@rikcodes/teamclaude 1.1.14-rik.2 → 1.1.15-rik.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.14-rik.2",
+  "version": "1.1.15-rik.1",
   "description": "Multi-account Claude proxy with automatic quota-based rotation",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,10 +1,11 @@
 import { refreshAccessToken, isTokenExpiringSoon, isTokenExpired, formatMoney } from './oauth.js';
-import { providerOf, DEFAULT_PROVIDER } from './provider.js';
+import { providerOf, DEFAULT_PROVIDER, isSubscriptionAccount } from './provider.js';
 import { refreshCodexToken } from './codex-auth.js';
 import { parseCodexQuota, parseCodexPlanType } from './codex-quota.js';
 import { sameIdentity } from './identity.js';
 import { weeklyBucketForModel, modelGlobMatches, modelFamily, gatingUtilization, resolveMaxUsage } from './model.js';
 import { SessionTracker } from './session-tracker.js';
+import { buildQuotaSummary } from './quota-summary.js';
 import { QuotaProjection, PROJECTED_BUCKETS } from './quota-projection.js';
 
 // Re-exported for callers that import these model helpers from here.
@@ -129,6 +130,11 @@ function makeAccount(acct, index) {
     accountUuid: acct.accountUuid || null,
     orgUuid: acct.orgUuid || null,
     orgName: acct.orgName || null,
+    organizationType: acct.organizationType || null,
+    rateLimitTier: acct.rateLimitTier || null,
+    seatTier: acct.seatTier || null,
+    hasClaudeMax: acct.hasClaudeMax ?? null,
+    hasClaudePro: acct.hasClaudePro ?? null,
     priority: acct.priority || 0,
     disabled: acct.disabled || false,
     maxUsage: acct.maxUsage ?? null,
@@ -237,6 +243,15 @@ export class AccountManager {
     // it. Each such switch arms the ramp below, so steady interleaved traffic
     // holds both accounts at the ramp floor while nothing has failed over.
     this.routeCursors = new Map();
+    // One cursor per provider. `currentIndex` is a single slot, and a request
+    // only another provider can serve would otherwise drag it across: a Codex
+    // request moved it onto a Codex account and the next Anthropic request moved
+    // it straight back, flapping the TUI's current-account marker and re-arming
+    // storm control on every alternation. A provider partition is the purest
+    // form of "barred for THIS request only" — an Anthropic account serves every
+    // Anthropic request perfectly well — so it must not move the fleet, exactly
+    // as a spent family bucket does not (#276).
+    this.providerCursors = new Map();
     this.switchThreshold = switchThreshold;
     this.setRoutes(routes);
     this.setSoonestWeekly(soonestWeekly);
@@ -459,6 +474,14 @@ export class AccountManager {
    * window (storm control) so they trickle out rather than flood. Extends an
    * existing pause rather than shortening it.
    */
+  /** True while an account is inside a rate-limit pause (see pauseAccount). The
+   * pause deliberately does NOT mark the account throttled, so selection still
+   * offers it — a caller choosing a failover target has to ask. */
+  isPaused(index, now = Date.now()) {
+    const account = this.accounts[index];
+    return !!(account?.pausedUntil && now < account.pausedUntil);
+  }
+
   pauseAccount(index, seconds) {
     const account = this.accounts[index];
     if (!account) return;
@@ -511,12 +534,43 @@ export class AccountManager {
    * request keeps flowing (upstream then fails just the advisor call).
    */
   getActiveAccount(exclude = null, model = null, advisorModel = null, sessionId = null, provider = DEFAULT_PROVIDER) {
-    const account = this._pickActiveAccount(this._excludeOtherProviders(exclude, provider), model, advisorModel, sessionId);
+    // Selection reads this.currentIndex as "where the fleet is". With more than
+    // one provider that is a single slot for several fleets, so a request whose
+    // provider does not own it borrows the slot for the walk and hands it back.
+    //
+    // With one provider — every config that predates #246 — `borrowed` is always
+    // false and this is the same code it was.
+    const owner = providerOf(this.accounts[this.currentIndex]);
+    const borrowed = !!this.accounts.length && owner !== provider;
+    const saved = this.currentIndex;
+    if (borrowed) {
+      const own = this.providerCursors.get(provider);
+      if (own != null && this.accounts[own] && providerOf(this.accounts[own]) === provider) this.currentIndex = own;
+    }
+
+    let account;
+    // Scoped rather than threaded through _select/_selectNext/_divertedFor: the
+    // whole walk is synchronous, so nothing can interleave and observe it, and
+    // the alternative is a provider argument on six private methods that exist
+    // to answer a different question.
+    this._selectingProvider = provider;
+    try {
+      account = this._pickActiveAccount(this._excludeOtherProviders(exclude, provider), model, advisorModel, sessionId);
+    } finally {
+      this._selectingProvider = null;
+      // Hand the slot back before anything can observe it moved. Only the
+      // provider that owns currentIndex gets to change it.
+      if (borrowed) this.currentIndex = saved;
+    }
+
     // Record where this route now sits, whatever path chose it — the steady-state
     // path returns the account the cursor already names and never reaches the
     // rotation code, so recording there alone would leave the cursor unset and
     // the next real failover unpaced.
-    if (account) this.routeCursors.set(this._cursorKey(model), account.index);
+    if (account) {
+      this.routeCursors.set(this._cursorKey(model, advisorModel, provider), account.index);
+      this.providerCursors.set(providerOf(account), account.index);
+    }
     return account;
   }
 
