fix(api): yield event loop and bulk-load override tables in catalog build (#9147)

changelog.d/fixes/10313-catalog-cache-key-hash.md

@@ -0,0 +1 @@
+- fix(api): hash the API key before using it as the model-catalog cache Map key (no raw credentials in process heap) (#10313)

changelog.d/fixes/10314-combo-error-aggregation.md

@@ -1 +0,0 @@
-- fix(resilience): keep combo quality and auth failure reasons separate and redact connection labels in terminal errors (#10314)

changelog.d/fixes/9147-catalog-eventloop-yield.md

@@ -0,0 +1 @@
+- fix(api): yield the event loop during catalog builds and bulk-load override/hidden-model tables (#9147)

open-sse/services/combo.ts

@@ -93,13 +93,6 @@ import {
   expandPromptCacheAffinityTargetsFromConnections,
   resolvePromptCacheAffinityKey,
 } from "./combo/promptCacheAffinity.ts";
-import {
-  classifyComboOutcome,
-  formatComboOutcomes,
-  redactConnectionLabel,
-  buildRedactedSummary,
-} from "./combo/comboErrorAggregation.ts";
-import type { ComboErrorEntry } from "./combo/comboErrorAggregation.ts";
 import type { CompressionMode } from "./compression/types.ts";
 import { getCachedProviderConnections } from "../../src/lib/db/readCache";
 import { isProviderInCooldown, recordProviderCooldown } from "./providerCooldownTracker.ts";
@@ -860,7 +853,7 @@ export async function handleComboChat({
   let comboExpired = false;
   // Accumulator for per-model error details across targets in the current set try.
   // Reset at the start of each set retry (same lifecycle as lastError/recordedAttempts).
-  let comboErrors: Array<ComboErrorEntry> = [];
+  let comboErrors: Array<{ model: string; status: number; error: string }> = [];
   // Quota trust spans set retries and recursive cooldown re-dispatches. Once any
   // failure is non-quota, a nested caller must never treat this dispatch as quota-only.
   let observedFailure = false;
@@ -1350,15 +1343,6 @@ export async function handleComboChat({
               // misleading ALL_ACCOUNTS_INACTIVE when the real issue is quality.
               lastError = `Upstream response failed quality validation: ${quality.reason}`;
               lastStatus = 502;
-              // #10314: record quality failures as a FIRST-CLASS per-target outcome
-              // so a quality reason is never silently dropped from the aggregated
-              // terminal message when a later sibling overwrites lastError.
-              comboErrors.push({
-                model: modelStr,
-                status: 502,
-                error: quality.reason || "upstream response failed quality validation",
-                kind: "quality",
-              });
               if (i > 0) fallbackCount++;
               if (provider && rawModel) {
                 const mlSettings = resolveModelLockoutSettings(settings);
@@ -1866,7 +1850,6 @@ export async function handleComboChat({
               model: modelStr,
               status: result.status,
               error: errorText || String(result.status),
-              kind: classifyComboOutcome(result.status, errorText),
             });
             lastStatus = result.status;
             if (i > 0) fallbackCount++;
@@ -2060,7 +2043,6 @@ export async function handleComboChat({
             model: modelStr,
             status: result.status,
             error: errorText || String(result.status),
-            kind: classifyComboOutcome(result.status, errorText),
           });
           lastStatus = result.status;
           if (i > 0) fallbackCount++;
@@ -2215,10 +2197,15 @@ export async function handleComboChat({
 
       // Global combo timeout: return aggregated error immediately, skipping set retries.
       if (comboExpired) {
-        const summary = buildRedactedSummary(comboErrors);
+        const summary = comboErrors
+          .slice(0, 5)
+          .map((e) => `${e.model} (${e.status})`)
+          .join(", ");
         const msg =
           `Combo global timeout (${comboTimeoutMs}ms) after ${recordedAttempts}/${orderedTargets.length} targets` +
-          (comboErrors.length > 0 ? ` | tried: ${summary}` : "");
+          (comboErrors.length > 0
+            ? ` | tried: ${summary}${comboErrors.length > 5 ? `... (+${comboErrors.length - 5})` : ""}`
+            : "");
         const latencyMs = Date.now() - startTime;
         if (recordedAttempts === 0) {
           recordComboRequest(combo.name, null, {
@@ -2289,12 +2276,18 @@ export async function handleComboChat({
       }
 
       const status = lastStatus;
-      // #10314: build the terminal message from the structured per-target
-      // outcomes (each distinct class+reason listed separately) instead of
-      // mashing a single lastError with raw `[model (status)]` markers. Connection
-      // identifiers are redacted. Falls back to lastError when no target recorded
-      // a structured outcome.
-      const msg = formatComboOutcomes(comboErrors) || lastError || "All combo models unavailable";
+      // Build aggregated error message with per-model failure details for diagnostics.
+      const comboErrorSummary =
+        comboErrors.length > 0
+          ? " [" +
+            comboErrors
+              .slice(0, 5)
+              .map((e) => `${e.model} (${e.status})`)
+              .join(", ") +
+            (comboErrors.length > 5 ? `... (+${comboErrors.length - 5})` : "") +
+            "]"
+          : "";
+      const msg = (lastError || "All combo models unavailable") + comboErrorSummary;
 
       // Cooldown-aware retry: instead of crystallizing a transient failure, wait
       // out a SHORT cooldown and re-run the whole set loop. Guarded by the helper
@@ -2722,10 +2715,6 @@ async function handleRoundRobinCombo({
   let globalAttempts = 0;
   let fallbackCount = 0;
   let recordedAttempts = 0;
-  // #10314: per-target outcome accumulator for the round-robin twin so the
-  // terminal message lists each distinct reason separately (see the quality path
-  // and the "Done with this model" path below), mirroring handleComboChat.
-  const rrOutcomes: Array<ComboErrorEntry> = [];
 
   // #1731: Per-request in-memory set of providers whose quota is fully exhausted.
   // When a target returns a quota-exhausted 429, remaining targets from the same
@@ -2922,12 +2911,6 @@ async function handleRoundRobinCombo({
             // misleading ALL_ACCOUNTS_INACTIVE when the real issue is quality.
             lastError = `Upstream response failed quality validation: ${quality.reason}`;
             lastStatus = 502;
-            rrOutcomes.push({
-              model: modelStr,
-              status: 502,
-              error: quality.reason || "upstream response failed quality validation",
-              kind: "quality",
-            });
             if (offset > 0) fallbackCount++;
             break; // move to next model
           }
@@ -3234,12 +3217,6 @@ async function handleRoundRobinCombo({
         recordedAttempts++;
         lastError = errorText || String(result.status);
         lastStatus = result.status;
-        rrOutcomes.push({
-          model: modelStr,
-          status: result.status,
-          error: errorText || String(result.status),
-          kind: classifyComboOutcome(result.status, errorText),
-        });
         if (offset > 0) fallbackCount++;
         log.warn("COMBO-RR", `${modelStr} failed, trying next model`, { status: result.status });
 
