@rikcodes/teamclaude 1.1.13-rik.1

package/src/warmer.js

@@ -0,0 +1,237 @@
+// Opt-in "keep-warm" scheduler (issue #76).
+//
+// DISABLED BY DEFAULT. When enabled (config.warmupSeconds > 0), periodically
+// starts the rolling 5-hour session window on idle accounts, so that when the
+// active account runs out the next one is not stone cold.
+//
+// This is the SECOND sanctioned active-upstream feature (the quota probe is the
+// first). It differs in an important way and is why it is strictly opt-in: the
+// 5h timer only starts on *real usage*, so — unlike the zero-spend
+// /api/oauth/usage probe — warming genuinely consumes a little quota (a few
+// tokens, a slice of the 5h window, a touch of the weekly bucket) per account
+// per window. To keep that cost minimal we warm an account only when its 5h
+// window is not already running, and we use the cheapest model.
+//
+// Mechanism (chosen in #76): for each eligible idle account we spawn a one-shot,
+// minimal `claude` (`--bare -p`) pointed at THIS proxy with the account pinned
+// via the `/tc-acct/<index>` path prefix. Using the real client means the
+// warm-up request is byte-identical to normal Claude Code traffic, routed to
+// exactly the account we want to warm.
+
+import { spawn } from 'node:child_process';
+import { encodePinComponent } from './claude-env.js';
+
+export class Warmer {
+  constructor(accountManager, {
+    intervalMs = 0,
+    port,
+    apiKey = null,
+    model = 'haiku',
+    prompt = 'hi',
+    spawnFn = defaultSpawn,
+    timeoutMs = 120_000,
+    log = console.log,
+  } = {}) {
+    this.am = accountManager;
+    this.intervalMs = intervalMs;
+    this.port = port;
+    this.apiKey = apiKey;
+    this.model = model;
+    this.prompt = prompt;
+    this.spawnFn = spawnFn;
+    this.timeoutMs = timeoutMs;
+    this.log = log;
+    this.timer = null;
+    this._running = false;
+    this._abort = null; // AbortController for the in-flight sweep (see warmAll/stop)
+    this.lastRunStartedAt = null;
+    this.lastRunFinishedAt = null;
+    this.nextRunAt = intervalMs > 0 ? Date.now() + intervalMs : null;
+    this.accountStatus = new Map();
+  }
+
+  start() {
+    if (this.intervalMs > 0) this.reschedule(this.intervalMs);
+  }
+
+  /** Change interval at runtime (0 = off). Warms once immediately when turned on. */
+  reschedule(intervalMs) {
+    const wasOn = this.intervalMs > 0 && this.timer;
+    this.intervalMs = intervalMs;
+    if (this.timer) { clearInterval(this.timer); this.timer = null; }
+
+    if (intervalMs > 0) {
+      this.nextRunAt = Date.now() + intervalMs;
+      // Immediate sweep only on an off→on transition. Re-running it on every
+      // interval *change* would spend quota each time the interval is edited.
+      if (!wasOn) this.warmAll().catch(() => {});
+      this.timer = setInterval(() => this.warmAll().catch(() => {}), intervalMs);
+      this.timer.unref?.();
+      this.log(`[TeamClaude] Keep-warm enabled (every ${Math.round(intervalMs / 1000)}s)`);
+    } else if (wasOn) {
+      this.nextRunAt = null;
+      this.log('[TeamClaude] Keep-warm disabled');
+    }
+  }
+
+  stop() {
+    if (this.timer) { clearInterval(this.timer); this.timer = null; }
+    this.nextRunAt = null;
+    // Cancel an in-flight sweep and kill any child it spawned, so shutdown /
+    // `warmup off` doesn't block on a running warm-up or orphan a `claude`.
+    this._abort?.abort();
+  }
+
+  /**
+   * True when `account` is a healthy, idle Anthropic OAuth account whose 5h
+   * window is NOT already running. We skip:
+   *  - non-OAuth and third-party-backend accounts (`upstream` set) — the 5h
+   *    concept is Anthropic-specific;
+   *  - disabled / errored / exhausted / throttled accounts — warming them is
+   *    pointless or would just 429;
+   *  - accounts with a live 5h window — already warm, so warming again only burns
+   *    quota for nothing.
