cartethyia 2.7.1 → 2.7.3

package/src/transport/request/preparer.ts

@@ -2,6 +2,7 @@ import { GatewayError } from "../../protocol/gateway-error";
 import type { CanonicalRequest, ServiceKind } from "../../protocol/canonical-model";
 import { toolResultParts } from "../../protocol/canonical-model";
 import type { ApiKeyAdmissionService } from "../../security/admission/service";
+import type { CallerIdentity } from "../../security/access-control";
 import type { RouteCandidate as RouteCandidate, InMemoryRouteSnapshotService, RoutePlan } from "../routing/route-model";
 import type { RouteContinuationAffinity } from "../routing/route-model";
 import { resolveAliasTarget, type RoutingEngine } from "../routing/router";
@@ -80,6 +81,8 @@ export function resolveContinuationAffinity(
     apiKeyId: authorization.id,
   };
   let affinity: RouteContinuationAffinity | undefined;
+  let anyResolved = false;
+  let allResolved = true;
   for (const callId of ids) {
     // The registry resolves by tenant + API key + provider + account, so a call
     // id replayed from another key or tenant resolves nothing.
@@ -91,6 +94,7 @@ export function resolveContinuationAffinity(
       // through the ids that still resolve; when none do, the ordinary routing
       // path decides (a Cursor adapter may rebase the full history into a
       // fresh Run).
+      allResolved = false;
       continue;
     }
     if (affinity !== undefined && affinity.providerAccountId !== record.providerAccountId) {
@@ -101,12 +105,21 @@ export function resolveContinuationAffinity(
         { callIds: [...ids] },
       );
     }
+    anyResolved = true;
     affinity = {
       providerId: record.providerId,
       providerAccountId: record.providerAccountId,
+      rebaseable: false,
     };
   }
-  return affinity;
+  if (affinity !== undefined) {
+    // Rebaseable when every supplied call id resolved to a live pending call
+    // (so none is owed to another account) — or when none resolved and the
+    // whole history is present. In both cases the conversation is complete and
+    // may travel as history to a fresh Run.
+    return { ...affinity, rebaseable: anyResolved ? allResolved : true };
+  }
+  return undefined;
 }
 
 /** Looks up one pending call across every provider that records continuations. */
@@ -137,6 +150,8 @@ export interface PreparedProxyRequest {
    * second account and pool slot.
    */
   readonly continuationAffinity?: RouteContinuationAffinity;
+  /** Single "who is speaking" identity, derived at auth. */
+  readonly caller: CallerIdentity;
   readonly estimatedInputTokens: number;
   readonly estimatedOutputTokens: number;
   readonly deadlineMs: number;
@@ -407,6 +422,7 @@ export class ProxyRequestPreparer {
       degradedCapabilities: degraded,
       plan,
       ...(continuationAffinity === undefined ? {} : { continuationAffinity }),
+      caller: authorization.caller,
       estimatedInputTokens,
       estimatedOutputTokens,
       deadlineMs: input.deadlineMs,

