@timo972/cc-router 0.12.0 → 0.12.1-rc.0

package/dist/proxy/openai-ingress.js

@@ -6,6 +6,7 @@ import { stats, boundModelId, createLocalRoutingErrorLog } from "./stats.js";
 import { logError, logRoute } from "./logger.js";
 import { EmptyPoolError, NoEligibleAccountError } from "./account-pool.js";
 import { acquireRequestRoute, routeReasonDetails, routeFailureDetails } from "./lease-lifecycle.js";
+import { createCorrelationId, formatTransportDiagnostic, safeCauseCode } from "./transport-diagnostics.js";
 import { MAX_UPSTREAM_ATTEMPTS, RETRY_REFRESH_TIMEOUT_MS, SAME_ACCOUNT_RETRY_DELAY_MS, boundedWait, isRetryableUpstreamStatus, retryDelay, } from "./upstream-retry.js";
 /**
  * Mirrors `anthropic-routing.ts`'s `requestTerminated` check. This ingress
@@ -100,13 +101,14 @@ export function mirrorUpstreamHeaders(source, apply) {
  * an unhandled rejection behind.
  */
 export async function runOpenAIIngress(opts) {
-    const { res, sessionKey, path, openAIRouter, openAIPool, prepareOpenAIAccount, forwardOpenAI, forwardBody, recordActivity, now, envelope, relay, onUpstreamAuthFailure, } = opts;
+    const { res, sessionKey, path, openAIRouter, openAIPool, prepareOpenAIAccount, forwardOpenAI, forwardBody, recordActivity, now, envelope, relay, onUpstreamAuthFailure, timeoutMs, } = opts;
     // The model comes from a client-controlled body and is retained in the
     // activity ring buffer below. Bound it once, here, so every activity entry,
     // routing context and bucket lookup on this path carries an identifier that
     // cannot grow with the request. The body forwarded upstream is untouched —
     // it still carries whatever model the caller asked for.
     const requestedModel = boundModelId(opts.requestedModel);
+    const correlationId = createCorrelationId();
     // A client that hangs up must take the upstream request with it. Releasing
     // the lease (which the response's own close listener does) only returns the
     // account's *local* capacity — without this the Codex request keeps
@@ -145,8 +147,11 @@ export async function runOpenAIIngress(opts) {
         // this handler's promise — no account lease was taken, so there is
         // nothing to release.
         stats.totalErrors++;
-        const message = error instanceof Error ? error.message : String(error);
-        logError("proxy", 500, `unexpected routing failure: ${message}`);
+        logError("proxy", 500, formatTransportDiagnostic({
+            correlationId,
+            operation: "forward",
+            causeCode: safeCauseCode(error),
+        }));
         recordActivity({
             ts: now(),
             accountId: "proxy",
@@ -155,6 +160,7 @@ export async function runOpenAIIngress(opts) {
             statusCode: 500,
             path,
             details: "proxy_error:acquire",
+            correlationId,
         });
         res.status(500).json(envelope.wrap("proxy_error", "Unexpected routing error"));
         return;
@@ -166,6 +172,8 @@ export async function runOpenAIIngress(opts) {
     // reason string — keep it that way.
     logRoute(selected.route.account.id, selected.route.account.requestCount, Math.round((selected.route.account.expiresAt - now()) / 60_000), selected.details);
     const startedAt = now();
+    const refreshDurations = new Map();
+    let headerDurationMs = 0;
     const maxAttempts = Math.max(1, opts.maxAttempts ?? MAX_UPSTREAM_ATTEMPTS);
     const sameAccountDelayMs = opts.sameAccountRetryDelayMs ?? SAME_ACCOUNT_RETRY_DELAY_MS;
     const retryRefreshTimeoutMs = opts.retryRefreshTimeoutMs ?? RETRY_REFRESH_TIMEOUT_MS;
@@ -178,6 +186,8 @@ export async function runOpenAIIngress(opts) {
     const prepareRoute = async (routed) => {
         const account = routed.route.account;
         const needed = needsOpenAIRefresh(account);
+        const refreshStartedAt = now();
+        let refreshCauseCode;
         let ready;
         try {
             ready = await prepareOpenAIAccount(account);
@@ -185,14 +195,13 @@ export async function runOpenAIIngress(opts) {
         catch (error) {
             // A throwing refresh must behave exactly like a `false` return, never
             // crash the request (or the daemon).
