Merge pull request #3617 from fosrl/dev

Dev

messages/en-US.json

@@ -1785,7 +1785,6 @@
     "aiClientConfigDescriptionClaude": "Anthropic's agentic coding tool for the terminal.",
     "aiClientConfigDescriptionCodex": "OpenAI's agentic coding tool for the terminal.",
     "aiClientConfigDescriptionOpencode": "Open source terminal coding agent.",
-    "aiClientConfigDescriptionCursor": "AI code editor built on VS Code.",
     "aiClientConfigSetup": "Setup",
     "aiClientConfigTabCli": "Automatic (CLI)",
     "aiClientConfigTabManual": "Manual Configuration",
@@ -3548,6 +3547,9 @@
     "sidebarLogsAction": "Admin Action Logs",
     "logRetention": "Log Retention",
     "logRetentionDescription": "Manage how long different types of logs are retained for this organization or disable them",
+    "logRetentionDisabledWarningTitle": "Log Retention Disabled",
+    "logRetentionDisabledWarningDescription": "{logType} are not being retained for this organization, so new activity will not appear here. Enable retention in security settings to start collecting these logs.",
+    "logRetentionDisabledWarningButton": "Go to Security Settings",
     "requestLogsDescription": "View detailed request logs for HTTPS resources in this organization",
     "aiSessionLogs": "AI Gateway Session Logs",
     "aiSessionLogsDescription": "View prompt and response transcripts for AI gateway requests in this organization",

public/third-party/cursor-dark.svg

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 466.73 532.09">
-  <!-- Generator: Adobe Illustrator 29.6.1, SVG Export Plug-In . SVG Version: 2.1.1 Build 9)  -->
-  <defs>
-    <style>
-      .st0 {
-        fill: #26251e;
-      }
-    </style>
-  </defs>
-  <path class="st0" d="M457.43,125.94L244.42,2.96c-6.84-3.95-15.28-3.95-22.12,0L9.3,125.94c-5.75,3.32-9.3,9.46-9.3,16.11v247.99c0,6.65,3.55,12.79,9.3,16.11l213.01,122.98c6.84,3.95,15.28,3.95,22.12,0l213.01-122.98c5.75-3.32,9.3-9.46,9.3-16.11v-247.99c0-6.65-3.55-12.79-9.3-16.11h-.01ZM444.05,151.99l-205.63,356.16c-1.39,2.4-5.06,1.42-5.06-1.36v-233.21c0-4.66-2.49-8.97-6.53-11.31L24.87,145.67c-2.4-1.39-1.42-5.06,1.36-5.06h411.26c5.84,0,9.49,6.33,6.57,11.39h-.01Z"/>
-</svg>

public/third-party/cursor-light.svg

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 466.73 532.09">
-  <!-- Generator: Adobe Illustrator 29.6.1, SVG Export Plug-In . SVG Version: 2.1.1 Build 9)  -->
-  <defs>
-    <style>
-      .st0 {
-        fill: #edecec;
-      }
-    </style>
-  </defs>
-  <path class="st0" d="M457.43,125.94L244.42,2.96c-6.84-3.95-15.28-3.95-22.12,0L9.3,125.94c-5.75,3.32-9.3,9.46-9.3,16.11v247.99c0,6.65,3.55,12.79,9.3,16.11l213.01,122.98c6.84,3.95,15.28,3.95,22.12,0l213.01-122.98c5.75-3.32,9.3-9.46,9.3-16.11v-247.99c0-6.65-3.55-12.79-9.3-16.11h-.01ZM444.05,151.99l-205.63,356.16c-1.39,2.4-5.06,1.42-5.06-1.36v-233.21c0-4.66-2.49-8.97-6.53-11.31L24.87,145.67c-2.4-1.39-1.42-5.06,1.36-5.06h411.26c5.84,0,9.49,6.33,6.57,11.39h-.01Z"/>
-</svg>

server/aiGatewayServer.ts

@@ -21,7 +21,9 @@ export function createAiGatewayServer() {
 
     aiGatewayServer.use(helmet());
     aiGatewayServer.use(cors());
-    aiGatewayServer.use(express.json());
+    // AI requests can carry large payloads (long conversation history, tool
+    // results, embedded documents), well beyond express.json()'s 100kb default.
+    aiGatewayServer.use(express.json({ limit: "50mb" }));
 
     aiGatewayServer.use(createAiGatewayRouter());
 