@@ -3360,10 +3337,7 @@ async function handleRoundRobinCombo({
   }
 
   const status = lastStatus;
-  // #10314: same structured per-target aggregation as handleComboChat — list each
-  // distinct reason separately (redacted), fall back to lastError when no outcome.
-  const msg =
-    formatComboOutcomes(rrOutcomes) || lastError || "All round-robin combo models unavailable";
+  const msg = lastError || "All round-robin combo models unavailable";
 
   if (earliestRetryAfter && isRetryAfterEligibleStatus(status)) {
     const retryHuman = formatRetryAfter(toRetryAfterDisplayValue(earliestRetryAfter));

open-sse/services/combo/comboErrorAggregation.ts

@@ -1,115 +0,0 @@
-/**
- * Shared combo terminal-error aggregation.
- *
- * #10314 — combo error aggregation mixes quality and auth. Prior to this module
- * the combo terminal message was built as a single `lastError` string (last
- * writer wins — it can only ever represent ONE target's reason) concatenated
- * with a raw `[model (status)]` suffix. A quality-failure reason from one
- * target and a sibling's 401 were collapsed into one client-facing sentence
- * (`invalid_api_key [openai/proxy-account-b (401)]`) and a quality reason that
- * was not the final failing target was dropped entirely.
- *
- * This module gives each per-target failure a structured {model, status, error,
- * kind} entry, so the terminal message can list every distinct reason
- * separately (and classification-labelled) instead of mashing them, and it
- * redacts connection/account identifiers that, on openai-compatible proxy
- * connections, used to surface verbatim in client-visible and shared-warn
- * strings (ops/PII leak).
- */
-
-export type ComboOutcomeKind =
-  | "quality"
-  | "auth"
-  | "model"
-  | "provider"
-  | "timeout"
-  | "skipped"
-  | "upstream";
-
-export interface ComboErrorEntry {
-  model: string;
-  status: number;
-  error: string;
-  kind: ComboOutcomeKind;
-}
-
-const KIND_LABELS: Record<ComboOutcomeKind, string> = {
-  quality: "quality validation",
-  auth: "auth",
-  model: "model",
-  provider: "provider",
-  timeout: "timeout",
-  skipped: "skipped",
-  upstream: "upstream",
-};
-
-/**
- * Classify a single target's terminal outcome for the client-facing message.
- * Auth-class errors (401/403 or auth-sounding text) are kept distinct from
- * model-class (400/422) and provider-class (5xx) so a sibling's 401 is never
- * presented as "quality failed". Fall through to `model` for everything else.
- */
-export function classifyComboOutcome(status: number, errorText: string): ComboOutcomeKind {
-  const text = typeof errorText === "string" ? errorText : "";
-  if (
-    status === 401 ||
-    status === 403 ||
-    /(invalid.?api.?key|unauthorized|not.?authorized|auth(entication|orization)?)/i.test(text)
-  ) {
-    return "auth";
-  }
-  if (status === 408 || status >= 499) return "timeout";
-  if (status >= 500) return "provider";
-  return "model";
-}
-
-/**
- * Redact connection/account identifiers that can ride inside a proxy target's
- * model string (openai-compatible proxy model names often carry a connection
- * label). UUIDs and long hex hashes are truncated to a short `conn:` prefix.
- * Provider/model names operators need for debugging are left intact.
- */
-export function redactConnectionLabel(modelStr: string | null | undefined): string {
-  const label = typeof modelStr === "string" && modelStr ? modelStr : "unknown";
-  return label
-    .replace(
-      /\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/g,
-      (m) => `conn:${m.slice(0, 8)}`
-    )
-    .replace(/\b[0-9a-fA-F]{16,}\b/g, (m) => `conn:${m.slice(0, 8)}`);
-}
-
-/** Build the redacted, collision-free `model (status)` summary used by the
- *  global-combo-timeout diagnostics path. */
-export function buildRedactedSummary(
-  entries: Array<{ model: string; status: number }> | ReadonlyArray<{ model: string; status: number }>
-): string {
-  const slice = entries.slice(0, 5);
-  const parts = slice.map((e) => `${redactConnectionLabel(e.model)} (${e.status})`).join(", ");
-  return entries.length > 5 ? `${parts}... (+${entries.length - 5})` : parts;
-}
-
-/**
- * Format per-target terminal outcomes into one client-facing sentence that keeps
- * every distinct reason separate (and classification-labelled) instead of
- * mashing a single `lastError` with raw status markers. Always redacts
- * connection identifiers unless `{ redact: false }` is explicitly passed.
- */
-export function formatComboOutcomes(
-  entries: ReadonlyArray<{ model: string; status: number; error: string; kind?: ComboOutcomeKind }>,
-  opts?: { redact?: boolean }
-): string {
-  if (!entries.length) return "";
-  const redact = opts?.redact !== false;
-  const slice = entries.slice(0, 5);
-  const parts = slice.map((e) => {
-    const label = redact ? redactConnectionLabel(e.model) : e.model;
-    const kind = e.kind ? KIND_LABELS[e.kind] ?? e.kind : null;
-    const reason = e.error || `HTTP ${e.status}`;
-    const statusTxt = ` (HTTP ${e.status})`;
-    return kind ? `${label}: ${kind} — ${reason}${statusTxt}` : `${label}: ${reason}${statusTxt}`;
-  });
-  return entries.length > 5
-    ? `${parts.join("; ")}... (+${entries.length - 5} more)`
-    : parts.join("; ");
-}

src/app/api/v1/models/catalog.ts

@@ -6,9 +6,9 @@ import {
   getAllCustomModels,
   getSettings,
   getCachedProviderNodes,
-  getModelIsHidden,
   getModelAliases,
   getDatabaseSettings,
+  getHiddenModelsByProvider,
 } from "@/lib/localDb";
 import { createLazyConnectionView } from "@/lib/db/providers/lazyConnectionView";
 import { extractAliasBackedModels } from "./aliasBackedModels";
@@ -132,7 +132,7 @@ export {
 } from "./catalogCache";
 export type { CachedCatalog } from "./catalogCache";
 
