utim-cli 2.4.2__tar.gz → 2.4.3__tar.gz

{utim_cli-2.4.2 → utim_cli-2.4.3}/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [2.4.3] - 2026-10-13
+
+### 🛡️ Process Immunity & Self-Kill Protection
+- **Immunity Against Self-Termination**: Protected the UTIM process tree from accidental termination when executing shell commands like `taskkill`, `kill`, or `Stop-Process`. Resolves ancestry PIDs and blocks commands targeting own PID or executable names.
+
+### 🐛 Model Response & Streaming Fixes
+- **Claude / Anthropic Completion Stability**: Fixed an issue where blank finish reasons on clean streaming completions defaulted to `"length"`, triggering spurious truncation warnings.
+- **Removed Active-Turn `[status: pending]` Tagging**: Removed active user message status injection that previously confused models (especially Claude) into premature halts or continuation loops.
+- **Backtick Heuristic Gating**: Gated unclosed code-block detection to only fire on non-clean completions, preventing false truncation triggers on prose responses.
+
 ## [2.4.2] - 2026-10-13
 
 ### 🤖 Sub-Agent Swarm Model Configuration & Hardcoded Lock

{utim_cli-2.4.2/utim_cli.egg-info → utim_cli-2.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: utim-cli
-Version: 2.4.2
+Version: 2.4.3
 Summary: UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal.
 License: Emend AI Proprietary EULA
 Project-URL: Homepage, https://utim.dev

{utim_cli-2.4.2 → utim_cli-2.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "utim-cli"
-version = "2.4.2"
+version = "2.4.3"
 
 description = "UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal."
 readme = "README.md"

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim/__init__.py

@@ -14,7 +14,7 @@ Quickstart:
 try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
-    __version__ = "2.4.2"
+    __version__ = "2.4.3"
 
 # Developer-friendly core classes (similar to `import genai` / `import openai`)
 from utim_cli.sdk.session import UtimSession as Session

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/__init__.py

@@ -5,7 +5,7 @@ try:
     from utim_cli._version import VERSION as __version__
 except ImportError:
     # Fallback during first-install / editable-install edge cases
-    __version__ = "2.4.2"
+    __version__ = "2.4.3"
 
 
 import builtins, os, pathlib, urllib.parse, re

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/_version.py

@@ -11,6 +11,6 @@
 # from here so every surface stays in sync automatically.
 # ─────────────────────────────────────────────────────────────────────────────
 
-VERSION = "2.4.2"
+VERSION = "2.4.3"
 
 

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/orchestrator.py

@@ -1039,7 +1039,15 @@ class Orchestrator(LLMTransportMixin, TurnHistoryMixin, ToolExecutionMixin):
             # If the model response was cut off mid-turn due to length/token limits, nudge it to continue
             # ONLY trigger when the response was genuinely truncated by token limits (never when finish_reason is "stop" or "end_turn")
             _fr = msg.get("finish_reason") or "stop"
-            _has_unclosed_code = bool(content and content.count("```") % 2 != 0)
+            # Unclosed code-block detection: only meaningful as a truncation signal when the
+            # model didn't explicitly say "stop" / "end_turn". If the model cleanly ended its
+            # response, odd backtick count is simply normal content (e.g. mentioning ``` in prose).
+            _clean_stop = _fr in ("stop", "end_turn")
+            _has_unclosed_code = bool(
+                content
+                and not _clean_stop
+                and content.count("```") % 2 != 0
+            )
             _is_truly_token_truncated = (
                 not msg.get("aborted")
                 and not tool_calls
@@ -1050,8 +1058,8 @@ class Orchestrator(LLMTransportMixin, TurnHistoryMixin, ToolExecutionMixin):
                     or _has_unclosed_code
                 )
             )
-            # If it explicitly said stop, only override if it's obviously cut off (unclosed code) or hit limits
-            if _fr in ("stop", "end_turn") and not _has_unclosed_code and not bool(msg.get("was_truncated_by_limit")):
+            # If it explicitly said stop/end_turn, never treat as truncated unless token limit was hit
+            if _clean_stop and not bool(msg.get("was_truncated_by_limit")):
                 _is_truly_token_truncated = False
             if _is_truly_token_truncated:
                 self.console.print("\n[bold yellow]Response truncated by token limits. Continuing response...[/bold yellow]\n")

