@timo972/cc-router 0.10.0-rc.0 → 0.10.0-rc.2

package/CHANGELOG.md

@@ -6,7 +6,63 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
-## [0.10.0] — 2026-08-17
+## [Unreleased]
+
+### Fixed
+
+- OpenAI activity rows carry the same columns as Claude ones. The OpenAI ingress
+  recorded a path but no method and no client, and the dashboard needs both
+  `method` and `path` to render the request — so those rows fell back to the
+  bare entry type and read `route` under a blank client column, beside
+  `POST /messages` and `cli` on the Claude rows. Codex CLI traffic now reports
+  a `codex` source of its own rather than borrowing `cli`, which the detail
+  panel spells out as "Claude Code"; a `/v1/messages` request that cross-routes
+  to an OpenAI backend is still classified by the client that sent it.
+- An OpenAI account's usage bars are labelled from each window's own duration
+  instead of by position. Codex reports its weekly window in the `primary` slot
+  and leaves `secondary` empty, but the bars assumed primary meant 5h and
+  secondary meant weekly — so an account at 100% of its weekly quota displayed
+  as `5h 100%` next to a `weekly 0%` bar that was really the empty slot. The
+  countdown gave it away: a 5h window cannot reset five days out.
+- A named Codex bucket no longer renders twice. Codex sends an absent window as
+  an all-zero placeholder rather than omitting it, so the empty `secondary` was
+  treated as real and emitted a second row — carrying the same label as the
+  first, because a zero-length window falls through to a guessed one.
+- An account id exactly as long as its column no longer runs into the status
+  next to it (`plus-developer-droidLIMITED`).
+- The status dashboard can enable, disable, and remove OpenAI accounts. Three
+  guards still sent the operator to the CLI for operations the management
+  endpoints had already gained: `e` answered "OpenAI accounts are managed from
+  the CLI", and delete refused both at the keypress and again inside the
+  confirmation, so the second gate would have caught anyone who got past the
+  first. The cap keys (`w`/`s`) never had such a check, which is what made the
+  inconsistency visible.
+- `cc-router start` no longer has to be run twice. In service mode it wrote the
+  LaunchAgent plist and immediately bootstrapped it, but `launchctl bootout`
+  returns as soon as launchd accepts the request — not once the job is gone.
+  Bootstrapping the same label during that window fails with
+  `Bootstrap failed: 5: Input/output error`, and the legacy `launchctl load`
+  fallback fails identically, so the command printed a warning and exited
+  successfully with nothing running. It now waits for launchd to release the
+  label before loading, and retries the bootstrap until a deadline.
+- A failed start is no longer reported as a success. Service mode installed the
+  service and returned without checking that anything was listening — the
+  background path already health-checked, the service path did not. It now
+  polls the health endpoint and exits non-zero with the log location if the
+  proxy never answers.
+- `cc-router stop` waits for the proxy to actually exit before reporting
+  success. With no PID file the stop fell through to killing by port, which
+  returned as soon as SIGTERM was sent; a `start` issued straight afterwards
+  then raced the still-running process. The port path now waits for the
+  process to die and escalates to SIGKILL, matching the PID path.
+- A service-managed proxy writes a PID file. `writePid`/`removePid` were gated
+  on `CC_ROUTER_DAEMON`, which the LaunchAgent and systemd unit never set —
+  they set `CC_ROUTER_SERVICE` — so every service-managed instance left no PID
+  behind and took the weaker port-based stop path.
+
+---
+
+## [0.10.0] — 2026-08-18
 
 ### Added
 
@@ -19,6 +75,13 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   account-global otherwise; local 429/503 responses when no account is eligible.
 - Dashboard: OpenAI accounts now show 5h/weekly bars, per-bucket rows, credits,
   plan, request/error/in-flight/session counts, and cooldown state.
+- Unprefixed `gpt-*` models route to OpenAI. The Codex CLI writes the bare slug
+  from its own registry — `model = "gpt-5.6-sol"` in `config.toml`, or whatever
+  its `/model` picker selects — and an unprefixed name went to the Claude path,
+  where `/v1/responses` answers `501 Not Implemented`. No configuration could
+  redirect it, because `openAIAliases` is only consulted for names that are
+  already prefixed; those aliases now apply to the bare form as well. Every
+  other unprefixed model still routes to Claude.
 
 ### Changed
 
@@ -29,6 +92,32 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- A refresh token the OAuth server rejects as terminally expired
+  (`400 invalid_grant`) is no longer retried forever. Every rejection was
+  treated as transient, so the five-minute refresh loop kept re-POSTing a token
+  that could never succeed — one account issued roughly 2000 futile requests
+  over three weeks on the shared Claude Code `client_id`, and nothing marked it
+  as needing re-authentication. Such an account is now flagged, dropped from the
+  refresh loop, and reported once to the operator; the flag is persisted, so a
+  restart neither resumes the futile traffic nor returns the dead account to the
+  routing pool, where it would have answered every request with a `401`. Any
+  other rejection — a different 400, 401, 429, 5xx, a network error — is still
+  retried. Thanks to @ethanhawkes-gif.
+- `accounts list` no longer prints a count that contradicts the rows beneath it.
+  The proxy reads `accounts.json` once at startup and holds that snapshot, so
+  the two sources diverge the moment anything rewrites the file underneath it;
+  the count came from disk while the rows came from the live pool, and a real
+  drift surfaced only as "Accounts (4 configured)" above six rows. An account
+  could be routing live while its refresh token existed nowhere on disk — one
+  restart from needing re-authentication — with nothing to indicate it. The
+  count now describes the rows it sits above, and both directions of drift are
+  named: accounts missing from disk (a credential-loss risk, with the recovery)
+  and accounts on disk the proxy has not loaded (merely stale).
+- `accounts remove` accepts an account that exists only in the running proxy.
+  The guard validated the id against disk while the removal it guards prefers
+  the live pool — the same pool `list` displays — so an account you could see
+  and the code could remove was rejected as "not found". The inventory is now
+  the union of both sources.
 - An unexpected failure partway through an OpenAI request — an upstream
   connection error, a rejected token refresh, a mid-stream abort — no longer
   takes down the proxy. Both `/v1/responses` and the `/v1/messages` OpenAI

package/README.md

@@ -18,7 +18,7 @@ Distribute Claude Code requests across Claude subscriptions, and expose an OpenA
 ### Features
 
