cartethyia 2.4.6 → 2.5.0

package/src/console/providers/oauth/callback-listener.ts

@@ -25,6 +25,7 @@
  * already spent.
  */
 import { log } from "../../../observability/logger";
+import { ConsoleDomainError } from "../../shared/errors";
 
 /** A loopback endpoint a callback can actually be delivered to. */
 export interface LoopbackCallbackEndpoint {
@@ -224,10 +225,15 @@ export class OAuthCallbackListener {
     try {
       servers.push(this.#serve({ hostname: "127.0.0.1", port: endpoint.port, fetch: handler }));
     } catch (cause) {
-      throw new Error(
+      // A domain error, not a bare Error: the console route maps an untyped
+      // failure to a generic `internal_error`, which hid an actionable "free
+      // the port" message behind "Failed to start OAuth".
+      throw new ConsoleDomainError(
+        "oauth_callback_port_unavailable",
+        409,
         `OAuth callback port ${endpoint.port} is in use, so the login redirect to ${endpoint.path} cannot be delivered. ` +
           `Free port ${endpoint.port} and retry.`,
-        { cause },
+        { port: endpoint.port, path: endpoint.path },
       );
     }
     try {
@@ -253,7 +259,16 @@ export class OAuthCallbackListener {
     }
     const error = url.searchParams.get("error");
     const state = url.searchParams.get("state") ?? "";
-    const code = url.searchParams.get("code") ?? "";
+    /**
+     * Not every authorization server hands back a `code`. Trae's page redirects
+     * with the refresh token already in the query (`?isRedirect=true&
+     * refreshToken=…`), and the client's parser reads the whole query. So an
+     * absent `code` falls back to the query itself — the client decides whether
+     * it can redeem it, and one that cannot still fails with its own message
+     * rather than a bare 400 here.
+     */
+    const codeParam = url.searchParams.get("code") ?? "";
+    const code = codeParam.length > 0 ? codeParam : url.search.slice(1);
     if (error !== null) {
       // A denial carries the state only when the server echoes one; clear it
       // when present so a retry starts a fresh flow.

package/src/console/providers/oauth/routes.ts

@@ -28,14 +28,22 @@ import type { ConsoleAccessResolver } from "../../auth/access";
  * identity the provider itself reports (an email or org name), which is stable
  * across logins, so it is what a re-login replaces.
  *
- * A provider that reports no label falls back to the refresh-token fingerprint,
- * which is the old behaviour and still catches an exact replay. Renaming an
- * account in the console changes the stored label, so a later login is treated
- * as a new account rather than silently overwriting the rename — the same
- * tradeoff the unique index has always had, now stated where it is decided.
+ * A label the provider never resolved is *not* that identity. Callers fill the
+ * gap with the provider id (`cursor`, `github`), and hashing that made every
+ * login of every account of that provider collide: the second login matched the
+ * first row and replaced it, so adding an account silently consumed the one
+ * already there. Only a label the provider actually reported — or the refresh
+ * token, which still catches an exact replay — may be the identity.
+ *
+ * Test seam: exported so the merge rule can be pinned without a database.
  */
-function oauthIdentityFingerprint(input: { readonly label: string } & OAuthExchangeResult): string {
-  return hashSecret(input.label.trim().length > 0 ? input.label.trim() : input.refresh);
+export function oauthIdentityFingerprint(input: {
+  readonly label: string;
+  readonly providerId: string;
+} & OAuthExchangeResult): string {
+  const label = input.label.trim();
+  const resolved = label.length > 0 && label.toLowerCase() !== input.providerId.trim().toLowerCase();
+  return hashSecret(resolved ? label : input.refresh);
 }
 
