cartethyia 2.5.3 → 2.5.6

package/src/boot/app.ts

@@ -15,7 +15,7 @@ import { GatewayError, publicGatewayErrorBody } from "../protocol/gateway-error"
 import { shutdownError, shutdownNotice } from "../transport/shutdown-notice";
 import type { CanonicalAdapter } from "../transport/contracts";
 import type { ApiKeyAuthorizationSnapshot } from "../security/api-key-auth";
-import { unknownApiKeyError } from "../security/api-key-auth";
+import { modelsListApiKeyError } from "../security/api-key-auth";
 import { getDbHandle } from "../persistence/boot";
 import { isPgHandle } from "../persistence/db-pg";
 import { resolveRedisClient } from "../persistence/redis";
@@ -80,7 +80,7 @@ import type { ShutdownDrainSource } from "../transport/contracts";
  * discriminant narrows `deps` to `ProductionAppDeps`. Listing them here would
  * let a caller pass a value the shell silently ignores.
  */
-export interface GatewayShellDeps {
+interface GatewayShellDeps {
   readonly mode: "route-only";
   readonly dashboardDist?: string;
   readonly checkDb?: () => Promise<void>;
@@ -159,7 +159,7 @@ export interface ProductionAppDeps {
 }
 
 /** Either app mode. The discriminant decides which builder path runs. */
-export type GatewayAppDeps = GatewayShellDeps | ProductionAppDeps;
+type GatewayAppDeps = GatewayShellDeps | ProductionAppDeps;
 
 function checkDatabaseConnection(): Promise<void> {
   return getDbHandle()
@@ -409,7 +409,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     const handleModelsList = async ({ request }: { request: Request }): Promise<Response> => {
       const state = requestStateStore.require(request);
       const auth = state.authorization;
-      if (!auth) throw unknownApiKeyError();
+      if (!auth) throw modelsListApiKeyError();
       const data = await queryAllowedModels(auth);
       return new Response(JSON.stringify({ object: "list", data }), {
         headers: {
@@ -432,7 +432,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     }): Promise<Response> => {
       const state = requestStateStore.require(request);
       const auth = state.authorization;
-      if (!auth) throw unknownApiKeyError();
+      if (!auth) throw modelsListApiKeyError();
       const raw = params?.["*"] ?? params?.id ?? "";
       const targetId = new URL(request.url).searchParams.get("id") ?? raw;
       const found = await publicModelStore.getPublicModelDetail(
@@ -614,10 +614,14 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       const tasks = deps.scheduledTasks;
       const token = deps.drainToken;
       app.post("/admin/tasks/:name/run", async ({ request, params }) => {
+        // `policy_rejected`, not `invalid_request`: the request may be perfectly
+        // well-formed. What refused it is where it came from — the client asked
+        // for something only the local host may ask. `invalid_request` told an
+        // operator to fix the body, when the body was never the problem.
         if (!isLoopbackPeer(peerAddresses.get(request) ?? null))
-          throw new GatewayError("invalid_request", 403, "task trigger is only available from loopback");
+          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback");
         if (!tokenMatches(request.headers.get("x-drain-token"), token))
-          throw new GatewayError("invalid_request", 401, "invalid drain token");
+          throw new GatewayError("authentication_failed", 401, "invalid drain token");
         const name = params.name;
         if (!tasks.names().includes(name))
           throw new GatewayError("invalid_request", 404, `no such task: ${name}`);

