@rikcodes/teamclaude 1.1.20-rik.3 → 1.1.20-rik.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.20-rik.3",
+  "version": "1.1.20-rik.5",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -19,6 +19,7 @@ import {
   updateAccountEntry,
   canUpsertOAuthAccount,
   oauthIdentityFields, duplicateNameWarnings } from './identity.js';
+import { routeReachabilityWarnings } from './route-warnings.js';
 import { resolveAccounts } from './resolve-accounts.js';
 import { loginCodex } from './codex-auth.js';
 import { syncAccountsFromDisk } from './sync-accounts.js';
@@ -290,6 +291,10 @@ async function serverCommand() {
   // one name, and every name lookup becomes ambiguous. Said once at startup and
   // again after a reload, never fatal.
   for (const line of duplicateNameWarnings(accounts)) console.error(line);
+  // Same shape, same reason: route membership is by name while eligibility is by
+  // provider, so a route can list only accounts that cannot serve the request
+  // that arrives — and every readout still shows it healthy.
+  for (const line of routeReachabilityWarnings(config.routes, accounts)) console.error(line);
   const accountManager = new AccountManager(accounts, threshold, { routes: config.routes, ramp: config.stormRamp, distributeSessions: config.distributeSessions, projection: config.projection, expiryRouting: config.expiryRouting, adaptive });
   // Names the activity log's session column from Claude Code's own on-disk
   // session titles. Built whether or not the TUI runs, so a reload has one
@@ -413,6 +418,9 @@ async function serverCommand() {
     // Pick up route table edits (teamclaude route …, TUI editor, or a hand edit).
     config.routes = diskConfig.routes || [];
     accountManager.setRoutes(config.routes);
+    // After setRoutes, not before: a route edit is the whole reason this check
+    // exists, and reading the table it replaced would miss exactly that.
+    for (const line of routeReachabilityWarnings(config.routes, accountManager.accounts)) console.error(line);
     // Pick up a distributeSessions change (hand edit or another writer) the same
     // way routes, sx, probe and warmup are picked up below.
     // Not coerced to a boolean: 'adaptive' is a third mode, and !! would flatten

package/src/provider.js

@@ -24,6 +24,11 @@ export const PROVIDERS = {
     // Anthropic pins the account inside the request body (metadata.user_id),
     // so the body rewrites apply here and only here.
     rewritesBody: true,
+    // Claude Code waits for the first response byte for as long as its own
+    // API_TIMEOUT_MS allows, which is generous. That is what lets the proxy
+    // wait out a short retry-after, or poll for an account to recover, without
+    // the client ever seeing the 429.
+    holdsConnection: true,
   },
   codex: {
     id: 'codex',
@@ -36,6 +41,13 @@ export const PROVIDERS = {
     // needed — and the Anthropic-specific tool-pair repair would be wrong to
     // apply to a Responses API body.
     rewritesBody: false,
+    // A Codex client gives the response head a fixed 60s and then retries the
+    // whole request, about four times, before failing. None of that is visible
+    // from here, so a wait we intended as "absorb this for the client" reads to
+    // it as a hang: it abandons the attempt we are still holding, retries into
+    // the same wait, and turns one reportable 429 into a ~250s silent stall and
+    // then a storm of them. Answer it instead and let it back off knowing why.
+    holdsConnection: false,
   },
 };
 
@@ -201,6 +213,25 @@ export function upstreamFor(account, configuredUpstream) {
   return configuredUpstream || PROVIDERS.anthropic.upstream;
 }
 
