cartethyia 2.6.7 → 2.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.6.7",
+  "version": "2.7.1",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",

package/scripts/cli/console-menu.ts

@@ -18,7 +18,6 @@ import { exportBackup, resetConsoleAccount } from "./admin";
 import { printUpdateInstructions, runDetachedUpdate } from "./update";
 import { acquireController } from "./controller";
 import { restoreControllerAfterFailedHandoff } from "./controller";
-import { attachGateway as attachRunningGateway } from "./instance";
 
 /**
  * Seconds to keep the update notice on screen before returning to the shell.
@@ -316,7 +315,11 @@ async function runMenu(handoff: { readonly token: string; readonly parentPid: nu
   // would stop the very process the tray just adopted, which is why the menu
   // appeared to hand over a gateway that was not listening.
   if (handedOff) return;
-  if (runningAttached !== null || (await attachRunningGateway(port, drainToken)) !== null) {
+  // An attached (externally owned) gateway is left running for its owner; our
+  // own child is drained before the menu returns to the shell. `attachGateway`
+  // is deliberately NOT probed again here: it would always see our own child's
+  // lock and turn a clean drain into a rough kill on the exit backstop.
+  if (runningAttached !== null) {
     detachAttached();
     return;
   }

package/scripts/cli/tray.ts

@@ -64,15 +64,16 @@ export async function startTray(): Promise<void> {
   const handoff = inheritedControllerHandoff();
   const controller = acquireController("tray", handoff);
   const releaseController = (): void => controller.release();
-  const failedHandoff = (): void => {
-    if (handoff) restoreControllerAfterFailedHandoff(handoff);
-  };
-  process.once("exit", failedHandoff);
   process.once("exit", releaseController);
   try {
     await runTray();
+  } catch (error) {
+    // Only a tray that never became ready restores the menu's lease. After a
+    // successful handoff the tray owns the controller; restoring it on a later
+    // normal exit would pin a controller record to the long-gone menu pid.
+    if (handoff) restoreControllerAfterFailedHandoff(handoff);
+    throw error;
   } finally {
-    process.removeListener("exit", failedHandoff);
     controller.release();
     process.removeListener("exit", releaseController);
   }
@@ -174,7 +175,21 @@ async function runTray(): Promise<void> {
     // over HTTP before it ever reaches for `kill()`, so detaching costs the
     // exit path nothing: the tray can still stop the gateway on Exit.
     adoptedGateway = await attachGateway(port, drainToken);
-    if (adoptedGateway === null) gateway = await startGateway(port, drainToken, { detached: true });
+    if (adoptedGateway === null) {
+      gateway = await startGateway(port, drainToken, { detached: true });
+    } else {
+      // The adopted gateway was started by the menu as a non-detached child of
+      // the menu's console. When the menu exits — and especially when the
+      // operator closes that terminal window afterwards — Windows delivers
+      // CTRL_CLOSE to the whole console group and the gateway (handling
+      // SIGTERM) shuts down with it: "Hide to tray" left nothing serving. The
+      // menu cannot hand the same process off to another console, so re-cycle
+      // it into a detached gateway now, before reporting ready, so the tray
+      // owns a gateway that is not attached to any console after the handoff.
+      await stopAttachedGateway(adoptedGateway, drainToken);
+      adoptedGateway = null;
+      gateway = await startGateway(port, drainToken, { detached: true });
+    }
     // The launcher that spawned this tray is blocked on a signal file: it
     // cannot read our stdio, because the tray is detached. Without this write
     // it waits out its 60 s deadline and reports a failure for a tray that is

package/src/boot/app.ts

@@ -30,8 +30,8 @@ import { ProxyRequestStateStore } from "../transport/request/state";
 import { fastPathname } from "../transport/pathname";
 import {
   handleProviderProxyRequest,
-  type ProviderProxyHandlerDeps,
 } from "../transport/dispatch/proxy-request";
+import type { GatewayHandlerDeps } from "../transport/dispatch/handler-deps";
 import { createResponsesCompactHandler } from "../transport/dispatch/responses-compact";
 import { createSystemoneHandler } from "../transport/dispatch/systemone";
 import { createWebsearchHandler } from "../transport/dispatch/websearch";
@@ -45,7 +45,6 @@ import {
 import { createTokenCountHandler } from "../transport/dispatch/token-count";
 
 import { createTransportPipeline } from "../transport/guards/pipeline";
-import { defaultProcessConcurrencyController } from "../transport/guards/concurrency-guard";
 import { createDrainHandler, isLoopbackPeer, tokenMatches } from "../transport/drain-endpoint";
 import { createConsoleAccountResetHandler } from "../console/auth/account-reset";
 import { resetConsoleAuthState } from "../console/auth/account-reset-store";
@@ -61,7 +60,6 @@ import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
 import { metrics } from "../observability/metrics";
 import type { RuntimeMetricsSampler } from "../observability/runtime-metrics";
 import { API_CONTENT_SECURITY_POLICY, X_FRAME_OPTIONS } from "../security/outbound-headers";
-import type { ModelStrikeService } from "../security/model-abuse";
 
