@timo972/cc-router 0.10.1 → 0.11.0

package/dist/proxy/anthropic-messages-route.js

@@ -0,0 +1,456 @@
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { createAnthropicRefreshMiddleware, createAnthropicRoutingMiddleware, extractClaudeSessionId, } from "./anthropic-routing.js";
+import { acquireRequestRoute, applyUpstreamFailureRoutingDetailed, routeFailureDetails, routeReasonDetails, } from "./lease-lifecycle.js";
+import { EmptyPoolError, NoEligibleAccountError } from "./token-pool.js";
+import { applyRateLimitHeaders } from "../providers/anthropic/rate-limit-headers.js";
+import { attachAnthropicResponseCapture } from "./anthropic-response-capture.js";
+import { boundModelId, stats } from "./stats.js";
+import { logError, logRoute } from "./logger.js";
+import { MAX_UPSTREAM_ATTEMPTS, RETRY_REFRESH_TIMEOUT_MS, SAME_ACCOUNT_RETRY_DELAY_MS, boundedWait, isRetryableUpstreamStatus, retryDelay, } from "./upstream-retry.js";
+const OAUTH_BETA = "oauth-2025-04-20";
+/**
+ * CRITICAL: api.anthropic.com requires the "oauth-2025-04-20" beta flag to
+ * accept OAuth tokens (sk-ant-oat01-*). Without it the request is rejected
+ * with "OAuth authentication is currently not supported." APPEND — do NOT
+ * replace — so existing betas (tools, computer-use, etc.) are preserved.
+ */
+export function withOAuthBeta(existing) {
+    const betas = existing === undefined || existing === null || existing === ""
+        ? []
+        : String(existing).split(",").map(beta => beta.trim()).filter(Boolean);
+    if (!betas.includes(OAUTH_BETA))
+        betas.push(OAUTH_BETA);
+    return betas.join(",");
+}
+/** Join a target base path with the request's original URL (path + query). */
+function joinTargetPath(target, originalUrl) {
+    const basePath = target.pathname.replace(/\/+$/, "");
+    return basePath === "" ? originalUrl : `${basePath}${originalUrl}`;
+}
+/**
+ * Build the upstream request headers from the client's. Mirrors the header
+ * behavior of the agent-less http-proxy transport the generic /v1 route
+ * uses (`connection: close`, `changeOrigin` host rewrite) plus this proxy's
+ * own auth handling: the placeholder bearer the client sent is replaced with
+ * the routed account's OAuth token, `x-api-key` is dropped because OAuth
+ * authentication uses Authorization Bearer and having both set can conflict
+ * at Anthropic's side, and the OAuth beta flag is appended.
+ */
+function buildUpstreamHeaders(req, target, account, bodyLength) {
+    const headers = { ...req.headers };
+    // The buffered body is re-framed with an explicit length; the client's own
+    // framing headers no longer describe what is sent.
+    delete headers["content-length"];
+    delete headers["transfer-encoding"];
+    delete headers["x-api-key"];
+    headers["connection"] = "close";
+    headers["host"] = target.host;
+    headers["authorization"] = `Bearer ${account.tokens.accessToken}`;
+    headers["anthropic-beta"] = withOAuthBeta(req.headers["anthropic-beta"]);
+    headers["content-length"] = String(bodyLength);
+    return headers;
+}
+/**
+ * URL.hostname keeps the brackets on an IPv6 literal ("[::1]"), but
+ * node:http's host option expects them stripped — a bracketed value is
+ * treated as a DNS name and fails with ENOTFOUND. The Host *header* is
+ * unaffected: it is built from URL.host, where the brackets belong.
+ */
+export function unbracketedHostname(target) {
+    const { hostname } = target;
+    return hostname.startsWith("[") && hostname.endsWith("]")
+        ? hostname.slice(1, -1)
+        : hostname;
+}
+function forwardAttempt(opts) {
+    const secure = opts.target.protocol === "https:";
+    const requestFn = secure ? httpsRequest : httpRequest;
+    const upstreamRequest = requestFn({
+        host: unbracketedHostname(opts.target),
+        port: opts.target.port !== "" ? Number(opts.target.port) : secure ? 443 : 80,
+        method: opts.method,
+        path: opts.path,
+        headers: opts.headers,
+        // Parity with the generic /v1 proxy: agent-less, one connection per
+        // request, closed by the `connection: close` request header.
