cartethyia 2.5.3 → 2.5.4

package/src/console/routing/pools/routes.ts

@@ -1,164 +1,181 @@
-// Network-pool control-plane HTTP routes. The only module that touches Elysia.
-import { Elysia, t } from "elysia";
-import { consoleErrorHandler } from "../../shared/errors";
-import { literalUnion } from "../../shared/elysia-schema";
-import { RELAY_TARGETS, type RelayDeployRequest } from "./relay-deploy";
-import { RELAY_REGIONS } from "./relay-regions";
-import { SPEED_TEST_DEFAULT_BYTES } from "./speed-test-sizes";
-import {
-  MAX_BATCH_PROBE_TARGETS,
-  POOL_KINDS,
-  POOL_ROUTING_STRATEGIES,
-  POOL_STATUSES,
-  type CreateNetworkPoolRequest,
-  type NetworkPoolConfig,
-  type PoolStrategySetting,
-} from "./contracts";
-import { createNetworkPoolOperations } from "./operations";
-
-const poolKindSchema = literalUnion(POOL_KINDS);
-const createPoolBody = t.Object({
-  kind: poolKindSchema,
-  label: t.Optional(t.String()),
-  endpoint: t.String(),
-  credential: t.Optional(t.String()),
-  maxInflight: t.Optional(t.Number()),
-  weight: t.Optional(t.Number()),
-  status: t.Optional(literalUnion(POOL_STATUSES)),
-  config: t.Optional(t.Record(t.String(), t.Unknown())),
-  /** Egress allowance in bytes; `null` clears it back to unmetered. */
-  quotaBytes: t.Optional(t.Union([t.Number({ minimum: 1 }), t.Null()])),
-  /** Operator-set family/tag naming which family this node belongs to. */
-  family: t.Optional(t.Union([t.String(), t.Null()])),
-});
-const deployRelayBody = t.Object({
-  target: literalUnion(RELAY_TARGETS),
-  token: t.String({ minLength: 1 }),
-  accountId: t.Optional(t.String()),
-  projectName: t.Optional(t.String()),
-  /** Vercel function region; ignored for targets that have no region control. */
-  region: t.Optional(literalUnion(RELAY_REGIONS)),
-});
-const testBatchBody = t.Object({
-  targets: t.Array(createPoolBody, { minItems: 1, maxItems: MAX_BATCH_PROBE_TARGETS }),
-});
-const updatePoolBody = t.Partial(createPoolBody);
-export function createNetworkPoolRoutes(config: NetworkPoolConfig): Elysia {
-  const factory = createNetworkPoolOperations(config);
-  return new Elysia({ prefix: "/network/pools" })
-    .error(consoleErrorHandler("Network pool operation failed"))
-    .get("/", async ({ request }) => {
-      return await factory.listPools(config.accessResolver(request));
-})
-    .get("/:poolId", async ({ request, params }) => {
-      return await factory.getPoolDetail(config.accessResolver(request), params.poolId);
-})
-    .post("/", { body: createPoolBody }, async ({ request, body, set }) => {
-      set.status = 201;
-      return await factory.createPool(
-        config.accessResolver(request),
-        body as CreateNetworkPoolRequest,
-      );
-})
-    .patch("/:poolId", { body: updatePoolBody }, async ({ request, params, body }) => {
-      return await factory.updatePool(
-        config.accessResolver(request),
-        params.poolId,
-        body as Partial<CreateNetworkPoolRequest>,
-      );
-})
-    .delete("/:poolId", async ({ request, params }) => {
-      return await factory.deletePool(config.accessResolver(request), params.poolId);
-})
-    .get("/:poolId/health-events", async ({ request, params }) => {
-      return await factory.listPoolHealthEvents(config.accessResolver(request), params.poolId);
-})
-    .post("/:poolId/recover", async ({ request, params }) => {
-      return await factory.recoverPool(config.accessResolver(request), params.poolId);
-})
-    .post(
-      "/:poolId/provider-probe",
-      { body: t.Object({ providerId: t.String() }) },
-      async ({ request, params, body }) => {
-        return await factory.providerProbe(
-          config.accessResolver(request),
-          params.poolId,
-          body.providerId,
-        );
-      },
-    )
-    .post("/:poolId/health-check", async ({ request, params }) => {
-      return await factory.healthCheck(config.accessResolver(request), params.poolId);
-})
-    .post(
-      "/:poolId/speed-test",
-      { body: t.Optional(t.Object({ bytes: t.Optional(t.Number()) })) },
-      async ({ request, params, body }) => {
-        return await factory.speedTest(
-          config.accessResolver(request),
-          params.poolId,
-          body?.bytes ?? SPEED_TEST_DEFAULT_BYTES,
-        );
-      },
-    )
-    .post("/test", { body: createPoolBody }, async ({ request, body }) => {
-      return await factory.probeAdHocPool(