 export class DrizzleOAuthAccountStore implements OAuthAccountStore {
@@ -46,7 +54,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
     providerId: string,
     input: { readonly label: string } & OAuthExchangeResult,
   ): Promise<PersistedOAuthAccount> {
-    const credentialFingerprint = oauthIdentityFingerprint(input);
+    const credentialFingerprint = oauthIdentityFingerprint({ ...input, providerId });
     const sameAccount = and(
       eq(providerAccounts.providerId, providerId),
       // The identity index coalesces a null tenant to a sentinel, so "same
@@ -375,12 +383,32 @@ export function createOAuthLoginOperations(config: OAuthLoginConfig) {
         }
         const state = generateOAuthState();
         const { codeVerifier, codeChallenge } = generatePkcePair();
+        /**
+         * A client whose authorize URL depends on an upstream discovery runs it
+         * here, before the URL is built: `buildAuthorizeUrl` is synchronous by
+         * contract, so a client cannot fetch inside it.
+         *
+         * Trae is the reason this is wired up: its login host comes from
+         * `GetLoginGuidance`, and without this step the URL was built with no
+         * host and the login failed at the first click. Kiro declares the hook
+         * as a no-op, so nothing that already worked changes.
+         */
+        const authorizeRequest = {
+          state,
+          codeChallenge,
+          redirectUri: client.browserRedirectUri ?? browserAuthorizeRedirectUri(),
+          ...(parameters === undefined ? {} : { parameters }),
+        };
+        const prepared =
+          typeof client.prepareAuthorize === "function"
+            ? await client.prepareAuthorize(authorizeRequest)
+            : authorizeRequest;
         // A client that names its own allowlisted redirect URI wins over the
         // gateway default: OpenAI registers exactly `http://localhost:1455/auth/callback`
         // for the Codex client and answers any other value with
         // `invalid_request` before consent, so the shared default cannot serve
         // every provider.
-        const redirectUri = client.browserRedirectUri ?? browserAuthorizeRedirectUri();
+        const redirectUri = authorizeRequest.redirectUri;
         // Bind the redirect's loopback port before the flow is recorded. The
         // advertised URI names the operator's own machine, so a login that only
         // advertises it leaves the browser on a dead page and the code stranded
@@ -404,12 +432,7 @@ export function createOAuthLoginOperations(config: OAuthLoginConfig) {
         // deliver itself; a non-loopback redirect (a custom scheme, a remote
         // host) returns false and keeps the manual path.
         return {
-          authorizeUrl: client.buildAuthorizeUrl({
-            state,
-            codeChallenge,
-            redirectUri,
-            ...(parameters === undefined ? {} : { parameters }),
-          }),
+          authorizeUrl: client.buildAuthorizeUrl(prepared),
           state,
         };
       },

package/src/console/quota/refresh.ts

@@ -377,6 +377,25 @@ async function runQuotaRefresh(
   // unsupported") is itself the answer the page must render, and caching it
   // stops every page open from re-hitting a provider that just refused us.
   await setCachedQuota(targetLens(target), target.accountId, quota, deps.redis);
+  // Persist the plan the provider reported, because routing gates on it: some
+  // upstreams refuse a model on a free plan and nothing but the account's own
+  // plan says which. The cache above is a short in-process TTL and empty after
+  // a restart, so it cannot be the only copy — the row is what survives one.
+  //
+  // A failed fetch leaves the last known plan in place rather than clearing
+  // it. The refresh failing is evidence about the network or the credential,
+  // not evidence that the account's plan changed, and clearing on failure
+  // would drop the router back to "unknown" on every transient error.
+  if (quota.plan !== null) {
+    try {
+      await deps.db
+        .update(providerAccounts)
+        .set({ quotaPlan: quota.plan })
+        .where(eq(providerAccounts.id, target.accountId));
+    } catch (error) {
+      log.warn(`[quota] failed to record plan for account=${target.accountId}`, error as Error);
+    }
+  }
   // A quota surface that names the account adopts the identity — but only over
   // a default label. An operator's custom rename is never overwritten, and the
   // CASE keeps the read and the write in one statement so a concurrent rename