+        agent: false,
+        timeout: opts.timeoutMs,
+    });
+    const response = new Promise((resolve, reject) => {
+        upstreamRequest.on("response", upstream => {
+            // The pre-response timeout must never cut a stream that has started.
+            upstreamRequest.setTimeout(0);
+            // The response may be HELD unconsumed while a retry decision resolves
+            // (re-acquire, token refresh) — a socket error in that window must not
+            // become an unhandled 'error' crash. The relay adds its own handler on
+            // top of this guard when the response is actually sent to the client.
+            upstream.on("error", () => { });
+            resolve(upstream);
+        });
+        upstreamRequest.on("error", reject);
+        upstreamRequest.on("timeout", () => {
+            upstreamRequest.destroy(new Error(`Upstream request timed out after ${opts.timeoutMs}ms`));
+        });
+    });
+    upstreamRequest.end(opts.body);
+    return { request: upstreamRequest, response };
+}
+/**
+ * Relay an upstream response to the client verbatim: status, status message,
+ * every header, and the raw (still possibly compressed) body bytes. Matches
+ * the observable behavior of http-proxy 1.18's outgoing passes, including
+ * its HTTP/1.0 accommodations, so moving /v1/messages off the generic proxy
+ * changes nothing about what a client receives.
+ */
+function relayUpstreamResponse(upstream, req, res) {
+    if (req.httpVersion === "1.0") {
+        delete upstream.headers["transfer-encoding"];
+        upstream.headers["connection"] = req.headers["connection"] ?? "close";
+    }
+    else if (req.httpVersion !== "2.0" && !upstream.headers["connection"]) {
+        upstream.headers["connection"] = req.headers["connection"] ?? "keep-alive";
+    }
+    res.statusCode = upstream.statusCode ?? 502;
+    if (upstream.statusMessage)
+        res.statusMessage = upstream.statusMessage;
+    for (const [key, value] of Object.entries(upstream.headers)) {
+        if (value !== undefined)
+            res.setHeader(key, value);
+    }
+    // A mid-body upstream failure cannot be recovered into a valid response —
+    // tear the client connection down rather than ending it cleanly, so the
+    // client sees a broken transfer instead of a silently truncated body.
+    upstream.once("error", () => {
+        if (!res.writableEnded)
+            res.destroy();
+    });
+    upstream.pipe(res);
+}
+/**
+ * Claude-bound POST /v1/messages with router-side failover: a 429 or 5xx
+ * received before any response byte is relayed retries on whichever account
+ * the pool would hand a brand-new request (a different one after a 429's
+ * cooldown, the same one after a plain 5xx), bounded by the shared attempt
+ * budget. When nothing is eligible the failed upstream response is relayed
+ * unchanged — the pass-through contract this route inherits is the fallback,
+ * not the default. Streaming stays byte-transparent; the route never
+ * synthesizes or transforms response bytes.
+ */
+export function mountAnthropicMessagesRoute(app, opts) {
+    const target = new URL(opts.target);
+    const recordActivity = opts.recordActivity ?? ((entry) => stats.addLog(entry));
+    const now = opts.now ?? Date.now;
+    const maxAttempts = Math.max(1, opts.maxAttempts ?? MAX_UPSTREAM_ATTEMPTS);
+    const sameAccountDelayMs = opts.sameAccountRetryDelayMs ?? SAME_ACCOUNT_RETRY_DELAY_MS;
+    const retryRefreshTimeoutMs = opts.retryRefreshTimeoutMs ?? RETRY_REFRESH_TIMEOUT_MS;
+    // Only requests whose raw body was buffered by the cross-provider dispatch
+    // can be retried (and re-sent at all) — anything else falls through to the
+    // generic /v1 proxy exactly as before this route existed.
