@cassius0924/dsh-usage-dashboard 0.8.3 → 0.9.0

package/lib/index.js

@@ -2,18 +2,61 @@
 var USAGE_WINDOW_DAYS = [7, 30, 90, 365];
 var SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 var isValidSessionId = (id) => SESSION_ID_PATTERN.test(id);
-var BREAKER_DEFAULT_SETTINGS = { enabled: true, sessions: [] };
-var BREAKER_API = {
-  state: "/api/dsh-usage-dashboard/breaker",
-  release: "/api/dsh-usage-dashboard/breaker/release"
-};
-var isBreakerSettingsRequest = (value) => {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const candidate = value;
-  if (typeof candidate.enabled !== "boolean") return false;
-  if (candidate.sessionId === void 0) return true;
-  return typeof candidate.sessionId === "string" && isValidSessionId(candidate.sessionId);
-};
+
+// src/memo.ts
+function memoize(ttlMs, compute) {
+  const state = { entry: void 0, inflight: void 0 };
+  const run = () => {
+    if (state.inflight !== void 0) return state.inflight;
+    const task = compute().then(
+      (value) => {
+        state.inflight = void 0;
+        if (value.ok) state.entry = { value, setAt: Date.now() };
+        return value;
+      },
+      (err) => {
+        state.inflight = void 0;
+        throw err;
+      }
+    );
+    state.inflight = task;
+    return task;
+  };
+  return {
+    get: () => {
+      const hit = state.entry;
+      if (hit !== void 0 && hit.value.ok && Date.now() - hit.setAt < ttlMs) {
+        return Promise.resolve(hit.value);
+      }
+      return run();
+    },
+    refresh: () => run()
+  };
+}
+
+// src/trust-fence.ts
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+}
+function isTrustedApiRequest(req) {
+  const host = req.headers.host;
+  if (host === void 0) return false;
+  let hostUrl;
+  try {
+    hostUrl = new URL(`http://${host}`);
+  } catch {
+    return false;
+  }
+  if (!isLoopbackHostname(hostUrl.hostname)) return false;
+  if (req.headers["sec-fetch-site"] === "cross-site") return false;
+  const origin = req.headers.origin;
+  if (origin === void 0) return true;
+  try {
+    return new URL(origin).host === hostUrl.host;
+  } catch {
+    return false;
+  }
+}
 
 // src/pricing.ts
 var PEAK_PRICING_FROM_MS = Date.UTC(2026, 7, 16, 16, 0, 0);
@@ -109,338 +152,6 @@ function pricingInfo(nowMs) {
   };
 }
 
-// src/breaker.ts
-var BEIJING_OFFSET_MS2 = 8 * 36e5;
-var HOUR_MS = 36e5;
-var DAY_MS = 864e5;
-var BREAKER_PEAK_WINDOWS = ["09:00\u201312:00", "14:00\u201318:00"];
-function nextResumeAt(nowMs) {
-  if (!isPeak(nowMs)) return nowMs;
-  const beijingMs = nowMs + BEIJING_OFFSET_MS2;
-  const dayStartMs = Math.floor(beijingMs / DAY_MS) * DAY_MS;
-  return dayStartMs + 18 * HOUR_MS - BEIJING_OFFSET_MS2;
-}
-function isUserTurn(messages) {
-  return messages.some((message) => message.source?.kind === "user");
-}
-function normalizeBreakerSettings(settings) {
-  const sessions = [...new Set(settings.sessions.filter(isValidSessionId))].sort();
-  return { enabled: settings.enabled, sessions };
-}
-function breakerProject(settings, nowMs, holding) {
-  const peak = isPeak(nowMs);
-  const normalized = normalizeBreakerSettings(settings);
-  const parkedSessions = [...new Set(holding.filter(isValidSessionId))].sort();
-  return {
-    enabled: normalized.enabled,
-    sessions: normalized.sessions,
-    holding: parkedSessions,
-    now: new Date(nowMs).toISOString(),
-    peak,
-    resumeAt: peak ? new Date(nextResumeAt(nowMs)).toISOString() : null,
-    peakWindows: [...BREAKER_PEAK_WINDOWS]
-  };
-}
-
-// src/breaker-gate.ts
-var MAX_BREAKER_TIMER_DELAY_MS = 2147483647;
-var systemBreakerTimers = {
-  schedule: (callback, delayMs) => {
