@rikcodes/teamclaude 1.1.13-rik.1

package/src/json-format-stream.js

@@ -0,0 +1,63 @@
+// Streaming JSON pretty-printer (no regex, no buffering of the whole body).
+//
+// Built on the same idea as the account_uuid patcher: walk the bytes once,
+// tracking only enough state (nesting depth, in-string, escape) to know where
+// we are, and re-emit with indentation as we go. This lets the request logger
+// flush a readable body to disk *as it streams* — so when a request blocks
+// mid-flight, the partial (pretty) body is already on disk and you can see how
+// far it got. Bodies can be ~1M tokens, so we never hold more than the current
+// chunk.
+//
+// Whitespace outside strings is dropped and re-inserted; strings (including any
+// whitespace/escapes inside them) are copied verbatim. Operates on latin1 so a
+// multi-byte UTF-8 sequence split across chunks is preserved byte-for-byte.
+export class JsonStreamFormatter {
+  constructor(indent = 2) {
+    this.pad = ' '.repeat(indent);
+    this.depth = 0;
+    this.inStr = false;
+    this.esc = false;
+    this.freshContainer = false; // just opened { or [ — first element needs a newline+indent
+  }
+
+  nl(depth) { return '\n' + this.pad.repeat(depth); }
+
+  // Feed a chunk; returns the formatted text for that chunk.
+  push(buf) {
+    const text = Buffer.isBuffer(buf) ? buf.toString('latin1') : String(buf);
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+      const ch = text[i];
+
+      if (this.inStr) {
+        out += ch;
+        if (this.esc) this.esc = false;
+        else if (ch === '\\') this.esc = true;
+        else if (ch === '"') this.inStr = false;
+        continue;
+      }
+
+      // Outside a string: collapse existing whitespace; we re-insert our own.
+      if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') continue;
+
+      if (ch === '}' || ch === ']') {
+        this.depth--;
+        // Empty container: emit "{}" / "[]" with no inner newline.
+        if (this.freshContainer) { this.freshContainer = false; out += ch; }
+        else out += this.nl(this.depth) + ch;
+        continue;
+      }
+
+      // Any other token. If it's the first token inside a just-opened
+      // container, break the line and indent first.
+      if (this.freshContainer) { out += this.nl(this.depth); this.freshContainer = false; }
+
+      if (ch === '{' || ch === '[') { out += ch; this.depth++; this.freshContainer = true; continue; }
+      if (ch === ',') { out += ',' + this.nl(this.depth); continue; }
+      if (ch === ':') { out += ': '; continue; }
+      if (ch === '"') { this.inStr = true; out += ch; continue; }
+      out += ch; // number / true / false / null character
+    }
+    return out;
+  }
+}

package/src/mitm.js

@@ -0,0 +1,336 @@
+// MITM forward-proxy support: local cert lifecycle + terminating CONNECT proxy.
+//
+// When a claude instance is launched with HTTPS_PROXY pointed at teamclaude it
+// sends `CONNECT api.anthropic.com:443`. Rather than byte-relaying the tunnel, we
+// TERMINATE it with a real Node HTTP/2 server (allowHTTP1, so an h1 client works
+// too) presenting our locally-minted leaf, then forward each request with a
+// buffering, retrying client — the SAME path the base proxy uses
+// (createProxyRequestListener). That gives per-request account selection, body
+// account_uuid rewriting, and — critically — the ability to resend a request on a
+// different account when one returns a quota 429, instead of surfacing it. A host
+// routing table decides per-CONNECT behavior:
+//   api.anthropic.com → terminate + forward,  www.example.org → local test server,
+//   anything else      → blind tunnel.
