@juspay/neurolink 12.7.3 → 12.7.5

package/dist/proxy/usageStats.js

@@ -8,6 +8,7 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, readdir, rename, rm, stat, } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { normalizeAnthropicAccountKey } from "./accountSelection.js";
 import { AsyncMutex } from "../utils/asyncMutex.js";
 import { redactUrlsInText, sanitizeForLog } from "../utils/logSanitize.js";
 import { writeJsonSnapshotAtomically } from "./snapshotPersistence.js";
@@ -63,6 +64,34 @@ function emptyTerminalErrorJournal(startedAt) {
         recent: [],
     };
 }
+/**
+ * Statistics must never use an email/label as their primary map key. One
+ * person can authenticate both provider pools with the same email, and a
+ * bare key silently merged their attempts, limits, and failures into one row.
+ *
+ * Keep non-account pseudo rows (passthrough, peer, internal) untouched. The
+ * display label remains separate so the CLI stays readable while persisted
+ * counters retain a collision-proof identity.
+ */
+function resolveStatsAccountIdentity(label, type) {
+    if (type === "codex-oauth") {
+        const key = label.startsWith("codex:") ? label : `codex:${label}`;
+        return {
+            key,
+            label: label.startsWith("codex:") ? label.slice("codex:".length) : label,
+        };
+    }
+    if (type === "oauth" || type === "api_key") {
+        const key = normalizeAnthropicAccountKey(label);
+        return {
+            key,
+            label: label.startsWith("anthropic:")
+                ? label.slice("anthropic:".length)
+                : label,
+        };
+    }
+    return { key: label, label };
+}
 function cloneTerminalErrorSummary(summary) {
     return { ...summary };
 }
@@ -152,6 +181,9 @@ function terminalErrorCategory(status, errorType) {
 }
 function createTerminalErrorSummary(args) {
     const { now, status, accountLabel, accountType, details } = args;
+    const accountIdentity = accountLabel && accountType
+        ? resolveStatsAccountIdentity(accountLabel, accountType)
+        : undefined;
     const errorType = clipTerminalErrorField(details?.errorType);
     const message = details?.message
         ? stripTerminalErrorControlCharacters(sanitizeForLog(redactUrlsInText(details.message), MAX_TERMINAL_ERROR_MESSAGE_LENGTH + MAX_TERMINAL_ERROR_FIELD_LENGTH))
@@ -170,6 +202,11 @@ function createTerminalErrorSummary(args) {
         ...(clipTerminalErrorField(accountLabel)
             ? { account: clipTerminalErrorField(accountLabel) }
             : {}),
+        ...(clipTerminalErrorField(details?.accountKey ?? accountIdentity?.key)
+            ? {
+                accountKey: clipTerminalErrorField(details?.accountKey ?? accountIdentity?.key),
+            }
+            : {}),
         ...(clipTerminalErrorField(accountType)
             ? { accountType: clipTerminalErrorField(accountType) }
             : {}),
@@ -201,7 +238,9 @@ function mergeAccountStats(left, right) {
     if (!left) {
         return cloneAccount(right);
     }
+    const key = right.key ?? left.key;
     return {
+        ...(key ? { key } : {}),
         label: right.label || left.label,
         type: right.type || left.type,
         attemptCount: left.attemptCount + right.attemptCount,
@@ -248,7 +287,9 @@ function validAccountStats(value) {
         return false;
     }
     const candidate = value;
-    return (typeof candidate.label === "string" &&
+    return ((candidate.key === undefined ||
+        (typeof candidate.key === "string" && candidate.key.length > 0)) &&
+        typeof candidate.label === "string" &&
         typeof candidate.type === "string" &&
         finiteNonNegativeInteger(candidate.attemptCount) &&
         finiteNonNegativeInteger(candidate.attemptErrorCount) &&
@@ -282,7 +323,7 @@ function validStats(value) {
         typeof candidate.accounts !== "object") {
         return false;
     }
-    return Object.entries(candidate.accounts).every(([label, account]) => validAccountStats(account) && label === account.label);
+    return Object.entries(candidate.accounts).every(([key, account]) => validAccountStats(account) && key === (account.key ?? account.label));
 }
 function validOptionalString(value, maxLength) {
     return (value === undefined ||
@@ -302,6 +343,7 @@ function validTerminalErrorSummary(value) {
         TERMINAL_ERROR_CATEGORIES.includes(candidate.category) &&
         validOptionalString(candidate.requestId, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.account, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
+        validOptionalString(candidate.accountKey, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.accountType, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.errorType, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.errorCode, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
@@ -615,8 +657,20 @@ export class ProxyUsageStatsStore {
     getStats() {
         return cloneStats(this.stats);
     }
-    getAccountStats(label) {
-        const account = this.stats.accounts[label];
+    getAccountStats(label, type) {
+        const direct = this.stats.accounts[label];
+        if (direct) {
+            return cloneAccount(direct);
+        }
+        const identity = type
+            ? resolveStatsAccountIdentity(label, type)
+            : undefined;
+        const account = identity
+            ? this.stats.accounts[identity.key]
+            : (() => {
+                const matches = Object.values(this.stats.accounts).filter((candidate) => candidate.label === label);
+                return matches.length === 1 ? matches[0] : undefined;
+            })();
         return account ? cloneAccount(account) : undefined;
     }
     getTerminalErrors() {
@@ -920,9 +974,11 @@ export class ProxyUsageStatsStore {
         }
     }
     ensureAccount(target, label, type) {
-        if (!target.accounts[label]) {
-            target.accounts[label] = {
-                label,
+        const identity = resolveStatsAccountIdentity(label, type);
+        if (!target.accounts[identity.key]) {
+            target.accounts[identity.key] = {
+                key: identity.key,
+                label: identity.label,
                 type,
                 attemptCount: 0,
                 attemptErrorCount: 0,
@@ -934,7 +990,7 @@ export class ProxyUsageStatsStore {
                 lastAttemptAt: 0,
             };
         }
-        return target.accounts[label];
+        return target.accounts[identity.key];
     }
     scheduleFlush() {
         if (!this.filePath || this.flushTimer) {
@@ -1131,8 +1187,8 @@ export async function getReconciledStats() {
 export async function getReconciledUsageSnapshot() {
     return defaultStore.reconcileUsageSnapshot();
 }
-export function getAccountStats(label) {
-    return defaultStore.getAccountStats(label);
+export function getAccountStats(label, type) {
+    return defaultStore.getAccountStats(label, type);
 }
 export function getTerminalErrors() {
     return defaultStore.getTerminalErrors();

