cartethyia 2.6.7 → 2.7.1

package/src/transport/failure-policy.ts

@@ -1,184 +1,26 @@
 import { GatewayError, type GatewayErrorCode, type GatewayErrorOrigin } from "../protocol/gateway-error";
 import { isRecord } from "../protocol/codecs";
 import { resolveFallbackRetryBaseMs, resolveFallbackRetryCapMs } from "../config/timeouts";
+import { parseUpstreamBackoff } from "../protocol/upstream-parsing";
 
-const MAX_UPSTREAM_ERROR_BYTES = 500;
-const MAX_COOLDOWN_MS = 24 * 3600 * 1000;
-
-/** Parses Retry-After seconds or an HTTP date, bounded to one day. */
-export function parseRetryAfter(value: string | null | undefined): number | null {
-  if (!value) return null;
-  const trimmed = value.trim();
-  const numeric = Number(trimmed);
-  if (Number.isFinite(numeric) && numeric > 0) return Math.min(MAX_COOLDOWN_MS, numeric * 1000);
-  const parsed = Date.parse(trimmed);
-  if (!Number.isFinite(parsed)) return null;
-  const delay = parsed - Date.now();
-  return delay > 0 ? Math.min(MAX_COOLDOWN_MS, delay) : null;
-}
-
-/**
- * Parses x-ratelimit-reset as epoch seconds or a relative delay.
- *
- * Returns `null` — not `0` — when the instant has already passed. This matters
- * because `parseUpstreamBackoff` chains these parsers with `??`, which falls
- * through only on null: a `0` from an elapsed `x-ratelimit-reset` (a cached error
- * body, clock skew, a stale edge response) stopped the chain before the
- * lower-priority headers that carried the real wait. The `0` was then written to
- * `details.retryAfterMs` and read by `classifyAccountError` as `headerCooldown`,
- * which outranks the provider's own message text — so both were discarded and the
- * account fell back to the generic default cooldown while the provider had parked
- * it for the rest of the window.
- *
- * `parseRetryAfter` above already returns `null` for an elapsed date; matching it
- * is what removes the asymmetry.
- */
-export function parseRateLimitReset(value: string | null | undefined): number | null {
-  if (!value) return null;
-  const numeric = Number(value.trim());
-  if (!Number.isFinite(numeric) || numeric <= 0) return null;
-  const target = numeric >= 1_000_000_000 ? numeric * 1000 : Date.now() + numeric * 1000;
-  const remaining = target - Date.now();
-  return remaining > 0 ? Math.min(MAX_COOLDOWN_MS, remaining) : null;
-}
-
-/** Parses a millisecond-denominated reset header (`retry-after-ms`, `x-ratelimit-reset-ms`). */
-export function parseResetAfterMs(value: string | null | undefined): number | null {
-  if (!value) return null;
-  const numeric = Number(value.trim());
-  if (!Number.isFinite(numeric) || numeric <= 0) return null;
-  return Math.min(MAX_COOLDOWN_MS, Math.round(numeric));
-}
-
-/**
- * Reads upstream backoff evidence in reference priority order: millisecond
- * variants first (`retry-after-ms`, then `x-ratelimit-reset-ms`), then the
- * classic `retry-after` / `x-ratelimit-reset` pair.
- */
-export function parseUpstreamBackoff(headers: {
-  get(name: string): string | null;
-}): number | null {
-  return (
-    parseResetAfterMs(headers.get("retry-after-ms")) ??
-    parseRetryAfter(headers.get("retry-after")) ??
-    parseResetAfterMs(headers.get("x-ratelimit-reset-ms")) ??
-    parseRateLimitReset(headers.get("x-ratelimit-reset")) ??
-    parseRateLimitReset(headers.get("x-ratelimit-reset-requests")) ??
-    parseRateLimitReset(headers.get("retry-after"))
-  );
-}
-
-/**
- * Extracts bounded reset durations from provider messages when headers omit
- * them.
- *
- * Two shapes are recognized, because providers state resets both ways:
- *
- *   - **Relative** — "quota will reset in 3 hours", "try again in 30s".
- *   - **Absolute** — "your usage will reset at 2026-09-24 02:12:51 UTC+8"
- *     (WorkBuddy/CodeBuddy `6004`). An absolute stamp is *not* a duration, and
- *     the relative-only pattern silently missed it, so the account fell back to
- *     the generic 15-minute default while the provider had actually parked it
- *     for the rest of the window — the account kept re-entering rotation and
- *     failing every request inside the stated reset window.
- */
 /**
- * One `amount unit` pair of a duration phrase: `4h`, `13m`, `2 hours`, `30s`.
+ * How much of the upstream's error body is kept and surfaced.
  *
- * The unit ends on `(?![a-z])`, not `\b`: a compact compound like `2h30m` puts
- * a digit straight after `h`, which is a word character, so a `\b` would refuse
- * to end the pair and the whole phrase would parse as null. `m(?!s|o)` is what
- * stops a bare `m` from swallowing `ms` (milliseconds) or `mo` (months),
- * neither of which is a reset duration.
+ * 500 bytes cut the CodeBuddy envelope mid-`extError`: the operator saw
+ * "request illegal" with none of the `displayMsg` prose that names the actual
+ * condition — "prompt is too long: 1048788 tokens > 1048576 maximum" — so a
+ * context overflow was indistinguishable from a policy refusal. The envelope
+ * runs a few KB; 4000 keeps the whole thing while bounding a hostile body.
  */
-const DURATION_PAIR_SOURCE = String.raw`(\d+(?:\.\d+)?)[\s-]*(hours?|hrs?|h|minutes?|mins?|m(?!s|o)|seconds?|secs?|s)(?![a-z])`;
-
-function durationUnitMs(unit: string): number {