-            const message = error instanceof Error ? error.message : String(error);
-            logError(account.id, 401, `openai token refresh threw: ${message}`);
+            refreshCauseCode = safeCauseCode(error);
             ready = false;
         }
+        const refreshDurationMs = now() - refreshStartedAt;
+        refreshDurations.set(account, refreshDurationMs);
         if (!ready) {
             routed.release();
-            account.errorCount++;
-            stats.totalErrors++;
             // Intentionally does not touch `account.healthy`: a single failed
             // refresh fails only this request. Disabling the account here would
             // hard-block it from every future request until a manual recovery, even
@@ -206,6 +215,13 @@ export async function runOpenAIIngress(opts) {
                 openAIRouter.invalidate(routed.route.sessionId, account.id, routed.route.bindingGeneration);
             }
             openAIPool.setGlobalCooldownForAccount(account, REFRESH_FAILURE_COOLDOWN_MS, "unavailable");
+            if (clientGone.signal.aborted || responseTerminated(res))
+                return false;
+            account.errorCount++;
+            stats.totalErrors++;
+            logError(account.id, 401, formatTransportDiagnostic({
+                correlationId, operation: "prepare", status: 401, causeCode: refreshCauseCode,
+            }));
             recordActivity({
                 ts: now(),
                 accountId: account.id,
@@ -213,7 +229,9 @@ export async function runOpenAIIngress(opts) {
                 type: "error",
                 statusCode: 401,
                 path,
-                details: "openai token refresh failed",
+                details: `openai token refresh failed;correlation=${correlationId};auth=${account.authFailure ?? "unknown"}`,
+                correlationId,
+                refreshDurationMs,
             });
             return false;
         }
@@ -223,6 +241,8 @@ export async function runOpenAIIngress(opts) {
         return true;
     };
     if (!(await prepareRoute(selected))) {
+        if (clientGone.signal.aborted || responseTerminated(res))
+            return;
         res.status(401).json(envelope.wrap("authentication_error", "OpenAI subscription token refresh failed"));
         return;
     }
@@ -248,6 +268,7 @@ export async function runOpenAIIngress(opts) {
                 body: forwardBody,
                 stream: forwardBody.stream === true,
                 signal: clientGone.signal,
+                timeoutMs,
             });
         }
         catch (error) {
@@ -267,21 +288,28 @@ export async function runOpenAIIngress(opts) {
             // own finish/close lifecycle once this response is sent.
             account.errorCount++;
             stats.totalErrors++;
-            const message = error instanceof Error ? error.message : String(error);
-            logError(account.id, 502, `openai request failed: ${message}`);
+            const timeout = error instanceof Error && error.name === "TimeoutError";
+            const diagnostic = formatTransportDiagnostic({
+                correlationId, operation: "forward", causeCode: safeCauseCode(error),
+            });
+            logError(account.id, timeout ? 504 : 502, diagnostic);
             recordActivity({
                 ts: startedAt,
                 accountId: account.id,
                 model: requestedModel,
                 type: "error",
-                statusCode: 502,
+                statusCode: timeout ? 504 : 502,
                 path,
-                details: "upstream_error:network",
+                details: `upstream_error:${timeout ? "timeout" : "network"};${diagnostic}`,
                 durationMs: now() - startedAt,
+                correlationId,
+                refreshDurationMs: refreshDurations.get(account),
+                headerDurationMs: now() - attemptStartedAt,
             });
-            res.status(502).json(envelope.wrap("upstream_error", `OpenAI request failed: ${message}`));
+            res.status(timeout ? 504 : 502).json(envelope.wrap("upstream_error", timeout ? "OpenAI request timed out" : "OpenAI request failed"));
             return;
         }
+        headerDurationMs = now() - attemptStartedAt;
         // Cooldown/eligibility react to the raw upstream signal — this must not
         // change based on how the relay later renders the response to the client.