@@ -535,7 +589,13 @@ export class AccountManager {
    * the common single-provider case allocates nothing.
    */
   _excludeOtherProviders(exclude, provider) {
-    const foreign = this.accounts.filter(a => providerOf(a) !== provider);
+    // Only SUBSCRIPTION accounts are partitioned. A Claude Max token is issued
+    // to Claude and a ChatGPT token to Codex; neither plan can be spent by the
+    // other's client, so crossing them is never right. An API key carries no
+    // such tie — it is metered capacity, not a seat — so it stays eligible for
+    // whichever app is asking, which is what keeps a third-party backend usable
+    // from both.
+    const foreign = this.accounts.filter(a => providerOf(a) !== provider && isSubscriptionAccount(a));
     if (foreign.length === 0) return exclude;
     const combined = new Set(exclude || []);
     for (const account of foreign) combined.add(account.index);
@@ -607,6 +667,11 @@ export class AccountManager {
       const betterExists = this._preemptedBy(current, model, advisorModel, exclude);
       return betterExists ? this._selectNext(exclude, model, advisorModel) : current;
     }
+    // Barred for this request only: keep the family where it was diverted.
+    // Barred outright (disabled, throttled, spent): rotate, as before.
+    const diverted = this._currentBarredOnlyFor(model, advisorModel, exclude)
+      ? this._divertedFor(model, advisorModel, exclude) : null;
+    if (diverted) return diverted;
     const next = this._selectNext(exclude, model, advisorModel);
     if (next) return next;
     // No account is under the switch threshold. Before refusing locally, allow a
@@ -776,6 +841,13 @@ export class AccountManager {
         this._isAvailable(a, model) && (a.priority || 0) < (current.priority || 0));
       if (!better) return current.index;
     }
+    // Mirror _select's diversion cursor, so the preview names the account a
+    // diverted family will actually land on rather than the one a fresh walk
+    // would pick.
+    if (this._currentBarredOnlyFor(model)) {
+      const diverted = this._divertedFor(model);
+      if (diverted) return diverted.index;
+    }
     const best = this._pickBestAvailable(null, model);
     return best ? best.index : null;
   }
@@ -978,7 +1050,13 @@ export class AccountManager {
 
