cartethyia 2.7.5 → 2.7.7

package/dist/dashboard/precompressed-assets.json

@@ -1,76 +1,77 @@
 {
   "count": 119,
   "assets": [
-    "assets/BannedPage-Cj15GsMp.js",
-    "assets/ClaimGiftsButton-D83pBJ6J.js",
-    "assets/CliToolDetailPage-DZKmVuJN.js",
-    "assets/CliToolsPage-BIccZmeL.js",
-    "assets/CombosPage-DEEKkYD-.js",
-    "assets/ConsoleLogPage-D5rol2j2.js",
-    "assets/CustomizationPage-BKj_r0rp.js",
-    "assets/InjectSystemPromptPanel-B5nZvmf0.js",
-    "assets/LoginPage-DkXb6dx-.js",
-    "assets/ModelPicker-DnQPSIA8.js",
-    "assets/OverviewPage-Ci2wQKUz.js",
-    "assets/ProviderDetailPage-odlgYrOg.js",
-    "assets/ProviderIcon-EfeloBn4.js",
-    "assets/ProvidersPage-CqFBQEB8.js",
-    "assets/ProxyPage-5SnUSy3j.js",
-    "assets/QuotaPage-CmnMDzhP.js",
-    "assets/SettingsPage-BJtRZ4qD.js",
-    "assets/SetupPage-WTa0sktC.js",
-    "assets/StudioPage-BfAb5-o_.js",
-    "assets/ToolIcon-K1ckcDKg.js",
-    "assets/UsagePage-BNzeZ2Vk.js",
-    "assets/api-keys-l29JROPv.js",
-    "assets/app--PJWq8_C.css",
-    "assets/app-Bgd3zANQ.js",
+    "assets/BannedPage-B05aF8Dg.js",
+    "assets/CliToolDetailPage-CLUhmjUy.js",
+    "assets/CliToolsPage-CQmrqqrk.js",
+    "assets/CombosPage-CHG_1Wr3.js",
+    "assets/ConsoleLogPage-DPgbklad.js",
+    "assets/CustomizationPage-pnfAqr_-.js",
+    "assets/HealthEventsModal-DGJuU2A6.js",
+    "assets/InjectSystemPromptPanel-C-e2AMz6.js",
+    "assets/LoginPage-J8wPbmfT.js",
+    "assets/ModelPicker-C6WlpU5E.js",
+    "assets/OverviewPage-BSQnF2Lp.js",
+    "assets/ProviderDetailPage-DK_e0FJz.js",
+    "assets/ProviderIcon-jjqXJDA3.js",
+    "assets/ProvidersPage-D_a3r6Gc.js",
+    "assets/ProxyPage-BBTRBAQ3.js",
+    "assets/QuotaPage-B2WqMSG1.js",
+    "assets/SettingsPage-D7xp5Ij_.js",
+    "assets/SetupPage-LND6_Ss7.js",
+    "assets/StudioPage-BzNnm6Bi.js",
+    "assets/ToolIcon-CfeLA-Z_.js",
+    "assets/UsagePage-C1TbL24N.js",
+    "assets/api-keys-KvX83mRe.js",
+    "assets/app-DRnQLhsc.js",
+    "assets/app-mweRcsKp.css",
     "assets/arrow-left-CpBxkoxI.js",
     "assets/arrow-right-Dl5yKnp8.js",
     "assets/arrow-up-59ms1iiT.js",
-    "assets/assert-C0K-c4eo.js",
+    "assets/assert-CidQVoNo.js",
     "assets/backup-file-gdKIlg8U.js",
-    "assets/badge-DfbhQU4k.js",
-    "assets/banner-BllT4LcF.js",
+    "assets/badge-BaX2GTrn.js",
+    "assets/banner-DFH4Bkte.js",
     "assets/brain-Cwed_72z.js",
-    "assets/card-CtkX66Wd.js",
+    "assets/card-CxDw0lK6.js",
     "assets/chevron-left-Bf6CaTSJ.js",
     "assets/chevron-right-BXIy5l3h.js",
     "assets/circle-alert-CntYHV5v.js",
     "assets/circle-check-BU3v_mFW.js",
-    "assets/cli-tools-CQXVMn4P.js",
-    "assets/clipboard-button-BQqBQd2n.js",
+    "assets/circle-question-mark-Cz4un8sH.js",
+    "assets/cli-tools-Bwv5-zGZ.js",
+    "assets/clipboard-button-DfS1ntiq.js",
     "assets/database-Dz9N3zGd.js",
-    "assets/dialog-BEK7KP0H.js",
+    "assets/dialog-BK-NRr5u.js",
     "assets/dialog-actions-B1axpEg7.js",
     "assets/download-dRFo5_Wu.js",
