cartethyia 2.5.3 → 2.5.6

package/src/console/providers/oauth/routes.ts

@@ -102,8 +102,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
               lastErrorAt: null,
               lastRecoveredAt: null,
               // A fresh login supplies a refresh token, so the account returns
-              // to normal OAuth refresh handling — a static-token flag set on
-              // the previous (refresh-less) credential no longer applies.
+              // to normal OAuth refresh handling and is not a static token.
               staticToken: false,
               // Only what this login reported: a flow that learned no profile or
               // region leaves the stored configuration alone rather than blanking it.
@@ -164,16 +163,13 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
  * and device-code start/poll — driven by whichever `OAuthLoginClient` is
  * registered for a given provider id.
  *
- * > **Koreksi.** An earlier comment here read "Cartethyia hosts the callback
- * > itself (it's a server process, not a local CLI), so there is no
- * > loopback-listener/port-selection problem." That was wrong, and it is the
- * > premise that produced the bug. The redirect URIs these clients advertise
- * > are loopback (`localhost:1455`, `127.0.0.1:54549`, …), which name the
- * > machine the *operator's browser* is on — not this process. Advertising one
- * > without binding the port leaves the code in the browser's address bar, so
- * > every browser login needed the redirect pasted back by hand. The gateway
- * > is a server process, but it is not *the* server the redirect arrives at;
- * > `callback-listener.ts` is what makes those the same endpoint.
+ * The redirect URIs these clients advertise are loopback (`localhost:1455`,
+ * `127.0.0.1:54549`, …), which name the machine the *operator's browser* is on
+ * — not this process. Advertising one without binding the port leaves the code
+ * in the browser's address bar, so every browser login needs the redirect
+ * pasted back by hand. The gateway is a server process, but it is not *the*
+ * server the redirect arrives at; `callback-listener.ts` is what makes those
+ * the same endpoint.
  */
 export interface PersistedOAuthAccount {
   readonly accountId: string;