 - **Cache-aware session routing** — keep each Claude Code session on one account while distributing new sessions across 2-20 Claude Max accounts
-- **Multi-provider routing** — route `openai/*` models to OpenAI ChatGPT/Codex subscription accounts and Claude models to Claude subscriptions
+- **Multi-provider routing** — route `openai/*` and unprefixed `gpt-*` models to OpenAI ChatGPT/Codex subscription accounts and Claude models to Claude subscriptions
 - **Transparent Claude proxy** — Claude Code works normally; streaming, thinking, tool use, prompt caching all pass through
 - **Codex CLI support** — configure Codex to use CC-Router as a Responses-compatible provider
 - **Automatic token refresh** — OAuth tokens are refreshed before they expire, saved atomically to disk
@@ -320,11 +320,20 @@ CC_ROUTER_TOKEN=cc-rtr-your-secret codex -m openai/gpt-5.5
 
 Model prefixes:
 
-| Prefix | Upstream |
+| Model | Upstream |
 |--------|----------|
 | `openai/*` | OpenAI ChatGPT/Codex subscription route |
+| `gpt-*` (no prefix) | OpenAI ChatGPT/Codex subscription route |
 | `claude/*` | Claude subscription route |
 | `anthropic/*` | Claude subscription route |
+| anything else with no prefix | Claude subscription route |
+
+The unprefixed `gpt-*` rule exists for clients that do not speak this
+convention. The Codex CLI writes the bare slug from its own registry — either
+`model = "gpt-5.6-sol"` in `~/.codex/config.toml` or whatever its `/model`
+picker selects — so those names arrive without a prefix and would otherwise be
+routed to Claude, where `/v1/responses` answers `501`. Configured
+`openAIAliases` apply to the bare form too.
 
 Examples after the configuration above:
 

package/dist/cli/cmd-accounts.js

@@ -31,7 +31,12 @@ export function registerAccounts(program) {
             console.log(JSON.stringify(liveStats ?? buildStoredAccountsJson(stored, openAIStored), null, 2));
             return;
         }
-        console.log(chalk.bold(`\n  Accounts (${stored.length + openAIStored.length} configured)\n`));
+        // The count has to describe the rows printed below it. Taking it from
+        // disk while listing the proxy's live pool made drift invisible — the
+        // header claimed four accounts above six rows.
+        console.log(chalk.bold(liveStats
+            ? `\n  Accounts (${liveStats.length} in the running proxy)\n`
+            : `\n  Accounts (${stored.length + openAIStored.length} configured)\n`));
         if (liveStats) {
             console.log(chalk.green("  ● Proxy is running — showing live stats\n"));
             for (const s of liveStats) {
@@ -52,6 +57,22 @@ export function registerAccounts(program) {
                     `  errors: ${chalk.red(String(s.errorCount).padStart(3))}` +
                     `  expires: ${exp}`);
             }
+            // The proxy reads accounts.json once at startup, so anything that
+            // rewrites the file afterwards leaves the two out of step. Silence
+            // here is how an account can be routing live while its refresh token
+            // exists nowhere on disk — one restart from having to authenticate it
+            // again.
+            const { unpersisted, unloaded } = accountDrift(liveStats.map(s => s.id), [...stored.map(a => a.id), ...openAIStored.map(a => a.id)]);
+            if (unpersisted.length > 0) {
+                console.log(chalk.red(`\n  ⚠ Not in accounts.json: ${unpersisted.join(", ")}`));
+                console.log(chalk.gray("    These live only in the running proxy. Restarting it loses their\n"
+                    + "    credentials — re-add them, or update any one account to make the\n"
+                    + "    proxy write its pool back to disk."));
+            }
+            if (unloaded.length > 0) {
+                console.log(chalk.yellow(`\n  ⚠ In accounts.json but not loaded: ${unloaded.join(", ")}`));
+                console.log(chalk.gray("    Restart the proxy to pick them up: cc-router start"));
+            }
         }
         else {
             console.log(chalk.gray("  (Proxy not running — showing stored configuration)\n"));
@@ -181,10 +202,7 @@ export function registerAccounts(program) {
         }
         const anthropicAccounts = loadAccounts();
         const openAIAccounts = loadOpenAIAccounts();
-        const existingIds = [
-            ...anthropicAccounts.map(a => a.id),
-            ...openAIAccounts.map(a => a.id),
-        ];
+        const { ids: existingIds, openAIIds } = mergeAccountInventory(anthropicAccounts.map(a => a.id), openAIAccounts.map(a => a.id), await fetchLiveStats());
         if (!existingIds.includes(id)) {
             console.log(chalk.red(`✗ Account "${id}" not found.`));
             console.log(chalk.gray(`  Available: ${existingIds.join(", ")}`));
@@ -199,7 +217,7 @@ export function registerAccounts(program) {
             console.log(chalk.gray("Cancelled."));
             return;
         }
-        const isOpenAI = openAIAccounts.some(account => account.id === id);
+        const isOpenAI = openAIIds.has(id);
         try {
             await removeAccountRuntimeAware(id);
         }
@@ -223,6 +241,46 @@ function printAddOutcome(mode) {
         ? chalk.gray("  Loaded into the running proxy — available now, no restart needed.\n")
         : chalk.gray("  Restart the proxy to load the new account: cc-router start\n"));
 }
+/**
+ * Every account this CLI could act on, from both places one can live.
+ *
+ * The proxy loads accounts.json once at startup and holds that snapshot, so
+ * the two sources drift the moment the file changes underneath a running
+ * proxy — and they answer different questions. Removal prefers the live pool
+ * (see `removeAccountRuntimeAware`), so validating an id against disk alone
+ * rejected accounts that existed and were perfectly removable.
+ */
+export function mergeAccountInventory(storedAnthropicIds, storedOpenAIIds, live) {
+    const openAIIds = new Set(storedOpenAIIds);
+    for (const account of live ?? []) {
+        if (account.provider === "openai_subscription")
+            openAIIds.add(account.id);
+    }
+    return {
+        ids: [...new Set([
+                ...storedAnthropicIds,
+                ...storedOpenAIIds,
+                ...(live ?? []).map(account => account.id),
+            ])],
+        openAIIds,
+    };
+}
+/**
+ * Where the running proxy and accounts.json disagree.
+ *
+ * `unpersisted` is the dangerous direction: those accounts exist only in the
+ * proxy's memory, so a restart loses their refresh tokens and they have to be
+ * authenticated again. `unloaded` is merely stale — the records are safe on
+ * disk, the proxy just has not read them.
+ */
+export function accountDrift(liveIds, storedIds) {
+    const live = new Set(liveIds);
+    const stored = new Set(storedIds);
+    return {
+        unpersisted: liveIds.filter(id => !stored.has(id)),
+        unloaded: storedIds.filter(id => !live.has(id)),
+    };
+}
 export function buildStoredAccountsJson(anthropicAccounts, openAIAccounts) {
     return [
         ...anthropicAccounts.map(a => ({