package/src/console/updates/routes.ts

@@ -1,6 +1,73 @@
 import { Elysia } from "elysia";
-import { consoleErrorHandler } from "../shared/errors";
-import { fetchLatestRelease } from "./repository-updates";
+import { consoleErrorHandler, requireTenantScope } from "../shared/errors";
+import { consoleSseResponse, createConsoleSseStream } from "../observability/sse";
+import type { ObservabilityStore } from "../observability/contracts";
+import type { ConsoleAccessResolver } from "../auth/access";
+import { fetchLatestRelease, type LatestRelease } from "./repository-updates";
+import { isNewerRelease } from "./version-compare";
+
+const MEMORY_SAMPLE_INTERVAL_MS = 10_000;
+const UPDATE_SAMPLE_INTERVAL_MS = 60_000;
+const HIGH_MEMORY_PERCENT = 85;
+const HIGH_MEMORY_CLEAR_PERCENT = 80;
+const MEMORY_GROWTH_WINDOW_MS = 60_000;
+const MEMORY_GROWTH_RATIO = 1.2;
+const MAX_MEMORY_SAMPLES = 8;
+const RELEASES_URL = "https://github.com/risunCodex/Cartethyia/releases";
+
+export interface NotificationEvent {
+  readonly id: string;
+  readonly kind: "memory-high" | "memory-growth" | "update-available";
+  readonly title: string;
+  readonly message: string;
+  readonly createdAt: string;
+  readonly level: "warning" | "info";
+  readonly href?: string;
+}
+
+export function memoryNotifications(
+  samples: readonly { readonly at: number; readonly rss: number; readonly percent: number }[],
+  previous: { high: boolean; growth: boolean },
+): { notifications: NotificationEvent[]; high: boolean; growth: boolean } {
+  const latest = samples.at(-1);
+  if (latest === undefined) return { notifications: [], ...previous };
+  const notifications: NotificationEvent[] = [];
+  const high = previous.high
+    ? latest.percent >= HIGH_MEMORY_CLEAR_PERCENT
+    : latest.percent >= HIGH_MEMORY_PERCENT;
+  if (high && !previous.high) {
+    notifications.push({
+      id: "memory-high",
+      kind: "memory-high",
+      title: "High gateway memory",
+      message: `Gateway RSS is using ${latest.percent.toFixed(1)}% of system memory.`,
+      createdAt: new Date(latest.at).toISOString(),
+      level: "warning",
+    });
+  }
+
+  const oldest = samples.find((sample) => latest.at - sample.at >= MEMORY_GROWTH_WINDOW_MS);
+  const growth = oldest !== undefined &&
+    latest.rss >= oldest.rss * MEMORY_GROWTH_RATIO &&
+    samples.filter((sample) => sample.at >= oldest.at).every((sample, index, window) =>
+      index === 0 || sample.rss >= (window[index - 1]?.rss ?? sample.rss),
+    );
+  if (growth && !previous.growth && !high) {
+    notifications.push({
+      id: "memory-growth",
+      kind: "memory-growth",
+      title: "Sustained memory growth",
+      message: `Gateway RSS grew ${Math.round((latest.rss / oldest.rss - 1) * 100)}% over the last minute.`,
+      createdAt: new Date(latest.at).toISOString(),
+      level: "warning",
+    });
+  }
+  return {
+    notifications,
+    high: high && latest.percent >= HIGH_MEMORY_CLEAR_PERCENT,
+    growth,
+  };
+}
 
 /**
  * Read-only update discovery for the console sidebar.
@@ -10,8 +77,99 @@ import { fetchLatestRelease } from "./repository-updates";
  * answers `null` rather than an error: an absent update badge is the honest
  * result when the upstream cannot be reached.
  */
-export function createUpdateRoutes(): Elysia {
+export function createUpdateRoutes(config: {
+  readonly accessResolver: ConsoleAccessResolver;
+  readonly observabilityStore: ObservabilityStore;
+  readonly fetchRelease?: () => Promise<LatestRelease | null>;
+}): Elysia {
+  const fetchRelease = config.fetchRelease ?? fetchLatestRelease;
   return new Elysia()
     .error(consoleErrorHandler("Update check failed"))
-    .get("/updates/release", async () => await fetchLatestRelease()) as unknown as Elysia;
+    .get("/updates/release", async () => await fetchRelease())
+    .get("/notifications/stream", ({ request }) => {
+      const tenantId = requireTenantScope(
+        config.accessResolver(request),
+        "dashboard:read",
+      ).tenantId;
+      return consoleSseResponse(
+        createConsoleSseStream(request.signal, (sender) => {
+          let closed = false;
+          let memoryTimer: ReturnType<typeof setTimeout> | undefined;
+          let updateTimer: ReturnType<typeof setTimeout> | undefined;
+          let latestTag: string | undefined;
+          let memoryState = { high: false, growth: false };
+          let samples: Array<{ at: number; rss: number; percent: number }> = [];
+
+          const publishMemory = async (): Promise<void> => {
+            if (closed) return;
+            try {
+              const at = Date.now();
+              // Fresh, not `health`: that read is cached for 10 s and this
+              // samples on that exact cadence, so the cached bytes would make
+              // consecutive samples identical and a growth trend unreadable.
+              const live = await config.observabilityStore.liveMemory();
+              samples = [
+                ...samples,
+                { at, rss: live.memory_bytes, percent: live.memory_percent },
+              ].filter((sample) => at - sample.at <= MEMORY_GROWTH_WINDOW_MS * 2)
+                .slice(-MAX_MEMORY_SAMPLES);
+              const computed = memoryNotifications(samples, memoryState);
+              memoryState = { high: computed.high, growth: computed.growth };
+              for (const notification of computed.notifications) sender.send("notification", notification);
+            } catch {
+              // A transient check must not terminate the feed or hide later events.
+            }
+          };
+
+          const publishUpdate = async (): Promise<void> => {
+            if (closed) return;
+            try {
+              const release = await fetchRelease();
+              if (release === null || release.tag_name === latestTag) return;
+              const health = (await config.observabilityStore.health(tenantId)).value;
+              if (!isNewerRelease(health.version, release.tag_name)) return;
+              latestTag = release.tag_name;
+              sender.send("notification", {
+                id: `update-${release.tag_name}`,
+                kind: "update-available",
+                title: "Cartethyia update available",
+                message: `Version ${release.tag_name} is available; this gateway runs ${health.version}.`,
+                createdAt: new Date().toISOString(),
+                level: "info",
+                href: RELEASES_URL,
+              } satisfies NotificationEvent);
+            } catch {
+              // Release discovery is best-effort and cannot interrupt memory sampling.
+            }
+          };
+
+          const scheduleMemory = (): void => {
+            memoryTimer = setTimeout(() => {
+              void publishMemory().finally(() => {
+                if (!closed) scheduleMemory();
+              });
+            }, MEMORY_SAMPLE_INTERVAL_MS);
+          };
+          const scheduleUpdate = (): void => {
+            updateTimer = setTimeout(() => {
+              void publishUpdate().finally(() => {
+                if (!closed) scheduleUpdate();
+              });
+            }, UPDATE_SAMPLE_INTERVAL_MS);
+          };
+
+          void publishMemory().finally(() => {
+            if (!closed) scheduleMemory();
+          });
+          void publishUpdate().finally(() => {
+            if (!closed) scheduleUpdate();
+          });
+          return () => {
+            closed = true;
+            clearTimeout(memoryTimer);
+            clearTimeout(updateTimer);
+          };
+        }),
+      );
+    }) as unknown as Elysia;
 }

