cartethyia 2.7.2 → 2.7.4

package/migrations/lite-sqlite3/0032_add_provider_pool_accounts.sql

@@ -0,0 +1,44 @@
+-- Pool-as-account routing entities for ip-scoped, credential-less providers.
+--
+-- Mirror of `full-postgres/0032_add_provider_pool_accounts.sql`; see that file
+-- for the rationale. SQLite representation: `id`/`tenant_id`/`network_pool_id`
+-- are text (uuid), `status` is text with a CHECK, timestamps are text.
+CREATE TABLE IF NOT EXISTS "provider_pool_accounts" (
+  "id"            text PRIMARY KEY,
+  "tenant_id"     text NOT NULL REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "network_pool_id" text NOT NULL REFERENCES "network_pools" ("id") ON DELETE CASCADE,
+  "provider_id"    text NOT NULL,
+  "label"          text NOT NULL,
+  "status"         text NOT NULL DEFAULT 'active'
+                  CHECK ("status" IN ('active', 'cooldown', 'disabled')),
+  "consecutive_failures" integer NOT NULL DEFAULT 0,
+  "last_success_at" text,
+  "last_error"      text,
+  "last_error_category" text,
+  "last_error_at"    text,
+  "cooldown_until"  text,
+  "last_recovered_at" text,
+  "created_at"      text NOT NULL DEFAULT (datetime('now')),
+  "updated_at"      text NOT NULL DEFAULT (datetime('now')),
+  CONSTRAINT provider_pool_accounts_pool_provider_uidx
+    UNIQUE ("network_pool_id", "provider_id", "tenant_id")
+);
+
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_tenant_status_idx
+  ON "provider_pool_accounts" ("tenant_id", "status");
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_provider_status_idx
+  ON "provider_pool_accounts" ("provider_id", "status");
+
+-- Backfill: every existing pool × ip-scoped provider gets its row. The
+-- ip-scoped set is OpenCode Free today; the provider id is spelled here so the
+-- rule stays a data fact, not a code constant. SQLite's bun driver rejects the
+-- newer `ON CONFLICT DO NOTHING` on an INSERT…SELECT, so the equivalent
+-- `INSERT OR IGNORE` form is used here (Postgres version keeps the standard one).
+INSERT OR IGNORE INTO "provider_pool_accounts"
+  ("tenant_id", "network_pool_id", "provider_id", "label")
+SELECT
+  p."tenant_id",
+  p."id",
+  'opencode',
+  'Pool ' || substr(p."id", 1, 8)
+FROM "network_pools" p;

package/migrations/lite-sqlite3/0033_add_api_key_ban.sql

@@ -0,0 +1,8 @@
+-- API-key ban state. Mirror of `full-postgres/0033_add_api_key_ban.sql`;
+-- SQLite stores timestamps as text (ISO), and each `ALTER TABLE ... ADD COLUMN`
+-- may carry exactly one column.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_at" text;
+
+ALTER TABLE "api_keys"
+  ADD COLUMN "ban_reason" text;

package/migrations/lite-sqlite3/0034_add_api_key_ban_until.sql

@@ -0,0 +1,5 @@
+-- API-key ban expiry. Mirror of `full-postgres/0034_add_api_key_ban_until.sql`;
+-- SQLite stores timestamps as text (ISO), and each `ALTER TABLE ... ADD COLUMN`
+-- may carry exactly one column.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_until" text;

package/migrations/lite-sqlite3/0035_align_pool_account_status_enum.sql

@@ -0,0 +1,6 @@
+-- SQLite mirror of `full-postgres/0035_align_pool_account_status_enum.sql`.
+--
+-- SQLite has no enum type: `provider_pool_accounts.status` is a `text`
+-- column with a CHECK constraint already (migration 0032), which matches the
+-- shared schema's semantics. Nothing to change here; the file exists so both
+-- backends carry the same numbered migration set.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.7.2",
+  "version": "2.7.4",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",
@@ -48,6 +48,7 @@
     "start": "bun run scripts/cli/main.ts start",
     "doctor": "bun run scripts/cli/doctor.ts",
     "probe:egress": "bun run scripts/tools/probe-egress.ts",
+    "probe:qoder": "bun run scripts/provider-probing/qoder/probe-qoder.ts",
     "restart": "bun run scripts/build/restart.ts",
     "build:aot": "bun run scripts/build/aot.ts",
     "dev:stack": "concurrently -n BACKEND,DASHBOARD -c cyan,magenta --kill-others-on-fail \"bun run dev:backend\" \"bun run dashboard:dev\"",

