@jonnyhoo/ccs 1.0.0

package/dist/cliproxy/proxy-detector.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * Unified Proxy Detector
+ *
+ * Single source of truth for CLIProxy detection.
+ * Uses multiple detection methods with fallbacks:
+ * 1. HTTP health check (most reliable, ~1s timeout)
+ * 2. Session lock file (sessions.json)
+ * 3. Port process detection (fallback for orphaned proxies)
+ *
+ * Detection Order Rationale:
+ * - HTTP first: Fastest verification that proxy is responsive
+ * - Session lock second: Catches proxies that are starting up
+ * - Port process third: Handles orphaned proxies and Windows PID-XXXXX case
+ *
+ * Solves race conditions between cliproxy-executor.ts and service-manager.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reclaimOrphanedProxy = exports.waitForProxyHealthy = exports.detectRunningProxy = void 0;
+const session_tracker_1 = require("./session-tracker");
+const stats_fetcher_1 = require("./stats-fetcher");
+const port_utils_1 = require("../utils/port-utils");
+const config_generator_1 = require("./config-generator");
+/** No-op logger for when verbose is disabled */
+const noopLog = () => { };
+/**
+ * Detect running CLIProxy using multiple methods with fallbacks.
+ *
+ * Detection order (most reliable first):
+ * 1. HTTP health check - fastest, verifies proxy is responsive
+ * 2. Session lock - checks sessions.json for tracked proxy
+ * 3. Port process - checks OS-level port ownership
+ *
+ * @param port Port to check (default: 8317)
+ * @param verbose Enable verbose logging (default: false)
+ * @returns ProxyStatus with detection details
+ */
+async function detectRunningProxy(port = config_generator_1.CLIPROXY_DEFAULT_PORT, verbose = false) {
+    const log = verbose ? (msg) => console.error(`[proxy-detector] ${msg}`) : noopLog;
+    // Validate port - fallback to default if invalid
+    const validPort = port && Number.isFinite(port) && port >= 1 && port <= 65535 ? port : config_generator_1.CLIPROXY_DEFAULT_PORT;
+    log(`Detecting proxy on port ${validPort}...`);
+    // 1. First: HTTP health check (fastest, most reliable)
+    log('Trying HTTP health check...');
+    const healthy = await (0, stats_fetcher_1.isCliproxyRunning)(validPort);
+    if (healthy) {
+        // Proxy is running and responsive
+        // Try to get PID from session lock if available
+        const lock = (0, session_tracker_1.getExistingProxy)(validPort);
+        let pid = lock?.pid;
+        // If no PID from session lock, try port-process detection
+        // This handles orphaned proxies (running but no sessions.json)
+        if (!pid) {
+            log('No PID from session lock, checking port process...');
+            const portProcess = await (0, port_utils_1.getPortProcess)(validPort);
+            if (portProcess) {
+                pid = portProcess.pid;
+                log(`Got PID from port process: ${pid}`);
+            }
+        }
+        // Get version from session lock
+        const runningVersion = (0, session_tracker_1.getRunningProxyVersion)(validPort);
+        log(`HTTP check passed, proxy healthy (PID: ${pid ?? 'unknown'}, version: ${runningVersion ?? 'unknown'})`);
+        return {
+            running: true,
+            verified: true,
+            method: 'http',
+            pid,
+            sessionCount: lock?.sessions?.length,
+            version: runningVersion ?? undefined,
+        };
+    }
+    log('HTTP check failed, proxy not responding');
+    // 2. Second: Check session lock file
+    log('Checking session lock file...');
+    const lock = (0, session_tracker_1.getExistingProxy)(validPort);
+    if (lock) {
+        // Session lock exists - proxy might be starting up
+        // The lock validates PID is running, so proxy exists but not ready
+        const lockVersion = (0, session_tracker_1.getRunningProxyVersion)(validPort);