-        config.accessResolver(request),
-        body as CreateNetworkPoolRequest,
-      );
-})
-    .post("/test-batch", { body: testBatchBody }, async ({ request, body }) => {
-      return await factory.probeAdHocPoolBatch(
-        config.accessResolver(request),
-        body.targets as CreateNetworkPoolRequest[],
-      );
-})
-    .post(
-      "/test-batch/provider",
-      {
-        body: t.Object({
-          providerId: t.String(),
-          targets: t.Array(createPoolBody, { minItems: 1, maxItems: MAX_BATCH_PROBE_TARGETS }),
-        }),
-      },
-      async ({ request, body }) => {
-        return await factory.probeAdHocProviderBatch(
-          config.accessResolver(request),
-          body.targets as CreateNetworkPoolRequest[],
-          body.providerId,
-        );
-      },
-    )
-    .post(
-      "/:poolId/cooldowns/clear",
-      { body: t.Optional(t.Object({ providerId: t.Optional(t.String()) })) },
-      async ({ request, params, body }) => {
-        return await factory.clearPoolCooldown(
-          config.accessResolver(request),
-          params.poolId,
-          body?.providerId,
-        );
-},
-    )
-    .post("/relay/deploy", { body: deployRelayBody }, async ({ request, body }) => {
-      return await factory.deployRelay(config.accessResolver(request), body as RelayDeployRequest);
-    })
-    .get("/strategy", async ({ request }) => {
-      return await factory.getStrategy(config.accessResolver(request));
-})
-    .patch(
-      "/strategy",
-      {
-        body: t.Object({
-          strategy: t.Optional(literalUnion(POOL_ROUTING_STRATEGIES)),
-          rotateCount: t.Optional(t.Number()),
-        }),
-      },
-      async ({ request, body }) => {
-        return await factory.updateStrategy(
-          config.accessResolver(request),
-          body as Partial<PoolStrategySetting>,
-        );
-},
-    ) as unknown as Elysia;
-}
+// Network-pool control-plane HTTP routes. The only module that touches Elysia.
+import { Elysia, t } from "elysia";
+import { consoleErrorHandler } from "../../shared/errors";
+import { literalUnion } from "../../shared/elysia-schema";
+import { RELAY_TARGETS, type RelayDeployRequest } from "./relay-deploy";
+import { RELAY_REGIONS } from "./relay-regions";
+import { SPEED_TEST_DEFAULT_BYTES } from "./speed-test-sizes";
+import {
+  MAX_BATCH_PROBE_TARGETS,
+  POOL_KINDS,
+  POOL_ROUTING_STRATEGIES,
+  POOL_STATUSES,
+  type CreateNetworkPoolRequest,
+  type NetworkPoolConfig,
+  type PoolStrategySetting,
+} from "./contracts";
+import { createNetworkPoolOperations } from "./operations";
+import { parseProxyFile } from "./import-parse";
+
+const poolKindSchema = literalUnion(POOL_KINDS);
+const createPoolBody = t.Object({
+  kind: poolKindSchema,
+  label: t.Optional(t.String()),
+  endpoint: t.String(),
+  credential: t.Optional(t.String()),
+  maxInflight: t.Optional(t.Number()),
+  weight: t.Optional(t.Number()),
+  status: t.Optional(literalUnion(POOL_STATUSES)),
+  config: t.Optional(t.Record(t.String(), t.Unknown())),
+  /** Egress allowance in bytes; `null` clears it back to unmetered. */
+  quotaBytes: t.Optional(t.Union([t.Number({ minimum: 1 }), t.Null()])),
+  /** Operator-set family/tag naming which family this node belongs to. */
+  family: t.Optional(t.Union([t.String(), t.Null()])),
+});
+const deployRelayBody = t.Object({
+  target: literalUnion(RELAY_TARGETS),
+  token: t.String({ minLength: 1 }),
+  accountId: t.Optional(t.String()),
+  projectName: t.Optional(t.String()),
+  /** Vercel function region; ignored for targets that have no region control. */
+  region: t.Optional(literalUnion(RELAY_REGIONS)),
+});
+const testBatchBody = t.Object({
+  targets: t.Array(createPoolBody, { minItems: 1, maxItems: MAX_BATCH_PROBE_TARGETS }),
+});
+const updatePoolBody = t.Partial(createPoolBody);
+/**
+ * A pasted proxy list. `content` is the file's text; the shapes accepted are
+ * documented on {@link parseProxyFile}. `maxInflight` and `weight` apply to
+ * every imported row, because a file carries no per-row tuning.
+ */
+const importPoolsBody = t.Object({
+  content: t.String({ minLength: 1 }),
+  maxInflight: t.Optional(t.Number()),
+  weight: t.Optional(t.Number()),
+  family: t.Optional(t.Union([t.String(), t.Null()])),
+  labelPrefix: t.Optional(t.String()),
+});
+export function createNetworkPoolRoutes(config: NetworkPoolConfig): Elysia {
+  const factory = createNetworkPoolOperations(config);