package/src/transport/request/system-prompt-injection.ts

@@ -0,0 +1,89 @@
+/**
+ * Tenant system-prompt injection at the canonical level.
+ *
+ * Runs inside `applyTenantPreferences`, after reasoning/thinking shaping and
+ * before RTK/PonyTail, so the injected text composes with (and is then
+ * appended-to by) the compression directive. Wire-agnostic: one transform
+ * covers messages/chat/responses/gemini/codex/kiro; provider-native
+ * injection (Claude identity/billing prepend, buddy fixed system turn,
+ * antigravity identity) happens later, in the adapters, and is untouched.
+ *
+ * Resolution is most-specific-wins: model > provider > global, where a
+ * provider either follows the tenant's global prompt or carries a custom one.
+ * Failure is non-fatal — an unusable configuration must not fail a
+ * dispatchable request.
+ */
+import type { CanonicalRequest } from "../../protocol/canonical-model";
+import type { ServiceKind } from "../../protocol/canonical-model";
+import type {
+  PromptSetting,
+  TenantSystemPrompts,
+} from "../../console/system-prompt/contracts";
+import {
+  systemPromptModelKey,
+} from "../../console/system-prompt/contracts";
+
+/** The route facts the resolution needs. */
+export interface SystemPromptRoute {
+  readonly providerId: string;
+  readonly modelId: string;
+  readonly serviceKind: ServiceKind;
+}
+
+/**
+ * Resolves the effective prompt for a route: the most-specific enabled scope
+ * wins. A provider scope honours its `followGlobal` toggle; model scope is
+ * always explicit. Returns `undefined` when nothing applies.
+ */
+export function resolveTenantSystemPrompt(
+  prompts: TenantSystemPrompts | undefined,
+  route: Pick<SystemPromptRoute, "providerId" | "modelId">,
+): PromptSetting | undefined {
+  if (prompts === undefined) return undefined;
+  const model = prompts.models[systemPromptModelKey(route.providerId, route.modelId)];
+  if (model !== undefined && model.enabled) return model;
+  const provider = prompts.providers[route.providerId];
+  if (provider !== undefined) {
+    if (provider.followGlobal) {
+      return prompts.global !== null && prompts.global.enabled ? prompts.global : undefined;
+    }
+    if (provider.setting !== undefined && provider.setting.enabled) return provider.setting;
+  }
+  return prompts.global !== null && prompts.global.enabled ? prompts.global : undefined;
+}
+
+/** Marker text guard so retries never double-inject. */
+function carriesText(system: readonly { kind: string }[] | undefined, text: string): boolean {
+  return (system ?? []).some((part) => part.kind === "text" && (part as { text?: string }).text === text);
+}
+
+/**
+ * Applies the resolved tenant prompt to the canonical request. Appends after
+ * existing system content (or replaces the caller's system content for
+ * `override` — provider-native identity injection later re-adds the fixed
+ * provider prompt, so override is never a bare wire).
+ */
+export function applyInjectSystemPrompt(
+  request: CanonicalRequest,
+  prompts: TenantSystemPrompts | undefined,
+  route: SystemPromptRoute,
+): CanonicalRequest {
+  // Non-chat native protocols have no system surface to inject into.
+  if (route.serviceKind !== "llm") return request;
+  const setting = resolveTenantSystemPrompt(prompts, route);
+  if (setting === undefined || setting.text.length === 0) return request;
+
+  const text = setting.text;
+  // `override` replaces only the CALLER's system content: the adapters later
+  // prepend their mandatory identity/billing blocks (claude, antigravity) or
+  // install their fixed system turn (buddy), so the wire always keeps the
+  // provider-native prompt. For wrapped-injection providers the override
+  // cannot survive the replace at all — the identity must stay the opener —
+  // so it degrades to append there.
+  const existing = request.system ?? [];
+  if (setting.mode === "override" && existing.length > 0) {
+    return { ...request, system: [{ kind: "text", text }] };
+  }
+  if (carriesText(existing, text)) return request;
+  return { ...request, system: [...existing, { kind: "text", text }] };
+}

package/src/transport/request/tenant-preferences.ts

@@ -12,9 +12,42 @@ import type { CanonicalRequest } from "../../protocol/canonical-model";
 import type { PreparedProxyRequest } from "./preparer";
 import { normalizeThinkingConfig } from "../../protocol/translation/thinking";
 import { compressRequest } from "./rtk/compress-request";
+import { applyInjectSystemPrompt } from "./system-prompt-injection";
 import { preferencesReaderFor } from "../../persistence/tenant-preferences";
+import {
+  readTenantSystemPrompts,
+  type StoredTenantSystemPrompts,
+} from "../../persistence/system-prompt-store";
+import { currentSettingsRevision } from "../../persistence/settings-revision";
+import { TtlCache } from "../../persistence/ttl-cache";
 import { resolveUpstreamTimeoutMs } from "../../config/timeouts";
 