server/db/pg/schema/schema.ts

@@ -69,7 +69,7 @@ export const orgs = pgTable("orgs", {
         "settingsLogRetentionDaysAISessions"
     ) // where 0 = dont keep logs and -1 = keep forever and 9001 = end of the following year
         .notNull()
-        .default(7),
+        .default(0),
     sshCaPrivateKey: text("sshCaPrivateKey"), // Encrypted SSH CA private key (PEM format)
     sshCaPublicKey: text("sshCaPublicKey"), // SSH CA public key (OpenSSH format)
     isBillingOrg: boolean("isBillingOrg"),

server/lib/aiBudgetEnforcement.ts

@@ -16,6 +16,7 @@ import {
     aiModels,
     aiUsageRecords,
     db,
+    logsDb,
     userOrgRoles
 } from "@server/db";
 import { modelKeyMatches } from "@server/lib/aiModelKeyMatch";
@@ -168,7 +169,7 @@ async function sumUsageAmount(
 ): Promise<number> {
     const column =
         unit === "usd" ? aiUsageRecords.costUsd : aiUsageRecords.totalTokens;
-    const [row] = await db
+    const [row] = await logsDb
         .select({ total: sql<number>`coalesce(sum(${column}), 0)` })
         .from(aiUsageRecords)
         .where(where);
@@ -200,7 +201,7 @@ export async function sumUsageForBudget(
         if (!model) {
             return 0;
         }
-        const rows = await db
+        const rows = await logsDb
             .select({
                 requestedModel: aiUsageRecords.requestedModel,
                 costUsd: aiUsageRecords.costUsd,
@@ -496,7 +497,7 @@ async function flushUsageRecords() {
 
     try {
         // Use a transaction to ensure all inserts succeed or fail together
-        await db.transaction(async (tx) => {
+        await logsDb.transaction(async (tx) => {
             // Batch insert in groups to avoid overwhelming the database
             const DB_BATCH_SIZE = 25;
             for (let i = 0; i < recordsToWrite.length; i += DB_BATCH_SIZE) {

server/lib/aiUsageExtraction.ts

@@ -17,7 +17,7 @@ export type AiUsage = {
     estimated: boolean;
 };
 
-function emptyUsage(): AiUsage {
+export function emptyUsage(): AiUsage {
     return {
         promptTokens: 0,
         cacheReadTokens: 0,

server/lib/readConfigFile.ts

@@ -443,7 +443,11 @@ export const configSchema = z
                 disable_config_managed_domains: z.boolean().optional(),
                 disable_product_help_banners: z.boolean().optional(),
                 disable_enterprise_features: z.boolean().optional(),
-                enable_acme_cert_sync: z.boolean().optional().default(true)
+                enable_acme_cert_sync: z.boolean().optional().default(true),
+                disable_private_http_placeholder: z
+                    .boolean()
+                    .optional()
+                    .default(false)
             })
             .optional(),
         acme: z

server/private/lib/config.ts

@@ -48,7 +48,7 @@ export class PrivateConfig {
 
         this.rawPrivateConfig = parsedPrivateConfig;
 
-        this.migrateDeprecatedAcmeConfig(privateEnvironment);
+        this.migrateDeprecatedConfig(privateEnvironment);
 
         process.env.BRANDING_HIDE_AUTH_LAYOUT_FOOTER =
             this.rawPrivateConfig.branding?.hide_auth_layout_footer === true
@@ -152,12 +152,12 @@ export class PrivateConfig {
         return this.rawPrivateConfig;
     }
 
-    // `flags.enable_acme_cert_sync` and `acme` used to live in the private
-    // config file. They now live in the public config file. If an operator
-    // still has them set in the private config and hasn't moved them over to
-    // the public config, pull them forward so behavior doesn't silently
-    // change out from under them.
-    private migrateDeprecatedAcmeConfig(privateEnvironment: any) {
+    // `flags.enable_acme_cert_sync`, `flags.disable_private_http_placeholder`,
+    // and `acme` used to live in the private config file. They now live in
+    // the public config file. If an operator still has them set in the
+    // private config and hasn't moved them over to the public config, pull
+    // them forward so behavior doesn't silently change out from under them.
+    private migrateDeprecatedConfig(privateEnvironment: any) {
         const publicEnvironment: any = readPublicConfigFile();
         const rawConfig: any = config.getRawConfig();
 
