cartethyia 2.6.3 → 2.6.4

package/package.json

@@ -1,96 +1,96 @@
-{
-  "name": "cartethyia",
-  "version": "2.6.3",
-  "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
-  "license": "GPL-3.0-only",
-  "type": "module",
-  "packageManager": "bun@1.4.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/risunCodex/Cartethyia.git"
-  },
-  "homepage": "https://github.com/risunCodex/Cartethyia#readme",
-  "bugs": {
-    "url": "https://github.com/risunCodex/Cartethyia/issues"
-  },
-  "keywords": [
-    "ai",
-    "gateway",
-    "llm",
-    "bun",
-    "self-hosted"
-  ],
-  "bin": {
-    "cartethyia": "scripts/cli/bin/cartethyia.cjs",
-    "carte": "scripts/cli/bin/carte.cjs"
-  },
-  "files": [
-    "scripts/cli/",
-    "src/",
-    "migrations/",
-    "dist/dashboard/",
-    ".env.example",
-    "README.md"
-  ],
-  "workspaces": [
-    "dashboard"
-  ],
-  "engines": {
-    "bun": ">=1.4.0"
-  },
-  "scripts": {
-    "dev": "bun run dev:stack",
-    "dev:watch": "bun run scripts/dev/supervisor.ts",
-    "test": "bun run scripts/test/run.ts",
-    "build": "bun run scripts/build/build.ts",
-    "prepack": "bun run dashboard:build",
-    "setup": "bun run scripts/cli/setup.ts",
-    "start": "bun run scripts/cli/main.ts start",
-    "doctor": "bun run scripts/cli/doctor.ts",
-    "probe:egress": "bun run scripts/tools/probe-egress.ts",
-    "restart": "bun run scripts/build/restart.ts",
-    "build:aot": "bun run scripts/build/aot.ts",
-    "dev:stack": "concurrently -n BACKEND,DASHBOARD -c cyan,magenta --kill-others-on-fail \"bun run dev:backend\" \"bun run dashboard:dev\"",
-    "typecheck": "tsc --noEmit",
-    "test:watch": "bun run scripts/test/run.ts --watch",
-    "test-db:up": "docker compose -f docker-compose.test.yml up -d --wait postgres-test",
-    "dev:backend": "bun run --hot src/main.ts",
-    "dev:console-auth": "bun run scripts/test/console-session.ts",
-    "dev:visual-baseline": "bun run scripts/test/visual-baseline.ts",
-    "build:binary": "bun run scripts/build/compile.ts",
-    "test:backend": "bun run scripts/test/run.ts --scope backend",
-    "test:integration": "bun run scripts/test/run.ts --scope integration",
-    "test-db:down": "docker compose -f docker-compose.test.yml down",
-    "dashboard:dev": "bun run --cwd dashboard dev",
-    "test-db:check": "bun run scripts/test/check-db.ts",
-    "dashboard:test": "bun run scripts/test/run.ts --scope dashboard",
-    "test-db:reset": "docker compose -f docker-compose.test.yml down -v && docker compose -f docker-compose.test.yml up -d --wait postgres-test",
-    "dashboard:build": "bun run --cwd dashboard build",
-    "dashboard:typecheck": "bun run --cwd dashboard typecheck",
-    "check:migrations": "bun run scripts/test/check-migrations.ts"
-  },
-  "dependencies": {
-    "drizzle-orm": "0.45.2",
-    "elysia": "2.0.0-beta.16",
-    "enquirer": "^2.4.1",
-    "ioredis": "6.0.0",
-    "jose": "^6.2.12",
-    "jsonrepair": "^3.15.0",
-    "pg": "8.23.0",
-    "pino": "^10.3.1",
-    "pino-pretty": "^13.1.3",
-    "protobufjs": "^7.6.5",
-    "socks-proxy-agent": "^10.1.0",
-    "systray2": "2.1.4",
-    "typebox": "1.3.27",
-    "ws": "8.22.0"
-  },
-  "devDependencies": {
-    "@types/pg": "8.11.10",
-    "@types/ws": "8.18.1",
-    "bun-types": "1.4.0",
-    "concurrently": "^10.0.5",
-    "drizzle-kit": "^0.31.11",
