cartethyia 2.4.5 → 2.5.0

package/src/transport/failure-policy.ts

@@ -884,10 +884,30 @@ export function isRetryableFailure(error: unknown): boolean {
   return classifyUpstreamFailure(error).retryable;
 }
 
+/**
+ * Minimum wall-clock budget a follow-on attempt needs to be worth starting.
+ *
+ * A retry repeats the whole pre-dispatch phase — credential resolution,
+ * admission, pool slot, request preparation — so it needs at least this much
+ * headroom on top of whatever the upstream itself takes. Below this, the
+ * attempt is killed by the deadline before it can return anything usable, and
+ * starting it replaces the first attempt's real error with a second one's
+ * timeout.
+ *
+ * Owned here so the attempt loop, the empty-stream replay, and the Codex
+ * retry budget cannot drift apart; each previously declared its own copy of
+ * the constant.
+ */
+export const MIN_RETRY_BUDGET_MS = 15_000;
+
 /**
  * Capped exponential backoff with full jitter for a zero-based attempt index.
  * The base and cap are operator-tunable (`CARTETHYIA_FALLBACK_RETRY_BASE_MS`,
  * `CARTETHYIA_FALLBACK_RETRY_CAP_MS`) and default to 100ms / 2000ms.
+ *
+ * Used for every retry delay, including the empty-stream replay: jitter keeps
+ * concurrent clients from resynchronizing, and the cap keeps a provider that
+ * returns 200-with-no-events from driving an unbounded wait.
  */
 export function fallbackRetryDelayMs(attemptIndex: number): number {
   const exp = Math.min(resolveFallbackRetryCapMs(), resolveFallbackRetryBaseMs() * 2 ** attemptIndex);

package/src/transport/guards/auth-guard.ts

@@ -1,3 +1,4 @@
+import { log } from "../../observability/logger";
 // API-key authentication guard for `/v1/*`: token resolution, scope check,
 // client-router denylist, and the model-abuse ban gate.
 import { Elysia } from "elysia";
@@ -39,7 +40,31 @@ export function createApiKeyAuthenticationMiddleware(deps: {
       const pathname = fastPathname(request.url);
       if (!pathname.startsWith("/v1/")) return;
       const token = requestToken(request.headers);
-      const authorization = await resolveApiKeyAuthorization(deps.db, token);
+      // A database failure here is not "the key is bad". Left to propagate it
+      // surfaced as a 500 whose log line carried the whole statement and its
+      // bound parameters — including the key hash — once per request. Under an
+      // overloaded database that is a credential leak written at request rate.
+      //
+      // It is also the wrong answer: the caller cannot fix it by sending a
+      // different key, so it is a capacity signal, not an auth one.
+      const authorization = await resolveApiKeyAuthorization(deps.db, token).catch((error: unknown) => {
+        // Only the error's identity is logged, never its message: a drizzle
+        // query error carries the full statement and its bound parameters, and
+        // on this path one of those parameters is the key hash.
+        // A sanitized stand-in, not the original: a drizzle query error's
+        // message is the statement plus its bound parameters, and one of those
+        // parameters is the key hash.
+        const safe = new Error("[redacted: credential-store query failed]");
+        safe.name = error instanceof Error ? error.name : "Error";
+        log.error("[auth] key lookup failed; treating as unavailable", safe);
+        throw new GatewayError(
+          "accounts_unavailable",
+          503,
+          "The gateway could not verify this API key because its credential store is unavailable. Retry shortly.",
+          {},
+          "cartethyia",
+        );
+      });
       if (!authorization)
         throw new GatewayError("invalid_request", 401, "This API key is unknown, revoked, or expired. Issue a new key and send it as: Authorization: Bearer <key>.");
       const decision = createAccessDecision({