@@ -182,6 +182,20 @@ export class PrivateConfig {
             );
             rawConfig.acme = this.rawPrivateConfig.acme;
         }
+
+        if (
+            privateEnvironment?.flags?.disable_private_http_placeholder !==
+                undefined &&
+            publicEnvironment?.flags?.disable_private_http_placeholder ===
+                undefined
+        ) {
+            logger.warn(
+                "`flags.disable_private_http_placeholder` is deprecated in the private config file and has moved to the public config file. Using the value from the private config file for now, but please move it to the public config."
+            );
+            rawConfig.flags = rawConfig.flags ?? {};
+            rawConfig.flags.disable_private_http_placeholder =
+                this.rawPrivateConfig.flags.disable_private_http_placeholder;
+        }
     }
 }
 

server/private/lib/readConfigFile.ts

@@ -115,10 +115,13 @@ export const privateConfigSchema = z
                 // any value set here is migrated into the public config at
                 // startup by PrivateConfig (server/private/lib/config.ts).
                 enable_acme_cert_sync: z.boolean().optional(),
-                disable_private_http_placeholder: z
-                    .boolean()
-                    .optional()
-                    .default(false)
+                // @deprecated Moved to the public config file as
+                // `flags.disable_private_http_placeholder`
+                // (server/lib/readConfigFile.ts). Kept here only so existing
+                // private config files keep parsing; any value set here is
+                // migrated into the public config at startup by PrivateConfig
+                // (server/private/lib/config.ts).
+                disable_private_http_placeholder: z.boolean().optional()
             })
             .optional()
             .prefault({}),

server/private/lib/traefik/getTraefikConfig.ts

@@ -329,8 +329,7 @@ export async function getTraefikConfig(
     }[] = [];
     if (
         build == "enterprise" &&
-        !privateConfig.getRawPrivateConfig().flags
-            .disable_private_http_placeholder
+        !config.getRawConfig().flags?.disable_private_http_placeholder
     ) {
         // we dont want to do this on the cloud
         // Query siteResources in HTTP mode with SSL enabled and aliases - cert generation / HTTPS edge

server/routers/aiGateway/pipeline.ts

@@ -82,6 +82,7 @@ import {
     needsStreamUsageInjection,
     withStreamUsageOption,
     extractResponseModel,
+    emptyUsage,
     type AiUsage
 } from "@server/lib/aiUsageExtraction";
 import { streamAiGatewayResponse } from "@server/routers/aiGateway/streamAiGatewayResponse";
@@ -713,19 +714,35 @@ export function recordAiGatewayCompletion(args: {
         budgets
     } = args;
 
-    let usage: AiUsage | null = extractUsage(
-        capability,
-        responseText,
-        isStream,
-        headers
-    );
-    if (!usage || isUsageEmpty(usage)) {
-        usage = estimateUsage(JSON.stringify(requestBody ?? ""), responseText);
-    }
+    // A non-2xx status means the upstream provider rejected the request
+    // (bad auth, invalid request, rate limit, 5xx, etc.) before ever running
+    // the model - no tokens were actually billed, so don't estimate usage
+    // off the error body text or price/charge it. We still record a
+    // zeroed-out row below (rather than skipping it) so request-count
+    // dashboards built on aiUsageRecords keep counting every attempt.
+    const upstreamSucceeded = statusCode >= 200 && statusCode < 300;
 
-    const model = extractResponseModel(responseText) ?? requestedModel;
-    const pricing = getModelPricing(provider.type as AiProviderType, model);
-    const cost = calculateAiCost(pricing, usage);
+    let usage: AiUsage;
+    let model: string | undefined;
+    let pricing: ReturnType<typeof getModelPricing> = null;
+    let cost: ReturnType<typeof calculateAiCost> = null;
+
+    if (upstreamSucceeded) {
+        usage = extractUsage(capability, responseText, isStream, headers) ?? emptyUsage();
+        if (isUsageEmpty(usage)) {
+            usage = estimateUsage(
+                JSON.stringify(requestBody ?? ""),
+                responseText
+            );
+        }
+
+        model = extractResponseModel(responseText) ?? requestedModel;
+        pricing = getModelPricing(provider.type as AiProviderType, model);
+        cost = calculateAiCost(pricing, usage);
+    } else {
+        usage = emptyUsage();
+        model = requestedModel;
+    }
 