package/dist/cli/cmd-start.js

@@ -4,7 +4,7 @@ import { PROXY_PORT, LITELLM_PORT, ACCOUNTS_PATH } from "../config/paths.js";
 import { accountsFileExists, readConfig, writeConfig, generateProxySecret, } from "../config/manager.js";
 import { writeClaudeSettings } from "../utils/claude-config.js";
 import { checkForUpdate, performUpdate, PKG_NAME } from "../utils/self-update.js";
-import { launchDaemon } from "../daemon/launcher.js";
+import { launchDaemon, waitForHealth } from "../daemon/launcher.js";
 import { installService } from "../daemon/service.js";
 import { getLocalIPs } from "../utils/network.js";
 export function registerStart(program) {
@@ -79,6 +79,19 @@ export function registerStart(program) {
         }
         if (prefs.mode === "service") {
             await installService(prefs.serverMode);
+            // Installing the service is not the same as the proxy being up: if
+            // launchd rejects the load, `installService` only warns. Verify, so a
+            // failed start is not reported as a success.
+            if (await waitForHealth(port, 10_000)) {
+                console.log(chalk.green(`✓ CC-Router running on port ${port}`));
+            }
+            else {
+                console.log(chalk.yellow(`\n⚠ Service configured, but nothing is answering on port ${port}.`));
+                console.log(chalk.gray(`  Check the logs: cc-router logs`));
+                console.log(chalk.gray(`  Then try again: cc-router start`));
+                process.exitCode = 1;
+                return;
+            }
         }
         else {
             // background mode

package/dist/config/manager.js

@@ -240,13 +240,18 @@ function deserialize(records) {
             expiresAt: a.expiresAt,
             scopes: a.scopes ?? ["user:inference", "user:profile"],
         },
-        healthy: true,
+        // An authExpired account must come back unhealthy. `needsRefresh()` skips
+        // it, so the startup refresh that would otherwise fail and clear `healthy`
+        // never runs — and TokenPool.hardBlock() gates only on `enabled && healthy`,
+        // so defaulting to true here would route live traffic to a dead token.
+        healthy: a.authExpired !== true,
         busy: false,
         requestCount: 0,
         errorCount: 0,
         lastUsed: 0,
         lastRefresh: 0,
         consecutiveErrors: 0,
+        authExpired: a.authExpired === true,
         rateLimits: { ...DEFAULT_RATE_LIMITS },
         enabled: a.enabled !== false, // default true
         sessionLimitPercent: a.sessionLimitPercent !== undefined
@@ -269,5 +274,6 @@ export function serialize(accounts) {
         enabled: a.enabled,
         sessionLimitPercent: a.sessionLimitPercent,
         weeklyLimitPercent: a.weeklyLimitPercent,
+        ...(a.authExpired ? { authExpired: true } : {}),
     }));
 }

package/dist/daemon/launcher.js

@@ -101,7 +101,8 @@ export async function stopDaemon(port = PROXY_PORT) {
     return killByPort(port);
 }
 // ─── Helpers ──────────────────────────────────────────────────────────────────
-async function waitForHealth(port, timeoutMs) {
+/** Poll the proxy's health endpoint until it answers or the budget runs out. */
+export async function waitForHealth(port, timeoutMs) {
     const start = Date.now();
     while (Date.now() - start < timeoutMs) {
         try {
@@ -125,34 +126,80 @@ async function waitForDeath(pid, timeoutMs) {
     }
     return false;
 }
+/**
+ * Terminate whatever holds `port` and wait until it is actually gone.
+ *
+ * The previous implementation returned `true` as soon as SIGTERM was sent, so
+ * `cc-router stop` reported "✓ Proxy process stopped" while the process was
+ * still shutting down. A `start` issued immediately afterwards then raced that
+ * teardown. The PID-based path already waited (`waitForDeath`); this is the
+ * fallback taken when no PID file exists, and it now waits too.
+ */
+export async function killPortAndWait(port, deps, timeoutMs = 5_000) {
+    const pids = await deps.listPids(port);
+    if (pids.length === 0)
+        return false;
+    for (const pid of pids)
+        deps.kill(pid, "SIGTERM");
+    const deadline = deps.now() + timeoutMs;
+    const anyAlive = () => pids.some(pid => deps.isAlive(pid));
+    while (anyAlive()) {
+        if (deps.now() >= deadline) {
+            for (const pid of pids) {
+                if (deps.isAlive(pid))
+                    deps.kill(pid, "SIGKILL");
+            }
+            await deps.sleep(POST_KILL_GRACE_MS);
+            return !anyAlive();
+        }
+        await deps.sleep(DEATH_POLL_MS);
+    }
+    return true;
+}
+const DEATH_POLL_MS = 200;
+const POST_KILL_GRACE_MS = 500;
 async function killByPort(port) {
     const { execFile } = await import("child_process");
     const { promisify } = await import("util");
     const execFileAsync = promisify(execFile);
-    try {
-        if (isWindows()) {
-            const { stdout } = await execFileAsync("netstat", ["-ano"]);
-            const match = stdout
-                .split("\n")
-                .find(line => line.includes(`:${port}`) && line.includes("LISTENING"));
-            if (!match)
-                return false;
-            const pid = match.trim().split(/\s+/).at(-1);
-            if (!pid || isNaN(Number(pid)))
-                return false;
-            await execFileAsync("taskkill", ["/PID", pid, "/F"]);
-            return true;
-        }
-        else {
-            const { stdout } = await execFileAsync("lsof", ["-ti", `:${port}`]);
-            const pids = stdout.trim().split("\n").filter(Boolean);
-            if (pids.length === 0)
-                return false;
-            for (const p of pids) {
-                await execFileAsync("kill", ["-TERM", p]);
+    const listPids = async (p) => {
+        try {
+            if (isWindows()) {
+                const { stdout } = await execFileAsync("netstat", ["-ano"]);
+                const match = stdout
+                    .split("\n")
+                    .find(line => line.includes(`:${p}`) && line.includes("LISTENING"));
+                if (!match)
+                    return [];
+                const pid = Number(match.trim().split(/\s+/).at(-1));
+                return Number.isNaN(pid) ? [] : [pid];
             }
-            return true;
+            const { stdout } = await execFileAsync("lsof", ["-ti", `:${p}`]);
+            return stdout.trim().split("\n").filter(Boolean).map(Number).filter(n => !Number.isNaN(n));
         }
+        catch {
+            return [];
+        }
+    };
+    try {
+        return await killPortAndWait(port, {
+            listPids,
+            // Windows has no signals: taskkill /F is the only lever, so both the
+            // graceful and forced step map onto it.
+            kill: (pid, signal) => {
+                if (isWindows()) {
+                    void execFileAsync("taskkill", ["/PID", String(pid), "/F"]).catch(() => { });
+                    return;
+                }
+                try {
+                    process.kill(pid, signal);
+                }
+                catch { /* already gone */ }
+            },
+            isAlive: isProcessAlive,
+            sleep,
+            now: Date.now,
+        });
     }
     catch {
         return false;

