[ggdayup]

Summary

When a provider with passthrough models (e.g., bai / thebai, third-party aggregators, or multi-model nodes) returns HTTP 400 with credit insufficient balance or quota exhaustion on a specific paid model, OmniRoute previously marked the entire connection as terminal credits_exhausted with rateLimitedUntil = null.

This disabled all free or available models on the same connection (e.g., bai/qwen3.8-flash) until a manual "Retest" was triggered or the 30-minute background reprobe timer elapsed.

This PR ensures credit exhaustion on per-model-quota providers is properly scoped as a model-level lockout (reason: "quota_exhausted") rather than a whole-connection terminal failure.

Root Cause

1. checkFallbackError() in open-sse/services/accountFallback.ts:
   PR fix(providers): cegp/gpt-5.6-luna dead — 403 insufficient_quota reset never fires, should mark model unhealthy #8247 added !isCompatibleProvider(provider) to prevent compatible providers from emitting creditsExhausted: true. However, isCompatibleProvider only matches openai-compatible- / anthropic-compatible- prefixes, omitting built-in passthrough providers like bai.
2. markAccountUnavailable() in src/sse/services/auth.ts:
   The model-lockout conditional check was restricted to (status === 404 || isNvidiaModelGone || status === 429 || status >= 500). When an upstream passthrough provider returns HTTP 400 with credit insufficient balance, status 400 did not match this condition, falling through to resolveTerminalConnectionStatus() and terminating the entire account connection.

Key Changes

1. Scope Quota Signal to Per-Model Providers (open-sse/services/accountFallback.ts):
   Replaced !isCompatibleProvider(provider) with !hasPerModelQuota(provider, _model) when returning creditsExhausted: true. Built-in passthrough providers, compatible providers, and multi-model configurations now avoid emitting connection-wide creditsExhausted. Account-level balance exhaustion (e.g. Moonshot empty wallet) continues to terminate the whole connection as expected.
2. Handle Model Quota Exhaustion in markAccountUnavailable (src/sse/services/auth.ts):
   Added isModelLevelQuotaOrRateLimit check so that non-permanent quota/credit exhaustion (RateLimitReason.QUOTA_EXHAUSTED or creditsExhausted) triggers model-only lockout with reason: "quota_exhausted". Sibling models on the same connection remain active and eligible.
3. Unit Tests (tests/unit/auth-passthrough-credit-lockout.test.ts):
   • Verified b.ai HTTP 400 credit insufficient balance locks only the requested model (glm-5.3-flash), connection remains active, and free model (qwen3.8-flash) remains unlocked.
   • Verified compatible providers continue to lock only the model.
   • Verified single-model providers (e.g. openai) still terminate the connection with credits_exhausted.

Testing

• Ran unit tests:

  node --import tsx/esm --test tests/unit/auth-passthrough-credit-lockout.test.ts tests/unit/auth-ollama-cloud-per-model-403-3027.test.ts tests/unit/account-fallback.test.ts tests/unit/auth-account-fallback.test.ts

  All passed cleanly.
• ESLint and Prettier checks passed with 0 errors.

[diegosouzapw]

Thanks for tracking down the passthrough-vs-terminal scoping bug — the reproduction and
your three new tests (bai passthrough, compatible-nickname passthrough, and the
single-model openai regression guard) are solid and all pass against the real
markAccountUnavailable() path with a live SQLite DB. Before merging I'd like two small
additions: (1) a changelog fragment under changelog.d/fixes/, and (2) one more test
case for a *-compatible-* provider WITHOUT the connection-level passthroughModels
override, since removing the old !isCompatibleProvider guard changes the cooldown path
for that case too (fixed 1h instead of the prior exponential backoff) and it'd be good to
pin that as intentional. Nothing structural — happy to merge once those land.