package/src/transport/guards/body-policy.ts

@@ -17,10 +17,11 @@ export function isProxyRequest(request: Request): boolean {
  * This list must mirror the routes `app.ts` actually mounts. It drives
  * body-read policy — a JSON route rejects a missing or non-JSON content-type
  * with 415, while an unrouted path is not read at all — so an entry with no
- * handler behind it describes a route the gateway does not serve. Two such
- * entries (`/v1/embeddings`, `/v1/audio/speech`) sit outside this list: they
- * advertise a surface that 404s, and the route-table test pins them absent so
- * re-adding one is a deliberate act.
+ * handler behind it describes a route the gateway does not serve. Three such
+ * entries (`/v1/embeddings`, `/v1/audio/transcriptions`, `/v1/audio/speech`)
+ * were listed for a while with nothing mounted — they advertised a surface
+ * that 404d — and the route-table test pinned them absent so re-adding one was
+ * a deliberate act. They are mounted now, as passthrough surfaces.
  *
  * The native service routes (`NATIVE_SERVICE_PATHS` — System One, web search,
  * image and video generation) are included: they read a JSON body through the

package/src/transport/request/preparer.ts

@@ -1,7 +1,9 @@
 import { GatewayError } from "../../protocol/gateway-error";
 import type { CanonicalRequest, ServiceKind } from "../../protocol/canonical-model";
+import { toolResultParts } from "../../protocol/canonical-model";
 import type { ApiKeyAdmissionService } from "../../security/admission/service";
 import type { RouteCandidate as RouteCandidate, InMemoryRouteSnapshotService, RoutePlan } from "../routing/route-model";
+import type { RouteContinuationAffinity } from "../routing/route-model";
 import { resolveAliasTarget, type RoutingEngine } from "../routing/router";
 import { projectForRoute, routeCapabilitiesFor } from "../translation/capabilities";
 import type { RequiredCapability } from "../translation/capabilities";
@@ -14,6 +16,7 @@ import { parseThinkingSuffix, withThinkingSuffixIntent } from "../translation/th
 import { nativeServicePathFor } from "../contracts";
 import { log } from "../../observability/logger";
 import { BUDDY_PROVIDER_IDS } from "../../providers/provider-metadata";
+import { cursorRunSessions } from "../../providers/integrations/cursor/cursor-session-manager";
 import {
   degradedRequestVariants,
   degradeEncryptedReasoning,
@@ -32,6 +35,90 @@ function requestNeedsToolRepair(request: CanonicalRequest): boolean {
   return false;
 }
 