     // A structured organization-policy 403 means this account cannot serve OAuth
     // requests right now. Skip it across requests until the short cooldown ends.
-    if (this._entitlementDenied(account)) return false;
+    //
+    // A reason string, not `false`: this function's contract is "a reason, or
+    // null when it can serve", and getStatus surfaces the value verbatim. `false`
+    // read as available against that contract and, being falsy, made
+    // unavailableLine drop the row — so the one state added to make a refusal
+    // explainable was the only one that printed no explanation (#258).
+    if (this._entitlementDenied(account)) return 'entitlement';
 
     // Check rate limit expiry
     if (account.status === 'throttled' && account.rateLimitedUntil) {
@@ -1257,9 +1335,59 @@ export class AccountManager {
     this.routeCursors?.clear();
   }
 
-  /** Cursor key for a model: its route's name, or '' when no route matches. */
-  _cursorKey(model) {
-    return this._routeForModel(model)?.name || '';
+  /**
+   * Cursor key for a request: its route's name, or — with no route configured —
+   * the weekly bucket the model spends, so Fable and Opus keep separate cursors
+   * in the default config too (one key for everything let a Fable diversion be
+   * read back as the Opus cursor, #276). An advisor request is keyed by both
+   * families it needs: it is diverted for the advisor's sake as often as the
+   * executor's, and sharing a cursor with plain requests for the executor's
+   * model would have each overwrite the other's and re-log the diversion.
+   */
+  _cursorKey(model, advisorModel = null, provider = this._selectingProvider || DEFAULT_PROVIDER) {
+    const own = this._routeForModel(model)?.name || (model ? this._weeklyBucketFor(model) : '');
+    const base = (() => {
+      if (!advisorModel) return own;
+      const adv = this._routeForModel(advisorModel)?.name || this._weeklyBucketFor(advisorModel);
+      return adv === own ? own : `${own}+${adv}`;
+    })();
+    // Namespaced by provider so a diversion recorded for one provider is never
+    // read back as another's. Model names do not have to differ between
+    // providers, and a bucket key certainly does not — an unprefixed key would
+    // hand a Codex request the account an Anthropic request was diverted to.
+    // The default provider keeps the bare key, so existing cursors and every
+    // single-provider config are unchanged.
+    return provider === DEFAULT_PROVIDER ? base : `${provider}\u0000${base}`;
+  }
+
+  /**
+   * True when the current account can serve in general but not THIS request:
+   * its family bucket or cap is spent, a route excludes it, or the advisor
+   * model's family is spent. That is a per-request diversion, not a rotation,
+   * and the fleet stays where it is. False for disabled / error / throttled /
+   * 5h or shared weekly over threshold, which bar every request and must
+   * rotate the fleet as before.
+   */
+  _currentBarredOnlyFor(model, advisorModel = null, exclude = null) {
+    const current = this.accounts[this.currentIndex];
+    return !!model && !!current && !exclude?.has(current.index)
+      && this._isAvailable(current, null) && !this._isAvailable(current, model, advisorModel);
+  }
+
+  /**
+   * Where this request's family was last diverted to, if that account can still
+   * serve it. Consulted only once the current account has been found barred
+   * for this request alone, so a family returns to the current account the
+   * moment it can serve it again rather than staying diverted out of habit.
+   * Yields to a higher-priority account the same way the current account does.
+   */
+  _divertedFor(model, advisorModel = null, exclude = null) {
+    if (!model) return null;
+    const idx = this.routeCursors.get(this._cursorKey(model, advisorModel));
+    const account = idx != null ? this.accounts[idx] : null;
+    if (!account || account.index === this.currentIndex || exclude?.has(account.index)) return null;
+    if (!this._isAvailable(account, model, advisorModel)) return null;
+    return this._preemptedBy(account, model, advisorModel, exclude) ? null : account;
   }
 
