n9router 0.4.49 → 0.4.51

package/app/open-sse/services/cursorModels.js

@@ -0,0 +1,187 @@
+/**
+ * Cursor live model catalog fetcher.
+ *
+ * Cursor exposes the account-specific model picker through the AgentService
+ * `GetUsableModels` Connect RPC. Unlike the static provider registry, this
+ * includes models newly enabled for the account and omits unavailable ones.
+ */
+
+import crypto from "crypto";
+import http2 from "http2";
+import { PROVIDER_OAUTH } from "../providers/index.js";
+import { buildCursorHeaders } from "../utils/cursorChecksum.js";
+import { decodeMessage } from "../utils/cursorProtobuf.js";
+
+const FETCH_TIMEOUT_MS = 10_000;
+const CACHE_TTL_MS = 5 * 60 * 1000;
+
+// agent.v1.ModelDetails protobuf field numbers.
+const MODEL_ID_FIELD = 1;
+const DISPLAY_MODEL_ID_FIELD = 3;
+const DISPLAY_NAME_FIELD = 4;
+const DISPLAY_NAME_SHORT_FIELD = 5;
+const RESPONSE_MODELS_FIELD = 1;
+
+/** @type {Map<string, { expiresAt: number, models: { id: string, name: string }[] }>} */
+const catalogCache = new Map();
+
+function getCursorModelsUrl() {
+  const config = PROVIDER_OAUTH.cursor;
+  if (!config?.agentEndpoint || !config?.modelsEndpoint) return null;
+  return `${config.agentEndpoint.replace(/\/$/, "")}${config.modelsEndpoint}`;
+}
+
+function cacheKey(credentials) {
+  const seed = [
+    credentials?.providerSpecificData?.machineId,
+    credentials?.accessToken,
+  ].filter(Boolean).join(":");
+  if (!seed) return "cursor-anonymous";
+  return crypto.createHash("sha256").update(`cursor:${seed}`).digest("hex");
+}
+
+function firstString(fields, fieldNumber) {
+  const value = fields.get(fieldNumber)?.[0]?.value;
+  if (!value || typeof value === "number") return "";
+  return Buffer.from(value).toString("utf8");
+}
+
+/**
+ * Decode Cursor's `agent.v1.GetUsableModelsResponse` protobuf payload.
+ * The response contains repeated `agent.v1.ModelDetails` messages in field 1.
+ */
+export function parseCursorUsableModels(payload) {
+  const response = decodeMessage(payload);
+  const seen = new Set();
+  const models = [];
+
+  for (const entry of response.get(RESPONSE_MODELS_FIELD) || []) {
+    if (!entry?.value || typeof entry.value === "number") continue;
+    const detail = decodeMessage(entry.value);
+    const id = firstString(detail, MODEL_ID_FIELD).trim();
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+
+    const name = (
+      firstString(detail, DISPLAY_NAME_FIELD)
+      || firstString(detail, DISPLAY_NAME_SHORT_FIELD)
+      || firstString(detail, DISPLAY_MODEL_ID_FIELD)
+      || id
+    ).trim();
+    models.push({ id, name });
+  }
+
+  return models;
+}
+
+/**
+ * agent.api5.cursor.sh is HTTP/2-only; Node fetch/undici cannot speak h2.
+ * Unary GetUsableModels uses an unframed protobuf body (application/proto).
+ */
+function http2PostProto(url, headers, body, signal, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const urlObj = new URL(url);
+    const client = http2.connect(`https://${urlObj.host}`);
+    const chunks = [];
+    let responseHeaders = {};
+    let settled = false;
+
+    const finish = (fn) => (...args) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutId);
