cartethyia 2.5.9 → 2.6.0

package/src/providers/provider-probe.ts

@@ -87,6 +87,9 @@ export async function buildProviderProbeRequest(
 ): Promise<ProviderProbeRequest | undefined> {
   if (!isProbeableProvider(providerId)) return undefined;
 
+  // dynamic-import: cycle break -- opencode/provider transitively imports
+  // this module through the discovery helper; a static import deadlocks at
+  // load time.
   const { OPENCODE_FREE_SPEC } = await import("./integrations/opencode/provider");
   const spec = OPENCODE_FREE_SPEC;
   const source = probeRequest();

package/src/providers/quota/quota-contracts.ts

@@ -1,4 +1,5 @@
 import { decodeJwtPayload } from "../authentication/oauth-flow-store";
+import { asCoercedNumber, asRecord as sharedAsRecord } from "../../shared/coerce";
 
 export interface ProviderQuotaWindow {
   readonly kind: string;
@@ -112,9 +113,7 @@ function creditWindowBalance(
 const TIMEOUT_MS = 15_000;
 
 export function record(value: unknown): Record<string, unknown> | null {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null;
+  return sharedAsRecord(value) ?? null;
 }
 
 export function text(value: unknown): string | null {
@@ -122,10 +121,7 @@ export function text(value: unknown): string | null {
 }
 
 export function number(value: unknown): number | null {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value === "string" && value.trim() && Number.isFinite(Number(value)))
-    return Number(value);
-  return null;
+  return asCoercedNumber(value) ?? null;
 }
 
 export function isoDate(value: unknown): string | null {

package/src/providers/search/search-provider.ts

@@ -1,3 +1,5 @@
+import { asRecord } from "../../shared/coerce";
+
 /**
  * Declarative web-search provider adapters.
  *
@@ -42,12 +44,6 @@ export interface SearchProviderSpec {
   readonly normalize: (data: unknown) => readonly WebSearchResult[];
 }
 
-function asRecord(value: unknown): Record<string, unknown> | undefined {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : undefined;
-}
-
 function stringField(record: Record<string, unknown> | undefined, key: string): string {
   const value = record?.[key];
   return typeof value === "string" ? value : "";

package/src/security/admission/contracts.ts

@@ -44,6 +44,16 @@ export interface AdmissionReserveRequest {
   readonly lifetimeBudget: number | null;
   readonly lifetimeConsumed: number;
   readonly concurrencyLimit: number | null;
+  /**
+   * Hidden allowance added on top of `concurrencyLimit`.
+   *
+   * The configured limit is what an operator tunes and what the error names;
+   * this is deliberate slack so a run that lands a few requests over does not
+   * get refused at the number it was told. Effective max is
+   * `concurrencyLimit + concurrencyTolerance`. Only requests *beyond* that are
+   * refused — never ones already admitted.
+   */
+  readonly concurrencyTolerance?: number | null | undefined;
   readonly tenantId: string;
   readonly tenantConcurrencyLimit: number | null;
   /**

package/src/security/admission/in-memory-store.ts

@@ -20,6 +20,16 @@ interface InMemoryReservation {
   readonly monthlyKey: string;
   readonly tracksLifetime: boolean;
   readonly tracksConcurrency: boolean;
+  /**
+   * The key the concurrency counter was incremented under.
+   *
+   * Not `apiKeyId`: a share child reserves under its own id while the
+   * reservation is recorded against its parent, so charging and refunding
+   * through `apiKeyId` incremented one counter and decremented another. The
+   * child's count then never fell — after `limit` requests it was permanently
+   * full and refused everything, which is the "never invoked again" symptom.
+   */
+  readonly concurrencyKey: string;
   readonly tenantId: string;
   readonly tracksTenantConcurrency: boolean;
   state: "active" | "committed" | "released";
@@ -36,9 +46,57 @@ const TERMINAL_RESERVATION_CAP = 10_000;
 const COUNTER_MAP_CAP = 20_000;
 
