@timo972/cc-router 0.12.4 → 0.13.0-rc.0

package/dist/providers/anthropic/usage-refresher.js

@@ -1,5 +1,6 @@
 import { UsageRefresher } from "../../proxy/usage-refresher.js";
 import { fetchAnthropicUsage } from "./usage.js";
+import { canReadProfile } from "./scopes.js";
 import { httpOutcome, recordRuntimeError, recordSafeLog, recordUpstreamStatus, withTelemetrySpan, } from "../../telemetry/facade.js";
 /**
  * The Anthropic instantiation of the shared usage scheduler (see
@@ -12,39 +13,45 @@ export class AnthropicUsageRefresher extends UsageRefresher {
         const now = options.now ?? Date.now;
         const fetchUsage = options.fetchUsage ?? fetchAnthropicUsage;
         super(pool, {
-            fetchUsage: account => withTelemetrySpan("provider.usage_refresh", { provider: "anthropic" }, async (span) => {
-                let result;
-                try {
-                    result = await fetchUsage(account);
-                }
-                catch (error) {
-                    recordRuntimeError(error, { operation: "provider.usage_refresh", provider: "anthropic" });
-                    throw error;
-                }
-                if (!result.ok) {
-                    if (result.status !== undefined) {
-                        recordUpstreamStatus("provider.usage_refresh", "anthropic", result.status);
-                        span.fail({ httpStatusCode: result.status, outcome: httpOutcome(result.status) });
+            // The OAuth usage endpoint needs `user:profile`. An inference-only
+            // credential (`claude setup-token`) can only ever be answered with a
+            // 403, so the request is never sent: the account lands on the same
+            // "unavailable" usage state without spending an upstream call.
+            fetchUsage: account => !canReadProfile(account.tokens.scopes)
+                ? Promise.resolve({ ok: false, reason: "http", status: 403 })
+                : withTelemetrySpan("provider.usage_refresh", { provider: "anthropic" }, async (span) => {
+                    let result;
+                    try {
+                        result = await fetchUsage(account);
                     }
-                    else {
-                        // fetchAnthropicUsage resolves transport failures instead of
-                        // throwing, so the unsampled failure log is emitted here.
-                        const reason = result.reason === "timeout" ? "timeout"
-                            : result.reason === "network" ? "network_failure"
-                                : "other";
-                        const outcome = reason === "timeout" ? "timeout" : "upstream_error";
-                        recordSafeLog({
-                            operation: "provider.usage_refresh",
-                            provider: "anthropic",
-                            severity: "error",
-                            reason,
-                            outcome,
-                        });
-                        span.fail({ outcome });
+                    catch (error) {
+                        recordRuntimeError(error, { operation: "provider.usage_refresh", provider: "anthropic" });
+                        throw error;
                     }
-                }
-                return result;
-            }),
+                    if (!result.ok) {
+                        if (result.status !== undefined) {
+                            recordUpstreamStatus("provider.usage_refresh", "anthropic", result.status);
+                            span.fail({ httpStatusCode: result.status, outcome: httpOutcome(result.status) });
+                        }
+                        else {
+                            // fetchAnthropicUsage resolves transport failures instead of
+                            // throwing, so the unsampled failure log is emitted here.
+                            const reason = result.reason === "timeout" ? "timeout"
+                                : result.reason === "network" ? "network_failure"
+                                    : "other";
+                            const outcome = reason === "timeout" ? "timeout" : "upstream_error";
+                            recordSafeLog({
+                                operation: "provider.usage_refresh",
+                                provider: "anthropic",
+                                severity: "error",
+                                reason,
+                                outcome,
+                            });
+                            span.fail({ outcome });
+                        }
+                    }
+                    return result;
+                }),
             cancelledResult: () => ({ ok: false, reason: "network" }),
             applyResult: (account, result) => {
                 if (result.ok) {