package/src/main.ts

@@ -1,3 +1,6 @@
+// Must run before any module that registers a route: it wires Elysia's TypeBox
+// bridge statically, which the source-run path needs under NODE_ENV=production.
+import "./boot/elysia-typebox-bridge";
 import { createGatewayApp, createGatewayShell } from "./boot/app";
 import { bootstrap } from "./boot/lifecycle";
 import type { CartethyiaBoot } from "./boot/lifecycle";

package/src/network/http2-bidi.ts

@@ -0,0 +1,85 @@
+// Transport-neutral bidirectional HTTP/2 egress contract.
+//
+// Cursor's Run is a Connect-RPC bidi stream: one long-lived writable request
+// whose response body is an unbounded stream of protobuf frames. Neither
+// `fetch` nor the WebSocket session contract can express it — `fetch` needs the
+// whole body up front, and a WebSocket is a different protocol — so the egress
+// boundary gets its own contract.
+//
+// This module is transport-neutral on purpose: it declares *what* a validated
+// bidi stream is, and `network/pool/resolver.ts` decides *how* one is dialed
+// (direct TLS to a pinned, SSRF-validated address, or through the selected
+// tenant pool's CONNECT/SOCKS tunnel). A provider adapter consumes the contract
+// and never opens a socket of its own.
+
+/** Response metadata of one opened bidi stream. */
+export interface Http2BidiResponse {
+  /** HTTP/2 `:status`; `0` before the response headers arrive. */
+  readonly status: number;
+  readonly headers: Readonly<Record<string, string>>;
+}
+
+/** Terminal reason a bidi stream ended. */
+export type Http2BidiEndReason =
+  /** The server closed the stream cleanly. */
+  | { readonly kind: "remote-clean-close" }
+  /** The server failed it: an HTTP status, a gRPC trailer, or a transport error. */
+  | { readonly kind: "remote-error"; readonly error: Error }
+  /** The client closed or aborted it. */
+  | { readonly kind: "local-close" };
+
+/**
+ * One validated bidirectional HTTP/2 stream.
+ *
+ * Bytes in are an async iterable (so a provider pumps frames naturally and
+ * backpressure comes from the consumer); bytes out are `write`, which resolves
+ * once the chunk has drained — a bidi Run can carry megabytes, and an
+ * unawaited write is how a stream overruns its session memory and dies with
+ * `ENHANCE_YOUR_CALM`.
+ */
+export interface ValidatedHttp2BidiStream {
+  readonly response: Http2BidiResponse;
+  /** Response trailers, populated when the server sends them (gRPC status). */
+  readonly trailers: Readonly<Record<string, string>>;
+  /** Response body bytes, in arrival order. */
+  readonly body: AsyncIterable<Uint8Array>;
+  /** Writes one request chunk, resolving when it has drained. */
+  write(chunk: Uint8Array): Promise<void>;
+  /** Half-closes the request side; the response may still be streaming. */
+  end(): void;
+  /** Tears the stream down immediately. Idempotent. */
+  abort(reason?: unknown): void;
+  /** Registers a terminal listener; the returned function unregisters it. */
+  onTerminal(listener: (reason: Http2BidiEndReason) => void): () => void;
+}
+
+/** Options for opening one validated bidi stream. */
+export interface Http2BidiOpenOptions {
+  readonly signal?: AbortSignal;
+  /** Bytes read idle before the stream is declared dead. */
+  readonly readIdleMs?: number;
+  /** Upper bound on buffered inbound bytes before the stream is refused. */
+  readonly maxBufferedBytes?: number;
+  /**
+   * Host allowlist applied on every new connection, in addition to the SSRF
+   * policy. A long-lived stream carries the account credential for its whole
+   * life, so "is this host one the caller may reach at all" is a per-provider
+   * decision the binding enforces rather than trusts the adapter to apply.
+   */
+  readonly allowHostname?: (hostname: string) => boolean;
+}
+
+/**
+ * The dialer contract a provider adapter is handed.
+ *
+ * Declared here rather than in the provider layer so the dependency runs one
+ * way: `provider-contracts` imports this module, never the reverse. It used to
+ * be declared there and re-exported from here, which made the two import each
+ * other — type-only, so it never deadlocked, but it meant this
+ * transport-neutral contract had to know about providers.
+ */
+export type ValidatedOutboundHttp2Bidi = (
+  url: URL,
+  headers: Readonly<Record<string, string>>,
+  options?: Http2BidiOpenOptions,
+) => Promise<ValidatedHttp2BidiStream>;