package/src/boot/dependencies.ts

@@ -52,6 +52,7 @@ import {
 import { NetworkPoolSelector } from "../network/pool/selector";
 import { ScheduledTaskRegistry } from "../workers/scheduler";
 import { quotaRefreshSweep } from "../workers/quota-refresh-sweep";
+import { markProviderApiKeyCredential } from "../console/quota/account-quota-shared";
 import { dailyCheckinEgressForPass } from "../workers/daily-checkin";
 import {
   buddyAdoptTask,
@@ -70,11 +71,14 @@ import { preferencesReaderFor } from "../persistence/tenant-preferences";
 import { sweepExpiredCooldowns } from "../providers/operations/account-health-service";
 import { DrizzleTelemetryStore } from "../persistence/stores/telemetry-store";
 import { TelemetryPayloadCapture } from "../observability/payload-capture";
+import { foldDayIndex, listEventDays } from "../observability/event-day-index";
+import { resolveTelemetryCompactIntervalMs } from "../config/telemetry";
 import { sweepExpiredPoolCooldowns } from "../network/pool-health-machine";
 import { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
 import { RuntimeMetricsSampler } from "../observability/runtime-metrics";
 import {
   resolveIpRateLimit,
+  resolveModelBanMaxTtlMs,
   resolveModelBanTtlMs,
   resolveModelStrikeThreshold,
   resolveModelStrikeWindowMs,
@@ -136,8 +140,8 @@ const OAUTH_REFRESH_INTER_ITEM_DELAY_MS = 1_500;
  * Client identities are refreshed out of band so provider dispatch never waits
  * on npm/provider version endpoints. Resolver TTLs deduplicate the sources.
  */
-// Matched to the resolver's own 30 min cache TTL: at 15 min every second pass
-// was a pure cache read that could not discover anything new.
+// Matched to the resolver's own 30 min cache TTL: a shorter interval makes
+// every second pass a pure cache read that cannot discover anything new.
 const CLIENT_VERSION_MONITOR_INTERVAL_MS = 30 * 60_000;
 const CLIENT_VERSION_INITIAL_DELAY_MS = 10_000;
 
