ldrouter 1.16.5 → 1.17.1

package/dist/server/providers/index.js

@@ -27,6 +27,8 @@ export async function probeProvider(cfg) {
     const start = Date.now();
     if (cfg.type === 'codex')
         return { ok: false, detail: 'Codex providers require the Codex account adapter', latencyMs: 0 };
+    if (cfg.type === 'qoder')
+        return { ok: false, detail: 'Qoder providers require the Qoder account adapter', latencyMs: 0 };
     try {
         const url = cfg.type === 'openai' ? `${stripSlash(cfg.baseUrl)}/v1/models` : `${stripSlash(cfg.baseUrl)}/v1/models`;
         const res = await fetchWithTimeout(url, { method: 'GET', headers: buildHeaders(cfg) }, cfg.totalTimeoutMs);
@@ -45,6 +47,8 @@ export async function probeProvider(cfg) {
 export async function discoverProviderModels(cfg) {
     if (cfg.type === 'codex')
         throw new Error('Codex providers require the Codex account adapter');
+    if (cfg.type === 'qoder')
+        throw new Error('Qoder providers require the Qoder account adapter');
     if (cfg.type === 'openai')
         return discoverOpenAI(cfg);
     return discoverAnthropic(cfg);

package/dist/server/providers/pooled.js

@@ -0,0 +1,84 @@
+// Account-pool providers: the upstream credential is a pool of accounts stored in a
+// dedicated table, not one API key on the provider row. The registry keeps the
+// per-type probe/discover/account branches out of the provider CRUD route.
+import { GatewayError } from '../errors.js';
+import { listCodexAccountSummaries, chatgptAccountIdOf } from '../db/repositories/codex-accounts.js';
+import { listQoderAccountSummaries } from '../db/repositories/qoder-accounts.js';
+import { probeCodex, codexModels, CODEX_BASE_URL } from './codex.js';
+import { withCodexCredentials, codexCredentialError } from './codex-refresh.js';
+import { probeQoder, qoderModels } from './qoder/client.js';
+import { withQoderCredentials } from './qoder/credentials.js';
+import { QODER_INFERENCE_BASE } from './qoder/constants.js';
+export const POOLED_PROVIDER_TYPES = ['codex', 'qoder'];
+function firstEligible(accounts) {
+    const account = accounts.find((candidate) => candidate.enabled && candidate.healthState !== 'down');
+    if (!account)
+        throw new GatewayError('authentication_error', 'No eligible account is configured for this provider', { status: 503 });
+    return account;
+}
+const codexStrategy = {
+    defaults: { name: 'Codex', slug: 'codex', baseUrl: CODEX_BASE_URL },
+    accountsTable: 'codex_accounts',
+    listAccounts: (providerId) => listCodexAccountSummaries(providerId),
+    // `firstEligible` is the single eligibility gate (matching the route it replaces); the account id
+    // is a plain lookup, not a second gate — an imported account without a chatgpt_account_id is still
+    // probed, and a degraded or token-expired account is still refreshable, so the upstream answers
+    // honestly instead of the route short-circuiting to 503 (which would also skip the audit write).
+    probe: async (provider) => {
+        const account = firstEligible(codexStrategy.listAccounts(provider.id));
+        const accountId = chatgptAccountIdOf(account.id) ?? '';
+        return withCodexCredentials(account.id, (credentials) => probeCodex({
+            baseUrl: provider.baseUrl, accountId, accessToken: credentials.accessToken,
+            accountRecordId: account.id, customHeaders: {}, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 20_000),
+        })).catch((error) => { throw codexCredentialError(error); });
+    },
+    discover: async (provider) => {
+        const account = firstEligible(codexStrategy.listAccounts(provider.id));
+        const accountId = chatgptAccountIdOf(account.id) ?? '';
+        return withCodexCredentials(account.id, (credentials) => codexModels({
+            baseUrl: provider.baseUrl, accountId, accessToken: credentials.accessToken,
+            accountRecordId: account.id, customHeaders: {}, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 30_000),
+        })).catch((error) => { throw codexCredentialError(error); });
+    },
+};
+const qoderStrategy = {
+    defaults: { name: 'Qoder', slug: 'qoder', baseUrl: QODER_INFERENCE_BASE },
+    accountsTable: 'qoder_accounts',
+    listAccounts: (providerId) => listQoderAccountSummaries(providerId),
+    // Same contract as Codex: `firstEligible` is the single eligibility gate, and the probe goes
+    // through the credential seam so a stale job token is refreshed before the upstream is asked.
