cartethyia 2.7.9 → 2.8.1

package/src/console/providers/detail/routes.ts

@@ -163,6 +163,7 @@ const updateRoutingBody = t.Object({
   usageFloor: t.Optional(t.Nullable(t.Integer({ minimum: 0, maximum: 1_000_000 }))),
   usageFloorUnit: t.Optional(t.Union([t.Literal("credit"), t.Literal("percent")])),
   skipProxy: t.Optional(t.Boolean()),
+  deviceFlowProxy: t.Optional(t.Union([t.Literal("random"), t.Literal("direct")])),
   userAgent: t.Optional(t.String({ minLength: 0, maxLength: 4096 })),
   customUserAgent: t.Optional(t.Nullable(t.String({ minLength: 0, maxLength: 4096 }))),
 });

package/src/console/providers/detail/store.ts

@@ -40,6 +40,7 @@ function mapRow(row: typeof providerRoutingSettings.$inferSelect): ProviderRouti
     usageFloorUnit: row.usageFloorUnit === "credit" ? "credit" : "percent",
     enabled: row.enabled,
     skipProxy: row.skipProxy,
+    deviceFlowProxy: row.deviceFlowProxy === "direct" ? "direct" : "random",
     userAgent: row.userAgent,
     customUserAgent: row.customUserAgent,
   };
@@ -94,6 +95,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
       usageFloorUnit: "percent",
       enabled: false,
       skipProxy: defaultSkipProxy(providerId),
+      deviceFlowProxy: "random",
       userAgent: buildClaudeCliUserAgent(),
       customUserAgent: null,
     };
@@ -117,6 +119,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
       usageFloorUnit: patch.usageFloorUnit ?? "percent",
       enabled: patch.enabled ?? false,
       skipProxy: patch.skipProxy ?? defaultSkipProxy(providerId),
+      deviceFlowProxy: patch.deviceFlowProxy ?? "random",
       userAgent: patch.userAgent ?? buildClaudeCliUserAgent(),
       customUserAgent: patch.customUserAgent ?? null,
     };
@@ -130,6 +133,7 @@ export class DrizzleProviderDetailStore implements ProviderDetailStore {
     if (patch.usageFloorUnit !== undefined) setClause.usageFloorUnit = patch.usageFloorUnit;
     if (patch.enabled !== undefined) setClause.enabled = patch.enabled;
     if (patch.skipProxy !== undefined) setClause.skipProxy = patch.skipProxy;
+    if (patch.deviceFlowProxy !== undefined) setClause.deviceFlowProxy = patch.deviceFlowProxy;
     if (patch.userAgent !== undefined) setClause.userAgent = patch.userAgent;
     if (patch.customUserAgent !== undefined) setClause.customUserAgent = patch.customUserAgent;
     const upserted = await this.db

package/src/console/providers/oauth/callback-listener.ts

@@ -158,14 +158,14 @@ export class OAuthCallbackListener {
   /**
    * The paths one login may deliver its callback on. Kiro's portal is observed
    * (unpacked IDE 1.4.62) to redirect to both `/oauth/callback` and
-   * `/signin/callback`; binding only the advertised path left a redirect to the
-   * other one hitting a 404 and the login hanging. Other providers neither
-   * register nor expect `/signin/callback`, so adding it is harmless.
+   * `/signin/callback`; DeepAI's desktop flow lands on `/auth-callback`.
+   * Binding only the advertised path left a redirect to the other one hitting
+   * a 404 and the login hanging. Other providers neither register nor expect
+   * these, so adding them is harmless.
    */
   #callbackPaths(advertised: string): readonly string[] {
-    return advertised === "/signin/callback"
-      ? [advertised]
-      : [advertised, "/signin/callback"];
+    const extras = advertised === "/signin/callback" ? [] : ["/signin/callback", "/auth-callback"];
+    return [advertised, ...extras];
   }
 
   /** Drops a flow and frees its port when nothing else is waiting on it. */
@@ -235,13 +235,32 @@ export class OAuthCallbackListener {
     listener.flows.set(state, { providerId, paths, timer, inFlight: false });
   }
 