+   */
+  _isWarmTarget(account) {
+    if (account.type !== 'oauth' || !account.credential) return false;
+    if (account.upstream) return false;
+    if (account.disabled) return false;
+    if (account.status === 'error' || account.status === 'exhausted' || account.status === 'throttled') return false;
+    const reset = account.quota?.unified5hReset;
+    return !(reset && Date.now() < reset); // a future reset ⇒ session already running
+  }
+
+  /** Warm every eligible account once. Overlapping cycles are skipped. Sequential
+   *  on purpose: one subprocess at a time keeps load and the quota burst gentle. */
+  async warmAll() {
+    if (this._running) return;
+    this._running = true;
+    const abort = this._abort = new AbortController();
+    this.lastRunStartedAt = Date.now();
+    this.nextRunAt = this.intervalMs > 0 ? this.lastRunStartedAt + this.intervalMs : null;
+    try {
+      const targets = this.am.accounts.filter(account => this._isWarmTarget(account));
+      for (const account of targets) {
+        if (abort.signal.aborted) break; // stopped mid-sweep (shutdown / warmup off)
+        await this.warmAccount(account, abort.signal);
+      }
+    } finally {
+      this.lastRunFinishedAt = Date.now();
+      this._running = false;
+      if (this._abort === abort) this._abort = null;
+    }
+  }
+
+  async warmAccount(account, signal) {
+    const startedAt = Date.now();
+    this._record(account, { status: 'running', startedAt });
+    try {
+      await this.am.ensureTokenFresh(account.index);
+      const code = await this.spawnFn(this._spawnSpec(account, signal));
+      const finishedAt = Date.now();
+      this._record(account, {
+        status: code === 0 ? 'ok' : 'error',
+        error: code === 0 ? null : `claude exited ${code}`,
+        startedAt, finishedAt, durationMs: finishedAt - startedAt,
+      });
+    } catch (err) {
+      const finishedAt = Date.now();
+      this._record(account, {
+        status: 'error',
+        error: err?.message || String(err),
+        startedAt, finishedAt, durationMs: finishedAt - startedAt,
+      });
+    }
+  }
+
+  /** The `claude` invocation for one account. Pure/deterministic so tests can
+   *  assert the args and env without spawning anything. */
+  _spawnSpec(account, signal) {
+    // Pin by accountUuid — a stable identity. The rotation index is NOT usable:
+    // it is array position, so removing an account would repoint this at a
+    // different one. Fall back to the display name when the uuid isn't known
+    // yet (e.g. an API-key account, or before the first profile fetch).
+    const pin = encodePinComponent(account.accountUuid || account.name);
+    const baseUrl = `http://127.0.0.1:${this.port}/tc-acct/${pin}`;
+    return {
+      command: 'claude',
+      // `--bare -p`: minimal, non-interactive, auth strictly via ANTHROPIC_API_KEY
+      // (which this proxy strips and replaces with the pinned account's token).
+      args: ['-p', '--bare', '--model', this.model, '--output-format', 'text', this.prompt],
+      env: {
+        ...process.env,
+        ANTHROPIC_BASE_URL: baseUrl,
+        ANTHROPIC_API_KEY: this.apiKey || 'tc-warm',
+      },
+      timeoutMs: this.timeoutMs,
+      signal, // aborts (and kills the child) when the warmer is stopped
+    };
+  }
+
+  getStatus() {
+    return {
+      enabled: this.intervalMs > 0,
+      intervalSeconds: Math.round(this.intervalMs / 1000),
+      running: this._running,
+      lastRunStartedAt: iso(this.lastRunStartedAt),
+      lastRunFinishedAt: iso(this.lastRunFinishedAt),
+      nextRunAt: iso(this.nextRunAt),
+      accounts: this.am.accounts.map(account => {
+        const status = this.accountStatus.get(account.name);
+        const applicable = account.type === 'oauth' && !account.upstream;
+        return {
+          name: account.name,
+          status: applicable ? (status?.status || 'never') : 'not-applicable',
+          lastWarmedAt: iso(status?.finishedAt),
+          startedAt: iso(status?.startedAt),
+          durationMs: status?.durationMs ?? null,
+          error: status?.error || null,
+        };
+      }),
+    };
+  }
+
+  _record(account, status) {
+    this.accountStatus.set(account.name, {
+      ...(this.accountStatus.get(account.name) || {}),
+      ...status,
+    });
+  }
+}
+
+// Spawn a one-shot `claude`, resolving with its exit code (non-zero ⇒ recorded as
+// an error) or rejecting if the binary can't launch (e.g. not on PATH) or the
+// warm-up overruns its timeout. stdio is ignored: we only care that a request
+// went through to start the timer.