@@ -219,7 +223,7 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
   // spent, worst exactly when the key is busiest.
   setPendingUsageSource((apiKeyId) => usageFlush.pendingFor(apiKeyId));
   // Health audit rows are append-only and read by nobody in dispatch, so they
-  // no longer land inside the request. The status write they accompany stays
+  // are buffered out of the request. The status write they accompany stays
   // synchronous — routing reads it.
   const healthEventFlush = new HealthEventFlushBuffer(db);
   setHealthEventBuffer(healthEventFlush);
@@ -272,6 +276,7 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
     threshold: resolveModelStrikeThreshold(),
     windowMs: resolveModelStrikeWindowMs(),
     banTtlMs: resolveModelBanTtlMs(),
+    maxBanTtlMs: resolveModelBanMaxTtlMs(),
   });
   const readiness = () => checkReadiness(db, redis, resolveRedisBackend(redis));
   // One list covers every periodic task: a small deployment can cut the
@@ -303,6 +308,25 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
     intervalMs: 15 * 60_000,
     run: () => payloadCapture.cleanupExpired(),
   });
+  scheduledTasks.register({
+    name: "telemetry-index-fold",
+    intervalMs: resolveTelemetryCompactIntervalMs(),
+    // Brings each day's index up to date with the bytes appended since the last
+    // pass, so a usage read is a small JSON read rather than a parse of the
+    // whole period. Folding is incremental and idempotent: a crash only leaves
+    // the watermark behind, and the next pass re-reads the tail.
+    run: async () => {
+      const days = await listEventDays();
+      let folded = 0;
+      for (const day of days) {
+        const result = await foldDayIndex(day).catch(() => ({ folded: 0 }));
+        folded += result.folded;
+      }
+      if (folded > 0) {
+        log.info(`[telemetry] indexed ${folded} event(s) across ${days.length} day(s)`);
+      }
+    },
+  });
   scheduledTasks.register({
     name: "console-session-sweep",
     // Sessions live 48 h, so an hourly sweep deleted nothing 47 times out of
@@ -352,17 +376,17 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
   });
   scheduledTasks.register({
     name: "pool-agent-sweep",
-    // `resolveAgent` already self-sweeps every 30 s, so a 1 min timer added a
-    // second pass that almost always found nothing to release. 5 min is well
+    // `resolveAgent` already self-sweeps every 30 s, so a 1 min timer adds a
+    // second pass that almost always finds nothing to release. 5 min is well
     // inside the idle timeout this exists to enforce, and outside the path
     // that already runs.
     intervalMs: 5 * 60_000,
     run: () => poolAgentResolver.sweepIdleAgents(),
   });
   const oauthRefreshService = new OAuthRefreshService(db);
-  // Converge accounts an earlier build parked on a dead refresh grant: an
-  // account whose stored access token is still usable becomes a static token
-  // (and returns to rotation) instead of staying disabled for re-auth.
+  // Converge accounts parked on a dead refresh grant: an account whose stored
+  // access token is still usable becomes a static token (and returns to
+  // rotation) instead of staying disabled for re-auth.
   await measureStartupPhase("static-token-reconciliation", () =>
     reconcileStaticTokenAccounts(db),
   );
@@ -373,10 +397,10 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
   scheduledTasks.register({
     name: "account-enrichment-sweep",
     // Converges via `identity_checked_at`: once every stored credential has
-    // been parsed, the listing query returns nothing — and a 30 s timer kept
-    // running that empty query forever, two million times a year. 10 min is
-    // still instant for the case that matters (a batch import, where the label
-    // and email show up on the next tick) and costs nothing when idle.
+    // been parsed, the listing query returns nothing — a 30 s timer would run
+    // that empty query forever, two million times a year. 10 min is still
+    // instant for the case that matters (a batch import, where the label and
+    // email show up on the next tick) and costs nothing when idle.
     intervalMs: 10 * 60_000,
     run: () => accountIdentitySweep({ db }),
   });
@@ -432,11 +456,10 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
   // the same pass (one attempt per account per day, guarded by a day
   // marker), so no second timer duplicates the credential resolution.
   //
-  // Registered in **every** mode, not only when Redis is present. It used to
-  // sit behind `if (redis)`, which quietly cost Lite two things: proactive
-  // quota warming, and the check-in ride-along above that claims the
-  // once-per-day WorkBuddy/CodeBuddy credit grant. The whole sweep chain
-  // already accepts `RedisClient | undefined` and falls back to the
+  // Registered in **every** mode, not only when Redis is present: gating it on
+  // Redis would cost Lite proactive quota warming and the check-in ride-along
+  // above that claims the once-per-day WorkBuddy/CodeBuddy credit grant. The
+  // whole sweep chain accepts `RedisClient | undefined` and falls back to the
   // in-process TTL cache and an in-process day marker, so Redis is an
   // optimization here rather than a precondition — which is exactly what
   // Lite is for.
@@ -453,6 +476,14 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
         providerRegistry: registry,
         resolveCredential: quotaResolveCredential,
         snapshotInvalidator: snapshotService,
+        // Without this the sweep hands each collector the raw stored secret.
+        // For `cline` that means an `sk_...` key reaching the OAuth branch,
+        // which prepends `workos:` and is refused with "please make sure
+        // you're using the latest version of Cline and re-authenticate" — so
+        // every sweep cools a working account with `quota_fetch_failed` while
+        // the same account refreshes fine from the console, which binds the
+        // same marker through `createQuotaRefreshDeps`.
+        markApiKeyCredential: markProviderApiKeyCredential,
         // Below the 60 s interval: a budget longer than the tick guarantees
         // skip/burst under load instead of steady progress.
         passBudgetMs: 45_000,
@@ -474,8 +505,8 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
   // dispatch failure.
   //
   // Daily, not hourly: each claim is once per account per day and is
-  // ledger-guarded, so at an hourly cadence 23 of every 24 passes were a full
-  // scan of active accounts plus a ledger read per account that resolved to
+  // ledger-guarded, so at an hourly cadence 23 of every 24 passes are a full
+  // scan of active accounts plus a ledger read per account that resolves to
   // nothing. Once a day is the shortest interval where a pass can still find
   // work, which is the only reason to run at all.
   const buddyTaskDeps = {

package/src/boot/timeout.ts

@@ -24,19 +24,8 @@ export function withTimeout<T>(
 }
 
 /**
- * Creates a standalone timeout promise that rejects after the specified duration.
- * The timer is unref'd to prevent keeping the event loop alive.
- */
-export function timeoutAfter(ms: number, message: string): Promise<never> {
-  return new Promise<never>((_, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    if (typeof timer.unref === "function") timer.unref();
-  });
-}
-
-/**
- * Cancellable variant of {@link timeoutAfter}: the loser timer is cleared
- * when the raced operation wins, instead of firing later against nothing.
+ * The loser timer is cleared when the raced operation wins, instead of firing
+ * later against nothing.
  */
 export function cancellableTimeout(ms: number, message: string): { promise: Promise<never>; cancel: () => void } {
   let timer: ReturnType<typeof setTimeout> | undefined;