-const BUILTIN_AUTO_YIELD_INTERVAL = 8;
+const BUILTIN_AUTO_YIELD_INTERVAL = 2;
 
 function yieldCatalogBuildTurn(): Promise<void> {
   return new Promise((resolve) => setImmediate(resolve));
@@ -156,6 +156,8 @@ export async function getUnifiedModelsResponse(
     try {
       settingsForAuth = await getSettings();
     } catch {}
+    // #9147: yield before auth check to allow event loop tick
+    await yieldCatalogBuildTurn();
     const authRejection = await getModelCatalogAuthRejection(request, settingsForAuth, {
       ...corsHeaders,
       ...diagnosticHeaders,
@@ -226,6 +228,28 @@ async function buildUnifiedModelsResponseCore(
   corsHeaders: Record<string, string> = {}
 ) {
   const diagnosticHeaders = getCatalogDiagnosticsHeaders({ request });
+  // #9147: this builder walks connections + model registries at catalog scale with no
+  // event-loop yield, so a large deployment pins the single Node.js thread for the
+  // whole build (reporter: 183 connections / 2000+ models → 10.1s stall that blocks the
+  // dashboard WS heartbeat). Yield every `catYIELD_EVERY` items across the hot loops.
+  const catYIELD_EVERY = 20;
+  let catYieldCount = 0;
+  const maybeYieldCatalogBuild = async (): Promise<void> => {
+    catYieldCount++;
+    if (catYieldCount % catYIELD_EVERY === 0) {
+      await yieldCatalogBuildTurn();
+    }
+  };
+  // #9147: `getModelIsHidden()` is a SQLite read per call (custom row + compat list)
+  // and the build consults it ~16× per entry. Bulk-load the hidden-model map once
+  // (one query — `getHiddenModelsByProvider`) and resolve from memory for the whole
+  // build. A provider absent from the map has no hidden models at all — `false`,
+  // no on-demand fallback (that would reintroduce the per-call SQLite reads).
+  const hiddenModelsByProvider = getHiddenModelsByProvider();
+  const isModelHiddenBulk = (providerId: string, modelId: string): boolean => {
+    const hiddenSet = hiddenModelsByProvider.get(providerId);
+    return hiddenSet ? hiddenSet.has(modelId) : false;
+  };
   try {
     let settings: Record<string, any> = {};
     try {
@@ -237,6 +261,10 @@ async function buildUnifiedModelsResponseCore(
       ...diagnosticHeaders,
     });
     if (authRejection) return authRejection;
+
+    // #9147: yield after auth check before DB initialization prologue
+    await yieldCatalogBuildTurn();
+
     const { aliasToProviderId, providerIdToAlias } = buildAliasMaps();
     const _qp = new URL(request.url).searchParams.get("prefix");
     const prefixMode =
@@ -321,6 +349,7 @@ async function buildUnifiedModelsResponseCore(
 
     // Get combos
     let combos = [];
+    await yieldCatalogBuildTurn();
     try {
       combos = await getCombos();
     } catch (e) {
@@ -588,7 +617,7 @@ async function buildUnifiedModelsResponseCore(
           timestamp,
           (c) => buildComboCatalogMetadata(c, combos)
         );
-        const quotaFinal = applyCatalogPostFilters(request, quotaModels, {
+        const quotaFinal = await applyCatalogPostFilters(request, quotaModels, {
           connections,
           prefixMode,
           aliasToProviderId,
@@ -683,7 +712,7 @@ async function buildUnifiedModelsResponseCore(
       ) as ComboCatalogTarget[];
       const visibleTargets = comboTargets.filter((target) => {
         const resolved = getComboTargetModelId(target);
-        return resolved ? !getModelIsHidden(resolved.providerId, resolved.modelId) : true;
+        return resolved ? !isModelHiddenBulk(resolved.providerId, resolved.modelId) : true;
       });
       if (visibleTargets.length === 0) continue;
 
@@ -700,11 +729,16 @@ async function buildUnifiedModelsResponseCore(
         parent: null,
         ...comboMetadata,
       });
+
+      // #9147: combos can number hundreds at catalog scale — yield periodically.
+      await maybeYieldCatalogBuild();
     }
 
     let syncedModelsByProvider: Record<string, SyncedAvailableModel[]> = {};
     try {
+      await yieldCatalogBuildTurn();
       syncedModelsByProvider = await getAllActiveSyncedModels();
+      await yieldCatalogBuildTurn();
     } catch (e) {
       // DB unavailable — log and fall through; static models remain as defaults.
       console.log("[catalog] Could not fetch synced available models:", e);
@@ -792,7 +826,7 @@ async function buildUnifiedModelsResponseCore(
         if (!isModelSelectable(canonicalProviderId, model.id)) continue;
         if (!providerSupportsModel(canonicalProviderId, model.id)) continue;
         const aliasId = `${alias}/${model.id}`;
-        if (getModelIsHidden(canonicalProviderId, model.id)) continue;
+        if (isModelHiddenBulk(canonicalProviderId, model.id)) continue;
         if (shouldHidePaid(canonicalProviderId, model.id, (model as { pricing?: unknown }).pricing))
           continue;
 
@@ -846,12 +880,15 @@ async function buildUnifiedModelsResponseCore(
             ...thinkingCapabilities,
           });
         }
+
+        // #9147: static model walk is the densest loop — yield periodically.
+        await maybeYieldCatalogBuild();
       }
     }
 
     for (const modelId of CODEX_NATIVE_UNPREFIXED_MODELS) {
       if (!providerSupportsModel("codex", modelId)) continue;
-      if (getModelIsHidden("codex", modelId)) continue;
+      if (isModelHiddenBulk("codex", modelId)) continue;
 