-    "assets/drawer-BrTEZ8zu.js",
-    "assets/entry-CHWxbS56.js",
-    "assets/entry-EBHJ3DrE.js",
-    "assets/entry-LCS85hiq.js",
+    "assets/drawer-QqPul6sC.js",
+    "assets/entry-BMlYJVFj.js",
+    "assets/entry-Dmx7gBiN.js",
+    "assets/entry-vqGb8yVz.js",
     "assets/eye-C_hawfH4.js",
     "assets/eye-off-Bk5g2luF.js",
     "assets/fingerprint-pattern-BWuHtbW4.js",
-    "assets/formatters-BAACA727.js",
+    "assets/formatters-DP-5E01-.js",
     "assets/gauge-BbIMy7MB.js",
-    "assets/github-badge-YSCE4UC2.js",
+    "assets/house-h9AZlJuT.js",
     "assets/image-BPaouViG.js",
-    "assets/index-FQlj0HUT.js",
-    "assets/inline-C4gU5iOL.js",
-    "assets/input-BHHX_Tmm.js",
+    "assets/index-D36vCZht.js",
+    "assets/inline-CHJQwxLa.js",
+    "assets/input-BlmlizVV.js",
     "assets/jsx-runtime-CXUMngI_.js",
     "assets/key-round-UkavsGxp.js",
     "assets/layers-2-glBbjl.js",
-    "assets/layout-CajrYUnD.js",
-    "assets/list-row-Bx2I7XUe.js",
-    "assets/live-DNNqRbj2.js",
+    "assets/layout-Bz93I-yE.js",
+    "assets/list-row-Ml16KCfu.js",
+    "assets/live-7_QpnYGu.js",
     "assets/log-in-BmRjy60c.js",
     "assets/message-circle-CCxGwRvv.js",
     "assets/minimize-2-BTmMTK4o.js",
-    "assets/mutation-Rr0TIvcj.js",
-    "assets/network-C5UBACrJ.js",
-    "assets/numbers-CUWAZK4J.js",
-    "assets/pagination-Xsi9Qx04.js",
+    "assets/mutation-GU7XdEjz.js",
+    "assets/network-CuMDaTzT.js",
+    "assets/numbers-CoqpaDMx.js",
+    "assets/pagination-B5aOoweZ.js",
     "assets/pencil-768ysRAr.js",
     "assets/plus-DIdX_g-x.js",
     "assets/power-off-Yjw9GMJh.js",
@@ -92,23 +93,22 @@
     "assets/providers/openai-light.svg",
     "assets/providers/parallel.svg",
     "assets/providers/tokenharbor.svg",
-    "assets/providers/zai-coding-plan.svg",
-    "assets/query-keys-BloKtaXJ.js",
-    "assets/quota-DvQbD_sr.js",
+    "assets/query-keys-YSoQOUh6.js",
+    "assets/quota-DJ1QlAOq.js",
     "assets/refresh-cw-BqJFk4sU.js",
     "assets/rotate-ccw-CufcqITi.js",
     "assets/route-CNSNj9Zm.js",
-    "assets/routing-in0f_IfK.js",
+    "assets/routing-fnCsxgNO.js",
     "assets/scaling-nWE4Cx8f.js",
     "assets/search-JOKus9rb.js",
-    "assets/select-BLULNqTp.js",
+    "assets/select-C9Ssle9b.js",
     "assets/settings-2-Ds9DQp0t.js",
-    "assets/settings-CcGczj6I.js",
+    "assets/settings-BxslsErn.js",
     "assets/shield-BMQNxORh.js",
     "assets/shield-check-DVS0Foqh.js",
-    "assets/stack-D2lIR0tg.js",
-    "assets/state-DTARjfiW.js",
-    "assets/switch-c0oPSnqW.js",
+    "assets/stack-j7cXjgYX.js",
+    "assets/state-DHmEnLa2.js",
+    "assets/switch-DmZcyTIC.js",
     "assets/terminal-0_IjPWTk.js",
     "assets/tokens-COzario9.js",
     "assets/trash-Cppn5c3R.js",
@@ -116,7 +116,7 @@
     "assets/use-modal-focus-By7oJoGd.js",
     "assets/use-reduced-motion-C4B0R6Sz.js",
     "assets/use-timeout-BwcBBRrT.js",
-    "assets/useMutation-m8WGNPrz.js",
+    "assets/useMutation-CbCP4w1o.js",
     "assets/wrench-B6E1oEuY.js",
     "assets/zap-C4EeVW4q.js",
     "index.html"