+    probe: async (provider) => {
+        const account = firstEligible(qoderStrategy.listAccounts(provider.id));
+        return withQoderCredentials(account.id, (config) => probeQoder({ ...config, accountRecordId: account.id, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 20_000) }))
+            .catch((error) => { throw qoderCredentialError(error); });
+    },
+    discover: async (provider) => {
+        const account = firstEligible(qoderStrategy.listAccounts(provider.id));
+        return withQoderCredentials(account.id, (config) => {
+            if (!config.catalog)
+                throw new GatewayError('invalid_request_error', 'Qoder model catalog is empty — the account has no usable models', { status: 400, code: 'model_config_not_cached' });
+            return Promise.resolve(qoderModels(config.catalog));
+        }).catch((error) => { throw qoderCredentialError(error); });
+    },
+};
+/** Qoder fixes credential failures by replacing the PAT, not by re-saving a provider API key. */
+function qoderCredentialError(error) {
+    if (error instanceof GatewayError)
+        return error;
+    const code = error instanceof Error ? error.message : '';
+    if (code === 'account_not_found')
+        return new GatewayError('invalid_request_error', 'Qoder account not found', { status: 404 });
+    return error;
+}
+const STRATEGIES = { codex: codexStrategy, qoder: qoderStrategy };
+/** null for types the registry does not own (openai / anthropic-compatible keep the generic path). */
+export function getPooledProvider(type) {
+    return STRATEGIES[type] ?? null;
+}
+/** Throws for a non-pool type so callers cannot read undefined defaults. */
+export function pooledProviderDefaults(type) {
+    const strategy = getPooledProvider(type);
+    if (!strategy)
+        throw new GatewayError('invalid_request_error', `Provider type '${type}' is not an account-pool provider`, { status: 400 });
+    return strategy.defaults;
+}

package/dist/server/providers/qoder/catalog.js

@@ -0,0 +1,138 @@
+// Qoder credential exchange and live model catalog.
+// A PAT (pt-) cannot sign COSY requests, so it is exchanged for a short-lived job
+// token (jt-) over plain JSON, then userinfo supplies the stable user id that signing
+// requires. The inference host is api2 for job tokens; api3 rejects them.
+import { buildCosyHeaders } from './cosy.js';
+import { QODER_JOB_TOKEN_EXCHANGE_URL, QODER_MODEL_LIST_URL, QODER_USERINFO_URL } from './constants.js';
+const FETCH_TIMEOUT_MS = 15_000;
+const PAT_PREFIX = 'pt-';
+export function isQoderPat(token) {
+    return typeof token === 'string' && token.startsWith(PAT_PREFIX);
+}
+async function timedFetch(url, init, deps = {}) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? FETCH_TIMEOUT_MS);
+    try {
+        return await (deps.fetchImpl ?? fetch)(url, { ...init, signal: init.signal ?? controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const numberOr = (value, fallback) => {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
+export function parseCatalog(body, fetchedAt) {
+    const entries = new Map();
+    const chat = body && typeof body === 'object' ? body.chat : null;
+    if (!Array.isArray(chat))
+        return { entries, fetchedAt };
+    for (const item of chat) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const raw = item;
+        const key = typeof raw.key === 'string' ? raw.key : '';
+        if (!key)
+            continue;
+        entries.set(key, {
+            key,
+            displayName: typeof raw.display_name === 'string' && raw.display_name ? raw.display_name : key,
+            // A disabled entry stays routable: the admin may still select it, and chat sends
+            // the live model_config regardless.