   /** The account this route was serving from before the current selection, or
@@ -1269,8 +1397,8 @@ export class AccountManager {
    * it names an account the route could have used: a cursor left on another
    * route's account was never this route's position, so moving off it is not a
    * rotation. */
-  _previousCursor(model) {
-    const recorded = this.routeCursors.get(this._cursorKey(model));
+  _previousCursor(model, advisorModel = null) {
+    const recorded = this.routeCursors.get(this._cursorKey(model, advisorModel));
     if (recorded != null) return recorded;
     const current = this.accounts[this.currentIndex];
     return current && this._routeAllows(current, model) ? current.index : null;
@@ -1449,6 +1577,14 @@ export class AccountManager {
     // Clear expired unified quotas
     if (q.unified5h != null && q.unified5hReset && now >= q.unified5hReset) {
       console.log(`[TeamClaude] Account "${account.name}" session quota reset`);
+      // Recorded on the account, not just returned. _clearExpiredQuotas is
+      // reached from two directions — refreshExpiredQuotas on the request path,
+      // which runs the session-reset switch rule, and _isNearQuota via
+      // unavailableReason, which getStatus calls for every account on every
+      // read. Whichever noticed first used to consume the event, so with a
+      // dashboard polling every 5s the rule almost never ran (#275). The flag
+      // outlives the observation; only the request path clears it.
+      account.sessionResetPending = true;
       q.unified5h = null;
       q.unified5hReset = null;
       // `rejected` describes the shared buckets and this is one of them: a
@@ -1557,13 +1693,31 @@ export class AccountManager {
    * account's (and it still has weekly quota), so we spend the quota closest to
    * refreshing first.
    */
+  /**
+   * Clear windows whose reset has passed, WITHOUT the session-reset switch.
+   *
+   * For read paths. refreshExpiredQuotas() also runs _switchOnSessionReset,
+   * which moves currentIndex — so calling that from getStatus would let a GET
+   * on /teamclaude/status rotate the fleet as a side effect of being read, and
+   * a polling dashboard would quietly drive routing.
+   */
+  sweepExpiredQuotas() {
+    for (const account of this.accounts) this._clearExpiredQuotas(account);
+  }
+
   refreshExpiredQuotas() {
     let changed = false;
     const sessionReset = [];
     for (const account of this.accounts) {
       const r = this._clearExpiredQuotas(account);
       if (r.changed) changed = true;
-      if (r.session) sessionReset.push(account);
+      // The flag, not r.session: a status read may have cleared the window
+      // seconds earlier, and the rule still has to run. Cleared here because
+      // this is the only path that acts on it.
+      if (account.sessionResetPending) {
+        account.sessionResetPending = false;
+        sessionReset.push(account);
+      }
     }
     if (sessionReset.length) this._switchOnSessionReset(sessionReset);
     return changed;
@@ -1697,15 +1851,25 @@ export class AccountManager {
   _selectNext(exclude = null, model = null, advisorModel = null) {
     const best = this._pickBestAvailable(exclude, model, advisorModel);
     if (best) {
-      const previous = this._previousCursor(model);
+      const previous = this._previousCursor(model, advisorModel);
       const switched = previous != null && previous !== best.index;
-      this.currentIndex = best.index;
+      // A model-scoped exclusion — the current account serves everything but
+      // this request (family bucket, cap, route, or the advisor's family) —
+      // diverts this request alone. The global cursor stays: the account was
+      // chosen, often by hand for a weekly window about to lapse, to be spent by
+      // what it can serve, and moving the whole fleet off it for one family's
+      // sake undid that on the next request (#276).
+      const current = this.accounts[this.currentIndex];
+      const scoped = this._currentBarredOnlyFor(model, advisorModel, exclude);
+      if (!scoped) this.currentIndex = best.index;
       // If we switched to an account whose weekly quota is still unknown, flag
       // it so we re-evaluate once that quota is learned (see updateQuota).
       best.probing = best.quota.unified7dReset == null;
       if (switched) {
         this._beginRamp(best);
-        console.log(`[TeamClaude] Switched to account "${best.name}"`);
+        console.log(scoped
+          ? `[TeamClaude] Diverting "${model}" to "${best.name}" — "${current.name}" cannot serve it`
+          : `[TeamClaude] Switched to account "${best.name}"`);
       }
       return best;
     }
@@ -2063,6 +2227,15 @@ export class AccountManager {
     }
   }
 