+      try { client.close(); } catch {}
+      fn(...args);
+    };
+
+    const timeoutId = setTimeout(finish(() => {
+      reject(new Error("Cursor GetUsableModels timed out"));
+    }), timeoutMs);
+
+    client.on("error", finish(reject));
+
+    const req = client.request({
+      ":method": "POST",
+      ":path": urlObj.pathname,
+      ":authority": urlObj.host,
+      ":scheme": "https",
+      ...headers,
+    });
+
+    req.on("response", (hdrs) => { responseHeaders = hdrs; });
+    req.on("data", (chunk) => { chunks.push(chunk); });
+    req.on("end", finish(() => {
+      resolve({
+        status: Number(responseHeaders[":status"] || 0),
+        body: Buffer.concat(chunks),
+      });
+    }));
+    req.on("error", finish(reject));
+
+    if (signal) {
+      const onAbort = finish(() => reject(new Error("Request aborted")));
+      if (signal.aborted) onAbort();
+      else signal.addEventListener("abort", onAbort, { once: true });
+    }
+
+    req.end(body && body.length ? Buffer.from(body) : undefined);
+  });
+}
+
+async function fetchCursorCatalog(credentials, signal) {
+  const accessToken = credentials?.accessToken;
+  const machineId = credentials?.providerSpecificData?.machineId;
+  const url = getCursorModelsUrl();
+  if (!accessToken || !machineId || !url) return null;
+
+  const headers = {
+    ...buildCursorHeaders(accessToken, machineId, credentials?.providerSpecificData?.ghostMode !== false),
+    // Connect unary calls use an unframed protobuf body, unlike Cursor chat's
+    // streaming `application/connect+proto` endpoint.
+    accept: "application/proto",
+    "content-type": "application/proto",
+  };
+  delete headers["connect-accept-encoding"];
+  delete headers["connect-protocol-version"];
+
+  const response = await http2PostProto(url, headers, new Uint8Array(), signal, FETCH_TIMEOUT_MS);
+  if (response.status !== 200) {
+    const error = new Error(`Cursor GetUsableModels returned ${response.status}`);
+    error.status = response.status;
+    throw error;
+  }
+
+  return parseCursorUsableModels(new Uint8Array(response.body));
+}
+
+/**
+ * Resolve the live Cursor catalog for the authenticated account.
+ * Returns null on any failure so callers can fall back to static models.
+ */
+export async function resolveCursorModels(credentials, options = {}) {
+  if (!credentials?.accessToken || !credentials?.providerSpecificData?.machineId) {
+    options.log?.debug?.("CURSOR_MODELS", "No Cursor access token or machine ID; skipping live fetch");
+    return null;
+  }
+
+  const key = cacheKey(credentials);
+  const now = Date.now();
+  if (!options.forceRefresh) {
+    const cached = catalogCache.get(key);
+    if (cached?.expiresAt > now) return { models: cached.models };
+  }
+
+  try {
+    const models = await fetchCursorCatalog(credentials, options.signal);
+    if (!models?.length) return null;
+    catalogCache.set(key, { expiresAt: now + CACHE_TTL_MS, models });
+    return { models };
+  } catch (error) {
+    options.log?.warn?.("CURSOR_MODELS", `Live model fetch failed: ${error?.message || error}`);
+    return null;
+  }
+}
+
+export function clearCursorModelCache() {
+  catalogCache.clear();
+}