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -65,7 +65,8 @@ declare function planCooldownFor429(quota: AccountQuota | null, retryAfterMs: nu
 declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: AccountQuota, now: number, policy?: ProxyOveragePolicy): ProxyQuotaCooldownUpdate;
 /**
  * Seed each account's runtime quota from the persisted snapshots in
- * ~/.neurolink/account-quotas.json (keyed by label). Runtime state is
+ * ~/.neurolink/account-quotas.json (keyed by provider-qualified account key).
+ * Runtime state is
  * in-memory only, so without this the quota-aware ordering is blind after a
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing

package/dist/server/routes/claudeProxyRoutes.js

@@ -15,7 +15,7 @@ import { join } from "node:path";
 import { Agent } from "undici";
 import { buildStableClaudeCodeBillingHeader, CLAUDE_CLI_USER_AGENT, CLAUDE_CODE_OAUTH_BETAS, getOrCreateClaudeCodeIdentity, parseClaudeCodeUserId, } from "../../auth/anthropicOAuth.js";
 import { clearAccountCooldown, loadAccountCooldowns, saveAccountCooldown, } from "../../proxy/accountCooldown.js";
-import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
+import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
 import { getUnifiedRateLimitStatus, isQuotaOverageAvailable, loadAccountQuotas, mergeQuotaSnapshot, modelFamilyToken, parseQuotaHeaders, saveAccountQuota, } from "../../proxy/accountQuota.js";
 import { fetchAccountUsage, listAnthropicAccountsForUsage, usageToQuota, } from "../../proxy/accountUsage.js";
 import { AccountQuotaRefreshCoordinator } from "../../proxy/accountQuotaRefreshCoordinator.js";
@@ -72,6 +72,30 @@ const BLOCKED_UPSTREAM_HEADERS = new Set([
 ]);
 const PROXY_INTERNAL_ACCOUNT_LABEL = "proxy/internal";
 const PROXY_INTERNAL_ACCOUNT_TYPE = "internal";
+function resolveRequestLogAccountIdentity(accountLabel, accountType) {
+    if (!accountLabel) {
+        return {};
+    }
+    if (accountType === "codex-oauth") {
+        return {
+            accountKey: accountLabel.startsWith("codex:")
+                ? accountLabel
+                : `codex:${accountLabel}`,
+            provider: "openai",
+        };
+    }
+    if (accountType === "oauth" ||
+        accountType === "api_key" ||
+        accountType === "passthrough") {
+        return {
+            accountKey: accountType === "passthrough"
+                ? accountLabel
+                : normalizeAnthropicAccountKey(accountLabel),
+            provider: "anthropic",
+        };
+    }
+    return {};
+}
 // ---------------------------------------------------------------------------
 // Module-level state
 // ---------------------------------------------------------------------------
@@ -634,7 +658,8 @@ function reconcileCooldownFromQuota(state, quota, now, policy = overagePolicy) {
 }
 /**
  * Seed each account's runtime quota from the persisted snapshots in
- * ~/.neurolink/account-quotas.json (keyed by label). Runtime state is
+ * ~/.neurolink/account-quotas.json (keyed by provider-qualified account key).
+ * Runtime state is
  * in-memory only, so without this the quota-aware ordering is blind after a
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
@@ -652,8 +677,13 @@ async function seedRuntimeQuotasFromDisk(accounts) {
         const now = Date.now();
         for (const account of accounts) {
             const state = getOrCreateRuntimeState(account.key);
-            if (!state.quota && persistedQuotas[account.label]) {
-                state.quota = persistedQuotas[account.label];
+            if (!state.quota) {
+                // Before provider identity was introduced, Anthropic snapshots were
+                // written under the bare display label. Keep that reading as an
+                // upgrade bridge, but never write new data back under the ambiguous
+                // key: a Codex login can legitimately use the same email.
+                state.quota =
+                    persistedQuotas[account.key] ?? persistedQuotas[account.label];
             }
             const persistedCooldown = persistedCooldowns[account.key];
             if (persistedCooldown?.coolingUntil > now &&
@@ -708,7 +738,7 @@ async function applyAccountUsageResult(account, fetchResult, observedAt, prior)
             // Non-fatal: the next successful response will reconcile again.
         });
     }
-    await saveAccountQuota(account.label, quota).catch(() => {
+    await saveAccountQuota(account.key, quota).catch(() => {
         // Non-fatal: quota persistence is best-effort.
     });
     return quota;
@@ -759,7 +789,11 @@ async function refreshAccountLimits(options = {}) {
             key: account.key,
             type: account.type,
             status,
-            quota: quota ?? state?.quota ?? persisted[account.label] ?? null,
+            quota: quota ??
+                state?.quota ??
+                persisted[account.key] ??
+                persisted[account.label] ??
+                null,
         };
         if (error !== undefined) {
             result.error = error;
@@ -815,7 +849,7 @@ async function refreshAccountLimits(options = {}) {
                     results[index] = buildResult(account, "error", null, fetchResult.error);
                     continue;
                 }
-                const quota = await applyAccountUsageResult(account, fetchResult, refresh.startedAt, persisted[account.label] ?? null);
+                const quota = await applyAccountUsageResult(account, fetchResult, refresh.startedAt, persisted[account.key] ?? persisted[account.label] ?? null);
                 if (!quota) {
