cartethyia 2.5.0 → 2.5.2

package/dist/dashboard/precompressed-assets.json

@@ -1,75 +1,73 @@
 {
-  "count": 117,
+  "count": 114,
   "assets": [
-    "assets\\AccountCooldown-ChpdzxRH.js",
-    "assets\\BannedPage-9igfctfZ.js",
-    "assets\\CliToolDetailPage-ZRr2K2sF.js",
-    "assets\\CliToolsPage-D3xqZbN-.js",
-    "assets\\CombosPage-CVnQPBBz.js",
-    "assets\\ConsoleLogPage-u6W1UXSc.js",
-    "assets\\CustomizationPage-CTTpCb25.js",
-    "assets\\HealthEventsModal-C5XpWlvy.js",
-    "assets\\LoginPage-DHoB3Agn.js",
-    "assets\\ModelPicker-oQ-SDXp8.js",
-    "assets\\OverviewPage-BrY4SgIt.js",
-    "assets\\ProviderDetailPage-D9VSt7T_.js",
+    "assets\\AccountCooldown-Bjo92Qat.js",
+    "assets\\BannedPage-MsQaeQTs.js",
+    "assets\\CliToolDetailPage-BO9nKg9w.js",
+    "assets\\CliToolsPage-DfWHTJ7v.js",
+    "assets\\CombosPage-BrCBQDAc.js",
+    "assets\\ConsoleLogPage-C6Uh33er.js",
+    "assets\\CustomizationPage-8aS9hyJu.js",
+    "assets\\HealthEventsModal-qomXThxX.js",
+    "assets\\LoginPage-C8hKyXBe.js",
+    "assets\\ModelPicker-CWkTUtpX.js",
+    "assets\\OverviewPage-C-ExCy1V.js",
+    "assets\\ProviderDetailPage-tr811uaF.js",
     "assets\\ProviderIcon-CmfzxpVM.js",
-    "assets\\ProvidersPage-Df77V5I5.js",
-    "assets\\ProxyPage-CDfxP7AC.js",
-    "assets\\QuotaPage-CY4o2t4p.js",
-    "assets\\SettingsPage-CvjZxHE4.js",
-    "assets\\SetupPage-D3nza7LH.js",
-    "assets\\SortableList-Dtt12WT1.js",
-    "assets\\StudioPage-CbK3hXvU.js",
+    "assets\\ProvidersPage-BS9IEpvv.js",
+    "assets\\ProxyPage-Rn_qXScb.js",
+    "assets\\QuotaPage-BihkgQSq.js",
+    "assets\\SettingsPage-DhiEjm6T.js",
+    "assets\\SetupPage-CXjUlfqr.js",
+    "assets\\SortableList-C-_oD3F2.js",
+    "assets\\StudioPage-u9IxmYOI.js",
     "assets\\ToolIcon-K1ckcDKg.js",
-    "assets\\UsagePage-BQlWbWg2.js",
-    "assets\\api-keys-BmDbsior.js",
-    "assets\\app-BbpSarVV.css",
-    "assets\\app-C-Y4oZT0.js",
+    "assets\\UsagePage-BEVLVrwP.js",
+    "assets\\api-keys-uNywYlfv.js",
+    "assets\\app-CafWtVXA.js",
+    "assets\\app-DxivpfYG.css",
     "assets\\arrow-left-CpBxkoxI.js",
     "assets\\arrow-right-Dl5yKnp8.js",
-    "assets\\assert-BHfaei-X.js",
+    "assets\\assert-NHwYq95t.js",
     "assets\\backup-file-gdKIlg8U.js",
-    "assets\\badge-DpXT4Ixt.js",
-    "assets\\banner-CSAAWLJv.js",
+    "assets\\badge-6uzDDvqs.js",
+    "assets\\banner-4_WNg2WZ.js",
     "assets\\brain-Cwed_72z.js",
-    "assets\\card-DEhRXXw4.js",
-    "assets\\check-D69FzdvC.js",
+    "assets\\card--AtFedAq.js",
     "assets\\chevron-right-BXIy5l3h.js",
     "assets\\circle-alert-CntYHV5v.js",
     "assets\\circle-check-BU3v_mFW.js",
-    "assets\\cli-tools-B0wBq-RL.js",
-    "assets\\clipboard-button-DOo6EU8O.js",
+    "assets\\cli-tools-B3e7dx3N.js",
+    "assets\\clipboard-button-NreUx6c8.js",
     "assets\\cog-CdWhsajs.js",
-    "assets\\copy-ngmQ9zcZ.js",