+
+import { readFile, writeFile, mkdir, rename } from 'node:fs/promises';
+import { X509Certificate } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import net from 'node:net';
+import tls from 'node:tls';
+import http2 from 'node:http2';
+import { getConfigPath } from './config.js';
+import { generateCertChain } from './x509.js';
+import { createProxyRequestListener, safeKeyEqual, isLoopbackAddr, relayUpgrade, resolveAccountPin } from './server.js';
+
+const CA_CERT = 'teamclaude-ca.pem';
+const LEAF_CERT = 'teamclaude-leaf.pem';
+const LEAF_KEY = 'teamclaude-leaf.key';
+
+// A built-in host the MITM proxy always intercepts and answers itself (never
+// forwarded upstream). Lets you verify the proxy + CA end-to-end with no
+// credentials, e.g.:
+//   curl --proxy http://localhost:3456 --cacert <ca.pem> https://www.example.org/
+export const TEST_HOST = 'www.example.org';
+
+const certDir = () => dirname(getConfigPath());
+const fpath = (n) => join(certDir(), n);
+
+/** Path to the CA cert clients should trust via NODE_EXTRA_CA_CERTS. */
+export function caCertPath() {
+  return fpath(CA_CERT);
+}
+
+async function readIf(p) {
+  try { return await readFile(p, 'utf8'); } catch { return null; }
+}
+
+async function atomicWrite(path, data, mode) {
+  const tmp = `${path}.tmp${process.pid}`;
+  await writeFile(tmp, data, { mode });
+  await rename(tmp, path);
+}
+
+// Is the stored leaf signed by the stored CA and valid for every host in `hosts`?
+function leafCovers(caCertPem, leafCertPem, hosts) {
+  try {
+    const ca = new X509Certificate(caCertPem);
+    const leaf = new X509Certificate(leafCertPem);
+    if (!leaf.verify(ca.publicKey)) return false;
+    const names = (leaf.subjectAltName || '').split(',').map((s) => s.trim());
+    return hosts.every((h) => names.includes(`DNS:${h}`));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Ensure a CA cert + a leaf for `host` exist in the config dir, generating them
+ * if missing/mismatched. The CA *private* key is never persisted — we regenerate
+ * the whole chain when needed, so the only on-disk secret is the leaf key (0600),
+ * which only authenticates as `host` to a process that already trusts our CA.
+ * Returns { caPath, caCertPem, leafCertPem, leafKeyPem }.
+ */
+export async function ensureCerts(host) {
+  const hosts = host === TEST_HOST ? [TEST_HOST] : [host, TEST_HOST];
+  const [caCertPem, leafCertPem, leafKeyPem] = await Promise.all([
+    readIf(fpath(CA_CERT)), readIf(fpath(LEAF_CERT)), readIf(fpath(LEAF_KEY)),
+  ]);
+
+  if (caCertPem && leafCertPem && leafKeyPem && leafCovers(caCertPem, leafCertPem, hosts)) {
+    return { caPath: fpath(CA_CERT), caCertPem, leafCertPem, leafKeyPem };
+  }
+
+  const chain = generateCertChain(hosts); // caKeyPem intentionally discarded
+  await mkdir(certDir(), { recursive: true });
+  await atomicWrite(fpath(CA_CERT), chain.caCertPem, 0o644);
+  await atomicWrite(fpath(LEAF_CERT), chain.leafCertPem, 0o644);
+  await atomicWrite(fpath(LEAF_KEY), chain.leafKeyPem, 0o600);
+  return {
+    caPath: fpath(CA_CERT),
+    caCertPem: chain.caCertPem,
+    leafCertPem: chain.leafCertPem,
+    leafKeyPem: chain.leafKeyPem,
+  };
+}
+
+function upstreamHostOf(config) {
+  try { return new URL(config?.upstream || 'https://api.anthropic.com').hostname; }
+  catch { return 'api.anthropic.com'; }
+}
+
+/** Per-CONNECT behavior: 'rewrite' (intercept + token inject), 'test', or 'tunnel'. */
+export function hostMode(host, config) {
+  if (host === TEST_HOST) return 'test';
+  if (host === upstreamHostOf(config)) return 'rewrite';
+  return 'tunnel';
+}
+
+/**
+ * Build a `connect` event handler implementing the terminating MITM described at
+ * the top of this file.
+ * @param ensureLeaf async () => { key, cert }   // current leaf PEMs
+ */
+export function createConnectHandler({ config, accountManager, ensureLeaf, logDir = null, hooks = {}, log = () => {}, sx = null, egress = null }) {
+  const upstream = config.upstream || 'https://api.anthropic.com';
+  const proxyApiKey = config.proxy?.apiKey;
+  const holdMs = (config.holdSeconds || 0) * 1000;
+
+  // One terminating h2/h1 server per pin, minted lazily on the first intercepted
+  // CONNECT that needs it (key '' = unpinned, the common case).
