fix(providers): stop devin-cli spawn error from double-closing SSE controller (#12517)

child.on("error") was manually calling controller.close() without
setting the finished flag, so the subsequent child.on("close") event
for the same failed spawn saw finished=false and called finish() ->
emit() -> controller.enqueue() on an already-closed controller,
throwing an uncaughtException. Route the error handler through the
existing finish(msg) helper, which already guards on finished, so the
error still reaches the client as a sanitized SSE error event exactly
once.

changelog.d/fixes/12341-budget-alias-auto.md

@@ -1 +0,0 @@
-- fix(usage): fail closed on API-key budget enforcement when a provider's `auto` routing alias has no pricing row, instead of silently counting it as $0 (#12341)

changelog.d/fixes/12517-devin-cli-sse-double-close.md

@@ -0,0 +1 @@
+- fix(providers): stop devin-cli spawn error from double-closing the SSE controller (#12517)

open-sse/executors/devin-cli.ts

@@ -170,11 +170,7 @@ export class DevinCliExecutor extends BaseExecutor {
             err.message.includes("ENOENT") || err.message.includes("not found")
               ? `Devin CLI not found: ${devinBin}. Install via https://cli.devin.ai or set CLI_DEVIN_BIN env var.`
               : `Devin CLI spawn error: ${err.message}`;
-          emit(
-            `data: ${JSON.stringify({ error: { message: msg, type: "devin_cli_error", code: "spawn_failed" } })}\n\n`
-          );
-          emit("data: [DONE]\n\n");
-          controller.close();
+          finish(msg);
         });
 
         if (signal) {

src/lib/usage/apiKeyUsageLimits.ts

@@ -1,7 +1,7 @@
 import { getDbInstance } from "@/lib/db/core";
 import type { ProviderLimitsCacheEntry } from "@/lib/db/providerLimits";
 import { getProviderQuotaWindowStartIso } from "@/lib/db/quotaResetEvents";
-import { calculateCostDetailed } from "./costCalculator";
+import { calculateCost } from "./costCalculator";
 import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
 
 const FORTALEZA_UTC_OFFSET_MS = 3 * 60 * 60 * 1000;
@@ -29,15 +29,6 @@ export interface ApiKeyUsageLimitStatus {
   weeklyResetAtIso: string | null;
   dailyExceeded: boolean;
   weeklyExceeded: boolean;
-  /**
-   * True when at least one usage_history row in the daily/weekly window could not
-   * be priced at all (no pricing row for the provider+model — e.g. a routing
-   * alias such as `auto`, #12341). Enforcement fails closed on this: an unpriced
-   * row forces `*Exceeded = true` rather than silently contributing $0 to spend,
-   * since a real cost may be hiding behind the alias.
-   */
-  dailyHasUnpricedUsage?: boolean;
-  weeklyHasUnpricedUsage?: boolean;
 }
 
 export interface ApiKeyUsageLimitDeps {
@@ -382,14 +373,8 @@ async function getProviderWeeklyWindow(
   };
 }
 
-interface ApiKeyUsdSpend {
-  totalUsd: number;
-  /** True when at least one (provider, model) group had no pricing row at all (#12341). */
-  hasUnpricedUsage: boolean;
-}
-
-async function getApiKeyUsdSpendSince(apiKeyId: string, sinceIso: string): Promise<ApiKeyUsdSpend> {
-  if (!apiKeyId) return { totalUsd: 0, hasUnpricedUsage: false };
+async function getApiKeyUsdSpendSince(apiKeyId: string, sinceIso: string): Promise<number> {
+  if (!apiKeyId) return 0;
   const db = getDbInstance();
   const rows = db
     .prepare(
@@ -413,13 +398,12 @@ async function getApiKeyUsdSpendSince(apiKeyId: string, sinceIso: string): Promi
     .all({ apiKeyId, sinceIso }) as UsageCostRow[];
 
   let total = 0;
-  let hasUnpricedUsage = false;
   for (const row of rows) {
     const provider = typeof row.provider === "string" ? row.provider : "";
     const model = typeof row.model === "string" ? row.model : "";
     if (!provider || !model) continue;
 
-    const { costUsd, priced } = await calculateCostDetailed(
+    total += await calculateCost(
       provider,
       model,
       {
@@ -435,17 +419,9 @@ async function getApiKeyUsdSpendSince(apiKeyId: string, sinceIso: string): Promi
         serviceTier: row.serviceTier || "standard",
       }
     );
-    if (!priced) {
-      hasUnpricedUsage = true;
-      console.warn(
-        `[apiKeyUsageLimits] no pricing found for ${provider}/${model} — usage counted as $0 ` +
-          "and enforcement is failing closed for this window (#12341)"
-      );
-    }
-    total += costUsd;
   }
 