+  return new Elysia({ prefix: "/network/pools" })
+    .error(consoleErrorHandler("Network pool operation failed"))
+    .get("/", async ({ request }) => {
+      return await factory.listPools(config.accessResolver(request));
+})
+    .get("/:poolId", async ({ request, params }) => {
+      return await factory.getPoolDetail(config.accessResolver(request), params.poolId);
+})
+    .post("/", { body: createPoolBody }, async ({ request, body, set }) => {
+      set.status = 201;
+      return await factory.createPool(
+        config.accessResolver(request),
+        body as CreateNetworkPoolRequest,
+      );
+})
+    .post("/import", { body: importPoolsBody }, async ({ request, body, set }) => {
+      set.status = 200;
+      return await factory.importPools(config.accessResolver(request), body);
+    })
+    .patch("/:poolId", { body: updatePoolBody }, async ({ request, params, body }) => {
+      return await factory.updatePool(
+        config.accessResolver(request),
+        params.poolId,
+        body as Partial<CreateNetworkPoolRequest>,
+      );
+})
+    .delete("/:poolId", async ({ request, params }) => {
+      return await factory.deletePool(config.accessResolver(request), params.poolId);
+})
+    .get("/:poolId/health-events", async ({ request, params }) => {
+      return await factory.listPoolHealthEvents(config.accessResolver(request), params.poolId);
+})
+    .post("/:poolId/recover", async ({ request, params }) => {
+      return await factory.recoverPool(config.accessResolver(request), params.poolId);
+})
+    .post(
+      "/:poolId/provider-probe",
+      { body: t.Object({ providerId: t.String() }) },
+      async ({ request, params, body }) => {
+        return await factory.providerProbe(
+          config.accessResolver(request),
+          params.poolId,
+          body.providerId,
+        );
+      },
+    )
+    .post("/:poolId/health-check", async ({ request, params }) => {
+      return await factory.healthCheck(config.accessResolver(request), params.poolId);
+})
+    .post(
+      "/:poolId/speed-test",
+      { body: t.Optional(t.Object({ bytes: t.Optional(t.Number()) })) },
+      async ({ request, params, body }) => {
+        return await factory.speedTest(
+          config.accessResolver(request),
+          params.poolId,
+          body?.bytes ?? SPEED_TEST_DEFAULT_BYTES,
+        );
+      },
+    )
+    .post("/test", { body: createPoolBody }, async ({ request, body }) => {
+      return await factory.probeAdHocPool(
+        config.accessResolver(request),
+        body as CreateNetworkPoolRequest,
+      );
+})
+    .post("/test-batch", { body: testBatchBody }, async ({ request, body }) => {
+      return await factory.probeAdHocPoolBatch(
+        config.accessResolver(request),
+        body.targets as CreateNetworkPoolRequest[],
+      );
+})
+    .post(
+      "/test-batch/provider",
+      {
+        body: t.Object({
+          providerId: t.String(),
+          targets: t.Array(createPoolBody, { minItems: 1, maxItems: MAX_BATCH_PROBE_TARGETS }),
+        }),
+      },
+      async ({ request, body }) => {
+        return await factory.probeAdHocProviderBatch(
+          config.accessResolver(request),
+          body.targets as CreateNetworkPoolRequest[],
+          body.providerId,
+        );
+      },
+    )
+    .post(
+      "/:poolId/cooldowns/clear",
+      { body: t.Optional(t.Object({ providerId: t.Optional(t.String()) })) },
+      async ({ request, params, body }) => {
+        return await factory.clearPoolCooldown(
+          config.accessResolver(request),
+          params.poolId,
+          body?.providerId,
+        );
+},
+    )
+    .post("/relay/deploy", { body: deployRelayBody }, async ({ request, body }) => {
+      return await factory.deployRelay(config.accessResolver(request), body as RelayDeployRequest);
+    })
+    .get("/strategy", async ({ request }) => {
+      return await factory.getStrategy(config.accessResolver(request));
+})
+    .patch(
+      "/strategy",
+      {
+        body: t.Object({
+          strategy: t.Optional(literalUnion(POOL_ROUTING_STRATEGIES)),
+          rotateCount: t.Optional(t.Number()),
+        }),
+      },
+      async ({ request, body }) => {
+        return await factory.updateStrategy(
+          config.accessResolver(request),
+          body as Partial<PoolStrategySetting>,
+        );
+},
+    ) as unknown as Elysia;
+}