       const alias = providerIdToAlias.codex || "cx";
       const aliasId = `${alias}/${modelId}`;
@@ -912,7 +949,7 @@ async function buildUnifiedModelsResponseCore(
           if (canonicalProviderId === "codex" && isCodexDiscoveryModelExcluded(sm)) {
             continue;
           }
-          if (getModelIsHidden(providerId, sm.id)) continue;
+          if (isModelHiddenBulk(providerId, sm.id)) continue;
           // #6457: some upstream discovery catalogs (e.g. HuggingFace's live
           // `/v1/models`) return image/diffusion models with no modality info,
           // so `endpoints` below would default to ["chat"] and misrepresent
@@ -1024,6 +1061,9 @@ async function buildUnifiedModelsResponseCore(
               });
             }
           }
+
+          // #9147: synced-model union is usually the largest walk — yield periodically.
+          await maybeYieldCatalogBuild();
         }
       }
     } catch (err) {
@@ -1053,7 +1093,7 @@ async function buildUnifiedModelsResponseCore(
           if (hidePaid && !isFree) continue;
           // #9293: respect per-model hidden flags (e.g. operator hid google/chirp-3
           // from the OpenRouter provider, so it should not appear in the live catalog).
-          if (getModelIsHidden("openrouter", openRouterModel.id)) continue;
+          if (isModelHiddenBulk("openrouter", openRouterModel.id)) continue;
           const supportedParameters = Array.isArray(openRouterModel.supported_parameters)
             ? openRouterModel.supported_parameters
             : [];
@@ -1094,6 +1134,9 @@ async function buildUnifiedModelsResponseCore(
             ...(outputModalities.length > 0 ? { output_modalities: outputModalities } : {}),
             ...(Object.keys(capabilities).length > 0 ? { capabilities } : {}),
           });
+
+          // #9147: OpenRouter catalog can be large — yield periodically.
+          await maybeYieldCatalogBuild();
         }
       } catch (err) {
         console.error("[catalog] Error loading OpenRouter catalog:", err);
@@ -1138,7 +1181,7 @@ async function buildUnifiedModelsResponseCore(
 
     // Helper: strip the provider prefix from a specialty model ID to get the
     // provider-relative path (e.g. "openrouter/google/chirp-3" -> "google/chirp-3").
-    // This is the correct key used by getModelIsHidden() — using .split("/").pop()
+    // This is the correct key used by the hidden-model lookup — using .split("/").pop()
     // here would discard all but the last segment and miss stored flags for
     // providers whose model IDs carry a sub-path (e.g. OpenRouter scoped models).
     const getSpecialtyModelRelativeId = (modelId: string, provider: string): string =>
@@ -1149,7 +1192,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(embModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(embModel.id, embModel.provider);
       if (!providerSupportsModel(embModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(embModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(embModel.provider, rawModelId)) continue;
       if (hasEquivalentSpecialtyModel(embModel.provider, rawModelId, "embedding", embModel.id)) {
         continue;
       }
@@ -1169,7 +1212,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(imgModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(imgModel.id, imgModel.provider);
       if (!providerSupportsModel(imgModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(imgModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(imgModel.provider, rawModelId)) continue;
       models.push({
         id: imgModel.id,
         object: "model",
@@ -1189,7 +1232,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(rerankModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(rerankModel.id, rerankModel.provider);
       if (!providerSupportsModel(rerankModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(rerankModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(rerankModel.provider, rawModelId)) continue;
       if (hasEquivalentSpecialtyModel(rerankModel.provider, rawModelId, "rerank", rerankModel.id)) {
         continue;
       }
@@ -1208,7 +1251,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(audioModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(audioModel.id, audioModel.provider);
       if (!providerSupportsModel(audioModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(audioModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(audioModel.provider, rawModelId)) continue;
       models.push({
         id: audioModel.id,
         object: "model",
@@ -1224,7 +1267,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(modModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(modModel.id, modModel.provider);
       if (!providerSupportsModel(modModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(modModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(modModel.provider, rawModelId)) continue;
       models.push({
         id: modModel.id,
         object: "model",
@@ -1239,7 +1282,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(videoModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(videoModel.id, videoModel.provider);
       if (!providerSupportsModel(videoModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(videoModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(videoModel.provider, rawModelId)) continue;
       models.push({
         id: videoModel.id,
         object: "model",
@@ -1260,7 +1303,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(musicModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(musicModel.id, musicModel.provider);
       if (!providerSupportsModel(musicModel.provider, rawModelId)) continue;
-      if (getModelIsHidden(musicModel.provider, rawModelId)) continue;
+      if (isModelHiddenBulk(musicModel.provider, rawModelId)) continue;
       models.push({
         id: musicModel.id,
         object: "model",
@@ -1306,7 +1349,7 @@ async function buildUnifiedModelsResponseCore(
           if (!isUnifiedChatSourceModelSelectable(canonicalProviderId, { ...model, id: modelId }))
             continue;
           if (model.isHidden === true) continue;
-          if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+          if (isModelHiddenBulk(canonicalProviderId, modelId)) continue;
           // #6328: apply hidePaidModels to user-defined custom rows too.
           // Custom entries do not carry pricing, so shouldHidePaid() decides
           // via FREE_MODEL_IDS_BY_PROVIDER — matches synced/PROVIDER_MODELS.
@@ -1441,6 +1484,9 @@ async function buildUnifiedModelsResponseCore(
               ...(providerVisionFields || {}),
             });
           }
+
+          // #9147: custom-model walk — yield periodically.
+          await maybeYieldCatalogBuild();
         }
       }
     } catch (e) {
@@ -1486,7 +1532,7 @@ async function buildUnifiedModelsResponseCore(
           continue;
         }
 
-        if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+        if (isModelHiddenBulk(canonicalProviderId, modelId)) continue;
         // #6328: apply hidePaidModels to alias-backed rows too. Alias mappings
         // point at providerKey/modelId with no pricing, so shouldHidePaid()
         // decides via the FREE_MODEL_IDS_BY_PROVIDER catalog tier.
@@ -1559,7 +1605,7 @@ async function buildUnifiedModelsResponseCore(
       for (const model of fallbackModels) {
         const modelId = typeof model.id === "string" ? model.id : null;
         if (!modelId) continue;
-        if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+        if (isModelHiddenBulk(canonicalProviderId, modelId)) continue;
         // #6328: apply hidePaidModels to managed-fallback rows too. Compatible
         // provider fallbacks lack pricing; shouldHidePaid() decides via the
         // FREE_MODEL_IDS_BY_PROVIDER catalog tier.
@@ -1586,6 +1632,9 @@ async function buildUnifiedModelsResponseCore(
           ...(contextLength ? { context_length: contextLength } : {}),
           ...(visionFields || {}),
         });
+
+        // #9147: per-connection fallback walk — yield periodically.
+        await maybeYieldCatalogBuild();
       }
     }
 
@@ -1631,7 +1680,7 @@ async function buildUnifiedModelsResponseCore(
       }
     }
     // ?configuredOnly — hide models that have no eligible DB connection.
-    finalModels = applyCatalogPostFilters(request, finalModels, {
+    finalModels = await applyCatalogPostFilters(request, finalModels, {
       connections,
       prefixMode,
       aliasToProviderId,

src/app/api/v1/models/catalogCache.ts

@@ -12,6 +12,8 @@
  * Auth rejection is NOT handled here and must stay in the caller: it depends on
  * live per-request state (dashboard cookie, API key) and must never be cached.
  */
+import { createHash } from "node:crypto";
+
 import { getModelCatalogCacheVersion } from "@/lib/db/readCache";
 import { extractApiKey } from "@/sse/services/auth";
 
