cartethyia 2.5.1 → 2.5.3

package/src/persistence/stores/telemetry-store.ts

@@ -44,7 +44,7 @@ function addUsageDelta(
   }
   delta.requests += 1;
   // Same definition as every read-side error count, including the HTTP-status
-  // exclusions (404/499/503): this rollup is durable, so a request counted here
+  // exclusions (404/499/503/504): this rollup is durable, so a request counted here
   // stays counted after its raw row is pruned and cannot be corrected later.
   if (isGatewayError(row.status, row.httpStatus)) delta.errors += 1;
   delta.inputTokens += row.inputTokens ?? 0;

package/src/protocol/response/gemini.ts

@@ -63,11 +63,25 @@ export function responseParts(parts: readonly Record<string, unknown>[]): {
 
 export function mapGeminiUsage(body: Record<string, unknown>): Record<string, unknown> {
   const usage = isRecord(body["usageMetadata"]) ? (body["usageMetadata"] as Record<string, unknown>) : {};
+  const prompt = nullableNumber(usage["promptTokenCount"]) ?? 0;
+  const candidates = nullableNumber(usage["candidatesTokenCount"]) ?? 0;
+  // Reasoning is billed output that Gemini reports in its own counter:
+  // `candidatesTokenCount` excludes `thoughtsTokenCount`, so dropping it here
+  // silently under-reported every thinking model's completion tokens. It is
+  // surfaced through `output_tokens_details` because that is the slot
+  // `normalizeUsage` reads for reasoning — keeping it separate from the
+  // candidate count it is added into, so downstream can still split them.
+  const thoughts = nullableNumber(usage["thoughtsTokenCount"]) ?? 0;
+  const output = candidates + thoughts;
+  const cached = nullableNumber(usage["cachedContentTokenCount"]) ?? 0;
   return {
-    input_tokens: nullableNumber(usage["promptTokenCount"]) ?? 0,
-    output_tokens: nullableNumber(usage["candidatesTokenCount"]) ?? 0,
-    total_tokens: nullableNumber(usage["totalTokenCount"]) ?? 0,
-    cached_tokens: nullableNumber(usage["cachedContentTokenCount"]) ?? 0,
+    input_tokens: prompt,
+    output_tokens: output,
+    total_tokens: nullableNumber(usage["totalTokenCount"]) ?? prompt + output,
+    cached_tokens: cached,
+    ...(thoughts > 0
+      ? { output_tokens_details: { reasoning_tokens: thoughts } }
+      : {}),
   };
 }
 

package/src/providers/discovery/openrouter-free-roster.ts

@@ -2,7 +2,7 @@
  * The free tier shared by the OpenRouter-backed providers.
  *
  * Cline, Kilo Code and OpenRouter serve one model catalog: the same 469 ids,
- * and the same 17 of them carrying a `:free` suffix. Verified against all three
+ * and the same 9 of them carrying a `:free` suffix. Verified against all three
  * live listings — every id below is present under `openrouter`, `kilo` and
  * `cline` — so this roster is a catalog fact, not a per-provider guess, and it
  * lives in one place rather than being restated three times.
@@ -37,10 +37,10 @@ interface FreeRow {
 }
 