+  // TLS uses our leaf; ALPN negotiates h2 or http/1.1 (allowHTTP1) with whatever
+  // the client offers. It emits 'request' for BOTH protocols, so `forward` — the
+  // shared buffering/retrying proxy listener — handles them identically. Each
+  // CONNECT feeds it the raw tunnel socket; the client keeps the tunnel open and
+  // multiplexes many requests over it, each independently account-selected.
+  //
+  // Keying by pin is what carries a TC_ACCT pin from the CONNECT to the requests
+  // inside the tunnel. The alternative — tagging the raw socket and reading it
+  // back from the request — means digging through a TLSSocket and, under h2, a
+  // Proxy over the session socket. A listener bound to the account is the same
+  // information with none of that. The map is bounded by the account count.
+  const serverPromises = new Map();
+  const getServer = (pin = '') => {
+    let p = serverPromises.get(pin);
+    if (p) return p;
+    p = (async () => {
+    const { key, cert } = await ensureLeaf();
+    const srv = http2.createSecureServer({ key, cert, allowHTTP1: true });
+    srv.on('request', createProxyRequestListener({ accountManager, upstream, logDir, hooks, sx, holdMs, config, forcedPin: pin || null, egress }));
+    // Remote Control's real-time channel is a WebSocket (Upgrade handshake),
+    // which never fires 'request' — only 'upgrade', with a raw socket instead
+    // of a response object (h1-only; falls back to blind h2 passthrough is not
+    // needed since WS clients negotiate h1 for the handshake).
+    srv.on('upgrade', (req, socket, head) => relayUpgrade(req, socket, head, upstream, sx));
+    srv.on('sessionError', (e) => log(`[TeamClaude] MITM session error: ${e.message}`));
+    srv.on('clientError', (e, sock) => { try { sock.destroy(); } catch { /* already gone */ } });
+    return srv;
+    })().catch((err) => {
+      // Don't let a transient cert/disk failure poison the memo forever: drop it
+      // so the next intercepted CONNECT retries instead of re-awaiting a cached
+      // rejection (which would leave the MITM path dead until a restart).
+      serverPromises.delete(pin);
+      throw err;
+    });
+    serverPromises.set(pin, p);
+    return p;
+  };
+
+  return (req, clientSocket, head) => {
+    clientSocket.on('error', () => {});
+
+    // Auth gate — mirror the HTTP path: loopback is exempt, everything else must
+    // present the proxy apiKey via Proxy-Authorization. Without this, a remote
+    // client can CONNECT api.anthropic.com and have a rotated ACCOUNT TOKEN
+    // injected (token theft), or blind-tunnel to arbitrary hosts (open relay /
+    // SSRF) — the HTTP path already blocks the equivalent for remote clients.
+    if (!connectAuthorized(req, clientSocket, proxyApiKey)) {
+      try {
+        clientSocket.write('HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm="teamclaude"\r\nConnection: close\r\n\r\n');
+      } catch { /* client already gone */ }
+      clientSocket.destroy();
+      return;
+    }
+
+    const [host, portStr] = (req.url || '').split(':');
+    const port = parseInt(portStr, 10) || 443;
+    const mode = hostMode(host, config);
+
+    if (mode === 'tunnel') {
+      // Until the upstream connects we still owe the client a CONNECT status
+      // line. If we tore the socket down on an upstream failure without one,
+      // the client reports "Proxy connection ended before receiving CONNECT
+      // response" — so before the tunnel is live, surface failures as a real
+      // proxy error status instead of a silent drop.
+      let established = false, closed = false;
+      // Tear down BOTH sockets when either errors or closes, so a one-sided
+      // failure can't leave the paired socket lingering (FD leak). The `closed`
+      // guard makes it idempotent (error+close both fire) and ensures we write
+      // at most one status line.