+/**
+ * Revision-keyed cached read of the tenant's system-prompt configuration, the
+ * same convergence mechanism as the runtime-preferences reader: a mutation
+ * bumps the settings revision, which changes every cache key, so writes are
+ * visible to the dispatch path immediately without a per-request round trip.
+ */
+const systemPromptCache = new TtlCache<StoredTenantSystemPrompts>({
+  ttlMs: 5_000,
+  maxEntries: 128,
+});
+
+async function readTenantSystemPromptsCached(
+  db: CartethyiaDatabase,
+  tenantId: string,
+): Promise<StoredTenantSystemPrompts> {
+  const cacheKey = `${tenantId}:${currentSettingsRevision()}`;
+  const cached = systemPromptCache.get(cacheKey);
+  if (cached !== undefined) return cached;
+  const prompts = await readTenantSystemPrompts(db, tenantId);
+  systemPromptCache.set(cacheKey, prompts);
+  return prompts;
+}
+
+/** Cached read for the dispatch path (same revision-keyed cache). */
+export { readTenantSystemPromptsCached as readTenantSystemPromptsForDispatch };
+
 /**
  * Re-arms the request deadline from the tenant's timeout override.
  *
@@ -91,6 +124,16 @@ export async function applyTenantPreferences(
       const next = normalizeThinkingConfig(canonicalRequest);
       if (next !== canonicalRequest) canonicalRequest = next;
     }
+    // Tenant system-prompt injection runs before compression: the PonyTail
+    // directive must stay the tail of the system content, and the injected
+    // prompt is itself stable per scope, so the prefix-cache invariant holds.
+    const prompts = await readTenantSystemPromptsCached(db, tenantId);
+    const candidate = prepared.candidate;
+    canonicalRequest = applyInjectSystemPrompt(canonicalRequest, prompts, {
+      providerId: candidate.provider_id,
+      modelId: candidate.model_id,
+      serviceKind: candidate.service_kind ?? "llm",
+    });
     if (prefs) {
       // When the routed model is Responses (codex/openai/muse-spark) and the
       // client hit a Chat surface, force the configured summary mode so the

package/src/transport/routing/admission.ts

@@ -17,15 +17,25 @@ import type {
 /**
  * The admission bucket one candidate draws from.
  *
+ * Bucket identity is `provider:model[:account][:ownerTenant]`:
+ * - A candidate with no account (credential-less provider) buckets per
+ *   provider:model.
+ * - A **shared** account (`owner_tenant_id` null) is one bucket across all
+ *   tenants — the account is pool-wide, so its concurrency ceiling is global.
+ * - A **tenant-owned** account is scoped to its owner tenant, so two tenants
+ *   cannot drain each other's ceiling on an account only one of them owns.
+ *
  * Exported so the router can order candidates by the same counters admission
  * enforces against: a second copy of this format would drift and quietly
  * deprioritize the wrong accounts.
  */
 export function admissionKey(candidate: RouteCandidate): string {
   const base = `${candidate.provider_id}:${candidate.model_id}`;
-  return candidate.provider_account_id === undefined
-    ? base
-    : `${base}:${candidate.provider_account_id}`;
+  if (candidate.provider_account_id === undefined) return base;
+  const account = `${base}:${candidate.provider_account_id}`;
+  return candidate.owner_tenant_id === undefined || candidate.owner_tenant_id === null
+    ? account
+    : `${account}:${candidate.owner_tenant_id}`;
 }
 
 /**

package/src/transport/routing/route-catalog.ts

@@ -35,7 +35,19 @@ import { providerHasAdapterUserAgent, providerUsesBespokeWire } from "../../prov
 
 const CLAUDE_MODEL_FAMILIES = new Set(["opus", "sonnet", "haiku", "fable", "mythos"]);
 