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/orchestrator_llm_transport.py

@@ -2143,10 +2143,19 @@ class LLMTransportMixin:
                         if _stream_finish_reason in ("stop", "end_turn") and not _was_truncated_by_limit:
                             was_cut_off = False
                             
-                        # If the stream was severed abruptly (no finish_reason ever arrived),
-                        # default to 'length' so the orchestrator auto-continues the cutoff text.
+                        # If the stream ended without an explicit finish_reason, decide whether
+                        # it was a clean completion or an abrupt disconnect:
+                        #   - If content or tool calls were produced → the model finished naturally
+                        #     (common with Anthropic Claude which often omits finish_reason on
+                        #     clean stop). Default to "stop" so we don't falsely trigger
+                        #     "Response truncated" and inject an unwanted continuation nudge.
+                        #   - If NOTHING was produced → truly abrupt disconnect; default to
+                        #     "length" so the orchestrator will retry / continue.
                         if not _stream_finish_reason:
-                            _stream_finish_reason = "length"
+                            if clean_content or final_tool_calls:
+                                _stream_finish_reason = "stop"
+                            else:
+                                _stream_finish_reason = "length"
 
                         _not_avail_str = "This model isn't currently available on UTIM in free plan"
                         if clean_content and _not_avail_str in clean_content:

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/orchestrator_turn_history.py

@@ -1076,14 +1076,12 @@ class TurnHistoryMixin:
                 tagged_past.append(m_copy)
             past_slice = tagged_past
 
-        if cur_msgs:
-            tagged_cur = []
-            for m in cur_msgs:
-                m_copy = dict(m)
-                if m.get("role") == "user" and not is_compression_artifact_message(m) and not is_system_notification_message(m):
-                    m_copy["content"] = _tag_content(m.get("content"), "pending")
-                tagged_cur.append(m_copy)
-            cur_msgs = tagged_cur
+        # NOTE: We intentionally do NOT tag current-turn user messages with [status: pending].
+        # Past-turn messages use [status: done/aborted] to help the model understand history,
+        # but tagging the ACTIVE user message with [status: pending] confuses some models
+        # (especially Claude) — they misread it as a meta-directive meaning the task is
+        # incomplete, which triggers premature stopping or unnecessary looping.
+        # The current user message is already "live" by position; no status tag is needed.
 
         def _quick_token_est(msgs):
             try:

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/server/api_models_db.py

@@ -1275,9 +1275,6 @@ def init_api_models_db():
         logger.error(f"Error initializing utim_models db: {exc}")
 
 
-init_api_models_db()
-
-
 def get_api_db():
     """FastAPI dependency for obtaining a Session to the utim_models database."""
     db = ApiSessionLocal()

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/server/audit_log.py

@@ -30,7 +30,7 @@ import os
 import re
 from typing import Any, Optional
 
-from .db import SessionLocal, Base, Column, String, DateTime, Text, BigInteger, create_engine, DATABindError  # type: ignore  # noqa: F401
+from .db import SessionLocal, Base, Column, String, DateTime, Text, BigInteger, create_engine
 
 logger = logging.getLogger("utim.audit")
 

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/server/router.py

@@ -53,24 +53,32 @@ from .auth import get_admin_user
 configure_logging(level=os.environ.get("LOG_LEVEL", "INFO"))
 logger = logging.getLogger("utim.server")
 
-# ── Database init ─────────────────────────────────────────────────────────────
+# ── Maintenance Mode Switch ─────────────────────────────────────────────────
+# Set UTIM_MAINTENANCE_MODE=1 (or true/on/yes) in Railway env to put the API
+# into maintenance mode without redeploying code. When enabled:
+#   • /health still returns 200 (so Railway doesn't kill the instance) but
+#     reports {"status":"maintenance"}
+#   • every other route returns 503 with Retry-After, except admin bypass
+#     paths and requests carrying X-UTIM-Maintenance-Bypass == UTIM_MAINTENANCE_BYPASS_TOKEN
+# You can also toggle at runtime via POST /admin/maintenance (admin auth) which
+# overrides the env var in-memory until the next restart.
+
+_maintenance_override: bool | None = None
+
+def _is_maintenance_mode() -> bool:
+    if _maintenance_override is not None:
+        return _maintenance_override
+    return os.environ.get("UTIM_MAINTENANCE_MODE", "0").strip().lower() in ("1", "true", "on", "yes")
+
+# ── Database init & startup sweeps ──────────────────────────────────────────
+# Heavy DB work (init_db, auto-degrade, reconciliation) MUST NOT run at import
+# time — it blocks uvicorn from binding to $PORT, so Railway health checks
+# see "service unavailable" until the DB job finishes (or forever if Postgres
+# is cold). All sweeps are deferred to the lifespan startup hook below, where
+# they run after the port is already listening.
 
