6 Commits
Author SHA1 Message Date
zmf 807553e246 feat(codebuddy-cn): replace deepseek-v4-flash with deepseek-v4.1-flash
The server's product-config payload (which the IDE plugin fetches from
copilot.tencent.com) publishes deepseek-v4.1-flash and no longer lists
deepseek-v4-flash, so the old id is dropped — same pattern as the previous
catalog refreshes (#3648, #3802). The v4-flash endpoint still answers 200,
but the published list is the contract.

Per the server table, maxOutput rises 50000 -> 128000 while contextWindow
stays 1000000.

- registry/codebuddy-cn.js: models[] entry swapped to the new id
- capabilities.js: per-model entry swapped, maxOutput -> 128000

No changes needed in thinkingLevels.js (the deepseek-v4* pattern already
matches the new id and publishes low/high/xhigh, matching the server's
supportedEfforts or pricing.js (the deepseek-v* glob yields the same rates).
EOF
)
2026-09-10 21:57:49 +07:00
zmf cec672d9d9 feat(providers): align codebuddy-cn catalog/capabilities with server config
- Sync codebuddy-cn catalog and capabilities with copilot.tencent.com server payload
- Fix thinkingCanDisable semantics for glm-5.3 and deepseek-v4 models
- Add missing glm-5.2 thinking levels to thinkingLevels.js
- Add glm-5-turbo model to glm and glm-cn registries
2026-09-05 21:03:02 +07:00
zmf e014cb537f feat(codebuddy-cn): refresh model catalog — add hy4-preview/hy3/glm-5.3/kimi-k3, drop EOL glm-5.0/glm-4.7
- Add hy3, hy3-x, hy4-preview, hy4-preview-x, glm-5.3, glm-5.3-flash, kimi-k3-1
- Remove dead models glm-5.0, glm-4.7 (API 11102)
- Register capabilities and context windows in PROVIDER_CAPABILITIES
- Configure supported effort sets in PATTERN_THINKING
2026-09-03 09:41:02 +07:00
zmf 8ed9da7165 feat(providers): add glm-5.3 to GLM Coding and GLM (China) registries
Zhipu released GLM-5.3 on both api.z.ai and open.bigmodel.cn coding
endpoints. Verified live against both, returning model:"glm-5.3" with
native reasoning_content.

No other changes needed: the '*glm-5*' family pattern in capabilities.js
and 'glm-5*' in pricing.js already cover it.
2026-08-14 16:16:46 +07:00
zmf 8a527fec91 fix(security): SSRF guard on search baseUrl, default-password remote login, and request-details redaction
- resolveBaseUrl() rejects client-supplied non-public baseUrls via assertPublicUrl (SSRF guard on /v1/search)
- fresh-install remote login with default password returns 403 without issuing a JWT
- /api/usage/request-details redacts request/providerRequest/providerResponse/response payloads
- declare chalk and prop-types in package.json (used but previously undeclared)
2026-08-13 11:50:25 +07:00
zmfandCursor 602ee4054b fix(codebuddy-cn): strip empty tool_calls arrays to preserve reasoning
CodeBuddy CN includes "tool_calls": [] in every SSE streaming delta.
@ai-sdk/openai-compatible checks delta.tool_calls != null — an empty
array passes ([] != null is true in JS), triggering premature
reasoning-end on every reasoning chunk (0/1ms durations in OpenCode).

Strip empty tool_calls arrays in passthrough before hasValuableContent.
Zero side-effect: real tool_calls always have at least one element.

Closes #2176

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-01 09:39:31 +07:00