         upstreamFailed = upstream.status === 401 || upstream.status === 429 || upstream.status >= 500;
@@ -314,11 +342,15 @@ export async function runOpenAIIngress(opts) {
                             : "upstream-error", applied.limitingScope);
                 if (upstream.status === 401)
                     onUpstreamAuthFailure?.(account);
+                logError(account.id, upstream.status, formatTransportDiagnostic({
+                    correlationId, operation: "upstream", status: upstream.status,
+                }));
             }
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            logError(account.id, upstream.status, `openai response classification failed: ${message}`);
+            logError(account.id, upstream.status, formatTransportDiagnostic({
+                correlationId, operation: "upstream", status: upstream.status, causeCode: safeCauseCode(error),
+            }));
         }
         // Retryable statuses (429 || >= 500) are a strict subset of
         // `upstreamFailed`, so this predicate alone decides the loop.
@@ -380,6 +412,9 @@ export async function runOpenAIIngress(opts) {
             path,
             ...(opts.method !== undefined ? { method: opts.method } : {}),
             ...(opts.source !== undefined ? { source: opts.source } : {}),
+            correlationId,
+            refreshDurationMs: refreshDurations.get(account),
+            headerDurationMs,
             details: `${details}:will-retry`,
             durationMs: now() - attemptStartedAt,
         });
@@ -405,12 +440,15 @@ export async function runOpenAIIngress(opts) {
         path,
         ...(opts.method !== undefined ? { method: opts.method } : {}),
         ...(opts.source !== undefined ? { source: opts.source } : {}),
+        refreshDurationMs: refreshDurations.get(account),
+        headerDurationMs,
+        correlationId,
         details,
     };
     let finalStatus = upstream.status;
     let relayFailed = false;
     let relayFailureMessage = "";
-    const relayReport = { upstreamReportedFailure: false };
+    const relayReport = { upstreamReportedFailure: false, routerFailure: false };
     try {
         const result = await relay(upstream, res, entry, relayReport);
         finalStatus = result.statusCode;
@@ -421,8 +459,17 @@ export async function runOpenAIIngress(opts) {
         // otherwise the client already has a partial response and the best we
         // can do is tear the connection down.
         relayFailed = true;
-        const message = error instanceof Error ? error.message : String(error);
-        relayFailureMessage = message;
+        // The same reader rejection is produced by two very different events:
+        // an upstream/idle failure, and the caller closing its socket. Capture
+        // the origin before any router-side destroy emits another `close`.
+        const downstreamAlreadyGone = clientGone.signal.aborted || responseTerminated(res);
+        relayReport.routerFailure = !downstreamAlreadyGone;
+        relayFailureMessage = formatTransportDiagnostic({
+            correlationId,
+            operation: "relay",
+            causeCode: error instanceof Error && error.name === "TimeoutError"
+                ? "UPSTREAM_IDLE_TIMEOUT" : safeCauseCode(error),
+        });
         // The recorded status is what this request *became*, which is a failure
         // whether or not another HTTP response can still be sent. Leaving it at
         // the upstream's 200 in the headers-already-sent case produced an
@@ -430,8 +477,11 @@ export async function runOpenAIIngress(opts) {
         // that contradicts itself, and one that reads as a success in any view
         // that keys off the status.
         finalStatus = 502;
-        if (!res.headersSent) {
-            res.status(502).json(envelope.wrap("upstream_error", `OpenAI response relay failed: ${message}`));
+        if (downstreamAlreadyGone) {
+            // There is no peer left to receive an error response.
+        }
+        else if (!res.headersSent) {
+            res.status(502).json(envelope.wrap("upstream_error", "OpenAI response relay failed"));
         }
         else {
             if (!res.writableEnded && !res.destroyed)
@@ -451,7 +501,9 @@ export async function runOpenAIIngress(opts) {
     // a 200 stream — the client can truncate a stream, but it cannot make
     // upstream announce a failure. Only the truncation is the disconnect's to
     // explain away.