+function defaultSpawn({ command, args, env, timeoutMs, signal }) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) { reject(new Error('warm-up aborted')); return; }
+    let child;
+    try {
+      child = spawn(command, args, { env, stdio: 'ignore' });
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    const onAbort = () => child.kill('SIGKILL');
+    signal?.addEventListener('abort', onAbort, { once: true });
+    const timer = setTimeout(() => {
+      child.kill('SIGKILL');
+      reject(new Error(`warm-up timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timer.unref?.();
+    const cleanup = () => { clearTimeout(timer); signal?.removeEventListener('abort', onAbort); };
+    child.once('error', (err) => { cleanup(); reject(err); });
+    child.once('exit', (code, sigName) => {
+      cleanup();
+      // A signal-killed child (OOM, external kill, our own abort) did NOT
+      // complete a warm-up — report it as an error, not a success (code null).
+      if (sigName) { reject(new Error(`claude terminated by ${sigName}`)); return; }
+      resolve(code ?? 0);
+    });
+  });
+}
+
+function iso(ts) {
+  return ts ? new Date(ts).toISOString() : null;
+}

package/src/x509.js

@@ -0,0 +1,166 @@
+// Minimal pure-JS X.509 certificate generation (no external deps).
+//
+// node:crypto can create keypairs and sign, but cannot issue certificates, so
+// we hand-encode the (small) ASN.1 DER cert envelope and sign the TBS with the
+// issuer key. Used only to mint a local CA + a leaf for the MITM proxy, which
+// the launched claude process trusts via NODE_EXTRA_CA_CERTS. Nothing here is a
+// general-purpose ASN.1 library — just what these two certs need.
+
+import { generateKeyPairSync, sign as cryptoSign, randomBytes } from 'node:crypto';
+
+// ── ASN.1 DER primitives ──────────────────────────────────────
+
+function derLen(n) {
+  if (n < 0x80) return Buffer.from([n]);
+  const bytes = [];
+  let x = n;
+  while (x > 0) { bytes.unshift(x & 0xff); x = Math.floor(x / 256); }
+  return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+
+function tlv(tag, content) {
+  return Buffer.concat([Buffer.from([tag]), derLen(content.length), content]);
+}
+
+const seq = (items) => tlv(0x30, Buffer.concat(items));
+const set = (items) => tlv(0x31, Buffer.concat(items));
+const NULL = Buffer.from([0x05, 0x00]);
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0x00]));
+const octet = (buf) => tlv(0x04, buf);
+const bitString = (buf) => tlv(0x03, Buffer.concat([Buffer.from([0]), buf])); // 0 unused bits
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+const explicit = (n, content) => tlv(0xa0 | n, content);   // [n] constructed
+const ctxPrim = (n, content) => tlv(0x80 | n, content);    // [n] primitive
+
+function integer(buf) {
+  let b = Buffer.isBuffer(buf) ? Buffer.from(buf) : Buffer.from([buf]);
+  let i = 0;
+  while (i < b.length - 1 && b[i] === 0) i++; // strip leading zeros
+  b = b.subarray(i);
+  if (b[0] & 0x80) b = Buffer.concat([Buffer.from([0]), b]); // keep positive
+  return tlv(0x02, b);
+}
+
+function oid(dotted) {
+  const parts = dotted.split('.').map(Number);
+  const out = [40 * parts[0] + parts[1]];
+  for (let i = 2; i < parts.length; i++) {
+    let v = parts[i];
+    const group = [v & 0x7f];
+    v = Math.floor(v / 128);
+    while (v > 0) { group.unshift((v & 0x7f) | 0x80); v = Math.floor(v / 128); }
+    out.push(...group);
+  }
+  return tlv(0x06, Buffer.from(out));
+}
+
+function utcTime(date) {
+  const z = (n) => String(n).padStart(2, '0');
+  const s = `${z(date.getUTCFullYear() % 100)}${z(date.getUTCMonth() + 1)}${z(date.getUTCDate())}` +
+            `${z(date.getUTCHours())}${z(date.getUTCMinutes())}${z(date.getUTCSeconds())}Z`;
+  return tlv(0x17, Buffer.from(s, 'ascii'));
+}
+
+function pem(der, label) {
+  const b64 = der.toString('base64').replace(/(.{64})/g, '$1\n').replace(/\n$/, '');
+  return `-----BEGIN ${label}-----\n${b64}\n-----END ${label}-----\n`;
+}
+
+// ── cert pieces ───────────────────────────────────────────────
+
+const SIG_ALG = seq([oid('1.2.840.113549.1.1.11'), NULL]); // sha256WithRSAEncryption
+
+function nameCN(cn) {
+  return seq([set([seq([oid('2.5.4.3'), utf8(cn)])])]); // RDNSequence with one CN
+}
+
+function ext(extOid, critical, valueDer) {
+  const items = [oid(extOid)];
+  if (critical) items.push(bool(true));
+  items.push(octet(valueDer));
+  return seq(items);
+}
+
+// keyUsage BIT STRING from named bit positions (bit 0 = MSB of first byte).