-    "typescript": "5.9.2"
-  }
-}
+{
+  "name": "cartethyia",
+  "version": "2.6.4",
+  "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
+  "license": "GPL-3.0-only",
+  "type": "module",
+  "packageManager": "bun@1.4.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/risunCodex/Cartethyia.git"
+  },
+  "homepage": "https://github.com/risunCodex/Cartethyia#readme",
+  "bugs": {
+    "url": "https://github.com/risunCodex/Cartethyia/issues"
+  },
+  "keywords": [
+    "ai",
+    "gateway",
+    "llm",
+    "bun",
+    "self-hosted"
+  ],
+  "bin": {
+    "cartethyia": "scripts/cli/bin/cartethyia.cjs",
+    "carte": "scripts/cli/bin/carte.cjs"
+  },
+  "files": [
+    "scripts/cli/",
+    "src/",
+    "migrations/",
+    "dist/dashboard/",
+    ".env.example",
+    "README.md"
+  ],
+  "workspaces": [
+    "dashboard"
+  ],
+  "engines": {
+    "bun": ">=1.4.0"
+  },
+  "scripts": {
+    "dev": "bun run dev:stack",
+    "dev:watch": "bun run scripts/dev/supervisor.ts",
+    "test": "bun run scripts/test/run.ts",
+    "build": "bun run scripts/build/build.ts",
+    "prepack": "bun run dashboard:build",
+    "setup": "bun run scripts/cli/setup.ts",
+    "start": "bun run scripts/cli/main.ts start",
+    "doctor": "bun run scripts/cli/doctor.ts",
+    "probe:egress": "bun run scripts/tools/probe-egress.ts",
+    "restart": "bun run scripts/build/restart.ts",
+    "build:aot": "bun run scripts/build/aot.ts",
+    "dev:stack": "concurrently -n BACKEND,DASHBOARD -c cyan,magenta --kill-others-on-fail \"bun run dev:backend\" \"bun run dashboard:dev\"",
+    "typecheck": "tsc --noEmit",
+    "test:watch": "bun run scripts/test/run.ts --watch",
+    "test-db:up": "docker compose -f docker-compose.test.yml up -d --wait postgres-test",
+    "dev:backend": "bun run --hot src/main.ts",
+    "dev:console-auth": "bun run scripts/test/console-session.ts",
+    "dev:visual-baseline": "bun run scripts/test/visual-baseline.ts",
+    "build:binary": "bun run scripts/build/compile.ts",
+    "test:backend": "bun run scripts/test/run.ts --scope backend",
+    "test:integration": "bun run scripts/test/run.ts --scope integration",
+    "test-db:down": "docker compose -f docker-compose.test.yml down",
+    "dashboard:dev": "bun run --cwd dashboard dev",
+    "test-db:check": "bun run scripts/test/check-db.ts",
+    "dashboard:test": "bun run scripts/test/run.ts --scope dashboard",
+    "test-db:reset": "docker compose -f docker-compose.test.yml down -v && docker compose -f docker-compose.test.yml up -d --wait postgres-test",
+    "dashboard:build": "bun run --cwd dashboard build",
+    "dashboard:typecheck": "bun run --cwd dashboard typecheck",
+    "check:migrations": "bun run scripts/test/check-migrations.ts"
+  },
+  "dependencies": {
+    "drizzle-orm": "0.45.2",
+    "elysia": "2.0.0-beta.16",
+    "enquirer": "^2.4.1",
+    "ioredis": "6.0.0",
+    "jose": "^6.2.12",
+    "jsonrepair": "^3.15.0",
+    "pg": "8.23.0",
+    "pino": "^10.3.1",
+    "pino-pretty": "^13.1.3",
+    "protobufjs": "^7.6.5",
+    "socks-proxy-agent": "^10.1.0",
+    "systray2": "2.1.4",
+    "typebox": "1.3.27",
+    "ws": "8.22.0"
+  },
+  "devDependencies": {
+    "@types/pg": "8.11.10",
+    "@types/ws": "8.18.1",
+    "bun-types": "1.4.0",
+    "concurrently": "^10.0.5",
+    "drizzle-kit": "^0.31.11",
+    "typescript": "5.9.2"
+  }
+}