package/src/console/settings/contracts.ts

@@ -26,6 +26,19 @@ export interface RuntimeSettingsResponse {
   readonly ponyTailEnabled: boolean;
   /** PonyTail directive intensity; `full` by default. */
   readonly ponyTailLevel: PonyTailLevel;
+  /**
+   * Ignores an account-wide cooldown when building route candidates. Off by
+   * default: dialing a cooled-down account reproduces the refusal that parked
+   * it, and can exhaust the candidate list. Overrides nothing else — the
+   * cooldown is still recorded and still recovered by the sweep.
+   */
+  readonly forceDisableCooldown: boolean;
+  /** Per-tenant upstream request timeout in seconds; null means deployment default. */
+  readonly upstreamTimeoutSeconds: number | null;
+  /** Per-tenant telemetry compaction age in days; null means deployment default. */
+  readonly telemetryWindowMinutes: number | null;
+  /** Per-tenant inline attachment ceiling in bytes; null means deployment default. */
+  readonly imageClampMaxBytes: number | null;
   readonly updatedAt: string;
 }
 
@@ -150,4 +163,28 @@ export const runtimeUpdateBody = t.Object({
   rtkPruneLevel: t.Optional(literalUnion(RTK_LEVELS)),
   ponyTailEnabled: t.Optional(t.Boolean()),
   ponyTailLevel: t.Optional(literalUnion(PONYTAIL_LEVELS)),
+  /*
+   * Operational overrides. Every field a caller may patch must appear here:
+   * this schema is what the route parses the body against, and a key it does
+   * not name is dropped before the store sees it. These four were added to the
+   * request type and the store but never to this object, so a save returned
+   * 200 and changed nothing — the mutation's toast fired while the stored
+   * value stayed put.
+   *
+   * `t.Null()` is what "Deployment default" sends, and it must survive:
+   * clearing an override is a real edit, not an absent one.
+   *
+   * The bounds mirror the store's own normalizers, so an out-of-range value is
+   * rejected here rather than silently clamped on the way in.
+   */
+  forceDisableCooldown: t.Optional(t.Boolean()),
+  upstreamTimeoutSeconds: t.Optional(
+    t.Union([t.Null(), t.Number({ minimum: 5, maximum: 600 })]),
+  ),
+  telemetryWindowMinutes: t.Optional(
+    t.Union([t.Null(), t.Number({ minimum: 1, maximum: 1440 })]),
+  ),
+  imageClampMaxBytes: t.Optional(
+    t.Union([t.Null(), t.Number({ minimum: 64 * 1024, maximum: 100 * 1024 * 1024 })]),
+  ),
 });

package/src/console/settings/store.ts

@@ -68,6 +68,43 @@ function normalizeTelemetryPayloadDepth(value: unknown): TelemetryPayloadDepth {
   return "minimum";
 }
 
+/**
+ * Bounds a per-tenant numeric override, or `null` for "use the default".
+ *
+ * Clamped rather than rejected: these are operational knobs an operator tunes
+ * live, and a PATCH that throws on an out-of-range value leaves them stuck at
+ * whatever was stored. Clamping keeps the value inside the range the request
+ * path can actually honour — the same range the deployment env var accepts.
+ *