+/** Codex's built-in (non-routeable) model spellings worth matching. */
+const CODEX_REVIEW_MODELS = new Set(["codex-auto-review"]);
+
 export function cliMappingSourceKeys(toolId: string, sourceModel: string): readonly string[] {
+  if (toolId === "codex") {
+    const normalized = sourceModel.trim().toLowerCase();
+    if (CODEX_REVIEW_MODELS.has(normalized)) {
+      // Guardian's auto-review model is one fixed spelling; surface the full
+      // spelling plus the bare family so a slot mapped to either one hits.
+      return [...new Set([sourceModel, "codex-auto-review"])];
+    }
+    return [sourceModel];
+  }
   if (toolId !== "claude") return [sourceModel];
   const normalized = sourceModel.trim().toLowerCase();
   const family =
@@ -199,23 +211,33 @@ export function capabilityProfileCacheSize(): number {
   return capabilityProfileCache.size;
 }
 
-/** Resolves route identity only for bundled adapters without a native User-Agent builder. */
+/** Resolves route identity: bundled adapters without a native User-Agent builder, plus custom providers. */
 export function resolveRouteUserAgent(
   providerId: string,
   tenantUserAgent: string | undefined,
   globalUserAgent: string | undefined,
 ): string | undefined {
-  if (!isBundledProviderId(providerId) || providerHasAdapterUserAgent(providerId)) return undefined;
-  // A provider whose operator set no identity of their own gets the Claude Code
-  // CLI identity, resolved live so the stamped version tracks discovery. This
-  // used to be a frozen `codex_cli_rs` literal, which named a different vendor's
-  // client on requests that mostly reached neither.
-  const selected = resolveTenantOverride(
-    tenantUserAgent,
-    globalUserAgent,
-    buildClaudeCliUserAgent(),
-  );
-  return selected.trim() === "" ? undefined : selected;
+  if (isBundledProviderId(providerId)) {
+    // A bundled adapter that frames its own identity headers never consumes a
+    // route User-Agent (Command Code, Qoder, buddy, ...), so it never gets one
+    // — the control is hidden for it too.
+    if (providerHasAdapterUserAgent(providerId)) return undefined;
+    // Bundled API-key providers: an operator who set no identity of their own
+    // gets the Claude Code CLI identity, resolved live so the stamped version
+    // tracks discovery. This used to be a frozen `codex_cli_rs` literal, which
+    // named a different vendor's client on requests that mostly reached neither.
+    const selected = resolveTenantOverride(
+      tenantUserAgent,
+      globalUserAgent,
+      buildClaudeCliUserAgent(),
+    );
+    return selected.trim() === "" ? undefined : selected;
+  }
+  // Custom (BYOK) providers: only an explicit operator choice rides on the
+  // route; the adapter owns the default otherwise (see `registerByokProviders`).
+  // An explicit empty choice ("None") is preserved so the adapter can honor it.
+  const selected = resolveTenantOverride(tenantUserAgent, globalUserAgent, undefined);
+  return selected === undefined ? undefined : selected.trim();
 }
 
 /** One persisted model row ready for candidate construction. */
@@ -648,6 +670,8 @@ class RouteCatalogRepository {
                 ...(model.outputLimit == null ? {} : { output_limit: model.outputLimit }),
                 capability_profile: capabilityProfile,
                 tenant_id: tId,
+                // Public credential-less candidates have no account to own them.
+                owner_tenant_id: null,
                 requires_account: false as const,
                 network_pool_ids: tenantPools.ids,
                 network_pool_required: true,
@@ -674,6 +698,8 @@ class RouteCatalogRepository {
           ...(model.outputLimit == null ? {} : { output_limit: model.outputLimit }),
           capability_profile: capabilityProfile,
           tenant_id: providerTenantId,
+          // Public credential-less candidates have no account to own them.
+          owner_tenant_id: null,
           ...(providerRequiresAccount
             ? { health_status: "disabled" as const }
             : { requires_account: false as const }),
@@ -716,6 +742,9 @@ class RouteCatalogRepository {
           ...(routeUserAgent === undefined ? {} : { user_agent: routeUserAgent }),
           tenant_id: rowTenantId,
           provider_account_id: account.id,
+          // The account's owning tenant (null = shared pool-wide) — the bucket
+          // key for admission, distinct from the requesting tenant.
+          owner_tenant_id: account.tenantId ?? null,
           // The plan gate is per (account, model): the model may be refused on
           // a free plan and the account may be on one. Both ride here because
           // `plan()` sees the candidate and nothing else.

