ldrouter 1.17.7 → 1.17.9

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.17.9] - 2026-09-22
+
+### Fixed
+
+- **A tripped provider circuit breaker locked the provider out until the process restarted.** The breaker's `open -> half_open` decay runs inside `getEffectiveState()`, which is only called from the attempt loop, but both candidate filters read the raw `isOpen()` flag instead — so once the flag was set no candidate ever reached the attempt loop that would have decayed it, and the provider answered `provider circuit is open` to every request until the container was restarted. `health_state` kept reading `healthy` throughout, so nothing in the UI showed the lockout. Live production: `code` and `qo` had each accumulated five consecutive upstream failures (a real upstream `503`) and were both in that state, while the upstream itself answered `200` to the same model and key when called directly. Candidate construction is now cooldown-aware through `circuitBlocks()`, so a candidate is admitted again as soon as the cooldown has elapsed and the half-open probe can close the breaker. Verified on a container against the released image: breaker open with the cooldown elapsed returned a zero-length `200`; with the fix it streams normally again.
+- **The admin "test model" button reported `Stream ended unexpectedly` instead of the actual reason.** The `test-stream` route hijacks the reply, so a `GatewayError` rethrown from its catch block could never reach Fastify's error handler — the response simply ended as `HTTP 200` with a zero-length body and no events, leaving the UI nothing to parse but that placeholder. The route now sends the reason as a `test_error` event. Measured on the released build with the breaker open: status `200`, `content-type` null, `body` 0 bytes; with the fix: `text/event-stream` carrying the real message.
+
+## [1.17.8] - 2026-09-21
+
+### Changed
+
+- Raised provider connection, first-token, stream-idle, and total request timeout defaults to 15s, 60s, 300s, and 600s. Existing providers still using the old defaults are upgraded by migration 0009.
+- Distinguish total request timeout errors from stream-idle timeout errors.
+
 ## [1.17.7] - 2026-09-20
 
 ### Fixed

package/dist/server/db/migrate.js

@@ -148,10 +148,10 @@ function buildInitialSchemaSql() {
       custom_headers_encrypted TEXT,
       custom_headers_nonce TEXT,
       enabled INTEGER NOT NULL DEFAULT 1,
-      connect_timeout_ms INTEGER NOT NULL DEFAULT 10000,
-      first_token_timeout_ms INTEGER NOT NULL DEFAULT 30000,
-      stream_idle_timeout_ms INTEGER NOT NULL DEFAULT 60000,
-      total_timeout_ms INTEGER NOT NULL DEFAULT 180000,
+      connect_timeout_ms INTEGER NOT NULL DEFAULT 15000,
+      first_token_timeout_ms INTEGER NOT NULL DEFAULT 60000,
+      stream_idle_timeout_ms INTEGER NOT NULL DEFAULT 300000,
+      total_timeout_ms INTEGER NOT NULL DEFAULT 600000,
       max_retries INTEGER NOT NULL DEFAULT 2,
       retry_base_ms INTEGER NOT NULL DEFAULT 500,
       retry_max_ms INTEGER NOT NULL DEFAULT 8000,

package/dist/server/db/schema.js

@@ -89,10 +89,10 @@ export const providers = sqliteTable('providers', {
     customHeadersEncrypted: text('custom_headers_encrypted'),
     customHeadersNonce: text('custom_headers_nonce'),
     enabled: integer('enabled', { mode: 'boolean' }).notNull().notNull().default(true),
-    connectTimeoutMs: integer('connect_timeout_ms').notNull().default(10000),
-    firstTokenTimeoutMs: integer('first_token_timeout_ms').notNull().default(30000),
-    streamIdleTimeoutMs: integer('stream_idle_timeout_ms').notNull().default(60000),
-    totalTimeoutMs: integer('total_timeout_ms').notNull().default(180000),
+    connectTimeoutMs: integer('connect_timeout_ms').notNull().default(15000),
+    firstTokenTimeoutMs: integer('first_token_timeout_ms').notNull().default(60000),
+    streamIdleTimeoutMs: integer('stream_idle_timeout_ms').notNull().default(300000),
+    totalTimeoutMs: integer('total_timeout_ms').notNull().default(600000),
     maxRetries: integer('max_retries').notNull().default(2),
     retryBaseMs: integer('retry_base_ms').notNull().default(500),
     retryMaxMs: integer('retry_max_ms').notNull().default(8000),