package/src/network/outbound-fetch.ts

@@ -9,7 +9,6 @@ import type { SsrfPolicy } from "../config/network";
 import { isProxyAgentPair, type ProxyAgentPair } from "./pool/agent";
 import { metrics } from "../observability/metrics";
 import { trackNetworkCall } from "../observability/performance-metrics";
-import { bunClientHelloOptions } from "./tls/bun-client-hello";
 import { stripResponseHeaders } from "./response-headers";
 // Validated fetch — single egress with ProxyAgent support
 export interface ValidatedFetchOptions {
@@ -18,14 +17,6 @@ export interface ValidatedFetchOptions {
   readonly maxRedirects?: number;
   readonly resolveFn?: (hostname: string, signal: AbortSignal) => Promise<readonly string[]>;
   readonly agent?: HttpAgent | HttpsAgent | ProxyAgentPair;
-  /**
-   * Handshake with Bun's cipher list, curve list and ALPN instead of
-   * OpenSSL's defaults. Opt-in, and off by default: see
-   * `network/tls/bun-client-hello.ts` — ciphers and curves match exactly, but
-   * the extension list cannot be shaped from Node, so this is a closer hello
-   * rather than an identical one.
-   */
-  readonly bunClientHello?: boolean;
 }
 export type ValidatedFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 
@@ -164,7 +155,6 @@ async function pinnedFetch(
   init: RequestInit,
   resolvedAddress: string | undefined,
   agent?: HttpAgent | HttpsAgent,
-  useBunHello = false,
 ): Promise<Response> {
   const request = url.protocol === "https:" ? httpsRequest : httpRequest;
   const headers = new Headers(init.headers);
@@ -232,15 +222,6 @@ async function pinnedFetch(
         signal: init.signal ?? undefined,
         ...(agent ? { agent } : { agent: directAgent, lookup }),
         ...(url.protocol === "https:" ? { servername: url.hostname } : {}),
-        // Bun's cipher list, curve list, ALPN and version span, when this
-        // request opted into it. See `network/tls/bun-client-hello.ts` for
-        // what this does and does not match: ciphers and curves land exactly;
-        // the extension list cannot be shaped from Node at all.
-        //
-        // Opt-in, and off by default. It changes the TLS handshake of every
-        // request it touches, and no provider needs it until the free-tier
-        // gate is shown to reject the default hello.
-        ...(useBunHello && url.protocol === "https:" ? bunClientHelloOptions() : {}),
       },
       (response) => {
         const responseHeaders = stripResponseHeaders(response.headers);
@@ -345,13 +326,7 @@ export function createValidatedFetch(options: ValidatedFetchOptions = {}): Valid
         response = await options.fetchFn(url, requestInit);
       } else {
         const agent = agentForTarget(configuredAgent, url.protocol);
-        response = await pinnedFetch(
-          url,
-          requestInit,
-          resolvedAddress!,
-          agent,
-          options.bunClientHello === true,
-        );
+        response = await pinnedFetch(url, requestInit, resolvedAddress!, agent);
       }
       if (response.status < 300 || response.status >= 400) {
         trackNetworkCall(url.hostname, performance.now() - startedAt);