     // Shared by the usage record and the session log so the two can be
     // joined later to show token/cost usage alongside the transcript -
@@ -738,6 +755,7 @@ export function recordAiGatewayCompletion(args: {
         providerId: provider.providerId,
         providerType: provider.type,
         model,
+        statusCode,
         estimated: usage.estimated,
         promptTokens: usage.promptTokens,
         cacheReadTokens: usage.cacheReadTokens,

server/routers/auditLogs/queryAiSessionLog.ts

@@ -312,7 +312,7 @@ async function enrichWithDetails(
     >();
     const sessionIds = logs.map((log) => log.sessionId);
     if (sessionIds.length > 0) {
-        const usageDetails = await primaryDb
+        const usageDetails = await logsDb
             .select({
                 sessionId: aiUsageRecords.sessionId,
                 promptTokens: aiUsageRecords.promptTokens,

server/routers/auditLogs/queryAiUsageFilterOptions.ts

@@ -1,5 +1,6 @@
 import {
     db,
+    logsDb,
     aiUsageRecords,
     aiProviders,
     resources,
@@ -78,22 +79,22 @@ async function query(data: Q) {
         uniqueUsers,
         uniqueVirtualApiKeys
     ] = await Promise.all([
-        db
+        logsDb
             .selectDistinct({ id: aiUsageRecords.providerId })
             .from(aiUsageRecords)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        db
+        logsDb
             .selectDistinct({ model: aiUsageRecords.requestedModel })
             .from(aiUsageRecords)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        db
+        logsDb
             .selectDistinct({ id: aiUsageRecords.resourceId })
             .from(aiUsageRecords)
             .where(and(baseConditions, not(isNull(aiUsageRecords.resourceId))))
             .limit(DISTINCT_LIMIT + 1),
-        db
+        logsDb
             .selectDistinct({ id: aiUsageRecords.siteResourceId })
             .from(aiUsageRecords)
             .where(
@@ -104,12 +105,12 @@ async function query(data: Q) {
                 )
             )
             .limit(DISTINCT_LIMIT + 1),
-        db
+        logsDb
             .selectDistinct({ userId: aiUsageRecords.userId })
             .from(aiUsageRecords)
             .where(and(baseConditions, not(isNull(aiUsageRecords.userId))))
             .limit(DISTINCT_LIMIT + 1),
-        db
+        logsDb
             .selectDistinct({ id: aiUsageRecords.virtualApiKeyId })
             .from(aiUsageRecords)
             .where(

server/routers/auditLogs/queryAiUsageOverview.ts

@@ -1,4 +1,4 @@
-import { db, aiUsageRecords } from "@server/db";
+import { logsDb, aiUsageRecords } from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -29,7 +29,7 @@ async function query(data: Q) {
     const roleUserIds = await resolveRoleUserIds(data.orgId, data.roleId);
     const baseConditions = buildAiUsageWhere(data, roleUserIds);
 
-    const [totalsRow] = await db
+    const [totalsRow] = await logsDb
         .select({
             requests: count(),
             promptTokens: sql<number>`COALESCE(SUM(${aiUsageRecords.promptTokens}), 0)`,
@@ -46,7 +46,7 @@ async function query(data: Q) {
 
     const dayExpr = dayBucketExpr();
 
-    const requestsPerDay = await db
+    const requestsPerDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             requests: count()
@@ -56,7 +56,7 @@ async function query(data: Q) {
         .groupBy(dayExpr)
         .orderBy(dayExpr);
 
-    const tokensPerDay = await db
+    const tokensPerDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             promptTokens: sql<number>`COALESCE(SUM(${aiUsageRecords.promptTokens}), 0)`,
@@ -70,7 +70,7 @@ async function query(data: Q) {
         .groupBy(dayExpr)
         .orderBy(dayExpr);
 
-    const costPerDay = await db
+    const costPerDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             cost: sql<number>`COALESCE(SUM(${aiUsageRecords.costUsd}), 0)`
@@ -80,7 +80,7 @@ async function query(data: Q) {
         .groupBy(dayExpr)
         .orderBy(dayExpr);
 
-    const modelByDay = await db
+    const modelByDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             model: aiUsageRecords.requestedModel,
@@ -117,7 +117,7 @@ async function query(data: Q) {
         topModelsByTokens
     );
 
-    const topModelsRaw = await db
+    const topModelsRaw = await logsDb
         .select({
             model: aiUsageRecords.requestedModel,
             requests: count(),

server/routers/auditLogs/queryAiUsageProviders.ts

@@ -1,4 +1,4 @@
-import { db, aiUsageRecords, aiProviders } from "@server/db";
+import { db, logsDb, aiUsageRecords, aiProviders } from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -29,7 +29,7 @@ async function query(data: Q) {
     const baseConditions = buildAiUsageWhere(data, roleUserIds);
     const dayExpr = dayBucketExpr();
 
-    const providerByDay = await db
+    const providerByDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             providerId: aiUsageRecords.providerId,
@@ -69,7 +69,7 @@ async function query(data: Q) {
         topByTokens
     );
 