package/dist/daemon/pid.js

@@ -1,6 +1,20 @@
 import { existsSync, readFileSync, writeFileSync, unlinkSync } from "fs";
 import { PID_PATH, PROXY_PORT } from "../config/paths.js";
 import { ensureConfigDir } from "../config/manager.js";
+/**
+ * Whether this process owns the PID file — i.e. its lifetime is what `cc-router
+ * stop` should act on.
+ *
+ * Both the background daemon (`CC_ROUTER_DAEMON`) and the OS service manager
+ * (`CC_ROUTER_SERVICE`, set by the LaunchAgent/systemd unit) qualify. A service
+ * instance used to leave no PID file, so `stop` fell through to killing by
+ * port, which does not wait for the process to exit. A plain `--foreground` run
+ * in a terminal owns nothing: it is the user's to Ctrl+C, and writing its PID
+ * would let `stop` target the wrong process.
+ */
+export function managesPidFile(env = process.env) {
+    return env["CC_ROUTER_DAEMON"] === "1" || env["CC_ROUTER_SERVICE"] === "1";
+}
 /** Write the current process PID to the PID file. */
 export function writePid(pid) {
     try {

package/dist/daemon/service.js

@@ -93,6 +93,60 @@ ${envVars}
 </plist>
 `;
 }
+const TEARDOWN_POLL_MS = 200;
+const TEARDOWN_TIMEOUT_MS = 10_000;
+/**
+ * Load a LaunchAgent that may have just been booted out.
+ *
+ * `launchctl bootout` returns as soon as launchd accepts the request, not once
+ * the job is gone. Bootstrapping the same label during that window fails with
+ * "Bootstrap failed: 5: Input/output error" — and the legacy `load` fallback
+ * fails the same way, so retrying through it does not help. That is what made
+ * `cc-router start` need a second invocation after a restart: the first one
+ * raced launchd's teardown, warned, and left nothing running.
+ *
+ * So: poll until launchd no longer knows the label, then bootstrap, retrying
+ * until a shared deadline because launchd can still reject briefly after the
+ * job disappears from `print`.
+ */
+export async function bootstrapAfterTeardown(opts) {
+    const { uid, label, plistPath, run, sleep, now } = opts;
+    const deadline = now() + (opts.timeoutMs ?? TEARDOWN_TIMEOUT_MS);
+    // Phase 1 — wait for launchd to forget the old job.
+    for (;;) {
+        let stillLoaded;
+        try {
+            await run(["print", `gui/${uid}/${label}`]);
+            stillLoaded = true;
+        }
+        catch {
+            stillLoaded = false; // `print` fails once the label is gone
+        }
+        if (!stillLoaded)
+            break;
+        if (now() >= deadline)
+            return false;
+        await sleep(TEARDOWN_POLL_MS);
+    }
+    // Phase 2 — bootstrap, retrying while launchd finishes releasing the label.
+    for (;;) {
+        try {
+            await run(["bootstrap", `gui/${uid}`, plistPath]);
+            return true;
+        }
+        catch {
+            if (now() >= deadline)
+                return false;
+            await sleep(TEARDOWN_POLL_MS);
+        }
+    }
+}
+const launchctlRun = async (args) => {
+    await execFileAsync("launchctl", args);
+};
+function sleepMs(ms) {
+    return new Promise(r => setTimeout(r, ms));
+}
 async function installMacOS(serverMode) {
     // Ensure LaunchAgents dir exists
     const launchAgentsDir = dirname(LAUNCHD_PLIST);
@@ -103,12 +157,17 @@ async function installMacOS(serverMode) {
         await launchctlUnload();
     }
     writeFileSync(LAUNCHD_PLIST, buildPlist(serverMode), "utf-8");
-    // Load — try modern `bootstrap` first, fallback to legacy `load`
     const uid = String(process.getuid?.() ?? 501);
-    try {
-        await execFileAsync("launchctl", ["bootstrap", `gui/${uid}`, LAUNCHD_PLIST]);
-    }
-    catch {
+    const loaded = await bootstrapAfterTeardown({
+        uid,
+        label: LAUNCHD_LABEL,
+        plistPath: LAUNCHD_PLIST,
+        run: launchctlRun,
+        sleep: sleepMs,
+        now: Date.now,
+    });
+    if (!loaded) {
+        // Last resort for hosts where `bootstrap` is unavailable rather than busy.
         try {
             await execFileAsync("launchctl", ["load", LAUNCHD_PLIST]);
         }

