@timo972/cc-router 0.12.2 → 0.12.3

package/CHANGELOG.md

@@ -10,6 +10,41 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [0.12.3] — 2026-09-17
+
+### Added
+
+- Account identity and plan details in the dashboard's selected-account line and
+  in `cc-router accounts list` while the proxy is running: email, personal or
+  workspace type, workspace name, and plan for Claude and ChatGPT accounts,
+  Claude subscription status and start date, and plans for stored Grok accounts.
+  Claude's start date is when the subscription was created, not the start of the
+  current billing period; billing interval is not supported, and renewal dates
+  are left unknown rather than guessed from token expiry or usage resets.
+- `GET /cc-router/accounts` returns an optional `accountInfo` object per account,
+  with a `fetchStatus` of `fresh`, `stale`, or `unavailable`. Metadata is cached
+  in memory for five minutes, refreshed in the background with one-minute retries
+  after a failure, and refreshed on demand by `POST /cc-router/refresh` or the
+  dashboard's **R**. Listings never block on a provider request; a failed lookup
+  keeps the last successful data and marks it stale.
+
+### Changed
+
+- `cc-router accounts list` reads live stats from the authenticated
+  `/cc-router/accounts` endpoint instead of `/cc-router/health`, sending the
+  configured proxy secret.
+
+### Security
+
+- Identity metadata is memory-only: it is never written to `accounts.json`,
+  never included in health responses — including authenticated health — and
+  never sent to telemetry. Provider responses are rebuilt field by field from an
+  allowlist with bounded, control-character-free strings and strict timestamps,
+  metadata requests refuse redirects so credentials cannot follow one, and
+  decoded token claims are used for display only, never to authorize a request.
+
+---
+
 ## [0.12.2] — 2026-09-16
 
 ### Added
@@ -757,6 +792,7 @@ cache-aware session routing and a round of security hardening.
 - `http-proxy-middleware` 3.0.5 → 3.0.7 for GHSA-gcq2-9pq2-cxqm (high). The
   affected APIs are not used here.
 
+[0.12.3]: https://github.com/Timo972/cc-router/releases/tag/v0.12.3
 [0.12.2]: https://github.com/Timo972/cc-router/releases/tag/v0.12.2
 [0.12.1]: https://github.com/Timo972/cc-router/releases/tag/v0.12.1
 [0.12.0]: https://github.com/Timo972/cc-router/releases/tag/v0.12.0

package/dist/cli/cmd-accounts.js

@@ -9,6 +9,7 @@ import { importGrokCliAuth } from "../providers/xai/import-auth.js";
 import { loginXaiWithDeviceCode } from "../providers/xai/device-oauth.js";
 import { isValidAccountId } from "../proxy/account-rename.js";
 import { createSetupAttempt, failAttemptFromError, withSetupTelemetryFlush, } from "../telemetry/setup-diagnostics.js";
+import { sanitizeAccountInfo, formatAccountInfo } from "../providers/account-info.js";
 export function registerAccounts(program) {
     const accounts = program
         .command("accounts")
@@ -63,6 +64,9 @@ export function registerAccounts(program) {
                     `  requests: ${chalk.cyan(String(s.requestCount).padStart(5))}` +
                     `  errors: ${chalk.red(String(s.errorCount).padStart(3))}` +
                     `  expires: ${exp}`);
+                const info = formatAccountInfo(s.accountInfo);
+                if (info)
+                    console.log(chalk.gray(`    ${info}`));
             }
             // The proxy reads accounts.json once at startup, so anything that
             // rewrites the file afterwards leaves the two out of step. Silence
@@ -618,7 +622,9 @@ export async function addAccountRuntimeAware(record, dependencies = {
 }
 async function fetchLiveStats() {
     try {
-        const res = await fetch(`http://localhost:${PROXY_PORT}/cc-router/health`, {
+        const { proxySecret } = readConfig();
+        const res = await fetch(`http://localhost:${PROXY_PORT}/cc-router/accounts`, {
+            headers: proxySecret ? { authorization: `Bearer ${proxySecret}` } : {},
             signal: AbortSignal.timeout(1_000),
         });
         if (!res.ok)
@@ -627,7 +633,9 @@ async function fetchLiveStats() {
         if (!Array.isArray(data.accounts))
             return null;
         const { mergeGrokIntoHealth } = await import("../providers/xai/overview.js");
-        return mergeGrokIntoHealth(data).accounts;
+        return mergeGrokIntoHealth(data).accounts.map(account => ({
+            ...account, accountInfo: sanitizeAccountInfo(account.accountInfo),
+        }));
     }
     catch {
         return null;