-  const first = unit.toLowerCase()[0];
-  return first === "h" ? 3600_000 : first === "m" ? 60_000 : 1_000;
-}
-
-/**
- * Sums the `amount unit` pairs at the head of a duration phrase.
- *
- * Providers state a reset as one compound duration at least as often as a
- * single unit: a daily-limit 429 reads "Try again in 4h 13m". A single-pair
- * parser read only `4h` and dropped the 13 minutes, so the stored retry
- * deadline was earlier than the window the provider had actually stated and the
- * account re-entered rotation before it. Pairs are accepted only while they
- * continue the phrase — separated by whitespace, a comma, or `and` — so a
- * number that merely follows later in the sentence cannot be absorbed.
- */
-function parseCompoundDuration(text: string): number | null {
-  const pairs = new RegExp(DURATION_PAIR_SOURCE, "gi");
-  let totalMs = 0;
-  let lastEnd = 0;
-  let matched = false;
-  for (let pair = pairs.exec(text); pair !== null; pair = pairs.exec(text)) {
-    const gap = text.slice(lastEnd, pair.index);
-    const continues = matched ? /^[\s,]*(?:and\s+)?$/i.test(gap) : /^\s*$/.test(gap);
-    if (!continues) break;
-    const amount = Number(pair[1]);
-    if (!Number.isFinite(amount) || amount <= 0) break;
-    totalMs += amount * durationUnitMs(pair[2] ?? "");
-    matched = true;
-    lastEnd = pair.index + pair[0].length;
-  }
-  return matched ? Math.round(totalMs) : null;
-}
-
-export function parseProviderResetDuration(message: string): number | null {
-  const trigger =
-    /(?:quota will reset|resets?|try again|retry(?:ing)?)\s+(?:in|after|over)\s+(?:a\s+)?(?:rolling\s+)?/i.exec(
-      message,
-    );
-  if (trigger) {
-    const parsed = parseCompoundDuration(message.slice(trigger.index + trigger[0].length));
-    if (parsed !== null) return Math.min(MAX_COOLDOWN_MS, parsed);
-  }
-  return parseAbsoluteResetTimestamp(message);
-}
-
-/**
- * Reads an absolute reset instant out of a provider message, e.g.
- * `will reset at 2026-09-24 02:12:51 UTC+8`. Returns the delay from now,
- * bounded to one day, or null when no future timestamp is present.
- *
- * `Date.parse` cannot read the space-separated `YYYY-MM-DD HH:MM:SS` form with
- * a bare `UTC±H` offset, so the parts are normalized explicitly rather than
- * relying on engine-specific leniency.
- */
-export function parseAbsoluteResetTimestamp(message: string): number | null {
-  const match = /(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})\s*(?:UTC|GMT)?\s*([+-]\d{1,2})?(?::?(\d{2}))?/i.exec(
-    message,
-  );
-  if (!match) return null;
-  const [, year, month, day, hour, minute, second, offsetHours, offsetMinutes] = match;
-  if (!year || !month || !day || !hour || !minute || !second) return null;
-  // A bare `UTC+8` means a whole-hour offset; `+08:30`-style halves are rare
-  // but cheap to honor. No offset at all is read as UTC (providers that omit
-  // it always label the stamp "UTC" in practice).
-  const sign = offsetHours?.startsWith("-") ? -1 : 1;
-  const offsetTotalMinutes =
-    offsetHours === undefined
-      ? 0
-      : sign * (Math.abs(Number(offsetHours)) * 60 + Number(offsetMinutes ?? 0));
-  const utcMs = Date.UTC(
-    Number(year),
-    Number(month) - 1,
-    Number(day),
-    Number(hour),
-    Number(minute),
-    Number(second),
-  );
-  if (!Number.isFinite(utcMs)) return null;
-  const targetMs = utcMs - offsetTotalMinutes * 60_000;
-  const delay = targetMs - Date.now();
-  // A past stamp is not a usable reset (clock skew, stale cached error); fall
-  // through to the caller's default instead of returning a negative delay.
-  if (!Number.isFinite(delay) || delay <= 0) return null;
-  return Math.min(MAX_COOLDOWN_MS, Math.round(delay));
-}
+const MAX_UPSTREAM_ERROR_BYTES = 4000;
+export {
+  parseRetryAfter,
+  parseRateLimitReset,
+  parseResetAfterMs,
+  parseUpstreamBackoff,
+  parseProviderResetDuration,
+  parseAbsoluteResetTimestamp,
+} from "../protocol/upstream-parsing";
 /** Extracts a bounded, newline-free provider message from any error envelope. */
 export function extractUpstreamMessage(body: unknown): string {
   let raw = "";
@@ -544,7 +386,27 @@ export interface TerminalOutcome {
   readonly status: "cancelled" | "failed";
   readonly errorCategory: GatewayErrorCode | "unknown_error";
   readonly errorOrigin: GatewayErrorOrigin;
-}
+  /**
+   * The HTTP status the row should carry. `undefined` means the caller has a
+   * better one (the wire status of an actual response) and should keep it;
+   * a raw error has none, and the caller's own fallback was 500 — which
+   * read as a gateway fault for what was an upstream transport drop.
+   */
+  readonly httpStatus?: number;
+}
+
+/** The HTTP status each classifier-derived category carries when no wire response named one. */
+const CATEGORY_HTTP_STATUS: Partial<Record<GatewayErrorCode | "unknown_error", number>> = {
+  // The upstream's transport died mid-response: a bad gateway, not a fault
+  // in this process.
+  transport_unavailable: 502,
+  platform_unavailable: 502,
+  deadline_exceeded: 504,
+  transport_closed: 499,
+  shutting_down: 503,
+  overloaded: 529,
+  unknown_error: 500,
+};
 