-    const topProvidersRaw = await db
+    const topProvidersRaw = await logsDb
         .select({
             providerId: aiUsageRecords.providerId,
             requests: count(),

server/routers/auditLogs/queryAiUsageResources.ts

@@ -1,4 +1,4 @@
-import { db, aiUsageRecords, resources, siteResources } from "@server/db";
+import { db, logsDb, aiUsageRecords, resources, siteResources } from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -39,7 +39,7 @@ async function query(data: Q) {
     const baseConditions = buildAiUsageWhere(data, roleUserIds);
     const dayExpr = dayBucketExpr();
 
-    const resourceByDay = await db
+    const resourceByDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             resourceId: aiUsageRecords.resourceId,
@@ -80,7 +80,7 @@ async function query(data: Q) {
         topByTokens
     );
 
-    const topResourcesRaw = await db
+    const topResourcesRaw = await logsDb
         .select({
             resourceId: aiUsageRecords.resourceId,
             siteResourceId: aiUsageRecords.siteResourceId,

server/routers/auditLogs/queryAiUsageUsersRoles.ts

@@ -1,4 +1,11 @@
-import { db, aiUsageRecords, users, roles, userOrgRoles } from "@server/db";
+import {
+    db,
+    logsDb,
+    aiUsageRecords,
+    users,
+    roles,
+    userOrgRoles
+} from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -36,7 +43,7 @@ async function query(data: Q) {
     // userId, so role totals are derived by expanding each user's usage into
     // every role they hold in the org (per-role double counting for
     // multi-role users is expected/accepted).
-    const userByDay = await db
+    const userByDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             userId: aiUsageRecords.userId,
@@ -48,7 +55,7 @@ async function query(data: Q) {
         .groupBy(dayExpr, aiUsageRecords.userId)
         .orderBy(dayExpr);
 
-    const userTotalsRaw = await db
+    const userTotalsRaw = await logsDb
         .select({
             userId: aiUsageRecords.userId,
             requests: count(),

server/routers/auditLogs/queryAiUsageVirtualApiKeys.ts

@@ -1,4 +1,4 @@
-import { db, aiUsageRecords, virtualApiKeys } from "@server/db";
+import { db, logsDb, aiUsageRecords, virtualApiKeys } from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -31,7 +31,7 @@ async function query(data: Q) {
     const baseConditions = buildAiUsageWhere(data, roleUserIds);
     const dayExpr = dayBucketExpr();
 
-    const virtualApiKeyByDay = await db
+    const virtualApiKeyByDay = await logsDb
         .select({
             day: dayExpr.as("day"),
             virtualApiKeyId: aiUsageRecords.virtualApiKeyId,
@@ -43,7 +43,7 @@ async function query(data: Q) {
         .groupBy(dayExpr, aiUsageRecords.virtualApiKeyId)
         .orderBy(dayExpr);
 
-    const virtualApiKeyTotalsRaw = await db
+    const virtualApiKeyTotalsRaw = await logsDb
         .select({
             virtualApiKeyId: aiUsageRecords.virtualApiKeyId,
             requests: count(),

server/setup/scriptsPg/1.22.0.ts

@@ -18,9 +18,6 @@ export default async function migration() {
     try {
         await db.execute(sql`BEGIN`);
 
-        await db.execute(sql`
-        `);
-
         await db.execute(sql`
             CREATE TABLE "aiBudgetBreachEvents" (
                 "id" serial PRIMARY KEY NOT NULL,
@@ -454,14 +451,14 @@ export default async function migration() {
             throw new Error(fromZodError(parsedConfig.error).toString());
         }
 
-        traefikConfig.experimental.plugins.badger.version = "v1.6.0";
+        traefikConfig.experimental.plugins.badger.version = "v1.6.1";
 
         const updatedTraefikYaml = yaml.dump(traefikConfig);
 
         fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");
 
         console.log(
-            "Updated the version of Badger in your Traefik configuration to v1.6.0"
+            "Updated the version of Badger in your Traefik configuration to v1.6.1"
         );
     } catch (e) {
         console.log(

server/setup/scriptsSqlite/1.22.0.ts

@@ -456,14 +456,14 @@ export default async function migration() {
             throw new Error(fromZodError(parsedConfig.error).toString());
         }
 