 
 import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
@@ -112,7 +110,6 @@ export interface ProductionAppDeps {
   readonly db: CartethyiaDatabase;
   readonly proxyPreparer: ProxyRequestPreparer;
   readonly resolveProviderAdapter: (providerId: string) => Promise<ProviderAdapter | undefined>;
-  readonly providerAdapters?: ReadonlyMap<string, ProviderAdapter>;
   /** Live lookup of a provider's SSRF-validated upstream host. */
   readonly byokUpstreamHosts: { readonly get: (providerId: string) => ByokUpstreamHost | undefined };
   readonly networkBindingFactory: ValidatedNetworkBindingFactory;
@@ -125,7 +122,6 @@ export interface ProductionAppDeps {
   readonly resolveOAuthRefresher: (providerId: string) => Promise<OAuthTokenRefresher | undefined>;
   readonly oauthRefreshService: OAuthRefreshService;
   /** Graduated strikes for repeated invalid-model requests. */
-  readonly modelStrikes?: ModelStrikeService;
   /**
    * The console control plane. Optional so reduced compositions (route-only
    * shell, console stubs) stay valid; production always mounts it. Without
@@ -245,10 +241,6 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     deps.mode === "production" ? deps.shutdownCoordinator : undefined,
   );
   deps.runtimeMetricsSampler?.bindInFlight(() => requestStateStore.inFlightCount());
-  // The concurrency ceiling is derived (memory limit ÷ body budget), so it is
-  // published as a gauge: an operator reading "shedding at 16 in flight" needs
-  // to see that 16 IS the limit on this box, not that the process is broken.
-  deps.runtimeMetricsSampler?.bindConcurrencyLimit(defaultProcessConcurrencyController.limit());
   // Shutdown ordering: abort in-flight proxy controllers first so the
   // bounded drain observes cancellation and finalizers run before
   // telemetry flush and pool close. The reason is threaded through so the
@@ -282,6 +274,9 @@ export function createGatewayApp(deps: GatewayAppDeps) {
   backstopTasks?.register({
     name: "inflight-backstop",
     intervalMs: INFLIGHT_BACKSTOP_INTERVAL_MS,
+    // Same stagger rationale as account-health-sweep: keep the 30s cluster
+    // from aligning under the single-flight gate.
+    initialDelayMs: 15_000,
     run: () => {
       requestStateStore.sweepOverdueInFlight(
         Date.now(),
@@ -392,7 +387,6 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       ...(deps.verifiedHttps ? { verifiedHttps: true } : {}),
       shutdownCoordinator: deps.shutdownCoordinator,
       telemetry: deps.telemetryBuffer,
-      ...(deps.modelStrikes ? { modelStrikes: deps.modelStrikes } : {}),
       ...(deps.consoleApi?.redis ? { redis: deps.consoleApi.redis } : {}),
       // Bound at construction so the guard holds the sampler's live snapshot
       // rather than a value captured at boot.
@@ -406,22 +400,27 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         (await deps.snapshotService.getSnapshot())?.invokeDisabledTenants?.has(tenantId),
     });
     transportPipeline.mountRoot(app);
-    const proxyDeps: ProviderProxyHandlerDeps = {
+    // One dependency bundle for every gateway handler. Proxy, generation,
+    // responses-compact, system one, web search, and token count all receive
+    // the same wiring — a handler dep is added once, here, not in five
+    // literals.
+    const gatewayDeps: GatewayHandlerDeps = {
       db: deps.db,
-      providerAdapters: deps.providerAdapters ?? new Map(),
       resolveProviderAdapter: deps.resolveProviderAdapter,
       stateStore: requestStateStore,
       proxyPreparer: deps.proxyPreparer,
       snapshotService: deps.snapshotService,
       networkBindingFactory: deps.networkBindingFactory,
-      byokUpstreamHosts: deps.byokUpstreamHosts,
       poolSelector: deps.poolSelector,
       telemetryBuffer: deps.telemetryBuffer,
       resolveOAuthRefresher: deps.resolveOAuthRefresher,
       oauthRefreshService: deps.oauthRefreshService,
     };
     const proxyHandler = ({ request }: { request: Request }) =>
-      handleProviderProxyRequest(request, proxyDeps);
+      handleProviderProxyRequest(request, {
+        ...gatewayDeps,
+        byokUpstreamHosts: deps.byokUpstreamHosts,
+      });
 