package/src/config/cooldowns.ts

@@ -1,138 +1,186 @@
-/**
- * Account/pool health cooldown fallback resolvers.
- */
-
-import { CONFIG_SPEC, readInt } from "./spec";
-
-/** Fallback cooldown for a provider rate limit (default 15m). */
-export function resolveAccountRateLimitCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_RATE_LIMIT_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_RATE_LIMIT_COOLDOWN_MS,
-  );
-}
-
-/**
- * Fallback cooldown for provider quota exhaustion when the error states no
- * reset window (default 1h). A provider-specific rule (xAI Grok Build's
- * rolling 24-hour free-tier window) overrides it inside the classifier.
- */
-export function resolveAccountQuotaCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_QUOTA_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_QUOTA_COOLDOWN_MS,
-  );
-}
-
-/** Fallback cooldown for model-capacity overload (default 2m). */
-export function resolveAccountModelCapacityCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_MODEL_CAPACITY_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_MODEL_CAPACITY_COOLDOWN_MS,
-  );
-}
-
-/** Backoff for a transient 5xx/network fault, recorded as `cooldown` (default 30s). */
-export function resolveAccountTransientCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_TRANSIENT_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_TRANSIENT_COOLDOWN_MS,
-  );
-}
-
-/** Backoff for a failure no rule matched, recorded as `cooldown` (default 1m). */
-export function resolveAccountUnclassifiedCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_UNCLASSIFIED_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_UNCLASSIFIED_COOLDOWN_MS,
-  );
-}
-
-/**
- * Ceiling an escalated fallback cooldown may reach (default 1h).
- *
- * A fallback duration is one the provider never stated, so escalating it is our
- * own estimate. The cap keeps that estimate from outliving a short transient
- * window: an account that recovers on its own must not sit parked for a day
- * because a burst of 5xx happened to arrive while it was already cooling.
- */
-export function resolveAccountCooldownEscalationMaxMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_COOLDOWN_ESCALATION_MAX_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_COOLDOWN_ESCALATION_MAX_MS,
-  );
-}
-
-/** How long a proxy pool stays `cooldown` after a transport fault (default 2m). */
-export function resolvePoolCooldownMs(): number {
-  return readInt("CARTETHYIA_POOL_COOLDOWN_MS", CONFIG_SPEC.CARTETHYIA_POOL_COOLDOWN_MS);
-}
-
-/**
- * Backoff for an auth rejection that names no revocation (default 5m).
- *
- * A bare `401`/`403` is weak evidence: it covers clock skew, a key rotated
- * upstream a moment ago, an edge cache, and a load balancer that answers before
- * the credential is loaded. None of those is the credential's death, and this
- * outcome used to be `disabled` — the one state no sweep recovers, so the
- * account left rotation until an operator noticed. A cooldown costs the same
- * requests for five minutes and comes back on its own.
- *
- * Only a *named* revocation (`token revoked`, `invalidated oauth token`) still
- * parks the account: the upstream stated the credential itself is dead, there is
- * no expiry to wait out and no refresh to run, so a cooldown would only return
- * it to rotation to fail again. Set this to `0` to restore the old behavior.
- */
-export function resolveAccountAuthRejectedCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_AUTH_REJECTED_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_AUTH_REJECTED_COOLDOWN_MS,
-  );
-}
-
-/**
- * Base backoff for the buddy policy/channel block (default 5m).
- *
- * Deliberately a *base*, not the 24h flat penalty it replaced. `11140` has two
- * documented causes our classifier cannot separate from the response alone: the
- * user's prompt failed a safety review, **and** sending the wrong desktop
- * `User-Agent` brand (`workbuddy/shared.ts`). A flat 24h meant that after we
- * fixed a header regression every buddy account stayed dead for up to a further
- * day, and one unsafe prompt cost a whole account a day.
- *
- * As a base it escalates through the consecutive-failure ladder instead, which
- * distinguishes the two causes by what they do next: a genuinely blocked account
- * is refused again on its very next request and parks itself within minutes,
- * while a single bad prompt costs five minutes.
- */
-export function resolveAccountPolicyBlockCooldownMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_POLICY_BLOCK_COOLDOWN_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_POLICY_BLOCK_COOLDOWN_MS,