-    const handle = setTimeout(callback, delayMs);
-    handle.unref?.();
-    return handle;
-  },
-  cancel: (handle) => {
-    clearTimeout(handle);
-  }
-};
-var clampBreakerTimerDelay = (delayMs) => {
-  if (!Number.isFinite(delayMs)) return 0;
-  return Math.max(0, Math.min(Math.trunc(delayMs), MAX_BREAKER_TIMER_DELAY_MS));
-};
-var MAX_TRACKED_TURNS = 512;
-var BreakerGate = class {
-  #settings;
-  #sessions;
-  #now;
-  #timers;
-  #held = /* @__PURE__ */ new Set();
-  #turns = /* @__PURE__ */ new Map();
-  #timer;
-  #disposed = false;
-  constructor(options = {}) {
-    this.#settings = normalizeBreakerSettings(options.initialSettings ?? { ...BREAKER_DEFAULT_SETTINGS });
-    this.#sessions = new Set(this.#settings.sessions);
-    this.#now = options.now ?? Date.now;
-    this.#timers = options.timers ?? systemBreakerTimers;
-  }
-  get settings() {
-    return normalizeBreakerSettings(this.#settings);
-  }
-  /** Steps parked right now, across every session. */
-  get held() {
-    return this.#held.size;
-  }
-  /** Session ids with at least one parked step, sorted for the wire projection. */
-  get heldSessions() {
-    return [...new Set([...this.#held].map((record) => record.sessionId))].sort();
-  }
-  /**
-   * Park one proposed step until it may proceed. Resolves immediately when the
-   * step is not subject to the breaker (session not opted in, off-peak,
-   * machine-started turn, turn already released by hand) or when the turn is
-   * aborted/disposed.
-   *
-   * The listener wrapping this must call `next()` after it resolves — this
-   * method never throws and never returns a decision of its own.
-   *
-   * `sessionId` is the agent id from the payload; an agent without one cannot
-   * be matched against the opt-in list, so its steps pass.
-   */
-  async hold(sessionId, turn, messages, signal) {
-    if (this.#disposed || signal.aborted || sessionId === void 0 || sessionId === "") return;
-    const key = `${sessionId}:${turn}`;
-    let state = this.#turns.get(key);
-    const user = isUserTurn(messages) || state?.user === true;
-    if (state === void 0) {
-      state = { user, released: false };
-      this.rememberTurn(key, state);
-    } else {
-      state.user = user;
-    }
-    if (state.released || !this.#settings.enabled || !this.#sessions.has(sessionId) || !isPeak(this.#now()) || !state.user) return;
-    await new Promise((resolve) => {
-      const onAbort = () => {
-        this.releaseRecord(record, false);
-      };
-      const record = {
-        sessionId,
-        turn,
-        resolve,
-        detach: () => {
-          signal.removeEventListener("abort", onAbort);
-        }
-      };
-      signal.addEventListener("abort", onAbort);
-      this.#held.add(record);
-      this.armTimer();
-    });
-  }
-  /**
-   * Let parked steps continue now. `sessionId` narrows it to one session; no
-   * argument releases every parked step (the UI's "continue all" button). The
-   * released turns are remembered, because re-parking their next step would
-   * contradict the user's instruction.
-   * @returns how many parked steps were released.
-   */
-  release(sessionId) {
-    const released = [...this.#held].filter((record) => sessionId === void 0 || record.sessionId === sessionId);
-    for (const record of released) this.releaseRecord(record, true);
-    return released.length;
-  }
-  /**
-   * Apply new settings. Turning off the master switch — or a session's own
-   * switch — releases the affected parked steps immediately and without
-   * remembering a bypass: that is the user's decision, not a request for one
-   * particular turn to run.
