The agent's tool calls run server-side (loopback HTTP via {@link PolicyExecutor}), so this + * 402 never reaches the frontend's API-client interceptor that pops the modal for direct calls + * — same gap the policy auto-run path bridges in {@code PolicyEngine}. + */ + private AiWorkflowResponse paygLimitResponseOrNull(Throwable e) { + if (!(e instanceof RestClientResponseException rce)) { + return null; + } + String code = DownstreamEntitlementError.extractCode(rce); + if (code == null) { + return null; + } + AiWorkflowResponse response = new AiWorkflowResponse(); + response.setOutcome(AiWorkflowOutcome.CANNOT_CONTINUE); + response.setReason("You've reached your current usage limit."); + response.setErrorCode(code); + response.setErrorSubscribed(DownstreamEntitlementError.extractSubscribed(rce)); + return response; + } + /** * Drive the engine's streaming orchestrator endpoint. Progress events are forwarded to {@code * listener} as they arrive (each one keeps the SSE connection to the frontend alive too). The diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/DownstreamEntitlementError.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/DownstreamEntitlementError.java new file mode 100644 index 000000000..52d9500a5 --- /dev/null +++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/DownstreamEntitlementError.java @@ -0,0 +1,64 @@ +package stirling.software.proprietary.service; + +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +import org.springframework.web.client.RestClientResponseException; + +/** + * Reads the {@code error} sentinel and {@code subscribed} flag out of a downstream 401/402 JSON + * body — e.g. the saas EntitlementGuard's {@code + * {"error":"PAYG_LIMIT_REACHED","subscribed":false}}. + * + *
Server-side run paths (policy auto-run, AI agent workflows) execute tool calls via loopback + * HTTP, so a usage-limit 402 surfaces as a {@link RestClientResponseException} rather than reaching + * the frontend's API-client interceptor. These helpers let those paths pass the structured code + * through to the client, which maps it to the right usage-limit modal instead of showing a generic + * failure. + * + *
Regex (not a JSON parse) on purpose: the body is a small, server-controlled shape and this
+ * keeps the proprietary module free of any billing-layer (saas) coupling.
+ */
+public final class DownstreamEntitlementError {
+
+ private DownstreamEntitlementError() {}
+
+ /** Matches the {@code "error":"CODE"} field of a small JSON error body. */
+ private static final Pattern ERROR_CODE_FIELD =
+ Pattern.compile("\"error\"\\s*:\\s*\"([^\"]+)\"");
+
+ /** Matches the {@code "subscribed":true|false} field of a small JSON error body. */
+ private static final Pattern SUBSCRIBED_FIELD =
+ Pattern.compile("\"subscribed\"\\s*:\\s*(true|false)");
+
+ /**
+ * Pull the {@code error} sentinel out of a downstream 401/402 JSON body. Returns null for other
+ * statuses or an unmatched body, in which case the caller treats it as a generic failure.
+ */
+ public static String extractCode(RestClientResponseException e) {
+ int status = e.getStatusCode().value();
+ if (status != 401 && status != 402) {
+ return null;
+ }
+ String body = e.getResponseBodyAsString();
+ if (body == null || body.isBlank()) {
+ return null;
+ }
+ Matcher m = ERROR_CODE_FIELD.matcher(body);
+ return m.find() ? m.group(1) : null;
+ }
+
+ /**
+ * Pull the {@code subscribed} flag out of the body (present on the saas {@code
+ * PAYG_LIMIT_REACHED}/{@code FEATURE_DEGRADED} responses). Null when absent — the client then
+ * defaults to the free-limit modal.
+ */
+ public static Boolean extractSubscribed(RestClientResponseException e) {
+ String body = e.getResponseBodyAsString();
+ if (body == null || body.isBlank()) {
+ return null;
+ }
+ Matcher m = SUBSCRIBED_FIELD.matcher(body);
+ return m.find() ? Boolean.valueOf(m.group(1)) : null;
+ }
+}
diff --git a/frontend/editor/public/locales/en-GB/translation.toml b/frontend/editor/public/locales/en-GB/translation.toml
index c8a1d5d28..7d0e368b2 100644
--- a/frontend/editor/public/locales/en-GB/translation.toml
+++ b/frontend/editor/public/locales/en-GB/translation.toml
@@ -2740,6 +2740,7 @@ need_clarification = "Could you clarify your request?"
not_found = "I couldn't find the requested information."
processing = "Processing ({{outcome}})..."
unsupported_capability = "Unsupported capability: {{capability}}"
+usage_limit_reached = "You've reached your usage limit. Check your plan options to keep going."
[chat.toolsUsed]
summary = "Ran {{count}} tools"
diff --git a/frontend/editor/src/proprietary/components/chat/ChatContext.tsx b/frontend/editor/src/proprietary/components/chat/ChatContext.tsx
index ac3aad972..05577885b 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatContext.tsx
+++ b/frontend/editor/src/proprietary/components/chat/ChatContext.tsx
@@ -12,6 +12,7 @@ import { useAllFiles, useFileActions } from "@app/contexts/FileContext";
import apiClient from "@app/services/apiClient";
import { getApiBaseUrl } from "@app/services/apiClientConfig";
import { getAuthHeaders } from "@app/services/apiClientSetup";
+import { dispatchPaygLimitReached } from "@app/services/usageLimitBridge";
import { createChildStub } from "@app/contexts/file/fileActions";
import {
createNewStirlingFileStub,
@@ -179,6 +180,25 @@ interface AiWorkflowResponse {
fileId?: string;
fileName?: string;
contentType?: string;
+ /**
+ * Structured error code when a tool call inside the workflow was blocked (e.g.