 
+/**
+ * Per-key RPM timestamp queue.
+ *
+ * Entries are appended in nondecreasing `now` order (requests are admitted
+ * under the store's exclusive gate, each stamped with its own `now`), so the
+ * window prefix is monotone: pruning advances a head index past every entry
+ * `<= cutoff` without copying the surviving suffix, and the array is compacted
+ * only when the consumed prefix exceeds half of it. Per request this is O(1)
+ * amortized instead of the previous per-request full-array rewrite.
+ *
+ * Exposed surface mirrors what the reserve path needs: `length` (window count
+ * for the limit check), `push` (append on admit), and `prune` (advance the
+ * window). `purge()` drops the whole key from the outer map.
+ */
+class RpmTimestampQueue {
+  private entries: number[] = [];
+  private head = 0;
+
+  get length(): number {
+    return this.entries.length - this.head;
+  }
+
+  push(now: number): void {
+    this.entries.push(now);
+  }
+
+  /**
+   * Drops every entry `<= cutoff`. An entry exactly one window old is expired
+   * (the existing exact-boundary semantics: `cutoff = now - window`, so an
+   * entry at `now - window` equals the cutoff and is dropped).
+   */
+  prune(now: number, windowMs: number): void {
+    const cutoff = now - windowMs;
+    while (this.head < this.entries.length && this.entries[this.head]! <= cutoff) {
+      this.head += 1;
+    }
+    if (this.head > this.entries.length / 2) {
+      this.entries = this.entries.slice(this.head);
+      this.head = 0;
+    }
+  }
+
+  /** True when no live entries remain — the caller deletes the bucket. */
+  isEmpty(): boolean {
+    return this.length === 0;
+  }
+}
+
 /** Atomic single-process admission store used by tests and single-process development. */
 export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
-  private readonly rpmTimestamps = new Map<string, number[]>();
+  private readonly rpmTimestamps = new Map<string, RpmTimestampQueue>();
   private readonly daily = new Map<string, number>();
   private readonly monthly = new Map<string, number>();
   private readonly lifetime = new Map<string, number>();
@@ -145,8 +203,19 @@ export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
         lifetime + request.estimatedTokens > request.lifetimeBudget
       )
         throw reasonToGatewayError("lifetime-token-budget", { limit: request.lifetimeBudget });
-      if (request.concurrencyLimit != null && concurrent >= request.concurrencyLimit)
-        throw reasonToGatewayError("concurrency-limit", { limit: request.concurrencyLimit });
+      // The tolerance is slack above the configured limit, so the ceiling is
+      // the sum. It widens admission only: requests already inside are never
+      // revisited, and the refusal still names the configured limit.
+      const concurrencyCeiling =
+        request.concurrencyLimit !== null
+          ? request.concurrencyLimit + Math.max(0, request.concurrencyTolerance ?? 0)
+          : null;
+      if (concurrencyCeiling !== null && concurrent >= concurrencyCeiling)
+        throw reasonToGatewayError("concurrency-limit", {
+          limit: request.concurrencyLimit,
+          tolerance: request.concurrencyTolerance ?? 0,
+          effectiveLimit: concurrencyCeiling,
+        });
       if (
         request.tenantConcurrencyLimit != null &&
         tenantConcurrent >= request.tenantConcurrencyLimit
@@ -182,6 +251,7 @@ export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
         monthlyKey,
         tracksLifetime: request.lifetimeBudget != null,
         tracksConcurrency: request.concurrencyLimit != null,
+        concurrencyKey: rpmConcId,
         tenantId: request.tenantId,
         tracksTenantConcurrency: request.tenantConcurrencyLimit != null,
         state: "active",
@@ -205,7 +275,7 @@ export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
       this.adjust(this.daily, reservation.dailyKey, delta, reservation.tracksDaily);
       this.adjust(this.monthly, reservation.monthlyKey, delta, reservation.tracksMonthly);
       this.adjust(this.lifetime, apiKeyId, delta, reservation.tracksLifetime);
-      if (reservation.tracksConcurrency) this.decrement(this.concurrent, apiKeyId);
+      if (reservation.tracksConcurrency) this.decrement(this.concurrent, reservation.concurrencyKey);
       if (reservation.tracksTenantConcurrency)
         this.decrement(this.tenantConcurrent, reservation.tenantId);
       reservation.state = "committed";
@@ -276,7 +346,7 @@ export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
   }
 
   /** Caps a bucketed counter map; oldest-inserted buckets evicted first. */
-  private evictCounter(store: Map<string, number> | Map<string, number[]>): void {
+  private evictCounter(store: Map<string, number> | Map<string, RpmTimestampQueue>): void {
     if (store.size < COUNTER_MAP_CAP) return;
     let toEvict = store.size - COUNTER_MAP_CAP + 1;
     for (const key of store.keys()) {
@@ -290,7 +360,7 @@ export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
     this.adjust(this.daily, reservation.dailyKey, -reservation.reserved, reservation.tracksDaily);
     this.adjust(this.monthly, reservation.monthlyKey, -reservation.reserved, reservation.tracksMonthly);
     this.adjust(this.lifetime, reservation.apiKeyId, -reservation.reserved, reservation.tracksLifetime);
-    if (reservation.tracksConcurrency) this.decrement(this.concurrent, reservation.apiKeyId);
+    if (reservation.tracksConcurrency) this.decrement(this.concurrent, reservation.concurrencyKey);
     if (reservation.tracksTenantConcurrency)
       this.decrement(this.tenantConcurrent, reservation.tenantId);
     reservation.state = "released";
@@ -316,21 +386,26 @@ export class InMemoryAdmissionCounterStore implements AdmissionCounterStore {
   private value(store: ReadonlyMap<string, number>, key: string): number {
     return store.get(key) ?? 0;
   }
-  private pruneRpm(apiKeyId: string, now: number): number[] {
-    const cutoff = now - (this.options.windowMs ?? 60_000);
+  private pruneRpm(apiKeyId: string, now: number): RpmTimestampQueue {
     const existing = this.rpmTimestamps.get(apiKeyId);
     if (!existing) {
-      const fresh: number[] = [];
+      const fresh = new RpmTimestampQueue();
       this.rpmTimestamps.set(apiKeyId, fresh);
       this.evictCounter(this.rpmTimestamps);
       return fresh;
     }
-    // In-place compaction: `.filter` allocated a new array per request.
-    let write = 0;
-    for (let read = 0; read < existing.length; read += 1) {
-      if (existing[read]! > cutoff) existing[write++] = existing[read]!;
+    // Amortized: advances the head past expired entries; compaction of the
+    // consumed prefix happens only when it exceeds half the array.
+    existing.prune(now, this.options.windowMs ?? 60_000);
+    if (existing.isEmpty()) {
+      // Drop the emptied bucket so the map cannot pin one dead queue per key
+      // the process ever served, then hand the caller a fresh queue — the
+      // caller pushes this request's timestamp into whatever it gets back, and
+      // pushing into the detached object would silently drop the admission.
+      const fresh = new RpmTimestampQueue();
+      this.rpmTimestamps.set(apiKeyId, fresh);
+      return fresh;
     }
-    existing.length = write;
     return existing;
   }
   private requireReservation(