cartethyia 2.7.4 → 2.7.5

package/migrations/full-postgres/0041_add_daily_checkin_ledger_account_fk.sql

@@ -0,0 +1,7 @@
+-- `daily_checkin_ledger.account_id` referenced `provider_accounts.id` only by
+-- convention; deleting an account left orphan ledger rows behind. This adds the
+-- missing FK with `ON DELETE CASCADE` so a deleted account's daily check-in
+-- markers go with it.
+ALTER TABLE "daily_checkin_ledger"
+  ADD CONSTRAINT "daily_checkin_ledger_account_id_provider_accounts_id_fk"
+  FOREIGN KEY ("account_id") REFERENCES "provider_accounts" ("id") ON DELETE CASCADE;

package/migrations/lite-sqlite3/0036_system_prompt_presets_refs.sql

@@ -0,0 +1,14 @@
+-- Tenant system-prompt injection: presets + combo/alias scopes + scope refs.
+--
+-- Legacy shape: `providers` (followGlobal + optional inline setting), `models`
+-- (providerId::modelId -> setting). New shape: every scope map stores a
+-- reference, and a named preset collection is introduced. Legacy rows remain
+-- readable (the store's defensive reader normalizes them); this migration only
+-- adds the new columns so the new shapes can be written.
+--
+-- SQLite stores JSON as TEXT, so the new maps are TEXT columns with an
+-- empty-object default, mirroring the existing `providers`/`models` TEXT
+-- columns.
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "presets" TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "combos" TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE "tenant_system_prompts" ADD COLUMN "aliases" TEXT NOT NULL DEFAULT '{}';

package/migrations/lite-sqlite3/0037_share_concurrency_scope.sql

@@ -0,0 +1,3 @@
+-- Share-template concurrency scope: family (one cap for all recipients, the
+-- default) vs per_key (each recipient key carries its own cap and counter).
+ALTER TABLE "api_keys" ADD COLUMN "concurrency_scope" TEXT NOT NULL DEFAULT 'family';

package/migrations/lite-sqlite3/0038_add_accounts_quota_snapshot.sql

@@ -0,0 +1,4 @@
+-- SQLite mirror of `full-postgres/0038_add_accounts_quota_snapshot.sql`:
+-- the column is `text` (the SQLite representation of jsonb).
+ALTER TABLE "provider_accounts"
+  ADD COLUMN "quota_snapshot" text;

package/migrations/lite-sqlite3/0039_add_telemetry_provider_model_indexes.sql

@@ -0,0 +1,6 @@
+-- SQLite mirror of `full-postgres/0039_add_telemetry_provider_model_indexes.sql`.
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_provider_created_idx"
+  ON "telemetry_events" ("tenant_id", "provider_id", "created_at");
+
+CREATE INDEX IF NOT EXISTS "telemetry_events_tenant_model_created_idx"
+  ON "telemetry_events" ("tenant_id", "requested_model", "created_at");

package/migrations/lite-sqlite3/0040_add_models_dialect.sql

@@ -0,0 +1,3 @@
+-- Explicit wire dialect per model row (nullable; absent = resolver fallback).
+-- See documentation/features/09-wire-dialects.md.
+ALTER TABLE "models" ADD COLUMN "dialect" TEXT;