+      const teardown = (statusLine) => {
+        if (closed) return;
+        closed = true;
+        if (!established && statusLine) {
+          try { clientSocket.write(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\n\r\n`); } catch { /* client already gone */ }
+        }
+        up.destroy(); clientSocket.destroy();
+      };
+      const up = net.connect(port, host, () => {
+        established = true;
+        reply200Raw(clientSocket);
+        if (head && head.length) up.write(head);
+        up.pipe(clientSocket); clientSocket.pipe(up);
+      });
+      up.on('error', (err) => {
+        if (!established) log(`[TeamClaude] tunnel ${host}:${port} failed: ${err.message}`);
+        teardown('502 Bad Gateway');
+      });
+      // A FIN before the tunnel is live (no preceding 'error') is still a failed
+      // dial from the client's view — surface a 502 rather than a silent drop.
+      up.on('close', () => teardown('502 Bad Gateway'));
+      clientSocket.on('close', () => teardown()); // client gone: nothing to write
+      up.setTimeout(30_000, () => teardown('504 Gateway Timeout')); // bound a stalled connect/idle tunnel
+      return;
+    }
+
+    if (mode === 'test') {
+      // The built-in test host is answered locally, never forwarded upstream.
+      ensureLeaf().then(({ key, cert }) => {
+        reply200Raw(clientSocket);
+        serveTest(termClaude(clientSocket, head, key, cert, ['http/1.1']));
+      }).catch((err) => { log(`[TeamClaude] MITM ${host}: ${err.message}`); reply502Raw(clientSocket); clientSocket.destroy(); });
+      return;
+    }
+
+    // rewrite: terminate the tunnel and forward each request with buffering +
+    // retry. Reply 200, hand the raw socket (ClientHello and all) to the h2/h1
+    // server, which does TLS + protocol negotiation itself. If the terminating
+    // server can't be minted (cert/disk/TLS-init failure) we haven't replied yet
+    // — send a 502 so the client sees a real proxy error instead of "Proxy
+    // connection ended before receiving CONNECT response".
+    // Pin resolution is deliberately confined to `rewrite`. Clients send
+    // Proxy-Authorization on EVERY CONNECT, including blind-tunneled third-party
+    // hosts, where an account pin is meaningless — rejecting there would take
+    // down unrelated traffic over a typo meant for Anthropic.
+    const { pin, error } = resolveConnectPin(req, accountManager, proxyApiKey);
+    if (error) {
+      log(`[TeamClaude] CONNECT ${host}: ${error}`);
+      try {
+        clientSocket.write(`HTTP/1.1 407 Proxy Authentication Required\r\nProxy-Authenticate: Basic realm="teamclaude"\r\nConnection: close\r\n\r\n`);
+      } catch { /* client already gone */ }
+      clientSocket.destroy();
+      return;
+    }
+
+    getServer(pin || '').then((srv) => {
+      reply200Raw(clientSocket);
+      if (head && head.length) clientSocket.unshift(head);
+      srv.emit('connection', clientSocket);
+    }).catch((err) => { log(`[TeamClaude] MITM ${host}: ${err.message}`); reply502Raw(clientSocket); clientSocket.destroy(); });
+  };
+}
+
+// The Basic username from a CONNECT's `Proxy-Authorization`, or null. This is
+// the only pin channel expressible in an HTTPS_PROXY URL, which is what
+// `teamclaude run` has to work with in MITM mode (there is no request path to
+// carry a `/tc-acct/` prefix — inside the tunnel the path is the real upstream
+// one). Clients send this preemptively on every CONNECT.
+export function connectPinToken(req) {
+  const header = (req?.headers?.['proxy-authorization'] || '').trim();
+  if (!header.toLowerCase().startsWith('basic ')) return null;
+  const dec = Buffer.from(header.slice('basic '.length).trim(), 'base64').toString('utf8'); // "user:pass"
+  const colon = dec.indexOf(':');
+  return (colon >= 0 ? dec.slice(0, colon) : dec) || null;
+}
+
+/**
+ * Resolve the account pin on a CONNECT, or a rejection reason.
