ldrouter 1.16.5 → 1.17.1

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.17.1] - 2026-09-17
+
+### Added
+
+- **Combo members are ordered by drag and drop.** The combo create/edit dialog lists members as sortable rows (`@dnd-kit`, the same interaction as the Codex and Qoder account pools): drag the handle — or reorder with the keyboard — and the row order becomes the saved priority, `position` 0 being tried first in fallback mode and leading the rotation in weighted round-robin.
+
+### Fixed
+
+- **`GET /api/admin/combos/:id` returned members in SQLite row order instead of priority order**, so a reordered combo could reopen showing the previous sequence. Members are now sorted by `position`.
+
+## [1.17.0] - 2026-09-17
+
+### Added
+
+- **Qoder provider.** Qoder joins OpenAI, Anthropic and Codex as a first-class provider type, backed by personal access tokens (`pt-…`) that are exchanged for short-lived job tokens and stored encrypted. It brings a per-account pool with drag-to-reorder routing priority, live model-catalog import, an account health panel, bulk token import, and the signed (COSY) streaming and non-streaming chat client, including context-tier selection and the `Encode=1` body encoding.
+
+### Fixed
+
+- **Codex requests never satisfied the backend contract.** Every call answered `502 Codex upstream HTTP 400`: the backend requires `store: false` and `stream: true` verbatim. Non-streaming requests are now served by merging the upstream stream, which also restores tool calls — `response.completed` always carries `output: []`, so they are only observable on `response.output_item.done` and were previously dropped silently on both paths.
+- **Expired Codex tokens could never be refreshed.** Routing and the account lookup rejected an account whose access token had expired, even though credentials are refreshed before use, so a healthy account stopped carrying traffic once its token aged out. The refresh client also omitted `client_id`, making every refresh fail on the backend side. Both are fixed and the account now recovers on the next request.
+- **Codex rejected three optional parameters.** `max_output_tokens`, `temperature` and `top_p` each answered `400 Unsupported parameter`, so any client that set `max_tokens` against a `codex/` model failed — including the Models-page Test button, which always sets it. They are no longer forwarded; `instructions`, `tools` and `reasoning` still are.
+- **Several admin actions failed with `403 CSRF token required`.** The model Test button, database backup create/restore, and the first-run database import called `fetch` directly instead of the shared client, so they carried no CSRF header while every authenticated admin mutation requires one. They now use a CSRF-aware wrapper; the first-run import is the deliberate exception, since no admin session exists yet.
+- **The first-run database import was unreachable.** `POST /api/admin/backup/restore` answered `401 Login required` on a fresh instance, because its exemption from auth ran alongside the other admin modules' hooks on a shared scope, and a `preHandler` cannot cancel a later one. Backup routes now register in their own scope.
+- **The Qoder account enable/disable button appeared dead.** The toggle wrote to the server correctly but never re-read the list, so the row kept showing its previous state. Test and Catalog had the same gap.
+
 ## [1.16.5] - 2026-09-15
 
 ### Fixed

package/README.md

@@ -20,6 +20,7 @@ Lightweight self-hosted LLM gateway with a polished admin UI. Presents stable Op
 - Prometheus `/metrics`, structured logs, graceful shutdown
 - One distributable npm package, multi-stage Dockerfile, Docker Compose
 - Native Codex OAuth account pools with encrypted JSON/JSONL import, refresh/rotation, account-aware routing, and admin management
+- Native Qoder account pools driven by personal access tokens, with encrypted storage, live model-catalog discovery, and account-aware routing
 
 ## Quick start
 
@@ -64,6 +65,22 @@ ZIP upload and automatic Codex CLI config-file generation/mutation are not inclu
 
 The account panel shows the 5-hour and weekly quota windows with reset countdowns, per-account and bulk usage refresh, weekly reset credits, an opt-in 5-hour window auto-start, and a **Test** control that probes the upstream account without exposing tokens. Routing order is set by dragging rows; the saved order is the fallback order the router uses. **Delete** is permanent and erases the stored encrypted credentials — past request logs are kept but lose the account reference.
 
+### Qoder setup
+
+Qoder providers use a personal access token (PAT) instead of an API key. Create one at `https://qoder.com/account/integrations`; it starts with `pt-`.
+
+1. Set `LATEDEV_MASTER_KEY` before adding a token. It encrypts both the PAT and the derived job token at rest.
+2. In **Providers**, click **Add Qoder**. The server creates the provider with its fixed endpoint — there is no base URL or API key to fill in.
+3. In the Qoder account panel, click **Add token** and paste the PAT, or **Import tokens** to paste/upload a list: one token per line, a JSON array of strings, an `{ "accounts": [...] }` wrapper, or JSONL of strings/objects (`token`, `pt_token`, `personal_token`, `access_token`; optional `label`/`name`/`email`). Only `pt-` tokens are accepted — a `dt-` device token or a `jt-` job token is rejected with that reason rather than failing later upstream.
+
+Adding a token exchanges it immediately for a short-lived job token and fetches the model list; inference then runs against `api2.qoder.sh` using that job token. The PAT is kept so a new job token can always be minted — the operator never has to touch it again. If the token works but the model list cannot be fetched, the account is still stored (health `unknown`, with the error recorded) so you can retry with **Catalog**.
+
+Because the gateway serves model discovery from that live catalog, a new account has no routable models until its first successful fetch. Use **Import models** on the provider row to pull the discovered models in.
+
+**Operational caveat:** a revoked or expired PAT is a durable failure. The account is marked `down` with "personal access token rejected — replace it" and routing skips it; nothing retries it forever. Re-add the account with a fresh token. Deleting an account is permanent and erases the stored encrypted PAT — past request logs are kept but lose the account reference.
+
+The panel shows the masked user id, job-token expiry, when the catalog was last fetched, health, and an enabled toggle. Routing order is set by dragging rows, exactly as with Codex.
+
 ## Environment variables
 