+            enabled: raw.enable !== false,
+            isReasoning: raw.is_reasoning === true,
+            isVl: raw.is_vl === true,
+            maxInputTokens: numberOr(raw.max_input_tokens, 0),
+            maxOutputTokens: numberOr(raw.max_output_tokens, 0),
+            raw,
+        });
+    }
+    return { entries, fetchedAt };
+}
+// The serialized form deliberately keeps each entry's `raw` config: chat must send the
+// live model_config and never re-derive it from the parsed fields.
+export function serializeCatalog(catalog) {
+    return JSON.stringify({
+        fetchedAt: catalog.fetchedAt,
+        entries: [...catalog.entries.values()].map((entry) => ({ ...entry })),
+    });
+}
+export function deserializeCatalog(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        const entries = new Map();
+        if (Array.isArray(parsed.entries)) {
+            for (const entry of parsed.entries)
+                if (entry?.key)
+                    entries.set(entry.key, entry);
+        }
+        return { entries, fetchedAt: typeof parsed.fetchedAt === 'string' ? parsed.fetchedAt : '' };
+    }
+    catch {
+        return null;
+    }
+}
+export async function exchangeQoderPat(personalToken, deps = {}) {
+    if (!isQoderPat(personalToken))
+        throw new Error('not a Qoder personal access token (expected a pt- value)');
+    const response = await timedFetch(QODER_JOB_TOKEN_EXCHANGE_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json', 'user-agent': 'qodercli/1.0.0' },
+        body: JSON.stringify({ personal_token: personalToken }),
+    }, deps);
+    if (!response.ok)
+        throw new Error(`Qoder personal access token exchange failed: HTTP ${response.status}`);
+    const body = (await response.json());
+    const jobToken = typeof body.token === 'string' ? body.token : '';
+    if (!jobToken)
+        throw new Error('Qoder personal access token exchange returned no job token');
+    const explicit = typeof body.expires_at === 'string' ? Date.parse(body.expires_at) : NaN;
+    const relative = typeof body.expires_in === 'number' && body.expires_in > 0 ? Date.now() + body.expires_in * 1000 : NaN;
+    // The upstream usually omits both; a job token is short-lived, so default to 24h and
+    // let a 401 at request time trigger an early re-exchange.
+    const expiresAt = new Date(Number.isFinite(explicit) ? explicit : Number.isFinite(relative) ? relative : Date.now() + 24 * 60 * 60 * 1000).toISOString();
+    const info = await fetchQoderUserInfo(jobToken, deps);
+    return { jobToken, jobTokenExpiresAt: expiresAt, qoderUserId: info.qoderUserId, email: info.email, label: info.label };
+}
+export async function fetchQoderUserInfo(jobToken, deps = {}) {
+    try {
+        const response = await timedFetch(QODER_USERINFO_URL, { method: 'GET', headers: { authorization: `Bearer ${jobToken}`, accept: 'application/json', 'user-agent': 'qodercli/1.0.0' } }, deps);
+        if (!response.ok)
+            return { qoderUserId: '', email: null, label: null };
+        const body = (await response.json());
+        const pick = (...values) => {
+            for (const value of values)
+                if (typeof value === 'string' && value.trim())
+                    return value.trim();
+            return null;
+        };
+        return {
+            qoderUserId: pick(body.id, body.userId, body.user_id) ?? '',
+            email: pick(body.email),
+            label: pick(body.name, body.username),
+        };
+    }
+    catch {
+        return { qoderUserId: '', email: null, label: null };
+    }
+}
+/** null on any failure: the caller decides whether that is fatal (it is, for cached model_config). */
+export async function fetchQoderCatalog(creds, deps = {}) {
+    const headers = {
+        accept: 'application/json',
+        'accept-encoding': 'identity',
+        ...buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, { userId: creds.userId, authToken: creds.jobToken, machineId: creds.machineId }),
+    };
+    try {
+        const response = await timedFetch(QODER_MODEL_LIST_URL, { method: 'GET', headers }, deps);
+        if (!response.ok)
+            return null;
+        return parseCatalog(await response.json(), new Date().toISOString());
+    }
+    catch {
+        return null;
+    }
+}

package/dist/server/providers/qoder/client.js

@@ -0,0 +1,248 @@
+// Qoder chat adapter: canonical request -> Qoder payload -> obfuscated body -> COSY-signed
+// fetch -> OpenAI-shaped chunks -> canonical aggregate.