-  );
-}
-
-/**
- * How long an **automatically** disabled account stays out of rotation (default 24h).
- *
- * `disabled` used to be terminal: nothing recovered it, so a credential rejected
- * once — a revoked key, a definitively dead refresh grant — left rotation until an
- * operator noticed and clicked Recover by hand. That is the wrong default for a
- * credential that may come back on its own: keys get re-issued, grants get
- * re-authorized, and an upstream's notion of "invalid" can outrun ours.
- *
- * The deadline is what makes this safe to automate rather than a policy guess. A row
- * this gateway disables **by itself** carries the deadline; a row an **operator**
- * disables keeps `cooldownUntil` null, and the recovery sweep selects only rows whose
- * deadline has elapsed. So an operator's decision still outranks the machine, with no
- * extra column and no way to confuse the two.
- *
- * Long on purpose: the states that reach here are the ones where retrying sooner
- * only reproduces the refusal. Set to `0` to restore the old terminal behavior.
- */
-export function resolveAccountDisabledRecoveryMs(): number {
-  return readInt(
-    "CARTETHYIA_ACCOUNT_DISABLED_RECOVERY_MS",
-    CONFIG_SPEC.CARTETHYIA_ACCOUNT_DISABLED_RECOVERY_MS,
-  );
-}
+/**
+ * Account/pool health cooldown fallback resolvers.
+ */
+
+import { CONFIG_SPEC, readInt } from "./spec";
+
+let _rateLimitCooldown: number | undefined;
+/** Fallback cooldown for a provider rate limit (default 15m). */
+export function resolveAccountRateLimitCooldownMs(): number {
+  if (_rateLimitCooldown === undefined)
+    _rateLimitCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_RATE_LIMIT_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_RATE_LIMIT_COOLDOWN_MS,
+  );
+  return _rateLimitCooldown;
+}
+
+let _quotaCooldown: number | undefined;
+/**
+ * Fallback cooldown for provider quota exhaustion when the error states no
+ * reset window (default 1h). A provider-specific rule (xAI Grok Build's
+ * rolling 24-hour free-tier window) overrides it inside the classifier.
+ */
+export function resolveAccountQuotaCooldownMs(): number {
+  if (_quotaCooldown === undefined)
+    _quotaCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_QUOTA_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_QUOTA_COOLDOWN_MS,
+  );
+  return _quotaCooldown;
+}
+
+let _modelCapacityCooldown: number | undefined;
+/** Fallback cooldown for model-capacity overload (default 2m). */
+export function resolveAccountModelCapacityCooldownMs(): number {
+  if (_modelCapacityCooldown === undefined)
+    _modelCapacityCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_MODEL_CAPACITY_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_MODEL_CAPACITY_COOLDOWN_MS,
+  );
+  return _modelCapacityCooldown;
+}
+
+let _transientCooldown: number | undefined;
+/** Backoff for a transient 5xx/network fault, recorded as `cooldown` (default 30s). */
+export function resolveAccountTransientCooldownMs(): number {
+  if (_transientCooldown === undefined)
+    _transientCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_TRANSIENT_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_TRANSIENT_COOLDOWN_MS,
+  );
+  return _transientCooldown;
+}
+
+let _unclassifiedCooldown: number | undefined;
+/** Backoff for a failure no rule matched, recorded as `cooldown` (default 1m). */
+export function resolveAccountUnclassifiedCooldownMs(): number {
+  if (_unclassifiedCooldown === undefined)
+    _unclassifiedCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_UNCLASSIFIED_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_UNCLASSIFIED_COOLDOWN_MS,
+  );
+  return _unclassifiedCooldown;
+}
+
+/**
+ * Ceiling an escalated fallback cooldown may reach (default 1h).
+ *
+ * A fallback duration is one the provider never stated, so escalating it is our
+ * own estimate. The cap keeps that estimate from outliving a short transient
+ * window: an account that recovers on its own must not sit parked for a day
+ * because a burst of 5xx happened to arrive while it was already cooling.
+ */
+let _escalationMaxCooldown: number | undefined;
+export function resolveAccountCooldownEscalationMaxMs(): number {
+  if (_escalationMaxCooldown === undefined)
+    _escalationMaxCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_COOLDOWN_ESCALATION_MAX_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_COOLDOWN_ESCALATION_MAX_MS,
+  );
+  return _escalationMaxCooldown;
+}
+
+let _poolCooldown: number | undefined;
+/** How long a proxy pool stays `cooldown` after a transport fault (default 2m). */