-init_db()
-
-
-# ── Auto-degrade sweep on startup ─────────────────────────────────────────────
-# Sweep all active paid subscriptions whose `current_period_end` has passed
-# and downgrade them to the Free plan. Without this, a user who never makes
-# a request after their plan expires would stay on the paid plan in the DB
-# forever, because the per-request auto-degrade in `process_pending_refills`
-# only fires when the user actually calls /quota or /v1/chat/completions.
 def _auto_degrade_sweep() -> int:
-    """One-shot sweep: downgrade any user whose paid period has ended.
-
-    Returns the number of users downgraded. Safe to call repeatedly; only
-    touches users who are still flagged as ``status='active'`` on a paid plan
-    but whose ``current_period_end`` is in the past.
-    """
+    """One-shot sweep: downgrade any user whose paid period has ended."""
     try:
         import datetime
         from .db import UserSubscription
@@ -110,16 +118,6 @@ def _auto_degrade_sweep() -> int:
         return 0
 
 
-# Fire the sweep once at import time. Wrapped in try/except so a transient
-# DB hiccup at boot never prevents the server from coming up.
-try:
-    _auto_degraded = _auto_degrade_sweep()
-    if _auto_degraded:
-        logger.info("startup_auto_degrade_done count=%s", _auto_degraded)
-except Exception as _ex:
-    logger.error("startup_auto_degrade_init_failed err=%s", _ex)
-
-
 def _subscription_reconcile_sweep() -> int:
     """Audit and reconcile active subscriptions on boot: downgrades unpaid paid tiers to free."""
     try:
@@ -144,14 +142,6 @@ def _subscription_reconcile_sweep() -> int:
         logger.error("subscription_reconcile_sweep_failed err=%s", _ex)
         return 0
 
-
-try:
-    _reconciled = _subscription_reconcile_sweep()
-    if _reconciled:
-        logger.info("startup_subscription_reconcile_done count=%s", _reconciled)
-except Exception as _ex:
-    logger.error("startup_subscription_reconcile_init_failed err=%s", _ex)
-
 # ── App Lifespan — startup / shutdown hooks ───────────────────────────────────
 
 from contextlib import asynccontextmanager
@@ -160,28 +150,40 @@ import asyncio as _asyncio
 
 @asynccontextmanager
 async def _lifespan(app):
-    """Startup: ensure key rotator background tasks are running.
-    A watchdog coroutine restarts the credit poller and queue watcher if they die.
+    """Startup: DB init + background tasks. The port is already bound when this
+    runs (uvicorn lifespan), so heavy DB work here no longer blocks health checks.
     """
+    import threading as _threading
+
+    def _bg_db_bootstrap():
+        try:
+            from .db import init_db as _init_db
+            _init_db()
+            logger.info("lifespan_db_init_done")
+        except Exception as _e:
+            logger.warning("lifespan_db_init_error err=%s", _e)
+        for _fn, _label in ((_auto_degrade_sweep, "auto_degrade"), (_subscription_reconcile_sweep, "reconcile")):
+            try:
+                n = _fn()
+                if n:
+                    logger.info("lifespan_%s_done count=%s", _label, n)
+            except Exception as _e:
+                logger.warning("lifespan_%s_error err=%s", _label, _e)
+        try:
+            from .api_models_db import init_api_models_db as _init_api
+            _init_api()
+        except Exception as _e:
+            logger.debug("lifespan_api_models_init_notice err=%s", _e)
+
+    _threading.Thread(target=_bg_db_bootstrap, daemon=True, name="utim-startup-bootstrap").start()
+
     from .key_rotator import global_key_rotator
 