package/dist/protocol/model-ref.js

@@ -6,10 +6,29 @@ function cleanModel(model) {
     const trimmed = model?.trim();
     return trimmed ? trimmed : undefined;
 }
+/**
+ * Unprefixed models that belong to OpenAI anyway.
+ *
+ * Clients do not all speak this router's `provider/model` convention. The
+ * Codex CLI writes the bare slug from its own registry — `model =
+ * "gpt-5.6-sol"` in config.toml, or whatever its `/model` picker selects — and
+ * an unprefixed name used to fall through to Anthropic, where the Responses
+ * ingress answers `501`. No configuration could redirect it either, since
+ * `openAIAliases` is only consulted once a name is already prefixed.
+ *
+ * `gpt-` is unambiguous: no Claude model is named that way, so claiming it
+ * costs the Anthropic path nothing. Everything else unprefixed still goes to
+ * Anthropic, which is what existing setups rely on.
+ */
+function isBareOpenAIModel(publicModel) {
+    return publicModel.toLowerCase().startsWith("gpt-");
+}
 export function parseModelRef(model, config = {}) {
     const publicModel = cleanModel(model) ?? cleanModel(config.anthropicDefaultModel) ?? "claude/sonnet";
-    if (publicModel.startsWith("openai/")) {
-        const openAIModel = publicModel.slice("openai/".length);
+    if (publicModel.startsWith("openai/") || isBareOpenAIModel(publicModel)) {
+        const openAIModel = publicModel.startsWith("openai/")
+            ? publicModel.slice("openai/".length)
+            : publicModel;
         const defaultOpenAIModel = cleanModel(config.openAIDefaultModel);
         return {
             provider: "openai_subscription",

package/dist/proxy/anthropic-routing.js

@@ -2,6 +2,21 @@ import { acquireRequestRoute } from "./lease-lifecycle.js";
 import { normalizeSessionId } from "./session-router.js";
 import { EmptyPoolError, NoEligibleAccountError } from "./token-pool.js";
 const SESSION_HEADER = "x-claude-code-session-id";
+/**
+ * Classify which Anthropic-shaped client sent a request, for the activity log.
+ *
+ * Mirrors the precedence the direct Claude proxy path applies: a Claude Code
+ * session header wins, an `x-api-key` means Claude Desktop, anything else is a
+ * raw API caller. Shared so a `/v1/messages` request that cross-routes to an
+ * OpenAI backend is still labelled by the client that sent it.
+ */
+export function detectAnthropicClientSource(headers) {
+    if (headers[SESSION_HEADER] !== undefined)
+        return "cli";
+    if (headers["x-api-key"] !== undefined)
+        return "desktop";
+    return "api";
+}
 /** Extract exactly one native HTTP session header field without joined duplicates. */
 export function extractClaudeSessionId(request) {
     const distinct = request.headersDistinct;

package/dist/proxy/messages-cross-route.js

@@ -9,7 +9,7 @@ import { terminalResponsePayload, usageFromTerminalEvent, usageFromResponseBody,
 import { extractAnthropicRouteContext } from "./request-model.js";
 import { stats, applyCodexUsage } from "./stats.js";
 import { extractCodexSessionKey } from "./openai-routing.js";
-import { sendAnthropicNoEligibleResponse } from "./anthropic-routing.js";
+import { sendAnthropicNoEligibleResponse, detectAnthropicClientSource } from "./anthropic-routing.js";
 import { mirrorUpstreamHeaders, runOpenAIIngress, } from "./openai-ingress.js";
 const MESSAGES_ENVELOPE = {
     wrap: (type, message) => ({ type: "error", error: { type, message } }),
@@ -348,6 +348,10 @@ export function mountMessagesCrossProviderRoute(app, opts) {
             sessionKey: extractCodexSessionKey(req, req.body),
             requestedModel: route.upstreamModel,
             path: "/v1/messages",
+            method: req.method,
+            // A Claude-shaped client that happens to route to an OpenAI backend is
+            // still that client — classify it the way the Claude path does.
+            source: detectAnthropicClientSource(req.headers),
             openAIRouter: opts.openAIRouter,
             openAIPool: opts.openAIPool,
             prepareOpenAIAccount,

package/dist/proxy/openai-ingress.js

@@ -298,6 +298,8 @@ export async function runOpenAIIngress(opts) {
         model: requestedModel,
         type: "route",
         path,
+        ...(opts.method !== undefined ? { method: opts.method } : {}),
+        ...(opts.source !== undefined ? { source: opts.source } : {}),
         details,
     };
     let finalStatus = upstream.status;

package/dist/proxy/responses-server.js

@@ -124,6 +124,9 @@ export function mountResponsesRoutes(app, opts) {
             sessionKey: extractCodexSessionKey(req, req.body),
             requestedModel: route.upstreamModel,
             path: "/v1/responses",
+            method: req.method,
+            // Only the Codex CLI speaks the Responses API to this proxy.
+            source: "codex",
             openAIRouter: opts.openAIRouter,
             openAIPool: opts.openAIPool,
             prepareOpenAIAccount,

package/dist/proxy/server.js

@@ -11,7 +11,7 @@ import { loadTelemetryState } from "../config/telemetry.js";
 import { logRoute, logError, logStartup } from "./logger.js";
 import { createLocalRoutingErrorLog, stats } from "./stats.js";
 import { PROXY_PORT, LITELLM_URL, ACCOUNTS_PATH } from "../config/paths.js";
-import { writePid, removePid } from "../daemon/pid.js";
+import { writePid, removePid, managesPidFile } from "../daemon/pid.js";
 import { applyOpenAIAccountPatch, validateAccountPatchBody } from "./account-patch.js";
 import { hasPendingCredentialWrite, markOpenAICredentialsPersisted, prepareOpenAIAccountForRequest, refreshAndPersistOpenAIAccount, startOpenAIRefreshLoop, } from "../providers/openai/token-refresher.js";
 import { createOpenAIAccount } from "../providers/openai/account-state.js";
@@ -1126,7 +1126,7 @@ export async function startServer(opts = {}) {
         console.log(chalk.yellow("\nShutting down — saving tokens..."));
         usageRefresher.stop();
         saveAccounts(pool.getAll());
-        if (process.env["CC_ROUTER_DAEMON"] === "1") {
+        if (managesPidFile()) {
             removePid();
         }
         process.exit(0);
@@ -1193,7 +1193,7 @@ export async function startServer(opts = {}) {
     }
     app.listen(port, host, () => {
         // Write PID for daemon/service process management
-        if (process.env["CC_ROUTER_DAEMON"] === "1") {
+        if (managesPidFile()) {
             writePid(process.pid);
         }
         const totalAccountCount = accounts.length + openAIAccounts.length;

