ldrouter 1.16.5 → 1.17.0

package/dist/server/providers/qoder/credentials.js

@@ -0,0 +1,125 @@
+// Qoder credential seam: turns an account row plus its PAT into a short-lived job token the
+// chat client can sign with, and classifies attempt failures back onto account health.
+//
+// A PAT (`pt-…`) cannot be used directly — it is exchanged at openapi for a job token (`jt-…`).
+// The exchange is coalesced per account so a burst of requests does not stampede the upstream,
+// exactly like codex-refresh.ts's flight map.
+import { GatewayError } from '../../errors.js';
+import { upstreamHttpError } from '../../upstream/client.js';
+import { getQoderAccountDetailById, getQoderAccountRefreshState, getQoderCredentials, persistQoderJobToken, readQoderCatalog, setQoderAccountHealth, } from '../../db/repositories/qoder-accounts.js';
+import { deserializeCatalog, exchangeQoderPat, fetchQoderCatalog, serializeCatalog } from './catalog.js';
+/** Refresh this far ahead of expiry so an in-flight request never crosses the boundary. */
+const REFRESH_LEAD_MS = 5 * 60 * 1000;
+const EXCHANGE_TIMEOUT_MS = 15_000;
+const flights = new Map();
+function needsRefresh(jobTokenExpiresAt, now) {
+    const expires = Date.parse(jobTokenExpiresAt);
+    return !Number.isFinite(expires) || expires - now.getTime() <= REFRESH_LEAD_MS;
+}
+function readCatalog(accountRecordId) {
+    const row = readQoderCatalog(accountRecordId);
+    return row?.catalogJson ? deserializeCatalog(row.catalogJson) : null;
+}
+async function resolveCredentials(accountRecordId, force, now) {
+    let state;
+    let credentials;
+    let detail;
+    try {
+        state = getQoderAccountRefreshState(accountRecordId);
+        detail = getQoderAccountDetailById(accountRecordId);
+        credentials = state ? getQoderCredentials(accountRecordId) : null;
+    }
+    catch {
+        // Never surface the underlying error: a decryption failure message can echo ciphertext.
+        return { ok: false, error: 'credential_unavailable' };
+    }
+    if (!state || !credentials || !detail)
+        return { ok: false, error: 'account_not_found' };
+    const base = { qoderUserId: detail.qoderUserId, machineId: detail.machineId, email: detail.email, label: detail.label };
+    if (!force && !needsRefresh(state.jobTokenExpiresAt, now)) {
+        return { ok: true, config: { ...base, jobToken: credentials.jobToken, catalog: readCatalog(accountRecordId) } };
+    }
+    // The PAT is the durable credential; the job token is derived and disposable. A fresh catalog
+    // is fetched on the same exchange because the model list is served to the same token.
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), EXCHANGE_TIMEOUT_MS);
+    try {
+        const exchanged = await exchangeQoderPat(credentials.personalToken, { signal: controller.signal });
+        const catalog = await fetchQoderCatalog({ jobToken: exchanged.jobToken, userId: exchanged.qoderUserId || detail.qoderUserId, machineId: detail.machineId }, { signal: controller.signal }).catch(() => null);
+        persistQoderJobToken(accountRecordId, {
+            jobToken: exchanged.jobToken,
+            expiresAt: exchanged.jobTokenExpiresAt,
+            ...(catalog ? { catalogJson: serializeCatalog(catalog), catalogFetchedAt: catalog.fetchedAt } : {}),
+        });
+        return {
+            ok: true,
+            config: {
+                qoderUserId: exchanged.qoderUserId || base.qoderUserId,
+                machineId: base.machineId,
+                jobToken: exchanged.jobToken,
+                catalog: catalog ?? readCatalog(accountRecordId),
+                email: exchanged.email ?? base.email,
+                label: exchanged.label ?? base.label,
+            },
+        };
+    }
+    catch {
+        // A rejected PAT is durable: the operator must replace it, so stop routing to this account.
+        setQoderAccountHealth(accountRecordId, 'down', 'personal access token rejected — replace it');
+        return { ok: false, error: 'exchange_failed' };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function toResult(result) {
+    if (result.ok)
+        return { config: result.config };
+    if (result.error === 'account_not_found')
+        throw new GatewayError('invalid_request_error', 'Qoder account not found', { status: 404 });
+    throw new GatewayError('authentication_error', 'Qoder credentials could not be refreshed — replace the personal access token', { status: 401 });
+}
+/**
+ * Resolve a usable job token for an account, refreshing when it is inside the lead window or when
+ * `force` is set. Concurrent callers share one exchange.
+ */
+export async function qoderCredentialsFor(accountRecordId, options = {}) {
+    const force = options.force === true;
+    const now = options.now ?? new Date();
+    const key = `${accountRecordId}:${force ? 'force' : 'soft'}`;
+    const existing = flights.get(key);
+    if (existing)
+        return toResult(await existing);
+    const flight = resolveCredentials(accountRecordId, force, now).finally(() => flights.delete(key));
+    flights.set(key, flight);
+    return toResult(await flight);
+}
+/**
+ * Classify a Qoder attempt failure. A rejected or expired PAT marks the account down so routing
+ * skips it; a billing wall only degrades it. Both keep the credential out of the error, and both
+ * fail the attempt so combo fallback proceeds.
+ */
+export async function qoderAttemptFailure(accountRecordId, error) {
+    const status = error.status ?? 502;
+    const billing = Boolean(error.billing);
+    if (status === 401 || status === 403) {
+        // The PAT may still be valid — the job token may merely have expired mid-request. Force one
+        // exchange before condemning the account; a second rejection is the PAT's fault.
+        const retried = await qoderCredentialsFor(accountRecordId, { force: true }).catch(() => null);
+        if (!retried) {
+            setQoderAccountHealth(accountRecordId, 'down', 'personal access token rejected — replace it');
+            throw new GatewayError('upstream_auth_error', 'Qoder account credentials were rejected — replace the personal access token', { status: 502, code: 'qoder_auth_failed' });
+        }
+        throw new GatewayError('upstream_auth_error', 'Qoder job token was rejected after a refresh', { status: 502, code: 'qoder_auth_failed' });
+    }
+    if (billing) {
+        setQoderAccountHealth(accountRecordId, 'degraded', 'upstream reported a quota or billing block');
+        throw new GatewayError('upstream_error', 'Qoder account is out of quota', { status: 502, code: 'qoder_billing_block' });
+    }
+    throw upstreamHttpError(status, '', error);
+}
+/** Probe/discover share this: a catalog is the only proof the PAT works end to end. */
+export async function withQoderCredentials(accountRecordId, fn) {
+    const { config } = await qoderCredentialsFor(accountRecordId);
+    return fn(config);
+}