package/app/open-sse/services/grokCliModels.js

@@ -0,0 +1,127 @@
+import {
+  GROK_CLI_BASE_URL,
+  GROK_CLI_CLIENT_IDENTIFIER,
+  GROK_CLI_MODEL,
+  GROK_CLI_USER_AGENT,
+  GROK_CLI_VERSION,
+} from "../config/grokCli.js";
+import { refreshProviderCredentials } from "./oauthCredentialManager.js";
+import { proxyAwareFetch } from "../utils/proxyFetch.js";
+
+const MODELS_URL = `${GROK_CLI_BASE_URL}/models`;
+
+function modelEntries(data) {
+  const value = Array.isArray(data) ? data : data?.data ?? data?.models ?? data?.results ?? [];
+  if (Array.isArray(value)) return value.map((item) => [null, item]);
+  if (value && typeof value === "object") return Object.entries(value);
+  return [];
+}
+
+export function parseGrokCliModels(data) {
+  const seen = new Set();
+  const models = [];
+
+  for (const [key, raw] of modelEntries(data)) {
+    const item = typeof raw === "string" ? { id: raw } : raw;
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const id = String(
+      item.id ?? item.model_id ?? item.modelId ?? item.model ?? item.slug ?? key ?? item.name ?? "",
+    ).trim();
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+
+    const model = {
+      ...item,
+      id,
+      name: item.display_name ?? item.displayName ?? item.name ?? id,
+    };
+    const contextLength = Number(
+      item.context_length ?? item.contextLength ?? item.context_window ?? item.contextWindow,
+    );
+    const maxOutputTokens = Number(item.max_output_tokens ?? item.maxOutputTokens);
+    if (Number.isFinite(contextLength) && contextLength > 0) model.contextLength = contextLength;
+    if (Number.isFinite(maxOutputTokens) && maxOutputTokens > 0) {
+      model.maxOutputTokens = maxOutputTokens;
+    }
+    if (id === GROK_CLI_MODEL) {
+      model.contextLength ||= 500000;
+      model.maxOutputTokens ||= 64000;
+    }
+    models.push(model);
+  }
+
+  return models;
+}
+
+function buildHeaders(accessToken, providerSpecificData = {}) {
+  const headers = {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: "application/json",
+    "User-Agent": GROK_CLI_USER_AGENT,
+    "x-xai-token-auth": "xai-grok-cli",
+    "x-grok-client-version": GROK_CLI_VERSION,
+    "x-grok-client-identifier": GROK_CLI_CLIENT_IDENTIFIER,
+    "x-grok-client-mode": "headless",
+  };
+  const email = providerSpecificData?.email;
+  const userId = providerSpecificData?.userId || providerSpecificData?.principalId;
+  if (email) headers["x-email"] = email;
+  if (userId) headers["x-userid"] = userId;
+  return headers;
+}
+
+export async function resolveGrokCliModels(credentials, options = {}) {
+  const {
+    fetchFn = proxyAwareFetch,
+    log = console,
+    proxyOptions = null,
+    onCredentialsRefreshed,
+  } = options;
+  let accessToken = credentials?.accessToken;
+  if (!accessToken) return { models: [], warning: "Grok CLI access token is missing." };
+
+  const request = (token) => fetchFn(
+    MODELS_URL,
+    {
+      method: "GET",
+      headers: buildHeaders(token, credentials?.providerSpecificData),
+    },
+    proxyOptions,
+  );
+
+  try {
+    let response = await request(accessToken);
+    if ((response.status === 401 || response.status === 403) && credentials?.refreshToken) {
+      const refreshed = await refreshProviderCredentials(
+        "grok-cli",
+        credentials,
+        log,
+        proxyOptions,
+      );
+      if (refreshed?.accessToken) {
+        accessToken = refreshed.accessToken;
+        try {
+          await onCredentialsRefreshed?.(refreshed);
+        } catch (error) {
+          log?.warn?.("Grok CLI credential persistence failed", error);
+        }
+        response = await request(accessToken);
+      }
+    }
+
+    if (!response.ok) {
+      const detail = await response.text().catch(() => "");
+      return {
+        models: [],
+        warning: `Grok CLI model discovery failed (${response.status})${detail ? `: ${detail.slice(0, 160)}` : ""}`,
+      };
+    }
+
+    const models = parseGrokCliModels(await response.json());
+    return models.length
+      ? { models }
+      : { models: [], warning: "Grok CLI returned no selectable models." };
+  } catch (error) {
+    return { models: [], warning: `Grok CLI model discovery failed: ${error.message}` };
+  }
+}

package/app/open-sse/services/model.js

@@ -17,6 +17,10 @@ for (const entry of REGISTRY) {
   for (const a of entry.aliases || []) ALIAS_TO_PROVIDER_ID[a] = entry.id;
 }
 