-  return { totalUsd: roundUsd(total), hasUnpricedUsage };
+  return roundUsd(total);
 }
 
 export async function getApiKeyUsageLimitStatus(
@@ -467,27 +443,10 @@ export async function getApiKeyUsageLimitStatus(
   const weeklyLimitUsd = normalizeLimitUsd(metadata.weeklyUsageLimitUsd);
   const enabled = metadata.usageLimitEnabled === true;
 
-  const [dailySpend, weeklySpend] = await Promise.all([
+  const [dailySpentUsd, weeklySpentUsd] = await Promise.all([
     getApiKeyUsdSpendSince(metadata.id, dailyWindowStartIso),
     getApiKeyUsdSpendSince(metadata.id, weeklyWindowStartIso),
   ]);
-  const dailySpentUsd = dailySpend.totalUsd;
-  const weeklySpentUsd = weeklySpend.totalUsd;
-
-  // Fail closed (#12341): a window with a configured limit that also contains
-  // usage which could not be priced at all (e.g. a provider's `auto` routing
-  // alias with no catalog price) must not let that usage silently pass the cap
-  // as an invisible $0 — treat the limit as exceeded rather than trust an
-  // undercounted spend total. A window with no configured limit was never
-  // enforced, so unpriced usage there is only logged, not blocking.
-  const dailyExceeded =
-    enabled &&
-    dailyLimitUsd !== null &&
-    (dailySpentUsd >= dailyLimitUsd || dailySpend.hasUnpricedUsage);
-  const weeklyExceeded =
-    enabled &&
-    weeklyLimitUsd !== null &&
-    (weeklySpentUsd >= weeklyLimitUsd || weeklySpend.hasUnpricedUsage);
 
   return {
     enabled,
@@ -499,10 +458,8 @@ export async function getApiKeyUsageLimitStatus(
     dailyResetAtIso,
     weeklyWindowStartIso,
     weeklyResetAtIso,
-    dailyExceeded,
-    weeklyExceeded,
-    dailyHasUnpricedUsage: dailySpend.hasUnpricedUsage,
-    weeklyHasUnpricedUsage: weeklySpend.hasUnpricedUsage,
+    dailyExceeded: enabled && dailyLimitUsd !== null && dailySpentUsd >= dailyLimitUsd,
+    weeklyExceeded: enabled && weeklyLimitUsd !== null && weeklySpentUsd >= weeklyLimitUsd,
   };
 }
 

src/lib/usage/costCalculator.ts

@@ -173,31 +173,18 @@ export function computeCostFromPricing(
   return cost * getCodexFastCostMultiplier(options.provider, options.model, options.serviceTier);
 }
 
-/**
- * Result of a cost calculation that also reports whether the number is backed by
- * a real pricing row. Budget-enforcement callers (#12341) must be able to tell
- * "$0, priced" (a genuinely free/flat-rate model) apart from "$0, unpriced" (no
- * pricing row was ever found — e.g. a routing alias like `auto`) so they can fail
- * closed on the latter instead of letting it silently pass a hard budget cap.
- */
-export interface CostCalculationResult {
-  costUsd: number;
-  /** false when no pricing row (direct, normalized, or codex-effortless) was found. */
-  priced: boolean;
-}
-
-export async function calculateCostDetailed(
+export async function calculateCost(
   provider: string,
   model: string,
   tokens: Record<string, number | undefined> | null | undefined,
   options: CostCalculationOptions = {}
-): Promise<CostCalculationResult> {
-  if (!tokens || !provider || !model) return { costUsd: 0, priced: true };
+): Promise<number> {
+  if (!tokens || !provider || !model) return 0;
 
   // Short-circuit before any pricing DB lookup when an exact, provider-reported
   // cost is present (currently xAI's `cost_in_usd_ticks` — see extractExactCostUsd).
   const exactCostUsd = extractExactCostUsd(tokens);
-  if (exactCostUsd !== null) return { costUsd: exactCostUsd, priced: true };
+  if (exactCostUsd !== null) return exactCostUsd;
 
   try {
     const { getPricingForModel } = await import("@/lib/db/settings");
@@ -217,37 +204,23 @@ export async function calculateCostDetailed(
         }
       }
     }
-    // No pricing row anywhere — this is the #12341 case (e.g. a provider's own
-    // routing alias such as "auto" that has no catalog price). Report it as
-    // unpriced rather than a bare $0 so budget enforcement can fail closed.
-    if (!pricing) return { costUsd: 0, priced: false };
+    if (!pricing) return 0;
 
     const pricingRecord =
       pricing && typeof pricing === "object" && !Array.isArray(pricing)
         ? (pricing as Record<string, unknown>)
         : {};
-    const costUsd = computeCostFromPricing(pricingRecord, tokens, {
+    return computeCostFromPricing(pricingRecord, tokens, {
       provider,
       model,
       ...options,
     });
-    return { costUsd, priced: true };
   } catch (error) {
     console.error("Error calculating cost:", error);
-    return { costUsd: 0, priced: false };
+    return 0;
   }
 }
 