-    const clientCancelled = clientGone.signal.aborted && !relayReport.upstreamReportedFailure;
+    const clientCancelled = clientGone.signal.aborted
+        && !relayReport.upstreamReportedFailure
+        && !relayReport.routerFailure;
     // Logged only now, after the cancellation classification: the Codex CLI
     // aborts streams routinely (a superseded turn, Ctrl-C, a pane closing),
     // and each abort rejects the relay's body read with "This operation was
@@ -459,7 +511,8 @@ export async function runOpenAIIngress(opts) {
     // every one — eight hours of them in one unattended overnight session —
     // while the stats correctly ignored them. The log now matches the stats.
     if (relayFailed && !clientCancelled) {
-        logError(account.id, 502, `openai response relay failed: ${relayFailureMessage}`);
+        logError(account.id, 502, relayFailureMessage);
+        entry.details = details ? `${details};${relayFailureMessage}` : relayFailureMessage;
     }
     // Activity/stats must reflect what the client actually received, not just
     // the raw upstream signal: the non-streaming collector can synthesize a

package/dist/proxy/pool-refresh.js

@@ -0,0 +1,80 @@
+/**
+ * One operator-triggered "reload everything" pass over the live pools —
+ * what a router restart gives you, without dropping in-flight requests or
+ * sticky sessions: expired cooldowns are swept, due (or quarantined) tokens
+ * go through the same refresh path the background loops use, and every
+ * account's usage is re-fetched immediately instead of waiting for its
+ * scheduled slot.
+ *
+ * Provider-agnostic on purpose: each provider hands in its own token refresh
+ * and usage hook, so the endpoint never learns OAuth or usage details.
+ */
+export async function refreshAllAccounts(sources, options = {}) {
+    const now = options.now ?? Date.now;
+    const startedAt = now();
+    options.sweepCooldowns?.();
+    const providers = await Promise.all(sources.map(async (source) => {
+        let tokenRefreshFailed = 0;
+        try {
+            tokenRefreshFailed = Math.max(0, (await source.refreshTokens()).failed);
+        }
+        catch (error) {
+            tokenRefreshFailed = source.getAll().length;
+            options.onError?.(source.provider, error);
+        }
+        // Snapshot AFTER the token pass — a refresh may have quarantined or
+        // recovered accounts — and as a copy: the pools hand out their live
+        // array, which an add/delete can mutate while usage fetches settle.
+        const accounts = [...source.getAll()];
+        const outcomes = await Promise.allSettled(accounts.map(account => source.refreshUsage(account)));
+        let usageRefreshed = 0;
+        for (const outcome of outcomes) {
+            if (outcome.status === "fulfilled" && outcome.value.ok)
+                usageRefreshed++;
+            else if (outcome.status === "rejected")
+                options.onError?.(source.provider, outcome.reason);
+        }
+        return {
+            provider: source.provider,
+            accounts: accounts.length,
+            usageRefreshed,
+            usageFailed: accounts.length - usageRefreshed,
+            tokenRefreshFailed,
+        };
+    }));
+    const total = (pick) => providers.reduce((sum, p) => sum + pick(p), 0);
+    return {
+        accounts: total(p => p.accounts),
+        usageRefreshed: total(p => p.usageRefreshed),
+        usageFailed: total(p => p.usageFailed),
+        tokenRefreshFailed: total(p => p.tokenRefreshFailed),
+        durationMs: Math.max(0, now() - startedAt),
+        providers,
+    };
+}
+/**
+ * Single-flight wrapper: a second reload request while one is running joins
+ * the running one instead of starting another pass. Needed because the
+ * dashboard's client deadline is shorter than the worst case of many
+ * accounts all timing out — a client that gave up and pressed again must
+ * not stack a second sweep on the pools.