+        log(`Session lock found: PID ${lock.pid}, ${lock.sessions.length} sessions, version: ${lockVersion ?? 'unknown'}`);
+        return {
+            running: true,
+            verified: false,
+            method: 'session-lock',
+            pid: lock.pid,
+            sessionCount: lock.sessions.length,
+            version: lockVersion ?? undefined,
+        };
+    }
+    log('No session lock found');
+    // 3. Third: Check port process (fallback for orphaned/untracked proxy)
+    log('Checking port process...');
+    const portProcess = await (0, port_utils_1.getPortProcess)(validPort);
+    if (portProcess) {
+        log(`Port occupied by: ${portProcess.processName} (PID ${portProcess.pid})`);
+        // Check by process name first (works on Linux/macOS, may fail on Windows)
+        if ((0, port_utils_1.isCLIProxyProcess)(portProcess)) {
+            log('Process name matches CLIProxy, retrying HTTP...');
+            // Looks like CLIProxy by name - verify with HTTP
+            const retryHealth = await (0, stats_fetcher_1.isCliproxyRunning)(validPort);
+            if (retryHealth) {
+                log('HTTP retry passed, proxy is healthy');
+                return {
+                    running: true,
+                    verified: true,
+                    method: 'http-retry',
+                    pid: portProcess.pid,
+                };
+            }
+            // CLIProxy by name but not responding - might be starting up
+            log('HTTP retry failed, proxy starting up or unresponsive');
+            return {
+                running: true,
+                verified: false,
+                method: 'port-process',
+                pid: portProcess.pid,
+            };
+        }
+        // Process name doesn't match (or Windows returned PID-XXXXX)
+        // Do one more HTTP check to be sure it's not ours
+        log('Process name unrecognized, final HTTP check (Windows PID-XXXXX case)...');
+        const finalHealthCheck = await (0, stats_fetcher_1.isCliproxyRunning)(validPort);
+        if (finalHealthCheck) {
+            // It IS our proxy, just with unrecognized name (Windows case)
+            log('Final HTTP check passed, reclaiming proxy with unrecognized name');
+            return {
+                running: true,
+                verified: true,
+                method: 'http-retry',
+                pid: portProcess.pid,
+            };
+        }
+        // Definitely not our proxy - port is blocked
+        log(`Port blocked by non-CLIProxy process: ${portProcess.processName}`);
+        return {
+            running: false,
+            verified: false,
+            blocked: true,
+            blocker: portProcess,
+        };
+    }
+    // Port is free
+    log('Port is free, no proxy detected');
+    return {
+        running: false,
+        verified: false,
+    };
+}
+exports.detectRunningProxy = detectRunningProxy;
+/**
+ * Wait for proxy to become ready (healthy via HTTP).
+ * Useful after detecting proxy via session-lock or port-process.
+ *
+ * @param port Port to check
+ * @param timeout Max wait time in ms (default: 5000)
+ * @param pollInterval Time between checks in ms (default: 100)
+ * @returns true if proxy became ready, false if timeout
+ */
+async function waitForProxyHealthy(port, timeout = 5000, pollInterval = 100) {
+    const start = Date.now();
+    while (Date.now() - start < timeout) {
+        const healthy = await (0, stats_fetcher_1.isCliproxyRunning)(port);
+        if (healthy) {
+            return true;
+        }
+        await new Promise((r) => setTimeout(r, pollInterval));
+    }
+    return false;
+}
+exports.waitForProxyHealthy = waitForProxyHealthy;
+/**
+ * Attempt to reclaim an orphaned CLIProxy (running but not in session tracker).
+ * Registers a new session with the detected proxy.