package/dist/server/providers/qoder/encode.js

@@ -0,0 +1,28 @@
+// Qoder request-body obfuscation for `&Encode=1`: standard base64, split into thirds
+// and reordered [tail][mid][head], then mapped through a custom 64-char alphabet.
+// Second-order WAF evasion, not security: the transform is public and reversible.
+// Pure and log-free — the plaintext is request content, so never echo it.
+const STD_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+const CUSTOM_ALPHABET = '_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!';
+const S2C = (() => {
+    const table = new Int16Array(128).fill(-1);
+    for (let i = 0; i < 64; i += 1)
+        table[STD_ALPHABET.charCodeAt(i)] = CUSTOM_ALPHABET.charCodeAt(i);
+    table['='.charCodeAt(0)] = '$'.charCodeAt(0);
+    return table;
+})();
+/** Encode a request body so the upstream can decode it with `&Encode=1`. */
+export function encodeQoderBody(plaintext) {
+    const buf = Buffer.isBuffer(plaintext) ? plaintext : typeof plaintext === 'string' ? Buffer.from(plaintext, 'utf8') : Buffer.from(plaintext);
+    const standard = buf.toString('base64');
+    const n = standard.length;
+    const a = Math.floor(n / 3);
+    const rearranged = standard.slice(n - a) + standard.slice(a, n - a) + standard.slice(0, a);
+    const out = Buffer.alloc(n);
+    for (let i = 0; i < n; i += 1) {
+        const code = rearranged.charCodeAt(i);
+        const mapped = code < 128 ? S2C[code] ?? -1 : -1;
+        out[i] = mapped >= 0 ? mapped : code;
+    }
+    return out.toString('latin1');
+}