+ *
+ * The username slot is overloaded: the documented remote form is
+ * `--proxy http://<key>@host:port`, where it holds the proxy apiKey, not an
+ * account. So the key wins over any account of the same name — an operator who
+ * names an account after their proxy key gets auth, not a surprise pin.
+ *
+ * An unrecognized username is an ERROR rather than a silently ignored pin: a
+ * typo'd account name that quietly served from the wrong account is exactly the
+ * failure mode this feature exists to remove.
+ *
+ * @returns {{pin: string|null, error: string|null}}
+ */
+export function resolveConnectPin(req, accountManager, proxyApiKey) {
+  const token = connectPinToken(req);
+  if (!token) return { pin: null, error: null };
+  if (proxyApiKey && safeKeyEqual(token, proxyApiKey)) return { pin: null, error: null };
+  if (resolveAccountPin(accountManager, token) == null) {
+    return { pin: null, error: `Unknown account pin "${token}"` };
+  }
+  return { pin: token, error: null };
+}
+
+// Authorize a CONNECT: no key configured → open (matches the HTTP path); a
+// loopback client is exempt; otherwise the proxy apiKey must be presented via
+// `Proxy-Authorization` (Bearer <key>, or Basic where the key is the username
+// or password — so `--proxy http://<key>@host:port` works). Exported for tests.
+export function connectAuthorized(req, socket, proxyApiKey) {
+  if (!proxyApiKey) return true;
+  if (isLoopbackAddr(socket?.remoteAddress)) return true;
+  const m = /^\s*(basic|bearer)\s+(.+?)\s*$/i.exec(req?.headers?.['proxy-authorization'] || '');
+  if (!m) return false;
+  let presented = m[2];
+  if (m[1].toLowerCase() === 'basic') {
+    const dec = Buffer.from(m[2], 'base64').toString('utf8'); // "user:pass"
+    const i = dec.indexOf(':');
+    const user = i >= 0 ? dec.slice(0, i) : dec;
+    const pass = i >= 0 ? dec.slice(i + 1) : '';
+    presented = pass || user;
+  }
+  return safeKeyEqual(presented, proxyApiKey);
+}
+
+function reply200Raw(sock) { sock.write('HTTP/1.1 200 Connection Established\r\n\r\n'); }
+function reply502Raw(sock) { try { sock.write('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n'); } catch { /* client already gone */ } }
+
+function termClaude(clientSocket, head, key, cert, alpn) {
+  if (head && head.length) clientSocket.unshift(head);
+  const t = new tls.TLSSocket(clientSocket, { isServer: true, key, cert, ALPNProtocols: alpn });
+  t.on('error', () => t.destroy());
+  return t;
+}
+
+// Answer the built-in test host locally over h1 with a canned JSON response.
+function serveTest(tlsSock) {
+  let buf = Buffer.alloc(0);
+  const onData = (chunk) => {
+    buf = Buffer.concat([buf, chunk]);
+    const idx = buf.indexOf('\r\n\r\n');
+    if (idx < 0) { if (buf.length > 65536) tlsSock.destroy(); return; }
+    tlsSock.removeListener('data', onData);
+    const reqLine = buf.subarray(0, buf.indexOf('\r\n')).toString('latin1');
+    const path = reqLine.split(' ')[1] || '/';
+    const body = JSON.stringify({ teamclaude: 'mitm-proxy-ok', host: TEST_HOST, path });
+    tlsSock.end(
+      `HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: ${Buffer.byteLength(body)}\r\nconnection: close\r\n\r\n${body}`,
+    );
+  };
+  tlsSock.on('data', onData);
+  tlsSock.on('error', () => tlsSock.destroy());
+}

package/src/model.js

@@ -0,0 +1,276 @@
+// Model-id helpers shared by the request path (server + MITM relay) and account
+// selection. Kept dependency-free so the low-level h2/h1 relay can peek a
+// request's model without pulling in the account-manager graph.
+
+// A request targets the Fable model family when its `model` id names Fable
+// (e.g. "claude-fable-5"). Account selection uses this to gate the Fable-only
+// weekly bucket: a Fable-exhausted account still serves every other model.