 /**
  * Derives a failed attempt's status, error category, and error origin **from
@@ -559,11 +421,24 @@ export interface TerminalOutcome {
  * outcome carries the real code and origin.
  */
 export function classifyTerminalOutcome(error: unknown, signal: AbortSignal): TerminalOutcome {
+  const category = classifyTerminalCategory(error, signal);
+  const gateway = error instanceof GatewayError ? error : signal.reason instanceof GatewayError ? signal.reason : undefined;
   return {
     status: isClientCancellation(error, signal) ? "cancelled" : "failed",
-    errorCategory: classifyTerminalCategory(error, signal),
-    // A non-GatewayError outcome has no upstream origin to claim: it is ours.
-    errorOrigin: error instanceof GatewayError ? error.origin : "cartethyia",
+    errorCategory: category,
+    // The classifier owns the blame. An upstream socket drop arrives as a
+    // raw runtime error — no `GatewayError` wraps it — and calling that ours
+    // made the row accuse the gateway for an upstream failure.
+    errorOrigin: gateway
+      ? gateway.origin
+      : category === "transport_unavailable"
+        ? "upstream"
+        : "cartethyia",
+    // A `GatewayError` carries its own status; a raw error takes the
+    // category's, so an upstream drop is 502 rather than the 500 fallback.
+    ...(gateway || CATEGORY_HTTP_STATUS[category] !== undefined
+      ? { httpStatus: gateway ? gateway.status : CATEGORY_HTTP_STATUS[category] }
+      : {}),
   };
 }
 
