@timo972/cc-router 0.10.0-rc.0 → 0.10.0-rc.1

package/CHANGELOG.md

@@ -6,7 +6,13 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
-## [0.10.0] — 2026-08-17
+## [Unreleased]
+
+Nothing yet.
+
+---
+
+## [0.10.0] — 2026-08-18
 
 ### Added
 
@@ -19,6 +25,13 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   account-global otherwise; local 429/503 responses when no account is eligible.
 - Dashboard: OpenAI accounts now show 5h/weekly bars, per-bucket rows, credits,
   plan, request/error/in-flight/session counts, and cooldown state.
+- Unprefixed `gpt-*` models route to OpenAI. The Codex CLI writes the bare slug
+  from its own registry — `model = "gpt-5.6-sol"` in `config.toml`, or whatever
+  its `/model` picker selects — and an unprefixed name went to the Claude path,
+  where `/v1/responses` answers `501 Not Implemented`. No configuration could
+  redirect it, because `openAIAliases` is only consulted for names that are
+  already prefixed; those aliases now apply to the bare form as well. Every
+  other unprefixed model still routes to Claude.
 
 ### Changed
 
@@ -29,6 +42,32 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- A refresh token the OAuth server rejects as terminally expired
+  (`400 invalid_grant`) is no longer retried forever. Every rejection was
+  treated as transient, so the five-minute refresh loop kept re-POSTing a token
+  that could never succeed — one account issued roughly 2000 futile requests
+  over three weeks on the shared Claude Code `client_id`, and nothing marked it
+  as needing re-authentication. Such an account is now flagged, dropped from the
+  refresh loop, and reported once to the operator; the flag is persisted, so a
+  restart neither resumes the futile traffic nor returns the dead account to the
+  routing pool, where it would have answered every request with a `401`. Any
+  other rejection — a different 400, 401, 429, 5xx, a network error — is still
+  retried. Thanks to @ethanhawkes-gif.
+- `accounts list` no longer prints a count that contradicts the rows beneath it.
+  The proxy reads `accounts.json` once at startup and holds that snapshot, so
+  the two sources diverge the moment anything rewrites the file underneath it;
+  the count came from disk while the rows came from the live pool, and a real
+  drift surfaced only as "Accounts (4 configured)" above six rows. An account
+  could be routing live while its refresh token existed nowhere on disk — one
+  restart from needing re-authentication — with nothing to indicate it. The
+  count now describes the rows it sits above, and both directions of drift are
+  named: accounts missing from disk (a credential-loss risk, with the recovery)
+  and accounts on disk the proxy has not loaded (merely stale).
+- `accounts remove` accepts an account that exists only in the running proxy.
+  The guard validated the id against disk while the removal it guards prefers
+  the live pool — the same pool `list` displays — so an account you could see
+  and the code could remove was rejected as "not found". The inventory is now
+  the union of both sources.
 - An unexpected failure partway through an OpenAI request — an upstream
   connection error, a rejected token refresh, a mid-stream abort — no longer
   takes down the proxy. Both `/v1/responses` and the `/v1/messages` OpenAI

package/README.md

@@ -18,7 +18,7 @@ Distribute Claude Code requests across Claude subscriptions, and expose an OpenA
 ### Features
 
 - **Cache-aware session routing** — keep each Claude Code session on one account while distributing new sessions across 2-20 Claude Max accounts
-- **Multi-provider routing** — route `openai/*` models to OpenAI ChatGPT/Codex subscription accounts and Claude models to Claude subscriptions
+- **Multi-provider routing** — route `openai/*` and unprefixed `gpt-*` models to OpenAI ChatGPT/Codex subscription accounts and Claude models to Claude subscriptions
 - **Transparent Claude proxy** — Claude Code works normally; streaming, thinking, tool use, prompt caching all pass through
 - **Codex CLI support** — configure Codex to use CC-Router as a Responses-compatible provider
 - **Automatic token refresh** — OAuth tokens are refreshed before they expire, saved atomically to disk
@@ -320,11 +320,20 @@ CC_ROUTER_TOKEN=cc-rtr-your-secret codex -m openai/gpt-5.5
 