package/dist/server/providers/qoder/qoder-import.js

@@ -0,0 +1,109 @@
+// Qoder credential import normalizer. PAT-only: a `pt-…` personal access token is the single
+// importable credential, because it is the only one the gateway can renew itself. Device tokens
+// (`dt-…`) expire after ~30 days with no refresh and job tokens (`jt-…`) are derived and
+// short-lived, so both are rejected here with a reason instead of failing upstream later.
+import { createHash } from 'node:crypto';
+const MAX_INPUT_BYTES = 2_000_000;
+const MAX_RECORDS = 500;
+const MAX_TOKEN_LENGTH = 200_000;
+const PAT_PREFIX = 'pt-';
+const stringValue = (value) => {
+    if (typeof value !== 'string')
+        return null;
+    const result = value.replace(/^\uFEFF/, '').trim();
+    return result || null;
+};
+const firstString = (...values) => {
+    for (const value of values) {
+        const result = stringValue(value);
+        if (result)
+            return result;
+    }
+    return null;
+};
+function objectValue(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function mask(value) {
+    if (!value)
+        return null;
+    return value.length <= 8 ? `${value.slice(0, 2)}…${value.slice(-2)}` : `${value.slice(0, 4)}…${value.slice(-4)}`;
+}
+/** Never derived from the token itself in any recoverable way — one-way, like Codex's identity. */
+export function qoderTokenFingerprint(personalToken) {
+    return `pat:${createHash('sha256').update(personalToken).digest('hex').slice(0, 32)}`;
+}
+export function isQoderPatImportable(token) {
+    return typeof token === 'string' && token.trim().startsWith(PAT_PREFIX);
+}
+export function normalizeQoderToken(input, index, source) {
+    const raw = objectValue(input);
+    // A bare string is the token; an object is matched against the aliases the Codex importer
+    // accepts so one export file works for either provider.
+    const token = stringValue(input) ?? (raw
+        ? firstString(raw.token, raw.pt_token, raw.personal_token, raw.personalToken, raw.access_token, raw.accessToken)
+        : null);
+    if (!token)
+        return { index, source, error: 'Missing personal access token' };
+    if (token.length > MAX_TOKEN_LENGTH)
+        return { index, source, error: 'Token exceeds maximum length' };
+    if (!token.startsWith(PAT_PREFIX)) {
+        // A dt- device token or a jt- job token is not importable; saying so beats an opaque 403 later.
+        return { index, source, error: 'Not a Qoder personal access token (must start with pt-)' };
+    }
+    const label = raw ? firstString(raw.label, raw.name, raw.email) : null;
+    return { index, personalToken: token, label, source };
+}
+function expandRoot(value) {
+    const root = objectValue(value);
+    if (Array.isArray(value))
+        return value;
+    if (root && Array.isArray(root.accounts))
+        return root.accounts;
+    return [value];
+}
+export function parseQoderImportText(text, source) {
+    if (Buffer.byteLength(text, 'utf8') > MAX_INPUT_BYTES)
+        return [{ index: 0, source, error: 'Input exceeds maximum size' }];
+    const cleaned = text.replace(/^\uFEFF/, '').trim();
+    if (!cleaned)
+        return [{ index: 0, source, error: 'Input is empty' }];
+    let roots;
+    try {
+        roots = expandRoot(JSON.parse(cleaned));
+    }
+    catch {
+        // Plain text / JSONL: one token (or JSON object) per line. A single unparseable line is
+        // still passed through as a bare string so the pt- check reports the real reason.
+        const lines = cleaned.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+        roots = lines.map((line) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return line;
+            }
+        });
+    }
+    const results = [];
+    for (const root of roots) {
+        for (const item of expandRoot(root)) {
+            if (results.length >= MAX_RECORDS) {
+                results.push({ index: results.length, source, error: 'Input exceeds maximum record count' });
+                return results;
+            }
+            results.push(normalizeQoderToken(item, results.length, source));
+        }
+    }
+    return results;
+}
+export function toQoderPreview(record, duplicateOf = null) {
+    return {
+        index: record.index, source: record.source, valid: true,
+        personalTokenMasked: mask(record.personalToken) ?? '', label: record.label,
+        fingerprint: qoderTokenFingerprint(record.personalToken), duplicateOf,
+    };
+}
+export function toQoderImportResult(records, failures = []) {
+    return { records: records.map((record) => toQoderPreview(record)), failures };
+}

