@timo972/cc-router 0.9.0 → 0.10.0-rc.0

package/dist/providers/openai/usage.js

@@ -0,0 +1,160 @@
+// Codex rate-limit reporting is bucket-based: a default account-level "codex"
+// bucket plus optional named metered buckets, each published as an
+// `x-<limit>-{primary,secondary}-*` header family. Discovery mirrors the
+// Codex CLI (codex-rs/codex-api/src/rate_limits.rs): scan header names for
+// the `-primary-used-percent` suffix.
+export const DEFAULT_CODEX_LIMIT_ID = "codex";
+const USED_PERCENT_SUFFIX = "-primary-used-percent";
+const MS_TIMESTAMP_THRESHOLD = 100_000_000_000;
+/** Strips ASCII control characters (including ESC) from upstream-controlled header text. */
+const CONTROL_CHAR_PATTERN = /[\x00-\x1f\x7f]/g;
+/**
+ * Reject a parsed reset timestamp (or clamp a window length) implausibly far
+ * in the future rather than trust it verbatim. Matches the same 8-day trust
+ * horizon already enforced downstream by `MAX_TRUSTED_RATE_LIMIT_RESET_MS`
+ * (token-pool.ts) and `MAX_RATE_LIMIT_COOLDOWN_MS` (lease-lifecycle.ts) — a
+ * malformed or malicious header must not be able to park an account in a
+ * cooldown/exhausted state for months. A reset beyond the horizon is treated
+ * as unknown (0), the same sentinel already used for "no usable reset value".
+ */
+export const MAX_TRUSTED_RATE_LIMIT_HORIZON_SEC = 8 * 24 * 60 * 60;
+const MAX_TRUSTED_WINDOW_MINUTES = MAX_TRUSTED_RATE_LIMIT_HORIZON_SEC / 60;
+export function createEmptyCodexRateLimits() {
+    return { status: "ok", buckets: new Map(), lastUpdated: 0 };
+}
+export function normalizeCodexLimitId(name) {
+    return name.trim().toLowerCase().replace(/-/g, "_");
+}
+export function headersToRecord(headers) {
+    const record = {};
+    headers.forEach((value, key) => {
+        record[key.toLowerCase()] = value;
+    });
+    return record;
+}
+function headerString(headers, name) {
+    const value = headers[name];
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
+function headerNumber(headers, name) {
+    const raw = headerString(headers, name)?.trim();
+    if (raw === undefined || raw === "")
+        return undefined;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function headerBool(headers, name) {
+    const raw = headerString(headers, name)?.trim().toLowerCase();
+    if (raw === "true" || raw === "1")
+        return true;
+    if (raw === "false" || raw === "0")
+        return false;
+    return undefined;
+}
+function parseResetAtSeconds(headers, prefix, kind, nowMs) {
+    const nowSec = Math.floor(nowMs / 1000);
+    const horizonSec = nowSec + MAX_TRUSTED_RATE_LIMIT_HORIZON_SEC;
+    const absolute = headerNumber(headers, `${prefix}-${kind}-reset-at`);
+    if (absolute !== undefined && absolute > 0) {
+        const seconds = absolute > MS_TIMESTAMP_THRESHOLD ? Math.floor(absolute / 1000) : Math.floor(absolute);
+        if (seconds > nowSec && seconds <= horizonSec)
+            return seconds;
+        // The absolute value is unusable (already past, or implausibly far out), so
+        // fall through to the relative header rather than reporting "no reset
+        // known". Giving up here would leave an exhausted window with no
+        // trustworthy expiry — an indefinite block the pool can only clear via the
+        // multi-hour staleness sweep — while the upstream had just advertised a
+        // reset seconds or minutes away.
+    }
+    const relative = headerNumber(headers, `${prefix}-${kind}-reset-after-seconds`);
+    if (relative !== undefined && relative > 0) {
+        const candidate = nowSec + Math.floor(relative);
+        return candidate <= horizonSec ? candidate : 0;
+    }
+    return 0;
+}
+function parseWindow(headers, prefix, kind, nowMs) {
+    const percent = headerNumber(headers, `${prefix}-${kind}-used-percent`);
+    if (percent === undefined)
+        return undefined;
+    const windowMinutes = headerNumber(headers, `${prefix}-${kind}-window-minutes`);
+    return {
+        utilization: Math.max(0, Math.min(1, percent / 100)),
+        resetAt: parseResetAtSeconds(headers, prefix, kind, nowMs),
+        windowMinutes: windowMinutes !== undefined && windowMinutes > 0
+            ? Math.min(Math.floor(windowMinutes), MAX_TRUSTED_WINDOW_MINUTES)
+            : 0,
+    };
+}
+function parseCredits(headers) {
+    const hasCredits = headerBool(headers, "x-codex-credits-has-credits");
+    const unlimited = headerBool(headers, "x-codex-credits-unlimited");
+    if (hasCredits === undefined && unlimited === undefined)
+        return undefined;
+    const balance = headerString(headers, "x-codex-credits-balance")
+        ?.replace(CONTROL_CHAR_PATTERN, "")
+        .trim();
+    return {
+        hasCredits: hasCredits === true,
+        unlimited: unlimited === true,
+        ...(balance ? { balance: balance.slice(0, 32) } : {}),
+    };
+}
+export function parseCodexRateLimits(headers, nowMs) {
+    const limitIds = new Set([DEFAULT_CODEX_LIMIT_ID]);
+    for (const name of Object.keys(headers)) {
+        const lower = name.toLowerCase();
+        if (!lower.startsWith("x-") || !lower.endsWith(USED_PERCENT_SUFFIX))
+            continue;
+        const limitId = normalizeCodexLimitId(lower.slice(2, -USED_PERCENT_SUFFIX.length));
+        if (limitId)
+            limitIds.add(limitId);
+    }
+    const buckets = [];
+    for (const limitId of limitIds) {
+        const prefix = `x-${limitId.replace(/_/g, "-")}`;
+        const primary = parseWindow(headers, prefix, "primary", nowMs);
+        const secondary = parseWindow(headers, prefix, "secondary", nowMs);
+        if (!primary && !secondary)
+            continue;
+        const limitName = headerString(headers, `${prefix}-limit-name`)?.trim();
+        buckets.push({
+            limitId,
+            ...(limitName ? { limitName: limitName.slice(0, 64) } : {}),
+            ...(primary ? { primary } : {}),
+            ...(secondary ? { secondary } : {}),
+        });
+    }
+    const credits = parseCredits(headers);
+    return { buckets, ...(credits ? { credits } : {}) };
+}
+export function resolveActiveLimit(headers) {
+    const raw = headerString(headers, "x-codex-active-limit")?.trim();
+    if (!raw)
+        return undefined;
+    const normalized = normalizeCodexLimitId(raw);
+    return /^[a-z0-9_]{1,64}$/.test(normalized) ? normalized : undefined;
+}
+export function decodeOpenAIPlan(accessToken) {
+    try {
+        const [, payload] = accessToken.split(".");
+        if (!payload)
+            return undefined;
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+        const auth = claims["https://api.openai.com/auth"];
+        if (typeof auth !== "object" || auth === null)
+            return undefined;
+        const plan = auth.chatgpt_plan_type;
+        if (typeof plan !== "string")
+            return undefined;
+        const normalized = plan.trim().toLowerCase().slice(0, 32);
+        return /^[a-z0-9_-]+$/.test(normalized) ? normalized : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/proxy/account-add.js