-   */
-  update(settings) {
-    this.#settings = normalizeBreakerSettings(settings);
-    this.#sessions = new Set(this.#settings.sessions);
-    if (this.#disposed) return;
-    const nowMs = this.#now();
-    for (const record of [...this.#held]) {
-      if (!this.#settings.enabled || !this.#sessions.has(record.sessionId) || !isPeak(nowMs)) {
-        this.releaseRecord(record, false);
-      }
-    }
-    if (this.#held.size > 0) this.armTimer();
-    else this.clearTimer();
-  }
-  /** Release everything and stop the timer; called when the plugin unloads. */
-  dispose() {
-    this.#disposed = true;
-    this.clearTimer();
-    for (const record of [...this.#held]) this.releaseRecord(record, false);
-    this.#turns.clear();
-  }
-  /** (Re)arm the single settle timer for the current peak window. */
-  armTimer() {
-    this.clearTimer();
-    if (this.#disposed || this.#held.size === 0) return;
-    const nowMs = this.#now();
-    const delayMs = nextResumeAt(nowMs) - nowMs;
-    if (!(delayMs > 0)) return;
-    const timer = { handle: void 0 };
-    timer.handle = this.#timers.schedule(() => {
-      if (this.#timer === timer) this.#timer = void 0;
-      this.onTimer();
-    }, clampBreakerTimerDelay(delayMs));
-    this.#timer = timer;
-  }
-  onTimer() {
-    if (this.#disposed || this.#held.size === 0) return;
-    if (isPeak(this.#now())) {
-      this.armTimer();
-      return;
-    }
-    for (const record of [...this.#held]) this.releaseRecord(record, false);
-  }
-  clearTimer() {
-    const timer = this.#timer;
-    if (timer === void 0) return;
-    this.#timer = void 0;
-    this.#timers.cancel(timer.handle);
-  }
-  releaseRecord(record, remember) {
-    if (!this.#held.delete(record)) return;
-    record.detach();
-    if (remember) this.markReleased(record.sessionId, record.turn);
-    record.resolve();
-    if (this.#held.size === 0) this.clearTimer();
-  }
-  markReleased(sessionId, turn) {
-    const key = `${sessionId}:${turn}`;
-    const state = this.#turns.get(key);
-    if (state !== void 0) {
-      state.released = true;
-      return;
-    }
-    this.rememberTurn(key, { user: false, released: true });
-  }
-  rememberTurn(key, state) {
-    if (this.#turns.size >= MAX_TRACKED_TURNS) {
-      const oldest = this.#turns.keys().next();
-      if (!oldest.done) this.#turns.delete(oldest.value);
-    }
-    this.#turns.set(key, state);
-  }
-};
-
-// src/breaker-settings.ts
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-var PLUGIN_LABEL = "dsh-usage-dashboard";
-var STORAGE_RELATIVE_PATH = join("storages", "dsh-usage-dashboard", "breaker.json");
-function breakerSettingsPath(env = process.env) {
-  const configured = env.DSH_HOME?.trim();
-  const home = configured !== void 0 && configured !== "" ? configured : join(homedir(), ".dsh");
-  return join(home, STORAGE_RELATIVE_PATH);
-}
-var errorText = (error) => error instanceof Error ? error.message : String(error);
-var defaultWarn = (message) => {
-  console.warn(message);
-};
-function settingsOf(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
-  const candidate = raw;
-  if (!Array.isArray(candidate.sessions)) return void 0;
-  if (candidate.enabled !== void 0 && typeof candidate.enabled !== "boolean") return void 0;
-  const ids = candidate.sessions.filter((entry) => typeof entry === "string");
-  return normalizeBreakerSettings({
-    enabled: candidate.enabled ?? true,
-    sessions: ids
-  });
-}
-async function loadBreakerSettings(options = {}) {
-  const filePath = options.filePath ?? breakerSettingsPath();
-  const warn = options.warn ?? defaultWarn;
-  let text;
-  try {
-    text = await readFile(filePath, "utf8");
