cartethyia 2.7.3 → 2.7.4

package/dist/dashboard/precompressed-assets.json

@@ -1,74 +1,75 @@
 {
-  "count": 117,
+  "count": 118,
   "assets": [
     "assets/AccountCooldown-Bjo92Qat.js",
-    "assets/BannedPage-2TJD37Hb.js",
-    "assets/CliToolDetailPage-xefJNRmJ.js",
-    "assets/CliToolsPage-Rj9iHQ3F.js",
-    "assets/CombosPage-JEbYJFxw.js",
-    "assets/ConsoleLogPage-C3xx_inM.js",
-    "assets/CustomizationPage-Dw306gJU.js",
-    "assets/HealthEventsModal-jaBo1TWV.js",
-    "assets/LoginPage-C4w7vea-.js",
-    "assets/ModelPicker-BtPcAfot.js",
-    "assets/OverviewPage-CGC5gNs1.js",
-    "assets/ProviderDetailPage-DQcthNGt.js",
+    "assets/BannedPage-ChG5svFb.js",
+    "assets/CliToolDetailPage-BIcWQun7.js",
+    "assets/CliToolsPage-Bf2VelDe.js",
+    "assets/CombosPage-DCgm5g6g.js",
+    "assets/ConsoleLogPage-a8mD0QF1.js",
+    "assets/CustomizationPage-ggeMSjte.js",
+    "assets/HealthEventsModal-DzSWzE_j.js",
+    "assets/LoginPage-U6AKaJcF.js",
+    "assets/ModelPicker-BMS2t8BA.js",
+    "assets/OverviewPage-D2D4IiHl.js",
+    "assets/ProviderDetailPage-CrNf7j_X.js",
     "assets/ProviderIcon-FB6yS4v1.js",
-    "assets/ProvidersPage-0OsXRGXe.js",
-    "assets/ProxyPage-DdPc8slb.js",
-    "assets/QuotaPage-Ci5O4BnH.js",
-    "assets/SettingsPage-CDZjTt87.js",
-    "assets/SetupPage-BQS0Rx_u.js",
-    "assets/SortableList-BAL5npBC.js",
-    "assets/StudioPage-TP7voAQ0.js",
+    "assets/ProvidersPage-BSDbquc1.js",
+    "assets/ProxyPage-lsrx7NYg.js",
+    "assets/QuotaPage-L0skzML8.js",
+    "assets/SettingsPage-CmAbjRHW.js",
+    "assets/SetupPage-f0DE1h0-.js",
+    "assets/SortableList-ClzpwyET.js",
+    "assets/StudioPage-Cq5tW7hW.js",
     "assets/ToolIcon-K1ckcDKg.js",
-    "assets/UsagePage-Cj_fEzhg.js",
-    "assets/api-keys-MbI7e7rt.js",
-    "assets/app-B2vyPoII.css",
-    "assets/app-wvwCi4Eh.js",
+    "assets/UsagePage-Dfc9rWQn.js",
+    "assets/api-keys-C38iXoO4.js",
+    "assets/app-BayTTy01.js",
+    "assets/app-a159k0ub.css",
     "assets/arrow-left-CpBxkoxI.js",
     "assets/arrow-right-Dl5yKnp8.js",
     "assets/arrow-up-59ms1iiT.js",
-    "assets/assert-C0YYuZJ4.js",
+    "assets/assert-DbRA8EG2.js",
     "assets/backup-file-gdKIlg8U.js",
-    "assets/badge-B_DMpMJN.js",
-    "assets/banner-DMrMPmth.js",
+    "assets/badge-D9CS6dZk.js",
+    "assets/banner-DympBNq4.js",
     "assets/brain-Cwed_72z.js",
-    "assets/card-Be5Uzamx.js",
+    "assets/card-ibRWU_uT.js",
     "assets/chevron-right-BXIy5l3h.js",
     "assets/circle-alert-CntYHV5v.js",
     "assets/circle-check-BU3v_mFW.js",
-    "assets/cli-tools-muFRphDu.js",
-    "assets/clipboard-button-DOfrVmsi.js",
+    "assets/cli-tools-63qBGaRw.js",
+    "assets/clipboard-button-DJm-9pz7.js",
     "assets/database-Dz9N3zGd.js",
-    "assets/dialog-C9omdjQt.js",
+    "assets/dialog-8fiE6tec.js",
     "assets/dialog-actions-B1axpEg7.js",
     "assets/download-dRFo5_Wu.js",
-    "assets/drawer-Bm8WKaGY.js",