-    "assets\\dialog-BvQeBMfP.js",
+    "assets\\dialog-BtpsJU98.js",
     "assets\\dialog-actions-B1axpEg7.js",
     "assets\\download-A0SW9OCW.js",
     "assets\\download-dRFo5_Wu.js",
-    "assets\\drawer-CMwPXwQB.js",
-    "assets\\entry-D4O2229X.js",
-    "assets\\entry-DKvr5Q9K.js",
-    "assets\\entry-FQCejoDY.js",
+    "assets\\drawer-WwwtzihF.js",
+    "assets\\entry-Dj9AR0gY.js",
+    "assets\\entry-TJIye_jT.js",
+    "assets\\entry-jy9_4-Ke.js",
     "assets\\eye-C_hawfH4.js",
     "assets\\eye-off-Bk5g2luF.js",
     "assets\\fingerprint-pattern-BWuHtbW4.js",
     "assets\\gauge-BbIMy7MB.js",
-    "assets\\github-badge-zliLvBwr.js",
+    "assets\\github-badge-D_eM3IgG.js",
     "assets\\image-BPaouViG.js",
-    "assets\\index-CXm3FIyt.js",
-    "assets\\inline-D1IlZZ8H.js",
-    "assets\\input-BpVZdrbc.js",
+    "assets\\index-DCBtROoK.js",
+    "assets\\inline-BcNGF8Gr.js",
+    "assets\\input-BG41et9G.js",
     "assets\\jsx-runtime-CXUMngI_.js",
     "assets\\key-round-UkavsGxp.js",
     "assets\\layers-2-glBbjl.js",
-    "assets\\layout-BioLW7gN.js",
-    "assets\\list-row-CwVcGAIc.js",
-    "assets\\live-yfEJFF9T.js",
+    "assets\\layout-C8mer_Ak.js",
+    "assets\\list-row-Gh_W4OR_.js",
+    "assets\\live-BJGYRBnR.js",
     "assets\\log-in-BmRjy60c.js",
     "assets\\message-circle-CCxGwRvv.js",
-    "assets\\model-bans-CT-TxSNX.js",
+    "assets\\model-bans-DeVLDA7I.js",
     "assets\\mutation-BkoLM5Ba.js",
-    "assets\\numbers-CFL4_Dqc.js",
+    "assets\\numbers-Bs4LOOuf.js",
     "assets\\pencil-768ysRAr.js",
     "assets\\plus-DIdX_g-x.js",
     "assets\\power-off-Yjw9GMJh.js",
@@ -96,26 +94,25 @@
     "assets\\refresh-cw-BqJFk4sU.js",
     "assets\\rotate-ccw-CufcqITi.js",
     "assets\\route-CNSNj9Zm.js",
-    "assets\\routing-Cs6jl49L.js",
+    "assets\\routing-CcusqXA7.js",
     "assets\\scaling-nWE4Cx8f.js",
     "assets\\search-JOKus9rb.js",
-    "assets\\select-C0Rer3gF.js",
-    "assets\\settings-CfcTcOyU.js",
+    "assets\\select-DsX5QT8K.js",
+    "assets\\settings-mpmXTgUa.js",
     "assets\\shield-check-DVS0Foqh.js",
     "assets\\sparkles-BRaRUxAU.js",
-    "assets\\stack-C9_uUjaA.js",
-    "assets\\state-DA0B95UQ.js",
+    "assets\\stack-DwLmjUFK.js",
+    "assets\\state-DYdQmdAl.js",
     "assets\\stream-retry-5QnVuSSo.js",
-    "assets\\switch-Cittxy-x.js",
+    "assets\\switch-CidSfbG7.js",
     "assets\\terminal-Bd4ee8TA.js",
-    "assets\\toast-CNt_jzO4.js",
     "assets\\tokens-DDxMbSRL.js",
     "assets\\trash-Cppn5c3R.js",
     "assets\\use-clipboard-B0Sy03fE.js",
     "assets\\use-presence-BSZEBx7U.js",
     "assets\\use-reduced-motion-C4B0R6Sz.js",
     "assets\\use-timeout-BwcBBRrT.js",
-    "assets\\useMutation-BQKMcJ1H.js",
+    "assets\\useMutation-w4u4CVue.js",
     "assets\\wrench-B6E1oEuY.js",
     "index.html"
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",