                     results[index] = buildResult(account, "error", null, "usage payload had no recognizable limit windows");
                     continue;
@@ -2832,7 +2866,7 @@ async function auditCompleteShareHeartbeat(grant, reportedCoins) {
         return { paused: false, detail: "no provisioned account recorded" };
     }
     const state = accountRuntimeState.get(`anthropic:${accountLabel}`);
-    const stats = getAccountStats(accountLabel);
+    const stats = getAccountStats(accountLabel, "oauth");
     const { verdict, shouldPause } = await recordAuditObservation({
         grantId: grant.id,
         accountLabel,
@@ -3453,6 +3487,7 @@ async function executeClaudeCodexFallback(args) {
         query: {},
         params: {},
         body: convertClaudeRequestToCodex(body, model),
+        metadata: { ...ctx.metadata, "neurolink.codexFallback": true },
         // Keep the child attribution isolated until its stream has passed
         // validation. A failed Codex attempt must not look like a served request.
         responseHeaders: {},
@@ -4059,7 +4094,7 @@ async function handleAnthropicSuccessfulResponse(args) {
                 // Non-fatal: the next successful response will reconcile again.
             });
         }
-        saveAccountQuota(account.label, quota).catch(() => {
+        saveAccountQuota(account.key, quota).catch(() => {
             // Non-fatal: quota persistence is best-effort
         });
     }
@@ -4725,7 +4760,7 @@ async function handleAnthropicSuccessfulNonStreamRetryResponse(args) {
                 // Non-fatal: the next successful response will reconcile again.
             });
         }
-        saveAccountQuota(account.label, retryQuota).catch((error) => {
+        saveAccountQuota(account.key, retryQuota).catch((error) => {
             logger.debug("[proxy] Failed to persist account quota after auth retry", {
                 account: account.label,
                 error: error instanceof Error ? error.message : String(error),
@@ -5016,7 +5051,7 @@ async function handleAnthropicAuthRetry(args) {
                     accountState.coolingReason = retryPlan.reason;
                 }
                 if (retryQuota429) {
-                    saveAccountQuota(account.label, retryQuota429).catch(() => {
+                    saveAccountQuota(account.key, retryQuota429).catch(() => {
                         // Non-fatal: routing already has the in-memory snapshot.
                     });
                 }
@@ -5580,9 +5615,13 @@ function createClaudeRequestRuntimeContext(args) {
             : status >= 400
                 ? PROXY_INTERNAL_ACCOUNT_TYPE
                 : undefined;
+        const finalAccountIdentity = resolveRequestLogAccountIdentity(finalAccountLabel, finalAccountType);
         if (status >= 400) {
             recordFinalError(status, finalAccountLabel, finalAccountType, {
                 requestId: ctx.requestId,
+                ...(finalAccountIdentity.accountKey
+                    ? { accountKey: finalAccountIdentity.accountKey }
+                    : {}),
                 errorType,
                 terminalOutcome: errorType === "client_cancelled"
                     ? "client_cancelled"
@@ -5606,7 +5645,13 @@ function createClaudeRequestRuntimeContext(args) {
             stream: !!body.stream,
             toolCount: Array.isArray(body.tools) ? body.tools.length : 0,
             account: finalAccountLabel ?? "",
+            ...(finalAccountIdentity.accountKey
+                ? { accountKey: finalAccountIdentity.accountKey }
+                : {}),
             accountType: finalAccountType ?? "",
+            ...(finalAccountIdentity.provider
+                ? { provider: finalAccountIdentity.provider }
+                : {}),
             ...buildClientAttribution(ctx.headers),
             responseStatus: status,
             responseTimeMs: Date.now() - requestStartTime,
@@ -5669,6 +5714,7 @@ function createClaudeRequestRuntimeContext(args) {
 function createAnthropicAttemptLogger(args) {
     const { ctx, body, toolCount, requestStart, tracer, account, attemptNumber } = args;
     const attemptStartedAt = Date.now();
+    const accountIdentity = resolveRequestLogAccountIdentity(account.label, account.type);
     return (status, errorType, errorMessage, extra) => {
         const attemptCompletedAt = Date.now();
         const traceCtx = tracer?.getTraceContext();
@@ -5682,7 +5728,11 @@ function createAnthropicAttemptLogger(args) {
             stream: !!body.stream,
             toolCount,
             account: account.label,
+            accountKey: account.key,
             accountType: account.type,
+            ...(accountIdentity.provider
+                ? { provider: accountIdentity.provider }
+                : {}),
             responseStatus: status,
             responseTimeMs: attemptCompletedAt - requestStart,
             attemptDurationMs: extra?.attemptDurationMs ?? attemptCompletedAt - attemptStartedAt,
@@ -6335,7 +6385,7 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                         // Refresh the account's quota snapshot for proactive selection.
                         if (fetchResult.quota) {
                             accountState.quota = mergeQuotaSnapshot(accountState.quota, fetchResult.quota);
-                            saveAccountQuota(account.label, fetchResult.quota).catch(() => {
+                            saveAccountQuota(account.key, fetchResult.quota).catch(() => {
                                 // Non-fatal: routing already has the in-memory snapshot.
                             });
                         }