-export async function calculateCost(
-  provider: string,
-  model: string,
-  tokens: Record<string, number | undefined> | null | undefined,
-  options: CostCalculationOptions = {}
-): Promise<number> {
-  const result = await calculateCostDetailed(provider, model, tokens, options);
-  return result.costUsd;
-}
-
 type ModalPricing = Record<string, unknown>;
 
 /** Per-image cost: flat per-image × n. 0 when pricing/usage absent. */

tests/unit/api-key-budget-alias-auto-12341.test.ts

@@ -1,113 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-api-key-budget-alias-"));
-process.env.DATA_DIR = TEST_DATA_DIR;
-process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "budget-alias-test-secret";
-
-const core = await import("../../src/lib/db/core.ts");
-const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
-const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
-const usageLimits = await import("../../src/lib/usage/apiKeyUsageLimits.ts");
-
-const NOW = Date.parse("2026-06-19T20:00:00.000Z");
-
-async function resetStorage() {
-  core.resetDbInstance();
-  apiKeysDb.resetApiKeyState();
-  usageHistory.clearPendingRequests();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
-  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
-}
-
-test.beforeEach(async () => {
-  await resetStorage();
-});
-
-test.after(() => {
-  core.resetDbInstance();
-  apiKeysDb.resetApiKeyState();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
-});
-
-async function makeMeteredKey() {
-  const created = await apiKeysDb.createApiKey("Budget Alias Key", "machine-budget-01");
-  await apiKeysDb.updateApiKeyPermissions(created.id, {
-    usageLimitEnabled: true,
-    dailyUsageLimitUsd: 10,
-    weeklyUsageLimitUsd: 50,
-  });
-  apiKeysDb.clearApiKeyCaches();
-  const metadata = await apiKeysDb.getApiKeyMetadata(created.key);
-  assert.ok(metadata);
-  return { created, metadata: metadata! };
-}
-
-test("BUG #12341: a real, billable completion routed through cursor/auto (unpriced) must not silently pass the daily budget cap as $0", async () => {
-  const { created, metadata } = await makeMeteredKey();
-
-  // Cursor's own default routing alias ("Auto (current, default)") has no
-  // pricing row anywhere — this is real, mainstream billable traffic, not an
-  // edge case.
-  await usageHistory.saveRequestUsage({
-    provider: "cursor",
-    model: "auto",
-    apiKeyId: created.id,
-    apiKeyName: "Budget Alias Key",
-    tokens: { input: 1_000_000, output: 1_000_000 },
-    success: true,
-    timestamp: "2026-06-19T12:00:00.000Z",
-  });
-
-  const status = await usageLimits.getApiKeyUsageLimitStatus(
-    { ...metadata, allowedConnections: null },
-    { now: () => NOW }
-  );
-
-  // Fail closed (#12341): unpriced usage in a window with a configured limit
-  // must flip the window to exceeded, even though the naive USD total is $0.
-  assert.equal(status.dailySpentUsd, 0, "cost stays $0 — no pricing row exists for cursor/auto");
-  assert.equal(
-    status.dailyHasUnpricedUsage,
-    true,
-    "status must flag that unpriced usage was seen in the daily window"
-  );
-  assert.equal(
-    status.dailyExceeded,
-    true,
-    "enforcement must fail closed instead of silently allowing unlimited unpriced usage"
-  );
-});
-
-test("control: a priced model routed at the same tokens does NOT trip fail-closed enforcement", async () => {
-  const { updatePricing } = await import("@/lib/db/settings");
-  await updatePricing({
-    openai: {
-      "gpt-4o": { input: 1, cached: 1, output: 1, reasoning: 1, cache_creation: 1 },
-    },
-  });
-
-  const { created, metadata } = await makeMeteredKey();
-
-  await usageHistory.saveRequestUsage({
-    provider: "openai",
-    model: "gpt-4o",
-    apiKeyId: created.id,
-    apiKeyName: "Budget Alias Key",
-    tokens: { input: 1_000_000, output: 0 },
-    success: true,
-    timestamp: "2026-06-19T12:00:00.000Z",
-  });
-
-  const status = await usageLimits.getApiKeyUsageLimitStatus(
-    { ...metadata, allowedConnections: null },
-    { now: () => NOW }
-  );
-
-  assert.equal(status.dailySpentUsd, 1);
-  assert.equal(status.dailyHasUnpricedUsage, false);
-  assert.equal(status.dailyExceeded, false);
-});