+const BUILTIN_MODEL_ALIASES = {
+  "grok-build": "gcli/grok-build",
+};
+
 /**
  * Resolve provider alias to provider ID
  */
@@ -104,7 +108,9 @@ export async function getModelInfoCore(modelStr, aliasesOrGetter) {
       : aliasesOrGetter;
 
   // Resolve alias
-  const resolved = resolveModelAliasFromMap(parsed.model, aliases);
+  const resolved =
+    resolveModelAliasFromMap(parsed.model, aliases) ||
+    resolveModelAliasFromMap(parsed.model, BUILTIN_MODEL_ALIASES);
   if (resolved) {
     return resolved;
   }

package/app/open-sse/services/projectId.js

@@ -7,7 +7,7 @@
  * This significantly reduces the risk of being flagged by Google's anti-abuse systems.
  */
 
-import { CLOUD_CODE_API, LOAD_CODE_ASSIST_HEADERS, LOAD_CODE_ASSIST_METADATA } from "../config/appConstants.js";
+import { CLOUD_CODE_API, LOAD_CODE_ASSIST_HEADERS, ANTIGRAVITY_LOAD_CODE_ASSIST_HEADERS, LOAD_CODE_ASSIST_METADATA } from "../config/appConstants.js";
 
 // ─── Cache ────────────────────────────────────────────────────────────────────
 // connectionId -> { projectId: string, fetchedAt: number }
@@ -83,7 +83,7 @@ startCacheCleanup();
  * @param {string} accessToken  - Valid OAuth access token
  * @returns {Promise<string|null>} Real project ID or null
  */
-export async function getProjectIdForConnection(connectionId, accessToken) {
+export async function getProjectIdForConnection(connectionId, accessToken, provider = "gemini-cli") {
     if (!connectionId || !accessToken) return null;
 
     // Return cached value if still fresh
@@ -102,7 +102,7 @@ export async function getProjectIdForConnection(connectionId, accessToken) {
 
     const promise = (async () => {
         try {
-            const projectId = await fetchProjectId(accessToken, controller.signal);
+            const projectId = await fetchProjectId(accessToken, controller.signal, provider);
             if (projectId) {
                 projectIdCache.set(connectionId, {projectId, fetchedAt: Date.now()});
                 return projectId;
@@ -155,10 +155,12 @@ export function removeConnection(connectionId) {
  * @param {AbortSignal} signal
  * @returns {Promise<string|null>}
  */
-async function fetchProjectId(accessToken, signal) {
-    const response = await fetch(CLOUD_CODE_API.loadCodeAssist, {
+async function fetchProjectId(accessToken, signal, provider) {
+    const endpoints = CLOUD_CODE_API[provider] || CLOUD_CODE_API["gemini-cli"];
+    const headers = provider === "antigravity" ? ANTIGRAVITY_LOAD_CODE_ASSIST_HEADERS : LOAD_CODE_ASSIST_HEADERS;
+    const response = await fetch(endpoints.loadCodeAssist, {
         method: "POST",
-        headers: { ...LOAD_CODE_ASSIST_HEADERS, "Authorization": `Bearer ${accessToken}` },
+        headers: { ...headers, "Authorization": `Bearer ${accessToken}` },
         body: JSON.stringify({ metadata: LOAD_CODE_ASSIST_METADATA }),
         signal
     });
@@ -185,7 +187,7 @@ async function fetchProjectId(accessToken, signal) {
         }
     }
 
-    return onboardUser(accessToken, tierID, signal);
+    return onboardUser(accessToken, tierID, signal, endpoints, provider);
 }
 