-        traefikConfig.experimental.plugins.badger.version = "v1.6.0";
+        traefikConfig.experimental.plugins.badger.version = "v1.6.1";
 
         const updatedTraefikYaml = yaml.dump(traefikConfig);
 
         fs.writeFileSync(traefikPath, updatedTraefikYaml, "utf8");
 
         console.log(
-            "Updated the version of Badger in your Traefik configuration to v1.6.0"
+            "Updated the version of Badger in your Traefik configuration to v1.6.1"
         );
     } catch (e) {
         console.log(

src/app/[orgId]/settings/logs/access/page.tsx

@@ -19,6 +19,8 @@ import { getPrivateResourceSettingsHref } from "@app/lib/launcherResourceAdminHr
 import axios from "axios";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import LogRetentionWarning from "@app/components/LogRetentionWarning";
+import { useOrgContext } from "@app/hooks/useOrgContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { logQueries } from "@app/lib/queries";
@@ -32,6 +34,7 @@ export default function GeneralPage() {
     const t = useTranslations();
     const { orgId } = useParams();
 
+    const { org } = useOrgContext();
     const { isPaidUser } = usePaidStatus();
 
     const [isExporting, startTransition] = useTransition();
@@ -529,6 +532,13 @@ export default function GeneralPage() {
 
             <PaidFeaturesAlert tiers={tierMatrix.accessLogs} />
 
+            {org.org.settingsLogRetentionDaysAccess === 0 && (
+                <LogRetentionWarning
+                    orgId={orgId as string}
+                    logTypeLabel={t("accessLogs")}
+                />
+            )}
+
             <LogDataTable
                 columns={columns}
                 data={rows}

src/app/[orgId]/settings/logs/action/page.tsx

@@ -3,8 +3,10 @@ import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
 import { DateTimeValue } from "@app/components/DateTimePicker";
 import { LogDataTable } from "@app/components/LogDataTable";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import LogRetentionWarning from "@app/components/LogRetentionWarning";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useOrgContext } from "@app/hooks/useOrgContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import { toast } from "@app/hooks/useToast";
@@ -29,6 +31,7 @@ export default function GeneralPage() {
     const { orgId } = useParams();
     const searchParams = useSearchParams();
 
+    const { org } = useOrgContext();
     const { isPaidUser } = usePaidStatus();
 
     const [isExporting, startTransition] = useTransition();
@@ -359,6 +362,13 @@ export default function GeneralPage() {
 
             <PaidFeaturesAlert tiers={tierMatrix.actionLogs} />
 
+            {org.org.settingsLogRetentionDaysAction === 0 && (
+                <LogRetentionWarning
+                    orgId={orgId as string}
+                    logTypeLabel={t("actionLogs")}
+                />
+            )}
+
             <LogDataTable
                 columns={columns}
                 data={rows}

src/app/[orgId]/settings/logs/ai/page.tsx

@@ -3,9 +3,11 @@ import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
 import { DateTimeValue } from "@app/components/DateTimePicker";
 import { LogDataTable } from "@app/components/LogDataTable";
 import { AiSessionChatView } from "@app/components/AiSessionChatView";
+import LogRetentionWarning from "@app/components/LogRetentionWarning";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { Button } from "@app/components/ui/button";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useOrgContext } from "@app/hooks/useOrgContext";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient } from "@app/lib/api";
 import { useTranslations } from "next-intl";
@@ -41,6 +43,8 @@ export default function AiSessionLogsPage() {
     const { orgId } = useParams();
     const searchParams = useSearchParams();
 
+    const { org } = useOrgContext();
+
     const [isExporting, startTransition] = useTransition();
 
     const [currentPage, setCurrentPage] = useState<number>(0);
@@ -641,6 +645,13 @@ export default function AiSessionLogsPage() {
                 description={t("aiSessionLogsDescription")}
             />
 
+            {org.org.settingsLogRetentionDaysAISessions === 0 && (
+                <LogRetentionWarning
+                    orgId={orgId as string}
+                    logTypeLabel={t("aiSessionLogs")}
+                />
+            )}
+
             <LogDataTable
                 columns={columns}
                 data={rows}

src/app/[orgId]/settings/logs/connection/page.tsx

@@ -4,8 +4,10 @@ import { ColumnFilterButton } from "@app/components/ColumnFilterButton";
 import { DateTimeValue } from "@app/components/DateTimePicker";
 import { LogDataTable } from "@app/components/LogDataTable";
 import { PaidFeaturesAlert } from "@app/components/PaidFeaturesAlert";
+import LogRetentionWarning from "@app/components/LogRetentionWarning";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useOrgContext } from "@app/hooks/useOrgContext";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { useStoredPageSize } from "@app/hooks/useStoredPageSize";
 import { toast } from "@app/hooks/useToast";
@@ -47,6 +49,7 @@ export default function ConnectionLogsPage() {
     const { orgId } = useParams();
     const searchParams = useSearchParams();
 