+/**
+ * Whether the proxy may hold a request on the connection — waiting out a
+ * retry-after, or polling for an account to recover — instead of answering now.
+ *
+ * Holding is only invisible to a client that waits longer than we do. That is a
+ * property of the client, and the request path is what we know about it: every
+ * caller on the Codex path speaks the Codex protocol and brings its own fixed
+ * deadline with it, whether it is the Codex CLI or a translating sidecar's back
+ * leg. Keyed on the provider rather than on the caller's address, because a
+ * loopback peer does not narrow it — Claude Code is loopback too.
+ *
+ * Only the WAIT is withheld. Pausing the account, so concurrent requests avoid
+ * it, still happens; the client is simply told now, with the retry-after it
+ * needs to act on.
+ */
+export function holdsConnection(provider) {
+  return PROVIDERS[provider && PROVIDERS[provider] ? provider : DEFAULT_PROVIDER].holdsConnection;
+}
+
 /** Whether the Anthropic-only body rewrites apply to this account. */
 export function rewritesBody(account) {
   return PROVIDERS[providerOf(account)].rewritesBody;

package/src/route-warnings.js

@@ -0,0 +1,60 @@
+// Config coherence a route cannot check for itself.
+//
+// Route membership is by NAME, but eligibility is by PROVIDER — and the two
+// disagree silently. A route may name three accounts, every one of them healthy
+// in `teamclaude status`, and still be unable to answer the request that
+// actually arrives, because the arriving path decides which of them are even
+// candidates.
+
+import { providerOf, isSubscriptionAccount, DEFAULT_PROVIDER } from './provider.js';
+
+/**
+ * Whether `account` is a candidate for a request on `provider`'s path.
+ *
+ * Mirrors the partition selection applies (`_excludeOtherProviders`): only
+ * SUBSCRIPTION accounts are fenced off by provider, because a Claude Max token
+ * is issued to Claude and a ChatGPT token to Codex. An API key is metered
+ * capacity rather than a seat, so it stays eligible for whichever app is asking.
+ */
+export function canServeProvider(account, provider) {
+  return providerOf(account) === provider || !isSubscriptionAccount(account);
+}
+
+/**
+ * Warn about a route that no inbound Claude Code request can be served by.
+ *
+ * The failure this exists for, observed live on 2026-09-15: a `gpt-*` route lost
+ * the one account that served its inbound leg — the local translating sidecar —
+ * leaving only the ChatGPT subscriptions its back leg draws on. Those are Codex
+ * accounts, so they serve `/backend-api/codex/*` and nothing else. Every GPT
+ * request died instantly while `teamclaude status` showed two healthy accounts
+ * sitting on the route, and nothing anywhere said why.
+ *
+ * Only routes with an explicit `accounts` list are checked. An empty list means
+ * "the whole fleet", which cannot have this problem — and the explicit list is
+ * where the trap lives, because it is edited by hand and silently load-bearing.
+ */
+export function routeReachabilityWarnings(routes = [], accounts = []) {
+  const warnings = [];
+  for (const route of routes || []) {
+    const listed = route?.accounts;
+    if (!Array.isArray(listed) || listed.length === 0) continue;
+    const members = (accounts || []).filter(a =>
+      listed.includes(a?.name) || (a?.index != null && listed.includes(String(a.index))));
+    // No member resolves at all: a different fault (a name that names nothing),
+    // and reporting it as "cannot serve" would point at the wrong repair.
+    if (members.length === 0) continue;
+    if (members.some(a => canServeProvider(a, DEFAULT_PROVIDER))) continue;
+
+    const names = members.map(a => a.name).join(', ');
+    const providers = [...new Set(members.map(a => providerOf(a)))].join('/');
+    const globs = (route.match || []).join(', ');
+    warnings.push(
+      `[TeamClaude] Route "${route.name}"${globs ? ` (${globs})` : ''} has no account that can serve `
+      + `/v1/messages — every account it lists (${names}) is a ${providers} subscription, which serves `
+      + 'only its own path. Claude Code requests matching this route will find no account, while '
+      + '`teamclaude status` shows the route healthy. Add back the account that serves the inbound '
+      + 'leg (for a sidecar setup, the local one).');
+  }
+  return warnings;
+}