+/** Prefix of a provider-continuation tool-call id the gateway itself minted. */
+const CURSOR_CALL_PREFIX = "call_cursor_";
+
+/**
+ * The provider-continuation tool results this request carries.
+ *
+ * Only ids the gateway minted (`call_cursor_<run-id>_<exec-id>`) are considered.
+ * Any other id belongs to a conversation the client owns; it is not a
+ * continuation and must not influence routing.
+ */
+export function continuationCallIds(request: CanonicalRequest): readonly string[] {
+  const ids: string[] = [];
+  for (const message of request.messages) {
+    if (message.role !== "tool" && message.role !== "user") continue;
+    for (const part of toolResultParts(message)) {
+      if (!part.call_id.startsWith(CURSOR_CALL_PREFIX)) continue;
+      if (!ids.includes(part.call_id)) ids.push(part.call_id);
+    }
+  }
+  return ids;
+}
+
+/**
+ * Resolves a request's pending tool results to the one account that owns them.
+ *
+ * Every pending id must resolve to the *same* live Run and the same account.
+ * Ids resolving to different Runs, or to no live Run at all, are refused rather
+ * than partially applied: one result cannot be delivered to another account's
+ * upstream turn, and a request that cannot be satisfied as a whole must not be
+ * dispatched at all.
+ *
+ * Returns `undefined` when the request carries no continuation ids — the
+ * ordinary routing path.
+ */
+export function resolveContinuationAffinity(
+  request: CanonicalRequest,
+  authorization: ResolvedApiKey,
+): RouteContinuationAffinity | undefined {
+  const ids = continuationCallIds(request);
+  if (ids.length === 0) return undefined;
+  const scope = {
+    tenantId: authorization.tenantId,
+    apiKeyId: authorization.id,
+  };
+  let affinity: RouteContinuationAffinity | undefined;
+  for (const callId of ids) {
+    // The registry resolves by tenant + API key + provider + account, so a call
+    // id replayed from another key or tenant resolves nothing.
+    const record = lookupPendingCall(callId, scope);
+    if (record === undefined) {
+      throw new GatewayError(
+        "invalid_request",
+        400,
+        "This tool result refers to a Cursor tool call that is no longer pending. Resend the complete conversation.",
+        { callId },
+      );
+    }
+    if (affinity !== undefined && affinity.providerAccountId !== record.providerAccountId) {
+      throw new GatewayError(
+        "invalid_request",
+        400,
+        "These tool results belong to different Cursor accounts; resend them one account at a time.",
+        { callIds: [...ids] },
+      );
+    }
+    affinity = {
+      providerId: record.providerId,
+      providerAccountId: record.providerAccountId,
+    };
+  }
+  return affinity;
+}
+
+/** Looks up one pending call across every provider that records continuations. */
+function lookupPendingCall(
+  callId: string,
+  scope: { readonly tenantId: string; readonly apiKeyId: string },
+): { readonly providerId: string; readonly providerAccountId: string } | undefined {
+  const record = cursorRunSessions.describePendingCall(callId, scope);
+  return record === undefined
+    ? undefined
+    : { providerId: record.providerId, providerAccountId: record.providerAccountId };
+}
+
 export interface PreparedProxyRequest {
   readonly canonicalRequest: CanonicalRequest;
   readonly authorization: ResolvedApiKey;
@@ -42,6 +129,13 @@ export interface PreparedProxyRequest {
   readonly degradedCapabilities?: readonly RequiredCapability[];
   /** Snapshot-consistent plan used to reserve each individual attempt. */
   readonly plan: RoutePlan;
+  /**
+   * The account this request must reach because a provider session is already
+   * live on it. Set only when the request carried a live tool result; the
+   * dispatch path uses it to borrow the held session instead of acquiring a
+   * second account and pool slot.
+   */
+  readonly continuationAffinity?: RouteContinuationAffinity;
   readonly estimatedInputTokens: number;
   readonly estimatedOutputTokens: number;
   readonly deadlineMs: number;
@@ -150,6 +244,13 @@ export class ProxyRequestPreparer {
     // requires the `image` capability — it plans like the text request it has
     // become, instead of being routed to a vision route for nothing.
     const requestWithAttachments = dropCorruptAttachments(request).request;
+    // Continuation affinity is resolved before anything else: a request
+    // carrying a tool result for a live provider session must be planned against
+    // the one account that owns that session, before capability derivation or
+    // degradation could narrow the candidate set past it. This is also the
+    // point where a mismatched or expired call id becomes a 400 the caller can
+    // act on, instead of a dispatch that silently starts a new upstream turn.
+    const continuationAffinity = resolveContinuationAffinity(request, authorization);
     // Capability-aware routing: derive requirements BEFORE planning so the
     // router filters candidates against snapshot profiles. When nothing
     // supports the full request, degrade (same greedy order) and re-plan
@@ -176,6 +277,7 @@ export class ProxyRequestPreparer {
           variant.required,
           allowCliMappings,
           authorization.cliMappingOwnerId ?? authorization.id,
+          continuationAffinity,
         );
       } catch (error) {
         if (error instanceof GatewayError && error.code === "capability_unsupported") continue;
@@ -303,6 +405,7 @@ export class ProxyRequestPreparer {
       eligibleRouteCandidates: eligible,
       degradedCapabilities: degraded,
       plan,
+      ...(continuationAffinity === undefined ? {} : { continuationAffinity }),
       estimatedInputTokens,
       estimatedOutputTokens,
       deadlineMs: input.deadlineMs,