+ * `null` (and every non-finite value) means "no override", which is distinct
+ * from "override with zero".
+ */
+function normalizeBoundedNumber(value: unknown, min: number, max: number): number | null {
+  if (value === null || value === undefined) return null;
+  const parsed = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(parsed)) return null;
+  // A value at or below zero is not a setting, it is a typo: clamping it to
+  // the floor would silently give the request a 5-second budget when the
+  // operator meant "no override". Non-positive therefore reads as absent.
+  if (parsed <= 0) return null;
+  return Math.min(max, Math.max(min, Math.floor(parsed)));
+}
+
+/** Upstream timeout in seconds: 5 s floor, 600 s ceiling, matching the env var. */
+function normalizeUpstreamTimeoutSeconds(value: unknown): number | null {
+  return normalizeBoundedNumber(value, 5, 600);
+}
+
+/** Source window in minutes: 1 floor, 1440 (one day) ceiling, matching the env var. */
+function normalizeTelemetryWindowMinutes(value: unknown): number | null {
+  return normalizeBoundedNumber(value, 1, 1440);
+}
+
+/** Inline attachment ceiling in bytes: 64 KB floor, 100 MB ceiling. */
+function normalizeImageClampMaxBytes(value: unknown): number | null {
+  return normalizeBoundedNumber(value, 64 * 1024, 100 * 1024 * 1024);
+}
+
 function mapRuntimeSettingsRow(
   row: typeof consoleSettings.$inferSelect | undefined,
   redisBackend: RedisBackend,
@@ -95,6 +132,10 @@ function mapRuntimeSettingsRow(
     // requires the flag — never injected it.
     ponyTailEnabled: prefs.ponyTailEnabled === true,
     ponyTailLevel: normalizePonyTailLevel(prefs.ponyTailLevel),
+    forceDisableCooldown: prefs.forceDisableCooldown === true,
+    upstreamTimeoutSeconds: normalizeUpstreamTimeoutSeconds(prefs.upstreamTimeoutSeconds),
+    telemetryWindowMinutes: normalizeTelemetryWindowMinutes(prefs.telemetryWindowMinutes),
+    imageClampMaxBytes: normalizeImageClampMaxBytes(prefs.imageClampMaxBytes),
     updatedAt,
   };
 }
@@ -133,6 +174,16 @@ export class DrizzleRuntimeSettingsStore implements RuntimeSettingsStore {
     if (patch.rtkPruneLevel !== undefined) patchPrefs.rtkPruneLevel = patch.rtkPruneLevel;
     if (patch.ponyTailEnabled !== undefined) patchPrefs.ponyTailEnabled = patch.ponyTailEnabled;
     if (patch.ponyTailLevel !== undefined) patchPrefs.ponyTailLevel = patch.ponyTailLevel;
+    if (patch.forceDisableCooldown !== undefined)
+      patchPrefs.forceDisableCooldown = patch.forceDisableCooldown === true;
+    if (patch.upstreamTimeoutSeconds !== undefined)
+      patchPrefs.upstreamTimeoutSeconds = normalizeUpstreamTimeoutSeconds(patch.upstreamTimeoutSeconds);
+    if (patch.telemetryWindowMinutes !== undefined)
+      patchPrefs.telemetryWindowMinutes = normalizeTelemetryWindowMinutes(
+        patch.telemetryWindowMinutes,
+      );
+    if (patch.imageClampMaxBytes !== undefined)
+      patchPrefs.imageClampMaxBytes = normalizeImageClampMaxBytes(patch.imageClampMaxBytes);
 