+function keyUsage(bits) {
+  const max = Math.max(...bits);
+  const nbytes = Math.floor(max / 8) + 1;
+  const bytes = Buffer.alloc(nbytes);
+  for (const b of bits) bytes[Math.floor(b / 8)] |= 0x80 >> (b % 8);
+  const unused = nbytes * 8 - (max + 1);
+  return tlv(0x03, Buffer.concat([Buffer.from([unused]), bytes]));
+}
+
+function buildCert({ subjectCN, issuerCN, spkiDer, signKey, isCA, altDnsNames = [], days }) {
+  const now = new Date();
+  const notBefore = new Date(now.getTime() - 60 * 60 * 1000);          // 1h back for clock skew
+  const notAfter = new Date(now.getTime() + days * 24 * 60 * 60 * 1000);
+
+  const extList = [];
+  extList.push(ext('2.5.29.19', true, isCA ? seq([bool(true)]) : seq([]))); // basicConstraints
+  extList.push(ext('2.5.29.15', true, isCA
+    ? keyUsage([0, 5, 6])   // digitalSignature, keyCertSign, cRLSign
+    : keyUsage([0, 2])));   // digitalSignature, keyEncipherment
+  if (!isCA) {
+    extList.push(ext('2.5.29.37', false, seq([oid('1.3.6.1.5.5.7.3.1')]))); // extKeyUsage serverAuth
+    if (altDnsNames.length) {
+      extList.push(ext('2.5.29.17', false, seq(altDnsNames.map((d) => ctxPrim(2, Buffer.from(d)))))); // SAN dNSName
+    }
+  }
+
+  const tbs = seq([
+    explicit(0, integer(Buffer.from([2]))),  // version v3
+    integer(randomBytes(16)),                // serial
+    SIG_ALG,
+    nameCN(issuerCN),
+    seq([utcTime(notBefore), utcTime(notAfter)]),
+    nameCN(subjectCN),
+    spkiDer,                                  // SubjectPublicKeyInfo (already DER)
+    explicit(3, seq(extList)),
+  ]);
+
+  const signature = cryptoSign('sha256', tbs, signKey); // RSASSA-PKCS1-v1_5
+  return pem(seq([tbs, SIG_ALG, bitString(signature)]), 'CERTIFICATE');
+}
+
+// ── public API ────────────────────────────────────────────────
+
+function newRsaKey() {
+  const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  return {
+    privateKey,
+    keyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }),
+    spkiDer: publicKey.export({ type: 'spki', format: 'der' }),
+  };
+}
+
+export function createCA(cn = 'TeamClaude Local CA') {
+  const key = newRsaKey();
+  const certPem = buildCert({
+    subjectCN: cn, issuerCN: cn, spkiDer: key.spkiDer, signKey: key.privateKey,
+    isCA: true, days: 3650,
+  });
+  return { cn, certPem, keyPem: key.keyPem, privateKey: key.privateKey };
+}
+
+export function createLeaf(hosts, ca) {
+  const list = Array.isArray(hosts) ? hosts : [hosts];
+  const key = newRsaKey();
+  const certPem = buildCert({
+    subjectCN: list[0], issuerCN: ca.cn, spkiDer: key.spkiDer, signKey: ca.privateKey,
+    isCA: false, altDnsNames: list, days: 825,
+  });
+  return { certPem, keyPem: key.keyPem };
+}
+
+/** Generate a fresh CA + a leaf covering `hosts` (string or array). Returns PEM strings. */
+export function generateCertChain(hosts) {
+  const ca = createCA();
+  const leaf = createLeaf(hosts, ca);
+  return {
+    caCertPem: ca.certPem,
+    caKeyPem: ca.keyPem,
+    leafCertPem: leaf.certPem,
+    leafKeyPem: leaf.keyPem,
+  };
+}