+//
+// Two behaviours the runner depends on:
+//   - Streaming emits OpenAI chunks and STOPS at the terminal frame. Qoder keeps the
+//     socket open after [DONE]; a client that drains would hang.
+//   - A missing live model_config is a hard error. Sending the wrong block makes the
+//     upstream silently serve a different model.
+import { createHash, randomUUID } from 'node:crypto';
+import { GatewayError } from '../../errors.js';
+import { redactString } from '../../security/redact.js';
+import { QODER_CHAT_URL, QODER_CHAT_SIG_PATH } from './constants.js';
+import { buildCosyHeaders } from './cosy.js';
+import { encodeQoderBody } from './encode.js';
+import { QoderEnvelopeReader } from './sse.js';
+import { applyQoderContextTier, resolveQoderContextTier } from './tier.js';
+export class QoderModelConfigMissingError extends Error {
+    status = 400;
+    constructor(key) {
+        super(`Qoder model_config for "${key}" is not cached — discover or refresh this account's models first`);
+        this.name = 'QoderModelConfigMissingError';
+    }
+}
+const emptyUsage = () => ({ input: 0, output: 0, total: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0 });
+function blocksToParts(content) {
+    const parts = [];
+    let text = '';
+    for (const block of content) {
+        if (block.type === 'text' && block.text) {
+            parts.push({ type: 'text', text: block.text });
+            text += block.text;
+            continue;
+        }
+        const image = block.type === 'image' ? block.image : undefined;
+        const url = image?.url ?? (image?.base64 ? `data:${image.mimeType ?? 'image/png'};base64,${image.base64}` : undefined);
+        if (url)
+            parts.push({ type: 'image_url', image_url: { url } });
+    }
+    return { text, parts };
+}
+function normalizeMessage(message) {
+    const { text, parts } = blocksToParts(message.content);
+    const hasImage = parts.some((part) => part.type === 'image_url');
+    // Qoder reads documents through its own file API; a 30MB inline document is not a request.
+    const toolCalls = message.content.filter((block) => block.type === 'tool_use').map((block) => ({ id: block.toolUse?.id ?? '', type: 'function', function: { name: block.toolUse?.name ?? '', arguments: JSON.stringify(block.toolUse?.input ?? {}) } }));
+    return {
+        role: message.role,
+        content: hasImage ? parts : text,
+        ...(toolCalls.length > 0 ? { tool_calls: toolCalls } : {}),
+    };
+}
+function stableHash(prefix, ...parts) {
+    const hash = createHash('sha256').update(prefix);
+    for (const part of parts)
+        hash.update('\0').update(String(part ?? ''));
+    return hash.digest('hex').slice(0, 24);
+}
+/**
+ * Build the exact payload Qoder expects. Throws QoderModelConfigMissingError when the
+ * account has no cached model_config for this key — never guesses.