package/src/boot/app.ts

@@ -269,7 +269,17 @@ export function createGatewayApp(deps: GatewayAppDeps) {
   const INFLIGHT_BACKSTOP_INTERVAL_MS = 30_000;
   const INFLIGHT_BACKSTOP_GRACE_MS = 30_000;
   const INFLIGHT_BACKSTOP_HARD_GRACE_MS = 120_000;
-  if (deps.mode === "production") deps.scheduledTasks?.register({
+  // Registered in every mode, not just production. The gauge is the operator's
+  // concurrency signal, and a cancelled request that never ran a finalizer
+  // leaves its flight behind — gating the only thing that reaps those on
+  // production made a permanently wrong count depend on how the gateway was
+  // started. The registry exists in every mode, so there is no mode where
+  // running this is wrong.
+  // `scheduledTasks` is declared on the production shape only, so it is
+  // narrowed rather than reached through the union — a shell composition
+  // without the registry simply skips the backstop, exactly as before.
+  const backstopTasks = "scheduledTasks" in deps ? deps.scheduledTasks : undefined;
+  backstopTasks?.register({
     name: "inflight-backstop",
     intervalMs: INFLIGHT_BACKSTOP_INTERVAL_MS,
     run: () => {

package/src/console/providers/catalog/contracts.ts

@@ -509,6 +509,13 @@ export interface ProviderAccountResponse {
   credentialKind: CredentialKind;
   credentialMode?: CredentialMode;
   tokenExpiresAt?: string;
+  /**
+   * Who issued this credential, read from the JWT `iss` claim at registration
+   * time. Present only for static JWTs, and only when the payload carried the
+   * claim: the secret is never readable after registration, so this is the one
+   * record of where the token came from.
+   */
+  jwtIssuer?: string;
   status: string;
   /** Live routing admission count for this request path; absent when unavailable. */
   inflight?: number;

package/src/console/providers/catalog/store.ts

@@ -59,11 +59,26 @@ function parseExpiry(value: unknown): Date | undefined {
   }
   return undefined;
 }
-function parseJwtCredential(raw: string): { readonly expiresAt?: Date } | undefined {
+/**
+ * Reads the two claims a static token's own payload can answer: when it stops
+ * working, and who issued it.
+ *
+ * The issuer is kept because a static JWT carries no other hint of its origin:
+ * an operator who pasted one from the wrong surface has nothing in the console
+ * to check it against, and several issuers accept the same token shape.
+ */
+function parseJwtCredential(
+  raw: string,
+): { readonly expiresAt?: Date; readonly issuer?: string } | undefined {
   const payload = decodeJwtPayload(raw.trim());
   if (payload === undefined) return undefined;
   const expiresAt = parseExpiry(payload["exp"]);
-  return expiresAt === undefined ? {} : { expiresAt };
+  const iss = payload["iss"];
+  const issuer = typeof iss === "string" && iss.trim().length > 0 ? iss.trim() : undefined;
+  return {
+    ...(expiresAt === undefined ? {} : { expiresAt }),
+    ...(issuer === undefined ? {} : { issuer }),
+  };
 }
 