+    const requireBufferedBody = (req, _res, next) => {
+        if (!req._ccRawBody) {
+            next("route");
+            return;
+        }
+        next();
+    };
+    const handler = async (req, res) => {
+        const rawBody = req._ccRawBody;
+        const context = req._ccRouteContext;
+        const sessionHeader = extractClaudeSessionId(req);
+        const path = joinTargetPath(target, req.originalUrl);
+        let route = req._ccRoute;
+        let release = req._ccReleaseLease;
+        const source = route.sessionId !== undefined
+            ? "cli"
+            : req.headers["x-api-key"]
+                ? "desktop"
+                : "api";
+        const model = boundModelId(context?.requestedModel ?? "-");
+        const startedAt = now();
+        stats.totalRequests++;
+        // A client that hangs up takes the in-flight upstream attempt (and any
+        // pending retry) with it. `writableEnded` guards the normal-completion
+        // close; only a premature close is a disconnect.
+        const clientGone = new AbortController();
+        let inFlight;
+        res.once("close", () => {
+            if (!res.writableEnded)
+                clientGone.abort();
+        });
+        clientGone.signal.addEventListener("abort", () => {
+            inFlight?.destroy(new Error("client disconnected"));
+        });
+        // Parity with the generic proxy's incoming-socket timeout: armed until
+        // the first upstream response headers arrive, then cleared for good so a
+        // long-lived stream is never cut (see anthropic-proxy.ts).
+        req.socket.setTimeout(opts.timeoutMs);
+        for (let attempt = 1;; attempt++) {
+            const account = route.account;
+            const attemptStartedAt = now();
+            req._ccAccount = account;
+            logRoute(account.id, account.requestCount, Math.round((account.tokens.expiresAt - now()) / 60_000));
+            const forwarded = forwardAttempt({
+                target,
+                path,
+                method: req.method,
+                headers: buildUpstreamHeaders(req, target, account, rawBody.byteLength),
+                body: rawBody,
+                timeoutMs: opts.timeoutMs,
+            });
+            inFlight = forwarded.request;
+            let upstream;
+            try {
+                upstream = await forwarded.response;
+            }
+            catch (error) {
+                release();
+                // A hung-up client rejects this await through the abort above. That
+                // is a cancellation, not an upstream failure — there is no client
+                // left to receive a 502, and the generic proxy does not log client
+                // resets either.
+                if (clientGone.signal.aborted || res.writableEnded)
+                    return;
+                const message = error instanceof Error ? error.message : String(error);
+                stats.totalErrors++;
+                logError("proxy", 0, message);
+                recordActivity({
+                    ts: attemptStartedAt,
+                    accountId: account.id,
+                    model,
+                    type: "error",
+                    statusCode: 0,
+                    method: req.method,
+                    path: req.path,
+                    source,
+                    details: routeFailureDetails(route, "proxy-error"),
+                    durationMs: now() - attemptStartedAt,
+                });
+                if (!res.headersSent) {
+                    // Match Anthropic's error response format so Claude Code handles it
+                    // gracefully — same shape the generic proxy's error handler sends.
+                    res.status(502).json({
+                        type: "error",
+                        error: { type: "proxy_error", message },
+                    });
+                }
+                return;
+            }
+            req.socket.setTimeout(0);
+            const status = upstream.statusCode ?? 0;
+            // Routing state changes implied by the failure — cooldowns and sticky
+            // binding invalidation — run before any retry decision, so the
+            // re-acquisition below already sees the failed account excluded.
+            const failureRouting = applyUpstreamFailureRoutingDetailed(status, upstream.headers, route, opts.sessionRouter, opts.pool, now);
+            const entry = {
+                ts: attemptStartedAt,
+                accountId: account.id,
+                model,
+                type: "route",
+                statusCode: status,
+                method: req.method,
+                path: req.path,
+                source,
+                details: routeReasonDetails(route),
+                durationMs: now() - attemptStartedAt,
+            };
+            if (status === 401) {
+                // Token invalid or expired mid-request. Forward the 401 to the client
+                // (Claude Code will retry on 401) and schedule a background refresh
+                // so the next request succeeds.
+                stats.totalErrors++;
+                account.errorCount++;
+                entry.type = "error";
+                entry.details = routeFailureDetails(route, "token-invalid");
+                logError(account.id, 401, "Token invalid — scheduling background refresh");
+                opts.onUpstream401?.(account);
+            }
+            else if (status === 429) {
+                stats.totalErrors++;
+                account.errorCount++;
+                entry.type = "error";
+                entry.details = routeFailureDetails(route, "rate-limited", failureRouting.limitingScope);
+                logError(account.id, 429, `Rate limited — cooldown ${failureRouting.cooldownSeconds ?? 60}s`);
+                // Lets the caller refresh usage in the background and narrow only
+                // ambiguity-owned global state when fresh usage proves a
+                // requested-model exhaustion.