package/dist/server/gateway/runner.js

@@ -11,7 +11,7 @@ import { qoderAttemptFailure, qoderCredentialsFor } from '../providers/qoder/cre
 import { refreshQoderCreditsIfStale } from '../providers/qoder/credits.js';
 import { callQoderNonStreaming, callQoderStreaming } from '../providers/qoder/client.js';
 import { refreshCodexUsageIfStale } from '../providers/codex-autostart.js';
-import { getEffectiveState, isOpen, recordSuccess, recordFailure, halfOpenProbeAllowed } from '../routing/circuit.js';
+import { getEffectiveState, recordSuccess, recordFailure, halfOpenProbeAllowed, circuitBlocks } from '../routing/circuit.js';
 import { checkRpm, checkTpm, acquireConcurrent, releaseConcurrent } from '../routing/ratelimit.js';
 import { checkDailyMonthly, consumeUsage } from '../routing/quota.js';
 import { keyAllowedFor } from '../auth/api-key.js';
@@ -436,7 +436,10 @@ export class GatewayRunner {
             enabled: m.enabled,
             providerEnabled: p.enabled,
             upstreamAvailable: m.upstreamAvailable,
-            circuitOpen: isOpen(m.providerId),
+            // Cooldown-aware, not the raw flag: `isOpen()` stays true until some request decays it,
+            // so a raw read here refused every candidate forever and the provider was unroutable
+            // until a restart.
+            circuitOpen: circuitBlocks(m.providerId, p.cbCooldownSeconds),
             capabilities: caps,
             providerType: p.type,
         };
@@ -479,6 +482,7 @@ export class GatewayRunner {
         const providers = db.select().from(schema.providers).all();
         const providerEnabled = new Map(providers.map((p) => [p.id, p.enabled]));
         const providerType = new Map(providers.map((p) => [p.id, p.type]));
+        const providerCooldown = new Map(providers.map((p) => [p.id, p.cbCooldownSeconds]));
         // Deliberately unfiltered: every combo member must reach selectCandidates so
         // it can report WHY it was skipped. Pre-filtering here erased the model rows
         // and turned every distinct reason into "model not found".
@@ -489,7 +493,10 @@ export class GatewayRunner {
             enabled: m.enabled,
             providerEnabled: providerEnabled.get(m.providerId),
             upstreamAvailable: m.upstreamAvailable,
-            circuitOpen: isOpen(m.providerId),
+            // Cooldown-aware: a raw `isOpen()` here froze the whole combo on one bad minute,
+            // because the flags are computed once per request while the breaker stays open
+            // until some request decays it — which this filter prevented from ever happening.
+            circuitOpen: circuitBlocks(m.providerId, providerCooldown.get(m.providerId) ?? 0),
             capabilities: safeJson(m.capabilitiesJson),
             providerType: providerType.get(m.providerId),
         }));

package/dist/server/routes/admin/models.js

@@ -312,8 +312,9 @@ export async function registerModelRoutes(app) {
         catch (e) {
             // Never let a raw non-GatewayError (e.g. MasterKeyError from credential
             // decryption) escape into the global handler as an opaque "Gateway error".
-            if (e instanceof GatewayError)
-                throw e;
+            // The reply is hijacked, so a rethrow here cannot reach the error handler:
+            // it ends the response having sent nothing, which the UI can only report as
+            // "Stream ended unexpectedly". Report the reason over the stream instead.
             send('test_error', { message: e.message });
         }
         finally {

package/dist/server/routes/admin/providers.js

@@ -19,10 +19,10 @@ const ProviderCreate = z.object({
     apiKey: z.string().min(1).max(20000).optional(),
     customHeaders: z.record(z.string(), z.string()).optional(),
     enabled: z.boolean().optional(),
-    connectTimeoutMs: z.number().int().min(100).max(60000).optional(),
-    firstTokenTimeoutMs: z.number().int().min(100).max(300000).optional(),
-    streamIdleTimeoutMs: z.number().int().min(100).max(600000).optional(),
-    totalTimeoutMs: z.number().int().min(1000).max(600000).optional(),
+    connectTimeoutMs: z.number().int().min(100).max(120000).optional(),
+    firstTokenTimeoutMs: z.number().int().min(100).max(600000).optional(),
+    streamIdleTimeoutMs: z.number().int().min(100).max(900000).optional(),
+    totalTimeoutMs: z.number().int().min(1000).max(1800000).optional(),
     maxRetries: z.number().int().min(0).max(8).optional(),
     cbFailureThreshold: z.number().int().min(1).max(50).optional(),
     cbCooldownSeconds: z.number().int().min(1).max(3600).optional(),
@@ -106,10 +106,10 @@ export async function registerProviderRoutes(app) {
             customHeadersEncrypted: headersEnc?.ciphertext ?? null,
             customHeadersNonce: headersEnc?.nonce ?? null,
             enabled: body.enabled ?? true,
-            connectTimeoutMs: body.connectTimeoutMs ?? 10000,
-            firstTokenTimeoutMs: body.firstTokenTimeoutMs ?? 30000,
-            streamIdleTimeoutMs: body.streamIdleTimeoutMs ?? 60000,
-            totalTimeoutMs: body.totalTimeoutMs ?? 180000,
+            connectTimeoutMs: body.connectTimeoutMs ?? 15000,
+            firstTokenTimeoutMs: body.firstTokenTimeoutMs ?? 60000,
+            streamIdleTimeoutMs: body.streamIdleTimeoutMs ?? 300000,
+            totalTimeoutMs: body.totalTimeoutMs ?? 600000,
             maxRetries: body.maxRetries ?? 2,
             cbFailureThreshold: body.cbFailureThreshold ?? 5,
             cbCooldownSeconds: body.cbCooldownSeconds ?? 60,