package/dist/providers/openai/device-oauth.js

@@ -1,9 +1,20 @@
 import { createOpenAIAccountRecord } from "./account-record.js";
+import { openInBrowser } from "../../utils/browser.js";
 import { SetupDiagnosticError, classifyHttpSetupFailure, classifyNetworkSetupFailure, } from "../../telemetry/setup-diagnostics.js";
 const DEFAULT_ISSUER = "https://auth.openai.com";
 export const DEFAULT_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const DEFAULT_SCOPE = "openid profile email offline_access";
 const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+/**
+ * The device page accepts the code (and the account to sign in as) in the query
+ * string, so the person only has to confirm rather than retype anything.
+ */
+export function buildOpenAIDeviceVerificationUrl(issuer, userCode, loginHint) {
+    const params = new URLSearchParams({ user_code: userCode });
+    if (loginHint)
+        params.set("login_hint", loginHint);
+    return `${issuer.replace(/\/+$/, "")}/codex/device?${params.toString()}`;
+}
 function issuerOf(opts) {
     return (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
 }
@@ -82,7 +93,7 @@ export async function requestOpenAIDeviceCode(opts = {}) {
         });
     }
     return {
-        verificationUrl: `${issuer}/codex/device`,
+        verificationUrl: buildOpenAIDeviceVerificationUrl(issuer, userCode, opts.loginHint),
         userCode,
         deviceAuthId: body.device_auth_id,
         intervalSeconds: Number(body.interval ?? 5),
@@ -162,6 +173,14 @@ export async function loginOpenAIWithDeviceCode(opts) {
     const deviceCode = await requestOpenAIDeviceCode(opts);
     opts.onStageCompleted?.("device_code_request");
     opts.onDeviceCode?.(deviceCode);
+    // Best effort, and only after the URL and code have been printed: a failed
+    // open must never abort a sign-in the person can still finish by hand. The
+    // catch covers an injected opener too, since only the default one promises
+    // not to throw.
+    try {
+        await (opts.openBrowser ?? openInBrowser)(deviceCode.verificationUrl);
+    }
+    catch { /* the URL and code are already on screen */ }
     const tokens = await exchangeOpenAIDeviceCodeForTokens({ ...opts, deviceCode });
     return createOpenAIAccountRecord({
         id: opts.accountId,

package/dist/providers/xai/device-oauth.js

@@ -1,4 +1,5 @@
 import { createXaiAccountRecord, XAI_DEFAULT_SCOPES } from "./account-record.js";
+import { openInBrowser } from "../../utils/browser.js";
 const DEFAULT_ISSUER = "https://auth.x.ai";
 const DEFAULT_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
@@ -106,6 +107,14 @@ export async function exchangeXaiDeviceCodeForTokens(opts) {
 export async function loginXaiWithDeviceCode(opts) {
     const deviceCode = await requestXaiDeviceCode(opts);
     opts.onDeviceCode?.(deviceCode);
+    // Best effort, and only after the URL and code have been printed: a failed
+    // open must never abort a sign-in the person can still finish by hand. The
+    // catch covers an injected opener too, since only the default one promises
+    // not to throw.
+    try {
+        await (opts.openBrowser ?? openInBrowser)(deviceCode.verificationUrl);
+    }
+    catch { /* the URL and code are already on screen */ }
     const tokens = await exchangeXaiDeviceCodeForTokens({ ...opts, deviceCode });
     return createXaiAccountRecord({
         id: opts.accountId,