-  } catch (error) {
-    const code = error.code;
-    if (code !== "ENOENT") {
-      warn(`[${PLUGIN_LABEL}] \u8BFB\u53D6\u9AD8\u5CF0\u6682\u505C\u8BBE\u7F6E\u5931\u8D25\uFF0C\u6309\u9ED8\u8BA4\u503C\u5904\u7406\uFF1A${errorText(error)}`);
-    }
-    return { ...BREAKER_DEFAULT_SETTINGS };
-  }
-  let raw;
-  try {
-    raw = JSON.parse(text);
-  } catch (error) {
-    warn(`[${PLUGIN_LABEL}] \u9AD8\u5CF0\u6682\u505C\u8BBE\u7F6E\u4E0D\u662F\u5408\u6CD5 JSON\uFF0C\u6309\u9ED8\u8BA4\u503C\u5904\u7406\uFF1A${errorText(error)}`);
-    return { ...BREAKER_DEFAULT_SETTINGS };
-  }
-  const settings = settingsOf(raw);
-  if (settings === void 0) {
-    warn(`[${PLUGIN_LABEL}] \u9AD8\u5CF0\u6682\u505C\u8BBE\u7F6E\u7ED3\u6784\u4E0D\u5408\u6CD5\uFF0C\u6309\u9ED8\u8BA4\u503C\u5904\u7406`);
-    return { ...BREAKER_DEFAULT_SETTINGS };
-  }
-  return settings;
-}
-async function saveBreakerSettings(settings, options = {}) {
-  const filePath = options.filePath ?? breakerSettingsPath();
-  const normalized = normalizeBreakerSettings(settings);
-  await mkdir(dirname(filePath), { recursive: true });
-  const tempPath = `${filePath}.${process.pid}.${Date.now().toString(36)}.tmp`;
-  try {
-    await writeFile(tempPath, `${JSON.stringify(normalized, null, 2)}
-`, "utf8");
-    await rename(tempPath, filePath);
-  } catch (error) {
-    await rm(tempPath, { force: true }).catch(() => {
-    });
-    throw error;
-  }
-}
-
-// src/memo.ts
-function memoize(ttlMs, compute) {
-  const state = { entry: void 0, inflight: void 0 };
-  const run = () => {
-    if (state.inflight !== void 0) return state.inflight;
-    const task = compute().then(
-      (value) => {
-        state.inflight = void 0;
-        if (value.ok) state.entry = { value, setAt: Date.now() };
-        return value;
-      },
-      (err) => {
-        state.inflight = void 0;
-        throw err;
-      }
-    );
-    state.inflight = task;
-    return task;
-  };
-  return {
-    get: () => {
-      const hit = state.entry;
-      if (hit !== void 0 && hit.value.ok && Date.now() - hit.setAt < ttlMs) {
-        return Promise.resolve(hit.value);
-      }
-      return run();
-    },
-    refresh: () => run()
-  };
-}
-
-// src/trust-fence.ts
-function isLoopbackHostname(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-}
-function isTrustedApiRequest(req) {
-  const host = req.headers.host;
-  if (host === void 0) return false;
-  let hostUrl;
-  try {
-    hostUrl = new URL(`http://${host}`);
-  } catch {
-    return false;
-  }
-  if (!isLoopbackHostname(hostUrl.hostname)) return false;
-  if (req.headers["sec-fetch-site"] === "cross-site") return false;
-  const origin = req.headers.origin;
-  if (origin === void 0) return true;
-  try {
-    return new URL(origin).host === hostUrl.host;
-  } catch {
-    return false;
-  }
-}
-
 // src/usage.ts
 var pad2 = (n) => n < 10 ? `0${n}` : String(n);
 function errorMessage(err) {
@@ -1032,141 +743,9 @@ var name = "dsh-usage-dashboard";
 var inject = ["webServer", "credentials", "sessionPersistence"];
 var BALANCE_TTL_MS = 6e4;
 var USAGE_TTL_MS = 5 * 6e4;
-var BREAKER_BODY_LIMIT_BYTES = 8 * 1024;
-var NO_STORE = { "cache-control": "no-store" };
-var errorText2 = (error) => error instanceof Error ? error.message : String(error);
-async function readBody(req, limit) {
-  const chunks = [];
-  let size = 0;
-  try {
-    for await (const chunk of req) {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      size += buffer.length;
-      if (size > limit) {
-        req.resume();
-        return { kind: "too-large" };
-      }
-      chunks.push(buffer);
-    }
-  } catch {
-    return { kind: "unreadable" };