 /**
- * The 17 `:free` ids, with the limits the catalog states for each.
+ * The 9 `:free` ids, with the limits the catalog states for each.
  *
  * Every row declares `reasoning`: `supported_parameters` lists it on all
- * seventeen. `toolCall` is `true` unless stated otherwise, because a row that
+ * nine. `toolCall` is `true` unless stated otherwise, because a row that
  * advertises tools must keep them — a false `toolCall` makes the preflight
  * strip `tools` from the request, which is a wrong capability rather than a
  * conservative one.
@@ -48,8 +48,6 @@ interface FreeRow {
 const FREE_ROWS: readonly FreeRow[] = [
   { id: "cohere/north-mini-code:free", ctx: 256_000, out: 64_000 },
   { id: "dots-studio/dots-3-note-preview:free", ctx: 512_000, out: 460_800, vision: true },
-  { id: "google/gemma-4-26b-a4b-it:free", ctx: 262_144, out: 32_768, vision: true },
-  { id: "google/gemma-4-31b-it:free", ctx: 262_144, out: 32_768, vision: true },
   { id: "liquid/lfm-2.5-2.6b:free", ctx: 65_536, out: 8_192 },
   { id: "minimax/minimax-m3.1-flash:free", ctx: 1_000_000, out: 524_288, vision: true },
   {
@@ -58,7 +56,6 @@ const FREE_ROWS: readonly FreeRow[] = [
     out: 65_536,
     vision: true,
   },
-  { id: "nvidia/nemotron-3-super-120b-a12b:free", ctx: 262_144, out: 235_929 },
   { id: "nvidia/nemotron-3-ultra-550b-a55b:free", ctx: 1_000_000, out: 65_536 },
   {
     id: "nvidia/nemotron-3.5-content-safety:free",
@@ -69,11 +66,6 @@ const FREE_ROWS: readonly FreeRow[] = [
   },
   { id: "nvidia/nemotron-3.5-lightning:free", ctx: 1_000_000, out: 65_536 },
   { id: "nvidia/nemotron-3.5-super-vl:free", ctx: 1_000_000, out: 131_072, vision: true },
-  { id: "poolside/laguna-s-2.1:free", ctx: 262_144, out: 32_768 },
-  { id: "poolside/laguna-xs-2.1:free", ctx: 262_144, out: 32_768 },
-  { id: "thinkingmachines/inkling-small:free", ctx: 1_048_576, out: 262_144, vision: true },
-  { id: "thinkingmachines/inkling:free", ctx: 1_048_576, out: 262_144, vision: true },
-  { id: "xingchen-agi/xing4.0-29b-a4b:free", ctx: 262_144, out: 235_929 },
 ];
 
 /** Builds this roster for one provider, since each spells its own endpoint. */

package/src/providers/discovery/probe-phases.ts

@@ -37,6 +37,7 @@ import { resolveByokWireProfile } from "../operations/byok-wire-profile";
 import { recordAccountFailure, recordAccountSuccess } from "../operations/account-health-service";
 import { buildCapabilityProfile } from "../../transport/routing/route-catalog";
 import { classifyUpstreamFailure } from "../../transport/failure-policy";
+import { terminalFailure } from "../../transport/dispatch/attempt-finalize";
 import { GatewayError } from "../../protocol/gateway-error";
 import type { ModelDefinition } from "../provider-model-definition";
 import type { ProviderAdapter, ProviderId } from "../provider-contracts";
@@ -579,13 +580,33 @@ export async function recordProbeHealth(args: {
   readonly invalidator: { invalidate(): unknown } | undefined;
   readonly accountId: string | undefined;
   readonly dispatchError: unknown;
+  /**
+   * The probe's canonical events, when there are any.
+   *
+   * Needed because some adapters deliver a refusal as a terminal event rather
+   * than as a thrown error — Cursor's `resource_exhausted` is the case — so
+   * `dispatchError` stays `undefined` for a Run the upstream refused. Without
+   * the events, that account looked like a success and was recovered.
+   */
+  readonly events?: readonly CanonicalEvent[] | undefined;
   readonly modelId: string;
   readonly upstreamStatusCode: number | undefined;
 }): Promise<void> {
   const { db, invalidator, accountId, dispatchError, modelId, upstreamStatusCode } = args;
-  if (dispatchError !== undefined && accountId) {
+  // A terminal `failed` state is written only by the upstream decoders, so it
+  // is the upstream refusing — the same thing a thrown error would have meant.
+  const terminal = args.events?.find((event) => event.type === "terminal");
+  // Reconstructed through the very function the live dispatch path uses, so a
+  // refusal carries the same code, status, and health classification in both.
+  // Hand-rolling a category here is how the two paths drifted apart.
+  const refusedUpstream =
+    terminal?.type === "terminal" && terminal.state === "failed"
+      ? terminalFailure(terminal)
+      : undefined;
+  const failure = dispatchError ?? refusedUpstream;
+  if (failure !== undefined && accountId) {
     const failureEvidence = {
-      ...classifyUpstreamFailure(dispatchError),
+      ...classifyUpstreamFailure(failure),
       modelId,
       ...(upstreamStatusCode === undefined ? {} : { statusCode: upstreamStatusCode }),
     };
@@ -593,7 +614,7 @@ export async function recordProbeHealth(args: {
     // already classified as `rate_limit_transient` with a real cooldown by
     // `classifyAccountError`, so writing a status here only clobbered that
     // cooldown with a state nothing recovers from.
-    await recordAccountFailure(db, accountId, dispatchError, failureEvidence)
+    await recordAccountFailure(db, accountId, failure, failureEvidence)
       .then((classification) => {
         if (classification?.mutatesAccount) void invalidator?.invalidate();
       })
@@ -603,7 +624,7 @@ export async function recordProbeHealth(args: {
   // (a cooling account flips back to active instead of staying stale).
   // recordAccountSuccess is a no-op write for already-healthy accounts and
   // never throws.
-  if (dispatchError === undefined && accountId) {
+  if (failure === undefined && accountId) {
     await recordAccountSuccess(db, accountId)
       .then((recovered) => {
         if (recovered) void invalidator?.invalidate();
@@ -703,7 +724,23 @@ export function computeProbeVerdict(args: {
     errorMessage = `${wireFamily} — ${tagged}${upstreamReq ? ` [req ${upstreamReq}]` : ""}`;
 