package/migrations/lite-sqlite3/0041_add_daily_checkin_ledger_account_fk.sql

@@ -0,0 +1,26 @@
+-- `daily_checkin_ledger.account_id` referenced `provider_accounts.id` only by
+-- convention; deleting an account left orphan ledger rows behind. This adds the
+-- missing FK with `ON DELETE CASCADE` so a deleted account's daily check-in
+-- markers go with it.
+--
+-- SQLite cannot add a FK to an existing table in place, so the ledger is
+-- rebuilt with the constraint. The runner wraps the file in a transaction, so
+-- `PRAGMA foreign_keys = OFF` is unusable (a no-op inside a transaction);
+-- `defer_foreign_keys` postpones enforcement to commit time instead, letting
+-- the drop/rename complete mid-rebuild.
+
+PRAGMA defer_foreign_keys = ON;
+
+CREATE TABLE "daily_checkin_ledger__new" (
+  "day_key" text NOT NULL,
+  "account_id" text NOT NULL,
+  "claimed_at" text DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')) NOT NULL,
+  CONSTRAINT "daily_checkin_ledger_day_key_account_id_pk" PRIMARY KEY("day_key", "account_id"),
+  CONSTRAINT "daily_checkin_ledger_account_id_provider_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "provider_accounts"("id") ON DELETE cascade
+);
+INSERT INTO "daily_checkin_ledger__new" ("day_key", "account_id", "claimed_at")
+  SELECT "day_key", "account_id", "claimed_at" FROM "daily_checkin_ledger";
+DROP TABLE "daily_checkin_ledger";
+ALTER TABLE "daily_checkin_ledger__new" RENAME TO "daily_checkin_ledger";
+
+PRAGMA defer_foreign_keys = OFF;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",
@@ -39,7 +39,7 @@
     "bun": ">=1.4.0"
   },
   "scripts": {
-    "dev": "bun run dev:stack",
+    "dev": "bun run dev:watch",
     "dev:watch": "bun run scripts/dev/supervisor.ts",
     "test": "bun run scripts/test/run.ts",
     "build": "bun run scripts/build/build.ts",
@@ -47,15 +47,13 @@
     "setup": "bun run scripts/cli/setup.ts",
     "start": "bun run scripts/cli/main.ts start",
     "doctor": "bun run scripts/cli/doctor.ts",
-    "probe:egress": "bun run scripts/tools/probe-egress.ts",
-    "probe:qoder": "bun run scripts/provider-probing/qoder/probe-qoder.ts",
     "restart": "bun run scripts/build/restart.ts",
     "build:aot": "bun run scripts/build/aot.ts",
     "dev:stack": "concurrently -n BACKEND,DASHBOARD -c cyan,magenta --kill-others-on-fail \"bun run dev:backend\" \"bun run dashboard:dev\"",
     "typecheck": "tsc --noEmit",
     "test:watch": "bun run scripts/test/run.ts --watch",
     "test-db:up": "docker compose -f docker-compose.test.yml up -d --wait postgres-test",
-    "dev:backend": "bun run --hot src/main.ts",
+    "dev:backend": "bun run src/main.ts",
     "dev:console-auth": "bun run scripts/test/console-session.ts",
     "dev:visual-baseline": "bun run scripts/test/visual-baseline.ts",
     "build:binary": "bun run scripts/build/compile.ts",
@@ -79,7 +77,6 @@
     "jsonrepair": "^3.15.0",
     "pg": "8.23.0",
     "pino": "^10.3.1",
-    "pino-pretty": "^13.1.3",
     "protobufjs": "^7.6.5",
     "socks-proxy-agent": "^10.1.0",
     "systray2": "2.1.4",
@@ -92,6 +89,7 @@
     "bun-types": "1.4.0",
     "concurrently": "^10.0.5",
     "drizzle-kit": "^0.31.11",
+    "pino-pretty": "^13.1.3",
     "typescript": "5.9.2"
   }
 }

package/scripts/cli/update.ts

@@ -1,5 +1,6 @@
 /**
- * The update path.
+ * The update path — CLI-side wrapper over the shared detached-install flow in
+ * `src/console/updates/apply-update.ts`.
  *
  * npm cannot replace this package's directory while a process is executing out
  * of it (EBUSY on Windows). So we spawn the installer as a detached process,
@@ -8,50 +9,20 @@
  * `cartethyia start`), so the new version comes up automatically.
  * Cross-OS: uses npm.cmd on Windows.
  */
-import { spawn } from "node:child_process";
+import {
+  spawnDetachedUpdate,
+  UPDATE_INSTALL_COMMAND,
+  type UpdateStatus,
+} from "../../src/console/updates/apply-update";
 