@@ -92,11 +94,18 @@ function buildCatalogCacheKey(
   const url = new URL(request.url);
   const prefix = url.searchParams.get("prefix") || "";
   const apiKey = extractApiKey(request) || "";
+  // #10313: NEVER embed the raw bearer secret into the Map key — it lives in process
+  // heap for the cache TTL and would leak the full credential in a heap dump /
+  // --inspect session / debug log. Hash it instead (the established repo idiom:
+  // `hashKey` in apiKeys.ts — intentionally SHA-256, NOT password hashing; API keys
+  // are high-entropy random tokens needing fast O(1) comparison).
+  // lgtm[js/insufficient-password-hash]
+  const apiKeyFingerprint = apiKey ? createHash("sha256").update(apiKey).digest("hex") : ""; // nosemgrep: insufficient-password-hash
   const isCodex = isCodexModelCatalogClient(request) ? "1" : "0";
   const configuredOnly = url.searchParams.get("configuredOnly") === "true" ? "1" : "0";
   const hideAuto = catalogSettings?.hideAutoCombos ? "1" : "0";
   const hideNoThink = catalogSettings?.hideNoThinkVariants ? "1" : "0";
-  return `${prefix}|${isCodex}|${apiKey}|${configuredOnly}|${hideAuto}|${hideNoThink}`;
+  return `${prefix}|${isCodex}|${apiKeyFingerprint}|${configuredOnly}|${hideAuto}|${hideNoThink}`;
 }
 
 // Tracks the model-catalog cache version (src/lib/db/readCache.ts) as of the last

src/app/api/v1/models/catalogResponse.ts

@@ -32,6 +32,7 @@ import {
   enrichCatalogModelEntry,
   type CatalogEnrichmentSnapshot,
 } from "@/lib/modelMetadataRegistry";
+import { createModelCapabilityResolutionSnapshot } from "@/lib/modelCapabilityResolutionSnapshot";
 import { isModelCatalogNamesEnabled } from "@/shared/utils/featureFlags";
 import { extractApiKey } from "@/sse/services/auth";
 import { maybeOmitCatalogModelName } from "./catalogHelpers";
@@ -45,7 +46,7 @@ import { isCodexModelCatalogClient } from "./catalogRequest";
  * returns early, but it still owes the caller these steps — the discovery mirrors in
  * particular are what let Claude Code see a quota pool's models at all.
  */
-export function applyCatalogPostFilters(
+export async function applyCatalogPostFilters(
   request: Request,
   models: Array<Record<string, any>>,
   ctx: {
@@ -54,7 +55,8 @@ export function applyCatalogPostFilters(
     aliasToProviderId: Record<string, string>;
     hideNoThinkVariants?: boolean;
   }
-): Array<Record<string, any>> {
+): Promise<Array<Record<string, any>>> {
+  const yieldTurn = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
   let finalModels = models;
 
   // variants are only generated for surviving models.
@@ -65,6 +67,11 @@ export function applyCatalogPostFilters(
     });
   }
 
+  // #9147: the variant-append passes each walk the full model list (O(n) per pass),
+  // so a catalog-scale build must not run all of them in one synchronous stretch.
+  // Yield once between the expensive passes to let the event loop breathe.
+  await yieldTurn();
+
   // Advertise Claude reasoning-effort variants (claude/<model>-{low,medium,high[,xhigh]}).
   // Derived from the already key-filtered list so a variant only appears when its real
   // model is permitted. Runs before the no-thinking pass: the gateway already routes these
@@ -139,11 +146,15 @@ export function applyCatalogPostFilters(
     );
   }
 
+  await yieldTurn();
+
   // #7694: advertise `<provider>/<model>-<tier>` variants for synced models that
   // captured `reasoning.supported_efforts` at sync time (capabilities.effort_tiers).
   // Derived from the already key-filtered list; skips codex/kimi (own suffix mechanism).
   finalModels = appendSyncedEffortVariants(finalModels);
 
+  await yieldTurn();
+
   // #4424 follow-up — drop exact-duplicate ids that slip through the per-source push
   // guards (e.g. `codex/gpt-5.5`, `veo-free/seedance` listed twice). Keyed by listing
   // identity (id, type, subtype) so the intentional same-id audio transcription/speech
@@ -207,25 +218,45 @@ export async function finalizeCatalogResponse(
   }
 
   const includeModelNames = isModelCatalogNamesEnabled();
-  const enrichedModels = disambiguateCatalogModelNames(
-    finalModels.map((model) => {
-      if (model.owned_by === "combo") {
-        return maybeOmitCatalogModelName(model, includeModelNames);
-      }
-      const enriched = enrichCatalogModelEntry(model, undefined, enrichmentSnapshot);
-      const fallbackContextLength = getContextFallback(enriched);
-      const listedModel = fallbackContextLength
-        ? { ...enriched, context_length: fallbackContextLength }
-        : enriched;
-      return maybeOmitCatalogModelName(listedModel, includeModelNames);
-    })
-  );
-  // Canonical provider-grouped publication: one contiguous block per provider,
-  // combos pinned first. Stable — preserves combo sort_order, connection priority,
-  // and equal-id audio twins. Grouped by owned_by (canonical identity), not the
-  // routing alias prefix. Applied after enrichment/disambiguation so the final
-  // serialized order is what every consumer sees; cached as part of the body.
+  // #9147: enrichment is the most expensive single stage of the catalog build —
+  // per-entry provider/model resolution plus pricing + token/context override
+  // lookups. Two fixes so a large catalog cannot pin the Node.js thread here:
+  //  (1) bulk-load the synced-capability + override tables ONCE into an in-memory
+  //      snapshot (#9199 machinery) so per-entry enrichment never hits SQLite;
+  //  (2) yield to the event loop every `YIELD_EVERY` entries so even the remaining
+  //      per-entry work is interleaved with other callers / the dashboard WS.
+  const yieldTurn = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
+  await yieldTurn();
+  const capabilityResolutionSnapshot = createModelCapabilityResolutionSnapshot();
+  const enriched: Array<Record<string, unknown>> = [];
+  const catYIELD_EVERY = 5;
+  let catEnrichCount = 0;
+  for (const model of finalModels) {
+    let listedModel: Record<string, unknown>;
+    if (model.owned_by === "combo") {
+      listedModel = maybeOmitCatalogModelName(model, includeModelNames);
+    } else {
+      const entry = enrichCatalogModelEntry(model, undefined, {
+        ...enrichmentSnapshot,
+        capabilityResolutionSnapshot,
+      });
+      const fallbackContextLength = getContextFallback(entry);
+      listedModel = fallbackContextLength
+        ? { ...entry, context_length: fallbackContextLength }
+        : entry;
+      listedModel = maybeOmitCatalogModelName(listedModel, includeModelNames);
+    }
+    enriched.push(listedModel);
+    catEnrichCount++;
+    if (catEnrichCount % catYIELD_EVERY === 0) {
+      await yieldTurn();
+    }
+  }
+  await yieldTurn();
+  const enrichedModels = disambiguateCatalogModelNames(enriched);
+  await yieldTurn();
   const orderedModels = sortCatalogModelsProviderGrouped(enrichedModels);
+  await yieldTurn();
   // Codex CLI compatibility: its model-catalog refresh (codex_models_manager) does
   // GET /v1/models?client_version=<v> and decodes a JSON object with a TOP-LEVEL
   // `models` array, so the OpenAI-standard `{object,data}` shape makes it fail with