 /**
@@ -1124,6 +1139,7 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
         const requestedCredentialMode: CredentialMode = request.credentialMode ?? "auto";
         let effectiveCredentialMode: CredentialMode = requestedCredentialMode;
         let tokenExpiresAt: Date | undefined;
+        let jwtIssuer: string | undefined;
         let oauthRefreshCiphertext: Buffer | undefined;
         let oauthExpiresAt: Date | undefined;
         let oauthHasRefreshToken = false;
@@ -1160,6 +1176,9 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
             effectiveCredentialKind = "api_key";
             effectiveCredentialMode = "jwt";
             tokenExpiresAt = parsedJwt.expiresAt;
+            // Kept alongside the expiry: the console shows who issued a static
+            // token, and the secret itself is never readable after this point.
+            jwtIssuer = parsedJwt.issuer;
           } else if (request.credentialKind === "oauth" || hasRefreshToken) {
             effectiveSecret = parts.accessToken;
             effectiveCredentialKind = hasRefreshToken ? "oauth" : "api_key";
@@ -1185,6 +1204,7 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
           ...(request.authState ?? {}),
           credentialMode: effectiveCredentialMode,
           ...(tokenExpiresAt === undefined ? {} : { tokenExpiresAt: tokenExpiresAt.toISOString() }),
+          ...(jwtIssuer === undefined ? {} : { jwtIssuer }),
         };
         const nextSortIndex =
           sortIndexOverride ?? (await this.nextAccountSortIndex(tx, providerId, tenantId));
@@ -1409,6 +1429,8 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
         : undefined;
     const tokenExpiresAt =
       typeof authState?.["tokenExpiresAt"] === "string" ? authState["tokenExpiresAt"] : undefined;
+    const jwtIssuer =
+      typeof authState?.["jwtIssuer"] === "string" ? authState["jwtIssuer"] : undefined;
     return {
       id: row.id,
       providerId: row.providerId,
@@ -1417,6 +1439,7 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
       credentialKind: row.credentialKind,
       ...(credentialMode === undefined ? {} : { credentialMode }),
       ...(tokenExpiresAt === undefined ? {} : { tokenExpiresAt }),
+      ...(jwtIssuer === undefined ? {} : { jwtIssuer }),
       status: row.status,
       ...(usage.inflight === undefined ? {} : { inflight: usage.inflight }),
       usageToday: usage.today,

package/src/observability/event-query.ts

@@ -215,7 +215,8 @@ export function eventRecordFromRow(row: {
  */
 function isPostgres(db: CartethyiaDatabase): boolean {
   const dialect = (db as unknown as { dialect?: { constructor?: { name?: string } } }).dialect;
-  return dialect?.constructor?.name === "PostgresDialect";
+  const name = dialect?.constructor?.name;
+  return name === "PostgresDialect" || name === "PgDialect";
 }
 
 /**
@@ -508,9 +509,14 @@ export async function chartTelemetry(
   bucketSeconds: number,
 ): Promise<ChartBucket[]> {
   const width = Math.max(1, Math.trunc(bucketSeconds));
+  // Inlined (not parameterised) so Postgres sees the SELECT and GROUP BY
+  // expressions as identical: parameter numbers differing between the two
+  // clauses made Postgres treat them as unrelated expressions referencing
+  // `created_at`, which 42803-rejected the query.
+  const w = sql.raw(String(width));
   const bucketExpression = isPostgres(db)
-    ? sql<number>`(cast(extract(epoch from ${telemetryEvents.createdAt}) as bigint) / ${width}) * ${width}`
-    : sql<number>`(cast(strftime('%s', ${telemetryEvents.createdAt}) as integer) / ${width}) * ${width}`;
+    ? sql<number>`(cast(extract(epoch from ${telemetryEvents.createdAt}) as bigint) / ${w}) * ${w}`
+    : sql<number>`(cast(strftime('%s', ${telemetryEvents.createdAt}) as integer) / ${w}) * ${w}`;
   const rows = await db
     .select({
       at: bucketExpression,
@@ -521,8 +527,7 @@ export async function chartTelemetry(
     })
     .from(telemetryEvents)
     .where(scoped(tenantId, since))
-    .groupBy(bucketExpression)
-    .orderBy(bucketExpression);
+    .groupBy(bucketExpression);
   return rows.map((row) => ({
     at: numeric(row.at) * 1000,
     requests: numeric(row.requests),