package/migrations/full-postgres/0042_add_telemetry_degenerate_stop.sql

@@ -0,0 +1,14 @@
+-- Adds `telemetry_events.degenerate_stop` (boolean, nullable).
+--
+-- Marked on completed requests whose output is far smaller than the model's
+-- ceiling and which ended with an ordinary `stop`. This is the signature of a
+-- model truncating itself on a cached prefix: a short, cut-off reply that the
+-- upstream reported as a clean stop. The column lets an operator measure how
+-- often that happens instead of having to eyeball request detail.
+--
+-- NULL means the row predates this column (or the request never reached a
+-- completed outcome). Only completed requests can carry a value.
+--
+-- `ADD COLUMN IF NOT EXISTS` keeps the file idempotent: a database built from a
+-- newer baseline that already carries the column must not fail startup.
+ALTER TABLE "telemetry_events" ADD COLUMN IF NOT EXISTS "degenerate_stop" boolean;

package/migrations/full-postgres/0043_add_provider_custom_user_agent.sql

@@ -0,0 +1,14 @@
+-- Adds `provider_routing_settings.custom_user_agent` (text, nullable) — an
+-- operator-set custom User-Agent that is stored separately from the provider's
+-- native client identity (`user_agent`). This is the column the dashboard's
+-- custom User-Agent control writes to.
+--
+-- NULL (default) means no custom override: dispatch uses the provider's native
+-- identity. A non-NULL value is an explicit override and is applied at the
+-- request edge (it replaces the User-Agent header even when the provider would
+-- otherwise stamp its own).
+--
+-- Idempotency comes from the migration ledger plus `ADD COLUMN IF NOT EXISTS`:
+-- a database built from a newer baseline that already carries the column must
+-- not fail startup.
+ALTER TABLE "provider_routing_settings" ADD COLUMN IF NOT EXISTS "custom_user_agent" text;

package/migrations/lite-sqlite3/0042_add_telemetry_degenerate_stop.sql

@@ -0,0 +1,12 @@
+-- Adds `telemetry_events.degenerate_stop` (boolean, nullable) — see the
+-- identically named PostgreSQL migration for why. Both backends must apply the
+-- same behavior; SQLite stores it as integer (0/1).
+--
+-- Idempotency comes from the migration ledger, not from the statement: the
+-- runner records the file inside the same transaction, so a file that has
+-- already run is never re-executed. The baseline is generated from
+-- `0000_baseline.sql` alone and does not carry this column.
+--
+-- NOTE: the runner already wraps each migration in a transaction, so this file
+-- must NOT issue BEGIN/COMMIT.
+ALTER TABLE "telemetry_events" ADD COLUMN "degenerate_stop" integer;