package/dist/server/routing/circuit.js

@@ -35,3 +35,16 @@ export function getEffectiveState(providerId, cooldownSeconds) {
 export function halfOpenProbeAllowed(providerId) {
     return circuitState(providerId) === 'half_open';
 }
+/**
+ * Should the candidate filter refuse this provider outright?
+ *
+ * `isOpen()` reports the raw state, which stays `'open'` until a request walks the
+ * attempt loop — so a tripped breaker rejected every candidate for the lifetime of the
+ * process and made the provider unroutable until a restart (the combo path and the
+ * direct-model path both read the flag off the candidate record). A candidate must be
+ * allowed through once the cooldown has elapsed so the probe that closes the breaker
+ * can actually run; `getEffectiveState` is what performs that open -> half_open decay.
+ */
+export function circuitBlocks(providerId, cooldownSeconds) {
+    return getEffectiveState(providerId, cooldownSeconds) === 'open';
+}

package/dist/server/upstream/client.js

@@ -148,15 +148,18 @@ function logUpstreamResponse(requestId, status, statusText, headers, durationMs,
  */
 export async function callUpstreamStreaming(cfg, url, payload, onChunk, requestId = '-') {
     const ctl = new AbortController();
-    const totalTimer = setTimeout(() => ctl.abort(), cfg.totalTimeoutMs);
     const start = Date.now();
     let ttft = null;
     let firstTokenTimer = null;
     let idleTimer = null;
+    // Which watchdog aborted, so the error names the limit that was actually hit: the total
+    // timer used to surface as "stream idle timeout", which sent operators tuning the wrong knob.
+    let abortedBy = 'total';
+    const totalTimer = setTimeout(() => { abortedBy = 'total'; ctl.abort(); }, cfg.totalTimeoutMs);
     const resetIdle = () => {
         if (idleTimer)
             clearTimeout(idleTimer);
-        idleTimer = setTimeout(() => ctl.abort(), cfg.streamIdleTimeoutMs);
+        idleTimer = setTimeout(() => { abortedBy = 'idle'; ctl.abort(); }, cfg.streamIdleTimeoutMs);
     };
     try {
         const res = await fetch(url, {
@@ -172,7 +175,7 @@ export async function callUpstreamStreaming(cfg, url, payload, onChunk, requestI
         }
         logUpstreamResponse(requestId, res.status, res.statusText, res.headers, Date.now() - start, '');
         // First-token watchdog
-        firstTokenTimer = setTimeout(() => ctl.abort(), cfg.firstTokenTimeoutMs);
+        firstTokenTimer = setTimeout(() => { abortedBy = 'first_token'; ctl.abort(); }, cfg.firstTokenTimeoutMs);
         resetIdle();
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
@@ -233,7 +236,10 @@ export async function callUpstreamStreaming(cfg, url, payload, onChunk, requestI
             ...formatError(e),
         ]);
         if (err.name === 'AbortError') {
-            if (ttft === null && firstTokenTimer) {
+            if (abortedBy === 'total') {
+                throw new GatewayError('timeout_error', 'Upstream total timeout', { status: 504, cause: e });
+            }
+            if (abortedBy === 'first_token' && ttft === null) {
                 throw new GatewayError('timeout_error', 'Upstream first token timeout', { status: 504, cause: e });
             }
             throw new GatewayError('timeout_error', 'Upstream stream idle timeout', { status: 504, cause: e });

package/migrations/0009_raise_timeout_defaults.sql

@@ -0,0 +1,15 @@
+-- 0009_raise_timeout_defaults.sql
+-- Raise the upstream timeout defaults. Long reasoning streams sit idle well past 60s between
+-- SSE frames, and the 180s total ceiling cut them off: the production request log showed 55
+-- `timeout_error` rows all ending at exactly 180s with a first token already delivered, i.e.
+-- the total timer firing while the stream was still alive.
+--
+-- New defaults: connect 15s, first token 60s, stream idle 300s, total 600s.
+-- Only rows still on the previous defaults are touched, so an admin-tuned value survives.
+-- The column DEFAULT in `providers` stays at the old values (SQLite cannot ALTER a default
+-- without a full table rebuild) — the application always writes the timeout columns
+-- explicitly, so the column default only applies to raw SQL inserts.
+UPDATE providers SET connect_timeout_ms = 15000 WHERE connect_timeout_ms = 10000;
+UPDATE providers SET first_token_timeout_ms = 60000 WHERE first_token_timeout_ms = 30000;
+UPDATE providers SET stream_idle_timeout_ms = 300000 WHERE stream_idle_timeout_ms = 60000;
+UPDATE providers SET total_timeout_ms = 600000 WHERE total_timeout_ms = 180000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.17.7",
+  "version": "1.17.9",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",