src/lib/modelCapabilities.ts

@@ -616,9 +616,12 @@ function getContextOverride(
 /**
  * Resolve a persisted context override by canonical id, then by the exact raw
  * alias supplied by the caller. Neither lookup inherits to related models.
+ *
+ * `snapshot` is the #9147 build-local bulk load; when supplied the on-demand
+ * SQLite read is skipped and the preloaded nested map is used instead.
  */
-export function getResolvedModelContextOverride(input: CapabilityInput): number | null {
-  return getContextOverride(resolveCapabilityInput(input));
+export function getResolvedModelContextOverride(input: CapabilityInput, snapshot?: ModelCapabilityResolutionSnapshot | null): number | null {
+  return getContextOverride(resolveCapabilityInput(input), snapshot);
 }
 
 function getInputTokenCapabilityOverride(resolved: {

src/lib/modelMetadataRegistry.ts

@@ -28,6 +28,7 @@ import {
   CANONICAL_EFFORT_VALUES,
   extendCodexGpt56EffortValues,
 } from "@/shared/reasoning/effortStandardization";
+import type { ModelCapabilityResolutionSnapshot } from "@/lib/modelCapabilityResolutionSnapshot";
 
 const MODEL_METADATA_SCHEMA_VERSION = "model-metadata-v1";
 
@@ -40,6 +41,9 @@ type JsonRecord = Record<string, unknown>;
 export interface CatalogEnrichmentSnapshot {
   modelsDevPricing: PricingByProvider | null;
   providerNodeIdsByPrefix?: Readonly<Record<string, string>>;
+  /** #9147: build-local bulk load of synced capabilities + token/context overrides
+   * so per-entry enrichment never hits SQLite again (see catalogResponse.ts). */
+  capabilityResolutionSnapshot?: ModelCapabilityResolutionSnapshot | null;
 }
 
 interface CatalogDiagnosticsOptions {
@@ -200,20 +204,27 @@ export function getCatalogDiagnosticsHeaders(
 export function getCanonicalModelMetadata(input: {
   provider?: string | null;
   model?: string | null;
+  snapshot?: ModelCapabilityResolutionSnapshot | null;
 }): CanonicalModelMetadata | null {
   const modelId = asNonEmptyString(input.model);
   if (!modelId) return null;
 
-  const resolved = getResolvedModelCapabilities({
-    provider: input.provider || null,
-    model: modelId,
-  });
+  const resolved = getResolvedModelCapabilities(
+    {
+      provider: input.provider || null,
+      model: modelId,
+    },
+    undefined,
+    input.snapshot || null
+  );
   const provider = resolved.provider;
   const providerAlias = provider ? PROVIDER_ID_TO_ALIAS[provider] || provider : null;
   const registryModel = getRegistryModel(providerAlias || provider, resolved.model || modelId);
   const staticSpec = getModelSpec(resolved.model || modelId);
   const syncedCapability =
-    provider && resolved.model ? getSyncedCapability(provider, resolved.model) : null;
+    provider && resolved.model
+      ? getSyncedCapability(provider, resolved.model, input.snapshot?.synced ?? null)
+      : null;
   const canonicalStaticAlias = resolveStaticModelAlias(resolved.model || modelId);
   const modalities = buildModalities(
     resolved.modalitiesInput,
@@ -420,7 +431,11 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
       return id;
     })();
 
-  const metadata = getCanonicalModelMetadata({ provider, model });
+  const metadata = getCanonicalModelMetadata({
+    provider,
+    model,
+    snapshot: snapshot?.capabilityResolutionSnapshot ?? null,
+  });
   if (!metadata) return entry;
   const registryModel = getRegistryModel(
     metadata.providerAlias || metadata.provider,
@@ -436,7 +451,11 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
     getAuthoritativeContextWindow(metadata.model) ??
     getAuthoritativeContextWindow(model);
   const specialtySurface = isNonChatCatalogSurface(entry.type);
-  const persistedContextWindow = getResolvedModelContextOverride({ provider, model });
+  const capabilitySnapshot = snapshot?.capabilityResolutionSnapshot ?? null;
+  const persistedContextWindow = getResolvedModelContextOverride(
+    { provider, model },
+    capabilitySnapshot
+  );
   const capabilityFields = {
     ...(typeof metadata.capabilities.vision === "boolean"
       ? { vision: metadata.capabilities.vision }
@@ -528,10 +547,15 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
   }
 
   const persistedOutputLimit =
-    getModelCapabilityOverride(provider, model, "max_output_tokens") ??
-    getModelCapabilityOverride(provider, model, "max_token") ??
-    getModelCapabilityOverride(publicProvider, model, "max_output_tokens") ??
-    getModelCapabilityOverride(publicProvider, model, "max_token");
+    getModelCapabilityOverride(provider, model, "max_output_tokens", capabilitySnapshot?.maxTokenOverrides) ??
+    getModelCapabilityOverride(provider, model, "max_token", capabilitySnapshot?.maxTokenOverrides) ??
+    getModelCapabilityOverride(
+      publicProvider,
+      model,
+      "max_output_tokens",
+      capabilitySnapshot?.maxTokenOverrides
+    ) ??
+    getModelCapabilityOverride(publicProvider, model, "max_token", capabilitySnapshot?.maxTokenOverrides);
   if (persistedOutputLimit !== null) {
     nextEntry.max_output_tokens = persistedOutputLimit;
   } else if (