package/migrations/lite-sqlite3/0043_add_provider_custom_user_agent.sql

@@ -0,0 +1,10 @@
+-- Adds `provider_routing_settings.custom_user_agent` (text, nullable) — an
+-- operator-set custom User-Agent stored separately from the provider's native
+-- client identity (`user_agent`). SQLite stores text as-is; NULL = no custom
+-- override (native identity is used).
+--
+-- Idempotency comes from the migration ledger, not from the statement: the
+-- runner records the file inside the same transaction, so a file that has
+-- already run is never re-executed. The baseline is generated from
+-- `0000_baseline.sql` alone and does not carry this column.
+ALTER TABLE "provider_routing_settings" ADD COLUMN "custom_user_agent" text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cartethyia",
-  "version": "2.7.5",
+  "version": "2.7.7",
   "description": "A powerful, self-hosted reverse proxy for OpenAI- and Anthropic-compatible AI clients, powered by native Bun and Elysia. It serves both protocols from a single server, routes every model across any configured provider, and translates requests and responses in real time — streaming and prompt caching included. Underneath it runs a full delivery engine: per-account health tracking, quota and cooldown enforcement, automatic failover across pools and providers, usage accounting, and telemetry. Point OpenCode, Cline, Claude Code, Codex, or any compatible client at Cartethyia and it keeps its native protocol while the gateway absorbs every provider-specific difference behind it. Runs on embedded SQLite or external PostgreSQL with optional Redis coordination, ships as a global CLI with a system-tray console, and needs only Bun 1.4+ alongside Node.js/npm.",
   "license": "GPL-3.0-only",
   "type": "module",
@@ -69,6 +69,8 @@
     "check:migrations": "bun run scripts/test/check-migrations.ts"
   },
   "dependencies": {
+    "@grpc/grpc-js": "^1.14.7",
+    "@grpc/proto-loader": "^0.8.1",
     "drizzle-orm": "0.45.2",
     "elysia": "2.0.0-beta.16",
     "enquirer": "^2.4.1",

package/src/boot/dependencies.ts

@@ -28,6 +28,7 @@ import { DrizzleProviderCatalogStore } from "../console/providers/catalog/store"
 import { InMemoryRouteSnapshotService } from "../transport/routing/route-model";
 import { RoutingEngine } from "../transport/routing/router";
 import { RedisAdmissionController } from "../transport/routing/admission";
+import { admissionKey } from "../transport/routing/admission";
 import { ApiKeyAdmissionService } from "../security/admission/service";
 import { InMemoryAdmissionCounterStore } from "../security/admission/in-memory-store";
 import { RedisAdmissionCounterStore } from "../security/admission/redis-store";
@@ -479,10 +480,17 @@ export async function buildProductionDeps(): Promise<ProductionDeps> {
         owned.has(candidate.provider_account_id),
     );
     const snapshot = await routingEngine.accountInflightSnapshot(ownedCandidates);
+    // Map each bucket back to the account it belongs to using the same
+    // `admissionKey` format admission writes with — never string-slicing the
+    // bucket (the trailing segment is the owner tenant, not the account id).
+    const accountByBucket = new Map<string, string>();
+    for (const candidate of ownedCandidates) {
+      accountByBucket.set(admissionKey(candidate), candidate.provider_account_id!);
+    }
     const totals = new Map<string, number>();
     for (const [bucket, count] of snapshot) {
-      const accountId = bucket.slice(bucket.lastIndexOf(":") + 1);
-      if (!owned.has(accountId)) continue;
+      const accountId = accountByBucket.get(bucket);
+      if (accountId === undefined || !owned.has(accountId)) continue;
       totals.set(accountId, (totals.get(accountId) ?? 0) + count);
     }
     return [...totals].map(([accountId, inflight]) => ({ accountId, inflight }));

package/src/config/providers.ts

@@ -91,14 +91,20 @@ export function resolveGithubEnterpriseDomain(): string {
   }
 }
 