 /**
@@ -196,10 +198,11 @@ async function fetchProjectId(accessToken, signal) {
  * @param {AbortSignal} externalSignal  – propagated from the connection's AbortController
  * @returns {Promise<string|null>}
  */
-async function onboardUser(accessToken, tierID, externalSignal) {
+async function onboardUser(accessToken, tierID, externalSignal, endpoints, provider) {
     console.log(`[ProjectId] Onboarding user with tier: ${tierID}`);
 
     const reqBody = { tierId: tierID, metadata: LOAD_CODE_ASSIST_METADATA };
+    const headers = provider === "antigravity" ? ANTIGRAVITY_LOAD_CODE_ASSIST_HEADERS : LOAD_CODE_ASSIST_HEADERS;
     const MAX_ATTEMPTS = 5;
 
     for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
@@ -213,9 +216,9 @@ async function onboardUser(accessToken, tierID, externalSignal) {
         externalSignal?.addEventListener("abort", forwardAbort);
 
         try {
-            const response = await fetch(CLOUD_CODE_API.onboardUser, {
+            const response = await fetch(endpoints.onboardUser, {
                 method: "POST",
-                headers: { ...LOAD_CODE_ASSIST_HEADERS, "Authorization": `Bearer ${accessToken}` },
+                headers: { ...headers, "Authorization": `Bearer ${accessToken}` },
                 body: JSON.stringify(reqBody),
                 signal: localCtrl.signal
             });

package/app/open-sse/services/provider.js

@@ -19,9 +19,15 @@ function isAnthropicCompatible(provider) {
   return typeof provider === "string" && provider.startsWith(ANTHROPIC_COMPATIBLE_PREFIX);
 }
 
-function getOpenAICompatibleType(provider) {
-  if (!isOpenAICompatible(provider)) return "chat";
-  return provider.includes("responses") ? "responses" : "chat";
+// Resolve the API type (chat vs responses) for an openai-compatible node.
+// The stored apiType on the connection's providerSpecificData (kept in sync with
+// the node on create/update) is authoritative. Falls back to the node ID
+// substring for legacy nodes created before apiType was persisted — their IDs
+// embed the type: openai-compatible-<chat|responses>-<uuid>.
+export function resolveOpenAICompatibleApiType(provider, credentials = null) {
+  const stored = credentials?.providerSpecificData?.apiType;
+  if (stored === "chat" || stored === "responses") return stored;
+  return typeof provider === "string" && provider.includes("responses") ? "responses" : "chat";
 }
 
 // Detect request format from body structure
@@ -105,9 +111,9 @@ export function detectFormat(body) {
 }
 
 // Get provider config (internal — no external runtime consumer)
-function getProviderConfig(provider) {
+function getProviderConfig(provider, credentials = null) {
   if (isOpenAICompatible(provider)) {
-    const apiType = getOpenAICompatibleType(provider);
+    const apiType = resolveOpenAICompatibleApiType(provider, credentials);
     return {
       ...PROVIDERS.openai,
       format: apiType === "responses" ? "openai-responses" : "openai",
@@ -125,14 +131,14 @@ function getProviderConfig(provider) {
 }
 
 // Get target format for provider
-export function getTargetFormat(provider) {
+export function getTargetFormat(provider, credentials = null) {
   if (isOpenAICompatible(provider)) {
-    return getOpenAICompatibleType(provider) === "responses" ? "openai-responses" : "openai";
+    return resolveOpenAICompatibleApiType(provider, credentials) === "responses" ? "openai-responses" : "openai";
   }
   if (isAnthropicCompatible(provider)) {
     return "claude";
   }
-  const config = getProviderConfig(provider);
+  const config = getProviderConfig(provider, credentials);
   return config.format || "openai";
 }
 

package/app/open-sse/services/qoderModels.js

@@ -10,6 +10,12 @@
  *
  * On any error the live cache stays empty and chatExecuteCall surfaces the
  * problem to the user as "model config not yet fetched, retry shortly".
+ *
+ * PAT (Personal Access Token, pt-...) connections: a PAT cannot sign COSY
+ * requests directly, so we exchange it for a short-lived job token (jt-...)
+ * via openapi.qoder.sh/api/v1/jobToken/exchange (plain JSON POST), then use
+ * that job token for signing. Job-token traffic must hit api2.qoder.sh —
+ * api3 rejects jt- with "Login expired" (403).
  */
 