+                opts.onRateLimited?.(route, failureRouting.ambiguousCooldownToken);
+            }
+            else if (status === 529) {
+                // Anthropic service overloaded — short cooldown on this account.
+                stats.totalErrors++;
+                account.errorCount++;
+                entry.type = "error";
+                entry.details = routeFailureDetails(route, "service-overloaded");
+                logError(account.id, 529, "Service overloaded — cooldown 30s");
+            }
+            else if (status >= 500) {
+                // A plain 5xx takes no cooldown: it says nothing about the account's
+                // capacity and can even be request-specific, so cooling the account
+                // down would punish it for upstream's (or the request's) problem.
+                stats.totalErrors++;
+                account.errorCount++;
+                entry.type = "error";
+                entry.details = routeFailureDetails(route, "upstream-error");
+                logError(account.id, status, "Upstream server error");
+            }
+            // Capture rate limit utilization from response headers — failed
+            // attempts carry them too.
+            applyRateLimitHeaders(account, upstream.headers);
+            // ── Router-side failover/retry ────────────────────────────────────────
+            // Decided at response headers: not a single byte has been relayed yet.
+            // Everything below resolves BEFORE the held failure response is
+            // abandoned, so any dead end still relays it unchanged.
+            if (isRetryableUpstreamStatus(status) && attempt < maxAttempts && !clientGone.signal.aborted) {
+                let next;
+                try {
+                    next = acquireRequestRoute(sessionHeader, res, opts.sessionRouter, context);
+                }
+                catch (error) {
+                    // Nothing eligible to fail over to — pass the failure through.
+                    // Only routing-level rejections are expected here; anything else is
+                    // a bug worth a log line, though pass-through stays the safe outcome.
+                    if (!(error instanceof NoEligibleAccountError) && !(error instanceof EmptyPoolError)) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        logError("proxy", 0, `unexpected routing failure during retry: ${message}`);
+                    }
+                    next = undefined;
+                }
+                if (next && status === 429 && next.route.account.id === account.id) {
+                    // Re-sending a 429 to the account that produced it would only
+                    // reproduce the rate limit. The cooldown normally guarantees a
+                    // different account here; if it ever does not, pass through.
+                    next.release();
+                    next = undefined;
+                }
+                if (next && opts.needsRefresh(next.route.account)) {
+                    // The held failure is ready to relay RIGHT NOW; preparing a better
+                    // answer must not hold it hostage. The refresh fetch carries no
+                    // deadline of its own and the pre-response socket timeout was
+                    // disarmed when the failure's headers arrived, so an unbounded
+                    // await here could withhold a ready 429/5xx for minutes — past a
+                    // client disconnect, even. The refresh is not cancelled: a late
+                    // success still readies the account for the next request.
+                    const failoverAccount = next.route.account;
+                    const refreshOutcome = opts.refresh(failoverAccount).then(ok => ok ? "refreshed" : "failed", () => "failed");
+                    // The failure booking hangs off the refresh's own settlement, not
+                    // off the bounded wait below: a refresh that fails AFTER the
+                    // deadline is the same operational failure as one that fails
+                    // inside it, and this single continuation on a once-settling
+                    // promise can neither miss it nor report it twice. The callback
+                    // owns error stats/logging, exactly as it does for the refresh
+                    // middleware on the first attempt; a refresh that eventually
+                    // succeeds books nothing.
+                    void refreshOutcome.then(settled => {
+                        if (settled === "failed")
+                            opts.onRefreshFailure(failoverAccount);
+                    });
+                    const outcome = await boundedWait(refreshOutcome, retryRefreshTimeoutMs, "still-pending", clientGone.signal);
+                    if (outcome === "still-pending" && !clientGone.signal.aborted) {
+                        logError(failoverAccount.id, 0, `failover token refresh still pending after ${retryRefreshTimeoutMs}ms — relaying held upstream failure`);
+                    }
+                    if (outcome !== "refreshed") {
+                        next.release();
+                        next = undefined;
+                    }
+                }
+                if (clientGone.signal.aborted || res.writableEnded) {
+                    next?.release();
+                    release();
+                    upstream.destroy();
+                    return;
+                }
+                if (next) {
+                    // Committed: record the failed attempt and abandon its response.