tests/unit/10313-catalog-cache-key-hashing.test.ts

@@ -0,0 +1,128 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-catalog-keyleak-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "catalog-keyleak-test-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
+const catalogCacheMod = await import("../../src/app/api/v1/models/catalogCache.ts");
+
+const SECRET = "sk-live-PROBE-10313-SUPER-SECRET-TOKEN";
+
+test.beforeEach(() => {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  v1ModelsCatalog.__resetCatalogBuilderRunsForTest();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+function captureMapKeys(): { keys: string[]; restore: () => void } {
+  const capturedKeys: string[] = [];
+  const originalSet = Map.prototype.set;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  (Map.prototype as any).set = function (key: unknown, value: unknown) {
+    if (typeof key === "string") capturedKeys.push(key);
+    return originalSet.call(this, key, value);
+  };
+  return {
+    keys: capturedKeys,
+    release: () => {
+      Map.prototype.set = originalSet;
+    },
+  };
+}
+
+// buildCatalogCacheKey emits `prefix|isCodex|apiKeyFingerprint|configuredOnly|hideAuto|hideNoThink`
+// (6 pipe-delimited fields). Other in-flight keys (e.g. `x-request-id`) don't match.
+function isCatalogCacheKey(k: string): boolean {
+  return k.split("|").length === 6;
+}
+
+test("catalog cache Map keys must not contain the raw bearer API key (#10313)", async () => {
+  const probe = captureMapKeys();
+
+  try {
+    const request = new Request("http://localhost/v1/models", {
+      headers: { Authorization: `Bearer ${SECRET}` },
+    });
+    const res = await v1ModelsCatalog.getUnifiedModelsResponse(request);
+    assert.ok(res.status === 200 || res.status === 401 || res.status === 403);
+  } finally {
+    probe.release();
+  }
+
+  const catalogKeys = probe.keys.filter(isCatalogCacheKey);
+  assert.ok(
+    catalogKeys.length > 0,
+    "no catalog cache Map.set() calls observed — the probe did not exercise catalogCache/catalogInFlight"
+  );
+
+  const leaked = catalogKeys.filter((k) => k.includes(SECRET));
+  assert.deepEqual(
+    leaked,
+    [],
+    `catalog cache Map key retained the raw API key verbatim: ${JSON.stringify(leaked)} — ` +
+      `buildCatalogCacheKey() must hash the secret (e.g. sha256) before using it as a Map key`
+  );
+
+  assert.ok(catalogCacheMod.CATALOG_CACHE_TTL_MS_DEFAULT > 0);
+});
+
+test("cache keys embed the sha256 digest of the secret, never the raw secret (#10313)", async () => {
+  // Capture ALL Map keys emitted across BOTH requests (a 2nd identical-secret request
+  // may be a cache hit and emit no new catalog key — irrelevant here: we assert on the
+  // digest that did appear).
+  const probe = captureMapKeys();
+  try {
+    const resA = await v1ModelsCatalog.getUnifiedModelsResponse(
+      new Request("http://localhost/v1/models", {
+        headers: { Authorization: "Bearer sk-10313-DIGEST-A" },
+      })
+    );
+    const resB = await v1ModelsCatalog.getUnifiedModelsResponse(
+      new Request("http://localhost/v1/models", {
+        headers: { Authorization: "Bearer sk-10313-DIGEST-B" },
+      })
+    );
+    assert.ok(resA.status === 200 || resA.status === 401 || resA.status === 403);
+    assert.ok(resB.status === 200 || resB.status === 401 || resB.status === 403);
+  } finally {
+    probe.release();
+  }
+
+  const catalogKeys = probe.keys.filter(isCatalogCacheKey);
+  assert.ok(catalogKeys.length > 0, "expected catalog cache Map.set() calls");
+
+  const { createHash } = await import("node:crypto");
+  const digestA = createHash("sha256").update("sk-10313-DIGEST-A").digest("hex");
+  const digestB = createHash("sha256").update("sk-10313-DIGEST-B").digest("hex");
+  const rawA = "sk-10313-DIGEST-A";
+  const rawB = "sk-10313-DIGEST-B";
+
+  // The hashed fingerprint, not the raw secret, rides in the cache keys.
+  const keysWithDigestA = catalogKeys.filter((k) => k.includes(digestA));
+  const keysWithDigestB = catalogKeys.filter((k) => k.includes(digestB));
+  assert.ok(keysWithDigestA.length > 0, `expected a cache key embedding sha256 of A: ${catalogKeys.join(",")}`);
+  assert.ok(keysWithDigestB.length > 0, `expected a cache key embedding sha256 of B: ${catalogKeys.join(",")}`);
+
+  // Raw secrets must never appear (issue #10313 root cause).
+  assert.ok(!catalogKeys.some((k) => k.includes(rawA) || k.includes(rawB)));
+
+  // Identical secrets ⇒ identical key (memoized reuse); different ⇒ distinct.
+  assert.ok(keysWithDigestA.every((k) => k === keysWithDigestA[0]), "all A keys must be identical");
+  assert.ok(keysWithDigestB.every((k) => k === keysWithDigestB[0]), "all B keys must be identical");
+  assert.notEqual(keysWithDigestA[0], keysWithDigestB[0]);
+});