   } else if (terminal?.type === "terminal" && terminal.state !== "complete") {
-    errorMessage = terminal.stop_reason ?? "Model probe failed";
+    // Read the terminal's own detail before falling back to the stop reason.
+    //
+    // `stop_reason` is a canonical one-word label — "error" — so reporting it
+    // alone turned a Cursor quota refusal into a toast whose entire body was
+    // the word "error". The upstream sentence an operator needs is in
+    // `stop_details`, which is where the adapter parks it and where the live
+    // dispatch path already reads it (see `terminalFailure` in
+    // `attempt-finalize.ts`). The probe path disagreed with the dispatch path
+    // about the same provider response.
+    const detail = terminal.stop_details;
+    const message =
+      typeof detail?.["message"] === "string" && detail["message"].trim().length > 0
+        ? detail["message"].trim()
+        : undefined;
+    const code = typeof detail?.["code"] === "string" ? detail["code"] : undefined;
+    const tag = code === undefined ? "" : ` (${code})`;
+    errorMessage = `${message ?? terminal.stop_reason ?? "Model probe failed"}${tag}`;
   } else {
     errorMessage = undefined;
   }

package/src/providers/discovery/probing-service.ts

@@ -274,7 +274,13 @@ export class ProviderProbingService {
       // The same wrapper a real dispatch uses, so the probe reads the model the
       // upstream named from the raw bytes rather than from a synthesized event.
       const probeFetch = createProbeFetch(
-        captureProviderExchange(outbound.fetch, probeCapture, false),
+        // Body capture on, unlike a live dispatch: a probe is one-shot and
+        // operator-initiated, so it exists to be inspected. With it off, the
+        // provider-response tee resolved to null and every probe row reported
+        // the middle two stages as absent — a constant, not a measurement,
+        // which made the stage markers useless for the diagnosis they exist
+        // for. The 256 KiB cap in the tee bounds the cost.
+        captureProviderExchange(outbound.fetch, probeCapture, true),
       );
       try {
         if (serviceKind === "websearch") {
@@ -435,6 +441,11 @@ export class ProviderProbingService {
       invalidator: this.snapshotInvalidator,
       accountId,
       dispatchError,
+      // Passed so a refusal delivered as a terminal event — not as a thrown
+      // error — still reaches the health machine. Without it, Cursor's
+      // `resource_exhausted` left `dispatchError` undefined and the probe
+      // recovered an exhausted account.
+      ...(events === undefined ? {} : { events }),
       modelId,
       upstreamStatusCode,
     });
@@ -496,12 +507,24 @@ export class ProviderProbingService {
       ...(tokensPerSec !== undefined ? { tokensPerSec } : {}),
     });
     if (this.telemetryBuffer && payloadCaptureEnabled) {
+      // All four surfaces, so the row's stage markers mean the same thing here
+      // as they do on a live request: which hop actually produced bytes.
+      const providerRequest = probeCapture?.request ?? null;
+      const providerResponse = await probeCapture?.response.catch(() => null) ?? null;
       await this.payloadCapture
         .capture({
           tenantId,
           requestId,
           requestBody: capturedRequest,
-          responseBody: events,
+          // `events` is what the *client* receives, so it belongs in the client
+          // surface. Passing it as `responseBody` lit the client bit on probes
+          // whose event list was empty, over a body that was never captured.
+          // The legacy alias is explicitly absent here; `null` leaves bit 8 to
+          // be decided by the real client body alone.
+          responseBody: null,
+          ...(events === undefined ? {} : { clientResponseBody: events }),
+          ...(providerRequest === null ? {} : { providerRequestBody: providerRequest }),
+          ...(providerResponse === null ? {} : { providerResponseBody: providerResponse }),
           scope: "tenant",
           tenantOptIn: true,
         })

