cartethyia 2.7.3 → 2.7.5

package/scripts/cli/update.ts

@@ -1,5 +1,6 @@
 /**
- * The update path.
+ * The update path — CLI-side wrapper over the shared detached-install flow in
+ * `src/console/updates/apply-update.ts`.
  *
  * npm cannot replace this package's directory while a process is executing out
  * of it (EBUSY on Windows). So we spawn the installer as a detached process,
@@ -8,50 +9,20 @@
  * `cartethyia start`), so the new version comes up automatically.
  * Cross-OS: uses npm.cmd on Windows.
  */
-import { spawn } from "node:child_process";
+import {
+  spawnDetachedUpdate,
+  UPDATE_INSTALL_COMMAND,
+  type UpdateStatus,
+} from "../../src/console/updates/apply-update";
 
 export function updateCommand(): string {
-  return "npm install -g cartethyia@latest --prefer-online";
-}
-
-/**
- * Processes still running out of the package directory, so npm can rename it.
- *
- * The rename is the whole install on Windows, and it fails with EBUSY while
- * anything holds the directory — including a hold that outlives the process
- * that took it. `carte` itself runs from that directory, so the install has to
- * wait until this process is gone; these are the others.
- */
-function stopHoldingProcesses(): void {
-  if (process.platform !== "win32") return;
-  // `taskkill` filters on the window title and image name only, so it is asked
-  // for the two processes this CLI can leave behind. /T takes the tree, so a
-  // detached gateway started by a tray goes with it.
-  for (const image of ["cartethyia.exe", "carte.exe"]) {
-    try {
-      spawn("taskkill", ["/F", "/T", "/IM", image], { stdio: "ignore" }).unref();
-    } catch {
-      // A missing taskkill is not the install's problem; npm will report the
-      // hold if one is left.
-    }
-  }
+  return UPDATE_INSTALL_COMMAND;
 }
 
 export function runDetachedUpdate(): void {
-  const isWin = process.platform === "win32";
-  const shell = isWin ? "cmd.exe" : "/bin/sh";
-  const install = "npm install -g cartethyia@latest --prefer-online";
-  const restart = isWin
-    ? "cartethyia start"
-    : "systemctl restart cartethyia 2>/dev/null || cartethyia start";
-  const script = `${install} && ${restart}`;
-  const args = isWin ? ["/c", script] : ["-c", script];
-  stopHoldingProcesses();
-  const child = spawn(shell, args, {
-    detached: true,
-    stdio: "ignore",
-  });
-  child.unref();
+  // The shared module owns stopHoldingProcesses, the wrapper, the status file,
+  // and the update.log redirection; the CLI only prints.
+  spawnDetachedUpdate({});
 }
 
 export function printUpdateInstructions(from: string, to: string | null): void {
@@ -73,4 +44,7 @@ export function printUpdateInstructions(from: string, to: string | null): void {
   console.log("If `carte` still shows the old version afterwards, run:");
   console.log(`  ${updateCommand()}`);
   console.log("");
-}
+}
+
+/** Status shape the shared module writes; re-exported for CLI readers. */
+export type { UpdateStatus };

package/src/boot/app.ts

@@ -27,6 +27,8 @@ import type { ByokUpstreamHost } from "../providers/operations/provider-catalog-
 import type { NetworkPoolSelector } from "../network/pool/selector";
 import type { ProxyRequestPreparer } from "../transport/request/preparer";
 import { ProxyRequestStateStore } from "../transport/request/state";
+import { resolveTenantVisionHandoffModels } from "../transport/request/tenant-preferences";
+import { tryVisionHandoff, type VisionHandoffDeps } from "../transport/vision-handoff";
 import { fastPathname } from "../transport/pathname";
 import {
   handleProviderProxyRequest,
@@ -60,6 +62,7 @@ import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
 import { metrics } from "../observability/metrics";
 import type { RuntimeMetricsSampler } from "../observability/runtime-metrics";
 import { API_CONTENT_SECURITY_POLICY, X_FRAME_OPTIONS } from "../security/outbound-headers";
+import { setProxyBusySource } from "../shared/invoke-guard";
 
 
 import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
@@ -105,7 +108,7 @@ interface GatewayShellDeps {
  * `runtime/dependencies.ts` either supplies it or the app does not boot, so
  * there is no runtime shape check to fall through.
  */
-export interface ProductionAppDeps {
+interface ProductionAppDeps {
   readonly mode: "production";
   readonly db: CartethyiaDatabase;
   readonly proxyPreparer: ProxyRequestPreparer;
@@ -158,6 +161,23 @@ export interface ProductionAppDeps {
 /** Either app mode. The discriminant decides which builder path runs. */
 type GatewayAppDeps = GatewayShellDeps | ProductionAppDeps;
 