+                    entry.details = `${entry.details}:will-retry`;
+                    recordActivity(entry);
+                    upstream.destroy();
+                    release();
+                    const sameAccount = next.route.account.id === account.id;
+                    route = next.route;
+                    release = next.release;
+                    req._ccRoute = route;
+                    req._ccReleaseLease = release;
+                    // An immediate same-account replay would hit whatever transient
+                    // condition produced the 5xx still in progress; a failover to a
+                    // different account needs no pause.
+                    if (sameAccount) {
+                        await retryDelay(sameAccountDelayMs, clientGone.signal);
+                        if (clientGone.signal.aborted || res.writableEnded) {
+                            release();
+                            return;
+                        }
+                    }
+                    continue;
+                }
+            }
+            // The client may have left while the response headers (or the retry
+            // decision) were in flight — the abort listener has already torn the
+            // upstream request down, so there is nothing to relay and no reader to
+            // relay it to. The attempt's bookkeeping above still stands; only a
+            // response that upstream itself answered cleanly gets the cancellation
+            // marker, mirroring the OpenAI ingress.
+            // The final attempt's entry describes the whole client request: it
+            // starts at the request and spans every attempt (and retry delay),
+            // exactly like the OpenAI ingress — so ts + durationMs always equals
+            // the moment the entry was finalized. Failed :will-retry entries keep
+            // their own per-attempt window.
+            entry.ts = startedAt;
+            entry.durationMs = now() - startedAt;
+            if (clientGone.signal.aborted || res.writableEnded) {
+                if (entry.type === "route") {
+                    entry.details = entry.details ? `${entry.details} client-cancelled` : "client-cancelled";
+                }
+                recordActivity(entry);
+                upstream.destroy();
+                release();
+                return;
+            }
+            // The held response can die while a retry decision is pending — its
+            // socket erroring during the failover account's token refresh is the
+            // concrete case. The forward-time error guard keeps that from crashing
+            // the daemon, but a destroyed body can no longer be relayed: piping it
+            // emits neither data nor end and would leave the client waiting
+            // forever. Nothing has been written yet, so answer with the same local
+            // 502 any other transport failure produces.
+            if (upstream.destroyed) {
+                if (entry.type === "route")
+                    stats.totalErrors++;
+                entry.type = "error";
+                entry.statusCode = 502;
+                entry.details = `${entry.details}:held-response-lost`;
+                recordActivity(entry);
+                release();
+                logError(account.id, 502, `upstream ${status} response was lost before it could be relayed`);
+                res.status(502).json({
+                    type: "error",
+                    error: {
+                        type: "proxy_error",
+                        message: `Upstream ${status} response was lost before it could be relayed`,
+                    },
+                });
+                return;
+            }
+            // ── Final: relay this response byte-transparently ─────────────────────
+            // The entry is recorded now (headers time) and mutated in place by the
+            // usage capture; the dashboard picks the values up on its next poll —
+            // same contract as the generic proxy path.
+            recordActivity(entry);
+            attachAnthropicResponseCapture(upstream, res, entry, startedAt);
+            relayUpstreamResponse(upstream, req, res);
+            return;
+        }
+    };
+    app.post("/v1/messages", requireBufferedBody, createAnthropicRoutingMiddleware({
+        sessionRouter: opts.sessionRouter,
+        ...(opts.onEmptyPool ? { onEmptyPool: opts.onEmptyPool } : {}),
+        ...(opts.onNoEligibleAccount ? { onNoEligibleAccount: opts.onNoEligibleAccount } : {}),
+        ...(opts.now ? { now: opts.now } : {}),
+    }), createAnthropicRefreshMiddleware({
+        needsRefresh: opts.needsRefresh,
+        refresh: opts.refresh,
+        onRefreshFailure: opts.onRefreshFailure,
+    }), (req, res, next) => {
+        void handler(req, res).catch(next);
+    });
+}

package/dist/proxy/anthropic-response-capture.js

@@ -0,0 +1,40 @@
+import { applyAnthropicInputUsage, applyAnthropicOutputUsage } from "./stats.js";
+import { createAnthropicUsageCapture } from "./usage-capture.js";
+import { createStreamLifecycleTracker } from "./stream-lifecycle.js";
+/**
+ * Attach the passive observability taps to a relayed Anthropic response:
+ * stream-lifecycle tracking and token-usage capture, both mutating the
+ * already-recorded activity entry in place (the dashboard picks the values
+ * up on its next poll).