@@ -735,6 +610,12 @@ const QUOTA_ERROR_IDENTIFIERS: ReadonlySet<string> = new Set([
   "usage_not_included",
   "subscription:free-usage-exhausted",
   "resource_exhausted",
+  // Qoder answers an exhausted daily billing allowance with a bare numeric
+  // code: `{"code":"110","message":"Billing daily count exceeded"}`. The 403
+  // wrapper made the old status-only fallback read it as a credential fault;
+  // it is a spend/limit verdict, never an auth one, so it must classify as
+  // quota (a cooldown) instead of `auth_invalidated`.
+  "110",
   // InferHub publishes its own vocabulary in `error.code`. The two 403s below
   // are deliberate absences: `account_blocked` means the account was blocked
   // (an auth/entitlement verdict, not a spend limit) and

package/src/transport/guards/abuse-guard.ts

@@ -69,6 +69,16 @@ export function createIpAbuseProtectionMiddleware(deps: {
       throw peerAddressUnavailableError();
     const address = resolveClientIdentity(request, deps.trustedProxyBoundary, peer);
     const state = deps.stateStore.get(request);
+    // The identity middleware runs later in the plugin chain and resolves the
+    // same value from the same boundary; stashing it here means the request
+    // pays for one resolveClientIdentity instead of two, and the middleware can
+    // skip its own when it finds the stash.
+    if (state !== undefined) {
+      state.clientIdentity ??= {
+        address,
+        source: address === peer ? "tcp-peer" : "trusted-forwarded-header",
+      };
+    }
     try {
       await deps.ipAbuseProtection.checkBeforeAccess({
         identity: {

package/src/transport/guards/auth-guard.ts

@@ -12,7 +12,6 @@ import {
   detectClientRouter,
 } from "../../security/client-router-fingerprint";
 import { createAccessDecision } from "../../security/access-control";
-import { modelAbuseBannedError, type ModelStrikeService } from "../../security/model-abuse";
 
 /**
  * Stateless Elysia `beforeHandle` gateway check: API-key authentication,
@@ -27,7 +26,6 @@ export function createApiKeyAuthenticationMiddleware(deps: {
    * assigned — so a banned caller's attempts produce no telemetry row and no
    * console error, which is exactly the noise this layer exists to stop.
    */
-  readonly modelStrikes?: Pick<ModelStrikeService, "check">;
   /**
    * Tenant invoke kill switch. Checked after the key resolves, because the
    * tenant is a property of the key: the same gateway serves several tenants
@@ -105,22 +103,6 @@ export function createApiKeyAuthenticationMiddleware(deps: {
           "No API invocation access for this client.",
           { reason: "client_router_denied", clientRouter: denied },
         );
-      // Abuse ban: refuse before parse/prepare and before authorization is
-      // recorded, so a banned caller cannot keep producing failed rows. The ban
-      // is keyed on the client address *and* the API key: one key can be shared
-      // by every recipient of a share link, so refusing the address alone would
-      // punish callers that did nothing, while refusing the key alone would let
-      // the caller that probed mint a fresh one.
-      if (deps.modelStrikes) {
-        const state = deps.stateStore.get(request);
-        const ip = state?.clientIdentity?.address;
-        if (ip !== undefined) {
-          const banned = await deps.modelStrikes
-            .check({ ip, apiKeyId: authorization.id })
-            .catch(() => false);
-          if (banned) throw modelAbuseBannedError();
-        }
-      }
       deps.stateStore.require(request).authorization = authorization;
     })
     .as("plugin");