+export type GithubCopilotMode = "opencode-copilot" | "vscode-client-real";
+
 /**
- * How cached prompt tokens are accounted. Unknown values fall back to `real`
- * so a typo cannot silently flip every provider to simplified accounting.
+ * Which GitHub Copilot wire identity the adapter uses. Defaults to
+ * `opencode-copilot` (raw GitHub OAuth token + minimal OpenCode headers),
+ * which is the proven-most-stable path (one token, no mint expiry). The
+ * `vscode-client-real` mode matches the VS Code reference client exactly but
+ * requires a freshly minted Copilot token.
  */
-export function resolveCacheMode(): "simplified" | "real" {
+export function resolveGithubCopilotMode(): GithubCopilotMode {
   const raw = readText(
-    "CARTETHYIA_CACHE_MODE",
-    CONFIG_SPEC.CARTETHYIA_CACHE_MODE,
-  ).toLowerCase();
-  return raw === "simplified" ? "simplified" : "real";
+    "CARTETHYIA_GITHUB_COPILOT_MODE",
+    CONFIG_SPEC.CARTETHYIA_GITHUB_COPILOT_MODE,
+  ).trim().toLowerCase();
+  if (raw === "vscode-client-real") return "vscode-client-real";
+  return "opencode-copilot";
 }

package/src/config/security.ts

@@ -9,7 +9,7 @@ const ENCRYPTION_KEY_LENGTH = 32;
 
 /**
  * Per-IP request ceiling for the unauthenticated abuse-protection layer.
- * Defaults to 240 requests per window so an unset env does not mean unlimited;
+ * Defaults to 540 requests per window so an unset env does not mean unlimited;
  * operators tune it via `IP_RATE_MAX_PER_WINDOW`.
  */
 export function resolveIpRateLimit(): number {

package/src/config/spec.ts

@@ -89,11 +89,12 @@ export const CONFIG_SPEC = {
   CARTETHYIA_API_KEY: { kind: "optional-text" },
   CARTETHYIA_SERVER_MAX_BODY_BYTES: {
     kind: "int",
-    // A 500K-token context is roughly 2 MB of text, so 4 MB admits every real
-    // request while halving the worst-case hold. How many may be in flight is
-    // admission's job, so an operator with larger payloads raises this and
-    // sets the ceiling in Settings.
-    default: 4 * 1024 * 1024,
+    // A 1M-token context is roughly 4+ MB of text (Qoder gRPC/legacy paths
+    // accept it), so 16 MB admits every real request while bounding the
+    // worst-case hold. How many may be in flight is admission's job, so an
+    // operator with even larger payloads raises this and sets the ceiling in
+    // Settings.
+    default: 16 * 1024 * 1024,
     min: 1024,
     max: Number.MAX_SAFE_INTEGER,
   },
@@ -172,6 +173,12 @@ export const CONFIG_SPEC = {
    */
   CARTETHYIA_DISABLED_TASKS: { kind: "list" },
 