-    "assets/entry-DS90gUks.js",
-    "assets/entry-j40LJotO.js",
-    "assets/entry-q5HwZ8nN.js",
+    "assets/drawer-CqGYeOrd.js",
+    "assets/entry-BSAsYsmV.js",
+    "assets/entry-CiIQULZD.js",
+    "assets/entry-Daz0lJ-W.js",
     "assets/eye-C_hawfH4.js",
     "assets/eye-off-Bk5g2luF.js",
     "assets/fingerprint-pattern-BWuHtbW4.js",
-    "assets/formatters-BTScrQpe.js",
+    "assets/formatters-D-MTJxMr.js",
     "assets/gauge-BbIMy7MB.js",
-    "assets/github-badge-Orjuzemr.js",
+    "assets/github-badge-CPK47xQx.js",
     "assets/image-BPaouViG.js",
-    "assets/index-cPrX5vn6.js",
-    "assets/inline-Dvux8w-0.js",
-    "assets/input-CU1Rgf3p.js",
+    "assets/index-DBNPOfhV.js",
+    "assets/inline-BT0zntEr.js",
+    "assets/input-Da2ZViWg.js",
     "assets/jsx-runtime-CXUMngI_.js",
     "assets/key-round-UkavsGxp.js",
     "assets/layers-2-glBbjl.js",
-    "assets/layout-C_7A6H55.js",
-    "assets/list-row-CzFvogbj.js",
-    "assets/live-KaG15HLQ.js",
+    "assets/layout-BXNeLw6M.js",
+    "assets/list-row-BycOrrIV.js",
+    "assets/live-DCQNZpF7.js",
     "assets/log-in-BmRjy60c.js",
     "assets/message-circle-CCxGwRvv.js",
-    "assets/minimize-2-D-MN8W8a.js",
-    "assets/mutation-JJGQm8TD.js",
-    "assets/numbers-BNDZnsUE.js",
+    "assets/minimize-2-BTmMTK4o.js",
+    "assets/mutation-Rr0TIvcj.js",
+    "assets/network-9Yj2ZyLo.js",
+    "assets/numbers-CEagj6ZZ.js",
     "assets/pencil-768ysRAr.js",
     "assets/plus-DIdX_g-x.js",
     "assets/power-off-Yjw9GMJh.js",
@@ -91,22 +92,22 @@
     "assets/providers/parallel.svg",
     "assets/providers/tokenharbor.svg",
     "assets/providers/zai-coding-plan.svg",
-    "assets/query-keys-CLaNz8Xz.js",
-    "assets/quota-DZGyp0N5.js",
+    "assets/query-keys-BloKtaXJ.js",
+    "assets/quota-Caw7wqci.js",
     "assets/refresh-cw-BqJFk4sU.js",
     "assets/rotate-ccw-CufcqITi.js",
     "assets/route-CNSNj9Zm.js",
-    "assets/routing-BEH32QOC.js",
+    "assets/routing-CO9zCUus.js",
     "assets/scaling-nWE4Cx8f.js",
     "assets/search-JOKus9rb.js",
-    "assets/select-B3iTetHN.js",
+    "assets/select-BIYIBkMU.js",
     "assets/settings-2-Ds9DQp0t.js",
-    "assets/settings-Dt3Eqbnq.js",
+    "assets/settings-jS3-PNSA.js",
     "assets/shield-check-DVS0Foqh.js",
-    "assets/stack-KrOrm7JZ.js",
-    "assets/state-DLS7IDMy.js",
+    "assets/stack-DfgnFDWY.js",
+    "assets/state-CkfdYWel.js",
     "assets/stream-retry-5QnVuSSo.js",
-    "assets/switch-42ItvbAs.js",
+    "assets/switch-SYm237HG.js",
     "assets/terminal-0_IjPWTk.js",
     "assets/tokens-COzario9.js",
     "assets/trash-Cppn5c3R.js",
@@ -114,7 +115,7 @@
     "assets/use-modal-focus-By7oJoGd.js",
     "assets/use-reduced-motion-C4B0R6Sz.js",
     "assets/use-timeout-BwcBBRrT.js",
-    "assets/useMutation-Dmnfh1Ue.js",
+    "assets/useMutation-BQqCRNIi.js",
     "assets/wrench-B6E1oEuY.js",
     "assets/zap-C4EeVW4q.js",
     "index.html"