 Model prefixes:
 
-| Prefix | Upstream |
+| Model | Upstream |
 |--------|----------|
 | `openai/*` | OpenAI ChatGPT/Codex subscription route |
+| `gpt-*` (no prefix) | OpenAI ChatGPT/Codex subscription route |
 | `claude/*` | Claude subscription route |
 | `anthropic/*` | Claude subscription route |
+| anything else with no prefix | Claude subscription route |
+
+The unprefixed `gpt-*` rule exists for clients that do not speak this
+convention. The Codex CLI writes the bare slug from its own registry — either
+`model = "gpt-5.6-sol"` in `~/.codex/config.toml` or whatever its `/model`
+picker selects — so those names arrive without a prefix and would otherwise be
+routed to Claude, where `/v1/responses` answers `501`. Configured
+`openAIAliases` apply to the bare form too.
 
 Examples after the configuration above:
 

package/dist/cli/cmd-accounts.js

@@ -31,7 +31,12 @@ export function registerAccounts(program) {
             console.log(JSON.stringify(liveStats ?? buildStoredAccountsJson(stored, openAIStored), null, 2));
             return;
         }
-        console.log(chalk.bold(`\n  Accounts (${stored.length + openAIStored.length} configured)\n`));
+        // The count has to describe the rows printed below it. Taking it from
+        // disk while listing the proxy's live pool made drift invisible — the
+        // header claimed four accounts above six rows.
+        console.log(chalk.bold(liveStats
+            ? `\n  Accounts (${liveStats.length} in the running proxy)\n`
+            : `\n  Accounts (${stored.length + openAIStored.length} configured)\n`));
         if (liveStats) {
             console.log(chalk.green("  ● Proxy is running — showing live stats\n"));
             for (const s of liveStats) {
@@ -52,6 +57,22 @@ export function registerAccounts(program) {
                     `  errors: ${chalk.red(String(s.errorCount).padStart(3))}` +
                     `  expires: ${exp}`);
             }
+            // The proxy reads accounts.json once at startup, so anything that
+            // rewrites the file afterwards leaves the two out of step. Silence
+            // here is how an account can be routing live while its refresh token
+            // exists nowhere on disk — one restart from having to authenticate it
+            // again.
+            const { unpersisted, unloaded } = accountDrift(liveStats.map(s => s.id), [...stored.map(a => a.id), ...openAIStored.map(a => a.id)]);
+            if (unpersisted.length > 0) {
+                console.log(chalk.red(`\n  ⚠ Not in accounts.json: ${unpersisted.join(", ")}`));
+                console.log(chalk.gray("    These live only in the running proxy. Restarting it loses their\n"
+                    + "    credentials — re-add them, or update any one account to make the\n"
+                    + "    proxy write its pool back to disk."));
+            }
+            if (unloaded.length > 0) {
+                console.log(chalk.yellow(`\n  ⚠ In accounts.json but not loaded: ${unloaded.join(", ")}`));
+                console.log(chalk.gray("    Restart the proxy to pick them up: cc-router start"));