tests/unit/costcalculator-auto-alias-12341.test.ts

@@ -1,42 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import {
-  calculateCost,
-  calculateCostDetailed,
-  normalizeModelName,
-} from "../../src/lib/usage/costCalculator.ts";
-import { getDefaultPricing } from "../../src/shared/constants/pricing.ts";
-
-const BILLABLE_TOKENS = { input: 1_000_000, output: 1_000_000 };
-const PROVIDERS_WITH_UNPRICED_AUTO_MODEL = ["cursor", "factory", "trae", "dify", "llm-kiwi"];
-
-test('normalizeModelName is a no-op for a bare alias like "auto"', () => {
-  assert.equal(normalizeModelName("auto"), "auto");
-});
-
-test('no pricing source carries an entry for the literal "auto" model id, for providers whose registry offers it as a real model', () => {
-  const pricing = getDefaultPricing() as Record<string, Record<string, unknown>>;
-  for (const provider of PROVIDERS_WITH_UNPRICED_AUTO_MODEL) {
-    const providerPricing = pricing[provider];
-    assert.ok(!providerPricing || !providerPricing["auto"], `expected no DEFAULT_PRICING entry for ${provider}/auto`);
-  }
-});
-
-test('calculateCost() still returns $0 for a real, billable completion routed through the unpriced "auto" alias (unchanged legacy contract)', async () => {
-  const cost = await calculateCost("cursor", "auto", BILLABLE_TOKENS);
-  assert.equal(cost, 0, "calculateCost's numeric contract is unchanged — $0 for unpriced usage");
-});
-
-test('#12341 fix: calculateCostDetailed() flags the "auto" alias as unpriced instead of a bare, indistinguishable $0', async () => {
-  for (const provider of PROVIDERS_WITH_UNPRICED_AUTO_MODEL) {
-    const result = await calculateCostDetailed(provider, "auto", BILLABLE_TOKENS);
-    assert.equal(result.costUsd, 0, `expected $0 for ${provider}/auto`);
-    assert.equal(result.priced, false, `expected ${provider}/auto to be reported as unpriced`);
-  }
-});
-
-test("control: calculateCostDetailed() DOES price a normal, non-alias model correctly and reports it as priced", async () => {
-  const result = await calculateCostDetailed("openai", "gpt-4o", BILLABLE_TOKENS);
-  assert.ok(result.costUsd > 0, `expected a known model to price above $0, got ${result.costUsd}`);
-  assert.equal(result.priced, true);
-});

tests/unit/executor-devin-cli-12517-double-close.test.ts

@@ -0,0 +1,55 @@
+import { describe, it, after } from "node:test";
+import assert from "node:assert/strict";
+
+const mod = await import("../../open-sse/executors/devin-cli.ts");
+
+describe("DevinCliExecutor — #12517 spawn error must not double-close SSE controller", () => {
+  it("surfaces a sanitized SSE error and never fires uncaughtException on ENOENT spawn", async () => {
+    const previousBin = process.env.CLI_DEVIN_BIN;
+    process.env.CLI_DEVIN_BIN = "/nonexistent/absolute/path/to/devin-bin-12517";
+
+    let caught: unknown = null;
+    const onUncaught = (err: unknown) => {
+      caught = err;
+    };
+    process.on("uncaughtException", onUncaught);
+
+    try {
+      const executor = new mod.DevinCliExecutor();
+      const { response } = await executor.execute({
+        model: "devin-cli",
+        body: { messages: [{ role: "user", content: "hi" }] },
+        stream: true,
+        credentials: {},
+        signal: undefined,
+        log: undefined,
+      } as never);
+
+      const reader = response.body!.getReader();
+      const decoder = new TextDecoder();
+      let payload = "";
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        payload += decoder.decode(value);
+      }
+
+      assert.match(payload, /Devin CLI not found/);
+      assert.match(payload, /data: \[DONE\]/);
+
+      // Give the child's async "close" event (which fires after "error" for a
+      // failed spawn) room to run before asserting no uncaughtException fired.
+      await new Promise((resolve) => setTimeout(resolve, 300));
+
+      assert.equal(caught, null, `expected no uncaughtException, got: ${String(caught)}`);
+    } finally {
+      process.removeListener("uncaughtException", onUncaught);
+      if (previousBin === undefined) delete process.env.CLI_DEVIN_BIN;
+      else process.env.CLI_DEVIN_BIN = previousBin;
+    }
+  });
+
+  after(() => {
+    delete process.env.CLI_DEVIN_BIN;
+  });
+});