package/scripts/cli/command/tray.ts

@@ -17,7 +17,29 @@ import { printUpdateInstructions } from "./update";
  * an empty console tab open for the tray's whole lifetime, and that window is
  * owned by Windows Terminal — not by this process, so it cannot be found and
  * hidden from inside.
+ *
+ * The gateway it starts is detached, which is what makes the health poll below
+ * necessary — see {@link TRAY_HEALTH_POLL_MS}.
  */
+
+/**
+ * How often the tray asks whether the gateway is still answering.
+ *
+ * 10 s: often enough that an operator who stops the gateway by hand sees the
+ * icon go away, and far below the cost of a request. A detached gateway can no
+ * longer be waited on, so this poll is the only signal left.
+ */
+const TRAY_HEALTH_POLL_MS = 10_000;
+
+/**
+ * Consecutive misses to forgive before a dead gateway closes the tray.
+ *
+ * One refusal is not a stopped gateway — a probe can lose a race with startup
+ * or a slow request — and closing the icon on one would make startup feel
+ * random.
+ */
+const TRAY_HEALTH_MISSES_BEFORE_CLOSE = 3;
+
 export async function startTray(): Promise<void> {
   const port = resolvePort();
   const drainToken = ensureDrainToken();
@@ -137,7 +159,13 @@ export async function startTray(): Promise<void> {
 
   try {
     await tray.ready();
-    gateway = await startGateway(port, drainToken);
+    // Detached, unlike every other caller: the gateway must outlive this
+    // process. Attached, it dies with the tray — and the tray dies with the
+    // terminal that launched it, so closing that terminal took the gateway
+    // down too and "Hide to tray" left nothing serving. `stopGateway` drains
+    // over HTTP before it ever reaches for `kill()`, so detaching costs the
+    // exit path nothing: the tray can still stop the gateway on Exit.
+    gateway = await startGateway(port, drainToken, { detached: true });
     // The launcher that spawned this tray is blocked on a signal file: it
     // cannot read our stdio, because the tray is detached. Without this write
     // it waits out its 60 s deadline and reports a failure for a tray that is
@@ -146,17 +174,28 @@ export async function startTray(): Promise<void> {
     console.log(`Cartethyia is running at ${dashboardUrl}`);
     void refreshVersion();
 
+    let misses = 0;
+    // A detached child's `exited` never settles on Windows, so the old
+    // `await current.exited` would have parked here forever and the tray would
+    // never notice the gateway going away. Poll its health endpoint instead:
+    // that answers for a process we no longer own, which is the whole point of
+    // detaching it. The probe is the same one startup used, so a gateway that
+    // is up reads as up regardless of who spawned it.
     while (!closing) {
-      const current: Bun.Subprocess | null = gateway;
-      if (!current) {
-        await Bun.sleep(100);
+      await Bun.sleep(TRAY_HEALTH_POLL_MS);
+      if (closing || gateway === null) continue;
+      const alive = await fetch(`http://127.0.0.1:${port}/health`, {
+        signal: AbortSignal.timeout(2_000),
+      }).then((response) => response.ok).catch(() => false);
+      if (alive) {
+        misses = 0;
         continue;
       }
-      const code = await current.exited;
-      if (gateway !== current || closing) continue;
+      misses += 1;
+      if (misses < TRAY_HEALTH_MISSES_BEFORE_CLOSE) continue;
       gateway = null;
-      console.error(`Cartethyia exited with code ${code}.`);
-      await close(code ?? 1);
+      console.error("Cartethyia stopped answering; the tray is closing.");
+      await close(1);
     }
   } catch (error) {
     await close(1);