+  /** Apply subscription metadata learned from the OAuth profile endpoint. */
+  applyProfileData(accountIndex, profile) {
+    const account = this.accounts[accountIndex];
+    if (!account || !profile || profile.error) return;
+    for (const field of ['organizationType', 'rateLimitTier', 'seatTier', 'hasClaudeMax', 'hasClaudePro']) {
+      if (profile[field] != null) account[field] = profile[field];
+    }
+  }
+
   /**
    * Mark an account as rate-limited for a given duration.
    */
@@ -2260,7 +2433,14 @@ export class AccountManager {
     return this.accounts.map(a => {
       const quota = {};
       for (const f of PERSISTED_QUOTA_FIELDS) quota[f] = a.quota[f];
-      return { accountUuid: a.accountUuid, orgUuid: a.orgUuid, orgName: a.orgName, name: a.name, quota };
+      const profile = {
+        organizationType: a.organizationType,
+        rateLimitTier: a.rateLimitTier,
+        seatTier: a.seatTier,
+        hasClaudeMax: a.hasClaudeMax,
+        hasClaudePro: a.hasClaudePro,
+      };
+      return { accountUuid: a.accountUuid, orgUuid: a.orgUuid, orgName: a.orgName, name: a.name, profile, quota };
     });
   }
 
@@ -2277,6 +2457,9 @@ export class AccountManager {
       for (const f of PERSISTED_QUOTA_FIELDS) {
         if (match.quota[f] != null) account.quota[f] = match.quota[f];
       }
+      for (const field of ['organizationType', 'rateLimitTier', 'seatTier', 'hasClaudeMax', 'hasClaudePro']) {
+        if (match.profile?.[field] != null) account[field] = match.profile[field];
+      }
       // We already know this account's weekly window, so it isn't "probing".
       if (account.quota.unified7dReset != null) account.probing = false;
     }
@@ -2290,9 +2473,19 @@ export class AccountManager {
   // client and dimension value to anyone who can read status, and on a shared
   // proxy that is every key holder.
   getStatus({ sessionDetail = false } = {}) {
+    // Sweep first: nothing else on the read path does, so an idle server kept
+    // reporting a window whose reset had already passed — at its old percentage,
+    // with a timestamp in the past — to `status --json`, anything scripted
+    // against the endpoint, and the attached TUI, whose own refresh is a no-op
+    // precisely because it trusts the server to have done this (#237).
+    this.sweepExpiredQuotas();
     const sessions = this.sessionTracker.stats(undefined, { detail: sessionDetail });
     return {
       currentAccount: this.accounts[this.currentIndex]?.name,
+      // Where a request no route claims lands right now — the same derivation
+      // as each route's `target`, so a status reader need not assume "the
+      // current account" when that account is blocked or outranked.
+      defaultTarget: this._routeTarget(null),
       switchThreshold: this.effectiveThreshold,
       // The full table when one is configured, so status output can show the
       // per-bucket values rather than only the representative number.
@@ -2340,4 +2533,10 @@ export class AccountManager {
       })),
     };
   }
+
+  /** Return per-account quota and fleet aggregates for status clients. */
+  getQuotaSummary() {
+    this.refreshExpiredQuotas();
+    return buildQuotaSummary(this.accounts);
+  }
 }