-    # Ensure noisy external HTTP loggers remain quiet
     for quiet_logger in ("httpx", "httpcore", "uvicorn.access", "sqlalchemy.engine"):
         logging.getLogger(quiet_logger).setLevel(logging.WARNING)
 
-    # Ensure credit poller is started (idempotent)
     global_key_rotator._ensure_credit_poller()
 
-    # Reconcile subscriptions on startup
-    _subscription_reconcile_sweep()
-
-    # Ensure canonical utim_models & utim_model_providers tables exist
-    try:
-        from .api_models_db import init_api_models_db
-        init_api_models_db()
-    except Exception as _e:
-        logger.debug("startup_api_models_init_notice err=%s", _e)
-
     async def _watchdog():
         """Restarts key-rotator background tasks if they die unexpectedly."""
         while True:
@@ -296,9 +298,52 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         return response
 
 
+class MaintenanceMiddleware(BaseHTTPMiddleware):
+    """When maintenance mode is on, short-circuit most requests with 503.
+
+    Whitelisted paths (health, maintenance toggle itself, docs) stay available.
+    Admins can bypass with header X-UTIM-Maintenance-Bypass == UTIM_MAINTENANCE_BYPASS_TOKEN.
+    /health intentionally stays 200 so Railway health checks don't kill the instance.
+    """
+
+    _BYPASS_PREFIXES = (
+        "/health",
+        "/admin/maintenance",
+        "/docs",
+        "/redoc",
+        "/openapi.json",
+    )
+
+    async def dispatch(self, request, call_next):
+        if _is_maintenance_mode():
+            path = request.url.path
+            # Header bypass for admin automation
+            bypass_token = os.environ.get("UTIM_MAINTENANCE_BYPASS_TOKEN", "")
+            header_bypass = request.headers.get("x-utim-maintenance-bypass", "")
+            if bypass_token and header_bypass and header_bypass == bypass_token:
+                return await call_next(request)
+            # Whitelisted paths stay reachable
+            if any(path == p or path.startswith(p.rstrip("/")) for p in self._BYPASS_PREFIXES):
+                if path == "/health" or path.startswith("/health"):
+                    return await call_next(request)
+                # allow toggle/docs through
+                return await call_next(request)
+            return JSONResponse(
+                status_code=503,
+                content={
+                    "status": "maintenance",
+                    "detail": "API is in maintenance mode. Please retry shortly.",
+                    "retry_after": 60,
+                },
+                headers={"Retry-After": "60"},
+            )
+        return await call_next(request)
+
+
 # Inner middlewares
 app.add_middleware(LimitUploadSize)
 app.add_middleware(SecurityHeadersMiddleware)
+app.add_middleware(MaintenanceMiddleware)
 
 # CLI signature verification — rejects requests that don't carry a valid
 # X-UTIM-CLI-Signature for protected routes when UTIM_REQUIRE_CLI_SIGNATURE=1.
@@ -651,23 +696,73 @@ def _find_changelog_path():
 