package/src/providers/operations/account-health-service.ts

@@ -160,7 +160,29 @@ export type AccountErrorCategory =
   | "model_capacity"
   | "model_unreachable"
   | "auth_invalidated"
+  /**
+   * Deprecated: an upstream ban. Kept so existing health rows keep rendering
+   * instead of showing a blank cause. No longer produced — see
+   * `policy_blocked_banned` and `policy_blocked_invalid_request`.
+   */
   | "policy_blocked"
+  /**
+   * The upstream banned this credential: a verdict on the account, e.g. buddy
+   * `11140` "request illegal" with "Your account has been restricted due to
+   * unusual activity". Cooldown cannot help — the account is not throttled, it
+   * is refused. Disabling immediately is a *feature*: a client's retry budget
+   * is spent in seconds, so surviving attempts burn sibling accounts that are
+   * still healthy.
+   */
+  | "policy_blocked_banned"
+  /**
+   * The upstream refused this request: a verdict on the request. e.g. buddy
+   * `11-128` "request illegal" with no account restriction. Distinguished from
+   * {@link policy_blocked_banned} because the correct responses differ — a
+   * banned account must be disabled, a malformed request must only stop being
+   * retried verbatim.
+   */
+  | "policy_blocked_invalid_request"
   | "server_error"
   | "timeout"
   | "unknown";
@@ -338,6 +360,35 @@ function accountDeadlineMs(
   return latest > 0 ? new Date(latest) : null;
 }
 
+/**
+ * Whether the upstream named a restriction on the account itself.
+ *
+ * The buddy family reuses "request illegal" for two unrelated rejections, and
+ * the difference is only in the body:
+ *
+ * - `11140` carries `displayMsg` about the account being restricted ("Your
+ *   account has been restricted due to unusual activity") and `actions`
+ *   offering an appeal. That is a ban — the account is refused, not throttled.
+ * - `11-128` is a refusal of this request; the account is fine.
+ *
+ * Proven account-scoped (2026-10-16): two live share-page requests carrying
+ * byte-identical bodies and headers to the same model differed only in the
+ * pooled account, and the blocked one 400'd while the other 200'd.
+ *
+ * Matched on the code *and* the account-restriction wording, so an unrelated
+ * upstream that happens to say "restricted" in prose cannot disable accounts.
+ */
+function isBuddyAccountBanned(lower: string, providerCode: string): boolean {
+  if (providerCode !== "11140") return false;
+  return (
+    lower.includes("restricted") ||
+    lower.includes("has been banned") ||
+    lower.includes("unusual activity") ||
+    lower.includes("appeal this restriction") ||
+    lower.includes("submit feedback to appeal")
+  );
+}
+
 /**
  * Bounded to a day, matching `MAX_COOLDOWN_MS` in the failure policy: a stated
  * window longer than that is a monthly or plan-level limit, and parking an
@@ -421,6 +472,12 @@ interface AccountErrorContext {
   readonly canMutate: boolean;
   readonly providerCode: string;
   readonly statedCooldownMs: number | null;
+  /**
+   * The upstream named a restriction on the account, not a refusal of the
+   * request. Read by the policy arm to pick between disabling the account and
+   * merely refusing the request.
+   */
+  readonly buddyBanned: boolean;
   readonly reason: (prefix: string) => string;
   readonly result: (
     category: AccountErrorCategory,
@@ -476,6 +533,13 @@ interface AccountErrorSignals {
   readonly credentialKind: string | undefined;
   /** Buddy-family provider: the only family with provider-specific codes below. */
   readonly buddy: boolean;
+  /**
+   * The upstream named a restriction on this account, not a refusal of the
+   * request. Only the `11140` shape carries `displayMsg` about the account
+   * being restricted, so the policy arm can tell a ban from a bad request
+   * instead of treating both as one cooldown.
+   */
+  readonly buddyBanned: boolean;
   readonly priceRefusal: boolean;
   readonly deploymentInfraError: boolean;
   readonly quotaSignal: boolean;
@@ -601,6 +665,7 @@ function accountErrorContext(error: unknown, options?: AccountFailureEvidence):
     canMutate,
     providerCode,
     statedCooldownMs,
+    buddyBanned: isBuddyAccountBanned(lower, providerCode),
     reason,
     result,
   };
@@ -623,6 +688,7 @@ export function classifyAccountError(
     providerCode,
 