+export function isFableModel(model) {
+  return typeof model === 'string' && /fable/i.test(model);
+}
+
+// The model "family" a request belongs to. Anthropic meters some families with
+// their own weekly quota bucket (Fable, Sonnet) on top of the shared 5-hour and
+// weekly buckets, so the family decides which bucket governs a given request —
+// letting an account whose Fable bucket is spent keep serving Opus/Sonnet.
+// Returns a stable lowercase tag; unknown ids fall back to 'other'.
+export function modelFamily(model) {
+  if (typeof model !== 'string' || !model) return 'other';
+  if (/fable/i.test(model)) return 'fable';
+  if (/sonnet/i.test(model)) return 'sonnet';
+  if (/opus/i.test(model)) return 'opus';
+  if (/haiku/i.test(model)) return 'haiku';
+  return 'other';
+}
+
+// Quota buckets on an account (see AccountManager emptyQuota). The shared 5-hour
+// bucket applies to every request; the weekly bucket depends on the family.
+// A family with no dedicated weekly bucket falls back to the shared 'unified7d'.
+const FAMILY_WEEKLY_BUCKET = {
+  fable: 'unified7dFable',
+  sonnet: 'unified7dSonnet',
+};
+
+// The weekly quota bucket key that governs a model, e.g. a Fable request is
+// gated by 'unified7dFable' rather than the shared 'unified7d'. Used by account
+// selection so a spent family bucket only bars that family's requests.
+export function weeklyBucketForModel(model) {
+  return FAMILY_WEEKLY_BUCKET[modelFamily(model)] || 'unified7d';
+}
+
+// Match a shell-style glob against a model id. Only `*` is special (matches any
+// run of characters, including none); every other character is literal. The
+// comparison is case-insensitive. Used by configurable routes so a pattern like
+// `*fable*` or `claude-opus-*` selects the models a route handles.
+export function modelGlobMatches(glob, model) {
+  if (typeof glob !== 'string' || typeof model !== 'string') return false;
+  const re = '^' + glob.split('*').map(escapeRegExp).join('.*') + '$';
+  return new RegExp(re, 'i').test(model);
+}
+
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// Do two model globs describe any model in common? Used to tell whether a route
+// is fully shadowed by the blocklist. Exact glob intersection is not decidable
+// in general, so this compares literal cores (the pattern with `*` removed) in
+// both directions: `claude-fable-5` overlaps `*fable*`, and a bare `*` (empty
+// core) overlaps everything. Display-only, and deliberately inclusive — the
+// authoritative per-request gate still matches the concrete model id.
+export function modelGlobOverlaps(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const core = s => s.replace(/\*/g, '').toLowerCase();
+  const ca = core(a);
+  const cb = core(b);
+  return ca.includes(cb) || cb.includes(ca);
+}
+
+// The `blockedModels` pattern that takes a model FAMILY out of service, or null.
+//
+// The blocklist is written against concrete model ids (`*fable*`,
+// `claude-fable-5`) but the status view reasons in families (`Fable`), so a
+// direct glob match is not enough: `claude-fable-5` never matches the literal
+// string `Fable`. Both spellings are checked so the two natural ways to block a
+// family light up the same row — the glob (via modelGlobMatches, which also
+// makes a bare `*` block everything) and a concrete id (via substring).
+//
+// Deliberately advisory: this drives display only. The authoritative gate is the
+// per-request check in server.js, which matches the real model id. A pattern
+// that names no family (say `claude-3-*`) simply lights up no row, and the
+// header list still shows it verbatim.
+export function findFamilyBlock(patterns, family) {
+  if (!Array.isArray(patterns) || !family) return null;
+  const key = String(family).toLowerCase();
+  return patterns.find(p => typeof p === 'string'
+    && (modelGlobMatches(p, key) || p.toLowerCase().includes(key))) || null;
+}
+
+// Streaming, byte-exact locator for a TOP-LEVEL string field of a JSON object,
+// fed incrementally. It tracks JSON structure (container stack, key/value,
+// string/escape) so it ONLY matches the field at depth 1 of the root object —
+// a `"model": "..."` sitting inside conversation text (a message, a tool result)
+// is nested deeper and is never mistaken for the real field. No regex, no
+// whole-body buffering, so the relay can peek just the first frames.