package/dist/providers/account-info-fetch.js

@@ -0,0 +1,90 @@
+import { infoRecord, infoText, sanitizeAccountInfo } from "./account-info.js";
+import { GROK_USER_ENDPOINT } from "./xai/subscription-fetch.js";
+/** Display hints only: decoded claims never authorize a request or select a token. */
+function tokenClaims(token) {
+    try {
+        if (token.length > 64_000)
+            return {};
+        return infoRecord(JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8")));
+    }
+    catch {
+        return {};
+    }
+}
+export async function fetchAccountInfo(account, options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    const claims = account.provider === "openai_subscription" ? tokenClaims(account.accessToken) : {};
+    const auth = infoRecord(claims["https://api.openai.com/auth"]);
+    const workspaceId = infoText(auth.chatgpt_account_id);
+    const headers = { authorization: `Bearer ${account.accessToken}`, accept: "application/json" };
+    if (workspaceId)
+        headers["chatgpt-account-id"] = workspaceId;
+    const get = async (url) => {
+        try {
+            const timeout = AbortSignal.timeout(10_000);
+            const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+            // Never forward a credential to a redirect destination.
+            const response = await fetchImpl(url, { headers, signal, redirect: "error" });
+            if (!response.ok)
+                return undefined;
+            const body = await response.json();
+            return Object.keys(infoRecord(body)).length ? infoRecord(body) : undefined;
+        }
+        catch {
+            // Metadata is best effort. Neither raw responses nor errors reach logs/telemetry.
+            return undefined;
+        }
+    };
+    if (account.provider === "anthropic_subscription") {
+        const body = await get("https://api.anthropic.com/api/oauth/profile");
+        const user = infoRecord(body?.account);
+        const org = infoRecord(body?.organization);
+        if (!infoText(user.uuid) || !infoText(user.email, 254) || !infoText(org.uuid))
+            return undefined;
+        const plans = { claude_pro: "Pro", claude_max: "Max", claude_team: "Team", claude_enterprise: "Enterprise" };
+        const type = infoText(org.organization_type) ?? "";
+        let plan = plans[type];
+        if (type === "claude_max" && org.rate_limit_tier === "default_claude_max_5x")
+            plan = "Max 5x";
+        if (type === "claude_max" && org.rate_limit_tier === "default_claude_max_20x")
+            plan = "Max 20x";
+        return sanitizeAccountInfo({
+            email: user.email, accountId: user.uuid, workspaceId: org.uuid, workspaceName: org.name,
+            accountType: type === "claude_team" || type === "claude_enterprise" ? "workspace"
+                : type === "claude_pro" || type === "claude_max" ? "personal" : "unknown",
+            plan,
+            subscription: {
+                status: org.subscription_status, startedAt: org.subscription_created_at,
+                trialEndsAt: org.claude_code_trial_ends_at,
+            },
+            fetchedAt: now(), fetchStatus: "fresh",
+        });
+    }
+    if (account.provider === "xai_subscription") {
+        const body = await get(GROK_USER_ENDPOINT);
+        const plan = infoText(body?.subscriptionTier);
+        // Identity/team and billing fields have not been verified for this endpoint.
+        return plan ? sanitizeAccountInfo({ accountType: "unknown", plan, fetchedAt: now(), fetchStatus: "fresh" }) : undefined;
+    }
+    const [usage, listing] = await Promise.all([
+        get("https://chatgpt.com/backend-api/wham/usage"),
+        get("https://chatgpt.com/backend-api/wham/accounts/check"),
+    ]);
+    const matchingUsage = workspaceId && usage?.account_id === workspaceId ? usage : undefined;
+    const entries = Array.isArray(listing?.accounts) ? listing.accounts : [];
+    const selected = workspaceId ? entries.map(infoRecord).find(row => row.id === workspaceId) : undefined;
+    const profile = infoRecord(claims["https://api.openai.com/profile"]);
+    const email = infoText(matchingUsage?.email, 254) ?? infoText(profile.email, 254);
+    const plan = infoText(selected?.plan_type) ?? infoText(matchingUsage?.plan_type) ?? infoText(auth.chatgpt_plan_type);
+    if (!email && !plan && !selected)
+        return undefined;
+    const fresh = Boolean(matchingUsage && selected);
+    return sanitizeAccountInfo({
+        email, plan, workspaceId, workspaceName: selected?.name,
+        accountId: matchingUsage?.user_id ?? auth.chatgpt_user_id,
+        accountType: selected?.structure,
+        ...(fresh ? { fetchedAt: now() } : {}),
+        fetchStatus: fresh ? "fresh" : "stale",
+    });
+}