 | Variable | Description | Default |

package/dist/server/db/repositories/codex-accounts.js

@@ -41,15 +41,27 @@ export function listCodexAccountsForProvider(providerId) {
     return client().prepare(`SELECT id, chatgpt_account_id AS chatgptAccountId, enabled, health_state AS healthState, token_expires_at AS tokenExpiresAt, priority FROM codex_accounts WHERE provider_id=? ORDER BY priority,id`).all(providerId);
 }
 export function getCodexAccountForProvider(providerId) {
-    const row = listCodexAccountsForProvider(providerId).find((a) => a.enabled && (a.healthState === 'healthy' || a.healthState === 'unknown') && Date.parse(a.tokenExpiresAt) > Date.now());
+    const row = listCodexAccountsForProvider(providerId).find((a) => a.enabled && a.healthState !== 'down');
     return row?.chatgptAccountId ? { id: row.id, chatgptAccountId: row.chatgptAccountId } : null;
 }
 export function getCodexAccountById(id) {
-    const row = client().prepare(`SELECT id, chatgpt_account_id AS chatgptAccountId, enabled, health_state AS healthState, token_expires_at AS tokenExpiresAt FROM codex_accounts WHERE id=?`).get(id);
-    if (!row || !row.enabled || !['healthy', 'unknown'].includes(row.healthState) || Date.parse(row.tokenExpiresAt) <= Date.now())
+    const row = client().prepare(`SELECT id, chatgpt_account_id AS chatgptAccountId, enabled, health_state AS healthState FROM codex_accounts WHERE id=?`).get(id);
+    // No token-expiry predicate: `withCodexCredentials` refreshes a stale token before the upstream
+    // call, so rejecting expired accounts here only blocked requests that were about to self-heal.
+    if (!row || !row.enabled || row.healthState === 'down')
         return null;
     return row.chatgptAccountId ? { id: row.id, chatgptAccountId: row.chatgptAccountId } : null;
 }
+/**
+ * Plain column read — deliberately no eligibility predicate. A pool provider gates account
+ * selection itself (`firstEligible`), and a `degraded` or token-expired account is still usable:
+ * `withCodexCredentials` refreshes the token before the upstream call. Using `getCodexAccountById`
+ * here would reintroduce a second, stricter gate that the route this replaced never had.
+ */
+export function chatgptAccountIdOf(id) {
+    const row = client().prepare('SELECT chatgpt_account_id AS chatgptAccountId FROM codex_accounts WHERE id=?').get(id);
+    return row?.chatgptAccountId ?? null;
+}
 export function listCodexAccountSummaries(providerId) {
     const rows = client().prepare(`SELECT id,email,workspace_id AS workspaceId,chatgpt_account_id AS chatgptAccountId,plan_type AS planType,token_expires_at AS tokenExpiresAt,enabled,health_state AS healthState,last_refresh_at AS lastRefreshAt,priority,codex_autostart_enabled AS autostart,codex_usage_json AS usageJson,codex_usage_error AS usageError,codex_usage_updated_at AS usageUpdatedAt,last_pinged_reset_at AS lastPingedResetAt,last_ping_at AS lastPingAt,created_at AS createdAt,updated_at AS updatedAt FROM codex_accounts WHERE provider_id=? ORDER BY priority,id`).all(providerId);
     return rows.map(toCodexAccountSummaryRow);