package/src/server.js

@@ -12,7 +12,7 @@ import { parseRequestModel, parseAdvisorModel } from './account-manager.js';
 import { TopLevelFieldFinder, modelGlobMatches } from './model.js';
 import { BodyWriter, truncationNote } from './request-log.js';
 import { upstreamFetch, upstreamPoolStatus } from './upstream-fetch.js';
-import { applyAuthHeaders, upstreamFor, rewritesBody, providerForPath, providerOf, isSubscriptionAccount, DEFAULT_PROVIDER } from './provider.js';
+import { applyAuthHeaders, upstreamFor, rewritesBody, providerForPath, providerOf, isSubscriptionAccount, holdsConnection, DEFAULT_PROVIDER } from './provider.js';
 import { tunnelTls } from './sx.js';
 import { createEgressGuard } from './egress-guard.js';
 import { safeLine } from './safe-text.js';
@@ -2074,7 +2074,11 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
     // recovers or the budget (holdSeconds) runs out. Claude Code waits for
     // the first response byte, so this is transparent to the client as long
     // as API_TIMEOUT_MS on the Claude Code side is large enough.
-    if (ctx.holdBudgetMs > 0) {
+    //
+    // Which is exactly the assumption `holdsConnection` exists to check. A
+    // Codex caller gives up on the head long before the budget does, so for it
+    // the hold is not transparent at all — it is the whole failure.
+    if (ctx.holdBudgetMs > 0 && holdsConnection(ctx.provider)) {
       // Cap the per-poll sleep to 60s so a newly-available account (e.g. one
       // manually enabled or whose quota reset early) is picked up within a
       // minute instead of sleeping the full retryAfter (often 3600s).
@@ -2087,7 +2091,7 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
     }
 
     const exhaustedRetries = ctx.exhaustedRetries || 0;
-    if (exhaustedRetries < 1 && retryAfter <= INLINE_RETRY_AFTER_MAX_SECONDS) {
+    if (exhaustedRetries < 1 && retryAfter <= INLINE_RETRY_AFTER_MAX_SECONDS && holdsConnection(ctx.provider)) {
       ctx.exhaustedRetries = exhaustedRetries + 1;
       console.log(`[TeamClaude] All accounts exhausted — waiting ${retryAfter}s before retry`);
       await waitForRetry(retryAfter * 1000, ctx.signal);
@@ -2415,17 +2419,19 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
       // Absorb short waits inline on the same account — the client never sees the
       // 429. Bounded by retryCount (maxRetries = account count) so a persistently
       // rate-limited account can't loop forever tying up the connection.
-      if (retryAfter <= RATE_LIMIT_ABSORB_MAX_SECONDS && retryCount < maxRetries) {
+      if (retryAfter <= RATE_LIMIT_ABSORB_MAX_SECONDS && retryCount < maxRetries && holdsConnection(ctx.provider)) {
         console.log(`[TeamClaude] Rate-limit 429 on "${account.name}" — waiting ${retryAfter}s, retrying same account (no switch)`);
         await waitForRetry(retryAfter * 1000, ctx.signal);
         if (clientGone(res)) { ctx.abandoned = true; return; }
         return forwardRequest(req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir, sx, nextUseSx);
       }
 
-      // Longer retry-after (or retries exhausted): don't hold the connection and
-      // don't rotate — surface the 429 with retry-after so the client backs off.
-      // The pause above keeps other requests off this account meanwhile.
-      console.log(`[TeamClaude] Rate-limit 429 on "${account.name}" — retry-after ${retryAfter}s over inline cap; returning 429 to client (no switch)`);
+      // Longer retry-after, retries exhausted, or a caller that will not wait
+      // for us (see holdsConnection): don't hold the connection and don't
+      // rotate — surface the 429 with retry-after so the client backs off. The
+      // pause above keeps other requests off this account meanwhile.
+      const why = holdsConnection(ctx.provider) ? `retry-after ${retryAfter}s over inline cap` : `${ctx.provider} caller does not wait`;
+      console.log(`[TeamClaude] Rate-limit 429 on "${account.name}" — ${why}; returning 429 to client (no switch)`);
       ctx.status = 429;
       if (!res.headersSent && !clientGone(res)) {
         res.writeHead(429, { 'Content-Type': 'application/json', 'retry-after': String(retryAfter) });

