@timo972/cc-router 0.13.0-rc.6 → 0.13.1

package/CHANGELOG.md

@@ -8,23 +8,46 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-### Changed
+---
+
+## [0.13.1] — 2026-11-06
+
+### Added
+
+- `POST /cc-router/sessions/resolve` returns the account that currently owns a
+  caller-known session (`{"provider":"anthropic"|"openai","sessionId":…}`),
+  with its provider and `lastSeenAt`, or `404` for an unknown or expired
+  binding. It looks up exactly one session: it does not list the affinity
+  table, echo the session ID or refresh the binding TTL, and it uses the
+  router's normal authentication. See
+  [session routing](docs/session-routing.md#resolving-a-caller-known-session-binding).
+
+### Fixed
+
+- The background daemon and the OS service no longer die on startup when npm
+  has a newer version. They run `start --foreground` with stdin ignored, so
+  the "Update now?" prompt could not be answered and the process exited before
+  it bound the port. Only an interactive terminal start offers the update now.
+- The proxy now binds both the IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback
+  addresses by default, instead of IPv4 only. On Windows `localhost` usually
+  resolves to `::1` first, so a client (Claude Code, the CLI, the mitmproxy
+  addon) reaching the IPv6 loopback while the server listened only on IPv4
+  got no response and every API/chat request hung until it timed out. The
+  second bind never blocks startup: hosts without an IPv6 stack skip it, and
+  a busy `[::1]:<port>` (for example a stale process) is retried every 2s
+  until it binds, instead of leaving `localhost` clients hanging for the
+  life of the process. An explicit `HOST`, including `HOST=127.0.0.1`, is
+  honoured verbatim, so the refusal message for a non-loopback `HOST` without
+  a proxy secret now says to unset `HOST`.
+- The Windows login service now sets its environment without trailing
+  spaces. `set VAR=value && …` stored `"1 "` and `"0.0.0.0 "`, so the service
+  was never recognised as the service (no PID file, wrong runtime mode in
+  telemetry), and in server mode it failed to bind (`ENOTFOUND`). The next
+  `cc-router start` rewrites the registry entry.
+
+---
 
-- `cc-router usage` charts and its daily grid switch between tokens and
-  estimated API spend (`s`) and narrow to input or output (`i`); every bucket,
-  model series and day in the report now carries frozen-rate USD per token
-  category. The model view (`l`) lists input, output, cache and spend per
-  model. Input, output and cache figures share one colour each across the
-  header, the cost line and the model view.
-- The usage view fills the terminal like `cc-router status`, is indented one
-  column, and quits on `Esc`. Chart columns scale to the available width and
-  the chart shares the daily grid's right edge; the axis names its unit
-  instead of running day numbers together. Warnings sit below the grid.
-- Subscription cost and net savings are no longer displayed in the usage
-  dashboard or the plain-text summary; the API-equivalent value stands alone,
-  broken down by input, output and cache. Both remain in `--json` output and
-  `usage subscription` still records costs. A client talking to an older
-  router shows the per-category spend as unavailable rather than zero.
+## [0.13.0] — 2026-10-18
 
 ### ⚠️ Breaking
 
@@ -38,6 +61,17 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- `cc-router usage` records token usage persistently, across restarts, and
+  shows it per provider and model as stacked bars and a daily activity grid
+  for a day, week, month or year. Charts and grid switch between tokens and
+  estimated API-equivalent spend (`s`) and narrow to input or output (`i`);
+  the model view (`l`) lists input, output, cache and spend per model. Spend
+  uses frozen per-category API rates, and missing prices are marked
+  incomplete. The view fills the terminal and quits on `Esc`. `--json` prints
+  the report without the terminal UI, and `usage subscription set|end|list`
+  records effective-dated monthly subscription costs, which appear in the
+  `--json` report. See the
+  [usage reference](docs/cli-reference.md#persistent-token-usage-and-savings).
 - `cc-router accounts login claude` drives `claude auth login --claudeai`
   (with `--email` prefill) and imports the new credentials; `--long-lived`
   drives `claude setup-token` for a one-year, refresh-less token.
@@ -903,6 +937,9 @@ cache-aware session routing and a round of security hardening.
 - `http-proxy-middleware` 3.0.5 → 3.0.7 for GHSA-gcq2-9pq2-cxqm (high). The
   affected APIs are not used here.
 