+            }
         }
         else {
             console.log(chalk.gray("  (Proxy not running — showing stored configuration)\n"));
@@ -181,10 +202,7 @@ export function registerAccounts(program) {
         }
         const anthropicAccounts = loadAccounts();
         const openAIAccounts = loadOpenAIAccounts();
-        const existingIds = [
-            ...anthropicAccounts.map(a => a.id),
-            ...openAIAccounts.map(a => a.id),
-        ];
+        const { ids: existingIds, openAIIds } = mergeAccountInventory(anthropicAccounts.map(a => a.id), openAIAccounts.map(a => a.id), await fetchLiveStats());
         if (!existingIds.includes(id)) {
             console.log(chalk.red(`✗ Account "${id}" not found.`));
             console.log(chalk.gray(`  Available: ${existingIds.join(", ")}`));
@@ -199,7 +217,7 @@ export function registerAccounts(program) {
             console.log(chalk.gray("Cancelled."));
             return;
         }
-        const isOpenAI = openAIAccounts.some(account => account.id === id);
+        const isOpenAI = openAIIds.has(id);
         try {
             await removeAccountRuntimeAware(id);
         }
@@ -223,6 +241,46 @@ function printAddOutcome(mode) {
         ? chalk.gray("  Loaded into the running proxy — available now, no restart needed.\n")
         : chalk.gray("  Restart the proxy to load the new account: cc-router start\n"));
 }
+/**
+ * Every account this CLI could act on, from both places one can live.
+ *
+ * The proxy loads accounts.json once at startup and holds that snapshot, so
+ * the two sources drift the moment the file changes underneath a running
+ * proxy — and they answer different questions. Removal prefers the live pool
+ * (see `removeAccountRuntimeAware`), so validating an id against disk alone
+ * rejected accounts that existed and were perfectly removable.
+ */
+export function mergeAccountInventory(storedAnthropicIds, storedOpenAIIds, live) {
+    const openAIIds = new Set(storedOpenAIIds);
+    for (const account of live ?? []) {
+        if (account.provider === "openai_subscription")
+            openAIIds.add(account.id);
+    }
+    return {
+        ids: [...new Set([
+                ...storedAnthropicIds,
+                ...storedOpenAIIds,
+                ...(live ?? []).map(account => account.id),
+            ])],
+        openAIIds,
+    };
+}
+/**
+ * Where the running proxy and accounts.json disagree.
+ *
+ * `unpersisted` is the dangerous direction: those accounts exist only in the
+ * proxy's memory, so a restart loses their refresh tokens and they have to be
+ * authenticated again. `unloaded` is merely stale — the records are safe on
+ * disk, the proxy just has not read them.
+ */
+export function accountDrift(liveIds, storedIds) {
+    const live = new Set(liveIds);
+    const stored = new Set(storedIds);
+    return {
+        unpersisted: liveIds.filter(id => !stored.has(id)),
+        unloaded: storedIds.filter(id => !live.has(id)),
+    };
+}
 export function buildStoredAccountsJson(anthropicAccounts, openAIAccounts) {
     return [
         ...anthropicAccounts.map(a => ({

