cartethyia 2.4.5 → 2.5.0

package/src/console/auth/account-reset-store.ts

@@ -0,0 +1,14 @@
+import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { consoleLockouts, consoleUsers } from "../../persistence/schema";
+
+/**
+ * Clears console lockouts and accounts atomically so a reset can be followed
+ * immediately by first-boot setup from the same client address.
+ */
+export function resetConsoleAuthState(db: CartethyiaDatabase): Promise<number> {
+  return db.transaction(async (tx) => {
+    await tx.delete(consoleLockouts);
+    const users = await tx.delete(consoleUsers);
+    return users.rowCount ?? 0;
+  });
+}

package/src/console/auth/account-reset.ts

@@ -5,8 +5,9 @@
  * `/console/api/auth/change-password` requires the current password, and
  * first-boot setup only runs when no console user exists. The only documented
  * escape was deleting the database by hand. This endpoint removes every console
- * user, which puts `requiresSetup()` back to true so the next visit to
- * `/console` runs the create-an-account wizard again.
+ * user and login lockouts, which puts `requiresSetup()` back to true so the
+ * next visit to `/console` runs the create-an-account wizard again without
+ * inheriting a stale failure lock.
  *
  * What it does not touch: providers, provider accounts, API keys, routing,
  * combos, aliases, usage, and telemetry. Those are not authentication state and

package/src/console/auth/setup-service.ts

@@ -15,7 +15,6 @@ import { hashSecret, encryptCredential } from "../../security/crypto";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import {
   DEFAULT_API_KEY_LABEL,
-  DEFAULT_API_KEY_PREFIX,
   generateApiKeySecret,
 } from "../api-keys/contracts";
 import { resolveDefaultGatewayApiKey } from "../../config/runtime";
@@ -132,7 +131,8 @@ export class FirstBootSetupService {
       // encryption key, so an install that never touched the variable still
       // boots with a usable key instead of failing later with
       // "the default gateway API key is missing".
-      const secret = defaultApiKey ?? generateApiKeySecret().secret;
+      const generated = generateApiKeySecret();
+      const secret = defaultApiKey ?? generated.secret;
       const keyHash = hashSecret(secret);
       const existingApiKey = await db
         .select({ id: apiKeys.id })
@@ -146,7 +146,10 @@ export class FirstBootSetupService {
           keyHash,
           label: DEFAULT_API_KEY_LABEL,
           scopes: TENANT_KEY_SCOPES,
-          keyPrefix: defaultApiKey === undefined ? DEFAULT_API_KEY_PREFIX : secret.slice(0, 3),
+          // The generated prefix, not a slice of the secret: a slice assumed a
+          // fixed-width prefix, so a longer one would store a truncated value
+          // that no longer matches the key the operator was shown.
+          keyPrefix: defaultApiKey === undefined ? generated.prefix : secret.slice(0, 3),
           keyEncrypted: encryptCredential(secret),
           requestsPerMinute: 240,
           isDefault: true,

package/src/console/backup/routes.ts

@@ -18,6 +18,7 @@ import { Elysia, t } from "elysia";
 import type { ConsoleAccessResolver } from "../auth/access";
 import { invalidateApiKeyCache } from "../../security/api-key-auth";
 import { ConsoleDomainError, errorResponse, requireAnyScope } from "../shared/errors";
+import { NO_COMPRESS_HEADER } from "../response-compression";
 import { MAX_BACKUP_BYTES } from "./contracts";
 import type { BackupSection } from "./contracts";
 import { DELETE_ALL_SCOPES, compressBackup } from "./store";
@@ -124,6 +125,13 @@ export function createBackupRoutes(config: BackupRoutesConfig): Elysia {
         }
         const bytes = compressBackup(payload);
         set.headers["content-type"] = "application/json; charset=utf-8";
+        // Opt out of the response wrapper's gzip rather than declaring
+        // `content-encoding: gzip`: the bytes here are base64 of a gzip
+        // stream, and a client told "this is gzip" tries to inflate the
+        // base64 text and fails. The payload inside is already compressed,
+        // and a second pass over base64 would find nothing to gain while
+        // paying a synchronous `gzipSync` over the whole multi-MB body.
+        set.headers[NO_COMPRESS_HEADER] = "1";
         return { compressed: true, filename: `cartethyia_backup_${stamp}.json.gz`, bytes: bytes.toString("base64") };
       } catch (error) {
         return errorResponse(error, set, "Backup export failed");

package/src/console/cli-tools/contracts.ts

@@ -486,9 +486,9 @@ export const TOOL_REGISTRY = {
         roleKind: "primary",
       },
       {
-        id: "gpt-5.1",
-        name: "GPT-5.1",
-        alias: "gpt-5.1",
+        id: "gpt-5.6-sol",
+        name: "GPT-5.6 Sol",
+        alias: "gpt-5.6-sol",
         roleLabel: "Fallback Agent",
         roleKind: "secondary",
       },
@@ -505,7 +505,7 @@ export const TOOL_REGISTRY = {
     settingsFile: "~/.factory/settings.json",
     defaultModels: [
       { id: "claude/claude-sonnet-5", name: "Claude Sonnet 5", alias: "sonnet" },
-      { id: "gpt-5.1", name: "GPT-5.1", alias: "gpt-5.1" },
+      { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", alias: "gpt-5.6-sol" },
     ],
   },
 