+[Unreleased]: https://github.com/Timo972/cc-router/compare/v0.13.1...HEAD
+[0.13.1]: https://github.com/Timo972/cc-router/releases/tag/v0.13.1
+[0.13.0]: https://github.com/Timo972/cc-router/releases/tag/v0.13.0
 [0.12.4]: https://github.com/Timo972/cc-router/releases/tag/v0.12.4
 [0.12.3]: https://github.com/Timo972/cc-router/releases/tag/v0.12.3
 [0.12.2]: https://github.com/Timo972/cc-router/releases/tag/v0.12.2

package/dist/cli/cmd-start.js

@@ -5,6 +5,7 @@ import { accountsFileExists, readConfig, writeConfig, generateProxySecret, } fro
 import { writeClaudeSettings } from "../utils/claude-config.js";
 import { checkForUpdate, performUpdate, PKG_NAME } from "../utils/self-update.js";
 import { launchDaemon, waitForHealth } from "../daemon/launcher.js";
+import { managesPidFile } from "../daemon/pid.js";
 import { installService } from "../daemon/service.js";
 import { getLocalIPs } from "../utils/network.js";
 /**
@@ -203,7 +204,20 @@ async function ensureClaudeCodeConfigured(prefs, cfg) {
     }
 }
 // ─── Update check ────────────────────────────────────────────────────────────
+/**
+ * Whether this start may ask "Update now?". The background daemon and the OS
+ * service run `start --foreground` with stdin ignored, so the prompt cannot be
+ * answered: inquirer rejects on the closed stdin and the process exits before
+ * it binds, which kept the proxy down whenever npm had a newer version. Only an
+ * interactive terminal start offers the update; the managed instance still
+ * logs the notify-only update notice from the server.
+ */
+export function canPromptForUpdate(env = process.env, stdinIsTTY = process.stdin.isTTY) {
+    return stdinIsTTY === true && !managesPidFile(env);
+}
 async function maybeUpdate() {
+    if (!canPromptForUpdate())
+        return;
     let check;
     try {
         check = await checkForUpdate(true); // force fresh check, skip disk cache

package/dist/daemon/service.js

@@ -273,10 +273,18 @@ async function uninstallLinux() {
 function buildWindowsCommand() {
     return `"${process.execPath}" "${CLI_ENTRY}" start --foreground`;
 }
+/**
+ * The Run-key command that starts the proxy at login. `set VAR=value && …`
+ * would store the space before `&&` in the value ("1 ", "0.0.0.0 "): the
+ * service then never recognised CC_ROUTER_SERVICE=1 (no PID file) and server
+ * mode failed to bind with ENOTFOUND. So `&&` follows the value directly.
+ */
+export function buildWindowsAutostartCommand(serverMode, command = buildWindowsCommand()) {
+    const env = serverMode ? "set HOST=0.0.0.0&& set CC_ROUTER_SERVICE=1&& " : "set CC_ROUTER_SERVICE=1&& ";
+    return `cmd /c "${env}${command}"`;
+}
 async function installWindows(serverMode) {
-    const cmd = serverMode
-        ? `cmd /c "set HOST=0.0.0.0 && set CC_ROUTER_SERVICE=1 && ${buildWindowsCommand()}"`
-        : `cmd /c "set CC_ROUTER_SERVICE=1 && ${buildWindowsCommand()}"`;
+    const cmd = buildWindowsAutostartCommand(serverMode);
     try {
         await execFileAsync("reg", [
             "add", WINDOWS_REG_KEY,