+ */
+export function qoderRequestPayload(req, modelKey, catalog, options = {}) {
+    const entry = catalog?.entries.get(modelKey);
+    if (!entry)
+        throw new QoderModelConfigMissingError(modelKey);
+    const modelConfig = { ...entry.raw, key: modelKey };
+    const isReasoning = entry.isReasoning;
+    const messages = req.messages.map(normalizeMessage);
+    const lastUser = [...messages].reverse().find((message) => message.role === 'user');
+    const lastUserText = typeof lastUser?.content === 'string'
+        ? lastUser.content
+        : Array.isArray(lastUser?.content) ? lastUser.content.map((part) => part.text ?? '').join('\n') : '';
+    const declaredMax = entry.maxOutputTokens > 0 ? entry.maxOutputTokens : 32_768;
+    const requestedMax = req.maxOutputTokens ?? 0;
+    const maxTokens = requestedMax > 0 ? Math.min(requestedMax, declaredMax) : declaredMax;
+    const tools = (req.tools ?? []).map((tool) => ({ type: 'function', function: { name: tool.name, description: tool.description, parameters: tool.inputSchema } }));
+    const recordId = stableHash('qoder-record', modelKey, JSON.stringify(messages), JSON.stringify(tools), maxTokens);
+    const payload = {
+        request_id: randomUUID(),
+        request_set_id: recordId,
+        chat_record_id: recordId,
+        session_id: stableHash('qoder-session', modelKey),
+        stream: true,
+        chat_task: 'FREE_INPUT',
+        is_reply: true,
+        is_retry: false,
+        source: 1,
+        version: '3',
+        session_type: 'qodercli',
+        agent_id: 'agent_common',
+        task_id: 'common',
+        code_language: '',
+        chat_prompt: '',
+        image_urls: null,
+        aliyun_user_type: '',
+        system: req.system ?? '',
+        messages,
+        tools,
+        parameters: { max_tokens: maxTokens },
+        chat_context: {
+            chatPrompt: '',
+            imageUrls: null,
+            extra: { context: [], modelConfig: { key: modelKey, is_reasoning: isReasoning }, originalContent: lastUserText },
+            features: [],
+            text: lastUserText,
+        },
+        model_config: modelConfig,
+        business: {
+            product: 'cli', version: '1.0.0', type: 'agent', stage: 'start',
+            id: randomUUID(), name: lastUserText.slice(0, 30), begin_at: Date.now(),
+        },
+    };
+    const tier = resolveQoderContextTier(modelConfig, { system: req.system, messages, tools }, { preference: options.contextPreference });
+    if (tier)
+        applyQoderContextTier(payload, tier.tier);
+    return { payload, modelConfig };
+}
+/** Thrown before any byte is written downstream, so the runner can still fail over. */
+export class QoderUpstreamError extends Error {
+    status;
+    billing;
+    constructor(status, message, billing = false) {
+        super(message);
+        this.status = status;
+        this.billing = billing;
+        this.name = 'QoderUpstreamError';
+    }
+}
+function signedInit(cfg, payload, modelKey) {
+    // encodeQoderBody returns latin1-mapped text; the COSY signature hashes exactly these
+    // bytes, so the body must be reconstructed with the same encoding.
+    const encoded = Buffer.from(encodeQoderBody(Buffer.from(JSON.stringify(payload), 'utf8')), 'latin1');
+    return {
+        init: {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'text/event-stream',
+                'cache-control': 'no-cache',
+                'accept-encoding': 'identity',
+                'x-model-key': modelKey,
+                'x-model-source': String(payload.model_config?.source ?? 'system'),
+                ...buildCosyHeaders(encoded, QODER_CHAT_URL, { userId: cfg.qoderUserId, authToken: cfg.jobToken, name: cfg.name, email: cfg.email ?? undefined, machineId: cfg.machineId }),
+            },
+            body: encoded,
+        },
+    };
+}
+async function openSignedStream(cfg, req, deps) {
+    // Accept both a public id (`qoder/qmodel_38max`) and the bare upstream key the runner passes.
+    // Qoder model keys never contain a slash, so the last segment is the key either way — taking it
+    // unconditionally is what makes this idempotent instead of stripping a prefix that may be gone.