package/src/boot/app.ts

@@ -15,6 +15,7 @@ import { GatewayError, publicGatewayErrorBody } from "../protocol/gateway-error"
 import { shutdownError, shutdownNotice } from "../transport/shutdown-notice";
 import type { CanonicalAdapter } from "../transport/contracts";
 import type { ApiKeyAuthorizationSnapshot } from "../security/api-key-auth";
+import { unknownApiKeyError } from "../security/api-key-auth";
 import { getDbHandle } from "../persistence/boot";
 import { isPgHandle } from "../persistence/db-pg";
 import { resolveRedisClient } from "../persistence/redis";
@@ -408,7 +409,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     const handleModelsList = async ({ request }: { request: Request }): Promise<Response> => {
       const state = requestStateStore.require(request);
       const auth = state.authorization;
-      if (!auth) throw new GatewayError("invalid_request", 401, "This API key is unknown, revoked, or expired. Issue a new key and send it as: Authorization: Bearer <key>.");
+      if (!auth) throw unknownApiKeyError();
       const data = await queryAllowedModels(auth);
       return new Response(JSON.stringify({ object: "list", data }), {
         headers: {
@@ -431,7 +432,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     }): Promise<Response> => {
       const state = requestStateStore.require(request);
       const auth = state.authorization;
-      if (!auth) throw new GatewayError("invalid_request", 401, "This API key is unknown, revoked, or expired. Issue a new key and send it as: Authorization: Bearer <key>.");
+      if (!auth) throw unknownApiKeyError();
       const raw = params?.["*"] ?? params?.id ?? "";
       const targetId = new URL(request.url).searchParams.get("id") ?? raw;
       const found = await publicModelStore.getPublicModelDetail(

package/src/console/observability/contracts.ts

@@ -45,7 +45,17 @@ export interface SystemHealthResponse {
    * gateway itself grew.
    */
   database_in_process: boolean;
-  cpu_percent: number;
+  /**
+   * `null` when the platform does not report it — there is no `loadavg` on
+   * Windows and Node hands back a zeroed tuple rather than failing, so on
+   * Windows this is always `null` rather than a confident-looking `0`.
+   *
+   * Nullable rather than `NaN`: `NaN` is not a JSON value and serializes to
+   * `null` anyway, which means a client validating the field as a number
+   * rejects the *whole* health payload. One unavailable metric then reads as
+   * every metric being unavailable.
+   */
+  cpu_percent: number | null;
   cpu_cores: number;
   pid: number;
   platform: string;

package/src/console/observability/store.ts

@@ -330,12 +330,15 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     // syscall and Node reports a zeroed tuple rather than failing. Divided by
     // cores that is a confident-looking 0.0% on a busy gateway, which is worse
     // than saying nothing: an operator reads it as "idle" and stops looking.
-    // Reported as unavailable instead of as a measurement.
-    const load = loadavg()[0] ?? 0;
-    const cpuPercent =
-      process.platform === "win32" || load === 0
-        ? Number.NaN
-        : Math.round((load / Math.max(cpus().length, 1)) * 10000) / 100;
+    // Reported as null instead of as a measurement.
+    //
+    // A real zero load is *not* the same thing and is reported as zero: an
+    // idle machine genuinely has nothing queued, and collapsing that into
+    // "unavailable" would hide a number the platform did supply.
+    const cpuPercent: number | null =
+      process.platform === "win32"
+        ? null
+        : Math.round(((loadavg()[0] ?? 0) / Math.max(cpus().length, 1)) * 10000) / 100;
 
     let databaseHealthy = true;
     let total = 0;

package/src/providers/discovery/openrouter-free-roster.ts

@@ -2,7 +2,7 @@
  * The free tier shared by the OpenRouter-backed providers.
  *
  * Cline, Kilo Code and OpenRouter serve one model catalog: the same 469 ids,
- * and the same 17 of them carrying a `:free` suffix. Verified against all three
+ * and the same 9 of them carrying a `:free` suffix. Verified against all three
  * live listings — every id below is present under `openrouter`, `kilo` and
  * `cline` — so this roster is a catalog fact, not a per-provider guess, and it
  * lives in one place rather than being restated three times.
@@ -37,10 +37,10 @@ interface FreeRow {
 }
 