package/dist/proxy/token-refresher.js

@@ -26,7 +26,35 @@ const pendingDurability = new WeakSet();
 function isReservedForDeletion(account) {
     return (deletionReservations.get(account) ?? 0) > 0;
 }
+/**
+ * A refresh rejection is terminal when the OAuth server reports `invalid_grant`
+ * (HTTP 400, "refresh token expired"). Such a token can never be refreshed
+ * again, so it must not be retried. Every other rejection — a different 400
+ * error code, 401, 429, 5xx, a network error — is treated as transient and
+ * remains eligible for retry.
+ *
+ * The structured `error` field is checked first so a different 400 (e.g.
+ * `invalid_request`) is not misread as terminal; a non-JSON body falls back to
+ * a substring check for older/plain-text responses.
+ */
+function isTerminalAuthFailure(status, body) {
+    if (status !== 400)
+        return false;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed?.error === "string")
+            return parsed.error === "invalid_grant";
+    }
+    catch {
+        // Not JSON — fall through to the plain-text check below.
+    }
+    return /invalid_grant/i.test(body);
+}
 export function needsRefresh(account) {
+    // A token the server rejected as terminally expired can never succeed; keep
+    // it out of the loop so it is not POSTed to the OAuth endpoint forever.
+    if (account.authExpired)
+        return false;
     return ownedRefreshLocks.has(account) ||
         pendingDurability.has(account) ||
         (account.tokens.expiresAt - Date.now()) < REFRESH_BUFFER_MS;
@@ -145,6 +173,13 @@ async function _doRefresh(account) {
             console.error(`  Status: ${res.status} — ${body}`);
             account.consecutiveErrors++;
             account.healthy = false;
+            if (isTerminalAuthFailure(res.status, body) && !account.authExpired) {
+                // Permanent rejection: retrying can only fail and hammers the OAuth
+                // endpoint (thousands of dead POSTs on one client_id). Take the account
+                // out of the refresh loop and tell the operator once.
+                account.authExpired = true;
+                console.error(`  Account ${account.id} needs re-authentication: its refresh token was rejected as expired (invalid_grant). Re-add the account to resume routing.`);
+            }
             return false;
         }
         const data = await res.json();
@@ -155,6 +190,7 @@ async function _doRefresh(account) {
         account.tokens.scopes = data.scope.split(" ");
         account.healthy = true;
         account.consecutiveErrors = 0;
+        account.authExpired = false;
         account.lastRefresh = Date.now();
         stats.totalRefreshes++;
         stats.addLog({ ts: Date.now(), accountId: account.id, model: "-", type: "refresh" });