+    const { org } = useOrgContext();
     const { isPaidUser } = usePaidStatus();
 
     const [isExporting, startTransition] = useTransition();
@@ -582,6 +585,13 @@ export default function ConnectionLogsPage() {
 
             <PaidFeaturesAlert tiers={tierMatrix.connectionLogs} />
 
+            {org.org.settingsLogRetentionDaysConnection === 0 && (
+                <LogRetentionWarning
+                    orgId={orgId as string}
+                    logTypeLabel={t("connectionLogs")}
+                />
+            )}
+
             <LogDataTable
                 columns={columns}
                 data={rows}

src/app/[orgId]/settings/logs/layout.tsx

@@ -1,6 +1,8 @@
 import { verifySession } from "@app/lib/auth/verifySession";
 import { redirect } from "next/navigation";
 import { cache } from "react";
+import OrgProvider from "@app/providers/OrgProvider";
+import { getCachedOrg } from "@app/lib/api/getCachedOrg";
 
 type GeneralSettingsProps = {
     children: React.ReactNode;
@@ -11,6 +13,8 @@ export default async function GeneralSettingsPage({
     children,
     params
 }: GeneralSettingsProps) {
+    const { orgId } = await params;
+
     const getUser = cache(verifySession);
     const user = await getUser();
 
@@ -18,5 +22,13 @@ export default async function GeneralSettingsPage({
         redirect(`/`);
     }
 
-    return children;
+    let org = null;
+    try {
+        const res = await getCachedOrg(orgId);
+        org = res.data.data;
+    } catch {
+        redirect(`/${orgId}`);
+    }
+
+    return <OrgProvider org={org}>{children}</OrgProvider>;
 }

src/app/[orgId]/settings/logs/request/page.tsx

@@ -2,9 +2,11 @@
 import { ColumnFilter } from "@app/components/ColumnFilter";
 import { DateTimeValue } from "@app/components/DateTimePicker";
 import { LogDataTable } from "@app/components/LogDataTable";
+import LogRetentionWarning from "@app/components/LogRetentionWarning";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { Button } from "@app/components/ui/button";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useOrgContext } from "@app/hooks/useOrgContext";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient } from "@app/lib/api";
 import { useTranslations } from "next-intl";
@@ -29,6 +31,8 @@ export default function GeneralPage() {
     const { orgId } = useParams();
     const searchParams = useSearchParams();
 
+    const { org } = useOrgContext();
+
     const [isExporting, startTransition] = useTransition();
 
     const [currentPage, setCurrentPage] = useState<number>(0);
@@ -714,6 +718,13 @@ export default function GeneralPage() {
                 description={t("requestLogsDescription")}
             />
 
+            {org.org.settingsLogRetentionDaysRequest === 0 && (
+                <LogRetentionWarning
+                    orgId={orgId as string}
+                    logTypeLabel={t("requestLogs")}
+                />
+            )}
+
             <LogDataTable
                 columns={columns}
                 data={rows}

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -201,7 +201,11 @@ export default async function ResourceAuthPage(props: {
     // Inference resources never establish a resource session on the inference
     // host. Authenticated users retrieve their virtual API key on the dashboard.
     if (isInference && user) {
-        redirect(keysPath);
+        if (host !== expectedHost) {
+            redirect(`/auth/org?redirect=${encodeURIComponent(keysPath)}`);
+        } else {
+            redirect(keysPath);
+        }
     }
 
     // After password/pincode/SSO, do not send the browser back to the

src/components/LogRetentionWarning.tsx

@@ -0,0 +1,40 @@
+"use client";
+
+import ActionBanner from "@app/components/ActionBanner";
+import { Button } from "@app/components/ui/button";
+import { ArrowRight, ShieldAlert } from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+
+type LogRetentionWarningProps = {
+    orgId: string;
+    logTypeLabel: string;
+};
+
+export function LogRetentionWarning({
+    orgId,
+    logTypeLabel
+}: LogRetentionWarningProps) {
+    const t = useTranslations();
+
+    return (
+        <ActionBanner
+            variant="warning"
+            title={t("logRetentionDisabledWarningTitle")}
+            titleIcon={<ShieldAlert className="w-5 h-5" />}
+            description={t("logRetentionDisabledWarningDescription", {
+                logType: logTypeLabel
+            })}
+            actions={
+                <Link href={`/${orgId}/settings/general/security`}>
+                    <Button variant="outline" className="gap-2">
+                        {t("logRetentionDisabledWarningButton")}
+                        <ArrowRight className="size-4" />
+                    </Button>
+                </Link>
+            }
+        />
+    );
+}
+
+export default LogRetentionWarning;

src/components/ai-client-config/AiClientConfigSection.tsx

@@ -49,10 +49,6 @@ const CLIENT_LOGOS = {
     opencode: {
         light: "/third-party/opencode-dark.svg",
         dark: "/third-party/opencode-light.svg"
-    },
-    cursor: {
-        light: "/third-party/cursor-dark.svg",
-        dark: "/third-party/cursor-light.svg"
     }
 } as const;
 