 import { createHash } from "crypto";
@@ -18,11 +24,30 @@ import { proxyAwareFetch } from "../utils/proxyFetch.js";
 import { buildCosyHeaders } from "../shared/qoder/cosy.js";
 import {
   QODER_MODEL_LIST_URL,
+  QODER_CHAT_BASE_ALT,
+  QODER_JOB_TOKEN_EXCHANGE_URL,
+  QODER_USERINFO_URL,
+  QODER_IDE_VERSION,
+  QODER_CLIENT_TYPE,
 } from "../shared/qoder/constants.js";
 
 const FETCH_TIMEOUT_MS = 15_000;
 const CACHE_TTL_MS = 60 * 60 * 1000; // 1h, same as the Kiro catalog
 
+const PAT_PREFIX = "pt-";
+
+// PAT → job-token cache: a job token is short-lived (24h), so we keep it per
+// PAT and re-exchange once it is within 5 minutes of expiry.
+const PAT_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const PAT_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+
+export function isQoderPat(token) {
+  return typeof token === "string" && token.startsWith(PAT_PREFIX);
+}
+
+/** @type {Map<string, { accessToken: string, userId: string, expiresAt: number }>} */
+const patJobCache = new Map();
+
 /** @type {Map<string, { expiresAt: number, models: any[], rawConfigs: Map<string, object>, fetched: boolean }>} */
 const catalogCache = new Map();
 
@@ -34,6 +59,109 @@ const catalogCache = new Map();
  */
 const inflight = new Map();
 
+/**
+ * Exchange a Qoder PAT (pt-...) for a short-lived job token (jt-...).
+ * This endpoint is plain JSON POST — NOT COSY-signed.
+ */
+async function exchangeJobToken(pat, proxyOptions = null, signal = null) {
+  const res = await proxyAwareFetch(
+    QODER_JOB_TOKEN_EXCHANGE_URL,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": "qodercli/1.0.0",
+        "Cosy-Version": QODER_IDE_VERSION,
+        "Cosy-ClientType": QODER_CLIENT_TYPE,
+      },
+      body: JSON.stringify({ personal_token: pat }),
+      signal,
+    },
+    proxyOptions,
+  );
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`qoder PAT exchange failed: ${res.status} ${text.slice(0, 200)}`);
+  }
+  const data = await res.json();
+  if (!data.token) throw new Error("qoder PAT exchange returned no job token");
+
+  let expiresAt = Date.now() + PAT_DEFAULT_TTL_MS;
+  if (data.expires_at) {
+    const parsed = Date.parse(data.expires_at);
+    if (!Number.isNaN(parsed)) expiresAt = parsed;
+  } else if (typeof data.expires_in === "number" && data.expires_in > 0) {
+    expiresAt = Date.now() + data.expires_in;
+  }
+  return { jobToken: data.token, jobRefreshToken: data.refresh_token || "", expiresAt };
+}
+
+/**
+ * Resolve the Qoder userId for a job token (needed for COSY signing).
+ * Returns "" on any failure — callers fall back to the stored userId.
+ */
+async function fetchUserIdForJobToken(jobToken, proxyOptions = null, signal = null) {
+  try {
+    const res = await proxyAwareFetch(
+      QODER_USERINFO_URL,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${jobToken}`,
+          Accept: "application/json",
+          "User-Agent": "qodercli/1.0.0",
+        },
+        signal,
+      },
+      proxyOptions,
+    );
+    if (!res.ok) return "";
+    const data = await res.json().catch(() => ({}));
+    return data.id || data.userId || data.user_id || "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Resolve a PAT to a job-token credential, cached per-PAT.
+ */
+async function resolvePatCredential(pat, proxyOptions = null, signal = null) {
+  const cached = patJobCache.get(pat);
+  if (cached && cached.expiresAt - Date.now() > PAT_REFRESH_BUFFER_MS) return cached;
+
+  const { jobToken, expiresAt } = await exchangeJobToken(pat, proxyOptions, signal);
+  const userId = await fetchUserIdForJobToken(jobToken, proxyOptions, signal);
+  const resolved = { accessToken: jobToken, userId, expiresAt };
+  patJobCache.set(pat, resolved);
+  return resolved;
+}
+
+/**
+ * Resolve connection credentials to COSY-signable form:
+ *   - PAT (pt-...) connections → exchanged to a job token (jt-...) + userId
+ *   - everything else → passed through unchanged
+ */
+export async function resolveQoderCredentials(credentials, proxyOptions = null, signal = null) {
+  const raw = credentials?.apiKey || credentials?.accessToken;
+  if (isQoderPat(raw)) {
+    const resolved = await resolvePatCredential(raw, proxyOptions, signal);
+    return {
+      ...credentials,
+      accessToken: resolved.accessToken,
+      apiKey: undefined,
+      providerSpecificData: {
+        authMethod: "pat",
+        ...(credentials?.providerSpecificData || {}),
+        userId: resolved.userId || credentials?.providerSpecificData?.userId || "",
+        machineId: credentials?.providerSpecificData?.machineId || "",
+      },
+    };
+  }
+  return credentials;
+}
+
 /**
  * Stable cache key per credential (so different login sessions for the same
  * account share an entry).
@@ -68,10 +196,16 @@ async function fetchQoderCatalogRaw(credentials, signal, proxyOptions = null) {
   const creds = cosyCredsFromConnection(credentials);
   if (!creds.userId || !creds.authToken) return null;
 