package/src/transport/guards/error-lifecycle.ts

@@ -7,7 +7,7 @@ import type { TelemetryBatchBuffer, TelemetryEventInput } from "../../observabil
 import type { TelemetryPayloadCapture } from "../../observability/payload-capture";
 import { captureEarlyRejectionPayload } from "./early-rejection-capture";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
-import { reasoningEffortFromIntent } from "../../providers/provider-reasoning";
+import { reasoningEffortFromIntent } from "../../protocol/reasoning";
 import { metrics } from "../../observability/metrics";
 import { computeTokensPerSec } from "../../observability/token-speed";
 import { pushStructuredConsoleLog } from "../../observability/log-ring";

package/src/transport/guards/pipeline.ts

@@ -10,7 +10,6 @@ import type { CanonicalAdapter, ShutdownDrainSource } from "../contracts";
 import { createApiKeyAuthenticationMiddleware } from "./auth-guard";
 import { createDependencyReadinessMiddleware } from "./readiness-guard";
 import { createIpAbuseProtectionMiddleware } from "./abuse-guard";
-import { createProcessConcurrencyMiddleware } from "./concurrency-guard";
 import { createHeadroomGuard } from "./headroom-guard";
 import {
   createErrorNormalizationMiddleware,
@@ -27,7 +26,6 @@ import type { TrustedProxyBoundary } from "../../config/network";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import type { RedisClient } from "../../persistence/redis";
 import type { TelemetryBatchBuffer } from "../../observability/telemetry-buffer";
-import type { ModelStrikeService } from "../../security/model-abuse";
 import type { RuntimeMemorySnapshot } from "../../observability/runtime-metrics";
 import {
   TelemetryPayloadCapture,
@@ -51,7 +49,6 @@ export interface TransportPipelineContext {
   readonly requestDeadlineMs?: number;
   readonly verifiedHttps?: boolean;
   /** Graduated strikes for repeated invalid-model requests. */
-  readonly modelStrikes?: ModelStrikeService;
   readonly shutdownCoordinator?: ShutdownDrainSource;
   readonly telemetry?: TelemetryBatchBuffer;
   /**
@@ -96,7 +93,6 @@ export interface TransportPipeline {
  */
 export function createTransportPipeline(context: TransportPipelineContext): TransportPipeline {
   const stages: Elysia[] = [
-    createProcessConcurrencyMiddleware(),
     createHeadroomGuard({
       store: context.stateStore,
       ...(context.memorySnapshot === undefined ? {} : { memorySnapshot: context.memorySnapshot }),
@@ -118,7 +114,6 @@ export function createTransportPipeline(context: TransportPipelineContext): Tran
     createApiKeyAuthenticationMiddleware({
       db: context.db,
       stateStore: context.stateStore,
-      ...(context.modelStrikes ? { modelStrikes: context.modelStrikes } : {}),
       ...(context.isInvokeDisabled
         ? { isInvokeDisabled: context.isInvokeDisabled }
         : {}),
@@ -132,7 +127,6 @@ export function createTransportPipeline(context: TransportPipelineContext): Tran
     createProxyRoutePreparationMiddleware({
       stateStore: context.stateStore,
       preparer: context.preparer,
-      ...(context.modelStrikes ? { modelStrikes: context.modelStrikes } : {}),
     }),
   ];
   const mountRoot = (app: Elysia<any, any, any, any, any, any, any, any>): void => {

package/src/transport/guards/request-context.ts

@@ -14,51 +14,9 @@ import { pushStructuredConsoleLog } from "../../observability/log-ring";
 import { log } from "../../observability/logger";
 import { isJsonProxyRoutePath, isProxyDispatchRoute } from "./body-policy";
 import { isOpaqueBodyRoute } from "../contracts";
-import {
-  modelAbuseBannedError,
-  modelWarningMessage,
-  type ModelAbuseOutcome,
-  type ModelStrikeService,
-} from "../../security/model-abuse";
 import { peerAddressUnavailableError } from "./guard-errors";
 