package/dist/server/db/repositories/qoder-accounts.js

@@ -0,0 +1,167 @@
+// Qoder account pool: the upstream credential is a per-account personal access token
+// (`pt-…`) exchanged for a short-lived job token (`jt-…`). Both are encrypted at rest;
+// nothing here ever returns them in a summary.
+import { decryptSecret, encryptSecret } from '../../auth/crypto.js';
+import { uuid } from '../../auth/ids.js';
+import { createHash } from 'node:crypto';
+import { getRawDb } from '../index.js';
+export function maskQoderValue(value) {
+    if (!value)
+        return null;
+    return value.length <= 8 ? `${value.slice(0, 2)}…${value.slice(-2)}` : `${value.slice(0, 4)}…${value.slice(-4)}`;
+}
+export function identityFromQoderRecord(record) {
+    return {
+        qoderUserId: record.qoderUserId,
+        machineId: record.machineId,
+        email: record.email,
+        label: record.label,
+    };
+}
+const SUMMARY_COLUMNS = 'id,provider_id AS providerId,label,email,qoder_user_id AS qoderUserId,machine_id AS machineId,enabled,health_state AS healthState,priority,job_token_expires_at AS jobTokenExpiresAt,catalog_fetched_at AS catalogFetchedAt,last_error AS lastError,consecutive_failures AS consecutiveFailures,created_at AS createdAt,updated_at AS updatedAt';
+export function toQoderAccountSummary(row) {
+    return {
+        id: row.id,
+        label: row.label,
+        email: row.email,
+        qoderUserIdMasked: maskQoderValue(row.qoderUserId),
+        // SQLite hands raw rows back as 0/1; the API contract (and the web UI) expects a boolean.
+        enabled: Boolean(row.enabled),
+        healthState: row.healthState,
+        priority: row.priority,
+        jobTokenExpiresAt: row.jobTokenExpiresAt,
+        catalogFetchedAt: row.catalogFetchedAt,
+        lastError: row.lastError,
+        consecutiveFailures: row.consecutiveFailures,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+export function listQoderAccountSummaries(providerId) {
+    const rows = getRawDb()
+        .prepare(`SELECT ${SUMMARY_COLUMNS} FROM qoder_accounts WHERE provider_id=? ORDER BY priority,id`)
+        .all(providerId);
+    return rows.map(toQoderAccountSummary);
+}
+export function listQoderAccountsForProvider(providerId) {
+    const rows = getRawDb()
+        .prepare(`SELECT ${SUMMARY_COLUMNS} FROM qoder_accounts WHERE provider_id=? ORDER BY priority,id`)
+        .all(providerId);
+    return rows.map((row) => ({ ...toQoderAccountSummary(row), providerId: row.providerId, qoderUserId: row.qoderUserId, machineId: row.machineId }));
+}
+export function findEligibleQoderAccount(providerId) {
+    const row = getRawDb()
+        .prepare(`SELECT id,qoder_user_id AS qoderUserId,enabled,health_state AS healthState,priority
+       FROM qoder_accounts WHERE provider_id=? AND enabled=1 AND health_state<>'down'
+       ORDER BY priority,id LIMIT 1`)
+        .get(providerId);
+    if (!row)
+        return null;
+    return { id: row.id, qoderUserId: row.qoderUserId, enabled: Boolean(row.enabled), healthState: row.healthState, priority: row.priority };
+}
+/**
+ * Match an imported PAT against existing rows. The PAT is the identity: the same token re-imported
+ * must update its account rather than create a duplicate. Rows are compared by decrypting each
+ * stored PAT (a handful at most) because the plaintext digest cannot be stored — that would make
+ * the token recoverable from the database.
+ */
+export function findQoderAccountForImport(providerId, personalToken) {
+    const target = createHash('sha256').update(personalToken, 'utf8').digest('hex');
+    const rows = getRawDb().prepare('SELECT id FROM qoder_accounts WHERE provider_id=?').all(providerId);
+    for (const row of rows) {
+        const digest = createHash('sha256').update(getQoderCredentials(row.id).personalToken, 'utf8').digest('hex');
+        if (digest === target)
+            return row.id;
+    }
+    return null;
+}
+export function getQoderCredentials(id) {
+    const row = getRawDb()
+        .prepare('SELECT encrypted_pat, pat_nonce, pat_version, encrypted_job_token, job_token_nonce, job_token_version, job_token_expires_at AS jobTokenExpiresAt FROM qoder_accounts WHERE id=?')
+        .get(id);
+    if (!row)
+        throw new Error('Qoder account not found');
+    return {
+        personalToken: decryptSecret({ ciphertext: row.encrypted_pat, nonce: row.pat_nonce, version: row.pat_version }),
+        jobToken: decryptSecret({ ciphertext: row.encrypted_job_token, nonce: row.job_token_nonce, version: row.job_token_version }),
+        jobTokenExpiresAt: row.jobTokenExpiresAt,
+    };
+}
+export function getQoderAccountRefreshState(id) {
+    const row = getRawDb().prepare('SELECT job_token_expires_at AS jobTokenExpiresAt FROM qoder_accounts WHERE id=?').get(id);
