseNova (Intl)", baseUrl: "https://token.sensenova.ai/v1", serviceKinds: ["llm", "imageGeneration"], credentialUrl: "https://platform.sensenova.ai", credentialHint: "Paste a SenseNova API key created on platform.sensenova.ai. China accounts use SenseNova." },
   { id: "helmcode", displayName: "HelmCode", baseUrl: "https://api.helmcode.com/v1", credentialUrl: "https://helmcode.com/dashboard" },
   { id: "coralbricks", displayName: "CoralBricks", baseUrl: "https://api.coralbricks.com/v1", credentialUrl: "https://coralbricks.com/api-keys" },
   { id: "aiand", displayName: "ai&", baseUrl: "https://api.aiand.com/v1", credentialUrl: "https://console.aiand.com/api-keys" },

package/src/providers/quota/quota-contracts.ts

@@ -29,6 +29,8 @@ export interface ProviderQuotaResult {
   readonly plan: string | null;
   readonly windows: readonly ProviderQuotaWindow[];
   readonly error: string | null;
+  /** The provider explicitly rejected the account credential; do not retry it automatically. */
+  readonly authInvalidated?: boolean;
   /** Display identity the billing surface reported, when it reported one. */
   readonly accountLabel?: string;
 }

package/src/providers/quota/refresh.ts

@@ -21,6 +21,7 @@ import { persistQuotaSnapshot } from "./snapshot";
 import { applyAccountVerdict } from "../operations/account-health-service";
 import { asJsonbRecord } from "../../shared/coerce";
 import { KIRO_DEFAULT_LABELS } from "../integrations/kiro/kiro-oauth";
+import { invalidateCredentialCache } from "../operations/provider-credential-service";
 
 /**
  * The stock Kiro fallback labels as a SQL literal list. Built once from the
@@ -34,7 +35,7 @@ const KIRO_DEFAULT_LABEL_IN = sql.raw(
 );
 
 /** Why an account quota refresh failed; `null` means the fetch succeeded. */
-export type QuotaRefreshFailureCode = "missing_credential" | "quota_fetch_failed";
+export type QuotaRefreshFailureCode = "missing_credential" | "quota_fetch_failed" | "auth_invalidated";
 
 export interface QuotaRefreshOutcome {
   readonly quota: ProviderQuotaResult;
@@ -150,9 +151,25 @@ function isTransientTimeout(error: string | null | undefined): boolean {
 export async function recordAccountCheck(
   db: CartethyiaDatabase,
   accountId: string,
-  outcome: { ok: boolean; error?: string | null; category?: string | null },
+  outcome: { ok: boolean; error?: string | null; category?: string | null; authInvalidated?: boolean },
   snapshotInvalidator?: { invalidate(): unknown },
 ): Promise<void> {
+  if (outcome.authInvalidated === true) {
+    const disabled = await applyAccountVerdict(db, {
+      accountId,
+      status: "disabled",
+      reason: outcome.error ?? "Provider rejected account authentication",
+      category: "auth_invalidated",
+      // No deadline: a credential rejected as invalid cannot heal by waiting,
+      // and the OAuth refresh sweep must not keep spending refresh attempts.
+      cooldownUntil: null,
+    });
+    if (disabled) {
+      invalidateCredentialCache(accountId);
+      await snapshotInvalidator?.invalidate();
+    }
+    return;
+  }
   if (outcome.ok) {
     // A successful quota refresh is the freshest evidence about the account's
     // health: heal a cooldown that the refresh shows is no longer justified, so
@@ -453,7 +470,11 @@ async function runQuotaRefresh(
         error: error instanceof Error ? error.message : "Failed to refresh quota",
       };
     }
-    failure = quota.error === null ? null : "quota_fetch_failed";
+    failure = quota.error === null
+      ? null
+      : quota.authInvalidated === true
+        ? "auth_invalidated"
+        : "quota_fetch_failed";
   }
 
   // Cache even a failed fetch: the error view ("credential expired", "quota
@@ -527,6 +548,7 @@ async function runQuotaRefresh(
       {
         ok: quota.error === null,
         ...(quota.error === null ? {} : { error: quota.error, category: failure ?? "quota_fetch_failed" }),
+        ...(quota.authInvalidated === true ? { authInvalidated: true } : {}),
       },
       deps.snapshotInvalidator,
     );

package/src/security/ip-boundary.ts

@@ -9,7 +9,7 @@ import {
   ipv6ToBigInt,
   isLoopbackAddress,
   unwrapMappedIpv4,
-} from "../network/ip-utils";
+} from "../network/util/ip";
 
 export { isLoopbackAddress };
 

package/src/transport/dispatch/attempt-finalize.ts

@@ -20,7 +20,7 @@ import { modelsDevCatalog } from "../../providers/discovery/models-dev-catalog";
 import {
   disablePoolForProxyHttpStatus,
   recordPoolDispatchOutcome,
-} from "../../network/pool-health-machine";
+} from "../../network/pool/health";
 import { ProxyConnectRefusalError } from "../../network/pool/agent";
 import { captureDepthMaxBytes, providerCaptureMaxBytes } from "./capture-policy";