package/src/transport/routing/route-model.ts

@@ -1,6 +1,9 @@
 // Routing contracts and snapshots.
 import { GatewayError } from "../../protocol/gateway-error";
 import { type ServiceKind, type WireFamily } from "../../protocol/canonical-model";
+import type { CallerIdentity } from "../../security/access-control";
+
+export type { CallerIdentity };
 
 
 export type RoutingRevision = number;
@@ -57,6 +60,14 @@ export interface RouteCandidate {
   readonly network_pool_provider_limit?: number;
   /** `null`/`undefined` = globally routable; a tenant id = routable only for that tenant's requests (BYOK). */
   readonly tenant_id?: string | null;
+  /**
+   * The tenant that owns this candidate's account (`provider_accounts.tenant_id`),
+   * or null for a shared pool-wide account. Distinct from `tenant_id` (the
+   * requesting tenant). Used to scope the admission bucket: a shared account
+   * is one bucket across tenants; a tenant-owned account is scoped to its
+   * owner so two tenants cannot drain each other's ceiling.
+   */
+  readonly owner_tenant_id?: string | null;
   /** `false` only for a genuinely credential-less provider (e.g. OpenCode
    * Free) dispatched with zero `provider_accounts` rows — the handler skips
    * `resolveCredentialForAccount` and dispatches with a `"none"` credential.
@@ -80,6 +91,11 @@ export interface RouteCandidate {
    * "free": guessing free here would defeat the gate it exists to serve.
    */
   readonly account_plan?: string | null;
+  /** Usage-floor ceiling from Routing Strategy; read live at plan time. */
+  readonly usage_floor?: number;
+  readonly usage_floor_unit?: "credit" | "percent";
+  /** Live quota windows (cache) the floor check evaluates. */
+  readonly quota_windows?: readonly unknown[];
 }
 
 /**
@@ -163,6 +179,16 @@ export interface PoolRoutingSetting {
 export interface RouteContinuationAffinity {
   readonly providerId: string;
   readonly providerAccountId: string;
+  /**
+   * True when the request's tool-result ids are all already answered by the
+   * conversation history (a replay), so no call is still owed to the pinned
+   * account. In that case, if the pinned account is no longer routable for
+   * the requested model, the request may safely rebase to a fresh Run on an
+   * eligible account instead of being refused — the recorded exchange travels
+   * as history. When false, the pin is a hard constraint: a live pending call
+   * must reach the exact account that owns it.
+   */
+  readonly rebaseable: boolean;
 }
 
 export interface RoutePlan {
@@ -171,6 +197,33 @@ export interface RoutePlan {
   readonly requested_model: string;
   readonly resolved_model: string;
   readonly provider_id: string;
+  /**
+   * The system decision behind each candidate, keyed by the candidate's
+   * admission bucket. Written once at plan time; every later layer (dispatch,
+   * telemetry) reads this instead of re-deriving its own ordering.
+   */
+  readonly decisions: ReadonlyMap<string, RoutingDecision>;
+}
+
+/** How eligible a candidate is and why — written once, read by every layer. */
+export const ROUTING_RANK = {
+  FRESH: 0,
+  SLOW: 1,
+  COOLING: 2,
+  SATURATED: 3,
+} as const;
+export type RoutingRank = (typeof ROUTING_RANK)[keyof typeof ROUTING_RANK];
+
+export interface RoutingDecision {
+  readonly eligible: boolean;
+  readonly rank: RoutingRank;
+  readonly reason: string;
+  readonly health_status?: string;
+  readonly cooldown_until?: number;
+  readonly floor_blocked?: boolean;
+  readonly plan_gate_blocked?: boolean;
+  readonly capability_blocked?: boolean;
+  readonly saturated?: boolean;
 }
 
 import type { ComboStrategy, PoolRoutingStrategy, ProviderRoutingStrategy } from "../../persistence/schema";