+ *
+ * @param port Port where proxy is running
+ * @param pid PID of the proxy process
+ * @param verbose Enable verbose logging (default: false)
+ * @returns Session ID if reclaimed, null if failed
+ */
+function reclaimOrphanedProxy(port, pid, verbose = false) {
+    const log = verbose ? (msg) => console.error(`[proxy-detector] ${msg}`) : noopLog;
+    try {
+        log(`Reclaiming orphaned proxy: port=${port}, pid=${pid}`);
+        const sessionId = (0, session_tracker_1.registerSession)(port, pid);
+        log(`Successfully reclaimed proxy, session ID: ${sessionId}`);
+        return sessionId;
+    }
+    catch (err) {
+        const error = err;
+        log(`Failed to reclaim proxy: ${error.message}`);
+        return null;
+    }
+}
+exports.reclaimOrphanedProxy = reclaimOrphanedProxy;
+//# sourceMappingURL=proxy-detector.js.map

package/dist/cliproxy/proxy-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-detector.js","sourceRoot":"","sources":["../../src/cliproxy/proxy-detector.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,uDAA8F;AAC9F,mDAAoD;AACpD,oDAAqF;AACrF,yDAA2D;AA4B3D,gDAAgD;AAChD,MAAM,OAAO,GAAU,GAAG,EAAE,GAAE,CAAC,CAAC;AAEhC;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAe,wCAAqB,EACpC,UAAmB,KAAK;IAExB,MAAM,GAAG,GAAU,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAEzF,iDAAiD;IACjD,MAAM,SAAS,GACb,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wCAAqB,CAAC;IAE7F,GAAG,CAAC,2BAA2B,SAAS,KAAK,CAAC,CAAC;IAE/C,uDAAuD;IACvD,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAiB,EAAC,SAAS,CAAC,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,kCAAkC;QAClC,gDAAgD;QAChD,MAAM,IAAI,GAAG,IAAA,kCAAgB,EAAC,SAAS,CAAC,CAAC;QACzC,IAAI,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QAEpB,0DAA0D;QAC1D,+DAA+D;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,MAAM,IAAA,2BAAc,EAAC,SAAS,CAAC,CAAC;YACpD,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC;gBACtB,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,IAAA,wCAAsB,EAAC,SAAS,CAAC,CAAC;QAEzD,GAAG,CACD,0CAA0C,GAAG,IAAI,SAAS,cAAc,cAAc,IAAI,SAAS,GAAG,CACvG,CAAC;QACF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM;YACd,GAAG;YACH,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM;YACpC,OAAO,EAAE,cAAc,IAAI,SAAS;SACrC,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAE/C,qCAAqC;IACrC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAA,kCAAgB,EAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,mDAAmD;QACnD,mEAAmE;QACnE,MAAM,WAAW,GAAG,IAAA,wCAAsB,EAAC,SAAS,CAAC,CAAC;QACtD,GAAG,CACD,2BAA2B,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,uBAAuB,WAAW,IAAI,SAAS,EAAE,CAC9G,CAAC;QACF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,cAAc;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAClC,OAAO,EAAE,WAAW,IAAI,SAAS;SAClC,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAE7B,uEAAuE;IACvE,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,IAAA,2BAAc,EAAC,SAAS,CAAC,CAAC;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,WAAW,CAAC,WAAW,SAAS,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC;QAE7E,0EAA0E;QAC1E,IAAI,IAAA,8BAAiB,EAAC,WAAW,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACvD,iDAAiD;YACjD,MAAM,WAAW,GAAG,MAAM,IAAA,iCAAiB,EAAC,SAAS,CAAC,CAAC;YACvD,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBAC3C,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,YAAY;oBACpB,GAAG,EAAE,WAAW,CAAC,GAAG;iBACrB,CAAC;YACJ,CAAC;YACD,6DAA6D;YAC7D,GAAG,CAAC,sDAAsD,CAAC,CAAC;YAC5D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,cAAc;gBACtB,GAAG,EAAE,WAAW,CAAC,GAAG;aACrB,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,kDAAkD;QAClD,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAC/E,MAAM,gBAAgB,GAAG,MAAM,IAAA,iCAAiB,EAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,gBAAgB,EAAE,CAAC;YACrB,8DAA8D;YAC9D,GAAG,CAAC,kEAAkE,CAAC,CAAC;YACxE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,YAAY;gBACpB,GAAG,EAAE,WAAW,CAAC,GAAG;aACrB,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,GAAG,CAAC,yCAAyC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;IAED,eAAe;IACf,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACvC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAnID,gDAmIC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,UAAkB,IAAI,EACtB,eAAuB,GAAG;IAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAiB,EAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAhBD,kDAgBC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,IAAY,EACZ,GAAW,EACX,UAAmB,KAAK;IAExB,MAAM,GAAG,GAAU,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAEzF,IAAI,CAAC;QACH,GAAG,CAAC,mCAAmC,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,GAAG,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAY,CAAC;QAC3B,GAAG,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAjBD,oDAiBC"}

package/dist/cliproxy/proxy-target-resolver.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Proxy Target Resolver
+ *
+ * Determines whether CLIProxyAPI requests should go to local or remote
+ * based on unified config. Used by stats-fetcher, auth-routes, and UI.