+    return row ?? null;
+}
+/** Identity of one account by its own id (the pool-wide lookups are keyed by provider). */
+export function getQoderAccountDetailById(id) {
+    const row = getRawDb().prepare(`SELECT ${SUMMARY_COLUMNS} FROM qoder_accounts WHERE id=?`).get(id);
+    return row ? { ...toQoderAccountSummary(row), providerId: row.providerId, qoderUserId: row.qoderUserId, machineId: row.machineId } : null;
+}
+function persistQoderAccount(providerId, record, existingId) {
+    const raw = getRawDb();
+    const pat = encryptSecret(record.personalToken);
+    const jobToken = encryptSecret(record.jobToken);
+    const now = existingId ? nextUpdatedAt(existingId) : new Date().toISOString();
+    const transaction = raw.transaction(() => {
+        if (existingId) {
+            raw
+                .prepare(`UPDATE qoder_accounts SET email=?, label=?, machine_id=?, encrypted_pat=?, pat_nonce=?, pat_version=?,
+           encrypted_job_token=?, job_token_nonce=?, job_token_version=?, job_token_expires_at=?,
+           last_error=NULL, consecutive_failures=0, health_state='unknown', updated_at=? WHERE id=?`)
+                .run(record.email, record.label, record.machineId, pat.ciphertext, pat.nonce, pat.version, jobToken.ciphertext, jobToken.nonce, jobToken.version, record.jobTokenExpiresAt, now, existingId);
+            return existingId;
+        }
+        const priority = raw.prepare('SELECT COALESCE(MAX(priority), -1) AS value FROM qoder_accounts WHERE provider_id=?').get(providerId).value + 1;
+        const id = uuid();
+        raw
+            .prepare(`INSERT INTO qoder_accounts (id, provider_id, email, label, qoder_user_id, machine_id, encrypted_pat, pat_nonce, pat_version,
+         encrypted_job_token, job_token_nonce, job_token_version, job_token_expires_at, priority)
+         VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+            .run(id, providerId, record.email, record.label, record.qoderUserId, record.machineId, pat.ciphertext, pat.nonce, pat.version, jobToken.ciphertext, jobToken.nonce, jobToken.version, record.jobTokenExpiresAt, priority);
+        return id;
+    });
+    return transaction();
+}
+export function insertQoderAccount(providerId, record) {
+    return persistQoderAccount(providerId, record);
+}
+export function upsertQoderAccount(providerId, record) {
+    const existing = getRawDb()
+        .prepare('SELECT id FROM qoder_accounts WHERE provider_id=? AND qoder_user_id=?')
+        .get(providerId, record.qoderUserId);
+    if (!existing)
+        return { id: persistQoderAccount(providerId, record), status: 'inserted' };
+    return { id: persistQoderAccount(providerId, record, existing.id), status: 'updated' };
+}
+export function persistQoderJobToken(id, update) {
+    const jobToken = encryptSecret(update.jobToken);
+    getRawDb()
+        .prepare(`UPDATE qoder_accounts SET encrypted_job_token=?, job_token_nonce=?, job_token_version=?, job_token_expires_at=?,
+       catalog_json=COALESCE(?, catalog_json), catalog_fetched_at=COALESCE(?, catalog_fetched_at),
+       health_state='healthy', last_error=NULL, updated_at=? WHERE id=?`)
+        .run(jobToken.ciphertext, jobToken.nonce, jobToken.version, update.expiresAt, update.catalogJson ?? null, update.catalogFetchedAt ?? null, nextUpdatedAt(id), id);
+}
+export function setQoderAccountHealth(id, healthState, lastError = null) {
+    const failures = healthState === 'healthy' ? 0 : null;
+    getRawDb()
+        .prepare(`UPDATE qoder_accounts SET health_state=?, last_error=?, consecutive_failures=COALESCE(?, consecutive_failures), updated_at=? WHERE id=?`)
+        .run(healthState, lastError, failures, nextUpdatedAt(id), id);
+}
+export function readQoderCatalog(id) {
+    const row = getRawDb()
+        .prepare('SELECT catalog_json AS catalogJson, catalog_fetched_at AS catalogFetchedAt FROM qoder_accounts WHERE id=?')
+        .get(id);
+    return row ?? null;
+}
+export function saveQoderCatalog(id, catalogJson, fetchedAt) {
+    getRawDb()
+        .prepare('UPDATE qoder_accounts SET catalog_json=?, catalog_fetched_at=?, updated_at=? WHERE id=?')
+        .run(catalogJson, fetchedAt ?? new Date().toISOString(), nextUpdatedAt(id), id);
+}
+// Keeps `updated_at` strictly increasing even within the same millisecond, so a caller can
+// detect a write it just made. Copied from the Codex repository for consistency.
+function nextUpdatedAt(id) {
+    const current = getRawDb().prepare('SELECT updated_at AS updatedAt FROM qoder_accounts WHERE id=?').get(id);
+    const now = Date.now();
+    const previous = current ? Date.parse(current.updatedAt) : 0;
+    return new Date(Math.max(now, previous + 1)).toISOString();
+}