package/dist/proxy/account-info-cache.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { fetchAccountInfo } from "../providers/account-info-fetch.js";
 import { sanitizeAccountInfo } from "../providers/account-info.js";
+import { canReadProfile } from "../providers/anthropic/scopes.js";
 const TTL_MS = 5 * 60_000;
 const RETRY_MS = 60_000;
 const key = (account) => `${account.provider}:${account.id}`;
@@ -11,6 +12,10 @@ export class AccountInfoCache {
     accounts;
     entries = new Map();
     inFlight;
+    /** One upstream request per account at a time: a dashboard `refreshOne`
+     *  landing while the scheduled pass is on the same account joins it, so
+     *  no second request is sent and no older response can land last. */
+    fetching = new Map();
     pendingForced;
     controller = new AbortController();
     timer;
@@ -73,7 +78,9 @@ export class AccountInfoCache {
                 this.entries.set(id, entry);
             }
             const ttl = entry.info?.fetchStatus === "fresh" ? TTL_MS : RETRY_MS;
-            return account.enabled !== false && account.expiresAt > this.now()
+            // An inference-only Claude credential cannot read the profile endpoint;
+            // fetching would only ever produce a 403. Other providers are never gated.
+            return this.canFetch(account)
                 && (force || entry.attemptedAt === undefined || this.now() - entry.attemptedAt >= ttl);
         });
         const worker = async () => {
@@ -81,29 +88,71 @@ export class AccountInfoCache {
                 const account = queue.shift();
                 if (!account)
                     break;
-                // Re-check presence/credentials before network I/O after time spent queued.
-                const current = this.accounts().find(row => key(row) === key(account));
-                if (!current || current.enabled === false || current.expiresAt <= this.now() || fingerprint(current) !== fingerprint(account))
-                    continue;
-                const entry = this.entries.get(key(account));
-                entry.attemptedAt = this.now();
-                let info;
-                try {
-                    info = await this.fetchInfo(account, { signal: this.controller.signal, now: this.now });
-                }
-                catch { /* best effort */ }
-                const latest = this.accounts().find(row => key(row) === key(account));
-                if (this.controller.signal.aborted || !latest || fingerprint(latest) !== entry.fingerprint)
-                    continue;
-                const safe = sanitizeAccountInfo(info);
-                if (safe && (safe.fetchStatus === "fresh" || !entry.info))
-                    entry.info = safe;
-                else if (entry.info)
-                    entry.info = { ...entry.info, fetchStatus: "stale" };
+                await this.fetchOne(account);
             }
         };
         await Promise.all([worker(), worker()]);
     }
+    /**
+     * Refresh one account's metadata now, leaving every other account alone.
+     * The per-account refresh endpoint uses this: a whole-cache `refresh(true)`
+     * from one dashboard keypress would hit every provider's profile endpoint
+     * for the entire fleet. Unknown, disabled, expired and inference-only
+     * accounts are skipped exactly as the scheduled pass skips them.
+     */
+    async refreshOne(target) {
+        if (this.controller.signal.aborted)
+            return;
+        const account = this.accounts().find(row => row.id === target.id && row.provider === target.provider);
+        if (!account || !this.canFetch(account))
+            return;
+        const id = key(account);
+        const digest = fingerprint(account);
+        if (this.entries.get(id)?.fingerprint !== digest)
+            this.entries.set(id, { fingerprint: digest });
+        await this.fetchOne(account);
+    }
+    /** Eligibility shared by the scheduled pass and `refreshOne`. */
+    canFetch(account) {
+        // An inference-only Claude credential cannot read the profile endpoint;
+        // fetching would only ever produce a 403. Other providers are never gated.
+        return account.enabled !== false && account.expiresAt > this.now()
+            && (account.provider !== "anthropic_subscription" || canReadProfile(account.scopes));
+    }
+    fetchOne(account) {
+        const id = key(account);
+        const active = this.fetching.get(id);
+        if (active)
+            return active;
+        const operation = this.fetchOneUnguarded(account)
+            .finally(() => { if (this.fetching.get(id) === operation)
+            this.fetching.delete(id); });
+        this.fetching.set(id, operation);
+        return operation;
+    }
+    async fetchOneUnguarded(account) {
+        // Re-check presence/credentials before network I/O after time spent queued.
+        const current = this.accounts().find(row => key(row) === key(account));
+        if (!current || current.enabled === false || current.expiresAt <= this.now() || fingerprint(current) !== fingerprint(account))
+            return;
+        const entry = this.entries.get(key(account));
+        if (!entry)
+            return;
+        entry.attemptedAt = this.now();
+        let info;
+        try {
+            info = await this.fetchInfo(account, { signal: this.controller.signal, now: this.now });
+        }
+        catch { /* best effort */ }
+        const latest = this.accounts().find(row => key(row) === key(account));
+        if (this.controller.signal.aborted || !latest || fingerprint(latest) !== entry.fingerprint)
+            return;
+        const safe = sanitizeAccountInfo(info);
+        if (safe && (safe.fetchStatus === "fresh" || !entry.info))
+            entry.info = safe;
+        else if (entry.info)
+            entry.info = { ...entry.info, fetchStatus: "stale" };
+    }
     stop() {
         if (this.timer)
             clearInterval(this.timer);