@@ -540,7 +540,7 @@ export const TOOL_REGISTRY = {
     surface: "chat" as const,
     settingsFile: "Code/User/chatLanguageModels.json",
     defaultModels: [
-      { id: "gpt-5.1", name: "GPT-5.1", alias: "gpt-5.1" },
+      { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", alias: "gpt-5.6-sol" },
       { id: "claude/claude-sonnet-5", name: "Claude Sonnet 5", alias: "sonnet" },
     ],
   },
@@ -703,7 +703,7 @@ amp --model "{{model}}"`,
     docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/configuration/model-providers/",
     defaultModels: [
       { id: "claude/claude-sonnet-5", name: "Claude Sonnet 5", alias: "sonnet" },
-      { id: "gpt-5.1", name: "GPT-5.1", alias: "gpt-5.1" },
+      { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", alias: "gpt-5.6-sol" },
     ],
     notes: [
       {

package/src/console/console-router.ts

@@ -209,9 +209,11 @@ export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
   // nothing to compress and no size to judge. `wrap` sits outside the router
   // and sees the finished `Response`, which is what this needs.
   //
-  // Scoped to the console instance: `/v1/*` is a separate Elysia and is
-  // deliberately not covered, because a streaming completion must not be
-  // buffered and proxied bodies are the provider's own bytes. See
+  // Scoped by path *inside* `gzipResponse`, not by this instance: Elysia's
+  // `use()` merges a child's `hoc` into the root app's ext, so this wrap is
+  // reached by `/v1/*` as well. The allowlist is `/console/api/` + `/metrics`.
+  // `/v1/*` is deliberately excluded, because a streaming completion must not
+  // be buffered and proxied bodies are the provider's own bytes. See
   // `response-compression.ts` for the full reasoning and the measured win.
   console.wrap(
     (fetch) => (request: Request, ...rest: unknown[]) =>

package/src/console/dashboard-assets.ts

@@ -4,6 +4,7 @@ import {
   X_FRAME_OPTIONS,
   dashboardContentSecurityPolicy,
 } from "../security/outbound-headers";
+import { acceptsGzip } from "./response-compression";
 
 /**
  * Represents the result of serving a static file.
@@ -148,9 +149,39 @@ function entryDocumentFor(pathname: string, entries: Readonly<Record<string, str
  * - Serves hashed assets with immutable cache headers and documents with no-cache
  * - Returns 404 for missing asset-like files
  */
+/**
+ * The `.gz` sibling of an asset, when one exists and the client offered gzip.
+ *
+ * Restricted to hashed assets — see the check below for why — and best-effort:
+ * a build that emitted no `.gz` simply serves the plain file.
+ */
+async function readPrecompressed(
+  fullPath: string,
+  acceptEncoding: string | undefined | null,
+): Promise<Uint8Array | undefined> {
+  if (acceptEncoding === undefined || acceptEncoding === null) return undefined;
+  if (!acceptsGzip(acceptEncoding)) return undefined;
+  // Only hashed assets: those are the immutable ones, and they are what the
+  // Vite build precompresses. An unhashed asset is served with a revalidating
+  // cache header precisely because it may be replaced in place, and a `.gz`
+  // left beside a file that was swapped afterwards would not match it.
+  if (!hasHashInFilename(fullPath)) return undefined;
+  const file = Bun.file(`${fullPath}.gz`);
+  if (!(await file.exists())) return undefined;
+  return await file.bytes();
+}
+
+/**
+ * Builds the static handler.
+ *
+ * The returned function takes an optional `acceptEncoding` so the caller can
+ * pass the request's header: a precompressed `.gz` sibling is only usable when
+ * the client asking for it offered gzip. Omitting it serves the plain file,
+ * which is what the tests and any non-HTTP caller want.
+ */
 export function createStaticHandler(
   config: StaticHandlerConfig,
-): (pathname: string) => Promise<StaticServeResult> {
+): (pathname: string, acceptEncoding?: string | null) => Promise<StaticServeResult> {
   const buildDirResolved = resolve(config.buildDir);
   const buildDirNorm = normalizePathSeparators(buildDirResolved);
   const entries = config.entries ?? DEFAULT_ENTRY_DOCUMENTS;
@@ -173,7 +204,10 @@ export function createStaticHandler(
     };
   };
 
-  const serve = async (pathname: string): Promise<StaticServeResult> => {
+  const serve = async (
+    pathname: string,
+    acceptEncoding?: string | null,
+  ): Promise<StaticServeResult> => {
     // Reject the reserved `/console/api` namespace, including its bare prefix.
     if (pathname === "/console/api" || pathname.startsWith("/console/api/")) {
       return {
@@ -241,6 +275,28 @@ export function createStaticHandler(
             cacheControl = "public, max-age=3600";
           }
 