package/dist/server/db/schema.js

@@ -81,7 +81,7 @@ export const providers = sqliteTable('providers', {
     id: text('id').primaryKey(),
     name: text('name').notNull(),
     slug: text('slug').notNull().unique(),
-    type: text('type', { enum: ['openai', 'anthropic', 'codex'] }).notNull(),
+    type: text('type', { enum: ['openai', 'anthropic', 'codex', 'qoder'] }).notNull(),
     baseUrl: text('base_url').notNull(),
     encryptedApiKey: text('encrypted_api_key'),
     apiKeyNonce: text('api_key_nonce'),
@@ -146,6 +146,36 @@ export const codexAccounts = sqliteTable('codex_accounts', {
     providerChatgptIdx: index('idx_codex_account_provider_chatgpt').on(t.providerId, t.chatgptAccountId),
 }));
 // ============================================================================
+// Qoder accounts
+// ============================================================================
+export const qoderAccounts = sqliteTable('qoder_accounts', {
+    id: text('id').primaryKey(),
+    providerId: text('provider_id').notNull().references(() => providers.id, { onDelete: 'restrict' }),
+    label: text('label'),
+    email: text('email'),
+    qoderUserId: text('qoder_user_id').notNull(),
+    machineId: text('machine_id').notNull(),
+    encryptedPat: text('encrypted_pat').notNull(),
+    patNonce: text('pat_nonce').notNull(),
+    patVersion: integer('pat_version').notNull().default(1),
+    encryptedJobToken: text('encrypted_job_token').notNull(),
+    jobTokenNonce: text('job_token_nonce').notNull(),
+    jobTokenVersion: integer('job_token_version').notNull().default(1),
+    jobTokenExpiresAt: text('job_token_expires_at').notNull(),
+    catalogJson: text('catalog_json'),
+    catalogFetchedAt: text('catalog_fetched_at'),
+    enabled: integer('enabled', { mode: 'boolean' }).notNull().default(true),
+    healthState: text('health_state', { enum: ['healthy', 'degraded', 'down', 'unknown'] }).notNull().default('unknown'),
+    lastError: text('last_error'),
+    consecutiveFailures: integer('consecutive_failures').notNull().default(0),
+    priority: integer('priority').notNull().default(0),
+    createdAt: text('created_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
+    updatedAt: text('updated_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
+}, (t) => ({
+    providerEnabledPriorityIdx: index('idx_qoder_account_provider_enabled_priority').on(t.providerId, t.enabled, t.priority),
+    providerUserIdx: index('idx_qoder_account_provider_user').on(t.providerId, t.qoderUserId),
+}));
+// ============================================================================
 // Models
 // ============================================================================
 export const models = sqliteTable('models', {
@@ -327,6 +357,7 @@ export const requestAttempts = sqliteTable('request_attempts', {
     providerId: text('provider_id').notNull(),
     modelId: text('model_id').notNull(),
     codexAccountId: text('codex_account_id').references(() => codexAccounts.id, { onDelete: 'set null' }),
+    qoderAccountId: text('qoder_account_id').references(() => qoderAccounts.id, { onDelete: 'set null' }),
     startedAt: text('started_at').notNull(),
     completedAt: text('completed_at'),
     statusCode: integer('status_code'),
@@ -348,6 +379,7 @@ export const requestAttempts = sqliteTable('request_attempts', {
     requestIdx: index('idx_attempt_request').on(t.requestId, t.attemptNumber),
     providerModelIdx: index('idx_attempt_provider_model').on(t.providerId, t.modelId, t.startedAt),
     codexAccountIdx: index('idx_attempt_codex_account').on(t.codexAccountId, t.startedAt),
+    qoderAccountIdx: index('idx_attempt_qoder_account').on(t.qoderAccountId, t.startedAt),
 }));
 // ============================================================================
 // Audit logs (immutable, excluded from request retention)