tests/unit/9147-catalog-eventloop-yield.test.ts

@@ -0,0 +1,88 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-9147-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "catalog-9147-test-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
+
+const CONNECTION_COUNT = 60;
+const MODELS_PER_CONNECTION = 12; // ~720 synced models total
+
+async function resetStorage() {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  v1ModelsCatalog.__resetCatalogBuilderRunsForTest();
+}
+
+async function seedCatalogScaleDataset() {
+  const db = core.getDbInstance();
+  const now = new Date().toISOString();
+  const insertConn = db.prepare(
+    `INSERT INTO provider_connections (id, provider, auth_type, name, priority, is_active, api_key, created_at, updated_at)
+     VALUES (?, 'openai-compatible', 'apikey', ?, ?, 1, ?, ?, ?)`
+  );
+  const insertModels = db.prepare(
+    `INSERT INTO key_value (namespace, key, value) VALUES ('syncedAvailableModels', ?, ?)`
+  );
+  const seedTx = db.transaction(() => {
+    for (let i = 0; i < CONNECTION_COUNT; i++) {
+      const id = `probe-conn-${i}`;
+      insertConn.run(id, `probe-connection-${i}`, i, `sk-probe-${i}`, now, now);
+      const models = Array.from({ length: MODELS_PER_CONNECTION }, (_, m) => ({
+        id: `probe-model-${i}-${m}`,
+        name: `Probe Model ${i}-${m}`,
+        contextLength: 128000,
+      }));
+      insertModels.run(`openai-compatible:${id}`, JSON.stringify(models));
+    }
+  });
+  seedTx();
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#9147 — catalog build at catalog-scale must not pin the event loop for a long stretch", async () => {
+  await seedCatalogScaleDataset();
+  const req = new Request("http://localhost/v1/models");
+  let settled = false;
+  const buildPromise = v1ModelsCatalog.getUnifiedModelsResponse(req).then((res) => {
+    settled = true;
+    return res;
+  });
+  let lastTick = performance.now();
+  let maxGapMs = 0;
+  let ticks = 0;
+  while (!settled) {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    const now = performance.now();
+    maxGapMs = Math.max(maxGapMs, now - lastTick);
+    lastTick = now;
+    ticks++;
+    if (ticks > 20000) break;
+  }
+  const res = await buildPromise;
+  assert.equal(res.status, 200);
+  assert.ok(
+    maxGapMs < 150,
+    `event loop was blocked for ${maxGapMs.toFixed(1)}ms in a single stretch while building the ` +
+      `catalog for ${CONNECTION_COUNT} connections / ${CONNECTION_COUNT * MODELS_PER_CONNECTION} models ` +
+      `(${ticks} interleaved ticks observed) — the builder is not yielding to the event loop`
+  );
+});

tests/unit/combo-error-aggregation.test.ts

@@ -1,54 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import {
-  classifyComboOutcome,
-  formatComboOutcomes,
-  redactConnectionLabel,
-  buildRedactedSummary,
-} from "../../open-sse/services/combo/comboErrorAggregation.ts";
-
-// #10314 — combo error aggregation mixes quality and auth.
-// Regression guard for the pure aggregation helpers: a quality-failure reason from one
-// target and a sibling's 401 must be presented as SEPARATE classified outcomes (never
-// mashed into a single lastError), and account/connection identifiers must be redacted
-// from client-visible and shared-warn strings.
-
-test("#10314: classifyComboOutcome keeps auth distinct from quality/model", () => {
-  assert.equal(classifyComboOutcome(401, "invalid_api_key"), "auth");
-  assert.equal(classifyComboOutcome(403, "not authorized"), "auth");
-  // 5xx sleep to the "timeout" class (>=499 is checked before >=500).
-  assert.equal(classifyComboOutcome(503, "upstream unavailable"), "timeout");
-  assert.equal(classifyComboOutcome(408, "timeout"), "timeout");
-  assert.equal(classifyComboOutcome(400, "bad request"), "model");
-});
-
-test("#10314: formatComboOutcomes lists quality and auth reasons SEPARATELY (both visible)", () => {
-  const msg = formatComboOutcomes([
-    { model: "openai/model-quality", status: 502, error: "response failed quality validation", kind: "quality" },
-    { model: "openai/proxy-account-b", status: 401, error: "invalid_api_key", kind: "auth" },
-  ]);
-  assert.match(msg, /quality validation/);
-  assert.match(msg, /invalid_api_key/);
-  assert.match(msg, /auth/);
-  assert.ok(msg.indexOf("quality validation") < msg.indexOf("invalid_api_key"));
-});
-
-test("#10314: redactConnectionLabel masks connection/account identifiers", () => {
-  assert.equal(
-    redactConnectionLabel("openai/proxy-account-b"),
-    "openai/proxy-account-b"
-  );
-  const withUuid = redactConnectionLabel("openai/8a4f0c6e-3b27-4c51-9d88-1f2a3b4c5d6e");
-  assert.equal(withUuid, "openai/conn:8a4f0c6e");
-  const withHex = redactConnectionLabel("openai/0f1e2d3c4b5a69788796170a1b2c3d4e5f607182");
-  assert.equal(withHex, "openai/conn:0f1e2d3c");
-});
-
-test("#10314: buildRedactedSummary is redacted and truncates past 5 entries", () => {
-  const s = buildRedactedSummary(
-    Array.from({ length: 6 }, (_, i) => ({ model: `openai/8a4f0c6e-3b27-4c51-9d88-1f2a3b4c5d6e-${i}`, status: 401 + i }))
-  );
-  assert.ok(!s.includes("8a4f0c6e-3b27"), "summary must not leak a full UUID");
-  assert.match(s, /conn:8a4f0c6e/);
-  assert.match(s, /\(\+1\)/);
-});

tests/unit/models-catalog-functional-gateway.test.ts

@@ -24,11 +24,11 @@ function makeRequest(query = ""): Request {
   return new Request(`http://localhost/v1/models${query}`);
 }
 
-test("catalog post-filters do not add mirrors when gate off (default)", () => {
+test("catalog post-filters do not add mirrors when gate off (default)", async () => {
   const models = [
     { id: "deepseek/deepseek-v4-flash", owned_by: "deepseek", root: "deepseek-v4-flash" },
   ];
-  const out = applyCatalogPostFilters(makeRequest(), models, {
+  const out = await applyCatalogPostFilters(makeRequest(), models, {
     connections: [],
     prefixMode: "dual",
     aliasToProviderId: {},
@@ -41,7 +41,7 @@ test("final catalog permission filtering does not let a mirror inherit base acce
   setFunctionalGatewayProviderSetting("agentrouter", "on");
 
   const models = [{ id: "kmc/k3", owned_by: "kimi-coding", root: "k3" }];
-  const withMirror = applyCatalogPostFilters(makeRequest(), models, {
+  const withMirror = await applyCatalogPostFilters(makeRequest(), models, {
     connections: [
       {
         id: "conn-1",
@@ -77,14 +77,14 @@ test("final catalog permission filtering does not let a mirror inherit base acce
   );
 });
 
-test("catalog post-filters synthesize a gateway mirror when gate on and gateway has a connection", () => {
+test("catalog post-filters synthesize a gateway mirror when gate on and gateway has a connection", async () => {
   setFeatureFlagOverride(FLAG_KEY, "true");
   setFunctionalGatewayProviderSetting("agentrouter", "on");
 
   const models = [
     { id: "deepseek/deepseek-v4-flash", owned_by: "deepseek", root: "deepseek-v4-flash" },
   ];
-  const out = applyCatalogPostFilters(makeRequest(), models, {
+  const out = await applyCatalogPostFilters(makeRequest(), models, {
     connections: [
       {
         id: "conn-1",