 @app.get("/health", tags=["system"], summary="Health check")
 async def health():
-    """Always returns 200 so Railway health checks pass.
-    DB status is reported in the body for diagnostics.
+    """Always returns 200 so Railway health checks pass instantly.
+
+    The check is fully synchronous and does not touch the DB thread-pool —
+    the DB status is reported opportunistically via a short-timeout probe so
+    a slow Postgres never makes /health itself time out. In maintenance mode
+    still returns 200 (so Railway doesn't kill the pod) but with status=maintenance.
     """
-    from .concurrency import run_in_db
-    def _check_db():
-        db = SessionLocal()
+    # Maintenance-aware fast path — report it before touching the DB
+    if _is_maintenance_mode():
         try:
-            db.execute(text("SELECT 1"))
-            return "ok", None
-        except Exception as exc:
-            return "error", str(exc)
+            import re as _re2
+            _cl_path2 = _find_changelog_path()
+            _version2 = "1.47.16"
+            if _cl_path2:
+                with open(_cl_path2, "r", encoding="utf-8") as _f2:
+                    for _line2 in _f2:
+                        _m2 = _re2.match(r"^##\s+\[?([0-9a-zA-Z\.\-]+)\]?\s*-", _line2.strip())
+                        if _m2:
+                            _version2 = _m2.group(1)
+                            break
+        except Exception:
+            _version2 = "1.47.16"
+        return JSONResponse(
+            content={"status": "maintenance", "db": "ok", "version": _version2, "maintenance": True},
+            status_code=200,
+        )
+
+    import time as _t
+    from sqlalchemy import text as _text
+
+    db_status: str = "ok"
+    db_error: str | None = None
+
+    # Probe the DB with an aggressive statement timeout so /health itself
+    # can never be held up by a saturated pool or a cold Postgres.
+    _deadline = _t.monotonic() + 1.5  # hard wall-clock deadline for /health
+    try:
+        _db = SessionLocal()
+        try:
+            # Short statement timeout for the probe only (does not leak).
+            try:
+                _db.execute(_text("SET LOCAL statement_timeout = '1000'"))
+            except Exception:
+                pass
+            _db.execute(_text("SELECT 1"))
+            db_status = "ok"
+        except Exception as _exc:
+            db_status = "error"
+            db_error = str(_exc)
+            try:
+                _db.rollback()
+            except Exception:
+                pass
+            logger.error("health_db_error: %s", _exc)
         finally:
-            db.close()
+            try:
+                _db.close()
+            except Exception:
+                pass
+    except Exception as _exc:  # SessionLocal() itself failed (e.g. bad DSN)
+        db_status = "error"
+        db_error = str(_exc)
 
-    db_status, db_error = await run_in_db(_check_db)
-    if db_error:
-        logger.error(f"health_db_error: {db_error}")
+    if _t.monotonic() > _deadline:
+        # We exceeded the deadline only if DB was painfully slow; still
+        # return a body — the status code must stay 200 anyway.
+        pass
 
     # Derive version dynamically from CHANGELOG.md so a deploy auto-updates it
     try:
@@ -690,6 +785,63 @@ async def health():
     return JSONResponse(content=body, status_code=200)
 
 
+# ── Maintenance Mode Admin Endpoints ──────────────────────────────────────────
+
+@app.get("/admin/maintenance", tags=["admin"], summary="Get maintenance mode status")
+async def get_maintenance_status(request: Request):
+    """Check whether maintenance mode is active. Requires admin auth."""
+    from .admin_auth import require_admin_auth
+    require_admin_auth(request)
+    return JSONResponse(content={
+        "maintenance": _is_maintenance_mode(),
+        "override": _maintenance_override,
+        "env": os.environ.get("UTIM_MAINTENANCE_MODE", "0"),
+    })
+
+
+class MaintenanceToggleRequest(BaseModel):
+    enabled: bool
+    # optional bypass token to set at same time
+    bypass_token: Optional[str] = None
+
+
+@app.post("/admin/maintenance", tags=["admin"], summary="Toggle maintenance mode at runtime")
+async def set_maintenance_mode(request: Request, body: MaintenanceToggleRequest):
+    """Toggle maintenance mode without redeploy. Requires admin auth (x-admin-key or Authorization: Bearer <UTIM_MASTER_KEY>).
+
+    POST body: {"enabled": true/false, "bypass_token": "optional-secret"}
+    When enabled=true, all non-whitelisted routes return 503. /health stays 200 with status=maintenance.
+    When enabled=false, normal operation resumes.
+    The in-memory override takes precedence over the UTIM_MAINTENANCE_MODE env var until next restart.
+    """
+    from .admin_auth import require_admin_auth
+    require_admin_auth(request)
+    global _maintenance_override
+    _maintenance_override = bool(body.enabled)
+    if body.bypass_token is not None:
+        if body.bypass_token:
+            os.environ["UTIM_MAINTENANCE_BYPASS_TOKEN"] = body.bypass_token
+        elif "UTIM_MAINTENANCE_BYPASS_TOKEN" in os.environ:
+            del os.environ["UTIM_MAINTENANCE_BYPASS_TOKEN"]
+    logger.warning("maintenance_mode_toggled enabled=%s by_admin=%s", _maintenance_override, request.client.host if request.client else "unknown")
+    return JSONResponse(content={
+        "status": "maintenance" if _maintenance_override else "ok",
+        "maintenance": _maintenance_override,
+        "message": "Maintenance mode enabled — API returns 503 (except /health, /docs, /admin/maintenance)" if _maintenance_override else "Maintenance mode disabled — API back to normal",
+    })
+
+
+@app.delete("/admin/maintenance", tags=["admin"], summary="Clear runtime override and fallback to env var")
+async def clear_maintenance_override(request: Request):
+    """Clear the in-memory override so UTIM_MAINTENANCE_MODE env var takes effect again."""
+    from .admin_auth import require_admin_auth
+    require_admin_auth(request)
+    global _maintenance_override
+    _maintenance_override = None
+    logger.info("maintenance_mode_override_cleared")
+    return JSONResponse(content={"maintenance": _is_maintenance_mode(), "override": None, "message": "Override cleared, now following UTIM_MAINTENANCE_MODE env var"})
+
+
 @app.get("/api/version/latest", tags=["system"], summary="Latest CLI version (source of truth for update banners)")
 async def api_version_latest():
     """Single source of truth for CLI update prompts.
@@ -713,8 +865,7 @@ async def api_version_latest():
             return JSONResponse(content={"latest": _version}, status_code=200)
     except Exception:
         pass
-    except Exception:
-        return JSONResponse(content={"latest": None}, status_code=200)
+    return JSONResponse(content={"latest": None}, status_code=200)
 