+    const modelKey = req.model.split('/').pop() ?? req.model;
+    const { payload } = qoderRequestPayload(req, modelKey, cfg.catalog);
+    const { init } = signedInit(cfg, payload, modelKey);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), cfg.totalTimeoutMs);
+    let response;
+    try {
+        response = await (deps.fetchImpl ?? fetch)(QODER_CHAT_URL, { ...init, signal: controller.signal });
+    }
+    catch (error) {
+        clearTimeout(timer);
+        throw new GatewayError('timeout_error', 'Qoder upstream request failed', { status: 504, cause: error });
+    }
+    // Headers are in: the total timeout no longer applies (Qoder streams can be long).
+    clearTimeout(timer);
+    if (!response.ok || !response.body) {
+        throw new QoderUpstreamError(response.status, `Qoder upstream HTTP ${response.status}`);
+    }
+    return {
+        response,
+        reader: new QoderEnvelopeReader({ model: `qoder/${modelKey}` }),
+        status: response.status,
+        upstreamRequestId: response.headers.get('x-request-id'),
+    };
+}
+async function drainEnvelope(reader, response, onChunk) {
+    const upstream = response.body.getReader();
+    const decoder = new TextDecoder();
+    let emitted = 0;
+    const drain = () => {
+        while (emitted < reader.chunks.length) {
+            onChunk?.({ data: reader.chunks[emitted] });
+            emitted += 1;
+        }
+        return reader.terminal();
+    };
+    try {
+        for (;;) {
+            const part = await upstream.read();
+            const done = part.done;
+            reader.push(decoder.decode(part.value ?? new Uint8Array(), { stream: !done }));
+            if (drain())
+                break;
+            if (done) {
+                reader.finish();
+                drain();
+                break;
+            }
+        }
+        const error = reader.errorEnvelope();
+        if (error)
+            throw new QoderUpstreamError(error.statusValue, redactString(error.message.slice(0, 300)), error.billing);
+    }
+    finally {
+        // Qoder holds the socket open after the terminal frame; leaving it un-cancelled leaks
+        // the connection until the upstream keepalive gives up.
+        await upstream.cancel().catch(() => { });
+    }
+}
+/** Streaming: emit OpenAI-shaped chunks as they arrive, stop at the terminal frame. */
+export async function callQoderStreaming(cfg, req, onChunk, deps = {}) {
+    const { response, reader, status, upstreamRequestId } = await openSignedStream(cfg, { ...req, stream: true }, deps);
+    await drainEnvelope(reader, response, onChunk);
+    return { status, upstreamRequestId, text: reader.text, toolCalls: reader.toolCalls, finishReason: reader.finishReason, usage: reader.usage ?? emptyUsage() };
+}
+/** Qoder only speaks SSE; the non-streaming shape is assembled from the same reader. */
+export async function callQoderNonStreaming(cfg, req, deps = {}) {
+    const { response, reader, status, upstreamRequestId } = await openSignedStream(cfg, { ...req, stream: false }, deps);
+    await drainEnvelope(reader, response);
+    return { status, upstreamRequestId, text: reader.text, toolCalls: reader.toolCalls, finishReason: reader.finishReason, usage: reader.usage ?? emptyUsage() };
+}
+export async function probeQoder(cfg) {
+    const started = Date.now();
+    const catalogue = cfg.catalog;
+    if (!catalogue || catalogue.entries.size === 0) {
+        return { ok: false, detail: 'Model catalog is empty — check the personal access token', latencyMs: Date.now() - started };
+    }
+    return { ok: true, detail: 'Connected (catalog loaded)', latencyMs: Date.now() - started, modelCount: catalogue.entries.size };
+}
+/** Catalog entries become discovered models; hidden (enable:false) keys stay routable. */
+export function qoderModels(catalog) {
+    return [...catalog.entries.values()].map((entry) => ({
+        upstreamId: entry.key,
+        displayName: entry.displayName,
+        capabilities: {
+            chat: true,
+            streaming: true,
+            tools: true,
+            reasoning: entry.isReasoning || undefined,
+            image_input: entry.isVl || undefined,
+            max_context_tokens: entry.maxInputTokens || null,
+            max_output_tokens: entry.maxOutputTokens || null,
+        },
+    }));
+}
+export { QODER_CHAT_SIG_PATH };

package/dist/server/providers/qoder/constants.js

@@ -0,0 +1,34 @@
+// Qoder endpoint map. PAT-only: every credential is a personal access token (pt-...)