     const rows = await this.db
       .insert(consoleSettings)

package/src/console/updates/routes.ts

@@ -1,4 +1,5 @@
 import { Elysia } from "elysia";
+import { spawn } from "node:child_process";
 import { consoleErrorHandler, requireTenantScope } from "../shared/errors";
 import { consoleSseResponse, createConsoleSseStream } from "../observability/sse";
 import type { ObservabilityStore } from "../observability/contracts";
@@ -86,6 +87,21 @@ export function createUpdateRoutes(config: {
   return new Elysia()
     .error(consoleErrorHandler("Update check failed"))
     .get("/updates/release", async () => await fetchRelease())
+    .post("/updates/apply", ({ request }) => {
+      requireTenantScope(config.accessResolver(request), "dashboard:write");
+      const isWin = process.platform === "win32";
+      const shell = isWin ? "cmd.exe" : "/bin/sh";
+      const install = "npm install -g cartethyia@latest --prefer-online";
+      const restart = isWin
+        ? "cartethyia start"
+        : "systemctl restart cartethyia 2>/dev/null || cartethyia start";
+      const script = `${install} && ${restart}`;
+      const args = isWin ? ["/c", script] : ["-c", script];
+      const child = spawn(shell, args, { detached: true, stdio: "ignore" });
+      child.unref();
+      setTimeout(() => process.exit(0), 1500);
+      return { started: true };
+    })
     .get("/notifications/stream", ({ request }) => {
       const tenantId = requireTenantScope(
         config.accessResolver(request),

package/src/main.ts

@@ -68,6 +68,16 @@ const app = boot
         admissionService: boot.deps.admissionService,
         modelStrikes: boot.deps.modelStrikes,
         readRoutingAccountInflight: boot.deps.readRoutingAccountInflight,
+        // The same three writers the shutdown coordinator drains, so a manual
+        // flush from the console does exactly what a graceful stop would do
+        // for the queues, minus the stop.
+        flushBuffers: {
+          flush: async () => {
+            await boot.deps.telemetryBuffer.flush();
+            await boot.deps.usageFlush.flush();
+            await boot.deps.healthEventFlush.flush();
+          },
+        },
       },
     })
   : createGatewayShell();