package/dist/server/routes/codexProxyRoutes.d.ts

@@ -17,7 +17,12 @@
  * never collides with anthropic entries) and does pre-commit rotation only, not
  * the full transient-budget / admission machinery.
  */
-import type { AccountCoolingReason, AccountQuota, CodexRuntimeAccount, RouteGroup, ServerContext } from "../../types/index.js";
+import type { AccountQuota, CodexRefreshTokenStore, CodexRuntimeAccount, CodexTokenRefresher, RateLimitCoolingReason, RouteGroup, ServerContext } from "../../types/index.js";
+declare function refreshCodexTokenOnceWithDependencies(key: string, refreshToken: string, store: CodexRefreshTokenStore, refresh: CodexTokenRefresher): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresAt?: number;
+}>;
 /** Refresh an account's token at most once at a time. */
 declare function refreshCodexTokenOnce(key: string, refreshToken: string): Promise<{
     accessToken: string;
@@ -44,7 +49,7 @@ declare function buildCodexUpstreamHeaders(clientHeaders: Record<string, string>
  */
 declare function planCodexCooldown(quota: AccountQuota | null, retryAfterMs: number, now: number): {
     coolingUntil: number;
-    reason: AccountCoolingReason;
+    reason: RateLimitCoolingReason;
 };
 /** Core pooled handler for POST /backend-api/codex/responses. */
 export declare function handleCodexResponsesRequest(ctx: ServerContext): Promise<Response>;
@@ -61,6 +66,7 @@ export declare const __testHooks: {
     buildCodexUpstreamHeaders: typeof buildCodexUpstreamHeaders;
     planCodexCooldown: typeof planCodexCooldown;
     refreshCodexTokenOnce: typeof refreshCodexTokenOnce;
+    refreshCodexTokenOnceWithDependencies: typeof refreshCodexTokenOnceWithDependencies;
     codexRefreshInFlightSize: () => number;
 };
 export {};