+export class TopLevelFieldFinder {
+  constructor(field) {
+    this.field = field;               // target key at the root, e.g. 'model'
+    this.isObj = [];                  // container stack: true=object, false=array
+    this.awaitingKey = false;         // at an object, the next string is a key
+    this.inStr = false;
+    this.esc = false;
+    this.readingKey = false;
+    this.readingValue = false;        // accumulating the target field's value
+    this.curKey = null;               // last key seen in the current object
+    this.buf = [];                    // key/value byte accumulation
+    this.value = null;                // the found value, or null
+    this.done = false;                // found it, or the root object closed without it
+  }
+
+  /** Feed a chunk (Buffer). Returns the found value so far (string) or null. */
+  push(chunk) {
+    if (this.done) return this.value;
+    for (let i = 0; i < chunk.length && !this.done; i++) this.#byte(chunk[i]);
+    return this.value;
+  }
+
+  #atRoot() { return this.isObj.length === 1 && this.isObj[0] === true; }
+
+  #byte(b) {
+    if (this.inStr) {
+      if (this.esc) { this.esc = false; if (this.readingKey || this.readingValue) this.buf.push(b); return; }
+      if (b === 0x5c) { this.esc = true; if (this.readingKey || this.readingValue) this.buf.push(b); return; } // backslash
+      if (b === 0x22) {                                            // closing quote
+        this.inStr = false;
+        if (this.readingKey) {
+          this.curKey = Buffer.from(this.buf).toString('utf8'); this.buf = []; this.readingKey = false;
+        } else if (this.readingValue) {
+          this.value = Buffer.from(this.buf).toString('utf8'); this.buf = [];
+          this.readingValue = false; this.done = true;             // the one top-level field we want
+        }
+        return;
+      }
+      if (this.readingKey || this.readingValue) this.buf.push(b);
+      return;
+    }
+
+    switch (b) {
+      case 0x7b: this.isObj.push(true); this.awaitingKey = true; this.curKey = null; break;   // {
+      case 0x5b: this.isObj.push(false); this.awaitingKey = false; break;                     // [
+      case 0x7d: case 0x5d:                                                                    // } ]
+        this.isObj.pop(); this.curKey = null;
+        if (this.isObj.length === 0) this.done = true;             // root closed → field absent
+        break;
+      case 0x3a: this.awaitingKey = false; break;                  // :
+      case 0x2c: this.awaitingKey = this.isObj[this.isObj.length - 1] === true; break;        // ,
+      case 0x22:                                                   // string begins
+        if (this.awaitingKey && this.isObj[this.isObj.length - 1]) {
+          this.readingKey = true; this.buf = [];
+        } else if (this.#atRoot() && this.curKey === this.field) {
+          this.readingValue = true; this.buf = [];
+        }
+        this.inStr = true; this.esc = false;
+        break;
+      default: break;                                              // scalars / whitespace
+    }
+  }
+}
+
+// Extract the requested model id from a JSON request body (Buffer or string).
+// Uses the streaming top-level finder so it is exact (never matches a `model`
+// key nested in conversation content) and cheap on large bodies (it stops as
+// soon as the top-level field resolves). Returns null if absent.
+export function parseRequestModel(body) {
+  if (!body) return null;
+  try {
+    const buf = Buffer.isBuffer(body) ? body : Buffer.from(String(body), 'utf8');
+    return new TopLevelFieldFinder('model').push(buf);
+  } catch { return null; }
+}
+
+// Byte-exact locator for the SECOND model an advisor request carries: Claude
+// Code's advisor tool (`anthropic-beta: advisor-tool-…`) keeps the executor in
+// the top-level `model` field and nests the advisor's model inside the tools
+// array — `tools: [{ type: "advisor_20260301", name: "advisor", model: "…" }]`.
+// The advisor sub-inference runs on the same account and spends that model's
+// quota bucket, so account selection must see it (issue #98).
+//
+// Same byte-machine discipline as TopLevelFieldFinder: it walks the container
+// stack and only reads `type`/`model` strings that are DIRECT fields of an
+// object element of the ROOT object's `tools` array — a "model" inside a tool's
+// input_schema or inside conversation text is deeper (or under another root
+// key) and never matches. Elements are judged when they close, so field order
+// within the tool object doesn't matter.