+export function resolvePoolCooldownMs(): number {
+  if (_poolCooldown === undefined)
+    _poolCooldown = readInt("CARTETHYIA_POOL_COOLDOWN_MS", CONFIG_SPEC.CARTETHYIA_POOL_COOLDOWN_MS);
+  return _poolCooldown;
+}
+
+let _authRejectedCooldown: number | undefined;
+/**
+ * Backoff for an auth rejection that names no revocation (default 5m).
+ *
+ * A bare `401`/`403` is weak evidence: it covers clock skew, a key rotated
+ * upstream a moment ago, an edge cache, and a load balancer that answers before
+ * the credential is loaded. None of those is the credential's death, and
+ * `disabled` is the one state no sweep recovers — the account would leave
+ * rotation until an operator noticed. A cooldown costs the same
+ * requests for five minutes and comes back on its own.
+ *
+ * Only a *named* revocation (`token revoked`, `invalidated oauth token`) still
+ * parks the account: the upstream stated the credential itself is dead, there is
+ * no expiry to wait out and no refresh to run, so a cooldown would only return
+ * it to rotation to fail again. Set this to `0` to return the account to
+ * rotation immediately, with no backoff to wait out.
+ */
+export function resolveAccountAuthRejectedCooldownMs(): number {
+  if (_authRejectedCooldown === undefined)
+    _authRejectedCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_AUTH_REJECTED_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_AUTH_REJECTED_COOLDOWN_MS,
+  );
+  return _authRejectedCooldown;
+}
+
+let _policyBlockCooldown: number | undefined;
+/**
+ * Base backoff for the buddy policy/channel block (default 5m).
+ *
+ * Deliberately a *base*, not the 24h flat penalty it replaced. `11140` has two
+ * documented causes our classifier cannot separate from the response alone: the
+ * user's prompt failed a safety review, **and** sending the wrong desktop
+ * `User-Agent` brand (`workbuddy/shared.ts`). A flat 24h meant that after we
+ * fixed a header regression every buddy account stayed dead for up to a further
+ * day, and one unsafe prompt cost a whole account a day.
+ *
+ * As a base it escalates through the consecutive-failure ladder instead, which
+ * distinguishes the two causes by what they do next: a genuinely blocked account
+ * is refused again on its very next request and parks itself within minutes,
+ * while a single bad prompt costs five minutes.
+ */
+export function resolveAccountPolicyBlockCooldownMs(): number {
+  if (_policyBlockCooldown === undefined)
+    _policyBlockCooldown = readInt(
+    "CARTETHYIA_ACCOUNT_POLICY_BLOCK_COOLDOWN_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_POLICY_BLOCK_COOLDOWN_MS,
+  );
+  return _policyBlockCooldown;
+}
+
+let _disabledRecovery: number | undefined;
+/**
+ * How long an **automatically** disabled account stays out of rotation (default 24h).
+ *
+ * A credential rejected once — a revoked key, a definitively dead refresh grant —
+ * would otherwise leave rotation until an operator noticed and clicked Recover by
+ * hand. That is the wrong default for a credential that may come back on its own:
+ * keys get re-issued, grants get re-authorized, and an upstream's notion of
+ * "invalid" can outrun ours.
+ *
+ * The deadline is what makes this safe to automate rather than a policy guess. A row
+ * this gateway disables **by itself** carries the deadline; a row an **operator**
+ * disables keeps `cooldownUntil` null, and the recovery sweep selects only rows whose
+ * deadline has elapsed. So an operator's decision still outranks the machine, with no
+ * extra column and no way to confuse the two.
+ *
+ * Long on purpose: the states that reach here are the ones where retrying sooner
+ * only reproduces the refusal. Set to `0` to make an automatic disable terminal.
+ */
+export function resolveAccountDisabledRecoveryMs(): number {
+  if (_disabledRecovery === undefined)
+    _disabledRecovery = readInt(
+    "CARTETHYIA_ACCOUNT_DISABLED_RECOVERY_MS",
+    CONFIG_SPEC.CARTETHYIA_ACCOUNT_DISABLED_RECOVERY_MS,
+  );
+  return _disabledRecovery;
+}
+
+/**
+ * Resets all cached cooldown values. Call this in tests that override
+ * cooldown env-vars between test cases.
+ */
+export function resetCooldownCacheForTests(): void {
+  _rateLimitCooldown = undefined;
+  _quotaCooldown = undefined;
+  _modelCapacityCooldown = undefined;
+  _transientCooldown = undefined;
+  _unclassifiedCooldown = undefined;
+  _escalationMaxCooldown = undefined;
+  _poolCooldown = undefined;
+  _authRejectedCooldown = undefined;
+  _policyBlockCooldown = undefined;
+  _disabledRecovery = undefined;
+}