-  #forget(port: number, listener: PortListener, state: string): void {
+  #forget(
+    port: number,
+    listener: PortListener,
+    state: string,
+    options: { readonly deferStop?: boolean } = {},
+  ): void {
     const flow = listener.flows.get(state);
     if (flow !== undefined) clearTimeout(flow.timer);
     listener.flows.delete(state);
     if (listener.flows.size > 0) return;
     this.#ports.delete(port);
-    for (const server of listener.servers) void server.stop(true);
+    const stopServers = () => {
+      for (const server of listener.servers) void server.stop(true);
+    };
+    if (options.deferStop === true) {
+      // The stop is called from inside a callback handler that is about to
+      // return its Response. `stop(true)` closes active connections, so
+      // stopping synchronously here kills the very response the browser is
+      // waiting for — the login "succeeds" server-side while the callback tab
+      // sees a connection reset (observed live: HTTP 000, and more reliably on
+      // deployed/docker hosts). Defer the stop one tick so the response is
+      // flushed first; the port is freed a moment later.
+      setTimeout(stopServers, 50);
+    } else {
+      stopServers();
+    }
     log.info(`[oauth] callback listener released on 127.0.0.1:${port}`);
   }
 
@@ -311,7 +330,7 @@ export class OAuthCallbackListener {
     if (error !== null) {
       // A denial carries the state only when the server echoes one; clear it
       // when present so a retry starts a fresh flow.
-      if (state.length > 0) this.#forget(endpoint.port, listener, state);
+      if (state.length > 0) this.#forget(endpoint.port, listener, state, { deferStop: true });
       return new Response(
         `<!doctype html><html><body><p>OAuth login failed: ${escapeHtml(error)}</p></body></html>`,
         { status: 400, headers: { "content-type": "text/html; charset=utf-8" } },
@@ -374,7 +393,7 @@ export class OAuthCallbackListener {
         Object.keys(callbackParams).length > 0 ? callbackParams : undefined,
       );
     } catch (failure) {
-      if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
+      if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState, { deferStop: true });
       const message = failure instanceof Error ? failure.message : "OAuth login failed";
       log.error(`[oauth] callback completion failed for ${matched.providerId}: ${message}`);
       return new Response(
@@ -393,7 +412,7 @@ export class OAuthCallbackListener {
         headers: { location: result.redirectUrl },
       });
     }
-    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState);
+    if (matchedState !== undefined) this.#forget(endpoint.port, listener, matchedState, { deferStop: true });
     if (!result.ok) {
       return new Response(
         `<!doctype html><html><body><p>OAuth login failed: ${escapeHtml(result.message)}</p></body></html>`,

package/src/console/providers/oauth/device-egress.ts

@@ -0,0 +1,123 @@
+// Device-flow OAuth egress resolution.
+//
+// Device-code flows (start + poll) previously always dialed from the
+// gateway's own egress, so every code minted on one host appeared to come
+// from a single IP — which let Cursor/Grok/other device-code providers flag
+// "multiple codes from one IP". The `device_flow_proxy` routing setting says
+// whether to route these requests through one of the tenant's active network
+// pools ("random", the default) or direct ("direct").
+//
+// The resolved fetch is a validated fetch bound to either a pool or the
+// gateway's direct egress, and is injected into the OAuth flow context so the
+// provider client uses it for its device-authorization and token-poll calls.
+
+import { eq, and, isNull } from "drizzle-orm";
+import type { DeviceFlowProxyMode } from "../../../persistence/schema";
+import { networkPools, providerRoutingSettings } from "../../../persistence/schema";
+import type { CartethyiaDatabase } from "../../../persistence/db-handle";
+import type { NetworkPoolSelector } from "../../../network/pool/selector";
+import type { ValidatedNetworkBindingFactory } from "../../../network/egress/factory";
+import type { FetchLike } from "../../../providers/authentication/oauth-flow-store";
+
+/** A resolved device-flow egress: the fetch to use, plus its release hook. */
+export interface DeviceEgress {
+  readonly fetch: FetchLike;
+  /** Release an acquired pool slot (no-op for direct egress). */
+  readonly release: () => void;
+  /** The pool selected, when one was (for correlation/persistence). */
+  readonly networkPoolId?: string;
+}
+
+/** Dependencies the device-egress resolver needs. */
+export interface DeviceEgressDeps {
+  readonly db: CartethyiaDatabase;
+  readonly poolSelector: NetworkPoolSelector;
+  readonly networkBindingFactory: ValidatedNetworkBindingFactory;
+}
+
+/** Reads the provider's `device_flow_proxy` mode; absent rows default to `random`. */
+async function resolveDeviceFlowProxyMode(
+  db: CartethyiaDatabase,
+  providerId: string,
+  tenantId: string | null,
+): Promise<DeviceFlowProxyMode> {
+  if (tenantId !== null) {
+    const tenantRow = await db
+      .select({ mode: providerRoutingSettings.deviceFlowProxy })
+      .from(providerRoutingSettings)
+      .where(
+        and(
+          eq(providerRoutingSettings.providerId, providerId),
+          eq(providerRoutingSettings.tenantId, tenantId),
+        ),
+      )
+      .limit(1);
+    if (tenantRow[0]) return tenantRow[0].mode === "direct" ? "direct" : "random";
+  }
+  const globalRow = await db
+    .select({ mode: providerRoutingSettings.deviceFlowProxy })
+    .from(providerRoutingSettings)
+    .where(
+      and(
+        eq(providerRoutingSettings.providerId, providerId),
+        isNull(providerRoutingSettings.tenantId),
+      ),
+    )
+    .limit(1);
+  return globalRow[0]?.mode === "direct" ? "direct" : "random";
+}
+
+/**
+ * Resolves the egress for one device-code flow. `random` selects an active
+ * network pool (weighted, cooldown-aware) when one is available and falls
+ * back to direct egress when the tenant has no usable pool; `direct` always
+ * dials direct. The returned fetch is what the provider client must use for
+ * its device-authorization and token-poll requests.
+ */
+export async function resolveDeviceEgress(
+  deps: DeviceEgressDeps,
+  providerId: string,
+  tenantId: string | null,
+): Promise<DeviceEgress> {
+  const mode = await resolveDeviceFlowProxyMode(deps.db, providerId, tenantId);
+  const direct = (): DeviceEgress => ({
+    fetch: deps.networkBindingFactory.fetch(undefined, tenantId ?? undefined),
+    release: () => undefined,
+  });
+
+  if (mode === "direct" || tenantId === null) return direct();
+
+  const poolRows = await deps.db
+    .select({
+      id: networkPools.id,
+      maxInflight: networkPools.maxInflight,
+      weight: networkPools.weight,
+    })
+    .from(networkPools)
+    .where(and(eq(networkPools.tenantId, tenantId), eq(networkPools.status, "active")));
+
+  if (poolRows.length > 0) {
+    const limits: Record<string, number> = {};
+    const weights: Record<string, number> = {};
+    for (const pool of poolRows) {
+      limits[pool.id] = pool.maxInflight ?? 10;
+      weights[pool.id] = pool.weight ?? 100;
+    }
+    const slot = await deps.poolSelector.tryAcquireAvailablePool(
+      poolRows.map((pool) => pool.id),
+      providerId,
+      limits,
+      weights,
+    );
+    if (slot) {
+      return {
+        fetch: deps.networkBindingFactory.fetch(slot.poolId, tenantId ?? undefined),
+        release: slot.release,
+        networkPoolId: slot.poolId,
+      };
+    }
+  }
+
+  // No active/usable pool: direct is the safe fallback (never block a login).
+  return direct();
+}

package/src/console/providers/oauth/routes.ts

@@ -2,11 +2,17 @@ import { providerAccounts, providerOauthStates } from "../../../persistence/sche
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { encryptCredential, hashSecret } from "../../../security/crypto";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
-import type { OAuthExchangeResult, OAuthLoginClient } from "../../../providers/authentication/oauth-flow-store";
+import type {
+  OAuthDeviceStartResult,
+  OAuthExchangeResult,
+  OAuthLoginClient,
+} from "../../../providers/authentication/oauth-flow-store";
+import { oauthAccountIdentity } from "../../../providers/authentication/oauth-flow-store";
 import type { OAuthDevicePollResponse } from "../catalog/contracts";
 import { providerJwtVerification } from "../../../providers/provider-metadata";
 import type { ProviderRegistry } from "../../../providers/provider-registry";
 import { browserAuthorizeRedirectUri } from "../../../config/providers";
+import { resolveDeviceEgress, type DeviceEgressDeps } from "./device-egress";
 import { log } from "../../../observability/logger";
 import { GatewayError } from "../../../protocol/gateway-error";
 import { Elysia, t, type AnyElysia } from "elysia";
@@ -41,11 +47,53 @@ export function oauthIdentityFingerprint(input: {
   readonly label: string;
   readonly providerId: string;
 } & OAuthExchangeResult): string {
+  const identity = input.accountEmail?.trim() ?? input.accountName?.trim();
+  if (identity !== undefined && identity.length > 0) return hashSecret(identity);
   const label = input.label.trim();
-  const resolved = label.length > 0 && label.toLowerCase() !== input.providerId.trim().toLowerCase();
+  const resolved =
+    label.length > 0 &&
+    label.toLowerCase() !== input.providerId.trim().toLowerCase() &&
+    !isGeneratedOAuthLabel(label, input.providerId);
   return hashSecret(resolved ? label : input.refresh);
 }
 
+/** First unused `<providerId>-N` label for an OAuth account with no upstream identity. */
+export function nextGeneratedOAuthAccountLabel(
+  providerId: string,
+  existingLabels: readonly string[],
+): string {
+  const taken = new Set(existingLabels.map((label) => label.trim().toLowerCase()));
+  for (let n = 1; ; n += 1) {
+    const candidate = `${providerId}-${n}`;
+    if (!taken.has(candidate.toLowerCase())) return candidate;
+  }
+}
+
+/** Generated labels are display-only and must never become re-login identity. */
+export function isGeneratedOAuthLabel(label: string, providerId: string): boolean {
+  const value = label.trim().toLowerCase();
+  const prefix = `${providerId.trim().toLowerCase()}-`;
+  return value === providerId.trim().toLowerCase() || (value.startsWith(prefix) && /^\d+$/.test(value.slice(prefix.length)));
+}
+
+/** Merges provider-reported identity with the operator label without inventing data. */
+function resolvedOAuthIdentity(
+  input: { readonly label: string } & OAuthExchangeResult,
+  providerId: string,
+): { readonly label: string; readonly accountEmail?: string; readonly accountName?: string } {
+  const tokenIdentity = oauthAccountIdentity(input);
+  const accountEmail = input.accountEmail?.trim() ?? tokenIdentity.accountEmail;
+  const accountName = input.accountName?.trim() ?? tokenIdentity.accountName;
+  const existing = input.label.trim();
+  const unresolved = existing.length === 0 || isGeneratedOAuthLabel(existing, providerId);
+  const label = unresolved ? (accountEmail ?? accountName ?? existing) : existing;
+  return {
+    label,
+    ...(accountEmail === undefined ? {} : { accountEmail }),
+    ...(accountName === undefined ? {} : { accountName }),
+  };
+}
+
 export class DrizzleOAuthAccountStore implements OAuthAccountStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
@@ -54,7 +102,8 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
     providerId: string,
     input: { readonly label: string } & OAuthExchangeResult,
   ): Promise<PersistedOAuthAccount> {
-    const credentialFingerprint = oauthIdentityFingerprint({ ...input, providerId });
+    const identity = resolvedOAuthIdentity(input, providerId);
+    const credentialFingerprint = oauthIdentityFingerprint({ ...input, ...identity, providerId });
     const sameAccount = and(
       eq(providerAccounts.providerId, providerId),
       // The identity index coalesces a null tenant to a sentinel, so "same
@@ -68,6 +117,20 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
     const refreshCiphertext = encryptCredential(input.refresh);
     const clientSecretCiphertext =
       input.client_secret === undefined ? undefined : encryptCredential(input.client_secret);
+    const identityColumns = {
+      ...(input.auth_state === undefined && identity.accountName === undefined
+        ? {}
+        : {
+          authState: {
+            ...(input.auth_state ?? {}),
+            ...(identity.accountName === undefined ? {} : { accountName: identity.accountName }),
+          },
+        }),
+      ...(identity.accountEmail === undefined ? {} : { accountEmail: identity.accountEmail }),
+      ...(identity.accountEmail !== undefined || identity.accountName !== undefined
+        ? { identityCheckedAt: new Date() }
+        : {}),
+    };
     try {
       return await this.db.transaction(async (tx) => {
         const existing = await tx
@@ -76,6 +139,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
           .where(sameAccount)
           .limit(1);
         const existingId = existing[0]?.id;
+        const label = isGeneratedOAuthLabel(input.label, providerId) ? identity.label : input.label;
         if (existingId !== undefined) {
           // A re-login replaces the account it belongs to rather than adding a
           // second row: the same email is the same account, and the newer
@@ -90,7 +154,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
               // the learned label — but never over an operator's custom rename.
               // The CASE keeps the read and the write in one statement, so a
               // concurrent rename cannot lose to the login.
-              label: sql`CASE WHEN lower(trim(${providerAccounts.label})) = lower(trim(${providerAccounts.providerId})) THEN ${input.label} ELSE ${providerAccounts.label} END`,
+              label: sql`CASE WHEN lower(trim(${providerAccounts.label})) = lower(trim(${providerAccounts.providerId})) OR lower(trim(${providerAccounts.label})) = lower(trim(${label})) THEN ${label} ELSE ${providerAccounts.label} END`,
               credentialCiphertext,
               credentialKind: "oauth",
               status: "active",
@@ -106,7 +170,7 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
               staticToken: false,
               // Only what this login reported: a flow that learned no profile or
               // region leaves the stored configuration alone rather than blanking it.
-              ...(input.auth_state === undefined ? {} : { authState: input.auth_state }),
+              ...identityColumns,
             })
             .where(eq(providerAccounts.id, existingId));
           await tx
@@ -119,17 +183,34 @@ export class DrizzleOAuthAccountStore implements OAuthAccountStore {
             .where(eq(providerOauthStates.providerAccountId, existingId));
           return { accountId: existingId };
         }
+        const existingLabels = await tx
+          .select({ label: providerAccounts.label })
+          .from(providerAccounts)
+          .where(
+            and(
+              eq(providerAccounts.providerId, providerId),
+              tenantId === null
+                ? isNull(providerAccounts.tenantId)
+                : eq(providerAccounts.tenantId, tenantId),
+            ),
+          );
+        const generatedLabel = isGeneratedOAuthLabel(label, providerId)
+          ? nextGeneratedOAuthAccountLabel(
+              providerId,
+              existingLabels.map((row) => row.label).filter((value): value is string => typeof value === "string"),
+            )
+          : label;
         const rows = await tx
           .insert(providerAccounts)
           .values({
             providerId,
             tenantId,
-            label: input.label,
+            label: generatedLabel,
             credentialKind: "oauth",
             credentialCiphertext,
             credentialFingerprint,
             status: "active",
-            ...(input.auth_state === undefined ? {} : { authState: input.auth_state }),
+            ...identityColumns,
           })
           .returning({ id: providerAccounts.id });
         const row = rows[0];
@@ -194,6 +275,8 @@ export interface OAuthLoginConfig {
    * itself instead of waiting for the operator to paste the URL back.
    */
   readonly callbackListener: OAuthCallbackListener;
+  /** Resolves device-flow OAuth egress per the `device_flow_proxy` setting. */
+  readonly deviceEgress: DeviceEgressDeps;
 }
 
 async function requireClient(
@@ -290,7 +373,7 @@ export async function completeLogin(
       );
     }
     await config.accountStore.persistAccount(flow.tenantId, providerId, {
-      label: result.accountLabel ?? flow.accountLabel,
+      label: result.accountLabel ?? (flow.accountLabel.trim().toLowerCase() === providerId.trim().toLowerCase() ? "" : flow.accountLabel),
       ...result,
     });
     // The exchange succeeded and the account is persisted; now the flow is
@@ -442,7 +525,7 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
             { providerId },
           );
         }
-        const state = generateOAuthState();
+        const state = client.generateState?.() ?? generateOAuthState();
         const { codeVerifier, codeChallenge } = generatePkcePair();
         /**
          * A client whose authorize URL depends on an upstream discovery runs it
@@ -547,12 +630,25 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
             `Provider ${providerId} does not support device-code login`,
             { providerId },
           );
-        const started = await client.startDeviceAuth({
+        const egress = await resolveDeviceEgress(
+          config.deviceEgress,
           providerId,
-          tenantId: a.tenantId,
-          accountLabel,
-          ...(parameters === undefined ? {} : { parameters }),
-        });
+          a.tenantId,
+        );
+        let started: OAuthDeviceStartResult;
+        try {
+          started = await client.startDeviceAuth({
+            providerId,
+            tenantId: a.tenantId,
+            accountLabel,
+            fetchFn: egress.fetch,
+            ...(parameters === undefined ? {} : { parameters }),
+          });
+        } finally {
+          // The flow has been started; the pool slot is only needed for the
+          // start request. Polls re-resolve their own egress.
+          egress.release();
+        }
         const { providerState, ...publicStarted } = started;
         await config.oauthFlowStore.saveDevice(started.deviceAuthId, {
           providerId,
@@ -585,15 +681,22 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
             409,
             "Provider does not support device-code login",
           );
+        const egress = await resolveDeviceEgress(
+          config.deviceEgress,
+          providerId,
+          a.tenantId,
+        );
         const polled = await client.pollDeviceAuth(deviceAuthId, {
           providerId,
           tenantId: a.tenantId,
           accountLabel: correlation.accountLabel,
+          fetchFn: egress.fetch,
           ...(correlation.providerState === undefined
             ? {}
             : { providerState: correlation.providerState }),
           ...(correlation.parameters === undefined ? {} : { parameters: correlation.parameters }),
         });
+        egress.release();
         if (polled.status === "pending")
           return {
             status: "pending",
@@ -634,7 +737,11 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
           correlation.tenantId,
           providerId,
           {
-            label: polled.result.accountLabel ?? correlation.accountLabel,
+            label:
+              polled.result.accountLabel ??
+              (correlation.accountLabel.trim().toLowerCase() === providerId.trim().toLowerCase()
+                ? ""
+                : correlation.accountLabel),
             ...polled.result,
           },
         );
@@ -675,7 +782,7 @@ function createOAuthLoginOperations(config: OAuthLoginConfig) {
           );
         }
         const persisted = await config.accountStore.persistAccount(a.tenantId, providerId, {
-          label: result.accountLabel ?? accountLabel,
+          label: result.accountLabel ?? (accountLabel.trim().toLowerCase() === providerId.trim().toLowerCase() ? "" : accountLabel),
           ...result,
         });
         await config.snapshotInvalidator?.invalidate();

package/src/console/quota/account-quota-global.ts

@@ -1,7 +1,7 @@
 import { t } from "elysia";
 import type { Elysia } from "elysia";
 import { and, eq, inArray, isNull, sql } from "drizzle-orm";
-import { isSqliteDatabase } from "../../persistence/dialect";
+import { liveModelCooldownExistsSql } from "../../persistence/dialect";
 import { adminAuditLog, providerAccounts } from "../../persistence/schema";
 import { requireGlobalAdmin } from "../shared/errors";
 import {
@@ -23,9 +23,8 @@ import {
 } from "../../providers/quota/refresh";
 import { sanitizeGlobalAccount } from "./quota-view";
 import {
-  ACCOUNT_STATUSES,
+  resolveNextAccountStatus,
   type AccountQuotaRoutesDeps,
-  type AccountStatus,
 } from "./account-quota-shared";
 import type { ProviderAccountBulkActionResult } from "../providers/catalog/contracts";
 
@@ -33,16 +32,18 @@ import type { ProviderAccountBulkActionResult } from "../providers/catalog/contr
  * The same live-cooldown predicate as the tenant-scoped store, evaluated in
  * SQL so one statement covers the whole shared-account set. `status='cooldown'`
  * counts even when its deadline elapsed; a live `model_cooldowns` entry counts
- * even while `status` is still `active` (D07).
+ * even while `status` is still `active` (D07). A row already `disabled` does
+ * not: disable keeps the deadline columns as evidence, and counting them would
+ * make a second pass look like it still has work. Scoped strictly to shared
+ * rows (`tenant_id IS NULL`); the shared JSON subquery lives in the dialect
+ * module.
  */
 function globalLiveCooldownPredicate(database: unknown): ReturnType<typeof and> {
   const nowIso = new Date().toISOString();
-  const liveModelCooldown = isSqliteDatabase(database)
-    ? sql`EXISTS (SELECT 1 FROM json_each(${providerAccounts.modelCooldowns}) AS entry WHERE json_valid(${providerAccounts.modelCooldowns}) AND json_type(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`
-    : sql`EXISTS (SELECT 1 FROM jsonb_each_text(${providerAccounts.modelCooldowns}) AS entry WHERE jsonb_typeof(${providerAccounts.modelCooldowns}) = 'object' AND entry.value > ${nowIso})`;
   return and(
     isNull(providerAccounts.tenantId),
-    sql`${providerAccounts.status} = 'cooldown' OR ${providerAccounts.cooldownUntil} > ${nowIso} OR ${liveModelCooldown}`,
+    sql`${providerAccounts.status} <> 'disabled'`,
+    sql`${providerAccounts.status} = 'cooldown' OR ${providerAccounts.cooldownUntil} > ${nowIso} OR ${liveModelCooldownExistsSql(database, nowIso)}`,
   )!;
 }
 
@@ -117,23 +118,12 @@ export function registerAccountQuotaGlobalRoutes(
       },
       async ({ request, params, body, set }) => {
         const access = requireGlobalAdmin(accessResolver(request));
-        if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
-          set.status = 400;
-          return {
-            error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
-            code: "invalid_status",
-          };
-        }
-        const nextStatus: AccountStatus | undefined =
-          body.active !== undefined
-            ? body.active
-              ? "active"
-              : "disabled"
-            : (body.status as AccountStatus | undefined);
-        if (!nextStatus) {
-          set.status = 400;
-          return { error: "active or status is required", code: "invalid_request" };
+        const resolved = resolveNextAccountStatus(body);
+        if (!resolved.ok) {
+          set.status = resolved.status;
+          return resolved.body;
         }
+        const nextStatus = resolved.nextStatus;
         const updated = await db
           .update(providerAccounts)
           .set({ status: nextStatus })

package/src/console/quota/account-quota-shared.ts

@@ -20,6 +20,55 @@ export interface AccountQuotaRoutesDeps extends QuotaRefreshDeps {
 export const ACCOUNT_STATUSES = ["active", "cooldown", "disabled"] as const;
 export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
 
+/**
+ * The merged result of interpreting a PATCH account-status body. On success it
+ * carries the resolved `AccountStatus`; on failure it carries the exact 400
+ * response the tenant and global routes both return.
+ */
+export type ResolveNextAccountStatusResult =
+  | { readonly ok: true; readonly nextStatus: AccountStatus }
+  | {
+      readonly ok: false;
+      readonly status: 400;
+      readonly body: { readonly error: string; readonly code: string };
+    };
+
+/**
+ * Resolves the next account status from a PATCH body: an explicit `active`
+ * boolean wins over `status`, and a missing `status` (or an invalid one) is
+ * rejected with the shared 400 shape. Both account PATCH handlers interpret
+ * the same input contract, so it lives here once.
+ */
+export function resolveNextAccountStatus(body: {
+  readonly active?: boolean;
+  readonly status?: string;
+}): ResolveNextAccountStatusResult {
+  if (body.status !== undefined && !ACCOUNT_STATUSES.includes(body.status as AccountStatus)) {
+    return {
+      ok: false,
+      status: 400,
+      body: {
+        error: `status must be one of: ${ACCOUNT_STATUSES.join(", ")}`,
+        code: "invalid_status",
+      },
+    };
+  }
+  const nextStatus: AccountStatus | undefined =
+    body.active !== undefined
+      ? body.active
+        ? "active"
+        : "disabled"
+      : (body.status as AccountStatus | undefined);
+  if (nextStatus === undefined) {
+    return {
+      ok: false,
+      status: 400,
+      body: { error: "active or status is required", code: "invalid_request" },
+    };
+  }
+  return { ok: true, nextStatus };
+}
+
 /**
  * Wraps a stored api_key credential in the envelope its collector expects.
  *