+export class AdvisorModelFinder {
+  constructor() {
+    this.stack = [];                  // frames: {isObj, key, awaitingKey}
+    this.inStr = false;
+    this.esc = false;
+    this.reading = null;              // 'key' | 'type' | 'model' while in a string
+    this.buf = [];
+    this.toolType = null;             // fields of the tools[] element being read
+    this.toolModel = null;
+    this.value = null;                // the advisor model, once found
+    this.done = false;
+  }
+
+  /** Feed a chunk (Buffer). Returns the found value so far (string) or null. */
+  push(chunk) {
+    if (this.done) return this.value;
+    for (let i = 0; i < chunk.length && !this.done; i++) this.#byte(chunk[i]);
+    return this.value;
+  }
+
+  // The stack is exactly [root object (last key "tools"), array, element object].
+  #inToolElement() {
+    const s = this.stack;
+    return s.length === 3 && s[0].isObj && s[0].key === 'tools' && !s[1].isObj && s[2].isObj;
+  }
+
+  #byte(b) {
+    if (this.inStr) {
+      if (this.esc) { this.esc = false; if (this.reading) this.buf.push(b); return; }
+      if (b === 0x5c) { this.esc = true; if (this.reading) this.buf.push(b); return; } // backslash
+      if (b === 0x22) {                                            // closing quote
+        this.inStr = false;
+        if (this.reading) {
+          const text = Buffer.from(this.buf).toString('utf8');
+          if (this.reading === 'key') this.stack[this.stack.length - 1].key = text;
+          else if (this.reading === 'type') this.toolType = text;
+          else this.toolModel = text;
+          this.reading = null;
+          this.buf = [];
+        }
+        return;
+      }
+      if (this.reading) this.buf.push(b);
+      return;
+    }
+
+    switch (b) {
+      case 0x7b:                                                   // {
+        this.stack.push({ isObj: true, key: null, awaitingKey: true });
+        if (this.#inToolElement()) { this.toolType = null; this.toolModel = null; }
+        break;
+      case 0x5b: this.stack.push({ isObj: false, key: null, awaitingKey: false }); break; // [
+      case 0x7d:                                                   // }
+        if (this.#inToolElement()
+            && typeof this.toolType === 'string' && /^advisor/i.test(this.toolType)
+            && this.toolModel) {
+          this.value = this.toolModel;
+          this.done = true;
+        }
+        // fall through: pop like ]
+      case 0x5d:                                                   // ]
+        this.stack.pop();
+        if (this.stack.length === 0) this.done = true;             // root closed → absent
+        break;
+      case 0x3a: { const t = this.stack[this.stack.length - 1]; if (t?.isObj) t.awaitingKey = false; break; } // :
+      case 0x2c: { const t = this.stack[this.stack.length - 1]; if (t?.isObj) t.awaitingKey = true; break; }  // ,
+      case 0x22: {                                                 // string begins
+        const t = this.stack[this.stack.length - 1];
+        if (t?.isObj && t.awaitingKey) this.reading = 'key';
+        else if (this.#inToolElement() && (t.key === 'type' || t.key === 'model')) this.reading = t.key;
+        else this.reading = null;                                  // uninteresting string: skip bytes
+        this.buf = [];
+        this.inStr = true;
+        this.esc = false;
+        break;
+      }
+      default: break;                                              // scalars / whitespace
+    }
+  }
+}
+
+// Extract the advisor model from a JSON request body, or null when the request
+// carries no advisor tool. Gated on a cheap byte search for "advisor" so the
+// full structural scan only runs on bodies that could possibly contain one —
+// for everything else this is a single Buffer.includes.
+export function parseAdvisorModel(body) {
+  if (!body) return null;
+  try {
+    const buf = Buffer.isBuffer(body) ? body : Buffer.from(String(body), 'utf8');
+    if (!buf.includes('advisor')) return null;
+    return new AdvisorModelFinder().push(buf);
+  } catch { return null; }
+}