package/dist/proxy/account-post-validation.js

@@ -0,0 +1,23 @@
+/**
+ * Field validation for POST /cc-router/accounts, pulled out of the route so
+ * the one behavioural exception is testable on its own: an Anthropic record
+ * may omit `refreshToken` (a `claude setup-token` credential has none), every
+ * other provider must send one.
+ */
+export function validateAccountPostBody(raw) {
+    const body = (raw && typeof raw === "object" ? raw : {});
+    const isAnthropic = body.provider === undefined || body.provider === "anthropic_subscription";
+    const required = isAnthropic
+        ? ["id", "accessToken", "expiresAt"]
+        : ["id", "accessToken", "refreshToken", "expiresAt"];
+    for (const k of required) {
+        if (body[k] === undefined || body[k] === null || body[k] === "") {
+            return { ok: false, status: 400, error: `Missing required field: ${k}` };
+        }
+    }
+    if (typeof body.id !== "string" || typeof body.accessToken !== "string" || typeof body.expiresAt !== "number"
+        || (body.refreshToken !== undefined && typeof body.refreshToken !== "string")) {
+        return { ok: false, status: 400, error: "Invalid field types on account record" };
+    }
+    return { ok: true, body: { ...body, replace: body.replace === true } };
+}

package/dist/proxy/account-refresh.js

@@ -0,0 +1,59 @@
+/**
+ * One account's worth of `POST /cc-router/refresh`: token if due, usage, then
+ * identity. Step failures are reported, never thrown — only an unexpected
+ * throw escapes so the route can answer 500. Single-flighted per id so a
+ * second press joins the running pass instead of stacking a second fetch.
+ */
+export function createAccountRefreshRunner(hooks) {
+    const now = hooks.now ?? Date.now;
+    const inFlight = new Map();
+    const attempt = async (fn, fallback) => {
+        try {
+            return await fn();
+        }
+        catch {
+            return fallback;
+        }
+    };
+    return id => {
+        const existing = inFlight.get(id);
+        if (existing)
+            return existing;
+        let run;
+        run = (async () => {
+            const started = now();
+            const anthropic = hooks.findAnthropic(id);
+            const openai = anthropic ? undefined : hooks.findOpenAI(id);
+            if (!anthropic && !openai)
+                return null;
+            let tokenRefreshed = null;
+            let usageRefreshed = false;
+            if (anthropic) {
+                if (hooks.anthropicTokenDue(anthropic)) {
+                    tokenRefreshed = await attempt(() => hooks.refreshAnthropicToken(anthropic), false);
+                }
+                usageRefreshed = (await attempt(() => hooks.refreshAnthropicUsage(anthropic), { ok: false })).ok;
+            }
+            else if (openai) {
+                if (hooks.openAITokenDue(openai)) {
+                    tokenRefreshed = await attempt(() => hooks.refreshOpenAIToken(openai), false);
+                }
+                usageRefreshed = (await attempt(() => hooks.refreshOpenAIUsage(openai), { ok: false })).ok;
+            }
+            await attempt(() => hooks.refreshIdentity({
+                id,
+                provider: anthropic ? "anthropic_subscription" : "openai_subscription",
+            }), undefined);
+            const result = { id, tokenRefreshed, usageRefreshed, durationMs: Math.max(0, now() - started) };
+            // A reporting failure must not turn a completed refresh into a 500.
+            try {
+                hooks.onComplete?.(result);
+            }
+            catch { /* best effort */ }
+            return result;
+        })().finally(() => { if (inFlight.get(id) === run)
+            inFlight.delete(id); });
+        inFlight.set(id, run);
+        return run;
+    };
+}