package/src/boot/app.ts

@@ -221,7 +221,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
     );
     if (reserved) {
-      const notFound = new GatewayError("not_found", 404, "No endpoint exists at this path. Check the route against the API reference.");
+      const notFound = new GatewayError("not_found", 404, "No endpoint exists at this path (request {requestId}). Check the route against the API reference. Nothing here but dust — check the path 🌙");
       return new Response(JSON.stringify(publicGatewayErrorBody(notFound)), {
         status: notFound.status,
         headers: {
@@ -244,8 +244,9 @@ export function createGatewayApp(deps: GatewayAppDeps) {
   // Shutdown ordering: abort in-flight proxy controllers first so the
   // bounded drain observes cancellation and finalizers run before
   // telemetry flush and pool close. The reason is threaded through so the
-  // streaming path emits a drain-aware terminal frame (`restart_for_update`
-  // vs `shutting_down`) instead of a bare abort that reads as a client drop.
+  // streaming path emits a drain-aware terminal frame (`shutting_down` with
+  // reason `restart_for_update` vs plain `shutting_down`) instead of a bare
+  // abort that reads as a client drop.
   // Only production has a coordinator to wire; the shell never drains.
   if (deps.mode === "production") {
     const coordinator = deps.shutdownCoordinator;
@@ -469,7 +470,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         throw new GatewayError(
           "model_not_found",
           404,
-          `The model '${targetId}' does not exist or you do not have access to it.`,
+          `The model '${targetId}' does not exist or you do not have access to it (request {requestId}). Try another model — this one's off the menu 📚`,
         );
       return new Response(JSON.stringify(found), {
         headers: {
@@ -600,14 +601,14 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         // for something only the local host may ask. `invalid_request` told an
         // operator to fix the body, when the body was never the problem.
         if (!isLoopbackPeer(peerAddresses.get(request) ?? null))
-          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback");
+          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
         if (!tokenMatches(request.headers.get("x-drain-token"), token))
-          throw new GatewayError("authentication_failed", 401, "invalid drain token");
+          throw new GatewayError("authentication_failed", 401, "invalid drain token (request {requestId}). Wrong key, right door — check the token 🔑");
         const name = params.name;
         if (!tasks.names().includes(name))
-          throw new GatewayError("invalid_request", 404, `no such task: ${name}`);
+          throw new GatewayError("not_found", 404, `no such task: ${name} (request {requestId}). Nothing here but dust — check the task name 🌙`);
         if (tasks.isRunning(name))
-          throw new GatewayError("invalid_request", 409, `${name} is already running`);
+          throw new GatewayError("invalid_request", 409, `${name} is already running (request {requestId}). One at a time — wait for it to finish ⏳`);
         void tasks.runNow(name);
         return new Response(JSON.stringify({ task: name, status: "started" }), {
           status: 202,

package/src/config/network.ts

@@ -111,10 +111,14 @@ export const DEFAULT_BOUNDS = {
    * the worker sweeps (`runGrowingWaves`, at most 5 concurrent), auth, and
    * readiness.
    *
-   * 20 leaves headroom over that without letting one process hold a large
+   * 16 leaves headroom over that without letting one process hold a large
    * share of the server's `max_connections` (Postgres defaults to 100), which
    * matters because the gateway is designed to run several processes behind
-   * `reusePort` — see `assertPoolFitsServerCapacity`.
+   * `reusePort` — see `assertPoolFitsServerCapacity`. With well-optimized
+   * queries a 16-connection pool sustains a hundred concurrent requests: the
+   * connections are held for microseconds per query, not for the whole
+   * request. If a burst still queues on the pool, fix the query/consumer
+   * that holds connections, rather than raising the ceiling.
    */
-  maxPostgresPoolSize: 20,
+  maxPostgresPoolSize: 16,
 } as const;

package/src/console/api-keys/bucket-spend.ts

@@ -20,7 +20,12 @@ import { utcDayStart, utcMonthStart } from "../shared/day";
  *
  * A share template's recipients admit under the parent id, and their spend is
  * attributed to their own child row, so the family is summed — otherwise
- * seeding a template would miss everything its recipients already used.
+ * seeding a template would miss everything its recipients already used. The
+ * family is passed to the reader as the template's id, which the query
+ * resolves with an `EXISTS` against `api_keys`: a family that has minted tens
+ * of thousands of children must not expand them into bind parameters on the
+ * key-creation path, which is where an old id-list version crashed the
+ * process.
  */
 export async function familyBucketSpend(
   db: CartethyiaDatabase,
@@ -36,15 +41,10 @@ export async function familyBucketSpend(
     .limit(1);
   const tenantId = parent?.tenantId;
   if (tenantId === undefined) return { daily: 0, monthly: 0 };
-  const children = await db
-    .select({ id: apiKeys.id })
-    .from(apiKeys)
-    .where(eq(apiKeys.parentKeyId, keyId));
-  const keyIds = [keyId, ...children.map((child) => child.id)];
   // Two SQL sums instead of reading every event of the family: the bucket
   // spend only needs a total, and this runs on the key-creation path.
   const spentSince = async (start: Date): Promise<number> =>
-    sumTelemetryTokens(db, tenantId, { apiKeyIds: keyIds, since: start });
+    sumTelemetryTokens(db, tenantId, { familyKeyId: keyId, since: start });
   const [daily, monthly] = await Promise.all([
     spentSince(utcDayStart(now)),
     spentSince(utcMonthStart(now)),