package/dist/proxy/server.js

@@ -38,6 +38,7 @@ import { mountMessagesCrossProviderRoute } from "./messages-cross-route.js";
 import { mountModelsRoute } from "./models-server.js";
 import chalk from "chalk";
 import { SessionRouter } from "./session-router.js";
+import { registerSessionResolveRoute } from "./session-resolve.js";
 import { createAnthropicProxy } from "./anthropic-proxy.js";
 import { AnthropicUsageRefresher } from "../providers/anthropic/usage-refresher.js";
 import { OpenAIUsageRefresher } from "../providers/openai/usage-fetch.js";
@@ -54,6 +55,8 @@ import { AccountInfoCache } from "./account-info-cache.js";
 import { loadXaiAccounts } from "../config/manager.js";
 /** Upper bound on how long a shutdown may wait for telemetry to drain. */
 const TELEMETRY_SHUTDOWN_DEADLINE_MS = 1_000;
+/** How often a busy secondary loopback bind ([::1]:<port>) is retried. */
+const SECONDARY_BIND_RETRY_MS = 2_000;
 const zeroRoutingMetrics = () => ({
     inFlightRequests: 0,
     activeSessions: 0,
@@ -666,6 +669,10 @@ export async function startServer(opts = {}) {
         stats.addLog({ ts: Date.now(), accountId: "proxy", model: "-", type: "refresh", details });
         res.json({ refresh: summary });
     });
+    registerSessionResolveRoute(app, {
+        anthropicRouter: sessionRouter,
+        openAIRouter,
+    });
     // ─── Account management endpoints (authenticated) ─────────────────────────
     // These are mounted BEFORE the /v1/* proxy middleware so they don't get
     // forwarded to Anthropic. express.json() is scoped to this sub-router so
@@ -1666,25 +1673,85 @@ export async function startServer(opts = {}) {
             `  anyone who can reach it use your Claude/OpenAI accounts.\n` +
             `  Fix: run 'cc-router start' and set a password when asked, or add a\n` +
             `  "proxySecret" to ~/.cc-router/config.json. To bind localhost only,\n` +
-            `  unset HOST (or set HOST=127.0.0.1).\n`));
+            `  unset HOST.\n`));
         process.exit(1);
     }
-    const server = app.listen(port, host);
-    await new Promise((resolve, reject) => {
-        const onError = (error) => {
-            server.off("listening", onListening);
-            usageRefresher.stop();
-            openAIUsageRefresher.stop();
-            accountInfoCache.stop();
-            usageRuntime.close();
-            reject(error);
-        };
-        const onListening = () => {
-            server.off("error", onError);
-            resolve();
-        };
-        server.once("error", onError);
-        server.once("listening", onListening);
+    // Default loopback must answer on BOTH IPv4 and IPv6 loopback. On Windows
+    // (and anywhere getaddrinfo lists ::1 before 127.0.0.1) a client resolving
+    // "localhost" reaches ::1 first; if we listen only on 127.0.0.1 that
+    // connection is never accepted and the client hangs until it times out —
+    // which is exactly why every Claude request "times out" once the proxy is
+    // running. Binding both loopback addresses keeps us localhost-only (unlike
+    // :: / 0.0.0.0) while accepting whichever family the client picks. An
+    // explicit HOST, including HOST=127.0.0.1, is honoured verbatim.
+    const bindAddresses = process.env["HOST"] === undefined ? ["127.0.0.1", "::1"] : [host];
+    const listenOn = (addr, p) => new Promise((resolve, reject) => {
+        const s = app.listen(p, addr);
+        const onError = (error) => { s.off("listening", onListening); reject(error); };
+        const onListening = () => { s.off("error", onError); resolve(s); };
+        s.once("error", onError);
+        s.once("listening", onListening);
+    });
+    // The primary bind (IPv4 loopback, or the explicit HOST) must succeed.
+    let server;
+    try {
+        server = await listenOn(bindAddresses[0], port);
+    }
+    catch (error) {
+        usageRefresher.stop();
+        openAIUsageRefresher.stop();
+        accountInfoCache.stop();
+        usageRuntime.close();
+        throw error;
+    }
+    // Secondary loopback binds must not block startup. A host without IPv6
+    // (EAFNOSUPPORT / EADDRNOTAVAIL) skips them for good. Anything else, usually
+    // EADDRINUSE from a stale process still holding [::1]:<port>, is retried in
+    // the background: giving up would leave `localhost` clients on Windows
+    // hanging for the whole life of this process. Reuse the port the primary
+    // actually bound so `port: 0` still pairs both families.
+    const boundPort = server.address()?.port ?? port;
+    const extraServers = [];
+    const retryTimers = new Set();
+    let primaryClosed = false;
+    const bindSecondary = async (addr, attempt) => {
+        if (primaryClosed)
+            return;
+        try {
+            const s = await listenOn(addr, boundPort);
+            if (primaryClosed) {
+                s.close();
+                return;
+            }
+            extraServers.push(s);
+            if (attempt > 0)
+                console.log(chalk.gray(`  (loopback ${addr}:${boundPort} is bound now)`));
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "EAFNOSUPPORT" || code === "EADDRNOTAVAIL") {
+                console.log(chalk.gray(`  (note: loopback ${addr} is not available on this host, skipped)`));
+                return;
+            }
+            if (attempt === 0) {
+                console.log(chalk.yellow(`  ⚠ loopback ${addr}:${boundPort} is busy (${code ?? error.message}), retrying every ${SECONDARY_BIND_RETRY_MS / 1000}s`));
+            }
+            const timer = setTimeout(() => {
+                retryTimers.delete(timer);
+                void bindSecondary(addr, attempt + 1);
+            }, SECONDARY_BIND_RETRY_MS);
+            timer.unref();
+            retryTimers.add(timer);
+        }
+    };
+    for (const addr of bindAddresses.slice(1))
+        await bindSecondary(addr, 0);
+    server.once("close", () => {
+        primaryClosed = true;
+        for (const timer of retryTimers)
+            clearTimeout(timer);
+        for (const s of extraServers)
+            s.close();
     });
     process.on("SIGTERM", () => { void shutdown(); });
     process.on("SIGINT", () => { void shutdown(); });