+ */
+export function createRefreshAllRunner(run) {
+    let inFlight = null;
+    return () => {
+        if (inFlight)
+            return inFlight;
+        const operation = run().finally(() => {
+            if (inFlight === operation)
+                inFlight = null;
+        });
+        inFlight = operation;
+        return operation;
+    };
+}
+/** Human-readable one-liner for the activity log and the dashboard banner. */
+export function describeRefreshAll(summary) {
+    const failed = summary.usageFailed > 0 ? `, ${summary.usageFailed} usage fetch${summary.usageFailed === 1 ? "" : "es"} failed` : "";
+    const tokens = summary.tokenRefreshFailed > 0 ? `, ${summary.tokenRefreshFailed} token refresh${summary.tokenRefreshFailed === 1 ? "" : "es"} failed` : "";
+    return `reloaded ${summary.accounts} account${summary.accounts === 1 ? "" : "s"}, usage fresh for ${summary.usageRefreshed}${failed}${tokens} (${summary.durationMs}ms)`;
+}

package/dist/proxy/responses-server.js

@@ -6,6 +6,7 @@ import { stats, applyCodexUsage, boundModelId } from "./stats.js";
 import { logWarn } from "./logger.js";
 import { extractCodexSessionKey, sendOpenAINoEligibleResponse } from "./openai-routing.js";
 import { runOpenAIIngress, mirrorUpstreamHeaders, } from "./openai-ingress.js";
+import { waitForWritable } from "./transport-timing.js";
 const RESPONSES_ENVELOPE = {
     wrap: (type, message) => ({ error: { type, message } }),
     sendNoEligible: (error, res, nowMs) => sendOpenAINoEligibleResponse(error, res, nowMs),
@@ -38,30 +39,45 @@ async function sendUpstreamResponse(upstream, res, onChunk) {
     // releases a stalled stream, so the account's upstream slot is not held for
     // a response nobody will receive.
     const DISCONNECTED = Symbol("client-disconnected");
+    let resolveDisconnected;
+    const onClose = () => resolveDisconnected?.(DISCONNECTED);
     const disconnected = new Promise(resolve => {
+        resolveDisconnected = resolve;
         if (res.destroyed)
             resolve(DISCONNECTED);
         else
-            res.once("close", () => resolve(DISCONNECTED));
+            res.once("close", onClose);
     });
+    let completed = false;
     try {
         while (true) {
             const next = await Promise.race([reader.read(), disconnected]);
             if (next === DISCONNECTED) {
                 await reader.cancel().catch(() => { });
-                break;
+                return;
             }
             const { value, done } = next;
             if (done)
                 break;
             if (value) {
-                res.write(Buffer.from(value));
                 onChunk?.(value);
+                if (!res.write(Buffer.from(value))) {
+                    // Backpressure is a contract: do not consume another upstream chunk
+                    // until Node drains, or until the peer goes away.
+                    const drained = await waitForWritable(res);
+                    if (!drained) {
+                        await reader.cancel().catch(() => { });
+                        return;
+                    }
+                }
             }
         }
+        completed = true;
     }
     finally {
-        res.end();
+        res.removeListener("close", onClose);
+        if (completed && !res.destroyed && !res.writableEnded)
+            res.end();
     }
 }
 export function mountResponsesRoutes(app, opts) {
@@ -137,6 +153,7 @@ export function mountResponsesRoutes(app, opts) {
             now,
             envelope: RESPONSES_ENVELOPE,
             onUpstreamAuthFailure: opts.onUpstreamAuthFailure,
+            timeoutMs: opts.timeoutMs,
             ...(opts.maxAttempts !== undefined ? { maxAttempts: opts.maxAttempts } : {}),
             ...(opts.sameAccountRetryDelayMs !== undefined
                 ? { sameAccountRetryDelayMs: opts.sameAccountRetryDelayMs }
@@ -160,6 +177,8 @@ export function mountResponsesRoutes(app, opts) {
                     // (or be cut short) after upstream has already announced a failure,
                     // and the verdict has to survive that.