package/src/providers/integrations/antigravity/antigravity-quota.ts

@@ -189,12 +189,20 @@ function parseModelQuotas(payload: Record<string, unknown>): ProviderQuotaWindow
     const family = modelFamily(collapseAntigravityVariant(modelId));
     const familyLabel = FAMILY_LABELS[family.key] ?? family.label;
     for (const entry of modelQuotaEntries(model)) {
-      const fraction = number(entry.info.remainingFraction);
-      if (fraction === null) continue;
+      // A bucket with no fraction but a reset time is exhausted, not unknown:
+      // the upstream omits the field when there is nothing left to report, so
+      // dropping it let a healthy sibling window mask a lane that is blocked
+      // until reset. Only a bucket with neither signal is genuinely unknown.
+      // This matches what the summary path already does for a disabled bucket.
+      const reported = number(entry.info.remainingFraction);
+      const resetAt = isoDate(entry.info.resetTime);
+      const exhausted = reported === null && resetAt !== null;
+      if (reported === null && !exhausted) continue;
+      const fraction = reported ?? 0;
       const kind = entry.kind ?? summaryWindowKind(entry.info);
       const label = kind === undefined ? familyLabel : `${familyLabel} (${SUMMARY_WINDOW_LABELS[kind]})`;
       const key = `${family.key}:${kind ?? "model"}`;
-      const window = fractionWindow(key, label, fraction, isoDate(entry.info.resetTime));
+      const window = fractionWindow(key, label, fraction, resetAt);
       grouped.set(key, keepWorse(grouped.get(key), window));
     }
   }

package/src/providers/integrations/buddy/buddy-catalog-shared.ts

@@ -257,8 +257,8 @@ export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
   ["claude-opus-4.6", "Claude Opus 4.6", true, true, 200_000, 64_000],
   ["claude-opus-4.7-1m", "Claude Opus 4.7 1M", true, true, 1_000_000, 64_000],
   ["claude-sonnet-4.6", "Claude Sonnet 4.6", true, true, 200_000, 32_000],
-  ["deepseek-v4.1-flash", "DeepSeek V4.1 Flash", true, false, 1_000_000, 384_000],
-  ["deepseek-v4.1-flash-sg", "DeepSeek V4.1 Flash SG", true, false, 1_000_000, 128_000],
+  ["deepseek-v4.1-flash", "DeepSeek V4.1 Flash", true, true, 1_000_000, 384_000],
+  ["deepseek-v4.1-flash-sg", "DeepSeek V4.1 Flash SG", true, true, 1_000_000, 128_000],
   ["deepseek-v4.1-pro", "DeepSeek V4.1 Pro", true, false, 1_000_000, 384_000],
   ["gemini-2.5-flash-image", "Gemini 2.5 Flash Image", true, true, 1_000_000, 64_000],
   ["gemini-3.0-pro-image", "Gemini 3.0 Pro Image", true, true, 1_000_000, 64_000],
@@ -286,8 +286,8 @@ export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
   ["grok-4.7", "Grok 4.7", true, true, 500_000, 500_000],
   ["hy3", "Hy3", true, false, 192_000, 64_000, true],
   ["hy3-preview", "Hy3 Preview", true, false, 262_144, 64_000],
-  ["hy4-preview", "Hy4 Preview", true, false, 1_000_000, 64_000, true],
-  ["hy4-preview-f", "Hy4 Preview F", true, false, 1_000_000, 64_000, true],
+  ["hy4-preview", "Hy4 Preview", true, true, 1_000_000, 64_000, true],
+  ["hy4-preview-f", "Hy4 Preview F", true, true, 1_000_000, 64_000, true],
   ["kimi-k2.5", "Kimi K2.5", true, false, 164_000, 262_144],
   ["kimi-k2.6", "Kimi K2.6", true, false, 256_000, 262_144],
   ["kimi-k2.7", "Kimi K2.7", true, false, 256_000, 65_536],