+ */
+/** Resolved proxy target for making requests */
+export interface ProxyTarget {
+    /** Target hostname or IP */
+    host: string;
+    /** Target port */
+    port: number;
+    /** Protocol (http/https) */
+    protocol: 'http' | 'https';
+    /** Optional auth token for API endpoints - only send header if defined and non-empty */
+    authToken?: string;
+    /** Optional management key for management API endpoints (/v0/management/*) */
+    managementKey?: string;
+    /** True if targeting remote server, false if local */
+    isRemote: boolean;
+}
+/**
+ * Get the current CLIProxyAPI target based on unified config.
+ * Returns remote server config if enabled, otherwise localhost.
+ */
+export declare function getProxyTarget(): ProxyTarget;
+/**
+ * Build URL for proxy endpoint
+ * @param target Resolved proxy target
+ * @param path Endpoint path (e.g., '/v0/management/usage')
+ */
+export declare function buildProxyUrl(target: ProxyTarget, path: string): string;
+/**
+ * Build request headers for proxy requests
+ * Handles optional auth token - only adds Authorization header if token is set.
+ *
+ * @param target Resolved proxy target
+ * @param additionalHeaders Extra headers to merge
+ */
+export declare function buildProxyHeaders(target: ProxyTarget, additionalHeaders?: Record<string, string>): Record<string, string>;
+/**
+ * Build request headers for management API endpoints (/v0/management/*).
+ * For remote targets: uses management_key, falls back to authToken.
+ * For local targets: uses the effective management secret from CCS config.
+ *
+ * @param target Resolved proxy target
+ * @param additionalHeaders Extra headers to merge
+ */
+export declare function buildManagementHeaders(target: ProxyTarget, additionalHeaders?: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=proxy-target-resolver.d.ts.map

package/dist/cliproxy/proxy-target-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-target-resolver.d.ts","sourceRoot":"","sources":["../../src/cliproxy/proxy-target-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CA4B5C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,iBAAiB,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,iBAAiB,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxB"}

package/dist/cliproxy/proxy-target-resolver.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * Proxy Target Resolver
+ *
+ * Determines whether CLIProxyAPI requests should go to local or remote
+ * based on unified config. Used by stats-fetcher, auth-routes, and UI.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildManagementHeaders = exports.buildProxyHeaders = exports.buildProxyUrl = exports.getProxyTarget = void 0;
+const unified_config_loader_1 = require("../config/unified-config-loader");
+const config_generator_1 = require("./config-generator");
+const auth_token_manager_1 = require("./auth-token-manager");
+/**
+ * Load cliproxy_server configuration from unified config.
+ * Returns undefined if not configured.
+ */
+function loadCliproxyServerConfig() {
+    const config = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
+    return config.cliproxy_server;
+}
+/**
+ * Get the current CLIProxyAPI target based on unified config.
+ * Returns remote server config if enabled, otherwise localhost.