package/dist/providers/account-info.js

@@ -0,0 +1,72 @@
+export function infoRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value : {};
+}
+/** Reject, rather than truncate, control-bearing/unbounded provider strings. */
+export function infoText(value, max = 160) {
+    if (typeof value !== "string")
+        return undefined;
+    const text = value.trim();
+    if (!text || text.length > max || /[\p{Cc}\p{Cf}]/u.test(value))
+        return undefined;
+    return text;
+}
+function timestamp(value) {
+    // Only explicit timestamps, not ambiguous local dates, seconds, or durations.
+    if (typeof value !== "string" || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$/.test(value))
+        return undefined;
+    const ms = Date.parse(value);
+    return Number.isFinite(ms) && ms > 0 ? new Date(ms).toISOString() : undefined;
+}
+/** Used at both provider and client boundaries; no arbitrary properties survive. */
+export function sanitizeAccountInfo(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const raw = infoRecord(value);
+    const info = {
+        accountType: raw.accountType === "personal" || raw.accountType === "workspace" ? raw.accountType : "unknown",
+        fetchStatus: raw.fetchStatus === "fresh" || raw.fetchStatus === "stale" ? raw.fetchStatus : "unavailable",
+    };
+    for (const key of ["email", "accountId", "workspaceId", "workspaceName", "plan"]) {
+        const text = infoText(raw[key], key === "email" ? 254 : 160);
+        if (text)
+            info[key] = text;
+    }
+    if (typeof raw.fetchedAt === "number" && Number.isFinite(raw.fetchedAt) && raw.fetchedAt > 0)
+        info.fetchedAt = raw.fetchedAt;
+    const sub = infoRecord(raw.subscription);
+    const subscription = {};
+    const status = infoText(sub.status, 64);
+    if (status)
+        subscription.status = status;
+    for (const key of ["startedAt", "currentPeriodStart", "currentPeriodEnd", "renewsAt", "trialEndsAt"]) {
+        const date = timestamp(sub[key]);
+        if (date)
+            subscription[key] = date;
+    }
+    if (typeof sub.cancelAtPeriodEnd === "boolean")
+        subscription.cancelAtPeriodEnd = sub.cancelAtPeriodEnd;
+    if (Object.keys(subscription).length)
+        info.subscription = subscription;
+    return info;
+}
+export function formatAccountInfo(value) {
+    const info = sanitizeAccountInfo(value);
+    if (!info)
+        return "";
+    const parts = [info.email, info.accountType === "unknown" ? undefined : info.accountType, info.workspaceName, info.plan];
+    const sub = info.subscription;
+    if (sub?.status)
+        parts.push(sub.status);
+    if (sub?.cancelAtPeriodEnd && sub.currentPeriodEnd)
+        parts.push(`Ends ${sub.currentPeriodEnd.slice(0, 10)}`);
+    else if (sub?.renewsAt)
+        parts.push(`Renews ${sub.renewsAt.slice(0, 10)}`);
+    else if (sub?.startedAt)
+        parts.push(`Since ${sub.startedAt.slice(0, 10)}`);
+    if (sub?.trialEndsAt)
+        parts.push(`Trial ends ${sub.trialEndsAt.slice(0, 10)}`);
+    if (info.fetchStatus !== "fresh")
+        parts.push(`metadata ${info.fetchStatus}`);
+    return parts.filter(Boolean).join(" · ");
+}