+ * PAYG_LIMIT_REACHED / FEATURE_DEGRADED). Present instead of a raw failure reason so the
+ * client can pop the usage-limit modal. See {@link isPaygLimitCode}.
+ */
+ errorCode?: string;
+ /** From the blocking 402: true → over spending cap, false/absent → free allowance spent. */
+ errorSubscribed?: boolean;
+}
+
+/**
+ * Usage-limit sentinels the agent can surface (matching the saas EntitlementGuard / apiClient
+ * interceptor). When one of these is the result's errorCode, we open the usage-limit modal rather
+ * than render the failure as chat text.
+ */
+const PAYG_LIMIT_CODES = new Set(["PAYG_LIMIT_REACHED", "FEATURE_DEGRADED"]);
+
+function isPaygLimitCode(code: string | null | undefined): boolean {
+ return code != null && PAYG_LIMIT_CODES.has(code);
}
interface ChatState {
@@ -512,18 +532,46 @@ export function ChatProvider({ children }: { children: ReactNode }) {
if (!response.ok) {
let detail: string | undefined;
+ let limitHandled = false;
try {
const body = await response.json();
- detail =
- body?.message ??
- body?.detail ??
- body?.error ??
- (Array.isArray(body?.errors)
- ? body.errors[0]?.message
- : undefined);
+ const code = typeof body?.error === "string" ? body.error : null;
+ // A 402 carrying a usage-limit sentinel means the agent call itself was gated.
+ // Fire the usage-limit modal (free → subscribe, subscribed → raise cap) and show a
+ // brief line below — not a generic "engine failed" error.
+ if (response.status === 402 && isPaygLimitCode(code)) {
+ dispatchPaygLimitReached(
+ typeof body?.subscribed === "boolean" ? body.subscribed : null,
+ );
+ limitHandled = true;
+ } else {
+ detail =
+ body?.message ??
+ body?.detail ??
+ body?.error ??
+ (Array.isArray(body?.errors)
+ ? body.errors[0]?.message
+ : undefined);
+ }
} catch {
// non-JSON body — ignore
}
+ if (limitHandled) {
+ dispatch({ type: "SET_PROGRESS", progress: null });
+ dispatch({
+ type: "ADD_MESSAGE",
+ message: {
+ id: generateId(),
+ role: ChatRole.ASSISTANT,
+ content: t(
+ "chat.responses.usage_limit_reached",
+ "You've reached your usage limit. Check your plan options to keep going.",
+ ),
+ timestamp: Date.now(),
+ },
+ });
+ return;
+ }
throw new Error(
detail ?? `AI engine request failed: ${response.status}`,
);
@@ -553,7 +601,20 @@ export function ChatProvider({ children }: { children: ReactNode }) {
onResult: (data) => {
receivedResult = true;
dispatch({ type: "SET_PROGRESS", progress: null });
- const replyContent = formatWorkflowResponse(data, t);
+ // The agent's tool calls run server-side, so a usage-limit 402 surfaces here on the
+ // result (not via the apiClient interceptor that pops the modal for direct calls).
+ // Fire the matching modal and replace the raw "tool failed: 402…" reason with a
+ // brief, non-alarming line.
+ const isLimit = isPaygLimitCode(data.errorCode);
+ if (isLimit) {
+ dispatchPaygLimitReached(data.errorSubscribed ?? null);
+ }
+ const replyContent = isLimit
+ ? t(
+ "chat.responses.usage_limit_reached",
+ "You've reached your usage limit. Check your plan options to keep going.",
+ )
+ : formatWorkflowResponse(data, t);
dispatch({
type: "ADD_MESSAGE",
message: {
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
index 64c177739..27f22b13a 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
@@ -27,9 +27,8 @@ import {
import type {
PolicyRunStatus,
PolicyRunView,
- PolicyLimitReachedDetail,
} from "@app/services/policyPipeline";
-import { POLICY_LIMIT_REACHED_EVENT } from "@app/services/policyPipeline";
+import { dispatchPaygLimitReached } from "@app/services/usageLimitBridge";
import type { FileId } from "@app/types/file";
import { createStirlingFilesAndStubs } from "@app/services/fileStubHelpers";
import type { StirlingFile, StirlingFileStub } from "@app/types/fileContext";
@@ -87,15 +86,7 @@ export function usePolicyAutoRun(): void {
if (code !== "PAYG_LIMIT_REACHED" && code !== "FEATURE_DEGRADED") return;
if (firedLimitModal.current.has(view.runId)) return;
firedLimitModal.current.add(view.runId);
- try {
- window.dispatchEvent(
- new CustomEvent Also bridges the policy auto-run path: a policy's tool calls run server-side,
- * so their usage-limit 402 never reaches the apiClient interceptor that pops these
- * modals for direct calls. The proprietary auto-run hook broadcasts {@link
- * POLICY_LIMIT_REACHED_EVENT} (with the blocking 402's {@code subscribed} flag)
- * instead; we open the matching modal here.
+ * Also bridges the server-side run paths (policy auto-run, AI agent): their tool
+ * calls run server-side, so a usage-limit 402 never reaches the apiClient interceptor
+ * that pops these modals for direct calls. Those proprietary paths broadcast {@link
+ * PAYG_LIMIT_REACHED_EVENT} (with the blocking 402's {@code subscribed} flag) instead;
+ * we open the matching modal here.
*/
export default function UsageLimitModalHost() {
const [freeOpen, setFreeOpen] = useState(false);
@@ -30,19 +30,19 @@ export default function UsageLimitModalHost() {
useEffect(() => {
const onFree = () => setFreeOpen(true);
const onSpend = () => setSpendOpen(true);
- const onPolicyLimit = (e: Event) => {
- const subscribed = (e as CustomEvent