package/dist/config/manager.js

@@ -240,13 +240,18 @@ function deserialize(records) {
             expiresAt: a.expiresAt,
             scopes: a.scopes ?? ["user:inference", "user:profile"],
         },
-        healthy: true,
+        // An authExpired account must come back unhealthy. `needsRefresh()` skips
+        // it, so the startup refresh that would otherwise fail and clear `healthy`
+        // never runs — and TokenPool.hardBlock() gates only on `enabled && healthy`,
+        // so defaulting to true here would route live traffic to a dead token.
+        healthy: a.authExpired !== true,
         busy: false,
         requestCount: 0,
         errorCount: 0,
         lastUsed: 0,
         lastRefresh: 0,
         consecutiveErrors: 0,
+        authExpired: a.authExpired === true,
         rateLimits: { ...DEFAULT_RATE_LIMITS },
         enabled: a.enabled !== false, // default true
         sessionLimitPercent: a.sessionLimitPercent !== undefined
@@ -269,5 +274,6 @@ export function serialize(accounts) {
         enabled: a.enabled,
         sessionLimitPercent: a.sessionLimitPercent,
         weeklyLimitPercent: a.weeklyLimitPercent,
+        ...(a.authExpired ? { authExpired: true } : {}),
     }));
 }

package/dist/protocol/model-ref.js

@@ -6,10 +6,29 @@ function cleanModel(model) {
     const trimmed = model?.trim();
     return trimmed ? trimmed : undefined;
 }
+/**
+ * Unprefixed models that belong to OpenAI anyway.
+ *
+ * Clients do not all speak this router's `provider/model` convention. The
+ * Codex CLI writes the bare slug from its own registry — `model =
+ * "gpt-5.6-sol"` in config.toml, or whatever its `/model` picker selects — and
+ * an unprefixed name used to fall through to Anthropic, where the Responses
+ * ingress answers `501`. No configuration could redirect it either, since
+ * `openAIAliases` is only consulted once a name is already prefixed.
+ *
+ * `gpt-` is unambiguous: no Claude model is named that way, so claiming it
+ * costs the Anthropic path nothing. Everything else unprefixed still goes to
+ * Anthropic, which is what existing setups rely on.
+ */
+function isBareOpenAIModel(publicModel) {
+    return publicModel.toLowerCase().startsWith("gpt-");
+}
 export function parseModelRef(model, config = {}) {
     const publicModel = cleanModel(model) ?? cleanModel(config.anthropicDefaultModel) ?? "claude/sonnet";
-    if (publicModel.startsWith("openai/")) {
-        const openAIModel = publicModel.slice("openai/".length);
+    if (publicModel.startsWith("openai/") || isBareOpenAIModel(publicModel)) {
+        const openAIModel = publicModel.startsWith("openai/")
+            ? publicModel.slice("openai/".length)
+            : publicModel;
         const defaultOpenAIModel = cleanModel(config.openAIDefaultModel);
         return {
             provider: "openai_subscription",

package/dist/proxy/token-refresher.js

@@ -26,7 +26,35 @@ const pendingDurability = new WeakSet();
 function isReservedForDeletion(account) {
     return (deletionReservations.get(account) ?? 0) > 0;
 }
+/**
+ * A refresh rejection is terminal when the OAuth server reports `invalid_grant`
+ * (HTTP 400, "refresh token expired"). Such a token can never be refreshed
+ * again, so it must not be retried. Every other rejection — a different 400
+ * error code, 401, 429, 5xx, a network error — is treated as transient and
+ * remains eligible for retry.
+ *
+ * The structured `error` field is checked first so a different 400 (e.g.
+ * `invalid_request`) is not misread as terminal; a non-JSON body falls back to
+ * a substring check for older/plain-text responses.
+ */
+function isTerminalAuthFailure(status, body) {
+    if (status !== 400)
+        return false;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed?.error === "string")
+            return parsed.error === "invalid_grant";
+    }
+    catch {
+        // Not JSON — fall through to the plain-text check below.
+    }
+    return /invalid_grant/i.test(body);
+}
 export function needsRefresh(account) {
+    // A token the server rejected as terminally expired can never succeed; keep
+    // it out of the loop so it is not POSTed to the OAuth endpoint forever.
+    if (account.authExpired)
+        return false;
     return ownedRefreshLocks.has(account) ||
         pendingDurability.has(account) ||
         (account.tokens.expiresAt - Date.now()) < REFRESH_BUFFER_MS;
@@ -145,6 +173,13 @@ async function _doRefresh(account) {
             console.error(`  Status: ${res.status} — ${body}`);
             account.consecutiveErrors++;
             account.healthy = false;
+            if (isTerminalAuthFailure(res.status, body) && !account.authExpired) {
+                // Permanent rejection: retrying can only fail and hammers the OAuth
+                // endpoint (thousands of dead POSTs on one client_id). Take the account
+                // out of the refresh loop and tell the operator once.
+                account.authExpired = true;
+                console.error(`  Account ${account.id} needs re-authentication: its refresh token was rejected as expired (invalid_grant). Re-add the account to resume routing.`);
+            }
             return false;
         }
         const data = await res.json();
@@ -155,6 +190,7 @@ async function _doRefresh(account) {
         account.tokens.scopes = data.scope.split(" ");
         account.healthy = true;
         account.consecutiveErrors = 0;
+        account.authExpired = false;
         account.lastRefresh = Date.now();
         stats.totalRefreshes++;
         stats.addLog({ ts: Date.now(), accountId: account.id, model: "-", type: "refresh" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timo972/cc-router",
-  "version": "0.10.0-rc.0",
+  "version": "0.10.0-rc.1",
   "description": "Cache-aware session router for Claude Max OAuth tokens — use multiple Claude Max accounts with Claude Code",
   "type": "module",
   "bin": {