package/dist/proxy/account-info-cache.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { fetchAccountInfo } from "../providers/account-info-fetch.js";
+import { sanitizeAccountInfo } from "../providers/account-info.js";
+const TTL_MS = 5 * 60_000;
+const RETRY_MS = 60_000;
+const key = (account) => `${account.provider}:${account.id}`;
+const fingerprint = (account) => createHash("sha256").update(account.accessToken).digest("hex");
+const unavailable = () => ({ accountType: "unknown", fetchStatus: "unavailable" });
+/** Ephemeral private metadata, isolated from persisted credentials and routing state. */
+export class AccountInfoCache {
+    accounts;
+    entries = new Map();
+    inFlight;
+    pendingForced;
+    controller = new AbortController();
+    timer;
+    now;
+    fetchInfo;
+    constructor(accounts, options = {}) {
+        this.accounts = accounts;
+        this.now = options.now ?? Date.now;
+        this.fetchInfo = options.fetchInfo ?? fetchAccountInfo;
+    }
+    start() {
+        if (this.timer || this.controller.signal.aborted)
+            return;
+        void this.refresh();
+        this.timer = setInterval(() => { void this.refresh(); }, RETRY_MS);
+        this.timer.unref();
+    }
+    get(account) {
+        const entry = this.entries.get(key(account));
+        if (!entry || entry.fingerprint !== fingerprint(account) || !entry.info)
+            return unavailable();
+        const info = sanitizeAccountInfo(entry.info);
+        if (!info.fetchedAt || this.now() - info.fetchedAt >= TTL_MS || account.expiresAt <= this.now())
+            info.fetchStatus = "stale";
+        return info;
+    }
+    refresh(force = false) {
+        if (this.controller.signal.aborted)
+            return Promise.resolve();
+        if (this.inFlight) {
+            if (!force)
+                return this.inFlight;
+            // A token refresh or account addition may have happened after the active
+            // pass took its snapshot. One queued pass observes the current sources.
+            this.pendingForced ??= this.inFlight.then(() => {
+                this.pendingForced = undefined;
+                return this.refresh(true);
+            });
+            return this.pendingForced;
+        }
+        const operation = this.run(force).catch(() => {
+            // Storage may disappear during a refresh. Do not report credential errors.
+        }).finally(() => { if (this.inFlight === operation)
+            this.inFlight = undefined; });
+        this.inFlight = operation;
+        return operation;
+    }
+    async run(force) {
+        const accounts = this.accounts();
+        const liveKeys = new Set(accounts.map(key));
+        for (const id of this.entries.keys())
+            if (!liveKeys.has(id))
+                this.entries.delete(id);
+        const queue = accounts.filter(account => {
+            const id = key(account);
+            const digest = fingerprint(account);
+            let entry = this.entries.get(id);
+            if (entry?.fingerprint !== digest) {
+                entry = { fingerprint: digest };
+                this.entries.set(id, entry);
+            }
+            const ttl = entry.info?.fetchStatus === "fresh" ? TTL_MS : RETRY_MS;
+            return account.enabled !== false && account.expiresAt > this.now()
+                && (force || entry.attemptedAt === undefined || this.now() - entry.attemptedAt >= ttl);
+        });
+        const worker = async () => {
+            while (!this.controller.signal.aborted) {
+                const account = queue.shift();
+                if (!account)
+                    break;
+                // Re-check presence/credentials before network I/O after time spent queued.
+                const current = this.accounts().find(row => key(row) === key(account));
+                if (!current || current.enabled === false || current.expiresAt <= this.now() || fingerprint(current) !== fingerprint(account))
+                    continue;
+                const entry = this.entries.get(key(account));
+                entry.attemptedAt = this.now();
+                let info;
+                try {
+                    info = await this.fetchInfo(account, { signal: this.controller.signal, now: this.now });
+                }
+                catch { /* best effort */ }
+                const latest = this.accounts().find(row => key(row) === key(account));
+                if (this.controller.signal.aborted || !latest || fingerprint(latest) !== entry.fingerprint)
+                    continue;
+                const safe = sanitizeAccountInfo(info);
+                if (safe && (safe.fetchStatus === "fresh" || !entry.info))
+                    entry.info = safe;
+                else if (entry.info)
+                    entry.info = { ...entry.info, fetchStatus: "stale" };
+            }
+        };
+        await Promise.all([worker(), worker()]);
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.controller.abort();
+        this.entries.clear();
+    }
+}