-/**
- * Whether a thrown error is a *model* rejection the strike layer counts: the
- * key may not use the named model (`isModelAllowed` → 404), or the name
- * resolves to nothing (`modelNotFoundError` → 404). Both surface as
- * `model_not_found`; every other failure — an aborted request, a store outage,
- * a capability mismatch — is not the caller probing for models and is not
- * counted.
- */
-function isModelRejection(error: unknown): boolean {
-  return error instanceof GatewayError && error.code === "model_not_found";
-}
-
-/**
- * Re-throws a model rejection carrying the escalating strike warning, so an
- * honest client that mistyped sees "Warning 1 of 3" instead of the same generic
- * 404 three times and then a ban. The code/status are unchanged — only the
- * message gains the warning, and the count rides in `details` for the console.
- */
-function withModelWarning(
-  error: unknown,
-  outcome: ModelAbuseOutcome,
-  limit: number,
-  opts?: { allowedModels?: readonly string[] | undefined },
-): GatewayError {
-  if (!(error instanceof GatewayError)) return error as GatewayError;
-  const model = String(error.details.model ?? "");
-  const message = modelWarningMessage(model, outcome, limit);
-  const hint = opts?.allowedModels?.slice(0, 8);
-  return new GatewayError(error.code, error.status, message, {
-    ...error.details,
-    strikes: outcome.strikes,
-    strike_limit: limit,
 
-    remaining_before_ban: Math.max(0, limit - outcome.strikes),
-    ...(hint && hint.length > 0 ? { allowed_models_hint: hint } : {}),
-  }, error.origin);
-}
 
 interface RequestApp {
   request(
@@ -71,7 +29,6 @@ export interface RequestContextDeps {
   readonly clock?: () => number;
   /** Explicit deadline override; defaults to `CARTETHYIA_UPSTREAM_TIMEOUT_MS` (120s). */
   readonly requestDeadlineMs?: number;
-  readonly maxBodyBytes?: number;
 }
 