 /**
- * The 17 `:free` ids, with the limits the catalog states for each.
+ * The 9 `:free` ids, with the limits the catalog states for each.
  *
  * Every row declares `reasoning`: `supported_parameters` lists it on all
- * seventeen. `toolCall` is `true` unless stated otherwise, because a row that
+ * nine. `toolCall` is `true` unless stated otherwise, because a row that
  * advertises tools must keep them — a false `toolCall` makes the preflight
  * strip `tools` from the request, which is a wrong capability rather than a
  * conservative one.
@@ -48,8 +48,6 @@ interface FreeRow {
 const FREE_ROWS: readonly FreeRow[] = [
   { id: "cohere/north-mini-code:free", ctx: 256_000, out: 64_000 },
   { id: "dots-studio/dots-3-note-preview:free", ctx: 512_000, out: 460_800, vision: true },
-  { id: "google/gemma-4-26b-a4b-it:free", ctx: 262_144, out: 32_768, vision: true },
-  { id: "google/gemma-4-31b-it:free", ctx: 262_144, out: 32_768, vision: true },
   { id: "liquid/lfm-2.5-2.6b:free", ctx: 65_536, out: 8_192 },
   { id: "minimax/minimax-m3.1-flash:free", ctx: 1_000_000, out: 524_288, vision: true },
   {
@@ -58,7 +56,6 @@ const FREE_ROWS: readonly FreeRow[] = [
     out: 65_536,
     vision: true,
   },
-  { id: "nvidia/nemotron-3-super-120b-a12b:free", ctx: 262_144, out: 235_929 },
   { id: "nvidia/nemotron-3-ultra-550b-a55b:free", ctx: 1_000_000, out: 65_536 },
   {
     id: "nvidia/nemotron-3.5-content-safety:free",
@@ -69,11 +66,6 @@ const FREE_ROWS: readonly FreeRow[] = [
   },
   { id: "nvidia/nemotron-3.5-lightning:free", ctx: 1_000_000, out: 65_536 },
   { id: "nvidia/nemotron-3.5-super-vl:free", ctx: 1_000_000, out: 131_072, vision: true },
-  { id: "poolside/laguna-s-2.1:free", ctx: 262_144, out: 32_768 },
-  { id: "poolside/laguna-xs-2.1:free", ctx: 262_144, out: 32_768 },
-  { id: "thinkingmachines/inkling-small:free", ctx: 1_048_576, out: 262_144, vision: true },
-  { id: "thinkingmachines/inkling:free", ctx: 1_048_576, out: 262_144, vision: true },
-  { id: "xingchen-agi/xing4.0-29b-a4b:free", ctx: 262_144, out: 235_929 },
 ];
 
 /** Builds this roster for one provider, since each spells its own endpoint. */

package/src/providers/discovery/probe-phases.ts

@@ -37,6 +37,7 @@ import { resolveByokWireProfile } from "../operations/byok-wire-profile";
 import { recordAccountFailure, recordAccountSuccess } from "../operations/account-health-service";
 import { buildCapabilityProfile } from "../../transport/routing/route-catalog";
 import { classifyUpstreamFailure } from "../../transport/failure-policy";
+import { terminalFailure } from "../../transport/dispatch/attempt-finalize";
 import { GatewayError } from "../../protocol/gateway-error";
 import type { ModelDefinition } from "../provider-model-definition";
 import type { ProviderAdapter, ProviderId } from "../provider-contracts";
@@ -579,13 +580,33 @@ export async function recordProbeHealth(args: {
   readonly invalidator: { invalidate(): unknown } | undefined;
   readonly accountId: string | undefined;
   readonly dispatchError: unknown;
+  /**
+   * The probe's canonical events, when there are any.
+   *
+   * Needed because some adapters deliver a refusal as a terminal event rather
+   * than as a thrown error — Cursor's `resource_exhausted` is the case — so
+   * `dispatchError` stays `undefined` for a Run the upstream refused. Without
+   * the events, that account looked like a success and was recovered.
+   */
+  readonly events?: readonly CanonicalEvent[] | undefined;
   readonly modelId: string;
   readonly upstreamStatusCode: number | undefined;
 }): Promise<void> {
   const { db, invalidator, accountId, dispatchError, modelId, upstreamStatusCode } = args;
-  if (dispatchError !== undefined && accountId) {
+  // A terminal `failed` state is written only by the upstream decoders, so it
+  // is the upstream refusing — the same thing a thrown error would have meant.
+  const terminal = args.events?.find((event) => event.type === "terminal");
+  // Reconstructed through the very function the live dispatch path uses, so a
+  // refusal carries the same code, status, and health classification in both.
+  // Hand-rolling a category here is how the two paths drifted apart.
+  const refusedUpstream =
+    terminal?.type === "terminal" && terminal.state === "failed"
+      ? terminalFailure(terminal)
+      : undefined;
+  const failure = dispatchError ?? refusedUpstream;
+  if (failure !== undefined && accountId) {
     const failureEvidence = {
-      ...classifyUpstreamFailure(dispatchError),
+      ...classifyUpstreamFailure(failure),
       modelId,
       ...(upstreamStatusCode === undefined ? {} : { statusCode: upstreamStatusCode }),
     };
@@ -593,7 +614,7 @@ export async function recordProbeHealth(args: {
     // already classified as `rate_limit_transient` with a real cooldown by
     // `classifyAccountError`, so writing a status here only clobbered that
     // cooldown with a state nothing recovers from.
-    await recordAccountFailure(db, accountId, dispatchError, failureEvidence)
+    await recordAccountFailure(db, accountId, failure, failureEvidence)
       .then((classification) => {
         if (classification?.mutatesAccount) void invalidator?.invalidate();
       })
@@ -603,7 +624,7 @@ export async function recordProbeHealth(args: {
   // (a cooling account flips back to active instead of staying stale).
   // recordAccountSuccess is a no-op write for already-healthy accounts and
   // never throws.
-  if (dispatchError === undefined && accountId) {
+  if (failure === undefined && accountId) {
     await recordAccountSuccess(db, accountId)
       .then((recovered) => {
         if (recovered) void invalidator?.invalidate();
@@ -703,7 +724,23 @@ export function computeProbeVerdict(args: {
     errorMessage = `${wireFamily} — ${tagged}${upstreamReq ? ` [req ${upstreamReq}]` : ""}`;
 