package/src/config/network.ts

@@ -83,20 +83,15 @@ export function resolveProxyMaxFreeSockets(): number {
 }
 
 // Proxy pool egress is dialed in-process by `network/pool/agent.ts` (http,
-// https, socks5). The former child-process pool flavor — generated config
-// files, a binary path, a local SOCKS port range, and a uid/gid drop — was
-// removed with that feature; do not reintroduce its resolvers without the
-// daemon that consumed them.
+// https, socks5). Add a resolver here only alongside the consumer it feeds.
 
 // ─── Process-wide resource bounds ───────────────────────────────────────────
 
 /**
  * Live process-wide resource bounds. Only bounds with a production consumer
  * live here: `maxPostgresPoolSize` feeds `poolMaxFromEnv()`, and
- * `maxTelemetryQueueBytes` caps `TelemetryBatchBuffer`. Everything else
- * that used to live in this module (`maxRedisPoolSize`, provider/network/
- * catalog/replay bounds, `BoundedConfig` + its validators) had zero callers
- * and was removed — re-add a bound only with its consumer in the same change.
+ * `maxTelemetryQueueBytes` caps `TelemetryBatchBuffer`. Re-add a bound only
+ * with its consumer in the same change.
  */
 export const DEFAULT_BOUNDS = {
   maxTelemetryQueueBytes: 10 * 1024 * 1024,
@@ -105,12 +100,11 @@ export const DEFAULT_BOUNDS = {
    *
    * This is a *ceiling*, not a reservation: the pool opens connections on
    * demand and returns them to idle, so a value the workload never reaches
-   * costs nothing today — it only bounds the worst case. The old value (60)
-   * was justified in a comment as "bursty 10k-inflight traffic", which is a
-   * property of the proxy path. The proxy path is *mostly* database-free —
-   * routing comes from `InMemoryRouteSnapshotService` and admission counters
-   * live in Redis — but not entirely: a dispatch attempt resolves its
-   * credential with a per-attempt read, health transitions write, and tenant
+   * costs nothing today — it only bounds the worst case. The proxy path is
+   * *mostly* database-free — routing comes from `InMemoryRouteSnapshotService`
+   * and admission counters live in Redis — but not entirely: a dispatch attempt
+   * resolves its credential with a per-attempt read, health transitions write,
+   * and tenant
    * preferences are read behind a short cache. Those are small, bounded reads
    * on the request's own attempt, not a per-request fan-out. The larger
    * database consumers remain the console API, one telemetry flush at a time,