package/src/transport/request/state.ts

@@ -4,6 +4,7 @@ import type { ClientIdentity } from "../../security/abuse";
 import type { ResolvedApiKey } from "../../security/api-key-auth";
 import type { PreparedProxyRequest } from "./preparer";
 import type { PayloadCaptureState, TelemetryPayloadCapture } from "../../observability/payload-capture";
+import type { TelemetryPayloadDepth, TelemetryPayloadMode } from "../../console/settings/contracts";
 import { createInFlightRegistry, type InFlightSnapshot } from "./inflight";
 import { log } from "../../observability/logger";
 import { fastPathname } from "../pathname";
@@ -103,6 +104,19 @@ export interface ProxyRequestState {
    * hint at it, and they look identical in both cases.
    */
   payloadCaptureState?: PayloadCaptureState;
+  /**
+   * This request's resolved payload-capture preference, memoized on the request.
+   *
+   * The preference is a tenant setting, so it cannot change between attempts of
+   * one request. It was resolved twice — once per attempt to decide whether to
+   * tee the provider body, and again on the terminal attempt to decide what to
+   * store — so a request with several attempts paid for it several times.
+   * Memoized here, the second read is free and the two cannot disagree about
+   * whether capture is on.
+   */
+  payloadCapturePreference?:
+    | { readonly ok: true; readonly mode: TelemetryPayloadMode; readonly depth: TelemetryPayloadDepth }
+    | { readonly ok: false };
   /**
    * Set by the dispatch handler synchronously before returning a streaming
    * response. `afterResponse` lifecycle hooks read it to skip finalization

package/src/transport/routing/plan-gate.ts

@@ -0,0 +1,45 @@
+/**
+ * Whether an account's reported plan is known to be a free one.
+ *
+ * CodeBuddy is the reason this exists. It refuses a set of models on a free
+ * plan with `11158 "model [X] is not allowed for user type [personal_free_user]"`,
+ * and the plan is the only thing that predicts it — the model directory
+ * publishes nothing usable. Routing therefore has to keep those models away
+ * from accounts that are known to be free, and the only per-account signal is
+ * the plan string the quota read reported: `"Free Plan Subscription"`.
+ *
+ * The match is deliberately narrow and the default is deliberately permissive.
+ * Only a plan that names itself free excludes an account. Anything else — a
+ * paid plan name, a provider that reports no plan, a plan string that changed
+ * shape — leaves the account in rotation, because the alternative is worse:
+ * guessing "free" for an unrecognised plan would take a working account out of
+ * rotation on the strength of a string we failed to parse. A wrong free match
+ * costs one refused request that the cooldown machinery already handles; a
+ * wrong paid match silently blackholes a model.
+ */
+const FREE_PLAN_MARKERS: readonly string[] = ["free"];
+
+export function isFreePlanAccount(plan: string | null | undefined): boolean {
+  if (plan === null || plan === undefined) return false;
+  const normalized = plan.trim().toLowerCase();
+  if (normalized.length === 0) return false;
+  return FREE_PLAN_MARKERS.some((marker) => normalized.includes(marker));
+}
+
+/**
+ * Whether this candidate can serve a request, given what is known about the
+ * model's plan gate and the account's plan.
+ *
+ * Returns `true` for every case except the one that is known to fail: a model
+ * the upstream refuses on a free plan, on an account the upstream reports as
+ * free. That pair is a certain refusal, so sending it wastes the request and
+ * advances the account's failure streak toward a six-hour park for something
+ * that is not the account's fault.
+ */
+export function planAllowsCandidate(candidate: {
+  readonly pro_only?: boolean;
+  readonly account_plan?: string | null;
+}): boolean {
+  if (candidate.pro_only !== true) return true;
+  return !isFreePlanAccount(candidate.account_plan);
+}