   } else if (terminal?.type === "terminal" && terminal.state !== "complete") {
-    errorMessage = terminal.stop_reason ?? "Model probe failed";
+    // Read the terminal's own detail before falling back to the stop reason.
+    //
+    // `stop_reason` is a canonical one-word label — "error" — so reporting it
+    // alone turned a Cursor quota refusal into a toast whose entire body was
+    // the word "error". The upstream sentence an operator needs is in
+    // `stop_details`, which is where the adapter parks it and where the live
+    // dispatch path already reads it (see `terminalFailure` in
+    // `attempt-finalize.ts`). The probe path disagreed with the dispatch path
+    // about the same provider response.
+    const detail = terminal.stop_details;
+    const message =
+      typeof detail?.["message"] === "string" && detail["message"].trim().length > 0
+        ? detail["message"].trim()
+        : undefined;
+    const code = typeof detail?.["code"] === "string" ? detail["code"] : undefined;
+    const tag = code === undefined ? "" : ` (${code})`;
+    errorMessage = `${message ?? terminal.stop_reason ?? "Model probe failed"}${tag}`;
   } else {
     errorMessage = undefined;
   }

package/src/providers/discovery/probing-service.ts

@@ -274,7 +274,13 @@ export class ProviderProbingService {
       // The same wrapper a real dispatch uses, so the probe reads the model the
       // upstream named from the raw bytes rather than from a synthesized event.
       const probeFetch = createProbeFetch(
-        captureProviderExchange(outbound.fetch, probeCapture, false),
+        // Body capture on, unlike a live dispatch: a probe is one-shot and
+        // operator-initiated, so it exists to be inspected. With it off, the
+        // provider-response tee resolved to null and every probe row reported
+        // the middle two stages as absent — a constant, not a measurement,
+        // which made the stage markers useless for the diagnosis they exist
+        // for. The 256 KiB cap in the tee bounds the cost.
+        captureProviderExchange(outbound.fetch, probeCapture, true),
       );
       try {
         if (serviceKind === "websearch") {
@@ -435,6 +441,11 @@ export class ProviderProbingService {
       invalidator: this.snapshotInvalidator,
       accountId,
       dispatchError,
+      // Passed so a refusal delivered as a terminal event — not as a thrown
+      // error — still reaches the health machine. Without it, Cursor's
+      // `resource_exhausted` left `dispatchError` undefined and the probe
+      // recovered an exhausted account.
+      ...(events === undefined ? {} : { events }),
       modelId,
       upstreamStatusCode,
     });
@@ -496,12 +507,24 @@ export class ProviderProbingService {
       ...(tokensPerSec !== undefined ? { tokensPerSec } : {}),
     });
     if (this.telemetryBuffer && payloadCaptureEnabled) {
+      // All four surfaces, so the row's stage markers mean the same thing here
+      // as they do on a live request: which hop actually produced bytes.
+      const providerRequest = probeCapture?.request ?? null;
+      const providerResponse = await probeCapture?.response.catch(() => null) ?? null;
       await this.payloadCapture
         .capture({
           tenantId,
           requestId,
           requestBody: capturedRequest,
-          responseBody: events,
+          // `events` is what the *client* receives, so it belongs in the client
+          // surface. Passing it as `responseBody` lit the client bit on probes
+          // whose event list was empty, over a body that was never captured.
+          // The legacy alias is explicitly absent here; `null` leaves bit 8 to
+          // be decided by the real client body alone.
+          responseBody: null,
+          ...(events === undefined ? {} : { clientResponseBody: events }),
+          ...(providerRequest === null ? {} : { providerRequestBody: providerRequest }),
+          ...(providerResponse === null ? {} : { providerResponseBody: providerResponse }),
           scope: "tenant",
           tenantOptIn: true,
         })