+          // A precompressed sibling is served when the client asked for gzip
+          // and the build emitted one. The bytes were compressed at build time
+          // (level 9), so this is a disk read rather than a per-request
+          // compress — and a build with no `.gz` falls through to the plain
+          // file, which is why there is no error path here.
+          const precompressed = await readPrecompressed(fullPath, acceptEncoding);
+          if (precompressed !== undefined) {
+            return {
+              status: 200,
+              body: precompressed,
+              headers: {
+                "content-type": mimeType,
+                "cache-control": cacheControl,
+                "content-encoding": "gzip",
+                // Without this a shared cache would hand the gzipped bytes to a
+                // client that never offered gzip: the URL is identical either
+                // way, so `accept-encoding` is the only thing that differs.
+                vary: "accept-encoding",
+              },
+            };
+          }
+
           return {
             status: 200,
             body: data,
@@ -260,8 +316,8 @@ export function createStaticHandler(
     return { status: 404, body: undefined, headers: {} };
   };
 
-  return async (pathname: string): Promise<StaticServeResult> =>
-    applyStaticSecurityHeaders(await serve(pathname));
+  return async (pathname: string, acceptEncoding?: string | null): Promise<StaticServeResult> =>
+    applyStaticSecurityHeaders(await serve(pathname, acceptEncoding));
 }
 
 /**
@@ -328,13 +384,27 @@ function getMimeType(filePath: string): string {
 }
 
 /**
- * Checks if a filename contains a hash (common pattern: name.hash.ext).
- * This is a heuristic that looks for hex-like strings in the filename.
+ * True when a filename carries a build hash, so its bytes are immutable.
+ *
+ * Matched on the two separator forms a bundler actually emits — `app.a1b2c3d4.js`
+ * and the modern Vite spelling `app-BCnqn3N3.js` — plus `_`, and then required
+ * to *look generated*: the segment must contain a digit or mix upper and lower
+ * case. The second half is what keeps a plain word out of the set, since
+ * `console-backgrounds.jpg` and `openai-light.svg` both match the separator
+ * alone and are emphatically not immutable.
+ *
+ * Getting this wrong in either direction costs real money: a hashed asset
+ * served with a revalidating header is re-downloaded after every deploy, and an
+ * unhashed one served `immutable` is pinned in the browser cache until it
+ * expires. Measured against a real build, this matches 198 of 288 files — all
+ * of them hashed bundles — and rejects every icon, photo, and document.
  */
 function hasHashInFilename(filePath: string): boolean {
-  const filename = filePath.split(/[/\\]/).pop() || "";
-  // Match patterns like: app.abc123def.js, script.12345678.mjs, etc.
-  // Look for segments that are at least 8 characters of hex digits
-  const hashPattern = /\.[a-f0-9]{6,}\./i;
-  return hashPattern.test(filename);
+  const filename = filePath.split(/[/\\]/).pop() ?? "";
+  const match = /[._-]([A-Za-z0-9_-]{8,})\./.exec(filename);
+  if (match === null) return false;
+  const segment = match[1] ?? "";
+  const hasDigit = /[0-9]/.test(segment);
+  const hasMixedCase = /[a-z]/.test(segment) && /[A-Z]/.test(segment);
+  return hasDigit || hasMixedCase;
 }

package/src/console/domain-registration.ts

@@ -180,6 +180,7 @@ export function registerConsoleDomains(
           if (slot) {
             return {
               fetch: ctx.networkBindingFactory.fetch(slot.poolId, tenantId),
+              http2Bidi: ctx.networkBindingFactory.http2Bidi(slot.poolId, tenantId),
               networkPoolId: slot.poolId,
               release: slot.release,
             };
@@ -195,7 +196,10 @@ export function registerConsoleDomains(
         }
       }
 
-      return { fetch: ctx.networkBindingFactory.fetch(undefined, tenantId) };
+      return {
+        fetch: ctx.networkBindingFactory.fetch(undefined, tenantId),
+        http2Bidi: ctx.networkBindingFactory.http2Bidi(undefined, tenantId),
+      };
     },
     snapshotInvalidator: ctx.routeSnapshotService,
     readAccountInflight: async (providerId, tenantId) =>
@@ -219,7 +223,10 @@ export function registerConsoleDomains(
   }));
   console.use(createLogRoutes({ accessResolver: ctx.accessResolver, auditSink: ctx.auditRecorder }));
   console.use(createPerformanceRoutes({ accessResolver: ctx.accessResolver }));
-  console.use(createUpdateRoutes());
+  console.use(createUpdateRoutes({
+    accessResolver: ctx.accessResolver,
+    observabilityStore,
+  }));
   console.use(createAuditRoutes({ store: auditReadStore, accessResolver: ctx.accessResolver }));
   if (ctx.modelStrikes) {
     console.use(createModelAbuseRoutes({