package/dist/proxy/account-replace.js

@@ -1,3 +1,4 @@
+import { withInheritedSettings } from "./types.js";
 import { reserveAccountForDeletion } from "./token-refresher.js";
 import { createOpenAIAccount } from "../providers/openai/account-state.js";
 /**
@@ -50,7 +51,9 @@ export async function replaceAnthropicAccountTransaction(options) {
         // old incarnation's in-flight count and cooldowns (the replacement must
         // not inherit a bench it never earned) and hands back a rollback that
         // restores every bit of it if the write below fails.
-        const { added, rollback } = options.pool.replaceAccount(options.record);
+        // Credentials come from the sign-in; enabled and the caps stay the
+        // operator's unless the record sets them explicitly.
+        const { added, rollback } = options.pool.replaceAccount(withInheritedSettings(options.record, previous));
         try {
             options.persist(options.pool.getAll());
         }
@@ -78,19 +81,16 @@ export function replaceOpenAIAccountTransaction(options) {
     if (index < 0)
         throw new Error(`Account "${options.record.id}" not found`);
     const previous = options.accounts[index];
+    const record = withInheritedSettings(options.record, previous);
     const account = createOpenAIAccount({
-        id: options.record.id,
+        id: record.id,
         provider: "openai_subscription",
-        accessToken: options.record.accessToken,
-        refreshToken: options.record.refreshToken,
-        expiresAt: options.record.expiresAt,
-        enabled: options.record.enabled !== false,
-        ...(options.record.sessionLimitPercent !== undefined
-            ? { sessionLimitPercent: options.record.sessionLimitPercent }
-            : {}),
-        ...(options.record.weeklyLimitPercent !== undefined
-            ? { weeklyLimitPercent: options.record.weeklyLimitPercent }
-            : {}),
+        accessToken: record.accessToken,
+        refreshToken: record.refreshToken,
+        expiresAt: record.expiresAt,
+        enabled: record.enabled !== false,
+        ...(record.sessionLimitPercent !== undefined ? { sessionLimitPercent: record.sessionLimitPercent } : {}),
+        ...(record.weeklyLimitPercent !== undefined ? { weeklyLimitPercent: record.weeklyLimitPercent } : {}),
     });
     // Splice in place so the replacement keeps the old account's position; the
     // array reference is the one the pool, router, and refresh loop all hold.