+ *
+ * SSE streams carry usage across two events (message_start → input/cache
+ * tokens, message_delta → output tokens); non-streaming JSON carries all
+ * fields in one usage object. The proxy is byte-transparent and the client's
+ * accept-encoding makes upstream compress, so the capture decompresses its
+ * own copy of the stream (see usage-capture.ts) — previously compressed
+ * responses were skipped, which in practice was EVERY response.
+ *
+ * Shared by the generic /v1 proxy and the retrying /v1/messages transport so
+ * the two Anthropic relays can never drift on what they observe. Must run
+ * BEFORE the response is piped to the client, in the same synchronous block,
+ * so no data event can slip past the taps.
+ */
+export function attachAnthropicResponseCapture(upstream, downstream, entry, startedAt) {
+    const contentType = String(upstream.headers["content-type"] ?? "");
+    const encoding = String(upstream.headers["content-encoding"] ?? "");
+    const isCompressed = /gzip|br|deflate/.test(encoding);
+    const streamTracker = createStreamLifecycleTracker(startedAt, !isCompressed && contentType.includes("text/event-stream"));
+    entry.streamLifecycle = streamTracker.state;
+    streamTracker.attach(upstream, downstream);
+    upstream.on("data", (chunk) => streamTracker.observeChunk(chunk));
+    const usageCapture = createAnthropicUsageCapture({
+        contentType,
+        contentEncoding: encoding,
+        onInputUsage: usage => applyAnthropicInputUsage(entry, usage),
+        onOutputUsage: usage => applyAnthropicOutputUsage(entry, usage),
+    });
+    if (usageCapture) {
+        upstream.on("data", (chunk) => usageCapture.write(chunk));
+        upstream.on("end", () => usageCapture.end());
+    }
+}

package/dist/proxy/event-sequence.js

@@ -0,0 +1,18 @@
+/**
+ * A process-wide monotonic counter for ordering routing events against each
+ * other.
+ *
+ * Wall-clock milliseconds cannot do this job. A 429 response, the header
+ * snapshot taken from it, and the usage refresh the router starts in response
+ * all happen inside one event-loop turn, so `Date.now()` returns the same value
+ * for all three — measured at ~199 ties in 200 runs. Anything deciding whether
+ * one of those events came after another needs an ordering that does not
+ * collapse at millisecond resolution.
+ *
+ * Values are meaningless as timestamps and are never persisted or reported:
+ * only their relative order carries information, and only within one process.
+ */
+let sequence = 0;
+export function nextEventSequence() {
+    return ++sequence;
+}

package/dist/proxy/lease-lifecycle.js

@@ -93,21 +93,33 @@ function matchingModelLimit(account, modelFamily) {
         return undefined;
     return usage.modelLimits.find(limit => normalizeModelFamily(limit.modelFamily) === modelFamily);
 }
+/** A reported figure strictly inside the normalized headroom range. */
+function withinHeadroomRange(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value < 1;
+}
+/** A reported figure at or above its limit. Unreported is never "at limit". */
+function atReportedLimit(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 1;
+}
 function classifyCooldown(claimValue, route) {
     const claim = typeof claimValue === "string" ? claimValue.trim().toLowerCase() : "";
     const requestedFamily = normalizeModelFamily(route.modelFamily);
     const usage = route.account.rateLimits?.usage;
     if (claim === "five_hour" || claim === "seven_day" || claim === "seven_day_oauth_apps") {
-        const usageWindow = claim === "five_hour" ? usage?.fiveHour : claim === "seven_day" ? usage?.sevenDay : undefined;
+        // seven_day_oauth_apps is a distinct quota the usage endpoint does not
+        // report, so it gets no window and can never be superseded by one.