package/migrations/full-postgres/0027_qoder_identity_genuine_seed.sql

@@ -1,21 +1,20 @@
 -- Qoder native identity: genuine SG identity + per-account seed replay.
 --
--- Research (2026-10-30, see documentation/research/qoder-identity-gate-
--- postmortem.md and qoder-umid-reverse.md) established that the daily-credit
--- campaign gates its CREDITS grant on a *genuine* Alibaba SG-produced
--- identity: generated/deterministic tokens do not reveal the grant on a
--- fresh account, while the `runtime-info` bridge (SG-signed) does.
+-- Research (2026-10-30, see
+-- documentation/archive/research/Qoder-03-umid-and-identity-findings.md)
+-- established that machine identity does not gate the daily-credit campaign.
+-- The seed is retained for deterministic replay of a native identity on
+-- surfaces that may require one; it is not required for campaign eligibility.
 --
 -- Migration 0026 already added `native_identity` (the token triple + optional
 -- seed) with a partial unique index on the extracted machineToken — the
 -- "one device per account" invariant. This migration does not change that
 -- schema; it only documents the contract change on the same column:
 --
---   `seed` is now REQUIRED for a claim-capable identity (the seed is the
---   device material; the token can be re-derived from it, never the reverse).
---   Rows minted by the retired generated path carry `seed = ""` — they stay
---   valid records but must be re-minted through the bridge before the next
---   claim; the store treats a missing/empty seed as "not replay-capable".
+--   `seed` makes a native identity replay-capable (the token can be
+--   re-derived from the seed, never the reverse). Rows minted by the
+--   generated path may have `seed = ""`; that affects native replay only,
+--   not the daily campaign claim.
 --
 -- No DDL is needed: the JSON shape already carries everything. Kept as an
 -- empty migration so the migration numbering records the policy change.

package/migrations/full-postgres/0032_add_provider_pool_accounts.sql

@@ -0,0 +1,53 @@
+-- Pool-as-account routing entities for ip-scoped, credential-less providers.
+--
+-- For providers whose rate limit follows the egress address (OpenCode Free),
+-- the pool is the resource that runs out — but it was invisible to account-level
+-- health and routing because the provider owns no `provider_accounts` rows.
+-- This table materializes one row per (pool × ip-scoped provider), carrying the
+-- same health state machine (`status`, `cooldown_until`, …) so a spent egress
+-- is excluded from routing plans exactly like a cooling account, and shows in
+-- the provider's Accounts card with a "Pool" badge.
+--
+-- The row is an account-equivalent, not an account: it resolves no credential,
+-- is skipped by quota-refresh and identity sweeps (they filter on real
+-- credential kinds), and is owned by its pool — deleting the pool cascades the
+-- row. Rows are backfilled here for every existing pool × ip-scoped provider so
+-- no operator action is needed to adopt the feature.
+CREATE TABLE IF NOT EXISTS "provider_pool_accounts" (
+  "id"            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "tenant_id"     uuid NOT NULL REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "network_pool_id" uuid NOT NULL REFERENCES "network_pools" ("id") ON DELETE CASCADE,
+  "provider_id"    text NOT NULL,
+  "label"          text NOT NULL,
+  "status"         text NOT NULL DEFAULT 'active'
+                  CHECK ("status" IN ('active', 'cooldown', 'disabled')),
+  "consecutive_failures" integer NOT NULL DEFAULT 0,
+  "last_success_at" timestamptz,
+  "last_error"      text,
+  "last_error_category" text,
+  "last_error_at"    timestamptz,
+  "cooldown_until"  timestamptz,
+  "last_recovered_at" timestamptz,
+  "created_at"      timestamptz NOT NULL DEFAULT now(),
+  "updated_at"      timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT provider_pool_accounts_pool_provider_uidx
+    UNIQUE ("network_pool_id", "provider_id", "tenant_id")
+);
+
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_tenant_status_idx
+  ON "provider_pool_accounts" ("tenant_id", "status");
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_provider_status_idx
+  ON "provider_pool_accounts" ("provider_id", "status");
+
+-- Backfill: every existing pool × ip-scoped provider gets its row. The
+-- ip-scoped set is OpenCode Free today; the provider id is spelled here so the
+-- rule stays a data fact, not a code constant.
+INSERT INTO "provider_pool_accounts"
+  ("tenant_id", "network_pool_id", "provider_id", "label")
+SELECT
+  p."tenant_id",
+  p."id",
+  'opencode',
+  'Pool ' || left(p."id"::text, 8)
+FROM "network_pools" p
+ON CONFLICT ("network_pool_id", "provider_id", "tenant_id") DO NOTHING;