package/dist/proxy/server.js

@@ -5,7 +5,8 @@ import { createProxyMiddleware } from "http-proxy-middleware";
 import { ServerResponse } from "http";
 import { timingSafeEqual } from "crypto";
 import { TokenPool } from "./token-pool.js";
-import { needsRefresh, refreshAccountIfCurrent, refreshAccountsOnce, saveAccounts, startRefreshLoop } from "./token-refresher.js";
+import { expireTokenOnlyAccount, needsRefresh, refreshAccountIfCurrent, refreshAccountsOnce, saveAccounts, startRefreshLoop } from "./token-refresher.js";
+import { createAccountRefreshRunner } from "./account-refresh.js";
 import { loadAccounts, loadOpenAIAccounts, saveOpenAIAccountsToPath, accountsFileExists, readAccountsFromPath, readConfig, writeConfig, getAutoFailoverEnabled, getProxyRequestTimeoutMs, migrateLegacyAccountProviders, setProviderAccountsEnabled, upsertAccountRecord, removeAccountRecordById } from "../config/manager.js";
 import { createRefreshAllRunner, describeRefreshAll, refreshAllAccounts } from "./pool-refresh.js";
 import { checkForUpdate, performUpdate, restartSelf, printUpdateBanner, getCurrentVersion } from "../utils/self-update.js";
@@ -18,9 +19,11 @@ import { mountAnthropicMessagesRoute, withOAuthBeta } from "./anthropic-messages
 import { PROXY_PORT, LITELLM_URL, ACCOUNTS_PATH } from "../config/paths.js";
 import { loadGrokHealthSnapshots } from "../providers/xai/overview.js";
 import { writePid, removePid, managesPidFile } from "../daemon/pid.js";
+import { isTokenOnly } from "./types.js";
 import { applyOpenAIAccountPatch, validateAccountPatchBody } from "./account-patch.js";
+import { validateAccountPostBody } from "./account-post-validation.js";
 import { AccountRenameConflictError, renameAccountTransaction } from "./account-rename.js";
-import { hasPendingCredentialWrite, markOpenAICredentialsPersisted, prepareOpenAIAccountForRequest, refreshOpenAIAccountsOnce, refreshAndPersistOpenAIAccount, startOpenAIRefreshLoop, } from "../providers/openai/token-refresher.js";
+import { hasPendingCredentialWrite, markOpenAICredentialsPersisted, needsOpenAIRefresh, prepareOpenAIAccountForRequest, refreshOpenAIAccountsOnce, refreshAndPersistOpenAIAccount, startOpenAIRefreshLoop, } from "../providers/openai/token-refresher.js";
 import { createOpenAIAccount } from "../providers/openai/account-state.js";
 import { OpenAITokenPool } from "../providers/openai/token-pool.js";
 import { DEFAULT_CODEX_LIMIT_ID } from "../providers/openai/usage.js";
@@ -70,6 +73,7 @@ export function createOperationalStatus(opts) {
             accounts: "/cc-router/accounts",
             allowance: "/cc-router/allowance",
             refresh: "/cc-router/refresh",
+            accountRefresh: "/cc-router/accounts/:id/refresh",
             messages: "/v1/messages",
             responses: "/v1/responses",
             models: "/v1/models",
@@ -126,6 +130,7 @@ function publicAnthropicAccountView(a, metrics) {
         // of `authState === "quarantined"`.
         healthy: a.enabled !== false && a.healthy && a.authExpired !== true,
         ...(a.authExpired ? { authExpired: true } : {}),
+        ...(a.tokens.refreshToken ? {} : { tokenOnly: true }),
         busy: a.busy || metrics.coolingDown,
         cooldownUntilMs: metrics.cooldownUntilMs ?? 0,
         globalCooldownUntilMs: metrics.globalCooldownUntilMs ?? 0,
@@ -464,6 +469,7 @@ export async function startServer(opts = {}) {
         ...pool.getAll().map(account => ({
             id: account.id, provider: "anthropic_subscription",
             accessToken: account.tokens.accessToken, expiresAt: account.tokens.expiresAt, enabled: account.enabled,
+            scopes: account.tokens.scopes,
         })),
         ...openAIAccounts.map(account => ({
             id: account.id, provider: "openai_subscription",
@@ -659,6 +665,60 @@ export async function startServer(opts = {}) {
         captureReset: account => openAIPool.captureUsageReset(account),
         refresh: account => openAIUsageRefresher.refreshAfterCurrent(account),
     }));
+    // ─── Per-account refresh (authenticated) ──────────────────────────────────
+    // The whole-pool reload above, narrowed to one row: the operator who just
+    // re-authenticated a single account should not have to pay for every other
+    // account's upstream calls to see the result.
+    const runAccountRefresh = createAccountRefreshRunner({
+        findAnthropic: id => pool.findById(id),
+        findOpenAI: id => openAIAccounts.find(account => account.id === id),