+        const scope = claim === "five_hour" ? "five_hour" : claim === "seven_day" ? "seven_day" : undefined;
+        const usageWindow = scope === "five_hour" ? usage?.fiveHour : scope === "seven_day" ? usage?.sevenDay : undefined;
         return {
             kind: "global",
             ambiguous: false,
+            ...(scope ? { usageWindow: scope } : {}),
             ...(usageWindow ? { usageResetAtMs: usageWindow.resetAt * 1_000 } : {}),
         };
     }
     if (claim === "seven_day_overage_included") {
         const matching = matchingModelLimit(route.account, requestedFamily);
-        if (requestedFamily && matching?.active === true && matching.utilization >= 1) {
+        if (requestedFamily && matching?.active === true && atReportedLimit(matching.utilization)) {
             return {
                 kind: "model",
                 ambiguous: false,
@@ -143,12 +155,12 @@ function cooldownDurationMs(headers, classification, nowMs) {
         ? Math.max(...expiries) - nowMs
         : DEFAULT_RATE_LIMIT_COOLDOWN_MS;
 }
-function setGlobalCooldown(pool, account, durationMs, ambiguous, modelFamily) {
+function setGlobalCooldown(pool, account, durationMs, ambiguous, modelFamily, usageWindow) {
     if (ambiguous && pool.setAmbiguousGlobalCooldownForAccount) {
         return pool.setAmbiguousGlobalCooldownForAccount(account, durationMs, modelFamily);
     }
     else if (pool.setGlobalCooldownForAccount) {
-        pool.setGlobalCooldownForAccount(account, durationMs);
+        pool.setGlobalCooldownForAccount(account, durationMs, usageWindow);
     }
     else {
         pool.setCooldownForAccount(account, durationMs);
@@ -163,19 +175,14 @@ export function reconcileAmbiguousRateLimitCooldown(route, pool, token, now = Da
         return false;
     if (!usage.fiveHour || !usage.sevenDay)
         return false;
-    if (!Number.isFinite(usage.fiveHour.utilization) ||
-        !Number.isFinite(usage.sevenDay.utilization) ||
-        usage.fiveHour.utilization < 0 ||
-        usage.sevenDay.utilization < 0 ||
-        usage.fiveHour.utilization >= 1 ||
-        usage.sevenDay.utilization >= 1)
+    if (!withinHeadroomRange(usage.fiveHour.utilization) ||
+        !withinHeadroomRange(usage.sevenDay.utilization))
         return false;
     if (canUseExtraUsage(usage.extraUsage))
         return false;
     const matching = matchingModelLimit(route.account, family);
-    if (!matching || !matching.active || !Number.isFinite(matching.utilization) || matching.utilization < 1) {
+    if (!matching || !matching.active || !atReportedLimit(matching.utilization))
         return false;
-    }
     if (!pool.reconcileAmbiguousGlobalCooldownForAccount)
         return false;
     const nowMs = now();
@@ -207,7 +214,7 @@ export function applyUpstreamFailureRoutingDetailed(status, failureHeaders, rout
             }
         }
         else {
-            ambiguousCooldownToken = setGlobalCooldown(pool, route.account, durationMs, classification.ambiguous, route.modelFamily);
+            ambiguousCooldownToken = setGlobalCooldown(pool, route.account, durationMs, classification.ambiguous, route.modelFamily, classification.usageWindow);
         }
         return {
             cooldownSeconds: durationMs / 1_000,

package/dist/proxy/messages-cross-route.js

@@ -361,6 +361,13 @@ export function mountMessagesCrossProviderRoute(app, opts) {
             now,
             envelope: MESSAGES_ENVELOPE,
             onUpstreamAuthFailure: opts.onUpstreamAuthFailure,
+            ...(opts.maxAttempts !== undefined ? { maxAttempts: opts.maxAttempts } : {}),
+            ...(opts.sameAccountRetryDelayMs !== undefined
+                ? { sameAccountRetryDelayMs: opts.sameAccountRetryDelayMs }
+                : {}),
+            ...(opts.retryRefreshTimeoutMs !== undefined
+                ? { retryRefreshTimeoutMs: opts.retryRefreshTimeoutMs }
+                : {}),
             relay: (upstream, res, entry, report) => sendOpenAIAsAnthropic(upstream, res, requestedStream, entry, report),
         });
     });