 export function updateCommand(): string {
-  return "npm install -g cartethyia@latest --prefer-online";
-}
-
-/**
- * Processes still running out of the package directory, so npm can rename it.
- *
- * The rename is the whole install on Windows, and it fails with EBUSY while
- * anything holds the directory — including a hold that outlives the process
- * that took it. `carte` itself runs from that directory, so the install has to
- * wait until this process is gone; these are the others.
- */
-function stopHoldingProcesses(): void {
-  if (process.platform !== "win32") return;
-  // `taskkill` filters on the window title and image name only, so it is asked
-  // for the two processes this CLI can leave behind. /T takes the tree, so a
-  // detached gateway started by a tray goes with it.
-  for (const image of ["cartethyia.exe", "carte.exe"]) {
-    try {
-      spawn("taskkill", ["/F", "/T", "/IM", image], { stdio: "ignore" }).unref();
-    } catch {
-      // A missing taskkill is not the install's problem; npm will report the
-      // hold if one is left.
-    }
-  }
+  return UPDATE_INSTALL_COMMAND;
 }
 
 export function runDetachedUpdate(): void {
-  const isWin = process.platform === "win32";
-  const shell = isWin ? "cmd.exe" : "/bin/sh";
-  const install = "npm install -g cartethyia@latest --prefer-online";
-  const restart = isWin
-    ? "cartethyia start"
-    : "systemctl restart cartethyia 2>/dev/null || cartethyia start";
-  const script = `${install} && ${restart}`;
-  const args = isWin ? ["/c", script] : ["-c", script];
-  stopHoldingProcesses();
-  const child = spawn(shell, args, {
-    detached: true,
-    stdio: "ignore",
-  });
-  child.unref();
+  // The shared module owns stopHoldingProcesses, the wrapper, the status file,
+  // and the update.log redirection; the CLI only prints.
+  spawnDetachedUpdate({});
 }
 
 export function printUpdateInstructions(from: string, to: string | null): void {
@@ -73,4 +44,7 @@ export function printUpdateInstructions(from: string, to: string | null): void {
   console.log("If `carte` still shows the old version afterwards, run:");
   console.log(`  ${updateCommand()}`);
   console.log("");
-}
+}
+
+/** Status shape the shared module writes; re-exported for CLI readers. */
+export type { UpdateStatus };

package/src/boot/app.ts

@@ -27,6 +27,8 @@ import type { ByokUpstreamHost } from "../providers/operations/provider-catalog-
 import type { NetworkPoolSelector } from "../network/pool/selector";
 import type { ProxyRequestPreparer } from "../transport/request/preparer";
 import { ProxyRequestStateStore } from "../transport/request/state";
+import { resolveTenantVisionHandoffModels } from "../transport/request/tenant-preferences";
+import { tryVisionHandoff, type VisionHandoffDeps } from "../transport/vision-handoff";
 import { fastPathname } from "../transport/pathname";
 import {
   handleProviderProxyRequest,
@@ -60,6 +62,7 @@ import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
 import { metrics } from "../observability/metrics";
 import type { RuntimeMetricsSampler } from "../observability/runtime-metrics";
 import { API_CONTENT_SECURITY_POLICY, X_FRAME_OPTIONS } from "../security/outbound-headers";
+import { setProxyBusySource } from "../shared/invoke-guard";
 
 
 import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
@@ -105,7 +108,7 @@ interface GatewayShellDeps {
  * `runtime/dependencies.ts` either supplies it or the app does not boot, so
  * there is no runtime shape check to fall through.
  */
-export interface ProductionAppDeps {
+interface ProductionAppDeps {
   readonly mode: "production";
   readonly db: CartethyiaDatabase;
   readonly proxyPreparer: ProxyRequestPreparer;
@@ -158,6 +161,23 @@ export interface ProductionAppDeps {
 /** Either app mode. The discriminant decides which builder path runs. */
 type GatewayAppDeps = GatewayShellDeps | ProductionAppDeps;
 