-  }
-  return { kind: "ok", text: Buffer.concat(chunks).toString("utf8") };
-}
-function apply(ctx, options = {}) {
+function apply(ctx) {
   const balanceMemo = memoize(BALANCE_TTL_MS, () => fetchBalance(ctx.credentials, ctx.get("deepseekAccount")));
   const usageMemo = memoize(USAGE_TTL_MS, () => fetchUsage(ctx.sessionPersistence));
-  const seams = options ?? {};
-  const warn = seams.warn ?? ((message) => {
-    console.warn(message);
-  });
-  const now = seams.now ?? Date.now;
-  const settingsFile = seams.settingsFile ?? breakerSettingsPath();
-  const gate = new BreakerGate({ now, timers: seams.timers });
-  let settingsTouched = false;
-  void loadBreakerSettings({ filePath: settingsFile, warn }).then((settings) => {
-    if (!settingsTouched) gate.update(settings);
-  }).catch((error) => {
-    warn(`[${name}] \u9AD8\u5CF0\u6682\u505C\u8BBE\u7F6E\u52A0\u8F7D\u5931\u8D25\uFF0C\u6309\u9ED8\u8BA4\u503C\u5904\u7406\uFF1A${errorText2(error)}`);
-  });
-  const projection = () => breakerProject(gate.settings, now(), gate.heldSessions);
-  const hostEvents = ctx;
-  ctx.effect(() => {
-    const dispose = hostEvents.on("agent/pre-step", async (payload, next) => {
-      try {
-        await gate.hold(payload.agent?.id, payload.turn, payload.messages, payload.signal);
-      } catch (error) {
-        warn(`[${name}] \u9AD8\u5CF0\u6682\u505C\u6302\u8D77\u5931\u8D25\uFF0C\u672C\u6B21 step \u76F4\u63A5\u653E\u884C\uFF1A${errorText2(error)}`);
-      }
-      return next();
-    });
-    return () => {
-      dispose();
-      gate.dispose();
-    };
-  }, "dsh-usage-dashboard: \u9AD8\u5CF0\u6682\u505C");
-  const writeSettings = async (req, res) => {
-    const body = await readBody(req, BREAKER_BODY_LIMIT_BYTES);
-    if (body.kind === "too-large") {
-      writeJson(res, 413, { ok: false, error: "\u8BF7\u6C42\u4F53\u8D85\u8FC7 8KB \u9650\u5236" }, NO_STORE);
-      return;
-    }
-    if (body.kind === "unreadable") {
-      writeJson(res, 400, { ok: false, error: "\u65E0\u6CD5\u8BFB\u53D6\u8BF7\u6C42\u4F53" }, NO_STORE);
-      return;
-    }
-    let raw;
-    try {
-      raw = JSON.parse(body.text);
-    } catch {
-      writeJson(res, 400, { ok: false, error: "\u8BF7\u6C42\u4F53\u4E0D\u662F\u5408\u6CD5 JSON" }, NO_STORE);
-      return;
-    }
-    if (!isBreakerSettingsRequest(raw)) {
-      writeJson(res, 400, { ok: false, error: "\u8BF7\u6C42\u4F53\u5FC5\u987B\u662F\u5408\u6CD5\u7684\u5F00\u5173\u8BF7\u6C42" }, NO_STORE);
-      return;
-    }
-    const previous = gate.settings;
-    let next;
-    if (raw.sessionId === void 0) {
-      next = normalizeBreakerSettings({ enabled: raw.enabled, sessions: previous.sessions });
-    } else {
-      const sessions = new Set(previous.sessions);
-      if (raw.enabled) sessions.add(raw.sessionId);
-      else sessions.delete(raw.sessionId);
-      next = normalizeBreakerSettings({ enabled: previous.enabled, sessions: [...sessions] });
-    }
-    settingsTouched = true;
-    gate.update(next);
-    try {
-      await saveBreakerSettings(next, { filePath: settingsFile });
-    } catch (error) {
-      gate.update(previous);
-      warn(`[${name}] \u9AD8\u5CF0\u6682\u505C\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25\uFF0C\u5DF2\u56DE\u9000\uFF1A${errorText2(error)}`);
-      writeJson(res, 500, { ok: false, error: "\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25" }, NO_STORE);
-      return;
-    }
-    writeJson(res, 200, { ok: true, data: projection() }, NO_STORE);
-  };
-  const releaseHeld = async (req, res) => {
-    const body = await readBody(req, BREAKER_BODY_LIMIT_BYTES);
-    if (body.kind === "too-large") {