package/dist/server/providers/qoder/rsa.js

@@ -0,0 +1,7 @@
+/** RSA public key used to wrap the per-request AES key. Not a secret. */
+export const QODER_RSA_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
+4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
+6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
+XcW+ML9FoCI6AOvOzwIDAQAB
+-----END PUBLIC KEY-----`;

package/dist/server/providers/qoder/sse.js

@@ -0,0 +1,211 @@
+const BILLING_CODES = /"code"\s*:\s*"(112|10605)"/;
+function isBilling(message) {
+    return BILLING_CODES.test(message) || message.toLowerCase().includes('pricingurl');
+}
+function numberOr(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback;
+}
+export function qoderUsageOf(value) {
+    const usage = (value && typeof value === 'object' ? value : {});
+    const details = (usage.prompt_tokens_details && typeof usage.prompt_tokens_details === 'object' ? usage.prompt_tokens_details : {});
+    const input = numberOr(usage.prompt_tokens ?? usage.input_tokens, 0);
+    const output = numberOr(usage.completion_tokens ?? usage.output_tokens, 0);
+    return {
+        input, output,
+        total: numberOr(usage.total_tokens, input + output),
+        cacheRead: numberOr(details.cached_tokens ?? usage.cached_tokens ?? usage.cache_read_input_tokens, 0),
+        cacheWrite: numberOr(details.cache_creation_tokens ?? usage.cache_creation_input_tokens, 0),
+        reasoning: numberOr(usage.reasoning_tokens ?? usage.completion_tokens_details?.reasoning_tokens, 0),
+    };
+}
+export class QoderEnvelopeReader {
+    options;
+    chunks = [];
+    toolCalls = [];
+    text = '';
+    finishReason = null;
+    usage = null;
+    error = null;
+    buffer = '';
+    ended = false;
+    pendingFinish = null;
+    pendingUsage = null;
+    finishForwarded = false;
+    meta;
+    constructor(options) {
+        this.options = options;
+        this.meta = { id: null, created: null };
+    }
+    terminal() { return this.ended; }
+    errorEnvelope() { return this.error; }
+    push(text) {
+        if (this.ended)
+            return;
+        this.buffer += text;
+        let index;
+        while ((index = this.buffer.indexOf('\n')) !== -1) {
+            const line = this.buffer.slice(0, index);
+            this.buffer = this.buffer.slice(index + 1);
+            this.line(line);
+            if (this.ended)
+                return;
+        }
+    }
+    /** Flush a final line that arrived without a terminating newline. */
+    finish() {
+        if (!this.ended && this.buffer.length > 0) {
+            const line = this.buffer;
+            this.buffer = '';
+            this.line(line);
+        }
+        this.flushPending();
+    }
+    cancel() { this.ended = true; this.buffer = ''; }
+    line(raw) {
+        const trimmed = raw.replace(/\r$/, '').trim();
+        if (!trimmed.startsWith('data:'))
+            return;
+        const data = trimmed.slice(5).trimStart();
+        if (data === '[DONE]') {
+            this.flushPending();
+            return;
+        }
+        let envelope;
+        try {
+            envelope = JSON.parse(data);
+        }
+        catch {
+            return;
+        }
+        const statusValue = numberOr(envelope.statusCodeValue, 200);
+        let inner;
+        if (typeof envelope.body === 'string') {
+            inner = envelope.body;
+            // Upstream may send `body` as a JSON-encoded string literal; unwrap that one layer.
+            if (inner.startsWith('"')) {
+                try {
+                    const parsed = JSON.parse(inner);
+                    if (typeof parsed === 'string')
+                        inner = parsed;
+                }
+                catch { /* keep raw */ }
+            }
+        }
+        else {
+            inner = envelope.body == null ? '' : JSON.stringify(envelope.body);
+        }
+        if (statusValue !== 200) {
+            this.error = { statusValue, message: inner || `upstream status ${statusValue}`, billing: isBilling(inner) };
+            this.ended = true;
+            return;
+        }
+        if (!inner || inner === '[DONE]') {
+            this.flushPending();
+            return;
+        }
+        let chunk;
+        try {
+            chunk = JSON.parse(inner);
+        }
+        catch {
+            return;
+        }
+        if (typeof chunk.id === 'string' && chunk.id)