@@ -69,8 +65,7 @@ export function AiClientConfigSection({
     const descriptions: Record<string, string> = {
         claude: t("aiClientConfigDescriptionClaude"),
         codex: t("aiClientConfigDescriptionCodex"),
-        opencode: t("aiClientConfigDescriptionOpencode"),
-        cursor: t("aiClientConfigDescriptionCursor")
+        opencode: t("aiClientConfigDescriptionOpencode")
     };
 
     return (

src/lib/aiClientConfig.ts

@@ -1,11 +1,10 @@
-export const AI_CLIENT_IDS = ["claude", "codex", "opencode", "cursor"] as const;
+export const AI_CLIENT_IDS = ["claude", "codex", "opencode"] as const;
 export type AiClientId = (typeof AI_CLIENT_IDS)[number];
 
 export const AI_CLIENT_NAMES: Record<AiClientId, string> = {
     claude: "Claude Code",
     codex: "Codex",
-    opencode: "OpenCode",
-    cursor: "Cursor"
+    opencode: "OpenCode"
 };
 
 /** Auth as supplied by callers: the real key isn't fetched yet. */
@@ -293,7 +292,7 @@ function buildOpencodeGuide(
                 '            "options": {',
                 `                "baseURL": "${endpoint}/v1"`,
                 "            }",
-                "        }",
+                "        },",
                 '        "openai": {',
                 '            "options": {',
                 `                "baseURL": "${endpoint}/v1"`,
@@ -314,12 +313,26 @@ function buildOpencodeGuide(
                 '    "anthropic": {',
                 '        "type": "api",',
                 `        "key": "${key}"`,
+                "    },",
+                '    "openai": {',
+                '        "type": "api",',
+                `        "key": "${key}"`,
                 "    }",
                 "}"
             ].join("\n"),
         auth
     );
 
+    const moreProviders = block(
+        "opencode-more-providers",
+        "More providers",
+        () =>
+            "OpenCode configures providers individually, so Anthropic and OpenAI are just the ones set up above. " +
+            'You can point any other OpenCode-supported provider (e.g. "openrouter", "google", "groq") at this gateway the same way: add a matching entry under "provider" in opencode.json, and under auth.json if it needs an API key.',
+        auth,
+        "steps"
+    );
+
     return {
         id: "opencode",
         name: AI_CLIENT_NAMES.opencode,
@@ -329,41 +342,10 @@ function buildOpencodeGuide(
                 id: "default",
                 label: "Default",
                 relation: "steps",
-                blocks: [config, authFile]
-            }
-        ]
-    };
-}
-
-function buildCursorGuide(endpoint: string, auth: AiClientAuth): AiClientGuide {
-    const steps = block(
-        "cursor-steps",
-        "Cursor Settings",
-        (key) =>
-            [
-                "1. Open Cursor Settings -> Models.",
-                '2. Enable "Override OpenAI Base URL".',
-                `3. Set the base URL to: ${endpoint}/v1`,
-                auth.mode === "keyed"
-                    ? `4. Paste your API key into the OpenAI API Key field: ${key}`
-                    : '4. Leave the OpenAI API Key field set to a placeholder (e.g. "-"). Pangolin authenticates the request over your Newt/Olm connection automatically.',
-                "5. Add a custom model matching the model your Pangolin AI Gateway serves (e.g. claude-sonnet-4-6)."
-            ].join("\n"),
-        auth,
-        "steps",
-        true
-    );
-
-    return {
-        id: "cursor",
-        name: AI_CLIENT_NAMES.cursor,
-        cli: null,
-        presets: [
-            {
-                id: "default",
-                label: "Default",
-                relation: "steps",
-                blocks: [steps]
+                blocks:
+                    auth.mode === "keyed"
+                        ? [config, authFile, moreProviders]
+                        : [config, moreProviders]
             }
         ]
     };
@@ -379,8 +361,7 @@ const GUIDE_BUILDERS: Record<
 > = {
     claude: buildClaudeGuide,
     codex: buildCodexGuide,
-    opencode: buildOpencodeGuide,
-    cursor: buildCursorGuide
+    opencode: buildOpencodeGuide
 };
 
 export function buildAiClientGuide(