     statedCooldownMs,
+    buddyBanned,
     reason,
     result,
   } = accountErrorContext(error, options);
@@ -761,19 +827,46 @@ export function classifyAccountError(
     lower.includes("request illegal") ||
     lower.includes("content blocked") ||
     lower.includes("account suspended");
+  // A ban is a verdict on the credential, and cooldown cannot answer it: the
+  // account is refused, not throttled. Disabling is the fix, and disabling
+  // *immediately* is a feature — a client's retry budget is spent in seconds,
+  // so a banned account that merely cooled stayed in the plan and burned
+  // sibling accounts that were still healthy before the window expired.
+  //
+  // The two shapes are told apart by the body, not the code alone: `11140`
+  // names a restriction on the account, `11-128` refuses the request.
   const policyBlock =
     policyRejection &&
     options?.providerId !== undefined &&
     BUDDY_PROVIDER_IDS.has(options.providerId.toLowerCase());
   if (policyBlock) {
-    const policyBlockMs = resolveAccountPolicyBlockCooldownMs();
+    if (buddyBanned) {
+      return result(
+        "policy_blocked_banned",
+        "disabled",
+        0,
+        null,
+        reason("Account banned by upstream"),
+        // A ban is evidence about the credential even at provider scope, for
+        // the same reason a named revocation is: the message is the evidence.
+        // Without this a stream frame's missing credential detail would leave a
+        // banned account serving.
+        true,
+      );
+    }
+    // Not a ban: the upstream refused this request. The account is fine, so the
+    // only correct move is to stop retrying it verbatim. Cooling the account
+    // here was the bug that made one malformed request look like a dead
+    // credential.
     return result(
-      "policy_blocked",
+      "policy_blocked_invalid_request",
       "cooldown",
-      policyBlockMs,
-      new Date(Date.now() + policyBlockMs),
-      reason("Provider content-policy block"),
-      origin === "upstream",
+      0,
+      null,
+      reason("Upstream refused this request"),
+      // Never mutates: a malformed body fails identically on every account, so
+      // cooling would burn a healthy credential on the gateway's own fault.
+      false,
     );
   }
   // These codes are a verdict on the request, not the account. Cooling the
@@ -829,14 +922,30 @@ export function classifyAccountError(
     options?.providerId !== undefined &&
     BUDDY_PROVIDER_IDS.has(options.providerId.toLowerCase());
   if (channelBlock) {
-    const channelBlockMs = resolveAccountPolicyBlockCooldownMs();
+    // Same split as the policy arm above: a ban disables, a channel refusal
+    // only stops this request. `11-128` is the request shape, so this branch
+    // nearly always takes the refusal path — but it shares the ban test so a
+    // `11140`-shaped body arriving as a channel rejection still disables.
+    if (buddyBanned) {
+      return result(
+        "policy_blocked_banned",
+        "disabled",
+        0,
+        null,
+        reason("Account banned by upstream"),
+        true,
+      );
+    }
     return result(
-      "policy_blocked",
+      "policy_blocked_invalid_request",
       "cooldown",
-      channelBlockMs,
-      new Date(Date.now() + channelBlockMs),
+      0,
+      null,
       reason("Provider channel rejection"),
-      origin === "upstream",
+      // The credential is valid; the upstream refuses this calling channel.
+      // Cooling was the bug: it kept a refused account in the plan, where a
+      // client's retry budget burned healthy siblings for the whole window.
+      false,
     );
   }
   // server-side tool (web search, x search, web fetch), not evidence about the
@@ -907,6 +1016,7 @@ export function classifyAccountError(
     staticToken,
     credentialKind,
     buddy,
+    buddyBanned,
     priceRefusal,
     deploymentInfraError,
     quotaSignal,
@@ -941,6 +1051,62 @@ export function classifyAccountError(
  * {@link AccountErrorRule}.
  */
 const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
+  {
+    // Must precede "rate-limit": this rejection is a 429 whose own text says
+    // "rate limit", so the broader arm claimed it and cooled the account for
+    // the full 15-minute rate-limit window.
+    //
+    // A full max-inflight is a statement about the gateway's own routing, not
+    // about the credential: every account serving the model is busy right now.