+ */
+function getProxyTarget() {
+    const config = loadCliproxyServerConfig();
+    if (config?.remote?.enabled && config.remote?.host) {
+        // Normalize protocol (handles case sensitivity and invalid values)
+        const protocol = (0, config_generator_1.normalizeProtocol)(config.remote.protocol);
+        // Validate port (returns undefined for invalid, triggering default)
+        const validatedPort = (0, config_generator_1.validateRemotePort)(config.remote.port);
+        const port = validatedPort ?? (0, config_generator_1.getRemoteDefaultPort)(protocol);
+        return {
+            host: config.remote.host,
+            port,
+            protocol,
+            authToken: config.remote.auth_token || undefined, // Empty string -> undefined
+            managementKey: config.remote.management_key || undefined, // Empty string -> undefined
+            isRemote: true,
+        };
+    }
+    const localPort = config?.local?.port ?? config_generator_1.CLIPROXY_DEFAULT_PORT;
+    return {
+        host: '127.0.0.1',
+        port: localPort,
+        protocol: 'http',
+        isRemote: false,
+    };
+}
+exports.getProxyTarget = getProxyTarget;
+/**
+ * Build URL for proxy endpoint
+ * @param target Resolved proxy target
+ * @param path Endpoint path (e.g., '/v0/management/usage')
+ */
+function buildProxyUrl(target, path) {
+    // Normalize path to ensure leading slash
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+    return `${target.protocol}://${target.host}:${target.port}${normalizedPath}`;
+}
+exports.buildProxyUrl = buildProxyUrl;
+/**
+ * Build request headers for proxy requests
+ * Handles optional auth token - only adds Authorization header if token is set.
+ *
+ * @param target Resolved proxy target
+ * @param additionalHeaders Extra headers to merge
+ */
+function buildProxyHeaders(target, additionalHeaders = {}) {
+    const headers = {
+        Accept: 'application/json',
+        ...additionalHeaders,
+    };
+    // Only add auth header if token is configured
+    if (target.authToken) {
+        headers['Authorization'] = `Bearer ${target.authToken}`;
+    }
+    return headers;
+}
+exports.buildProxyHeaders = buildProxyHeaders;
+/**
+ * Build request headers for management API endpoints (/v0/management/*).
+ * For remote targets: uses management_key, falls back to authToken.
+ * For local targets: uses the effective management secret from CCS config.
+ *
+ * @param target Resolved proxy target
+ * @param additionalHeaders Extra headers to merge
+ */
+function buildManagementHeaders(target, additionalHeaders = {}) {
+    const headers = {
+        Accept: 'application/json',
+        ...additionalHeaders,
+    };
+    // Remote: use configured management key or auth token
+    // Local: use CCS management secret (default: 'ccs')
+    const authKey = target.isRemote
+        ? (target.managementKey ?? target.authToken)
+        : (0, auth_token_manager_1.getEffectiveManagementSecret)();
+    if (authKey) {
+        headers['Authorization'] = `Bearer ${authKey}`;
+    }
+    return headers;
+}
+exports.buildManagementHeaders = buildManagementHeaders;
+//# sourceMappingURL=proxy-target-resolver.js.map

package/dist/cliproxy/proxy-target-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-target-resolver.js","sourceRoot":"","sources":["../../src/cliproxy/proxy-target-resolver.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,2EAA4E;AAE5E,yDAK4B;AAC5B,6DAAoE;AAkBpE;;;GAGG;AACH,SAAS,wBAAwB;IAC/B,MAAM,MAAM,GAAG,IAAA,iDAAyB,GAAE,CAAC;IAC3C,OAAO,MAAM,CAAC,eAAe,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc;IAC5B,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACnD,mEAAmE;QACnE,MAAM,QAAQ,GAAG,IAAA,oCAAiB,EAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,oEAAoE;QACpE,MAAM,aAAa,GAAG,IAAA,qCAAkB,EAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,aAAa,IAAI,IAAA,uCAAoB,EAAC,QAAQ,CAAC,CAAC;QAE7D,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE,4BAA4B;YAC9E,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,SAAS,EAAE,4BAA4B;YACtF,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,wCAAqB,CAAC;IAE/D,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AA5BD,wCA4BC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,MAAmB,EAAE,IAAY;IAC7D,yCAAyC;IACzC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAChE,OAAO,GAAG,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;AAC/E,CAAC;AAJD,sCAIC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,MAAmB,EACnB,oBAA4C,EAAE;IAE9C,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,GAAG,iBAAiB;KACrB,CAAC;IAEF,8CAA8C;IAC9C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAfD,8CAeC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,MAAmB,EACnB,oBAA4C,EAAE;IAE9C,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,GAAG,iBAAiB;KACrB,CAAC;IAEF,sDAAsD;IACtD,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ;QAC7B,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,CAAC;QAC5C,CAAC,CAAC,IAAA,iDAA4B,GAAE,CAAC;IAEnC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AApBD,wDAoBC"}

package/dist/cliproxy/quota-fetcher-codex.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Quota Fetcher for Codex (ChatGPT) Accounts
+ *
+ * Fetches quota information from ChatGPT backend API.