+  /**
+   * Force the Qoder UMID bridge to the mini-ELF bundle on Linux
+   * (`1` = always mini, `0` = never mini; absent = auto-detect containers).
+   */
+  CARTETHYIA_QODER_UMID_MINI: { kind: "int", default: 0, min: 0, max: 1 },
+
   /**
    * How long a day's telemetry is kept, in days.
    *
@@ -188,6 +195,13 @@ export const CONFIG_SPEC = {
     min: 1 * 1024 * 1024,
     max: 16 * 1024 * 1024,
   },
+  // Input-token accounting for usage display. Providers disagree on whether
+  // `input_tokens` already includes cached tokens: OpenAI/DeepSeek report the
+  // inclusive total with a cached subset, while Anthropic reports fresh-only
+  // with cache reads separate. `inclusive` (default) folds cache into input so
+  // every provider reads alike — IN is always the whole prompt and CACHED its
+  // subset. `as-is` keeps the raw upstream semantics.
+  CARTETHYIA_USAGE_INPUT_MODE: { kind: "text", default: "inclusive" },
 
   // Upstream request timeout + retry backoff
   //
@@ -262,7 +276,7 @@ export const CONFIG_SPEC = {
   CARTETHYIA_PROXY_MAX_FREE_SOCKETS: { kind: "int", default: 20, min: 0, max: 100_000 },
 
   // Security (encryption key, public origin, abuse ceiling)
-  IP_RATE_MAX_PER_WINDOW: { kind: "int", default: 240, min: 1, max: Number.MAX_SAFE_INTEGER },
+  IP_RATE_MAX_PER_WINDOW: { kind: "int", default: 540, min: 1, max: Number.MAX_SAFE_INTEGER },
   CARTETHYIA_ENCRYPTION_KEY: {
     kind: "required",
     error:
@@ -297,20 +311,20 @@ export const CONFIG_SPEC = {
    * an operator on one has no other way to point the login at it.
    */
   CARTETHYIA_GITHUB_ENTERPRISE_DOMAIN: { kind: "text", default: "" },
-  // Only the literal true opts active ZCode accounts into daily gift claims.
-  CARTETHYIA_ZCODE_AUTO_CLAIM: { kind: "text", default: "false" },
   /**
-   * How cached prompt tokens are accounted.
+   * Which wire identity the GitHub Copilot Auto/chat path presents to the
+   * upstream:
    *
-   * - `simplified` (default): the request is cache-eligible when the provider
-   *   reports a cache hit (`cached_input_tokens > 0`); every input token is
-   *   then counted as cached. A reported `0` or an absent report are both a
-   *   cache miss and stay uncached.
-   * - `real`: the provider's reported cache numbers are kept as-is (the
-   *   pre-2.7.6 behavior). Use it when the exact per-provider split matters
-   *   more than a uniform hit-rate reading.
+   * - `opencode-copilot` (default): the long-lived GitHub OAuth token + minimal
+   *   OpenCode headers. One token, no mint step, no short-lived minted-token
+   *   expiry. This is the most stable in practice.
+   * - `vscode-client-real`: a freshly minted Copilot token + the full VS Code
+   *   reference headers. Matches the VS Code client exactly, but requires the
+   *   minted token (expires ~25 min) and the reference identity.
    */
-  CARTETHYIA_CACHE_MODE: { kind: "text", default: "simplified" },
+  CARTETHYIA_GITHUB_COPILOT_MODE: { kind: "text", default: "opencode-copilot" },
+  // Only the literal true opts active ZCode accounts into daily gift claims.
+  CARTETHYIA_ZCODE_AUTO_CLAIM: { kind: "text", default: "false" },
   /**
    * Free-tier OpenCode ids the listing still advertises but upstream refuses.
    * Replaces the bundled list outright; the single token `none` trusts the