                     await sendUpstreamResponse(upstream, res, chunk => {
+                        if (entry.firstByteDurationMs === undefined)
+                            entry.firstByteDurationMs = now() - entry.ts;
                         observer.push(chunk);
                         if (observer.explicitFailure() !== undefined)
                             report.upstreamReportedFailure = true;

package/dist/proxy/server.js

@@ -3,8 +3,9 @@ import { createProxyMiddleware } from "http-proxy-middleware";
 import { ServerResponse } from "http";
 import { timingSafeEqual } from "crypto";
 import { TokenPool } from "./token-pool.js";
-import { needsRefresh, refreshAccountIfCurrent, saveAccounts, startRefreshLoop } from "./token-refresher.js";
+import { needsRefresh, refreshAccountIfCurrent, refreshAccountsOnce, saveAccounts, startRefreshLoop } from "./token-refresher.js";
 import { loadAccounts, loadOpenAIAccounts, saveOpenAIAccountsToPath, accountsFileExists, readAccountsFromPath, readConfig, writeConfig, getAutoFailoverEnabled, getProxyRequestTimeoutMs, migrateLegacyAccountProviders, setProviderAccountsEnabled, upsertAccountRecord, removeAccountRecordById } from "../config/manager.js";
+import { createRefreshAllRunner, describeRefreshAll, refreshAllAccounts } from "./pool-refresh.js";
 import { checkForUpdate, performUpdate, restartSelf, printUpdateBanner, getCurrentVersion } from "../utils/self-update.js";
 import { trackEvent, startHeartbeat } from "../utils/telemetry.js";
 import { loadTelemetryState } from "../config/telemetry.js";
@@ -17,7 +18,7 @@ import { loadGrokHealthSnapshots } from "../providers/xai/overview.js";
 import { writePid, removePid, managesPidFile } from "../daemon/pid.js";
 import { applyOpenAIAccountPatch, validateAccountPatchBody } from "./account-patch.js";
 import { AccountRenameConflictError, renameAccountTransaction } from "./account-rename.js";
-import { hasPendingCredentialWrite, markOpenAICredentialsPersisted, prepareOpenAIAccountForRequest, refreshAndPersistOpenAIAccount, startOpenAIRefreshLoop, } from "../providers/openai/token-refresher.js";
+import { hasPendingCredentialWrite, markOpenAICredentialsPersisted, prepareOpenAIAccountForRequest, refreshOpenAIAccountsOnce, refreshAndPersistOpenAIAccount, startOpenAIRefreshLoop, } from "../providers/openai/token-refresher.js";
 import { createOpenAIAccount } from "../providers/openai/account-state.js";
 import { OpenAITokenPool } from "../providers/openai/token-pool.js";
 import { DEFAULT_CODEX_LIMIT_ID } from "../providers/openai/usage.js";
@@ -61,6 +62,7 @@ export function createOperationalStatus(opts) {
             health: "/cc-router/health",
             accounts: "/cc-router/accounts",
             allowance: "/cc-router/allowance",
+            refresh: "/cc-router/refresh",
             messages: "/v1/messages",
             responses: "/v1/responses",
             models: "/v1/models",
@@ -222,7 +224,7 @@ function publicOpenAIAccountView(a, routing) {
         enabled: a.enabled !== false,
         sessionLimitPercent: a.sessionLimitPercent,
         weeklyLimitPercent: a.weeklyLimitPercent,
-        healthy: a.enabled !== false && a.healthy && expiresInMs > 0,
+        healthy: a.enabled !== false && a.healthy && a.authState !== "quarantined" && expiresInMs > 0,
         busy: routing.metrics.coolingDown,
         cooldownUntilMs: routing.metrics.cooldownUntilMs ?? 0,
         globalCooldownUntilMs: routing.cooldowns.globalUntilMs,
@@ -235,6 +237,8 @@ function publicOpenAIAccountView(a, routing) {
         lastRefreshMs: a.lastRefresh,
         codexRateLimits: publicCodexRateLimits(a, routing.cooldowns),
         ...(hasPendingCredentialWrite(a) ? { credentialsPendingWrite: true } : {}),
+        ...(a.authState === "quarantined" ? { authState: "quarantined" } : {}),
+        ...(a.authFailure ? { authFailure: a.authFailure } : {}),
     };
 }
 function publicCodexRateLimits(a, cooldowns) {
@@ -532,6 +536,59 @@ export async function startServer(opts = {}) {
         const views = createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics, createOpenAIRoutingResolver(), loadGrokHealthSnapshots());
         res.json(createAllowanceView(views, Date.now()));
     });
+    // ─── Manual reload (authenticated) ────────────────────────────────────────
+    // The dashboard's "reload everything" key. Gives the operator what a
+    // restart would — swept cooldowns, due/quarantined tokens re-tried, every
+    // account's usage re-fetched — without dropping in-flight requests or
+    // sticky sessions. Each provider contributes its own hooks; the route
+    // itself knows nothing about OAuth or usage formats.