+ * Used for displaying rate limit windows and reset times.
+ */
+import type { CodexQuotaResult, CodexQuotaWindow } from './quota-types';
+/** Auth data extracted from Codex auth file */
+interface CodexAuthData {
+    accessToken: string;
+    accountId: string;
+    isExpired: boolean;
+    expiresAt: string | null;
+}
+/** Raw API response structure */
+interface CodexUsageResponse {
+    plan_type?: string;
+    planType?: string;
+    rate_limit?: CodexRateLimitWindow;
+    rateLimit?: CodexRateLimitWindow;
+    code_review_rate_limit?: CodexRateLimitWindow;
+    codeReviewRateLimit?: CodexRateLimitWindow;
+}
+/** Rate limit window from API */
+interface CodexRateLimitWindow {
+    primary_window?: CodexWindowData;
+    primaryWindow?: CodexWindowData;
+    secondary_window?: CodexWindowData;
+    secondaryWindow?: CodexWindowData;
+}
+/** Individual window data */
+interface CodexWindowData {
+    used_percent?: number;
+    usedPercent?: number;
+    reset_after_seconds?: number | null;
+    resetAfterSeconds?: number | null;
+}
+/**
+ * Read auth data from Codex auth file
+ */
+declare function readCodexAuthData(accountId: string): CodexAuthData | null;
+/**
+ * Build CodexQuotaWindow array from API response
+ * Handles both snake_case and camelCase field names
+ */
+declare function buildCodexQuotaWindows(payload: CodexUsageResponse): CodexQuotaWindow[];
+/**
+ * Fetch quota for a single Codex account
+ *
+ * @param accountId - Account identifier (email)
+ * @param verbose - Show detailed diagnostics
+ * @returns Quota result with windows and percentages
+ */
+export declare function fetchCodexQuota(accountId: string, verbose?: boolean): Promise<CodexQuotaResult>;
+/**
+ * Fetch quota for all Codex accounts
+ *
+ * @param verbose - Show detailed diagnostics
+ * @returns Array of account quotas
+ */
+export declare function fetchAllCodexQuotas(verbose?: boolean): Promise<{
+    account: string;
+    quota: CodexQuotaResult;
+}[]>;
+export { readCodexAuthData, buildCodexQuotaWindows };
+//# sourceMappingURL=quota-fetcher-codex.d.ts.map

package/dist/cliproxy/quota-fetcher-codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-fetcher-codex.d.ts","sourceRoot":"","sources":["../../src/cliproxy/quota-fetcher-codex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAWxE,+CAA+C;AAC/C,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,iCAAiC;AACjC,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,sBAAsB,CAAC,EAAE,oBAAoB,CAAC;IAC9C,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;CAC5C;AAED,iCAAiC;AACjC,UAAU,oBAAoB;IAC5B,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,6BAA6B;AAC7B,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;GAEG;AACH,iBAAS,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAkDlE;AAED;;;GAGG;AACH,iBAAS,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,gBAAgB,EAAE,CAmD/E;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,UAAQ,GACd,OAAO,CAAC,gBAAgB,CAAC,CAyJ3B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,UAAQ,GACd,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,EAAE,CAAC,CAezD;AAGD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC"}