+// that is exchanged for a short-lived job token (jt-...), and job tokens are served
+// by api2 (api3 answers 403 "Login expired" for jt-).
+// ponytail: single inference host because there is exactly one credential kind.
+// If device tokens (dt-, api3) are ever supported, restore a token-prefix branch here.
+import { QODER_RSA_PUBLIC_KEY as RSA_KEY } from './rsa.js';
+export const QODER_OPENAPI_BASE = 'https://openapi.qoder.sh';
+export const QODER_INFERENCE_BASE = 'https://api2.qoder.sh';
+export const QODER_LOGIN_URL = 'https://qoder.com/account/integrations';
+export const QODER_JOB_TOKEN_EXCHANGE_URL = `${QODER_OPENAPI_BASE}/api/v1/jobToken/exchange`;
+export const QODER_USERINFO_URL = `${QODER_OPENAPI_BASE}/api/v1/userinfo`;
+export const QODER_CHAT_SIG_PATH = '/api/v2/service/pro/sse/agent_chat_generation';
+export const QODER_CHAT_URL = `${QODER_INFERENCE_BASE}/algo${QODER_CHAT_SIG_PATH}?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1`;
+export const QODER_MODEL_LIST_URL = `${QODER_INFERENCE_BASE}/algo/api/v2/model/list`;
+// COSY client fingerprint. The upstream validates the signature against the values
+// used at signing time, so these are not free-form.
+export const QODER_IDE_VERSION = '1.0.0';
+export const QODER_CLIENT_TYPE = '5';
+export const QODER_DATA_POLICY = 'disagree';
+export const QODER_LOGIN_VERSION = 'v2';
+export const QODER_MACHINE_OS = 'x86_64_windows';
+export const QODER_MACHINE_TYPE = '5';
+// Static fallback catalog used only when the live model list cannot be fetched at
+// add time, so the admin sees something to select. Chat never trusts this list —
+// it always sends the live model_config.
+export const QODER_MODEL_KEYS = [
+    'auto', 'ultimate', 'performance', 'efficient', 'lite',
+    'qmodel_38max', 'qmodel_latest', 'qmodel', 'qfmodel',
+    'kmodel_latest', 'kmodel', 'gmodel', 'gfmodel',
+    'dmodel', 'dfmodel', 'mmodel',
+];
+export const QODER_RSA_PUBLIC_KEY = RSA_KEY;
+export const QODER_CONTEXT_TIER_ENV = 'QODER_CONTEXT_TIER';
+export const QODER_CONTEXT_TIER_HEADROOM = 0.15;

package/dist/server/providers/qoder/cosy.js

@@ -0,0 +1,81 @@
+// Qoder COSY request signing: AES-128-CBC user blob + RSA-wrapped key + MD5 signature
+// over payload || cosyKey || timestamp || body || sigPath, plus the Cosy-* header set.
+// Pure: reads no env, touches no DB, logs nothing. The signed material is a credential —
+// callers must never log the returned headers.