+  // Job-token traffic is rejected by api3 ("Login expired" 403) — the
+  // official qodercli serves it from api2 instead.
+  const modelListUrl = String(creds.authToken).startsWith("jt-")
+    ? `${QODER_CHAT_BASE_ALT}/algo/api/v2/model/list`
+    : QODER_MODEL_LIST_URL;
+
   const headers = {
     Accept: "application/json",
     "Accept-Encoding": "identity",
-    ...buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds),
+    ...buildCosyHeaders(Buffer.alloc(0), modelListUrl, creds),
   };
 
   const controller = new AbortController();
@@ -92,7 +226,7 @@ async function fetchQoderCatalogRaw(credentials, signal, proxyOptions = null) {
       }
     }
     response = await proxyAwareFetch(
-      QODER_MODEL_LIST_URL,
+      modelListUrl,
       {
         method: "GET",
         headers,
@@ -159,11 +293,16 @@ export async function getQoderModelConfig(credentials, modelKey, options = {}) {
  * one upstream request per credential.
  */
 export async function resolveQoderModels(credentials, options = {}) {
-  if (!credentials?.accessToken) return null;
-  const psd = credentials.providerSpecificData || {};
-  if (!psd.userId) return null;
+  let resolved;
+  try {
+    resolved = await resolveQoderCredentials(credentials, options.proxyOptions, options.signal);
+  } catch (error) {
+    options.log?.warn?.("QODER", `PAT exchange failed: ${error.message}`);
+    return null;
+  }
+  if (!resolved?.accessToken || !(resolved.providerSpecificData || {}).userId) return null;
 
-  const key = cacheKey(credentials);
+  const key = cacheKey(resolved);
   const now = Date.now();
   if (!options.forceRefresh) {
     const cached = catalogCache.get(key);
@@ -180,7 +319,7 @@ export async function resolveQoderModels(credentials, options = {}) {
   }
 
   const fetchPromise = (async () => {
-    const fetched = await fetchQoderCatalogRaw(credentials, options.signal, options.proxyOptions);
+    const fetched = await fetchQoderCatalogRaw(resolved, options.signal, options.proxyOptions);
     if (!fetched) return null;
     const entry = {
       expiresAt: Date.now() + CACHE_TTL_MS,