package/migrations/full-postgres/0033_add_api_key_ban.sql

@@ -0,0 +1,9 @@
+-- API-key ban state.
+--
+-- A ban is distinct from revoke (terminal, tombstone-like) and disable
+-- (operator toggle, reversible): it records *why* a key was banned
+-- (`ban_reason`) for the console's "See reason" modal. Unban clears both
+-- columns entirely — no tombstone, no leftover metadata.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_at" timestamptz,
+  ADD COLUMN "ban_reason" text;

package/migrations/full-postgres/0034_add_api_key_ban_until.sql

@@ -0,0 +1,7 @@
+-- API-key ban expiry.
+--
+-- A ban may now carry an optional `banned_until`: a timed ban lifts on its
+-- own (auth checks `banned_at` against `banned_until`), while `null` keeps the
+-- earlier permanent-ban behavior. Unban clears all three ban columns.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_until" timestamptz;

package/migrations/full-postgres/0035_align_pool_account_status_enum.sql

@@ -0,0 +1,21 @@
+-- Align `provider_pool_accounts.status` with the shared `health_status` enum.
+--
+-- The table was created with a `text` column plus an inline CHECK (migration
+-- 0032), while every other health-state column uses the `health_status` enum.
+-- The Drizzle schema declares the enum, so the drift checker reported the text
+-- column and its CHECK as "produced by migrations but not in schema". This
+-- migration rewrites the column to the enum: same allowed values, one
+-- canonical type.
+--
+-- The inline CHECK from 0032 must be dropped first: PostgreSQL rewrites
+-- CHECK expressions during an ALTER TYPE, and the old `status IN ('active',
+-- ...)` expression compares the new enum column against text literals, which
+-- has no operator once the column becomes the enum.
+
+ALTER TABLE "provider_pool_accounts" DROP CONSTRAINT "provider_pool_accounts_status_check";
+
+ALTER TABLE "provider_pool_accounts"
+  ALTER COLUMN "status" DROP DEFAULT,
+  ALTER COLUMN "status" SET DATA TYPE "public"."health_status"
+    USING "status"::"public"."health_status",
+  ALTER COLUMN "status" SET DEFAULT 'active';

package/migrations/lite-sqlite3/0027_qoder_identity_genuine_seed.sql

@@ -1,21 +1,20 @@
 -- Qoder native identity: genuine SG identity + per-account seed replay.
 --
--- Research (2026-10-30, see documentation/research/qoder-identity-gate-
--- postmortem.md and qoder-umid-reverse.md) established that the daily-credit
--- campaign gates its CREDITS grant on a *genuine* Alibaba SG-produced
--- identity: generated/deterministic tokens do not reveal the grant on a
--- fresh account, while the `runtime-info` bridge (SG-signed) does.
+-- Research (2026-10-30, see
+-- documentation/archive/research/Qoder-03-umid-and-identity-findings.md)
+-- established that machine identity does not gate the daily-credit campaign.
+-- The seed is retained for deterministic replay of a native identity on
+-- surfaces that may require one; it is not required for campaign eligibility.
 --
 -- Migration 0026 already added `native_identity` (the token triple + optional
 -- seed) with a partial unique index on the extracted machineToken — the
 -- "one device per account" invariant. This migration does not change that
 -- schema; it only documents the contract change on the same column:
 --
---   `seed` is now REQUIRED for a claim-capable identity (the seed is the
---   device material; the token can be re-derived from it, never the reverse).
---   Rows minted by the retired generated path carry `seed = ""` — they stay
---   valid records but must be re-minted through the bridge before the next
---   claim; the store treats a missing/empty seed as "not replay-capable".
+--   `seed` makes a native identity replay-capable (the token can be
+--   re-derived from the seed, never the reverse). Rows minted by the
+--   generated path may have `seed = ""`; that affects native replay only,
+--   not the daily campaign claim.
 --
 -- No DDL is needed: the JSON shape already carries everything. Kept as an
 -- empty migration so the migration numbering records the policy change.