+/**
+ * Adapts the static handler's `Uint8Array | undefined` body to `BodyInit`.
+ *
+ * Typed-array buffers are `ArrayBufferLike` (may be a SharedArrayBuffer), but
+ * `BodyInit` only accepts `ArrayBuffer`-backed views, so a direct assignment
+ * does not type-check. The common case reuses the same bytes without copying;
+ * the exotic SharedArrayBuffer case falls back to a copy. This replaces the
+ * old `as unknown as BodyInit` double cast with a structural guard.
+ */
+function staticBodyToInit(body: Uint8Array | undefined): BodyInit | null {
+  if (body === undefined) return null;
+  if (body.buffer instanceof ArrayBuffer) {
+    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+  }
+  return new Uint8Array(body);
+}
+
 function checkDatabaseConnection(): Promise<void> {
   return getDbHandle()
     .query("SELECT 1")
@@ -204,7 +224,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     // The client's `accept-encoding` is what decides whether a precompressed
     // `.gz` sibling can be served instead of the plain asset.
     const result = await staticHandler(pathname, request.headers.get("accept-encoding"));
-    return new Response(result.body ? (result.body as unknown as BodyInit) : null, {
+    return new Response(staticBodyToInit(result.body), {
       status: result.status,
       headers: result.headers,
     });
@@ -221,7 +241,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
       (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
     );
     if (reserved) {
-      const notFound = new GatewayError("not_found", 404, "No endpoint exists at this path. Check the route against the API reference.");
+      const notFound = new GatewayError("not_found", 404, "No endpoint exists at this path (request {requestId}). Check the route against the API reference. Nothing here but dust — check the path 🌙");
       return new Response(JSON.stringify(publicGatewayErrorBody(notFound)), {
         status: notFound.status,
         headers: {
@@ -241,11 +261,44 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     deps.mode === "production" ? deps.shutdownCoordinator : undefined,
   );
   deps.runtimeMetricsSampler?.bindInFlight(() => requestStateStore.inFlightCount());
+  // G-03 InvokeGuard: expose the proxy plane's live in-flight count as the
+  // "foreground busy" source the scheduled worker registry consults before a
+  // tick. Bound once here, where the request store exists; a proxy invoke in
+  // progress (or a page-open console poll) keeps background sweeps from
+  // contending for the single event loop.
+  setProxyBusySource(() => requestStateStore.inFlightCount() > 0);
+  // Vision handoff runs as an internal sub-dispatch when the tenant configured
+  // an ordered list of vision models. Wire the preparer's runner here, where
+  // the request state store and the full dispatch dependency surface exist.
+  if (deps.mode === "production") {
+    deps.proxyPreparer.bindVisionHandoff(async (input) => {
+      const models = await resolveTenantVisionHandoffModels(
+        deps.db,
+        input.authorization.tenantId,
+      );
+      if (models.length === 0) return [];
+      const runnerDeps: VisionHandoffDeps = {
+        db: deps.db,
+        stateStore: requestStateStore,
+        proxyPreparer: deps.proxyPreparer,
+        resolveProviderAdapter: deps.resolveProviderAdapter,
+        byokUpstreamHosts: deps.byokUpstreamHosts,
+        networkBindingFactory: deps.networkBindingFactory,
+        snapshotService: deps.snapshotService,
+        telemetryBuffer: deps.telemetryBuffer,
+        resolveOAuthRefresher: deps.resolveOAuthRefresher,
+        oauthRefreshService: deps.oauthRefreshService,
+        poolSelector: deps.poolSelector,
+      };
+      return tryVisionHandoff(runnerDeps, input, models);
+    });
+  }
   // Shutdown ordering: abort in-flight proxy controllers first so the
   // bounded drain observes cancellation and finalizers run before
   // telemetry flush and pool close. The reason is threaded through so the
-  // streaming path emits a drain-aware terminal frame (`restart_for_update`
-  // vs `shutting_down`) instead of a bare abort that reads as a client drop.
+  // streaming path emits a drain-aware terminal frame (`shutting_down` with
+  // reason `restart_for_update` vs plain `shutting_down`) instead of a bare
+  // abort that reads as a client drop.
   // Only production has a coordinator to wire; the shell never drains.
   if (deps.mode === "production") {
     const coordinator = deps.shutdownCoordinator;
@@ -469,7 +522,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         throw new GatewayError(
           "model_not_found",
           404,
-          `The model '${targetId}' does not exist or you do not have access to it.`,
+          `The model '${targetId}' does not exist or you do not have access to it (request {requestId}). Try another model — this one's off the menu 📚`,
         );
       return new Response(JSON.stringify(found), {
         headers: {
@@ -600,14 +653,14 @@ export function createGatewayApp(deps: GatewayAppDeps) {
         // for something only the local host may ask. `invalid_request` told an
         // operator to fix the body, when the body was never the problem.
         if (!isLoopbackPeer(peerAddresses.get(request) ?? null))
-          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback");
+          throw new GatewayError("policy_rejected", 403, "task trigger is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
         if (!tokenMatches(request.headers.get("x-drain-token"), token))
-          throw new GatewayError("authentication_failed", 401, "invalid drain token");
+          throw new GatewayError("authentication_failed", 401, "invalid drain token (request {requestId}). Wrong key, right door — check the token 🔑");
         const name = params.name;
         if (!tasks.names().includes(name))
-          throw new GatewayError("invalid_request", 404, `no such task: ${name}`);
+          throw new GatewayError("not_found", 404, `no such task: ${name} (request {requestId}). Nothing here but dust — check the task name 🌙`);
         if (tasks.isRunning(name))
-          throw new GatewayError("invalid_request", 409, `${name} is already running`);
+          throw new GatewayError("invalid_request", 409, `${name} is already running (request {requestId}). One at a time — wait for it to finish ⏳`);
         void tasks.runNow(name);
         return new Response(JSON.stringify({ task: name, status: "started" }), {
           status: 202,
@@ -634,6 +687,10 @@ export function createGatewayApp(deps: GatewayAppDeps) {
           stateStore: requestStateStore,
           resolvePeerAddress: (request) => peerAddresses.get(request) ?? null,
           trustedProxyBoundary: deps.trustedProxyBoundary,
+          // The update apply route drains through the process coordinator
+          // before exiting, so the destructive path cannot skip telemetry
+          // flush and pool close.
+          shutdownCoordinator: deps.shutdownCoordinator,
         }),
       );
     }