+    // Cooling them marks healthy accounts as `cooldown` for a limit their
+    // provider never applied, which is what made every account read busy while
+    // incoming requests piled up — the accounts were never the problem, the
+    // ceiling was.
+    name: "gateway-capacity-exhausted",
+    match: (s) =>
+      s.lower.includes("at its concurrency limit") ||
+      s.lower.includes("every proxy pool for this provider is at its concurrency limit") ||
+      s.lower.includes("the gateway is at its concurrency limit"),
+    decide: (s) =>
+      s.result(
+        "model_capacity",
+        // `status` is the status the account would move to; it is never
+        // applied because `mutatesAccount` is false below, so this names the
+        // shape rather than a transition. Zero cooldown is the point: no wait
+        // is attached to the account, so the next request may use it at once.
+        "cooldown",
+        0,
+        null,
+        s.reason("Gateway concurrency ceiling reached; no account was at fault"),
+        // Never mutates: there is nothing wrong with the account to record.
+        false,
+      ),
+  },
+  {
+    // Must precede the unclassified fallback: the fallback is account-blind and
+    // would stamp this as a provider-wide failure, which is how one proxy
+    // refusing CONNECT put every account of every provider behind that pool
+    // into cooldown — opencode's dead front door taking codebuddy down with it.
+    //
+    // A CONNECT refusal is a statement about the proxy pool, not about a
+    // credential: the tunnel was never established, so no upstream ever saw the
+    // request and no account can be at fault. Scoped to the pool so the
+    // provider's own accounts stay in rotation.
+    name: "proxy-connect-refusal",
+    match: (s) =>
+      s.lower.includes("proxy connect failed") ||
+      (s.lower.includes("connect") && s.lower.includes("tunnel") && s.lower.includes("refus")),
+    decide: (s) =>
+      s.result(
+        "model_unreachable",
+        "cooldown",
+        0,
+        null,
+        s.reason("Proxy pool refused the CONNECT tunnel"),
+        // Never mutates: the pool owns this failure, not the account.
+        false,
+      ),
+  },
   {
     name: "deployment-infrastructure",
     match: (s) => s.deploymentInfraError,
@@ -976,14 +1142,42 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
     name: "content-policy-block",
     match: (s) => s.policyRejection && s.buddy,
     decide: (s) => {
-      const policyBlockMs = resolveAccountPolicyBlockCooldownMs();
+      // A ban is a verdict on the credential, and cooldown cannot answer it:
+      // the account is refused, not throttled. Disabling is the fix, and
+      // disabling *immediately* is a feature — a client's retry budget is spent
+      // in seconds, so a banned account that merely cooled stayed in the plan
+      // and burned sibling accounts that were still healthy before the window
+      // expired.
+      //
+      // The two shapes are told apart by the body, not the code alone: `11140`
+      // names a restriction on the account, `11-128` refuses the request.
+      if (s.buddyBanned) {
+        return s.result(
+          "policy_blocked_banned",
+          "disabled",
+          0,
+          null,
+          s.reason("Account banned by upstream"),
+          // A ban is evidence about the credential even at provider scope, for
+          // the same reason a named revocation is: the message is the evidence.
+          // Without this a stream frame's missing credential detail would leave
+          // a banned account serving.
+          true,
+        );
+      }
+      // Not a ban: the upstream refused this request. The account is fine, so
+      // the only correct move is to stop retrying it verbatim. Cooling the
+      // account here was the bug that made one malformed request look like a
+      // dead credential.
       return s.result(
-        "policy_blocked",
+        "policy_blocked_invalid_request",
         "cooldown",
-        policyBlockMs,
-        new Date(Date.now() + policyBlockMs),
-        s.reason("Provider content-policy block"),
-        s.origin === "upstream",
+        0,
+        null,
+        s.reason("Upstream refused this request"),
+        // Never mutates: a malformed body fails identically on every account,
+        // so cooling would burn a healthy credential on the gateway's own fault.
+        false,
       );
     },
   },