package/migrations/lite-sqlite3/0032_add_provider_pool_accounts.sql

@@ -0,0 +1,44 @@
+-- Pool-as-account routing entities for ip-scoped, credential-less providers.
+--
+-- Mirror of `full-postgres/0032_add_provider_pool_accounts.sql`; see that file
+-- for the rationale. SQLite representation: `id`/`tenant_id`/`network_pool_id`
+-- are text (uuid), `status` is text with a CHECK, timestamps are text.
+CREATE TABLE IF NOT EXISTS "provider_pool_accounts" (
+  "id"            text PRIMARY KEY,
+  "tenant_id"     text NOT NULL REFERENCES "tenants" ("id") ON DELETE CASCADE,
+  "network_pool_id" text NOT NULL REFERENCES "network_pools" ("id") ON DELETE CASCADE,
+  "provider_id"    text NOT NULL,
+  "label"          text NOT NULL,
+  "status"         text NOT NULL DEFAULT 'active'
+                  CHECK ("status" IN ('active', 'cooldown', 'disabled')),
+  "consecutive_failures" integer NOT NULL DEFAULT 0,
+  "last_success_at" text,
+  "last_error"      text,
+  "last_error_category" text,
+  "last_error_at"    text,
+  "cooldown_until"  text,
+  "last_recovered_at" text,
+  "created_at"      text NOT NULL DEFAULT (datetime('now')),
+  "updated_at"      text NOT NULL DEFAULT (datetime('now')),
+  CONSTRAINT provider_pool_accounts_pool_provider_uidx
+    UNIQUE ("network_pool_id", "provider_id", "tenant_id")
+);
+
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_tenant_status_idx
+  ON "provider_pool_accounts" ("tenant_id", "status");
+CREATE INDEX IF NOT EXISTS provider_pool_accounts_provider_status_idx
+  ON "provider_pool_accounts" ("provider_id", "status");
+
+-- Backfill: every existing pool × ip-scoped provider gets its row. The
+-- ip-scoped set is OpenCode Free today; the provider id is spelled here so the
+-- rule stays a data fact, not a code constant. SQLite's bun driver rejects the
+-- newer `ON CONFLICT DO NOTHING` on an INSERT…SELECT, so the equivalent
+-- `INSERT OR IGNORE` form is used here (Postgres version keeps the standard one).
+INSERT OR IGNORE INTO "provider_pool_accounts"
+  ("tenant_id", "network_pool_id", "provider_id", "label")
+SELECT
+  p."tenant_id",
+  p."id",
+  'opencode',
+  'Pool ' || substr(p."id", 1, 8)
+FROM "network_pools" p;

package/migrations/lite-sqlite3/0033_add_api_key_ban.sql

@@ -0,0 +1,8 @@
+-- API-key ban state. Mirror of `full-postgres/0033_add_api_key_ban.sql`;
+-- SQLite stores timestamps as text (ISO), and each `ALTER TABLE ... ADD COLUMN`
+-- may carry exactly one column.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_at" text;
+
+ALTER TABLE "api_keys"
+  ADD COLUMN "ban_reason" text;

package/migrations/lite-sqlite3/0034_add_api_key_ban_until.sql

@@ -0,0 +1,5 @@
+-- API-key ban expiry. Mirror of `full-postgres/0034_add_api_key_ban_until.sql`;
+-- SQLite stores timestamps as text (ISO), and each `ALTER TABLE ... ADD COLUMN`
+-- may carry exactly one column.
+ALTER TABLE "api_keys"
+  ADD COLUMN "banned_until" text;