package/src/console/quota/account-quota-shared.ts

@@ -1,39 +1,52 @@
-import type { ConsoleAccessResolver } from "../auth/access";
-import type { AuditRecorder } from "../auth/audit-recorder";
-import { markClineApiKeyCredential } from "../../providers/integrations/cline/cline-quota";
-import { type QuotaRefreshDeps } from "./refresh";
-import type { AccountTestEgressDeps } from "./account-test-egress";
-
-/**
- * Dependencies shared by the tenant-scoped and global-admin account/quota route
- * groups. Both groups are composed onto one Elysia instance by
- * `createAccountQuotaRoutes`.
- */
-export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
-  readonly poolSelector?: AccountTestEgressDeps["poolSelector"];
-  readonly networkBindingFactory?: AccountTestEgressDeps["networkBindingFactory"];
-  readonly accessResolver: ConsoleAccessResolver;
-  readonly snapshotInvalidator?: { invalidate(): Promise<number> };
-  /** Records privileged account mutations (e.g. hard deletion) to `admin_audit_log`. */
-  readonly auditRecorder?: AuditRecorder | undefined;
-}
-
-export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
-export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
-
-/**
- * Builds the refresh dependency bundle from the route deps, binding the
- * provider-specific credential normalisation (`cline` API keys) once so every
- * caller refreshes through the same wiring.
- */
-export function createQuotaRefreshDeps(deps: AccountQuotaRoutesDeps): QuotaRefreshDeps {
-  return {
-    db: deps.db,
-    redis: deps.redis,
-    providerRegistry: deps.providerRegistry,
-    resolveCredential: deps.resolveCredential,
-    ...(deps.snapshotInvalidator ? { snapshotInvalidator: deps.snapshotInvalidator } : {}),
-    markApiKeyCredential: (providerId, credential) =>
-      providerId === "cline" ? markClineApiKeyCredential(credential) : credential,
-  };
-}
+import type { ConsoleAccessResolver } from "../auth/access";
+import type { AuditRecorder } from "../auth/audit-recorder";
+import { markClineApiKeyCredential } from "../../providers/integrations/cline/cline-quota";
+import { type QuotaRefreshDeps } from "./refresh";
+import type { AccountTestEgressDeps } from "./account-test-egress";
+
+/**
+ * Dependencies shared by the tenant-scoped and global-admin account/quota route
+ * groups. Both groups are composed onto one Elysia instance by
+ * `createAccountQuotaRoutes`.
+ */
+export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
+  readonly poolSelector?: AccountTestEgressDeps["poolSelector"];
+  readonly networkBindingFactory?: AccountTestEgressDeps["networkBindingFactory"];
+  readonly accessResolver: ConsoleAccessResolver;
+  readonly snapshotInvalidator?: { invalidate(): Promise<number> };
+  /** Records privileged account mutations (e.g. hard deletion) to `admin_audit_log`. */
+  readonly auditRecorder?: AuditRecorder | undefined;
+}
+
+export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
+export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
+
+/**
+ * Wraps a stored api_key credential in the envelope its collector expects.
+ *
+ * Exported because every refresh path needs it, and the ones that omit it
+ * fail in a way that looks like the credential is dead: an unmarked `cline`
+ * `sk_...` key takes the OAuth branch, gets `workos:` prepended, and is
+ * refused with a message naming a version problem. The scheduled sweep once
+ * omitted it, so a working account was cooled with `quota_fetch_failed` every
+ * minute while refreshing fine from the console.
+ */
+export function markProviderApiKeyCredential(providerId: string, credential: string): string {
+  return providerId === "cline" ? markClineApiKeyCredential(credential) : credential;
+}
+
+/**
+ * Builds the refresh dependency bundle from the route deps, binding the
+ * provider-specific credential normalisation (`cline` API keys) once so every
+ * caller refreshes through the same wiring.
+ */
+export function createQuotaRefreshDeps(deps: AccountQuotaRoutesDeps): QuotaRefreshDeps {
+  return {
+    db: deps.db,
+    redis: deps.redis,
+    providerRegistry: deps.providerRegistry,
+    resolveCredential: deps.resolveCredential,
+    ...(deps.snapshotInvalidator ? { snapshotInvalidator: deps.snapshotInvalidator } : {}),
+    markApiKeyCredential: markProviderApiKeyCredential,
+  };
+}

package/src/console/quota/account-quota-tenant.ts

@@ -354,12 +354,12 @@ export function registerAccountQuotaTenantRoutes(
       const accounts = rows.map((row) => {
         const entry =
           row.tenantId === null ? globalCache.get(row.id) : ownedCache.get(row.id);
-        // No background refresh is enqueued here. Opening the page used to
-        // enqueue one for every account whose cached value had aged out, so a
-        // single page open hit every provider's quota endpoint at once — and
-        // because the page also polled, the operator saw that fan-out as "the
-        // page refreshes everything when I open it". The periodic sweep owns
-        // freshness; this route renders what is cached.
+        // No background refresh is enqueued here: enqueuing one for every
+        // account whose cached value had aged out means a single page open hits
+        // every provider's quota endpoint at once — and because the page also
+        // polls, the operator sees that fan-out as "the page refreshes
+        // everything when I open it". The periodic sweep owns freshness; this
+        // route renders what is cached.
         //
         // `refreshing` still counts accounts with no cached value, so the client
         // can show them as pending while the sweep fills them.

package/src/console/quota/quota-view.ts

@@ -154,7 +154,7 @@ export function toQuotaAccountHealth(row: {
     cooldownUntil: row.cooldownUntil ? row.cooldownUntil.toISOString() : null,
     // Only deadlines still in force are returned: the sweep prunes the column
     // on a timer, so a raw read can carry an entry that has already elapsed and
-    // would render as a cooldown that no longer applies.
+    // would render as a cooldown that is not in force.
     modelCooldowns: liveModelCooldowns(row.modelCooldowns),
   };
 }