+            this.meta.id = chunk.id;
+        if (typeof chunk.created === 'number')
+            this.meta.created = chunk.created;
+        if (chunk.usage)
+            this.pendingUsage = qoderUsageOf(chunk.usage);
+        const choice = (Array.isArray(chunk.choices) ? chunk.choices[0] : null);
+        const delta = (choice?.delta ?? {});
+        const finish = (choice?.finish_reason ?? delta.finish_reason);
+        const content = typeof delta.content === 'string' ? delta.content : '';
+        const reasoning = typeof delta.reasoning_content === 'string' ? delta.reasoning_content : '';
+        const toolCalls = Array.isArray(delta.tool_calls) ? delta.tool_calls : [];
+        if (content || reasoning || toolCalls.length > 0) {
+            if (content)
+                this.text += content;
+            for (const call of toolCalls) {
+                let input = {};
+                if (typeof call.function?.arguments === 'string' && call.function.arguments) {
+                    try {
+                        input = JSON.parse(call.function.arguments);
+                    }
+                    catch {
+                        input = {};
+                    }
+                }
+                this.toolCalls.push({ id: call.id ?? `call-${this.toolCalls.length}`, name: call.function?.name ?? 'unknown', input });
+            }
+            // Pass the upstream chunk through verbatim so client-side shape is preserved.
+            this.emit(chunk);
+            // Forward the upstream finish reason verbatim; a `tool_calls` finish must survive
+            // the coalesce, so never coerce it to 'stop' here.
+            if (finish) {
+                this.finishForwarded = true;
+                this.pendingFinish = finish;
+                this.finishReason = finish;
+            }
+            this.endOnUsage();
+            return;
+        }
+        if (finish) {
+            this.pendingFinish = finish;
+            this.finishReason = finish;
+        }
+        this.endOnUsage();
+    }
+    /**
+     * A usage frame terminates the stream even when no finish_reason was ever seen: usage
+     * arriving is itself the end-of-stream signal. Shared by both entry paths so they cannot
+     * drift apart. When both are present the coalesce still happens in emitTerminal().
+     */
+    endOnUsage() {
+        if (!this.pendingUsage)
+            return;
+        if (!this.pendingFinish)
+            this.pendingFinish = 'stop';
+        this.emitTerminal();
+    }
+    emit(chunk) {
+        this.chunks.push(JSON.stringify(chunk));
+    }
+    emitTerminal() {
+        if (this.pendingFinish || this.pendingUsage) {
+            // We only reach here with finishReason still null when we synthesized 'stop' ourselves
+            // (usage-only termination). The accessor must report what went on the wire; a real
+            // upstream reason is always recorded alongside pendingFinish and is never overwritten.
+            if (!this.finishReason)
+                this.finishReason = 'stop';
+            this.usage = this.pendingUsage ?? this.usage;
+            this.chunks.push(JSON.stringify({
+                id: this.meta.id ?? `qoder-${Date.now()}`,
+                object: 'chat.completion.chunk',
+                created: this.meta.created ?? Math.floor(Date.now() / 1000),
+                model: this.options.model,
+                choices: [{ index: 0, delta: {}, finish_reason: this.pendingFinish ?? 'stop' }],
+                ...(this.pendingUsage ? { usage: this.toOpenAIUsage(this.pendingUsage) } : {}),
+            }));
+            this.pendingFinish = null;
+            this.pendingUsage = null;
+        }
+        this.ended = true;
+    }
+    flushPending() {
+        if (this.ended)
+            return;
+        if (this.pendingUsage || (this.pendingFinish && !this.finishForwarded))
+            this.emitTerminal();
+        this.ended = true;
+    }
+    toOpenAIUsage(usage) {
+        return {
+            prompt_tokens: usage.input,
+            completion_tokens: usage.output,
+            total_tokens: usage.total,
+            ...(usage.cacheRead ? { prompt_tokens_details: { cached_tokens: usage.cacheRead } } : {}),
+            ...(usage.reasoning ? { completion_tokens_details: { reasoning_tokens: usage.reasoning } } : {}),
+        };
+    }
+}