 
 @app.get("/models", tags=["system"], summary="List available LLM models from ModelDB")

{utim_cli-2.4.2 → utim_cli-2.4.3}/utim_cli/server/routes/api_models_public_routes.py

@@ -1243,30 +1243,10 @@ async def _do_dispatch_chat_completion(
     ] if model_obj else []
 
     if not model_obj or not model_obj.is_active or not active_providers:
-        # Check if model exists in primary platform registry (MODEL_REGISTRY / ModelDB)
-        from ..models import is_model_in_registry
-        if is_model_in_registry(req.model, db=user_db):
-            from .provider_compat_routes import (
-                v1_chat_completions,
-                ChatCompletionRequest as CompatChatCompletionRequest,
-            )
-            compat_req = CompatChatCompletionRequest(
-                model=req.model,
-                messages=req.messages,
-                stream=req.stream,
-                temperature=req.temperature,
-                max_tokens=req.max_tokens,
-                tools=req.tools,
-            )
-            res = await v1_chat_completions(
-                request=request,
-                req=compat_req,
-                db=user_db,
-                user=user,
-                concurrency_acquired=True,
-            )
-            return res, True
-
+        # ── Strict api_models isolation: NEVER fall back to OpenRouter / platform registry.
+        #    Requests hitting /v1/chat/completions (api_models router) must stay on the
+        #    api_models endpoint so a provider failure surfaces as 404/503 from this
+        #    endpoint instead of silently proxying to OpenRouter.
         if not model_obj or not model_obj.is_active:
             raise HTTPException(
                 status_code=404,
@@ -1486,34 +1466,8 @@ async def _do_dispatch_chat_completion(
             if status_code not in (401, 403, 429) or key_idx == len(candidate_keys) - 1:
                 break
 
-    # If all upstream providers in api_models failed:
-    # Check if primary platform registry has this model to serve as fallback before giving up with 502!
-    from ..models import is_model_in_registry
-    if is_model_in_registry(req.model, db=user_db):
-        logger.warning(
-            f"All api_models providers failed for '{req.model}'. Falling back to platform registry..."
-        )
-        from .provider_compat_routes import (
-            v1_chat_completions,
-            ChatCompletionRequest as CompatChatCompletionRequest,
-        )
-        compat_req = CompatChatCompletionRequest(
-            model=req.model,
-            messages=req.messages,
-            stream=req.stream,
-            temperature=req.temperature,
-            max_tokens=req.max_tokens,
-            tools=req.tools,
-        )
-        res = await v1_chat_completions(
-            request=request,
-            req=compat_req,
-            db=user_db,
-            user=user,
-            concurrency_acquired=True,
-        )
-        return res, True
-
+    # ── Strict api_models isolation: upstream failures must NOT fall back to OpenRouter.
+    #    Surface the real upstream error so callers see the api_models failure directly.
     raise HTTPException(status_code=502, detail={"error": {"message": f"All upstream providers failed: {last_err}", "type": "bad_gateway"}})