package/src/providers/integrations/claude/claude.ts

@@ -96,7 +96,9 @@ export const CLAUDE_MODELS: readonly ModelDefinition[] = [
   claudeMessagesModel("claude-sonnet-5", 1_000_000, 128_000, true),
   claudeMessagesModel("claude-sonnet-4-6", 1_000_000, 128_000, true),
   claudeMessagesModel("claude-opus-4-5", 200_000, 64_000, true),
-  claudeMessagesModel("claude-sonnet-4-5", 1_000_000, 64_000, true),
+  // 200K: the 4.5 trio predates the million-token window, which arrived with
+  // Opus 4.6. Only this row claimed 1M while its own siblings said 200K.
+  claudeMessagesModel("claude-sonnet-4-5", 200_000, 64_000, true),
   claudeMessagesModel("claude-haiku-4-5", 200_000, 64_000, true),
 ];
 

package/src/providers/integrations/cloudflareai/cloudflareai-models.ts

@@ -59,7 +59,9 @@ export const CLOUDFLAREAI_MODELS: readonly ModelDefinition[] = [
   ["claude-opus-4.7", 1_000_000, 128_000] as const,
   ["claude-opus-4.8", 1_000_000, 128_000] as const,
   ["claude-opus-5", 1_000_000, 128_000] as const,
-  ["claude-sonnet-4.5", 1_000_000, 64_000] as const,
+  // 200K, matching the other two 4.5 rows: the million-token window starts at
+  // Opus 4.6, so the 4.5 trio is 200K across the board.
+  ["claude-sonnet-4.5", 200_000, 64_000] as const,
   ["claude-sonnet-4.6", 1_000_000, 128_000] as const,
   ["claude-sonnet-5", 1_000_000, 128_000] as const,
 ].map(cloudflareaiModel);

package/src/providers/integrations/inferhub.ts

@@ -124,7 +124,9 @@ const INFERHUB_MODELS_RAW: readonly {
   { id: "cc/claude-opus-4-8", contextLimit: 1000000, outputLimit: 128000 },
   { id: "cc/claude-opus-5", contextLimit: 1000000, outputLimit: 128000 },
   { id: "cc/claude-sonnet-4-5", contextLimit: 200000, outputLimit: 64000 },
-  { id: "cc/claude-sonnet-4-6", contextLimit: 1000000, outputLimit: 64000 },
+  // 128K: Sonnet 4.6 is in the 1M/128K generation, the same as the Opus 4.6
+  // row directly above it and every other 4.6+ row here.
+  { id: "cc/claude-sonnet-4-6", contextLimit: 1000000, outputLimit: 128000 },
   { id: "cc/claude-sonnet-5", contextLimit: 1000000, outputLimit: 128000 },
   // cb/ — CodeBuddy (12 models)
   { id: "cb/claude-opus-4.6", contextLimit: 1000000, outputLimit: 128000 },

package/src/providers/integrations/kilo/kilo.ts

@@ -87,7 +87,6 @@ export const KILO_MODELS: readonly ModelDefinition[] = [
   // window the router may select into rather than one model's.
   kiloModel("kilo-auto/free", 256_000, 32_768, { reasoning: true }),
   kiloModel("kilo-auto/small", 262_144, 32_768, { vision: true, reasoning: true }),
-  kiloModel("openrouter/auto", 2_000_000, 128_000, { reasoning: true }),
 ];
 