package/dist/server/providers/qoder/tier.js

@@ -0,0 +1,105 @@
+// Qoder context-window tiers. A model_config advertises context_config tiers
+// (200K/400K/1M) while max_input_tokens carries only the IDE-selected one. The IDE
+// lets the user switch; a CLI-style client has no picker, so a long session is
+// rejected upstream even though the model supports more. Emulate the picker:
+// estimate the prompt, choose the smallest tier that fits, mirror it into the same
+// three fields the IDE writes. Pure — no I/O.
+import { QODER_CONTEXT_TIER_ENV, QODER_CONTEXT_TIER_HEADROOM } from './constants.js';
+const UNIT = { K: 1_000, M: 1_000_000 };
+export function parseTierTokenCount(value) {
+    if (typeof value === 'number')
+        return Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
+    if (typeof value !== 'string')
+        return 0;
+    const match = value.trim().toUpperCase().match(/^(\d+(?:\.\d+)?)\s*([KM])?$/);
+    if (!match)
+        return 0;
+    const count = Number(match[1]) * (UNIT[match[2] ?? ''] ?? 1);
+    return Number.isFinite(count) && count > 0 ? Math.floor(count) : 0;
+}
+function tierName(entry, tokenCount) {
+    const raw = entry.name ?? entry.label ?? entry.display_name ?? entry.displayName;
+    if (typeof raw === 'string' && raw.trim())
+        return raw.trim();
+    return String(tokenCount);
+}
+export function getQoderContextTiers(modelConfig) {
+    const list = modelConfig?.context_config ?? modelConfig?.contextConfig;
+    if (!Array.isArray(list))
+        return [];
+    const byCount = new Map();
+    for (const item of list) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const entry = item;
+        const tokenCount = parseTierTokenCount(entry.tokenCount ?? entry.token_count ?? entry.max_input_tokens ?? entry.maxInputTokens);
+        if (!tokenCount)
+            continue;
+        const isDefault = entry.isDefault === true || entry.is_default === true || entry.default === true;
+        const previous = byCount.get(tokenCount);
+        byCount.set(tokenCount, { name: tierName(entry, tokenCount), tokenCount, isDefault: (previous?.isDefault ?? false) || isDefault });
+    }
+    return [...byCount.values()].sort((a, b) => a.tokenCount - b.tokenCount);
+}
+const CJK_RE = /[\u1100-\u11ff\u2e80-\u9fff\uac00-\ud7af\uf900-\ufaff\uff00-\uffef]/g;
+/** CJK counts ~1 token per char; everything else ~4 chars per token. */
+export function estimateQoderPromptTokens(prompt = {}) {
+    let text;
+    try {
+        text = JSON.stringify({ system: prompt.system ?? '', messages: prompt.messages ?? [], tools: prompt.tools ?? [] }) ?? '';
+    }
+    catch {
+        return 0;
+    }
+    const cjk = (text.match(CJK_RE) ?? []).length;
+    return Math.ceil(cjk + (text.length - cjk) / 4);
+}
+/**
+ * null means "send the payload as-is": the model has no tiers, or the default already fits.
+ * Pure function of its inputs plus the QODER_CONTEXT_TIER env var.
+ */
+export function resolveQoderContextTier(modelConfig, prompt, options = {}) {
+    const tiers = getQoderContextTiers(modelConfig);
+    if (tiers.length === 0)
+        return null;
+    const preference = String(options.preference ?? process.env[QODER_CONTEXT_TIER_ENV] ?? '').trim().toLowerCase() || 'auto';
+    const largest = tiers[tiers.length - 1];
+    const defaultTier = tiers.find((tier) => tier.isDefault) ?? tiers[0];
+    const estimatedTokens = estimateQoderPromptTokens(prompt);
+    const headroom = typeof options.headroom === 'number' ? options.headroom : QODER_CONTEXT_TIER_HEADROOM;
+    const needed = Math.ceil(estimatedTokens * (1 + headroom));
+    if (preference === 'max')
+        return { tier: largest, estimatedTokens, reason: 'forced:max' };
+    if (preference === 'default')
+        return { tier: defaultTier, estimatedTokens, reason: 'forced:default' };
+    if (preference !== 'auto') {
+        const wanted = preference.replace(/\s+/g, '');
+        const asCount = parseTierTokenCount(wanted);
+        const named = tiers.find((tier) => tier.name.replace(/\s+/g, '').toLowerCase() === wanted || (asCount > 0 && tier.tokenCount === asCount));
+        if (named)
+            return { tier: named, estimatedTokens, reason: `forced:${named.name}` };
+    }
+    const currentLimit = parseTierTokenCount(modelConfig?.max_input_tokens ?? modelConfig?.maxInputTokens) || defaultTier.tokenCount;
+    if (needed <= currentLimit)
+        return null;
+    const fits = tiers.find((tier) => tier.tokenCount >= needed && tier.tokenCount > currentLimit);
+    const tier = fits ?? largest;
+    if (tier.tokenCount <= currentLimit)
+        return null;
+    return { tier, estimatedTokens, reason: fits ? 'auto:fits' : 'auto:largest' };
+}
+/** Mutates and returns the payload, mirroring the IDE's three writes. */
+export function applyQoderContextTier(payload, tier) {
+    if (!payload || !tier?.tokenCount)
+        return payload;
+    const target = payload;
+    target.parameters = { ...(target.parameters ?? {}), context_length: tier.tokenCount };
+    const chatContext = target.chat_context ?? {};
+    const extra = chatContext.extra ?? {};
+    chatContext.extra = { ...extra, ideModelConfigOverride: { max_input_tokens: tier.tokenCount } };
+    target.chat_context = chatContext;
+    if (target.model_config && typeof target.model_config === 'object') {
+        target.model_config = { ...target.model_config, max_input_tokens: tier.tokenCount };
+    }
+    return payload;
+}