package/dist/ui/Dashboard.js

@@ -102,6 +102,45 @@ function codexWindowLabel(windowMinutes, fallback) {
     }
     return fallback;
 }
+/**
+ * Whether a reported window carries real data.
+ *
+ * Codex sends absent windows as all-zero placeholders rather than omitting the
+ * field, so a truthiness check treats "no such window" as a window with no
+ * duration — which then renders under a guessed label.
+ */
+function hasWindow(window) {
+    return window !== undefined && window.windowMinutes > 0;
+}
+/**
+ * The default (`codex`) bucket's windows, each labelled from its own duration.
+ *
+ * These used to be read positionally — `primary` as the 5h window, `secondary`
+ * as the weekly one. Codex reports the weekly window in `primary` and leaves
+ * `secondary` empty, so an account at 100% of its weekly quota displayed as
+ * "5h 100%" beside a "weekly 0%" bar that was really the empty slot. The reset
+ * countdown gave it away: a 5h window cannot reset five days out.
+ */
+export function getCodexDefaultWindows(codex) {
+    const bucket = codex?.buckets.find(b => b.limitId === "codex");
+    if (!bucket)
+        return [];
+    const windows = [];
+    for (const [window, fallback] of [
+        [bucket.primary, "5h"],
+        [bucket.secondary, "weekly"],
+    ]) {
+        if (!hasWindow(window))
+            continue;
+        windows.push({
+            label: codexWindowLabel(window.windowMinutes, fallback),
+            utilization: window.utilization,
+            resetAt: window.resetAt,
+            kind: window.windowMinutes >= 10_080 ? "weekly" : "session",
+        });
+    }
+    return windows;
+}
 /** Named Codex metered buckets as compact capacity rows (default bucket renders as bars). */
 export function getCodexCapacityRows(codex, globalCooldownUntilMs, now = Date.now()) {
     const rows = [];
@@ -110,10 +149,14 @@ export function getCodexCapacityRows(codex, globalCooldownUntilMs, now = Date.no
             continue;
         const cooling = bucket.cooldownUntilMs > now;
         const windows = [];
-        if (bucket.primary) {
+        // A zero-width window is Codex's placeholder for "this bucket has no such
+        // window", not a real one — it arrives as an all-zero object rather than
+        // being omitted. Rendering it duplicated the bucket, and both rows carried
+        // the same label because codexWindowLabel(0) falls through to its fallback.
+        if (hasWindow(bucket.primary)) {
             windows.push({ label: codexWindowLabel(bucket.primary.windowMinutes, "5h"), ...bucket.primary });
         }
-        if (bucket.secondary) {
+        if (hasWindow(bucket.secondary)) {
             windows.push({ label: codexWindowLabel(bucket.secondary.windowMinutes, "weekly"), ...bucket.secondary });
         }
         for (const window of windows) {
@@ -248,7 +291,6 @@ function LiveDashboard({ data, port, baseUrl, lastUpdate, api, modelsApi, onInte
         ? Math.max(0, data.accounts.findIndex(a => a.id === selectedAccountId))
         : 0;
     const selectedAccount = data.accounts[selectedAccountIndex] ?? null;
-    const selectedAccountIsAnthropic = selectedAccount?.provider !== "openai_subscription";
     const [modelsStatus, setModelsStatus] = useState(null);
     const [selectedModelId, setSelectedModelId] = useState(null);
     const modelRows = modelsStatus?.models ?? [];
@@ -287,13 +329,14 @@ function LiveDashboard({ data, port, baseUrl, lastUpdate, api, modelsApi, onInte
         return s || "unknown error";
     };
     // ── Async helpers (fire-and-forget with error → banner) ──────────────────
+    // Provider-agnostic: `PATCH /cc-router/accounts/:id` applies `enabled` to
+    // OpenAI accounts through the same transaction contract as Claude ones, and
+    // drops their sticky bindings on disable. The cap keys below never had a
+    // provider check; this one was left behind after the endpoint gained OpenAI
+    // support, so the dashboard was refusing an operation the server had.
     const doToggleEnabled = useCallback(async () => {
         if (!selectedAccount)
             return;
-        if (selectedAccount.provider === "openai_subscription") {
-            showBanner("OpenAI accounts are managed from the CLI", "yellow");
-            return;
-        }
         const newValue = !(selectedAccount.enabled !== false);
         try {
             await api.patch(selectedAccount.id, { enabled: newValue });
@@ -336,10 +379,6 @@ function LiveDashboard({ data, port, baseUrl, lastUpdate, api, modelsApi, onInte
     const doDelete = useCallback(async () => {
         if (!selectedAccount)
             return;
-        if (selectedAccount.provider === "openai_subscription") {
-            showBanner("Use cc-router accounts remove for OpenAI accounts", "yellow");
-            return;
-        }
         try {
             await api.remove(selectedAccount.id);
             showBanner(`Removed ${selectedAccount.id}`, "yellow");
@@ -493,11 +532,12 @@ function LiveDashboard({ data, port, baseUrl, lastUpdate, api, modelsApi, onInte
                 setEditBuffer("");
                 return;
             }
+            // Also provider-agnostic: `DELETE /cc-router/accounts/:id` removes an
+            // OpenAI account through `deleteOpenAIAccountTransaction`, which is the
+            // same path `cc-router accounts remove` reaches. Sending the operator to
+            // the CLI for something the dashboard can do was left over from before
+            // that existed.
             if (input === "d") {
-                if (!selectedAccountIsAnthropic) {
-                    showBanner("Use cc-router accounts remove for OpenAI accounts", "yellow");
-                    return;
-                }
                 setMode("confirmDelete");
                 return;
             }
@@ -599,7 +639,7 @@ function AccountRow({ account: a, selected }) {
     const globalCapacity = getGlobalCapacityView(rl);
     const isOpenAI = a.provider === "openai_subscription";
     const codex = a.codexRateLimits;
-    const codexDefaultBucket = codex?.buckets.find(bucket => bucket.limitId === "codex");
+    const codexDefaultWindows = getCodexDefaultWindows(codex);
     const capacityRows = isOpenAI
         ? getCodexCapacityRows(a.codexRateLimits, a.globalCooldownUntilMs)
         : getAccountCapacityRows(a);
@@ -632,10 +672,10 @@ function AccountRow({ account: a, selected }) {
                 ? codex.credits.balance
                 : codex.credits.hasCredits ? "yes" : "no"