 /**

package/src/providers/integrations/kiro/kiro-catalog.ts

@@ -71,9 +71,15 @@ export const KIRO_MODELS: readonly ModelDefinition[] = [
   kiroModel({ id: "claude-opus-4.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "claude-sonnet-5", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "claude-sonnet-5.5", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, toolCall: true }),
-  kiroModel({ id: "claude-sonnet-4.5", ctx: 1_000_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
+  // 200K, not the 1M the 1M-window models use: Sonnet 4.5 predates it. The
+  // million-token window arrived with Opus 4.6 and the 5.x generation; the 4.5
+  // trio is 200K, and Opus and Haiku here already say so.
+  kiroModel({ id: "claude-sonnet-4.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "claude-haiku-4.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
-  kiroModel({ id: "claude-haiku-5.5", ctx: 200_000, out: 64_000, vision: true, reasoning: true, toolCall: true }),
+  // 1M/128K, not the 200K/64K of the 4.5 row above it: Haiku moved to the
+  // million-token window and the doubled output ceiling with the rest of the
+  // 5.x generation, and this line had been copied from its predecessor.
+  kiroModel({ id: "claude-haiku-5.5", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, toolCall: true }),
   kiroModel({ id: "gpt-5.5", ctx: 272_000, out: 128_000, reasoning: true, toolCall: true }),
   kiroModel({ id: "gpt-5.6-sol", ctx: 272_000, out: 128_000, reasoning: true, toolCall: true }),
   kiroModel({ id: "gpt-5.6-terra", ctx: 272_000, out: 128_000, reasoning: true, toolCall: true }),

package/src/providers/integrations/openrouter/provider.ts

@@ -24,21 +24,11 @@ const OPENROUTER_REQUIRED_HEADERS: Readonly<Record<string, string>> = {
  * served by the native System One route, never by the chat surface.
  */
 export const OPENROUTER_MODELS: readonly ModelDefinition[] = [
-  // The router, and only the router. A hand-kept catalog of specific ids was a
-  // snapshot of one afternoon: OpenRouter adds and pulls models within days, so
-  // every committed row outside this one drifts out of truth. Discovery is the
-  // authority, and the free roster below is the offline floor.
-  defineModel({
-    id: "openrouter/auto",
-    providerId: OPENROUTER_PROVIDER_ID,
-    wireFamily: "chat",
-    endpoint: "/chat/completions",
-    // The catalog publishes no limits for a router (pricing is -1, meaning
-    // "decided at dispatch"), so this is the largest window it may select into.
-    ctx: 2_000_000,
-    out: 128_000,
-    reasoning: true,
-  }),
+  // No committed chat rows. OpenRouter adds and pulls models within days, so a
+  // hand-kept list of ids drifts out of truth and discovery is the authority;
+  // the free roster below stays as the offline floor. `openrouter/auto` was the
+  // last committed chat row and went with the rest of the static catalog — it
+  // publishes no limits of its own anyway, since a router's pricing is -1.
   // Not a chat row: it answers `{answers}` to a `{state, questions}` body, and
   // is served by the native System One route. Kept because deleting it removes
   // that route, which is a capability, not a stale catalog entry.

package/src/security/api-key-auth.ts

@@ -305,6 +305,29 @@ export interface ResolvedApiKey {
   /** Share-template id whose remote CLI mappings are inherited by this child. */
   readonly cliMappingOwnerId?: string;
 }
+
+/**
+ * The 401 a caller gets when a key resolves to nothing.
+ *
+ * One function, not a message repeated at each boundary: three surfaces refuse
+ * an unknown key, and any wording drift between them is a caller guessing which
+ * surface it hit. Unknown, revoked and expired stay deliberately
+ * indistinguishable — distinguishing them would let a caller confirm that a
+ * guessed token once existed — so there is no variant carrying a reason.
+ *
+ * The rotate instruction is unconditional for the same reason. The key that
+ * fails is usually the one seeded at first boot, which cannot be deleted and
+ * only rotates, and an operator hitting this on a personal key loses nothing by
+ * being told the same thing.
+ */
+export function unknownApiKeyError(): GatewayError {
+  return new GatewayError(
+    "authentication_failed",
+    401,
+    "Invalid API key. Rotate the default Cartethyia API key in API Keys and send the new key as: Authorization: Bearer <key>.",
+  );
+}
+
 /** Extracts exactly one supported credential source, preserving public auth statuses. */
 export function requestToken(headers: Headers | Record<string, string>): string {
   const get = (name: string): string | null =>