package/dist/proxy/server.js

@@ -40,6 +40,8 @@ import { accountDeletionStatusCode, deleteAnthropicAccountTransaction, deleteOpe
 import { addOpenAIAccountTransaction } from "./account-add.js";
 import { createAnthropicRefreshMiddleware, createAnthropicRoutingMiddleware, } from "./anthropic-routing.js";
 import { createAllowanceView } from "./allowance.js";
+import { AccountInfoCache } from "./account-info-cache.js";
+import { loadXaiAccounts } from "../config/manager.js";
 /** Upper bound on how long a shutdown may wait for telemetry to drain. */
 const TELEMETRY_SHUTDOWN_DEADLINE_MS = 1_000;
 const zeroRoutingMetrics = () => ({
@@ -433,6 +435,22 @@ export async function startServer(opts = {}) {
         prepare: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, persistOpenAIAccounts),
     });
     openAIUsageRefresher.start();
+    const accountInfoSources = () => [
+        ...pool.getAll().map(account => ({
+            id: account.id, provider: "anthropic_subscription",
+            accessToken: account.tokens.accessToken, expiresAt: account.tokens.expiresAt, enabled: account.enabled,
+        })),
+        ...openAIAccounts.map(account => ({
+            id: account.id, provider: "openai_subscription",
+            accessToken: account.accessToken, expiresAt: account.expiresAt, enabled: account.enabled,
+        })),
+        ...loadXaiAccounts(accountsPath).map(account => ({
+            id: account.id, provider: "xai_subscription",
+            accessToken: account.accessToken, expiresAt: account.expiresAt, enabled: account.enabled,
+        })),
+    ];
+    const accountInfoCache = new AccountInfoCache(accountInfoSources);
+    accountInfoCache.start();
     const app = express();
     const proxyRequestTimeoutMs = getProxyRequestTimeoutMs();
     // Router-side 429 failover / 5xx retry is on by default; `"autoFailover":
@@ -549,12 +567,12 @@ export async function startServer(opts = {}) {
     // account's usage re-fetched — without dropping in-flight requests or
     // sticky sessions. Each provider contributes its own hooks; the route
     // itself knows nothing about OAuth or usage formats.
-    const runRefreshAll = createRefreshAllRunner(() => {
+    const runRefreshAll = createRefreshAllRunner(async () => {
         const onError = (provider, error) => {
             const message = error instanceof Error ? error.message : String(error);
             logError(provider, 0, `manual refresh: ${message}`);
         };
-        return refreshAllAccounts([
+        const summary = await refreshAllAccounts([
             {
                 provider: "anthropic",
                 getAll: () => pool.getAll(),
@@ -580,6 +598,10 @@ export async function startServer(opts = {}) {
             },
             onError,
         });
+        const metadataStartedAt = Date.now();
+        await accountInfoCache.refresh(true);
+        summary.durationMs += Math.max(0, Date.now() - metadataStartedAt);
+        return summary;
     });
     app.post("/cc-router/refresh", async (_req, res) => {
         let summary;
@@ -612,8 +634,15 @@ export async function startServer(opts = {}) {
     // Shape returned to clients — NEVER includes access/refresh tokens.
     accountsRouter.get("/", (_req, res) => {
         const resolveRoutingMetrics = createRoutingMetricsResolver();
+        // Never wait on an upstream metadata request while listing accounts.
+        void accountInfoCache.refresh();
+        const sources = accountInfoSources();
+        res.setHeader("Cache-Control", "no-store");
         res.json({
-            accounts: createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics, createOpenAIRoutingResolver(), loadGrokHealthSnapshots()),
+            accounts: createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics, createOpenAIRoutingResolver(), loadGrokHealthSnapshots()).map(view => {
+                const source = sources.find(account => account.id === view.id && account.provider === view.provider);
+                return { ...view, ...(source ? { accountInfo: accountInfoCache.get(source) } : {}) };
+            }),
         });
     });
     accountsRouter.patch("/providers/:provider", (req, res) => {
@@ -1347,6 +1376,7 @@ export async function startServer(opts = {}) {
         console.log(chalk.yellow("\nShutting down — saving tokens..."));
         usageRefresher.stop();
         openAIUsageRefresher.stop();
+        accountInfoCache.stop();
         saveAccounts(pool.getAll());
         if (managesPidFile()) {
             removePid();

