refactor(ai-gateway): tighten LLM proxy phase types and guard early auth rejections

Author: chrarnoldus

packages/web-shared/src/lib/ai-gateway/handlers/llm-proxy-model-resolution.ts

@@ -68,7 +68,7 @@ import type {
   ValidatedGatewayRequest,
 } from '@kilocode/web-shared/lib/ai-gateway/handlers/llm-proxy-request';
 
-export type AutoRoutingFailure =
+type AutoRoutingFailure =
   | { kind: 'invalid_token' }
   | { kind: 'auth_required' }
   | { kind: 'decision_secret_missing' }
@@ -78,7 +78,7 @@ export type AutoRoutingFailure =
   | { kind: 'custom_router'; code: CustomRouterErrorCode; message: string }
   | { kind: 'unavailable' };
 
-export type ModelResolution =
+type ModelResolution =
   | { kind: 'direct' }
   | {
       kind: 'routed';
@@ -408,7 +408,7 @@ export function billLegacyClassifierCost(params: {
   headers: LlmProxyRequestHeaders;
 }): void {
   const { resolution, user, usage, headers } = params;
-  if (resolution.kind === 'direct' || resolution.classifierCostUsd <= 0) return;
+  if (resolution.kind === 'direct' || !(resolution.classifierCostUsd > 0)) return;
   const costMicrodollars = toMicrodollars(resolution.classifierCostUsd);
   const priorMicrodollarUsage = user.microdollars_used;
   after(

packages/web-shared/src/lib/ai-gateway/handlers/llm-proxy-respond.ts

@@ -3,6 +3,7 @@ import type { Span } from '@sentry/nextjs';
 import type { User } from '@kilocode/db';
 import { applyUpstreamErrorPolicy } from '@kilocode/web-shared/lib/ai-gateway/upstream-error-policy';
 import { recordBriefingUsage } from '@kilocode/web-shared/lib/agent-briefing-usage';
+import type { sendUpstreamAttempt } from '@kilocode/web-shared/lib/ai-gateway/providers/upstream-attempt';
 import type { GetProviderProviderResult } from '@kilocode/web-shared/lib/ai-gateway/providers/get-provider';
 import {
   accountForMicrodollarUsage,
@@ -21,7 +22,7 @@ import { errorExceptInTest, logExceptInTest } from '@kilocode/web-shared/lib/uti
 import type { GatewayRequest } from '@kilocode/web-shared/lib/ai-gateway/providers/openrouter/types';
 
 type RespondInput = {
-  upstream: { response: Response; toolsAvailable: string[]; toolsUsed: string[] };
+  upstream: Extract<Awaited<ReturnType<typeof sendUpstreamAttempt>>, { type: 'success' }>;
   /** The request as sent upstream; provider transforms may have removed its model. */
   request: GatewayRequest;
   /** The resolved model id, lowercased. */

packages/web-shared/src/lib/ai-gateway/handlers/llm-proxy.ts

@@ -184,6 +184,9 @@ export async function handleLlmProxyRequest(
     adminOnly: false,
     expectedAudience: KILO_GATEWAY_AUDIENCE,
   });
+  // Invalid requests return before anything awaits auth. Keep those paths from
+  // surfacing auth failures as unhandled rejections.
+  void authPromise.catch(() => {});
   debugSaveProxyRequest(requestBodyText);
   const parsed = parseLlmProxyRequest(path, requestBodyText, rawIpAddress);
   if (!parsed.ok) return parsed.response;