     const publicModelStore = new PublicModelCatalogStore(deps.db);
     const queryAllowedModels = (auth: {
@@ -483,16 +482,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     };
 
     const handleResponsesCompact = createResponsesCompactHandler({
-      db: deps.db,
-      providerAdapters: deps.providerAdapters ?? new Map(),
-      resolveProviderAdapter: deps.resolveProviderAdapter,
-      proxyPreparer: deps.proxyPreparer,
-      stateStore: requestStateStore,
-      poolSelector: deps.poolSelector,
-      networkBindingFactory: deps.networkBindingFactory,
-      snapshotService: deps.snapshotService,
-      resolveOAuthRefresher: deps.resolveOAuthRefresher,
-      oauthRefreshService: deps.oauthRefreshService,
+      ...gatewayDeps,
       // The compact handler completes its attempt through `completeAttempt`,
       // which marks the request completed and finalizes telemetry itself —
       // so the afterResponse lifecycle skips it. Without the buffer here the
@@ -501,48 +491,14 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     });
 
     const handleSystemone = createSystemoneHandler({
-      db: deps.db,
-      providerAdapters: deps.providerAdapters ?? new Map(),
-      resolveProviderAdapter: deps.resolveProviderAdapter,
-      proxyPreparer: deps.proxyPreparer,
-      stateStore: requestStateStore,
-      poolSelector: deps.poolSelector,
-      networkBindingFactory: deps.networkBindingFactory,
-      snapshotService: deps.snapshotService,
-      resolveOAuthRefresher: deps.resolveOAuthRefresher,
-      oauthRefreshService: deps.oauthRefreshService,
+      ...gatewayDeps,
       // Same reasoning as compact: the handler finalizes telemetry itself, so
       // the buffer must be threaded here or the route emits no row.
       telemetryBuffer: deps.telemetryBuffer,
     });
 
-    const handleWebsearch = createWebsearchHandler({
-      db: deps.db,
-      providerAdapters: deps.providerAdapters ?? new Map(),
-      resolveProviderAdapter: deps.resolveProviderAdapter,
-      proxyPreparer: deps.proxyPreparer,
-      stateStore: requestStateStore,
-      poolSelector: deps.poolSelector,
-      networkBindingFactory: deps.networkBindingFactory,
-      snapshotService: deps.snapshotService,
-      resolveOAuthRefresher: deps.resolveOAuthRefresher,
-      oauthRefreshService: deps.oauthRefreshService,
-      telemetryBuffer: deps.telemetryBuffer,
-    });
-
-    const generationDeps = {
-      db: deps.db,
-      providerAdapters: deps.providerAdapters ?? new Map(),
-      resolveProviderAdapter: deps.resolveProviderAdapter,
-      proxyPreparer: deps.proxyPreparer,
-      stateStore: requestStateStore,
-      poolSelector: deps.poolSelector,
-      networkBindingFactory: deps.networkBindingFactory,
-      snapshotService: deps.snapshotService,
-      resolveOAuthRefresher: deps.resolveOAuthRefresher,
-      oauthRefreshService: deps.oauthRefreshService,
-      telemetryBuffer: deps.telemetryBuffer,
-    };
+    const handleWebsearch = createWebsearchHandler(gatewayDeps);
+    const generationDeps = gatewayDeps;
     const handleImageGeneration = createImageGenerationHandler(generationDeps);
     // Mounted with no model behind it on purpose: the surface exists so it can
     // be finished when an upstream is known, rather than 404ing like a typo.
@@ -660,6 +616,11 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       });
     }
 
+    // One share-link store for both surfaces: the public share router and the
+    // console's API-key/share domain wrap the same table, and one instance
+    // keeps the "one owner per store" convention.
+    const shareStore = new DrizzleShareLinkStore(deps.db);
+
     // `peerAddresses` is populated by the root `beforeHandle` above from
     // `server.requestIP`. The console login route needs it to key its lockout
     // bucket, and the trusted-proxy boundary decides whether an
@@ -669,6 +630,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       app.use(
         createConsoleRouter({
           ...deps.consoleApi,
+          ...(shareStore ? { shareStore } : {}),
           stateStore: requestStateStore,
           resolvePeerAddress: (request) => peerAddresses.get(request) ?? null,
           trustedProxyBoundary: deps.trustedProxyBoundary,
@@ -681,7 +643,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     app.use(
       createShareRouter({
         db: deps.db,
-        shareStore: new DrizzleShareLinkStore(deps.db),
+        shareStore,
         stats: createShareStatsPort({ db: deps.db, redis: deps.consoleApi?.redis }),
         resolveClientIp: (request) => {
           const peer = peerAddresses.get(request);