package/src/status-renderer.js

@@ -217,7 +217,13 @@ function routingLines(routes, blocked, paint) {
     // which hop each account serves instead of reading as one flat pool.
     const routeProvider = route.provider || 'anthropic';
     const accountText = (a) => {
-      const tag = a.provider && a.provider !== routeProvider ? `:${nameText(a.provider)}` : '';
+      const foreign = a.provider && a.provider !== routeProvider;
+      // Unless the name already leads with it. `login --codex` mints
+      // `codex:someone@example.com`, so tagging that again reads
+      // `codex:someone@example.com:codex` — the same word twice, once as the
+      // thing's name and once as a fact about it.
+      const saysSoItself = foreign && a.name.startsWith(`${a.provider}:`);
+      const tag = foreign && !saysSoItself ? `:${nameText(a.provider)}` : '';
       return nameText(a.name) + tag;
     };
     const accounts = routeBlocked

package/src/tui.js

@@ -494,6 +494,18 @@ export class TUI {
   start() {
     this.running = true;
     this._openActivityLog();
+    // Node puts a TTY stdout in BLOCKING mode, so every paint is a synchronous
+    // write(2) that returns only when the terminal has drained the pty. That
+    // makes the proxy's event loop hostage to its own display: when the
+    // terminal emulator pauses — an Electron pane busy elsewhere, a window
+    // occluded, the machine dozing — the write sits in the kernel and nothing
+    // else runs: no upstream bytes relayed, no request completed, no log line.
+    // Measured live: stalls of 5-29s, the main thread in write() under
+    // StreamBase::WriteString, with sessions "waiting for API response" and
+    // nothing to see anywhere because the thing that would show it is the
+    // thing blocked. Non-blocking here, and the paint below drops a frame
+    // when the terminal is behind instead of waiting for it.
+    this._setStdoutBlocking(false);
     process.stdout.write(`${ESC}?1049h${ESC}?25l`);
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -550,6 +562,12 @@ export class TUI {
     if (this._activityStream) { this._activityStream.end(); this._activityStream = null; }
     process.stdin.removeListener('data', this._dataHandler);
     process.stdout.removeListener('resize', this._resizeHandler);
+    if (this._drainHandler) { process.stdout.removeListener('drain', this._drainHandler); this._drainHandler = null; }
+    // Blocking again for the exit sequence: a non-blocking write can still be
+    // queued when the process exits, and a terminal left on the alternate
+    // screen with no cursor is the one state an operator cannot recover
+    // without knowing the escape by heart.
+    this._setStdoutBlocking(true);
     process.stdout.write(`${ESC}?25h${ESC}?1049l`);
     try { process.stdin.setRawMode(false); } catch {}
     process.stdin.pause();
@@ -1361,11 +1379,35 @@ export class TUI {
   _paint(buf, force) {
     const stale = Date.now() - (this._lastPaintAt || 0) >= FORCE_REPAINT_MS;
     if (!force && !stale && buf === this._lastFrame) return;
+    // The terminal has not taken the previous frame yet. Painting anyway would
+    // only queue another full screen behind it — the operator sees the newest
+    // frame either way, so the one in between is worth nothing. Drop it, and
+    // paint what is current once the terminal catches up.
+    if (process.stdout.writableNeedDrain) {
+      this._pendingPaint = true;
+      if (!this._drainHandler) {
+        this._drainHandler = () => {
+          this._drainHandler = null;
+          if (this._pendingPaint && this.running) { this._pendingPaint = false; this.render({ force: true }); }
+        };
+        process.stdout.once('drain', this._drainHandler);
+      }
+      return;
+    }
+    this._pendingPaint = false;
     this._lastFrame = buf;
     this._lastPaintAt = Date.now();
     process.stdout.write(buf);
   }
 
+  /** Flip stdout between blocking and non-blocking. A handle without the
+   *  method (a pipe in tests, a file) needs neither, and a failure to flip is
+   *  worth no more than the old behaviour it leaves in place. */
+  _setStdoutBlocking(blocking) {
+    // `_handle` is Node-internal and untyped; the optional chain is the guard.
+    try { /** @type {any} */ (process.stdout)._handle?.setBlocking?.(blocking); } catch {}
+  }
+
   _render(force = false) {
     // Reset the display the instant a quota window (e.g. 5-hour session) expires,
     // instead of waiting for the next request to clear it.