         : undefined;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: selected ? "cyan" : undefined, children: pointer }), _jsxs(Text, { color: dotColor, children: [" ", dot, " "] }), _jsx(Text, { color: nameColor, dimColor: isDisabled, children: a.id.slice(0, 20).padEnd(20) }), _jsx(Text, { color: statusColor, children: statusLabel }), providerTag && _jsx(Text, { color: isOpenAI ? "cyan" : "magenta", children: providerTag.padEnd(10) }), !providerTag && _jsx(Text, { children: "".padEnd(10) }), _jsx(Text, { color: "gray", children: " req " }), _jsx(Text, { color: "white", children: String(a.requestCount).padStart(5) }), _jsx(Text, { color: "gray", children: "  err " }), _jsx(Text, { color: a.errorCount > 0 ? "red" : "gray", children: String(a.errorCount).padStart(3) }), _jsx(Text, { color: "gray", children: "  tok " }), _jsx(Text, { color: expiryColor, children: expiryLabel.padEnd(8) }), _jsx(Text, { color: "gray", children: "  last " }), _jsx(Text, { color: "gray", children: formatAgo(a.lastUsedMs) }), _jsxs(Text, { color: "gray", children: ["  ", a.activeSessions ?? 0, " active / ", a.inFlightRequests ?? 0, " streams"] }), capsHint && _jsx(Text, { color: "yellow", children: capsHint }), a.credentialsPendingWrite && (
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: selected ? "cyan" : undefined, children: pointer }), _jsxs(Text, { color: dotColor, children: [" ", dot, " "] }), _jsx(Text, { color: nameColor, dimColor: isDisabled, children: a.id.slice(0, 20).padEnd(21) }), _jsx(Text, { color: statusColor, children: statusLabel }), providerTag && _jsx(Text, { color: isOpenAI ? "cyan" : "magenta", children: providerTag.padEnd(10) }), !providerTag && _jsx(Text, { children: "".padEnd(10) }), _jsx(Text, { color: "gray", children: " req " }), _jsx(Text, { color: "white", children: String(a.requestCount).padStart(5) }), _jsx(Text, { color: "gray", children: "  err " }), _jsx(Text, { color: a.errorCount > 0 ? "red" : "gray", children: String(a.errorCount).padStart(3) }), _jsx(Text, { color: "gray", children: "  tok " }), _jsx(Text, { color: expiryColor, children: expiryLabel.padEnd(8) }), _jsx(Text, { color: "gray", children: "  last " }), _jsx(Text, { color: "gray", children: formatAgo(a.lastUsedMs) }), _jsxs(Text, { color: "gray", children: ["  ", a.activeSessions ?? 0, " active / ", a.inFlightRequests ?? 0, " streams"] }), capsHint && _jsx(Text, { color: "yellow", children: capsHint }), a.credentialsPendingWrite && (
                     // The account still works — its rotated token is live in memory — but a
                     // restart before the pending write lands would need a re-login.
-                    _jsx(Text, { color: "yellow", children: "  creds unsaved" }))] }), (rl.lastUpdated > 0 || usage) && (_jsxs(Box, { paddingLeft: 4, children: [_jsx(UtilBar, { label: "5h", util: globalCapacity.fiveHour.utilization, resetTs: globalCapacity.fiveHour.resetAt, isActive: rl.claim === "five_hour", cap: s5 }), _jsx(Text, { children: "   " }), _jsx(UtilBar, { label: "7d all-model", util: globalCapacity.sevenDay.utilization, resetTs: globalCapacity.sevenDay.resetAt, isActive: rl.claim === "seven_day", cap: w7 }), usage && _jsx(Text, { color: globalCapacity.usageFetchStatus === "fresh" ? "gray" : "yellow", children: `  usage ${globalCapacity.usageFetchStatus} ${usage.fetchedAt > 0 ? formatAgo(usage.fetchedAt) : ""}` })] })), isOpenAI && codexDefaultBucket && (codexDefaultBucket.primary || codexDefaultBucket.secondary) && (_jsxs(Box, { paddingLeft: 4, children: [_jsx(UtilBar, { label: "5h", util: codexDefaultBucket.primary?.utilization ?? 0, resetTs: codexDefaultBucket.primary?.resetAt ?? 0, isActive: false, cap: s5 }), _jsx(Text, { children: "   " }), _jsx(UtilBar, { label: "weekly", util: codexDefaultBucket.secondary?.utilization ?? 0, resetTs: codexDefaultBucket.secondary?.resetAt ?? 0, isActive: false, cap: w7 }), creditsLabel !== undefined && _jsx(Text, { color: "gray", children: `  credits ${creditsLabel}` })] })), capacityRows.map((row, index) => (_jsxs(Box, { paddingLeft: 4, children: [_jsxs(Text, { color: row.color, children: [" ", row.label] }), _jsxs(Text, { color: "gray", children: [" \u00B7 ", row.state] }), row.utilization !== undefined && _jsx(Text, { color: row.color, children: ` ${Math.round(row.utilization * 100)}%` }), row.resetAt !== undefined && row.resetAt > 0 && (_jsxs(Text, { color: "gray", children: [" ", `↻${formatResetIn(row.resetAt)}`] }))] }, `${row.label}-${index}`)))] }));
+                    _jsx(Text, { color: "yellow", children: "  creds unsaved" }))] }), (rl.lastUpdated > 0 || usage) && (_jsxs(Box, { paddingLeft: 4, children: [_jsx(UtilBar, { label: "5h", util: globalCapacity.fiveHour.utilization, resetTs: globalCapacity.fiveHour.resetAt, isActive: rl.claim === "five_hour", cap: s5 }), _jsx(Text, { children: "   " }), _jsx(UtilBar, { label: "7d all-model", util: globalCapacity.sevenDay.utilization, resetTs: globalCapacity.sevenDay.resetAt, isActive: rl.claim === "seven_day", cap: w7 }), usage && _jsx(Text, { color: globalCapacity.usageFetchStatus === "fresh" ? "gray" : "yellow", children: `  usage ${globalCapacity.usageFetchStatus} ${usage.fetchedAt > 0 ? formatAgo(usage.fetchedAt) : ""}` })] })), isOpenAI && codexDefaultWindows.length > 0 && (_jsxs(Box, { paddingLeft: 4, children: [codexDefaultWindows.map((window, index) => (_jsxs(React.Fragment, { children: [index > 0 && _jsx(Text, { children: "   " }), _jsx(UtilBar, { label: window.label, util: window.utilization, resetTs: window.resetAt, isActive: false, cap: window.kind === "weekly" ? w7 : s5 })] }, window.label))), creditsLabel !== undefined && _jsx(Text, { color: "gray", children: `  credits ${creditsLabel}` })] })), capacityRows.map((row, index) => (_jsxs(Box, { paddingLeft: 4, children: [_jsxs(Text, { color: row.color, children: [" ", row.label] }), _jsxs(Text, { color: "gray", children: [" \u00B7 ", row.state] }), row.utilization !== undefined && _jsx(Text, { color: row.color, children: ` ${Math.round(row.utilization * 100)}%` }), row.resetAt !== undefined && row.resetAt > 0 && (_jsxs(Text, { color: "gray", children: [" ", `↻${formatResetIn(row.resetAt)}`] }))] }, `${row.label}-${index}`)))] }));
 }
 // ─── Utilization bar ─────────────────────────────────────────────────────────
 function UtilBar({ label, util, resetTs, isActive, cap }) {
@@ -680,10 +720,12 @@ function LogRow({ log, selected }) {
     const sourceLabel = log.source === "cli" ? "cli"
         : log.source === "desktop" ? "dsk"
             : log.source === "api" ? "api"
-                : "   ";
+                : log.source === "codex" ? "cdx"
+                    : "   ";
     const sourceColor = log.source === "cli" ? "blue"
         : log.source === "desktop" ? "magenta"
-            : "gray";
+            : log.source === "codex" ? "cyan"
+                : "gray";
     // Per-request token stats
     const inputTok = (log.cacheReadTokens ?? 0) + (log.cacheCreationTokens ?? 0) + (log.inputTokens ?? 0);
     const outputTok = log.outputTokens ?? 0;
@@ -759,6 +801,8 @@ function sourceFullLabel(source) {
         return "Claude Code";
     if (source === "desktop")
         return "Claude Desktop";
+    if (source === "codex")
+        return "Codex CLI";
     if (source === "api")
         return "API";
     return "—";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timo972/cc-router",
-  "version": "0.10.0-rc.0",
+  "version": "0.10.0-rc.2",
   "description": "Cache-aware session router for Claude Max OAuth tokens — use multiple Claude Max accounts with Claude Code",
   "type": "module",
   "bin": {