+        // A long-lived `claude setup-token` credential has nothing to POST, so
+        // `needsRefresh` excludes it. Past its expiry it still needs the flip to
+        // `authExpired`, which is what the refresh step below does for it — and
+        // it stays "due" afterwards so every press reports the same unrefreshable
+        // token rather than a first `false` and a silent `null` after that.
+        anthropicTokenDue: account => needsRefresh(account)
+            || (isTokenOnly(account.tokens) && account.tokens.expiresAt <= Date.now()),
+        refreshAnthropicToken: async (account) => {
+            if (isTokenOnly(account.tokens)) {
+                // Nothing to refresh — mark it re-auth required once and persist, so
+                // the dashboard sees the same terminal state a restart would derive.
+                if (expireTokenOnlyAccount(account))
+                    persistAnthropicAccounts(pool.getAll());
+                return false;
+            }
+            return refreshAccountIfCurrent(account, pool, { persist: persistAnthropicAccounts });
+        },
+        refreshAnthropicUsage: account => usageRefresher.refreshNow(account),
+        openAITokenDue: account => needsOpenAIRefresh(account),
+        refreshOpenAIToken: account => refreshAndPersistOpenAIAccount(account, openAIAccounts, persistOpenAIAccounts),
+        refreshOpenAIUsage: account => openAIUsageRefresher.refreshNow(account),
+        refreshIdentity: target => accountInfoCache.refreshOne(target),
+        // Logged from here, not from the route: concurrent requests for one id
+        // share a single pass, and a per-request write would record it twice.
+        onComplete: result => stats.addLog({
+            ts: Date.now(), accountId: result.id, model: "-", type: "refresh",
+            details: `manual refresh ${result.id} — ${result.usageRefreshed ? "usage fresh" : "usage fetch failed"}${result.tokenRefreshed === false ? ", token refresh failed" : ""}`,
+        }),
+    });
+    accountsRouter.post("/:id/refresh", async (req, res) => {
+        const id = req.params.id;
+        let result;
+        try {
+            result = await runAccountRefresh(id);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logError("refresh", 0, `manual refresh of ${id} failed: ${message}`);
+            res.status(500).json({ error: `Refresh failed: ${message}` });
+            return;
+        }
+        if (!result) {
+            res.status(404).json({ error: `Account "${id}" not found` });
+            return;
+        }
+        res.json({ refresh: result });
+    });
     // Shape returned to clients — NEVER includes access/refresh tokens.
     accountsRouter.get("/", (_req, res) => {
         const resolveRoutingMetrics = createRoutingMetricsResolver();
@@ -905,24 +965,16 @@ export async function startServer(opts = {}) {
         });
     });
     accountsRouter.post("/", async (req, res) => {
-        const body = (req.body ?? {});
         // Opt-in upsert. Re-authenticating an existing id is the only recovery for
         // a terminally rejected refresh token, and refusing it here discarded the
         // OAuth login the operator had just completed. It stays opt-in so an
         // accidental id collision from any other API client still gets its 409.
-        const wantsReplace = req.body?.replace === true;
-        const required = ["id", "accessToken", "refreshToken", "expiresAt"];
-        for (const k of required) {
-            if (body[k] === undefined || body[k] === null || body[k] === "") {
-                res.status(400).json({ error: `Missing required field: ${k}` });
-                return;
-            }
-        }
-        if (typeof body.id !== "string" || typeof body.accessToken !== "string" ||
-            typeof body.refreshToken !== "string" || typeof body.expiresAt !== "number") {
-            res.status(400).json({ error: "Invalid field types on account record" });
+        const validated = validateAccountPostBody(req.body);
+        if (!validated.ok) {
+            res.status(validated.status).json({ error: validated.error });
             return;
         }
+        const { replace: wantsReplace, ...body } = validated.body;
         // Same cap validation the PATCH endpoint applies, so the two writers of
         // these fields agree instead of POST silently clamping a bad value to 100.
         const capValidation = validateAccountPatchBody({