package/src/config/usage.ts

@@ -0,0 +1,27 @@
+/**
+ * Usage input-token accounting mode.
+ *
+ * Providers disagree on whether `input_tokens` already includes cached tokens.
+ * OpenAI/DeepSeek report the inclusive total with a cached subset; Anthropic
+ * reports fresh-only with cache reads (and writes) separate. `normalizeUsage`
+ * reads this mode to decide whether to fold cache into input so every provider
+ * reads alike (`inclusive`, the default) or to keep the raw upstream semantics
+ * (`as-is`).
+ */
+
+import { CONFIG_SPEC, readText } from "./spec";
+
+export type UsageInputMode = "inclusive" | "as-is";
+
+/** Resolves the operator's chosen accounting mode; defaults to inclusive. */
+export function resolveUsageInputMode(): UsageInputMode {
+  const raw = readText(
+    "CARTETHYIA_USAGE_INPUT_MODE",
+    CONFIG_SPEC.CARTETHYIA_USAGE_INPUT_MODE,
+  )
+    .trim()
+    .toLowerCase();
+  if (raw === "inclusive") return "inclusive";
+  if (raw === "as-is") return "as-is";
+  throw new Error('CARTETHYIA_USAGE_INPUT_MODE must be "inclusive" or "as-is"');
+}

package/src/console/api-keys/routes.ts

@@ -41,7 +41,6 @@ import {
 } from "./contracts";
 import type { SharedKeyActivityDetail, SharedKeySummary } from "../share/share-usage";
 import { popupImageBytes } from "./share-popup-image";
-import { log } from "../../observability/logger";
 
 const SHARED_CHILD_SORT_COLUMNS = new Set<SharedChildSortColumn>([
   "createdAt",
@@ -87,33 +86,23 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         const topLevel = records.filter(
           (record) => record.revokedAt === undefined && record.parentKeyId === undefined,
         );
-        // A share template's own counter never moves for child traffic, so
-        // reporting it raw would show a template as untouched while the gateway
-        // is refusing its recipients on the parent budget. Report the figure
-        // the gateway actually enforces: the template's counter plus every
-        // telemetry total the family ever recorded — revoked/deleted children
-        // included (their spend is already spent), so the number survives
-        // cleanup and matches the share page.
+        // A share template's own counter is the live family accumulator now:
+        // every recipient commit adds to it (see ApiKeyAdmissionService
+        // commitUsage), so reporting it raw gives the enforced family total.
+        // No telemetry add-on is needed, and adding it here would double-count.
         return Promise.all(
           topLevel.map(async (record) => {
             const response = sanitizeApiKeyResponse(record);
             if (record.keyMode !== "share") return response;
-            const family = await config.store
-              .sumFamilyTelemetryConsumed(authorized.tenantId, record.id)
-              .catch((error) => {
-                // A failed sum must not fail the whole list, but it must not
-                // be silent either: reporting the share template's spend as 0
-                // under-reports consumed tokens in the console list.
-                log.warn(
-                  `[api-keys] sumFamilyTelemetryConsumed failed for key ${record.id}; reporting 0`,
-                  error as Error,
-                );
-                return 0;
-              });
-            return { ...response, tokensConsumed: response.tokensConsumed + family };
+            return response;
           }),
-        );
-      },
+      );
+    },
+    async listActiveBannedKeys(access: AccessDecision | undefined): Promise<ApiKeyResponse[]> {
+      const authorized = requireTenantScope(access, "dashboard:read");
+      const records = await config.store.listActiveBanned(authorized.tenantId);
+      return records.map(sanitizeApiKeyResponse);
+    },
     /** Persists a new credential order. `keyIds` must name every top-level key
         the tenant has, so a partial list cannot silently renumber rows. */
     async reorderKeys(access: AccessDecision | undefined, keyIds: readonly string[]): Promise<void> {
@@ -939,6 +928,13 @@ export function createApiKeyRoutes(config: ApiKeyConfig): AnyElysia {
         return errorResponse(error, set, "API-key operation failed");
       }
     })
+    .get("/banned", async ({ request, set }) => {
+      try {
+        return await factory.listActiveBannedKeys(config.accessResolver(request));
+      } catch (error) {
+        return errorResponse(error, set, "API-key operation failed");
+      }
+    })
     .post("/reorder", { body: reorderKeysBody }, async ({ request, body, set }) => {
       try {
         await factory.reorderKeys(config.accessResolver(request), body.keyIds);