package/dist/server/routes/admin/backup.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
 import { getDb, closeDb, openDb, schema } from '../../db/index.js';
-import { requireAdminAuth } from '../../auth/middleware.js';
+import { requireAdminAuth, requireAdminCsrf } from '../../auth/middleware.js';
 import { sha256Hex } from '../../auth/ids.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { loadConfig, setConfigMasterKey } from '../../config/index.js';
@@ -54,10 +54,15 @@ function assertDatabaseUsable(expectedSchemaVersion) {
     }
 }
 export async function registerBackupRoutes(app) {
+    // This module is registered in its own scope (routes/admin.ts) precisely so this is the only
+    // auth hook on the backup routes. A preHandler cannot cancel a later one, so the first-run
+    // import exemption must not sit alongside another admin module's requireAdminAuth.
     app.addHook('preHandler', async (req, reply) => {
         if (req.url === '/api/admin/backup/restore' && !getSettings().setupComplete)
             return;
-        return requireAdminAuth(req, reply);
+        await requireAdminAuth(req, reply);
+        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method))
+            await requireAdminCsrf(req);
     });
     app.post('/api/admin/backup/create', async (req, reply) => {
         const passphrase = req.body?.passphrase ?? '';

package/dist/server/routes/admin/models.js

@@ -88,6 +88,9 @@ export async function registerModelRoutes(app) {
         const { codexModels } = await import('../../providers/codex.js');
         const { getCodexAccountById, listCodexAccountSummaries } = await import('../../db/repositories/codex-accounts.js');
         const { withCodexCredentials } = await import('../../providers/codex-refresh.js');
+        const { withQoderCredentials } = await import('../../providers/qoder/credentials.js');
+        const { qoderModels } = await import('../../providers/qoder/client.js');
+        const { listQoderAccountSummaries } = await import('../../db/repositories/qoder-accounts.js');
         let discovered;
         try {
             if (provider.type === 'codex') {
@@ -100,6 +103,17 @@ export async function registerModelRoutes(app) {
                     accountRecordId: account.id, customHeaders: {}, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 30000),
                 }));
             }
+            else if (provider.type === 'qoder') {
+                // The catalog is fetched live from the first eligible account; no manual model list.
+                const summary = listQoderAccountSummaries(provider.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
+                if (!summary)
+                    throw new GatewayError('authentication_error', 'No eligible Qoder account is configured', { status: 503 });
+                discovered = await withQoderCredentials(summary.id, (config) => {
+                    if (!config.catalog)
+                        throw new GatewayError('invalid_request_error', 'Qoder model catalog is empty — replace the personal access token', { status: 400, code: 'model_config_not_cached' });
+                    return Promise.resolve(qoderModels(config.catalog));
+                });
+            }
             else {
                 if (!provider.encryptedApiKey || !provider.apiKeyNonce)
                     throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });