ldrouter 1.16.2 → 1.16.4

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.16.4] - 2026-09-15
+
+### Added
+
+- Codex account pools are now part of `main`: native Codex OAuth providers, encrypted JSON/JSONL account import, token refresh/rotation, account-aware routing and fallback, model discovery, quota/usage panel, browser PKCE connect, and the Codex accounts UI.
+
+### Fixed
+
+- Admin sessions with a missing or expired CSRF row could not mutate anything (`Unable to acquire CSRF token`); the CSRF endpoint now re-issues a token for a valid session, and the admin client invalidates its cached token and retries once on an auth rejection.
+
+## [1.16.3] - 2026-09-14
+
+### Fixed
+
+- **Routing rejections now name the model and the reason.** A request a model could not serve answered `No available model candidates` (direct model) or `No combo member satisfies the request capabilities or availability` (combo) — the same failure described differently, naming neither the model nor the cause. Both paths now share one taxonomy of capability gaps and availability reasons, grouped per model and reported with the model name without its provider prefix (`vl/gpt-5.5` is reported as `gpt-5.5`).
+- **Error codes reached clients again.** `GatewayError.code` was dropped when each gateway route rebuilt the error from the runner outcome, so `rpm_limit`, `tpm_limit`, `quota_limit`, `concurrency_limit`, and `upstream_http_*` never left the process.
+- **Admin-disabled models answered `404 Unknown model`.** The resolver skipped disabled models, so callers looked for a typo in a model that had just been switched off; it now reports `model disabled`. The candidate loader also pre-filtered disabled models and providers, making the recorded reasons unreachable and collapsing every case into `model not found`.
+- **Upstream HTTP failures agreed across paths.** A 429 surfaced as 529 without a code on the non-streaming path and with one on another; all paths now share one mapping (429 → `upstream_http_429`, 401/403 → `upstream_http_401`/`upstream_http_403`, ≥500 → `upstream_http_503`).
+- **No internal JS errors in responses.** A 200 with an unexpected body shape surfaced `Cannot read properties of undefined (reading '0')`; it is now `Upstream response for "<model>" has no "choices" array` with code `upstream_bad_response`.
+- **Combo create/update no longer 500, leave orphans, or rename the public ID.** Uniqueness checked only `publicModelId` while `combos.slug` is its own UNIQUE column, duplicate members hit `UNIQUE(combo_id, model_id)`, and both operations ran outside a transaction — update deleting members before inserting the new ones. Saving the edit form unchanged also rewrote a public ID such as `smart` into `combo/smart`, breaking aliases and API keys. All uniqueness checks share one path, both operations are atomic, and the ID is never derived from the name.
+- **Image requests to image-capable models failed.** `/v1/responses` dropped `input_image` blocks, Anthropic inbound read URLs from `source.data`, and outbound Anthropic conversion emitted `{"type":"url","media_type","data"}` instead of `source.url`.
+- **Model capabilities are no longer guessed.** `inferOpenAICapabilities` wrote `image_input`, `structured_output`, and `reasoning` as `false` whenever a model name missed a substring heuristic, hard-rejecting `gpt-4o-2024-11-20`, `gemini-*`, `qwen-vl-*`, and `grok-*`. Unknown stays unknown; manual admin edits survive re-import.
+
 ## [1.16.2] - 2026-09-14
 
 ### Fixed

package/dist/server/errors.js

@@ -63,3 +63,14 @@ export function toAnthropicError(g, requestId) {
         ...(requestId ? { request_id: requestId } : {}),
     };
 }
+/**
+ * Rehydrate the error for the client from a gateway outcome. `errorCode` matters:
+ * without it every propagated failure lost its specific code (rpm_limit,
+ * upstream_http_429, …) and arrived as a bare type.
+ */
+export function outcomeError(outcome) {
+    return new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', {
+        status: outcome.httpStatus,
+        ...(outcome.errorCode ? { code: outcome.errorCode } : {}),
+    });
+}

package/dist/server/gateway/runner.js

@@ -3,14 +3,14 @@ import { getDb, schema } from '../db/index.js';
 import { eq } from 'drizzle-orm';
 import { GatewayError } from '../errors.js';
 import { resolveRequestedModel, unwrapAlias } from '../routing/resolver.js';
-import { deriveRequiredCapabilities, modelMeets } from '../routing/capabilities.js';
+import { bareModelName, deriveRequiredCapabilities, describeRejections, firstMissingCapability } from '../routing/capabilities.js';
 import { loadCombo, selectCandidates, orderCandidates, shouldFallback, expandCodexAccountCandidates } from '../routing/combo.js';
 import { listCodexAccountsForProvider, setCodexAccountHealth } from '../db/repositories/codex-accounts.js';
 import { getEffectiveState, isOpen, recordSuccess, recordFailure, halfOpenProbeAllowed } from '../routing/circuit.js';
 import { checkRpm, checkTpm, acquireConcurrent, releaseConcurrent } from '../routing/ratelimit.js';
 import { checkDailyMonthly, consumeUsage } from '../routing/quota.js';
 import { keyAllowedFor } from '../auth/api-key.js';
-import { providerToUpstreamConfig, callUpstreamNonStreaming, callUpstreamStreaming, upstreamUrl } from '../upstream/client.js';
+import { providerToUpstreamConfig, callUpstreamNonStreaming, callUpstreamStreaming, upstreamUrl, upstreamHttpError } from '../upstream/client.js';
 import { callCodexNonStreaming, callCodexStreaming } from '../providers/codex.js';
 import { canonicalToOpenAIRequest, openAIResponseToCanonical } from '../protocols/canonical.js';
 import { canonicalToAnthropicRequest, anthropicResponseToCanonical } from '../protocols/anthropic.js';
@@ -100,21 +100,22 @@ export class GatewayRunner {
             ]);
             // --- Determine candidates ---
             let candidates = [];
-            let selectionReasons = [];
+            const selectionReasons = [];
+            const rejected = [];
             if (resolved.kind === 'model') {
-                candidates = await this.loadModelCandidate(resolved.modelId, required, ctx.requestId);
+                const loaded = await this.loadModelCandidate(resolved.modelId, required, ctx.requestId);
+                candidates = loaded.candidates;
+                rejected.push(...loaded.rejected);
                 selectionReasons.push('direct_model');
-                if (candidates.length === 0) {
-                    debugHttp(ctx.requestId, 'CAPABILITY REJECT', [
-                        `model=${resolved.publicModelId}`,
-                        `reason=direct_model_unavailable_or_capability_mismatch`,
-                        '(direct model candidates rejected: not found / provider disabled / model disabled / upstream unavailable / circuit open / capability mismatch)',
-                    ]);
-                }
             }
             else if (comboPlan) {
+                // A disabled combo is a configuration decision, not a routing failure:
+                // say so instead of blaming its members for not being available.
+                if (!resolved.enabled) {
+                    const s = describeRejections({ kind: 'combo', publicModelId: resolved.publicModelId }, [{ publicModelId: resolved.publicModelId, reason: 'combo_disabled' }]);
+                    throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
+                }
                 const all = await this.loadAllModels();
-                const rejected = [];
                 const filtered = selectCandidates(comboPlan, all, required, (c, reason) => {
                     rejected.push({ publicModelId: c.publicModelId, reason });
                     debugHttp(ctx.requestId, 'CAPABILITY REJECT', [`model=${c.publicModelId}`, `reason=${reason}`]);
@@ -127,7 +128,8 @@ export class GatewayRunner {
                     ...rejected.map((r) => `rejected: ${r.publicModelId} reason=${r.reason}`),
                 ]);
                 if (filtered.length === 0) {
-                    throw new GatewayError('capability_not_supported', 'No combo member satisfies the request capabilities or availability', { status: 400 });
+                    const s = describeRejections({ kind: 'combo', publicModelId: resolved.publicModelId }, rejected);
+                    throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
                 }
                 candidates = orderCandidates(comboPlan, filtered).flatMap((candidate) => {
                     const provider = getDb().select().from(schema.providers).where(eq(schema.providers.id, candidate.providerId)).get();
@@ -140,7 +142,8 @@ export class GatewayRunner {
                 selectionReasons.push('combo');
             }
             if (candidates.length === 0) {
-                throw new GatewayError('upstream_unavailable', 'No available model candidates', { status: 502 });
+                const s = describeRejections({ kind: 'model', publicModelId: resolved.publicModelId }, rejected);
+                throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
             }
             // --- Gateway response cache check ---
             const settings = getSettings();
@@ -319,6 +322,7 @@ export class GatewayRunner {
                 httpStatus: lastError ? lastError.status : 200,
                 errorType: lastError?.type ?? null,
                 errorMessage: lastError ? redactString(lastError.message) : null,
+                errorCode: lastError?.code ?? null,
                 text: lastError ? null : resultText,
                 toolCalls: lastError ? null : resultToolCalls,
                 finishReason: lastError ? null : resultFinishReason,
@@ -367,52 +371,43 @@ export class GatewayRunner {
             metrics.activeRequests.dec();
         }
     }
+    /** Resolve a direct physical model into a candidate, reporting the exact
+     *  reason it cannot serve the request instead of a blanket "no candidates". */
     async loadModelCandidate(modelId, required, requestId) {
         const db = getDb();
-        const reject = (reason) => {
+        const reject = (publicModelId, reason) => {
             if (requestId)
                 debugHttp(requestId, 'CAPABILITY REJECT', [`modelId=${modelId}`, `reason=${reason}`]);
+            return [{ publicModelId, reason }];
         };
         const m = db.select().from(schema.models).where(eq(schema.models.id, modelId)).get();
-        if (!m) {
-            reject('model_not_found');
-            return [];
-        }
+        if (!m)
+            return { candidates: [], rejected: reject(modelId, 'model_not_found') };
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, m.providerId)).get();
-        if (!p) {
-            reject('provider_not_found');
-            return [];
-        }
-        if (!p.enabled) {
-            reject('provider_disabled');
-            return [];
-        }
+        if (!p)
+            return { candidates: [], rejected: reject(m.publicModelId, 'provider_not_found') };
+        if (!p.enabled)
+            return { candidates: [], rejected: reject(m.publicModelId, 'provider_disabled') };
         const caps = safeJson(m.capabilitiesJson);
         const candidate = {
             modelId: m.id,
             publicModelId: m.publicModelId,
             providerId: m.providerId,
             enabled: m.enabled,
+            providerEnabled: p.enabled,
             upstreamAvailable: m.upstreamAvailable,
             circuitOpen: isOpen(m.providerId),
             capabilities: caps,
         };
-        if (!m.enabled) {
-            reject('model_disabled');
-            return [];
-        }
-        if (!m.upstreamAvailable) {
-            reject('upstream_unavailable');
-            return [];
-        }
-        if (candidate.circuitOpen) {
-            reject('circuit_open');
-            return [];
-        }
-        if (!modelMeets(caps, required)) {
-            reject('capability_mismatch');
-            return [];
-        }
+        if (!m.enabled)
+            return { candidates: [], rejected: reject(m.publicModelId, 'model_disabled') };
+        if (!m.upstreamAvailable)
+            return { candidates: [], rejected: reject(m.publicModelId, 'upstream_unavailable') };
+        if (candidate.circuitOpen)
+            return { candidates: [], rejected: reject(m.publicModelId, 'circuit_open') };
+        const missing = firstMissingCapability(caps, required);
+        if (missing)
+            return { candidates: [], rejected: reject(m.publicModelId, missing) };
         debugHttp(requestId ?? '-', 'CAPABILITY CANDIDATE', [
             `model=${m.publicModelId}`,
             `caps.tools=${caps.tools}`,
@@ -421,28 +416,34 @@ export class GatewayRunner {
             `caps.image_input=${caps.image_input}`,
             `caps.structured_output=${caps.structured_output}`,
         ]);
+        // Codex providers route through their account pool: one candidate per
+        // eligible account, so fallback can move between accounts of the same model.
         if (p.type === 'codex') {
             const expanded = expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(p.id));
             if (expanded.length === 0)
-                reject('codex_account_unavailable');
-            return expanded;
+                return { candidates: [], rejected: reject(m.publicModelId, 'codex_account_unavailable') };
+            return { candidates: expanded, rejected: [] };
         }
-        return [candidate];
+        return { candidates: [candidate], rejected: [] };
     }
     async loadAllModels() {
         const db = getDb();
         const models = db.select().from(schema.models).all();
         const providers = db.select().from(schema.providers).all();
         const providerEnabled = new Map(providers.map((p) => [p.id, p.enabled]));
+        // Deliberately unfiltered: every combo member must reach selectCandidates so
+        // it can report WHY it was skipped. Pre-filtering here erased the model rows
+        // and turned every distinct reason into "model not found".
         return models.map((m) => ({
             modelId: m.id,
             publicModelId: m.publicModelId,
             providerId: m.providerId,
             enabled: m.enabled,
+            providerEnabled: providerEnabled.get(m.providerId),
             upstreamAvailable: m.upstreamAvailable,
             circuitOpen: isOpen(m.providerId),
             capabilities: safeJson(m.capabilitiesJson),
-        })).filter((m) => m.enabled && m.upstreamAvailable && providerEnabled.get(m.providerId));
+        }));
     }
     async runOneAttempt(req, ctx, candidate, providerName, cfg, required, onStreamStart, onFirstToken) {
         if (req.canonical.stream) {
@@ -468,20 +469,21 @@ export class GatewayRunner {
             call = await callUpstreamNonStreaming(cfg, upstreamUrl(cfg, '/v1/messages'), payload, ctx.requestId);
         }
         if (!call.ok) {
-            if (call.status === 429)
-                throw new GatewayError('upstream_rate_limit', `Upstream rate limited (HTTP ${call.status})`, { status: 429, code: 'upstream_http_429' });
-            if (call.status === 401 || call.status === 403)
-                throw new GatewayError('upstream_auth_error', 'Upstream authentication failed', { status: 502 });
-            if (call.status >= 500)
-                throw new GatewayError('upstream_error', `Upstream HTTP ${call.status}`, { status: 502, code: `upstream_http_${call.status}`, cause: { status: call.status } });
-            throw new GatewayError('upstream_error', `Upstream HTTP ${call.status}: ${redactString(call.text.slice(0, 300))}`, { status: 502, cause: { status: call.status } });
+            throw upstreamHttpError(call.status, redactString(call.text.slice(0, 300)), { status: call.status });
         }
         let parsed;
         try {
             parsed = JSON.parse(call.text);
         }
         catch {
-            throw new GatewayError('upstream_error', 'Upstream returned invalid JSON', { status: 502 });
+            throw new GatewayError('upstream_error', `Upstream returned invalid JSON for "${bareModelName(candidate.publicModelId)}"`, { status: 502, code: 'upstream_bad_response' });
+        }
+        // A 200 carrying the wrong shape used to explode into a raw
+        // "Cannot read properties of undefined (reading '0')" that reached the client
+        // verbatim. Name the model and the missing field instead.
+        const expectedField = cfg.type === 'openai' ? 'choices' : 'content';
+        if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed[expectedField])) {
+            throw new GatewayError('upstream_error', `Upstream response for "${bareModelName(candidate.publicModelId)}" has no "${expectedField}" array`, { status: 502, code: 'upstream_bad_response' });
         }
         let result;
         let usage;
@@ -813,6 +815,7 @@ export class GatewayRunner {
             httpStatus: 200,
             errorType: null,
             errorMessage: null,
+            errorCode: null,
             text,
             toolCalls,
             finishReason,

package/dist/server/protocols/anthropic.js

@@ -53,7 +53,9 @@ function parseAnthropicUserContent(content) {
                 out.push({ type: 'image', image: { base64: b.source.data, mimeType: b.source.media_type } });
             }
             else if (b.source.type === 'url') {
-                out.push({ type: 'image', image: { url: b.source.data } });
+                // Anthropic's url source carries the image in `url`; only our own older
+                // base64->url downgrade ever put it in `data` (see canonicalToAnthropicRequest).
+                out.push({ type: 'image', image: { url: b.source.url ?? b.source.data } });
             }
         }
         if (b.type === 'tool_result') {
@@ -84,8 +86,8 @@ export function canonicalToAnthropicRequest(req, targetModel) {
                         blocks.push({ type: 'text', text: b.text });
                     if (b.type === 'image' && b.image?.base64)
                         blocks.push({ type: 'image', source: { type: 'base64', media_type: b.image.mimeType ?? 'image/png', data: b.image.base64 } });
-                    if (b.type === 'image' && b.image?.url)
-                        blocks.push({ type: 'image', source: { type: 'url', media_type: 'image/png', data: b.image.url } });
+                    else if (b.type === 'image' && b.image?.url)
+                        blocks.push({ type: 'image', source: { type: 'url', url: b.image.url } });
                     if (b.type === 'tool_result')
                         blocks.push({ type: 'tool_result', tool_use_id: b.toolResult.toolUseId, content: b.toolResult.content, is_error: b.toolResult.isError });
                 }

package/dist/server/protocols/canonical.js

@@ -20,10 +20,14 @@ export function openAIToCanonical(req) {
                 blocks.push({ type: 'text', text: m.content });
             else if (Array.isArray(m.content)) {
                 for (const c of m.content) {
-                    if (c.type === 'text' && c.text)
-                        blocks.push({ type: 'text', text: c.text });
-                    else if (c.type === 'image_url' && c.image_url)
-                        blocks.push({ type: 'image', image: { url: c.image_url.url } });
+                    const t = textBlock(c);
+                    if (t)
+                        blocks.push(t);
+                    else {
+                        const u = imageUrlOf(c);
+                        if (u)
+                            blocks.push({ type: 'image', image: { url: u } });
+                    }
                 }
             }
             if (m.tool_calls) {
@@ -192,15 +196,32 @@ function normalizeContent(content) {
     if (Array.isArray(content)) {
         const out = [];
         for (const b of content) {
-            if (b.type === 'text' && b.text)
-                out.push({ type: 'text', text: b.text });
-            if (b.type === 'image_url' && b.image_url)
-                out.push({ type: 'image', image: { url: b.image_url.url } });
+            const t = textBlock(b);
+            if (t)
+                out.push(t);
+            const u = imageUrlOf(b);
+            if (u)
+                out.push({ type: 'image', image: { url: u } });
         }
         return out;
     }
     throw new GatewayError('invalid_request_error', 'Unsupported message content', { status: 400 });
 }
+// OpenAI Responses (`input_text`/`output_text`, `input_image`) and Chat
+// (`text`/`image_url`) use different part names for the same content.
+function textBlock(c) {
+    if (!c.text)
+        return null;
+    return c.type === 'text' || c.type === 'input_text' || c.type === 'output_text' ? { type: 'text', text: c.text } : null;
+}
+// `image_url` is an object in Chat Completions and a plain string in Responses.
+function imageUrlOf(c) {
+    if (c.type !== 'image_url' && c.type !== 'input_image')
+        return undefined;
+    if (typeof c.image_url === 'string')
+        return c.image_url;
+    return typeof c.image_url?.url === 'string' ? c.image_url.url : undefined;
+}
 function safeJson(s) {
     try {
         return JSON.parse(s);

package/dist/server/providers/index.js

@@ -83,12 +83,34 @@ function inferOpenAICapabilities(id) {
         chat: true,
         streaming: true,
         tools: !(lower.includes('embedding') || lower.includes('whisper') || lower.includes('dall-e') || lower.includes('tts')),
-        image_input: lower.includes('vision') || lower.includes('gpt-4o') || lower.includes('4-vision') || lower.includes('claude'),
-        structured_output: lower.includes('gpt-4') || lower.includes('gpt-3.5') || lower.includes('o1') || lower.includes('claude'),
-        reasoning: lower.includes('o1') || lower.includes('o3') || lower.includes('reasoning'),
+        // image_input / structured_output / reasoning are intentionally omitted.
+        // A guessed `false` is read as "known unsupported" and hard-rejects matching
+        // requests (docs/04 §capability filtering); docs/00 requires unknown
+        // capabilities to stay unknown, so leave them undefined (undefined = allow).
+        // ponytail: name-based guessing was wrong for most ids (e.g. qwen-vl-max,
+        // claude-sonnet-4-5). Upgrade path: a real /models metadata probe, or the
+        // admin capability override UI.
     };
 }
 function stripSlash(u) {
     return u.endsWith('/') ? u.slice(0, -1) : u;
 }
+/**
+ * Merge freshly discovered capabilities into a stored model record.
+ *
+ * `baseline` is what discovery last wrote for this model. An admin edit is by
+ * definition a divergence from that baseline, so those keys survive a
+ * re-import; everything else is refreshed (this is what clears stale guesses
+ * such as `image_input: false`). A record with no baseline predates this
+ * tracking, so it is refreshed wholesale rather than preserved blindly.
+ */
+export function mergeDiscoveredCapabilities(stored, baseline, discovered) {
+    const overrides = {};
+    if (baseline) {
+        for (const [k, v] of Object.entries(stored))
+            if (stored[k] !== baseline[k])
+                overrides[k] = v;
+    }
+    return { capabilities: { ...discovered, ...overrides }, baseline: discovered };
+}
 export { buildHeaders, fetchWithTimeout, stripSlash };

package/dist/server/routes/admin/combos.js

@@ -35,6 +35,55 @@ function comboSlug(input) {
         .replace(/[^a-z0-9._-]+/g, '')
         .slice(0, 64) || 'item');
 }
+/**
+ * A combo's slug and public id both have to be unique, and `slug` is NOT
+ * derivable from `public_model_id` (a slugless combo has slug "beta" and id
+ * "beta"; a slugged one has slug "beta" and id "combo/beta"). Checking only the
+ * public id lets a new name collide with an existing *slug*: the insert then
+ * dies as a raw SQLITE_CONSTRAINT and reaches the admin as an opaque
+ * 500 "Gateway error".
+ */
+function assertComboIdFree(db, slug, publicModelId, excludeId) {
+    const clash = db
+        .select()
+        .from(schema.combos)
+        .where(sql `public_model_id = ${publicModelId} OR slug = ${slug}`)
+        .all()
+        .find((c) => c.id !== excludeId);
+    if (clash)
+        throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
+    if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
+        throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
+    }
+}
+/** Slug triple the route / slug triple the runtime resolver expects. */
+function comboIds(name, slug) {
+    const s = comboSlug(slug || name);
+    return { slug: s, publicModelId: slug ? `combo/${s}` : s };
+}
+/**
+ * `combo_members` is UNIQUE(combo_id, model_id) and the admin UI's member rows
+ * are the payload of record, so two rows for one model collapse silently. Reject
+ * that here: a member list is a set, and telling the operator beats a lost row.
+ */
+function assertMembersUsable(db, members) {
+    const ids = members.map((m) => m.modelId);
+    const dupes = ids.filter((id, i) => ids.indexOf(id) !== i);
+    if (dupes.length > 0) {
+        throw new GatewayError('invalid_request_error', `Duplicate members: ${[...new Set(dupes)].join(', ')}`, { status: 400 });
+    }
+    assertModelsExist(db, members);
+}
+function assertModelsExist(db, members) {
+    const models = db
+        .select()
+        .from(schema.models)
+        .where(sql `id IN (${sql.join(members.map((m) => sql `${m.modelId}`), sql `, `)})`)
+        .all();
+    if (models.length !== members.length) {
+        throw new GatewayError('invalid_request_error', 'One or more members are not valid physical models', { status: 400 });
+    }
+}
 export async function registerComboRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/combos', async () => {
@@ -92,41 +141,35 @@ export async function registerComboRoutes(app) {
         const body = ComboCreate.parse(req.body);
         const db = getDb();
         // No slug given → the public id IS the normalized name (no "combo/" prefix).
-        const slug = comboSlug(body.slug ?? body.name);
-        const publicModelId = body.slug ? `combo/${slug}` : slug;
+        const { slug, publicModelId } = comboIds(body.name, body.slug);
         // The id must be globally unique across combos AND physical models — the
         // resolver treats every name as one routing surface.
-        if (db.select().from(schema.combos).where(eq(schema.combos.publicModelId, publicModelId)).get()) {
-            throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
-        }
-        if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
-            throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
-        }
-        // Verify all referenced models exist and are physical
-        const modelIds = body.members.map((m) => m.modelId);
-        const models = db.select().from(schema.models).where(sql `id IN (${sql.join(modelIds.map((id) => sql `${id}`), sql `, `)})`).all();
-        if (models.length !== new Set(modelIds).size)
-            throw new GatewayError('invalid_request_error', 'One or more members are not valid physical models', { status: 400 });
+        assertComboIdFree(db, slug, publicModelId);
+        assertMembersUsable(db, body.members);
         const id = uuid();
-        db.insert(schema.combos).values({
-            id,
-            name: body.name,
-            slug,
-            publicModelId,
-            mode: body.mode,
-            enabled: body.enabled ?? true,
-            maxTotalAttempts: body.maxTotalAttempts ?? 3,
-            fallbackOnConnection: body.fallbackOnConnection ?? true,
-            fallbackOnConnectTimeout: body.fallbackOnConnectTimeout ?? true,
-            fallbackOnFirstTokenTimeout: body.fallbackOnFirstTokenTimeout ?? true,
-            fallbackOn408: body.fallbackOn408 ?? true,
-            fallbackOn429: body.fallbackOn429 ?? true,
-            fallbackOn5xx: body.fallbackOn5xx ?? true,
-            configVersion: 1,
-        }).run();
-        for (const m of body.members) {
-            db.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
-        }
+        // ponytail: one transaction — a combo row without its members is unroutable,
+        // and a half-applied create used to burn the name and report only "Gateway error".
+        db.transaction((tx) => {
+            tx.insert(schema.combos).values({
+                id,
+                name: body.name,
+                slug,
+                publicModelId,
+                mode: body.mode,
+                enabled: body.enabled ?? true,
+                maxTotalAttempts: body.maxTotalAttempts ?? 3,
+                fallbackOnConnection: body.fallbackOnConnection ?? true,
+                fallbackOnConnectTimeout: body.fallbackOnConnectTimeout ?? true,
+                fallbackOnFirstTokenTimeout: body.fallbackOnFirstTokenTimeout ?? true,
+                fallbackOn408: body.fallbackOn408 ?? true,
+                fallbackOn429: body.fallbackOn429 ?? true,
+                fallbackOn5xx: body.fallbackOn5xx ?? true,
+                configVersion: 1,
+            }).run();
+            for (const m of body.members) {
+                tx.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+            }
+        });
         recordAudit({ action: 'combo.create', success: true, targetType: 'combo', targetId: id, targetName: body.name, ip: req.ip, metadata: { members: body.members.length, mode: body.mode } });
         return { id, slug, publicModelId };
     });
@@ -139,18 +182,17 @@ export async function registerComboRoutes(app) {
         const update = { updatedAt: new Date().toISOString(), configVersion: c.configVersion + 1 };
         if (body.name)
             update.name = body.name;
-        if (body.slug !== undefined) {
-            // Same rule as creation: empty slug → plain id, provided slug → combo/<slug>.
-            const slug = comboSlug(body.slug || body.name || c.name);
-            const publicModelId = body.slug ? `combo/${slug}` : slug;
-            const clashCombo = db.select().from(schema.combos).where(eq(schema.combos.publicModelId, publicModelId)).get();
-            if (clashCombo && clashCombo.id !== body.id)
-                throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
-            if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
-                throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
+        // Same rule as creation: no slug → the id IS the (normalized) name, slug →
+        // combo/<slug>. Deliberately no `|| body.name || c.name` fallback: a request
+        // carrying neither field would otherwise re-derive the id from the current
+        // name and silently rename the combo (or degrade it to "item").
+        if (body.name !== undefined || body.slug !== undefined) {
+            const { slug, publicModelId } = comboIds(body.name ?? c.name, body.slug);
+            if (slug !== c.slug || publicModelId !== c.publicModelId) {
+                assertComboIdFree(db, slug, publicModelId, body.id);
+                update.slug = slug;
+                update.publicModelId = publicModelId;
             }
-            update.slug = slug;
-            update.publicModelId = publicModelId;
         }
         if (body.mode)
             update.mode = body.mode;
@@ -170,12 +212,20 @@ export async function registerComboRoutes(app) {
             update.fallbackOn429 = body.fallbackOn429;
         if (body.fallbackOn5xx !== undefined)
             update.fallbackOn5xx = body.fallbackOn5xx;
-        db.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
         if (body.members) {
-            db.delete(schema.comboMembers).where(eq(schema.comboMembers.comboId, body.id)).run();
-            for (const m of body.members) {
-                db.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
-            }
+            assertMembersUsable(db, body.members);
+            // Replace members inside one transaction: the delete-then-insert used to
+            // leave the combo memberless (and so unroutable) if any insert failed.
+            db.transaction((tx) => {
+                tx.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
+                tx.delete(schema.comboMembers).where(eq(schema.comboMembers.comboId, body.id)).run();
+                for (const m of body.members) {
+                    tx.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+                }
+            });
+        }
+        else {
+            db.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
         }
         // Invalidate cache for this combo
         const { invalidateCacheFor } = await import('../../caching/store.js');