+/**
+ * Adapts the static handler's `Uint8Array | undefined` body to `BodyInit`.
+ *
+ * Typed-array buffers are `ArrayBufferLike` (may be a SharedArrayBuffer), but
+ * `BodyInit` only accepts `ArrayBuffer`-backed views, so a direct assignment
+ * does not type-check. The common case reuses the same bytes without copying;
+ * the exotic SharedArrayBuffer case falls back to a copy. This replaces the
+ * old `as unknown as BodyInit` double cast with a structural guard.
+ */
+function staticBodyToInit(body: Uint8Array | undefined): BodyInit | null {
+  if (body === undefined) return null;
+  if (body.buffer instanceof ArrayBuffer) {
+    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+  }
+  return new Uint8Array(body);
+}
+
 function checkDatabaseConnection(): Promise<void> {
   return getDbHandle()
     .query("SELECT 1")
@@ -204,7 +224,7 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     // The client's `accept-encoding` is what decides whether a precompressed
     // `.gz` sibling can be served instead of the plain asset.
     const result = await staticHandler(pathname, request.headers.get("accept-encoding"));
-    return new Response(result.body ? (result.body as unknown as BodyInit) : null, {
+    return new Response(staticBodyToInit(result.body), {
       status: result.status,
       headers: result.headers,
     });
@@ -241,6 +261,38 @@ export function createGatewayApp(deps: GatewayAppDeps) {
     deps.mode === "production" ? deps.shutdownCoordinator : undefined,
   );
   deps.runtimeMetricsSampler?.bindInFlight(() => requestStateStore.inFlightCount());
+  // G-03 InvokeGuard: expose the proxy plane's live in-flight count as the
+  // "foreground busy" source the scheduled worker registry consults before a
+  // tick. Bound once here, where the request store exists; a proxy invoke in
+  // progress (or a page-open console poll) keeps background sweeps from
+  // contending for the single event loop.
+  setProxyBusySource(() => requestStateStore.inFlightCount() > 0);
+  // Vision handoff runs as an internal sub-dispatch when the tenant configured
+  // an ordered list of vision models. Wire the preparer's runner here, where
+  // the request state store and the full dispatch dependency surface exist.
+  if (deps.mode === "production") {
+    deps.proxyPreparer.bindVisionHandoff(async (input) => {
+      const models = await resolveTenantVisionHandoffModels(
+        deps.db,
+        input.authorization.tenantId,
+      );
+      if (models.length === 0) return [];
+      const runnerDeps: VisionHandoffDeps = {
+        db: deps.db,
+        stateStore: requestStateStore,
+        proxyPreparer: deps.proxyPreparer,
+        resolveProviderAdapter: deps.resolveProviderAdapter,
+        byokUpstreamHosts: deps.byokUpstreamHosts,
+        networkBindingFactory: deps.networkBindingFactory,
+        snapshotService: deps.snapshotService,
+        telemetryBuffer: deps.telemetryBuffer,
+        resolveOAuthRefresher: deps.resolveOAuthRefresher,
+        oauthRefreshService: deps.oauthRefreshService,
+        poolSelector: deps.poolSelector,
+      };
+      return tryVisionHandoff(runnerDeps, input, models);
+    });
+  }
   // Shutdown ordering: abort in-flight proxy controllers first so the
   // bounded drain observes cancellation and finalizers run before
   // telemetry flush and pool close. The reason is threaded through so the
@@ -635,6 +687,10 @@ export function createGatewayApp(deps: GatewayAppDeps) {
           stateStore: requestStateStore,
           resolvePeerAddress: (request) => peerAddresses.get(request) ?? null,
           trustedProxyBoundary: deps.trustedProxyBoundary,
+          // The update apply route drains through the process coordinator
+          // before exiting, so the destructive path cannot skip telemetry
+          // flush and pool close.
+          shutdownCoordinator: deps.shutdownCoordinator,
         }),
       );
     }