package/dist/ui/Dashboard.js

@@ -7,6 +7,7 @@ import { createModelsApi } from "./modelsApi.js";
 import { getCurrentVersion } from "../utils/self-update.js";
 import { readClaudeRouting, readCodexRouting, setClaudeRouting, setCodexRouting, } from "../utils/cli-routing.js";
 import { mergeGrokIntoHealth, loadGrokHealthSnapshotsWithSubscription } from "../providers/xai/overview.js";
+import { formatAccountInfo } from "../providers/account-info.js";
 const POLL_INTERVAL_MS = 2_000;
 /** Progress banner for the manual reload; replaced by the result banner, so
  *  only the failure case (client gave up) ever lets it expire. */
@@ -620,6 +621,34 @@ function ErrorScreen({ error, port, retries }) {
 }
 // ─── Live dashboard ───────────────────────────────────────────────────────────
 function LiveDashboard({ data, port, baseUrl, lastUpdate, api, modelsApi, onIntent, onRefreshAll, resetSession, }) {
+    // Private identity comes only from the authenticated account endpoint, never health.
+    const [accountInfo, setAccountInfo] = useState({});
+    useEffect(() => {
+        let cancelled = false;
+        let pending = false;
+        const poll = async () => {
+            if (pending)
+                return;
+            pending = true;
+            try {
+                const accounts = await api.list();
+                if (!cancelled)
+                    setAccountInfo(Object.fromEntries(accounts.map(account => [
+                        `${account.provider ?? "anthropic_subscription"}:${account.id}`, account.accountInfo,
+                    ])));
+            }
+            catch {
+                if (!cancelled)
+                    setAccountInfo({});
+            }
+            finally {
+                pending = false;
+            }
+        };
+        void poll();
+        const timer = setInterval(() => { void poll(); }, POLL_INTERVAL_MS);
+        return () => { cancelled = true; clearInterval(timer); };
+    }, [api]);
     const [cliRouting, setCliRouting] = useState(() => ({
         claude: readClaudeRouting(),
         codex: readCodexRouting(),
@@ -1235,7 +1264,7 @@ function LiveDashboard({ data, port, baseUrl, lastUpdate, api, modelsApi, onInte
                                             : "daemon version unreported (older build)", ` · dashboard v${DASHBOARD_VERSION}`] }), LOCAL_TARGET_RE.test(baseUrl) ? (_jsxs(_Fragment, { children: [_jsx(Text, { color: "gray", children: "  \u2014  restart: " }), _jsx(Text, { color: "cyan", children: "cc-router stop --keep-config && cc-router start" })] })) : (
                                 // A remote router can only be restarted where it runs; printing a
                                 // local restart command here would never clear the banner.
-                                _jsxs(Text, { color: "gray", children: ["  \u2014  update and restart the daemon on ", baseUrl] }))] })), _jsx(Box, { marginTop: 1 }), data.operational && (_jsxs(_Fragment, { children: [_jsx(OperationsPanel, { operational: data.operational, baseUrl: baseUrl, focus: focus, cliRouting: cliRouting }), _jsx(Box, { marginTop: 1 })] })), (focus === "models" || modelsStatus) && (_jsxs(_Fragment, { children: [_jsx(ModelsPanel, { status: modelsStatus, selectedIndex: selectedModelIndex, focused: focus === "models", visibleRows: modelsVisible, rowsRef: modelRowsRef }), _jsx(Box, { marginTop: 1 })] })), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsxs(Text, { bold: true, children: [" ACCOUNTS  ", _jsxs(Text, { color: healthyCount === orderedAccounts.length ? "green" : "yellow", children: [healthyCount, "/", orderedAccounts.length, " healthy"] }), weeklyFullCount > 0 && _jsx(Text, { color: "red", children: `  ·  ${weeklyFullCount} 7d full` })] }), shownAccounts < orderedAccounts.length && (_jsxs(Text, { color: "gray", children: ["  ·  showing ", accountWindowTop + 1, "\u2013", accountWindowTop + shownAccounts] })), compact && _jsx(Text, { color: "cyan", children: "  ·  compact" })] }), _jsx(Box, { marginTop: 1, flexDirection: "column", ref: accountRowsRef, children: _jsx(AccountGroups, { visible: orderedAccounts.slice(accountWindowTop, accountWindowTop + shownAccounts), fleet: orderedAccounts, windowTop: accountWindowTop, selectedIndex: selectedAccountIndex, focused: focus === "accounts" }) })] }), banner && (_jsx(Box, { marginTop: 1, paddingLeft: 2, children: _jsxs(Text, { color: banner.color, children: [" ", banner.text] }) })), !compact && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1 }), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: " TOTALS  " }), _jsx(Text, { children: "requests " }), _jsx(Text, { color: "cyan", children: data.totalRequests }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "errors " }), _jsx(Text, { color: data.totalErrors > 0 ? "red" : "green", children: data.totalErrors }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "refreshes " }), _jsx(Text, { color: "yellow", children: data.totalRefreshes }), _jsx(CacheHealthBadge, { read: data.totalCacheReadTokens, created: data.totalCacheCreationTokens, input: data.totalInputTokens })] }), _jsx(TokenSummary, { cacheRead: data.totalCacheReadTokens, cacheCreated: data.totalCacheCreationTokens, uncached: data.totalInputTokens, output: data.totalOutputTokens ?? 0 })] }), _jsx(Box, { marginTop: 1 }), _jsx(Text, { bold: true, children: " RECENT ACTIVITY" }), _jsx(Box, { marginTop: 1 })] }))] }), !compact && (_jsx(Box, { flexDirection: "column", ref: logRowsRef, children: visibleLogs.length === 0
+                                _jsxs(Text, { color: "gray", children: ["  \u2014  update and restart the daemon on ", baseUrl] }))] })), _jsx(Box, { marginTop: 1 }), data.operational && (_jsxs(_Fragment, { children: [_jsx(OperationsPanel, { operational: data.operational, baseUrl: baseUrl, focus: focus, cliRouting: cliRouting }), _jsx(Box, { marginTop: 1 })] })), (focus === "models" || modelsStatus) && (_jsxs(_Fragment, { children: [_jsx(ModelsPanel, { status: modelsStatus, selectedIndex: selectedModelIndex, focused: focus === "models", visibleRows: modelsVisible, rowsRef: modelRowsRef }), _jsx(Box, { marginTop: 1 })] })), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsxs(Text, { bold: true, children: [" ACCOUNTS  ", _jsxs(Text, { color: healthyCount === orderedAccounts.length ? "green" : "yellow", children: [healthyCount, "/", orderedAccounts.length, " healthy"] }), weeklyFullCount > 0 && _jsx(Text, { color: "red", children: `  ·  ${weeklyFullCount} 7d full` })] }), shownAccounts < orderedAccounts.length && (_jsxs(Text, { color: "gray", children: ["  ·  showing ", accountWindowTop + 1, "\u2013", accountWindowTop + shownAccounts] })), compact && _jsx(Text, { color: "cyan", children: "  ·  compact" })] }), _jsx(Box, { marginTop: 1, flexDirection: "column", ref: accountRowsRef, children: _jsx(AccountGroups, { visible: orderedAccounts.slice(accountWindowTop, accountWindowTop + shownAccounts), fleet: orderedAccounts, windowTop: accountWindowTop, selectedIndex: selectedAccountIndex, focused: focus === "accounts" }) }), focus === "accounts" && selectedAccount && (_jsxs(Text, { color: "gray", wrap: "truncate-end", children: ["  ", formatAccountInfo(accountInfo[`${selectedAccount.provider ?? "anthropic_subscription"}:${selectedAccount.id}`])] }))] }), banner && (_jsx(Box, { marginTop: 1, paddingLeft: 2, children: _jsxs(Text, { color: banner.color, children: [" ", banner.text] }) })), !compact && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1 }), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: " TOTALS  " }), _jsx(Text, { children: "requests " }), _jsx(Text, { color: "cyan", children: data.totalRequests }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "errors " }), _jsx(Text, { color: data.totalErrors > 0 ? "red" : "green", children: data.totalErrors }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "refreshes " }), _jsx(Text, { color: "yellow", children: data.totalRefreshes }), _jsx(CacheHealthBadge, { read: data.totalCacheReadTokens, created: data.totalCacheCreationTokens, input: data.totalInputTokens })] }), _jsx(TokenSummary, { cacheRead: data.totalCacheReadTokens, cacheCreated: data.totalCacheCreationTokens, uncached: data.totalInputTokens, output: data.totalOutputTokens ?? 0 })] }), _jsx(Box, { marginTop: 1 }), _jsx(Text, { bold: true, children: " RECENT ACTIVITY" }), _jsx(Box, { marginTop: 1 })] }))] }), !compact && (_jsx(Box, { flexDirection: "column", ref: logRowsRef, children: visibleLogs.length === 0
                         ? _jsx(Text, { color: "gray", children: "  No activity yet" })
                         : visibleLogs.map((log, i) => (_jsx(LogRow, { log: log, selected: focus === "logs" && logWindowTop + i === selectedLogIndex }, `${log.ts}-${i}`))) })), !compact && focus === "logs" && selectedLog && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginTop: 1 }), _jsx(DetailPanel, { log: selectedLog })] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", children: focus === "accounts"
                             ? " [Tab]  [e] toggle  [a]/[o]/[g] provider  [n] add  [d] delete  [w] 7d  [s] 5h  [Ctrl+R] reset  [R] reload  [z] compact  [q]"

package/dist/ui/accountsApi.js

@@ -1,3 +1,4 @@
+import { sanitizeAccountInfo } from "../providers/account-info.js";
 /**
  * Tiny authenticated HTTP client for /cc-router/accounts.
  *
@@ -100,10 +101,12 @@ function publicAccountSafeView(value) {
         ? value.provider
         : undefined;
     const rateLimits = publicRateLimits(value.rateLimits);
+    const accountInfo = sanitizeAccountInfo(value.accountInfo);
     const modelCooldowns = publicCooldowns(value.modelCooldowns);
     return [{
             id: publicText(value.id, 128, "unknown-account"),
             ...(provider ? { provider } : {}),
+            ...(accountInfo ? { accountInfo } : {}),
             ...(rateLimits ? { rateLimits } : {}),
             globalCooldownUntilMs: publicTimestamp(value.globalCooldownUntilMs),
             modelCooldowns,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timo972/cc-router",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Cache-aware session router for Claude Max OAuth tokens — use multiple Claude Max accounts with Claude Code",
   "type": "module",
   "bin": {