package/dist/proxy/token-refresher.js

@@ -1,3 +1,4 @@
+import { isTokenOnly } from "./types.js";
 import { writeAnthropicAccountsPreservingOtherProviders, serialize } from "../config/manager.js";
 import { logRefresh } from "./logger.js";
 import { stats } from "./stats.js";
@@ -56,11 +57,33 @@ export function needsRefresh(account) {
     // it out of the loop so it is not POSTed to the OAuth endpoint forever.
     if (account.authExpired)
         return false;
+    // A setup-token credential has nothing to POST; expiry is handled by
+    // expireTokenOnlyAccount instead of the refresh loop.
+    if (isTokenOnly(account.tokens))
+        return false;
     return ownedRefreshLocks.has(account) ||
         pendingDurability.has(account) ||
         (account.tokens.expiresAt - Date.now()) < REFRESH_BUFFER_MS;
 }
+/**
+ * A long-lived token cannot be refreshed, so passing its expiry is the same
+ * terminal state as a rejected refresh token: only a new sign-in restores it.
+ * Returns true only on the tick that flips the account, so the caller can
+ * persist and log exactly once.
+ */
+export function expireTokenOnlyAccount(account, now = Date.now()) {
+    if (!isTokenOnly(account.tokens) || account.authExpired || account.tokens.expiresAt > now)
+        return false;
+    account.authExpired = true;
+    account.healthy = false;
+    console.error(`  Account ${account.id} needs re-authentication: its long-lived token has expired. Run: cc-router accounts reauth ${account.id}`);
+    return true;
+}
 export async function refreshAccountToken(account) {
+    // Nothing to POST: a setup-token credential has no refresh token, so the
+    // OAuth token endpoint must never be contacted for it.
+    if (isTokenOnly(account.tokens))
+        return false;
     // A deletion reservation rejects every new caller, including callers that
     // would otherwise attach themselves to already-running raw refresh work.
     if (isReservedForDeletion(account))
@@ -162,10 +185,13 @@ export function refreshAccountIfCurrent(account, pool, options = {}) {
     return operation;
 }
 async function _doRefresh(account, span) {
+    const refreshToken = account.tokens.refreshToken;
+    if (!refreshToken)
+        return false;
     try {
         const body = new URLSearchParams({
             grant_type: "refresh_token",
-            refresh_token: account.tokens.refreshToken,
+            refresh_token: refreshToken,
             client_id: CLAUDE_CODE_CLIENT_ID,
         });
         const res = await fetch(TOKEN_ENDPOINT, {
@@ -231,6 +257,15 @@ export async function refreshAccountsOnce(accounts, options = {}) {
         getAll: () => accounts,
     };
     for (const account of [...accounts]) {
+        if (expireTokenOnlyAccount(account)) {
+            try {
+                options.persist?.(accounts);
+            }
+            catch (error) {
+                (options.onError ?? console.error)(error);
+            }
+            continue;
+        }
         if (!needsRefresh(account))
             continue;
         try {

package/dist/proxy/types.js

@@ -1,3 +1,22 @@
+/** A credential with no refresh token can only be replaced, never refreshed. */
+export function isTokenOnly(tokens) {
+    return !tokens.refreshToken;
+}
+/**
+ * Fill the operator-controlled settings a record omits from the account it
+ * replaces. Re-authentication hands over credentials only; without this a
+ * disabled account came back enabled and custom caps reset to 100.
+ */
+export function withInheritedSettings(record, previous) {
+    return {
+        ...record,
+        ...(record.enabled === undefined && previous.enabled !== undefined ? { enabled: previous.enabled } : {}),
+        ...(record.sessionLimitPercent === undefined && previous.sessionLimitPercent !== undefined
+            ? { sessionLimitPercent: previous.sessionLimitPercent } : {}),
+        ...(record.weeklyLimitPercent === undefined && previous.weeklyLimitPercent !== undefined
+            ? { weeklyLimitPercent: previous.weeklyLimitPercent } : {}),
+    };
+}
 export const DEFAULT_RATE_LIMITS = {
     status: "unknown",
     fiveHourUtil: 0,

package/dist/telemetry/contracts.js

@@ -17,6 +17,8 @@ export const SETUP_METHODS = [
     "claude_credentials_file",
     "manual_token",
     "device_oauth",
+    "claude_cli_login",
+    "claude_setup_token",
 ];
 export const SETUP_STAGES = [
     "attempt_start",