package/migrations/lite-sqlite3/0035_align_pool_account_status_enum.sql

@@ -0,0 +1,6 @@
+-- SQLite mirror of `full-postgres/0035_align_pool_account_status_enum.sql`.
+--
+-- SQLite has no enum type: `provider_pool_accounts.status` is a `text`
+-- column with a CHECK constraint already (migration 0032), which matches the
+-- shared schema's semantics. Nothing to change here; the file exists so both
+-- backends carry the same numbered migration set.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.7.3",
+  "version": "2.7.4",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",
@@ -48,6 +48,7 @@
     "start": "bun run scripts/cli/main.ts start",
     "doctor": "bun run scripts/cli/doctor.ts",
     "probe:egress": "bun run scripts/tools/probe-egress.ts",
+    "probe:qoder": "bun run scripts/provider-probing/qoder/probe-qoder.ts",
     "restart": "bun run scripts/build/restart.ts",
     "build:aot": "bun run scripts/build/aot.ts",
     "dev:stack": "concurrently -n BACKEND,DASHBOARD -c cyan,magenta --kill-others-on-fail \"bun run dev:backend\" \"bun run dashboard:dev\"",

package/src/boot/app.ts

@@ -221,7 +221,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
     );
     if (reserved) {
-      const notFound = new GatewayError("not_found", 404, "No endpoint exists at this path. Check the route against the API reference.");
+      const notFound = new GatewayError("not_found", 404, "No endpoint exists at this path (request {requestId}). Check the route against the API reference. Nothing here but dust — check the path 🌙");
       return new Response(JSON.stringify(publicGatewayErrorBody(notFound)), {
         status: notFound.status,
         headers: {
@@ -244,8 +244,9 @@ export function createGatewayApp(deps: GatewayAppDeps) {
   // Shutdown ordering: abort in-flight proxy controllers first so the
   // bounded drain observes cancellation and finalizers run before
   // telemetry flush and pool close. The reason is threaded through so the
-  // streaming path emits a drain-aware terminal frame (`restart_for_update`
-  // vs `shutting_down`) instead of a bare abort that reads as a client drop.
+  // streaming path emits a drain-aware terminal frame (`shutting_down` with
+  // reason `restart_for_update` vs plain `shutting_down`) instead of a bare
+  // abort that reads as a client drop.
   // Only production has a coordinator to wire; the shell never drains.
   if (deps.mode === "production") {
     const coordinator = deps.shutdownCoordinator;
@@ -469,7 +470,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         throw new GatewayError(
           "model_not_found",
           404,
-          `The model '${targetId}' does not exist or you do not have access to it.`,
+          `The model '${targetId}' does not exist or you do not have access to it (request {requestId}). Try another model — this one's off the menu 📚`,
         );
       return new Response(JSON.stringify(found), {
         headers: {
@@ -600,14 +601,14 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         // for something only the local host may ask. `invalid_request` told an
         // operator to fix the body, when the body was never the problem.
         if (!isLoopbackPeer(peerAddresses.get(request) ?? null))
-          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback");
+          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
         if (!tokenMatches(request.headers.get("x-drain-token"), token))
-          throw new GatewayError("authentication_failed", 401, "invalid drain token");
+          throw new GatewayError("authentication_failed", 401, "invalid drain token (request {requestId}). Wrong key, right door — check the token 🔑");
         const name = params.name;
         if (!tasks.names().includes(name))
-          throw new GatewayError("invalid_request", 404, `no such task: ${name}`);
+          throw new GatewayError("not_found", 404, `no such task: ${name} (request {requestId}). Nothing here but dust — check the task name 🌙`);
         if (tasks.isRunning(name))
-          throw new GatewayError("invalid_request", 409, `${name} is already running`);
+          throw new GatewayError("invalid_request", 409, `${name} is already running (request {requestId}). One at a time — wait for it to finish ⏳`);
         void tasks.runNow(name);
         return new Response(JSON.stringify({ task: name, status: "started" }), {
           status: 202,