package/dist/server/gateway/runner.js

@@ -4,8 +4,11 @@ import { eq } from 'drizzle-orm';
 import { GatewayError } from '../errors.js';
 import { resolveRequestedModel, unwrapAlias } from '../routing/resolver.js';
 import { bareModelName, deriveRequiredCapabilities, describeRejections, firstMissingCapability } from '../routing/capabilities.js';
-import { loadCombo, selectCandidates, orderCandidates, shouldFallback, expandCodexAccountCandidates } from '../routing/combo.js';
+import { loadCombo, selectCandidates, orderCandidates, shouldFallback, expandCodexAccountCandidates, expandQoderAccountCandidates } from '../routing/combo.js';
 import { listCodexAccountsForProvider, setCodexAccountHealth } from '../db/repositories/codex-accounts.js';
+import { listQoderAccountsForProvider, setQoderAccountHealth } from '../db/repositories/qoder-accounts.js';
+import { qoderAttemptFailure, qoderCredentialsFor } from '../providers/qoder/credentials.js';
+import { callQoderNonStreaming, callQoderStreaming } from '../providers/qoder/client.js';
 import { getEffectiveState, isOpen, recordSuccess, recordFailure, halfOpenProbeAllowed } from '../routing/circuit.js';
 import { checkRpm, checkTpm, acquireConcurrent, releaseConcurrent } from '../routing/ratelimit.js';
 import { checkDailyMonthly, consumeUsage } from '../routing/quota.js';
@@ -133,7 +136,11 @@ export class GatewayRunner {
                 }
                 candidates = orderCandidates(comboPlan, filtered).flatMap((candidate) => {
                     const provider = getDb().select().from(schema.providers).where(eq(schema.providers.id, candidate.providerId)).get();
-                    return provider?.type === 'codex' ? expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(provider.id)) : [candidate];
+                    if (provider?.type === 'codex')
+                        return expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(provider.id));
+                    if (provider?.type === 'qoder')
+                        return expandQoderAccountCandidates(candidate, listQoderAccountsForProvider(provider.id));
+                    return [candidate];
                 });
                 debugHttp(ctx.requestId, 'CANDIDATES ORDERED', [
                     `mode=${comboPlan.mode}`,
@@ -235,6 +242,7 @@ export class GatewayRunner {
                     partialResponse: false,
                     selectionReason: candidate.selectionReason ?? selectionReasons[0] ?? 'direct',
                     codexAccountId: candidate.codexAccountId,
+                    qoderAccountId: candidate.qoderAccountId,
                     failureReason: null,
                     sanitizedError: null,
                     upstreamRequestId: null,
@@ -269,6 +277,8 @@ export class GatewayRunner {
                     recordSuccess(provider.id);
                     if (candidate.codexAccountId)
                         setCodexAccountHealth(candidate.codexAccountId, 'healthy');
+                    if (candidate.qoderAccountId)
+                        setQoderAccountHealth(candidate.qoderAccountId, 'healthy');
                     getDb().update(schema.providers).set({ healthState: 'healthy', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
                     attempts.push(attempt);
                     sentToClient = out.streamStarted ?? false;
@@ -306,6 +316,8 @@ export class GatewayRunner {
                         recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
                         if (candidate.codexAccountId)
                             setCodexAccountHealth(candidate.codexAccountId, 'down', redactString(err.message));
+                        if (candidate.qoderAccountId)
+                            setQoderAccountHealth(candidate.qoderAccountId, 'down', redactString(err.message));
                         getDb().update(schema.providers).set({ healthState: 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
                     }
                     if (shouldRetry && i + 1 < maxAttempts) {
@@ -398,6 +410,7 @@ export class GatewayRunner {
             upstreamAvailable: m.upstreamAvailable,
             circuitOpen: isOpen(m.providerId),
             capabilities: caps,
+            providerType: p.type,
         };
         if (!m.enabled)
             return { candidates: [], rejected: reject(m.publicModelId, 'model_disabled') };
@@ -424,6 +437,12 @@ export class GatewayRunner {
                 return { candidates: [], rejected: reject(m.publicModelId, 'codex_account_unavailable') };
             return { candidates: expanded, rejected: [] };
         }
+        if (p.type === 'qoder') {
+            const expanded = expandQoderAccountCandidates(candidate, listQoderAccountsForProvider(p.id));
+            if (expanded.length === 0)
+                return { candidates: [], rejected: reject(m.publicModelId, 'qoder_account_unavailable') };
+            return { candidates: expanded, rejected: [] };
+        }
         return { candidates: [candidate], rejected: [] };
     }
     async loadAllModels() {
@@ -431,6 +450,7 @@ export class GatewayRunner {
         const models = db.select().from(schema.models).all();
         const providers = db.select().from(schema.providers).all();
         const providerEnabled = new Map(providers.map((p) => [p.id, p.enabled]));
+        const providerType = new Map(providers.map((p) => [p.id, p.type]));
         // Deliberately unfiltered: every combo member must reach selectCandidates so
         // it can report WHY it was skipped. Pre-filtering here erased the model rows
         // and turned every distinct reason into "model not found".
@@ -443,6 +463,7 @@ export class GatewayRunner {
             upstreamAvailable: m.upstreamAvailable,
             circuitOpen: isOpen(m.providerId),
             capabilities: safeJson(m.capabilitiesJson),
+            providerType: providerType.get(m.providerId),
         }));
     }
     async runOneAttempt(req, ctx, candidate, providerName, cfg, required, onStreamStart, onFirstToken) {
@@ -457,6 +478,19 @@ export class GatewayRunner {
             const out = await callCodexNonStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel });
             return { statusCode: out.status, ttftMs: null, upstreamRequestId: out.upstreamRequestId, usage: out.usage, result: { text: out.text, toolCalls: out.toolCalls, finishReason: out.finishReason } };
         }
+        if (cfg.type === 'qoder') {
+            const accountRecordId = candidate.qoderAccountId ?? cfg.qoderAccountRecordId;
+            if (!accountRecordId)
+                throw new GatewayError('upstream_unavailable', 'No Qoder account is available for this request', { status: 503, code: 'qoder_account_unavailable' });
+            try {
+                const { config } = await qoderCredentialsFor(accountRecordId);
+                const out = await callQoderNonStreaming({ ...config, accountRecordId, name: config.label ?? undefined, email: config.email, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel });
+                return { statusCode: out.status, ttftMs: null, upstreamRequestId: out.upstreamRequestId, usage: out.usage, result: { text: out.text, toolCalls: out.toolCalls, finishReason: out.finishReason } };
+            }
+            catch (error) {
+                return qoderAttemptFailure(accountRecordId, error);
+            }
+        }
         let call;
         if (cfg.type === 'openai') {
             const payload = canonicalToOpenAIRequest(req.canonical, upstreamModel);
@@ -630,7 +664,7 @@ export class GatewayRunner {
                 const events = [];
                 let firstCodexEvent = true;
                 const meta = await callCodexStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel }, (event) => {
-                    if (event.text || event.isLast) {
+                    if (event.text || event.isLast || event.toolCall) {
                         events.push(event);
                         if (event.usage)
                             Object.assign(usage, event.usage);
@@ -646,6 +680,35 @@ export class GatewayRunner {
                     usage.total = usage.input + usage.output;
                 return { statusCode: meta.status, ttftMs: events.length ? Date.now() - streamStartTs : null, upstreamRequestId: meta.upstreamRequestId, usage, result: { text: textBuf, toolCalls: toolBuf, finishReason } };
             }
+            if (cfg.type === 'qoder') {
+                const accountRecordId = candidate.qoderAccountId ?? cfg.qoderAccountRecordId;
+                if (!accountRecordId)
+                    throw new GatewayError('upstream_unavailable', 'No Qoder account is available for this request', { status: 503, code: 'qoder_account_unavailable' });
+                let firstQoderChunk = true;
+                let qoderTtftMs = null;
+                try {
+                    const { config } = await qoderCredentialsFor(accountRecordId);
+                    const out = await callQoderStreaming({ ...config, accountRecordId, name: config.label ?? undefined, email: config.email, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel }, 
+                    // Qoder already emits OpenAI-shaped chunks, so they pipe through unchanged.
+                    (chunk) => {
+                        if (firstQoderChunk) {
+                            qoderTtftMs = Date.now() - streamStartTs;
+                            firstQoderChunk = false;
+                        }
+                        chunkHandler({ data: chunk.data }, false);
+                    });
+                    if (!headWritten)
+                        writeHead();
+                    pipe.write('data: [DONE]\n\n');
+                    pipe.end();
+                    if (!usage.total)
+                        usage.total = usage.input + usage.output;
+                    return { statusCode: out.status, ttftMs: qoderTtftMs, upstreamRequestId: out.upstreamRequestId, usage, result: { text: out.text, toolCalls: out.toolCalls, finishReason: out.finishReason } };
+                }
+                catch (error) {
+                    return qoderAttemptFailure(accountRecordId, error);
+                }
+            }
             const url = cfg.type === 'openai' ? upstreamUrl(cfg, '/v1/chat/completions') : upstreamUrl(cfg, '/v1/messages');
             const payload = cfg.type === 'openai' ? canonicalToOpenAIRequest(req.canonical, upstreamModel) : canonicalToAnthropicRequest(req.canonical, upstreamModel);
             logUpstreamRequest(ctx.requestId, cfg, url, payload, true);
@@ -882,6 +945,7 @@ export class GatewayRunner {
                 providerId: a.providerId,
                 modelId: a.modelId,
                 codexAccountId: a.codexAccountId ?? null,
+                qoderAccountId: a.qoderAccountId ?? null,
                 startedAt: a.startedAt,
                 completedAt: a.completedAt,
                 statusCode: a.statusCode,
@@ -1017,14 +1081,19 @@ function usageFromCache(u) {
 // Map Codex's native response events to the public protocol stream shape.
 export function codexStreamEventToClient(protocol, event, model, requestId) {
     if (protocol === 'openai') {
+        const delta = event.toolCall
+            ? { tool_calls: [{ index: 0, id: event.toolCall.id, type: 'function', function: { name: event.toolCall.name, arguments: JSON.stringify(event.toolCall.input) } }] }
+            : event.isLast ? {} : { content: event.text };
         return JSON.stringify({
             id: `chatcmpl-${requestId}`,
             object: 'chat.completion.chunk',
             created: Math.floor(Date.now() / 1000),
             model,
-            choices: [{ index: 0, delta: event.isLast ? {} : { content: event.text }, finish_reason: event.isLast ? 'stop' : null }],
+            choices: [{ index: 0, delta, finish_reason: event.isLast ? 'stop' : null }],
         });
     }
+    if (event.toolCall)
+        return JSON.stringify({ type: 'content_block_start', index: 0, content_block: { type: 'tool_use', id: event.toolCall.id, name: event.toolCall.name, input: event.toolCall.input } });
     return JSON.stringify(event.isLast
         ? { type: 'message_delta', delta: { stop_reason: 'end_turn', stop_sequence: null }, usage: { output_tokens: 0 } }
         : { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: event.text } });