 /**
@@ -120,17 +77,25 @@ export function createClientIdentityMiddleware(deps: {
   // pipeline position still guarantees this executes before IP-abuse checks.
   return new Elysia()
     .beforeHandle(({ request, server }) => {
-      const peer = deps.resolvePeerAddress
-        ? deps.resolvePeerAddress(request)
-        : (server?.requestIP(request)?.address ?? null);
-      if (!peer)
-        throw peerAddressUnavailableError();
-      const address = resolveClientIdentity(request, deps.trustedProxyBoundary, peer);
       const state = deps.stateStore.require(request);
-      state.clientIdentity = {
-        address,
-        source: address === peer ? "tcp-peer" : "trusted-forwarded-header",
-      };
+      // The IP-abuse root hook already resolved the same identity from the
+      // same boundary (and only for /v1/*, exactly these routes); reuse it so
+      // a request pays one resolveClientIdentity instead of two. Fall back to
+      // resolving here when running in a reduced composition without the
+      // abuse guard.
+      if (!state.clientIdentity) {
+        const peer = deps.resolvePeerAddress
+          ? deps.resolvePeerAddress(request)
+          : (server?.requestIP(request)?.address ?? null);
+        if (!peer)
+          throw peerAddressUnavailableError();
+        const address = resolveClientIdentity(request, deps.trustedProxyBoundary, peer);
+        state.clientIdentity = {
+          address,
+          source: address === peer ? "tcp-peer" : "trusted-forwarded-header",
+        };
+      }
+      const address = state.clientIdentity.address;
       const path = state.ingressPath;
       if (!isProxyDispatchRoute(path)) return;
       // The ingress policy stage already decoded the body, so the client's
@@ -249,14 +214,6 @@ export function createCanonicalRequestMiddleware(deps: {
 export function createProxyRoutePreparationMiddleware(deps: {
   readonly stateStore: ProxyRequestStateStore;
   readonly preparer: ProxyRequestPreparer;
-  /**
-   * Graduated strikes for repeated invalid-model requests. The preparation step
-   * is the single choke point where a request is rejected for naming a model the
-   * key may not use (`isModelAllowed`) or a model that resolves to nothing
-   * (`modelNotFoundError`), so it is where a strike is recorded and where a
-   * valid model clears one.
-   */
-  readonly modelStrikes?: ModelStrikeService;
 }): Elysia {
   return new Elysia()
     .beforeHandle(async ({ request }) => {
@@ -268,15 +225,8 @@ export function createProxyRoutePreparationMiddleware(deps: {
       const state = deps.stateStore.require(request);
       if (!state.authorization || !state.canonicalRequest)
         throw new GatewayError("admission_unavailable", 503, "The request was not authenticated and parsed, so this route cannot be served. Resend the request.");
-      const strikes = deps.modelStrikes;
-      const ip = state.clientIdentity?.address;
       // The key rides along so a strike is charged to the caller that made it.
       // Without it, one recipient of a shared link could escalate a ban onto
-      // every other caller behind the same address.
-      const strikeIdentity =
-        strikes && ip !== undefined
-          ? { strikes, ip, apiKeyId: state.authorization?.id ?? null }
-          : undefined;
       try {
         state.preparedRequest = await deps.preparer.prepare({
           canonicalRequest: state.canonicalRequest,
@@ -288,31 +238,8 @@ export function createProxyRoutePreparationMiddleware(deps: {
             : { clientUserAgent: state.clientUserAgent }),
         });
       } catch (error) {
-        // Only a *model* rejection is a strike: an invalid model the key may not
-        // use, or a name that resolves to nothing. A store outage, an aborted
-        // request, or any other failure is not the caller probing for models.
-        if (strikeIdentity && isModelRejection(error)) {
-          const outcome = await strikeIdentity.strikes
-            .noteInvalid({ ip: strikeIdentity.ip, apiKeyId: strikeIdentity.apiKeyId })
-            .catch(() => null);
-          if (outcome?.banned === true) throw modelAbuseBannedError();
-          if (outcome) {
-            const snap = state.authorization?.snapshot;
-            const raw = snap?.model_list;
-            const hint = Array.isArray(raw) ? (raw as readonly string[]) : raw instanceof Set ? [...raw] : undefined;
-            throw withModelWarning(error, outcome, strikeIdentity.strikes.limit, {
-              allowedModels: hint,
-            });
-          }
-        }
         throw error;
       }
-      // A valid model does not reset the invalid-attempt window. Old attempts
-      // leave only when they age out of that window.
-      if (strikeIdentity)
-        void strikeIdentity.strikes
-          .noteValid({ ip: strikeIdentity.ip })
-          .catch(() => undefined);
     })
     .as("plugin");
 }

package/src/transport/request/degradation.ts

@@ -7,7 +7,7 @@
  * the planner warns (throttled here) when a request was dispatched degraded.
  */
 import type { CanonicalRequest, ContentPart } from "../../protocol/canonical-model";
-import { deriveRequiredCapabilities, type RequiredCapability } from "../translation/capabilities";
+import { deriveRequiredCapabilities, type RequiredCapability } from "../../protocol/translation/capabilities";
 
 // Degradation is often sustained — a client that always asks for tools against
 // a tools-less route degrades every single request. An unthrottled warn would
@@ -261,6 +261,25 @@ export function* degradedRequestVariants(
     "audio",
   ] as RequiredCapability[];
   const ordered = priority.filter((c) => required.includes(c));
+  // Pre-pass: drop exactly one capability from the pristine request. The
+  // cumulative chain below can only ADD losses, so when the plan's real blocker
+  // is a late capability in this order (an image on a text-only model), every
+  // surviving chain variant has already lost `tools` as collateral — a
+  // tool-capable model then served a transcript of `[tool:<name>]` placeholders
+  // with no tool catalog at all. Trying each single loss first finds the
+  // smallest degradation that satisfies routing: `degraded: [cap]` alone is
+  // always lexicographically smaller than the chain's `[...earlier, cap]`, so
+  // a single-loss win must be preferred, never the reverse.
+  for (const cap of ordered) {
+    const singular = degradeRequestForCapability(original, cap);
+    if (singular) {
+      yield {
+        request: singular,
+        degraded: [cap],
+        required: required.filter((c) => c !== cap),
+      };
+    }
+  }
   let current: CanonicalRequest = original;
   const degraded: RequiredCapability[] = [];
   for (const cap of ordered) {