package/dist/proxy/session-resolve.js

@@ -0,0 +1,68 @@
+import express from "express";
+import { normalizeSessionId } from "./session-router.js";
+export function parseSessionResolveRequest(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        return invalidRequest();
+    }
+    const keys = Object.keys(body);
+    if (keys.length !== 2 || !keys.includes("provider") || !keys.includes("sessionId")) {
+        return invalidRequest();
+    }
+    const candidate = body;
+    if (candidate.provider !== "anthropic" && candidate.provider !== "openai") {
+        return invalidRequest();
+    }
+    const sessionId = normalizeSessionId(candidate.sessionId);
+    if (!sessionId)
+        return invalidRequest();
+    return {
+        ok: true,
+        request: {
+            provider: candidate.provider,
+            sessionId,
+        },
+    };
+}
+export function resolveSessionBinding(request, routers) {
+    const router = request.provider === "anthropic"
+        ? routers.anthropicRouter
+        : routers.openAIRouter;
+    const binding = router.resolve(request.sessionId);
+    if (!binding) {
+        return {
+            status: 404,
+            body: { error: "Session binding not found" },
+        };
+    }
+    return {
+        status: 200,
+        body: {
+            accountId: binding.accountId,
+            provider: request.provider,
+            lastSeenAt: binding.lastSeenAt,
+        },
+    };
+}
+export function registerSessionResolveRoute(app, routers) {
+    const route = express.Router();
+    route.use(express.json({ limit: "1kb", strict: true }));
+    route.post("/", (req, res) => {
+        const parsed = parseSessionResolveRequest(req.body);
+        if (!parsed.ok) {
+            res.status(400).json({ error: parsed.error });
+            return;
+        }
+        const result = resolveSessionBinding(parsed.request, routers);
+        res.status(result.status).json(result.body);
+    });
+    route.use((_error, _req, res, _next) => {
+        res.status(400).json({ error: "Invalid session resolve request" });
+    });
+    app.use("/cc-router/sessions/resolve", route);
+}
+function invalidRequest() {
+    return {
+        ok: false,
+        error: "Invalid session resolve request",
+    };
+}

package/dist/proxy/session-router.js

@@ -63,6 +63,20 @@ export class SessionRouter {
         const binding = this.insertBinding(sessionId, lease.account.id, now);
         return this.wrapScoped(lease, existing ? "failover" : "new-session", sessionId, binding.generation, modelFamily);
     }
+    resolve(sessionHeader) {
+        const sessionId = normalizeSessionId(sessionHeader);
+        if (!sessionId)
+            return undefined;
+        const now = this.now();
+        this.sweepExpiredBindings(now);
+        const binding = this.bindings.get(sessionId);
+        if (!binding)
+            return undefined;
+        return {
+            accountId: binding.accountId,
+            lastSeenAt: binding.lastSeen,
+        };
+    }
     /**
      * Remove a binding only if it still belongs to the expected account. This
      * protects a new failover binding from a late response on the old account.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timo972/cc-router",
-  "version": "0.13.0-rc.6",
+  "version": "0.13.1",
   "description": "Cache-aware session router for Claude Max OAuth tokens — use multiple Claude Max accounts with Claude Code",
   "type": "module",
   "bin": {