+    const runRefreshAll = createRefreshAllRunner(() => {
+        const onError = (provider, error) => {
+            const message = error instanceof Error ? error.message : String(error);
+            logError(provider, 0, `manual refresh: ${message}`);
+        };
+        return refreshAllAccounts([
+            {
+                provider: "anthropic",
+                getAll: () => pool.getAll(),
+                refreshTokens: async () => {
+                    let failed = 0;
+                    await refreshAccountsOnce(pool.getAll(), { onError: error => { failed++; onError("anthropic", error); } });
+                    return { failed };
+                },
+                refreshUsage: account => usageRefresher.refreshNow(account),
+            },
+            {
+                provider: "openai",
+                getAll: () => openAIAccounts,
+                refreshTokens: () => refreshOpenAIAccountsOnce(openAIAccounts, persistOpenAIAccounts, {
+                    onError: error => onError("openai", error),
+                }),
+                refreshUsage: account => openAIUsageRefresher.refreshNow(account),
+            },
+        ], {
+            sweepCooldowns: () => {
+                pool.sweepExpiredCooldowns();
+                openAIPool.sweepExpiredCooldowns();
+            },
+            onError,
+        });
+    });
+    app.post("/cc-router/refresh", async (_req, res) => {
+        let summary;
+        try {
+            summary = await runRefreshAll();
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logError("refresh", 0, `manual refresh failed: ${message}`);
+            res.status(500).json({ error: `Refresh failed: ${message}` });
+            return;
+        }
+        const details = `manual refresh — ${describeRefreshAll(summary)}`;
+        stats.addLog({ ts: Date.now(), accountId: "proxy", model: "-", type: "refresh", details });
+        res.json({ refresh: summary });
+    });
     // ─── Account management endpoints (authenticated) ─────────────────────────
     // These are mounted BEFORE the /v1/* proxy middleware so they don't get
     // forwarded to Anthropic. express.json() is scoped to this sub-router so
@@ -989,6 +1046,7 @@ export async function startServer(opts = {}) {
         prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, persistOpenAIAccounts),
         modelRouting,
         onUpstreamAuthFailure: onOpenAIUpstreamAuthFailure,
+        timeoutMs: proxyRequestTimeoutMs,
         ...upstreamAttempts,
     });
     mountMessagesCrossProviderRoute(app, {
@@ -997,6 +1055,7 @@ export async function startServer(opts = {}) {
         prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, persistOpenAIAccounts),
         modelRouting,
         onUpstreamAuthFailure: onOpenAIUpstreamAuthFailure,
+        timeoutMs: proxyRequestTimeoutMs,
         ...upstreamAttempts,
     });
     // Shared between the retrying /v1/messages route and the generic /v1 chain

package/dist/proxy/transport-diagnostics.js

@@ -0,0 +1,32 @@
+import { randomUUID } from "node:crypto";
+const SAFE_CODE = /^[A-Za-z0-9_.:-]{1,48}$/;
+const SAFE_CORRELATION = /^[A-Za-z0-9-]{1,48}$/;
+export function createCorrelationId() {
+    return `oai-${randomUUID().slice(0, 8)}`;
+}
+export function safeCauseCode(error) {
+    let cause = error instanceof Error ? error.cause : undefined;
+    for (let depth = 0; depth < 3 && typeof cause === "object" && cause !== null; depth++) {
+        const code = cause.code;
+        if (typeof code === "string" && SAFE_CODE.test(code))
+            return code;
+        cause = cause.cause;
+    }
+    return undefined;
+}
+export function formatTransportDiagnostic(diagnostic) {
+    const correlationId = SAFE_CORRELATION.test(diagnostic.correlationId)
+        ? diagnostic.correlationId
+        : "invalid";
+    const fields = [
+        `correlation=${correlationId}`,
+        `operation=${diagnostic.operation}`,
+    ];
+    if (diagnostic.status !== undefined && Number.isInteger(diagnostic.status)) {
+        fields.push(`status=${diagnostic.status}`);
+    }
+    if (diagnostic.causeCode !== undefined && SAFE_CODE.test(diagnostic.causeCode)) {
+        fields.push(`cause=${diagnostic.causeCode}`);
+    }
+    return fields.join(" ");
+}