package/src/account-pairing.js

@@ -58,10 +58,70 @@ export function configIndexFor(configAccounts, managerAccounts, mgrIdx) {
  * its own and read another's credential a restart later. Pairing by id does not
  * reach this axis.
  */
-export function mergeAccountsForSave(configAccounts, managerAccounts, diskAccounts) {
-  return configAccounts.map(a => {
+/**
+ * Whether this entry's OAuth token belongs in `config.json` at all.
+ *
+ * The save used to write `accessToken: am.credential` onto EVERY entry, which
+ * is right for an ordinary oauth account and wrong for the other two kinds:
+ *
+ *   - an API-KEY account's credential is its `apiKey`, so the save mirrored the
+ *     same secret into `accessToken` — and makeAccount reads
+ *     `acct.accessToken || acct.apiKey`, preferring the mirror. Rotating the key
+ *     in config.json was then ignored on the next cold start, while a running
+ *     server picked it up, so the failure looked like the provider rejecting a
+ *     key that reads correctly in the file (#202).
+ *   - an `importFrom` account delegates to a credentials file on purpose. One
+ *     save materialised the token into config.json, and from then on the copy
+ *     won over re-reading the file, so the entry stopped delegating in practice
+ *     (#204).
+ *
+ * Refreshed tokens for ordinary oauth entries still persist — that is the case
+ * this write exists for.
+ */
+function ownsInlineToken(entry) {
+  return entry?.type === 'oauth' && !entry.importFrom;
+}
+
+// Entries the operator removed in this process, by id.
+//
+// The save has to tell two things apart that look identical on disk: a row that
+// appeared since the last reload (`teamclaude login` while the server runs —
+// keep it) and a row the operator just deleted (drop it). Both are "on disk but
+// not in memory", and removal is itself a save, so adopting disk-only rows
+// without this would resurrect the account the operator was in the middle of
+// deleting.
+//
+// Held on the config object and non-enumerable, so it never reaches JSON.
+const REMOVED = Symbol('removedAccountIds');
+
+/** Record that `id` was deliberately removed, so a save does not adopt it back. */
+export function markAccountRemoved(config, id) {
+  if (!config || !id) return;
+  if (!config[REMOVED]) {
+    Object.defineProperty(config, REMOVED, { value: new Set(), enumerable: false, writable: true });
+  }
+  config[REMOVED].add(id);
+}
+
+/** The ids removed so far. */
+export function removedAccountIds(config) {
+  return config?.[REMOVED] || new Set();
+}
+
+/**
+ * Forget the removals, once a save has written a list that omits them. After
+ * that the rows are gone from disk too, so there is nothing left to re-adopt
+ * and keeping the ids would only strand them if the operator re-added the same
+ * account later.
+ */
+export function clearRemovedAccountIds(config) {
+  if (config?.[REMOVED]) config[REMOVED].clear();
+}
+
+export function mergeAccountsForSave(configAccounts, managerAccounts, diskAccounts, removedIds = new Set()) {
+  const merged = configAccounts.map(a => {
     const am = managerAccountFor(managerAccounts, a);
-    const live = am ? {
+    const live = am && ownsInlineToken(a) ? {
       ...a,
       accessToken: am.credential,
       refreshToken: am.refreshToken,
@@ -70,6 +130,24 @@ export function mergeAccountsForSave(configAccounts, managerAccounts, diskAccoun
     const diskAcct = diskAccounts.find(d => sameIdentity(d, a));
     return diskAcct ? { ...diskAcct, ...live } : live;
   });
+
+  // Carry over rows that exist on disk and not in memory. The list used to be
+  // exactly as long as the in-memory one, so an account added by another
+  // process since the last reload — `teamclaude login` or `import` while the
+  // server runs — was silently dropped by the next save (#205). The refresh
+  // handler already re-reads disk for this reason; the save had no equivalent.
+  //
+  // Except the ones the operator removed: removal is itself a save, so without
+  // that check this would resurrect the account being deleted, on the very
+  // write that was meant to delete it.
+  const keptIds = new Set(merged.map(a => a?.id).filter(Boolean));
+  for (const diskAcct of diskAccounts) {
+    if (!diskAcct?.id) continue;                 // pre-id row; identity above covers it
+    if (keptIds.has(diskAcct.id)) continue;
+    if (removedIds.has(diskAcct.id)) continue;
+    merged.push(diskAcct);
+  }
+  return merged;
 }
 
 /**