package/src/config/network.ts

@@ -111,10 +111,14 @@ export const DEFAULT_BOUNDS = {
    * the worker sweeps (`runGrowingWaves`, at most 5 concurrent), auth, and
    * readiness.
    *
-   * 20 leaves headroom over that without letting one process hold a large
+   * 16 leaves headroom over that without letting one process hold a large
    * share of the server's `max_connections` (Postgres defaults to 100), which
    * matters because the gateway is designed to run several processes behind
-   * `reusePort` — see `assertPoolFitsServerCapacity`.
+   * `reusePort` — see `assertPoolFitsServerCapacity`. With well-optimized
+   * queries a 16-connection pool sustains a hundred concurrent requests: the
+   * connections are held for microseconds per query, not for the whole
+   * request. If a burst still queues on the pool, fix the query/consumer
+   * that holds connections, rather than raising the ceiling.
    */
-  maxPostgresPoolSize: 8,
+  maxPostgresPoolSize: 16,
 } as const;

package/src/console/api-keys/contracts.ts

@@ -101,6 +101,11 @@ export interface ApiKeyResponse {
   readonly sharePopupBody?: string;
   readonly createdAt: string;
   readonly revokedAt?: string;
+  /** Ban state; see the schema columns for the contract. */
+  readonly bannedAt?: string;
+  readonly banReason?: string;
+  /** When the ban lifts on its own; absent means permanent. */
+  readonly bannedUntil?: string;
   readonly tokensConsumed: number;
 }
 /** Creation result; plaintext is returned only when a personal key is minted. */
@@ -113,6 +118,50 @@ export interface UpdateApiKeyResponse extends ApiKeyResponse {
   readonly secret?: string;
 }
 
+/**
+ * Ban reasons offered by the console dropdown. The first two are the operator's
+ * own: "Instant Ban — Suka suka Gw" for the arbitrary ban, and a template for
+ * suspicious traffic. The rest are generic, and an operator can still type a
+ * custom reason — the dropdown is a convenience, not a closed set.
+ */
+export const API_KEY_BAN_REASONS: readonly { readonly value: string; readonly label: string }[] = [
+  { value: "instant_arbitrary", label: "Instant Ban — Suka suka Gw" },
+  { value: "traffic_suspicious", label: "Your traffic looks suspicious" },
+  { value: "abuse", label: "Abuse of the gateway" },
+  { value: "policy_violation", label: "Policy violation" },
+  { value: "compromised", label: "Key may be compromised" },
+  { value: "quota_exceeded", label: "Quota abused" },
+  { value: "other", label: "Other / custom" },
+] as const;
+
+/**
+ * Ban durations the console offers, in whole minutes. `null` is permanent.
+ * Mirrored by the dashboard (`dashboard/src/lib/ban-durations.ts`) so the UI
+ * and the API agree on one list.
+ */
+export const BAN_DURATION_CHOICES: readonly { readonly minutes: number | null; readonly label: string }[] = [
+  { minutes: 60, label: "1 hour" },
+  { minutes: 6 * 60, label: "6 hours" },
+  { minutes: 12 * 60, label: "12 hours" },
+  { minutes: 24 * 60, label: "1 day" },
+  { minutes: 7 * 24 * 60, label: "7 days" },
+  { minutes: null, label: "Permanent" },
+];
+
+/** What a bare "ban this key" click uses: the shortest, most reversible choice. */
+export const DEFAULT_BAN_MINUTES: number = 60;
+
+/** Body accepted by the ban endpoint. */
+export interface BanApiKeyRequest {
+  readonly reason: string;
+  readonly reasonLabel?: string;
+  /**
+   * Ban duration in whole minutes from {@link BAN_DURATION_CHOICES}; `null`
+   * means permanent. Absent = {@link DEFAULT_BAN_MINUTES}.
+   */
+  readonly minutes?: number | null;
+}
+
 /** API-key route dependency boundary. */
 export interface ApiKeyConfig {
   readonly store: ApiKeyStore;
@@ -400,6 +449,9 @@ export function sanitizeApiKeyResponse(record: ApiKeyRecord): ApiKeyResponse {
       : { clientRouterDenylist: record.clientRouterDenylist }),
     createdAt: record.createdAt.toISOString(),
     ...(record.revokedAt === undefined ? {} : { revokedAt: record.revokedAt.toISOString() }),
+    ...(record.bannedAt === undefined ? {} : { bannedAt: record.bannedAt.toISOString() }),
+    ...(record.banReason === undefined ? {} : { banReason: record.banReason }),
+    ...(record.bannedUntil === undefined ? {} : { bannedUntil: record.bannedUntil.toISOString() }),
     tokensConsumed: record.tokensConsumed,
   };
 }