package/dist/server/providers/codex-refresh.js

@@ -1,4 +1,5 @@
 import { getCodexCredentials, getCodexAccountRefreshState, persistCodexRefresh, setCodexAccountHealth } from '../db/repositories/codex-accounts.js';
+import { CODEX_OAUTH } from './codex-oauth.js';
 import { GatewayError } from '../errors.js';
 /**
  * Maps the credential-layer's opaque error codes onto typed admin-facing errors. Call sites that
@@ -28,10 +29,12 @@ export function needsCodexRefresh(account, now = new Date()) {
     return !Number.isFinite(expires) || expires - now.getTime() <= REFRESH_LEAD_MS;
 }
 async function defaultRefreshClient(input) {
-    const response = await fetch('https://auth.openai.com/oauth/token', {
+    const response = await fetch(CODEX_OAUTH.tokenUrl, {
         method: 'POST',
         headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-        body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: input.refreshToken }),
+        // `client_id` is required: without it the endpoint answers 400 `Missing 'client_id'`,
+        // which surfaced as an opaque refresh failure and left expired tokens unusable.
+        body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: input.refreshToken, client_id: CODEX_OAUTH.clientId }),
         signal: input.signal,
     });
     if (!response.ok)

package/dist/server/providers/codex.js

@@ -5,8 +5,16 @@ const base = (url) => url.replace(/\/$/, '');
  * `400 [{'loc': ('query', 'client_version'), 'msg': 'Field required'}]`.
  */
 export const CODEX_CLIENT_VERSION = '0.144.6';
+/**
+ * The Codex OAuth backend only exists on chatgpt.com — `api.openai.com/backend-api/codex/*`
+ * answers 404. The base URL is therefore not user-configurable: a stored value pointing
+ * anywhere else makes discovery and routing fail with an opaque 404.
+ */
+export const CODEX_BASE_URL = 'https://chatgpt.com';
 export function codexRequest(cfg, path) {
-    return `${base(cfg.baseUrl)}/backend-api/codex${path.startsWith('/') ? path : `/${path}`}`;
+    // Always chatgpt.com: the Codex OAuth backend does not exist on api.openai.com,
+    // so a stored base URL pointing elsewhere yields an opaque 404. See CODEX_BASE_URL.
+    return `${base(CODEX_BASE_URL)}/backend-api/codex${path.startsWith('/') ? path : `/${path}`}`;
 }
 export function codexHeaders(cfg, accept = 'application/json') {
     if (!cfg.accessToken)
@@ -60,6 +68,12 @@ export async function codexModels(cfg) {
         ctl.cancel();
     }
 }
+/**
+ * The Codex backend rejects any request that does not set both flags verbatim:
+ * `{"detail":"Store must be set to false"}` / `{"detail":"Stream must be set to true"}`.
+ * Upstream always streams; non-streaming callers merge the stream below.
+ */
+const CODEX_REQUIRED_FLAGS = { store: false, stream: true };
 export function codexRequestPayload(req, targetModel = req.model) {
     const input = req.messages.map((message) => ({ role: message.role, content: message.content.map((block) => {
             if (block.type === 'text')
@@ -68,11 +82,12 @@ export function codexRequestPayload(req, targetModel = req.model) {
                 return { type: 'input_image', image_url: block.image?.url ?? `data:${block.image?.mimeType ?? 'image/png'};base64,${block.image?.base64}` };
             return null;
         }).filter(Boolean) }));
-    const payload = { model: targetModel, input, stream: req.stream };
+    const payload = { model: targetModel, input, ...CODEX_REQUIRED_FLAGS };
     if (req.system)
         payload.instructions = req.system;
-    if (req.maxOutputTokens !== undefined)
-        payload.max_output_tokens = req.maxOutputTokens;
+    // max_output_tokens, temperature and top_p are NOT forwarded: the Codex backend rejects each
+    // with 400 "Unsupported parameter" (verified live against chatgpt.com). The Codex CLI omits them
+    // too, so a client that sets max_tokens on a codex/ model still gets a working request.
     if (req.tools?.length)
         payload.tools = req.tools.map((tool) => ({ type: 'function', name: tool.name, description: tool.description, parameters: tool.inputSchema }));
     if (req.reasoning?.effort)
@@ -106,6 +121,24 @@ export function codexResponseToCanonical(body, requestedModel) {
 export function codexStreamEventToCanonical(event) {
     if (event.type === 'response.output_text.delta')
         return { text: typeof event.delta === 'string' ? event.delta : '', isLast: false };
+    if (event.type === 'response.output_item.done') {
+        // `response.completed` always carries `output: []`, so function calls are only
+        // observable here — this is what lets a non-streaming merge see tool calls.
+        const item = event.item && typeof event.item === 'object' ? event.item : {};
+        if (item.type !== 'function_call')
+            return { text: '', isLast: false };
+        const raw = item.arguments;
+        let input = raw ?? {};
+        if (typeof raw === 'string') {
+            try {
+                input = JSON.parse(raw);
+            }
+            catch {
+                input = raw;
+            }
+        }
+        return { text: '', isLast: false, toolCall: { id: String(item.call_id ?? item.id ?? ''), name: String(item.name ?? ''), input } };
+    }
     if (event.type === 'response.completed') {
         const response = event.response && typeof event.response === 'object' ? event.response : {};
         return { text: '', isLast: true, usage: usage(response.usage), finishReason: typeof response.status === 'string' ? response.status : null };
@@ -117,21 +150,22 @@ async function responseError(response) {
     return error;
 }
 export async function callCodexNonStreaming(cfg, req) {
-    const call = async (tokenCfg) => {
-        const ctl = timeout(tokenCfg.totalTimeoutMs);
-        try {
-            const response = await fetch(codexRequest(tokenCfg, '/responses'), { method: 'POST', headers: codexHeaders(tokenCfg), body: JSON.stringify(codexRequestPayload(req)), signal: ctl.signal });
-            if (!response.ok)
-                throw await responseError(response);
-            return { ...codexResponseToCanonical(await response.json(), req.model), status: response.status, upstreamRequestId: response.headers.get('x-request-id') };
-        }
-        finally {
-            ctl.cancel();
-        }
-    };
-    if (cfg.accountRecordId)
-        return withCodexCredentials(cfg.accountRecordId, (credentials) => call({ ...cfg, accessToken: credentials.accessToken }));
-    return call(cfg);
+    // The Codex backend rejects `stream:false`, so a non-streaming caller merges the
+    // stream itself instead of asking upstream for a single JSON body.
+    let text = '';
+    const toolCalls = [];
+    let finishReason = null;
+    let usage = { input: 0, output: 0, total: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0 };
+    const meta = await callCodexStreaming(cfg, req, (event) => {
+        text += event.text;
+        if (event.toolCall)
+            toolCalls.push(event.toolCall);
+        if (event.usage)
+            usage = event.usage;
+        if (event.isLast && event.finishReason !== undefined)
+            finishReason = event.finishReason;
+    });
+    return { model: req.model, text, toolCalls, finishReason, usage, status: meta.status, upstreamRequestId: meta.upstreamRequestId };
 }
 export async function callCodexStreaming(cfg, req, onEvent) {
     const run = async (tokenCfg) => {