+import { createCipheriv, createHash, publicEncrypt, randomUUID, constants as cryptoConstants } from 'node:crypto';
+import { QODER_CLIENT_TYPE, QODER_DATA_POLICY, QODER_IDE_VERSION, QODER_LOGIN_VERSION, QODER_MACHINE_OS, QODER_MACHINE_TYPE, QODER_RSA_PUBLIC_KEY, } from './constants.js';
+export function generateMachineId() {
+    return randomUUID();
+}
+/** Strip the leading `/algo`; matches the client convention the upstream validates against. */
+export function computeSigPath(requestUrl) {
+    let pathname;
+    try {
+        pathname = new URL(requestUrl).pathname;
+    }
+    catch {
+        return '';
+    }
+    return pathname.startsWith('/algo') ? pathname.slice('/algo'.length) : pathname;
+}
+function pkcs7Pad(data, blockSize) {
+    const padding = blockSize - (data.length % blockSize);
+    const padded = Buffer.alloc(data.length + padding, padding);
+    data.copy(padded, 0);
+    return padded;
+}
+function aesEncryptCbcBase64(plaintext, key) {
+    const keyBytes = Buffer.from(key, 'utf8');
+    if (keyBytes.length !== 16)
+        throw new Error(`qoder cosy: aes key must be 16 bytes, got ${keyBytes.length}`);
+    const cipher = createCipheriv('aes-128-cbc', keyBytes, keyBytes);
+    cipher.setAutoPadding(false);
+    return Buffer.concat([cipher.update(pkcs7Pad(Buffer.from(plaintext, 'utf8'), 16)), cipher.final()]).toString('base64');
+}
+const md5 = (input) => createHash('md5').update(input).digest('hex');
+/**
+ * Build the full Cosy-* header map for one request.
+ * `body` must be the exact bytes that will be sent (the obfuscated body for chat,
+ * an empty buffer for GETs).
+ */
+export function buildCosyHeaders(body, requestUrl, creds) {
+    if (!creds?.userId)
+        throw new Error('qoder cosy: user id is empty');
+    if (!creds?.authToken)
+        throw new Error('qoder cosy: auth token is empty');
+    const bodyBuf = Buffer.isBuffer(body) ? body : typeof body === 'string' ? Buffer.from(body, 'latin1') : Buffer.from(body ?? []);
+    // Fresh AES key per request: first 16 chars of a uuid4, which also becomes the IV.
+    const aesKey = randomUUID().slice(0, 16);
+    const info = aesEncryptCbcBase64(JSON.stringify({
+        uid: creds.userId, security_oauth_token: creds.authToken, name: creds.name ?? '', aid: '', email: creds.email ?? '',
+    }), aesKey);
+    const cosyKey = publicEncrypt({ key: QODER_RSA_PUBLIC_KEY, padding: cryptoConstants.RSA_PKCS1_PADDING }, Buffer.from(aesKey, 'utf8')).toString('base64');
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const payloadB64 = Buffer.from(JSON.stringify({
+        version: 'v1', requestId: randomUUID(), info, cosyVersion: QODER_IDE_VERSION, ideVersion: '',
+    }), 'utf8').toString('base64');
+    const sigPath = computeSigPath(requestUrl);
+    const sig = md5(Buffer.from(`${payloadB64}\n${cosyKey}\n${timestamp}\n${bodyBuf.toString('latin1')}\n${sigPath}`, 'latin1'));
+    const machineId = creds.machineId || generateMachineId();
+    return {
+        Authorization: `Bearer COSY.${payloadB64}.${sig}`,
+        'Cosy-Key': cosyKey,
+        'Cosy-User': creds.userId,
+        'Cosy-Date': timestamp,
+        'Cosy-Version': QODER_IDE_VERSION,
+        'Cosy-Machineid': machineId,
+        'Cosy-Machinetoken': machineId,
+        'Cosy-Machinetype': QODER_MACHINE_TYPE,
+        'Cosy-Machineos': QODER_MACHINE_OS,
+        'Cosy-Clienttype': QODER_CLIENT_TYPE,
+        'Cosy-Clientip': '127.0.0.1',
+        'Cosy-Bodyhash': md5(bodyBuf),
+        'Cosy-Bodylength': String(bodyBuf.length),
+        'Cosy-Sigpath': sigPath,
+        'Cosy-Data-Policy': QODER_DATA_POLICY,
+        'Cosy-Organization-Id': '',
+        'Cosy-Organization-Tags': '',
+        'Login-Version': QODER_LOGIN_VERSION,
+        'X-Request-Id': randomUUID(),
+    };
+}