-      writeJson(res, 413, { ok: false, error: "\u8BF7\u6C42\u4F53\u8D85\u8FC7 8KB \u9650\u5236" }, NO_STORE);
-      return;
-    }
-    if (body.kind === "unreadable") {
-      writeJson(res, 400, { ok: false, error: "\u65E0\u6CD5\u8BFB\u53D6\u8BF7\u6C42\u4F53" }, NO_STORE);
-      return;
-    }
-    let target;
-    if (body.text.trim() !== "") {
-      let raw;
-      try {
-        raw = JSON.parse(body.text);
-      } catch {
-        writeJson(res, 400, { ok: false, error: "\u8BF7\u6C42\u4F53\u4E0D\u662F\u5408\u6CD5 JSON" }, NO_STORE);
-        return;
-      }
-      if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        writeJson(res, 400, { ok: false, error: "\u8BF7\u6C42\u4F53\u5FC5\u987B\u662F JSON \u5BF9\u8C61" }, NO_STORE);
-        return;
-      }
-      const candidate = raw;
-      if (Object.keys(candidate).some((key) => key !== "sessionId")) {
-        writeJson(res, 400, { ok: false, error: "\u8BF7\u6C42\u5B57\u6BB5\u4E0D\u5408\u6CD5" }, NO_STORE);
-        return;
-      }
-      if (candidate.sessionId !== void 0) {
-        if (typeof candidate.sessionId !== "string" || !isValidSessionId(candidate.sessionId)) {
-          writeJson(res, 400, { ok: false, error: "\u4F1A\u8BDD id \u683C\u5F0F\u4E0D\u5408\u6CD5" }, NO_STORE);
-          return;
-        }
-        target = candidate.sessionId;
-      }
-    }
-    gate.release(target);
-    writeJson(res, 200, { ok: true, data: projection() }, NO_STORE);
-  };
   ctx.effect(() => ctx.webServer.register({
     kind: "prefix",
     path: "/api/dsh-usage-dashboard",
@@ -1175,38 +754,12 @@ function apply(ctx, options = {}) {
         writeJson(res, 403, { ok: false, error: "forbidden" });
         return;
       }
-      const url = new URL(req.url ?? "/", "http://dsh.internal");
-      const pathname = url.pathname;
-      const method = req.method ?? "GET";
-      if (pathname === BREAKER_API.state) {
-        if (method === "GET") {
-          writeJson(res, 200, { ok: true, data: projection() }, NO_STORE);
-          return;
-        }
-        if (method === "PUT") {
-          await writeSettings(req, res);
-          return;
-        }
-        writeJson(res, 405, { ok: false, error: "method not allowed" }, { ...NO_STORE, allow: "GET, PUT" });
-        return;
-      }
-      if (pathname === BREAKER_API.release) {
-        if (method === "POST") {
-          await releaseHeld(req, res);
-          return;
-        }
-        writeJson(res, 405, { ok: false, error: "method not allowed" }, { ...NO_STORE, allow: "POST" });
-        return;
-      }
-      const knownReadPath = pathname === "/api/dsh-usage-dashboard/balance" || pathname === "/api/dsh-usage-dashboard/usage" || pathname === "/api/dsh-usage-dashboard/session";
-      if (!knownReadPath) {
-        writeJson(res, 404, { ok: false, error: "not found" });
-        return;
-      }
-      if (method !== "GET") {
+      if (req.method !== "GET") {
         writeJson(res, 405, { ok: false, error: "method not allowed" });
         return;
       }
+      const url = new URL(req.url ?? "/", "http://dsh.internal");
+      const pathname = url.pathname;
       const force = url.searchParams.get("refresh") === "1";
       if (pathname === "/api/dsh-usage-dashboard/balance") {
         const payload = await (force ? balanceMemo.refresh() : balanceMemo.get());
@@ -1225,6 +778,8 @@ function apply(ctx, options = {}) {
         }
         const payload = await fetchSessionUsage(ctx.sessionPersistence, id);
         writeJson(res, 200, payload, { "cache-control": "no-store" });
+      } else {
+        writeJson(res, 404, { ok: false, error: "not found" });
       }
     }
   }), "dsh-usage-dashboard: /api routes");