@@ -1,21 +1,24 @@
+import { createOpenAIAccount } from "../providers/openai/account-state.js";
 /**
  * Append an OpenAI subscription account to the running pool and persist it.
  *
- * The account is pushed IN PLACE so the picker (`createOpenAIAccountPicker`) and
- * the refresh loop — both of which close over the same array reference — pick it
- * up immediately without a restart, mirroring `TokenPool.addAccount` for Claude.
- * If persistence throws, the in-place append is rolled back so the live routing
- * state never diverges from disk.
+ * The account is pushed IN PLACE (as a full runtime `OpenAIAccount`, so the
+ * `OpenAITokenPool`/`SessionRouter` — which close over the same array
+ * reference — can route to it immediately without a restart, mirroring
+ * `TokenPool.addAccount` for Claude. If persistence throws, the in-place
+ * append is rolled back so the live routing state never diverges from disk.
  */
 export function addOpenAIAccountTransaction(options) {
-    const account = {
+    const account = createOpenAIAccount({
         id: options.record.id,
         provider: "openai_subscription",
         accessToken: options.record.accessToken,
         refreshToken: options.record.refreshToken,
         expiresAt: options.record.expiresAt,
         enabled: options.record.enabled !== false,
-    };
+        sessionLimitPercent: options.record.sessionLimitPercent,
+        weeklyLimitPercent: options.record.weeklyLimitPercent,
+    });
     options.accounts.push(account);
     try {
         options.persist(options.accounts);

package/dist/proxy/account-deletion.js

@@ -42,7 +42,7 @@ export async function deleteAnthropicAccountTransaction(options) {
         releaseReservation();
     }
 }
-/** Persist prospective OpenAI state before removing it from the live picker array. */
+/** Persist prospective OpenAI state before removing it from the live pool array. */
 export function deleteOpenAIAccountTransaction(options) {
     const account = options.accounts.find(candidate => candidate.id === options.id);
     if (!account)
@@ -56,5 +56,9 @@ export function deleteOpenAIAccountTransaction(options) {
     if (index < 0)
         throw new AccountDeletionConflictError(options.id);
     options.accounts.splice(index, 1);
+    // Only after the account is out of the live array — mirrors the Anthropic
+    // transaction, which removes pool state and then invalidates bindings.
+    options.forgetAccount?.(account);
+    options.invalidateAccount?.(options.id);
     return account;
 }

package/dist/proxy/account-patch.js

@@ -0,0 +1,64 @@
+import { clampPercent } from "./types.js";
+/**
+ * Validate a `PATCH /cc-router/accounts/:id` request body. Shared between the
+ * Anthropic and OpenAI account branches in server.ts so both providers reject
+ * a malformed `enabled`/`sessionLimitPercent`/`weeklyLimitPercent` the same
+ * way, before either pool is even consulted.
+ */
+export function validateAccountPatchBody(body) {
+    const patch = {};
+    if (body.enabled !== undefined) {
+        if (typeof body.enabled !== "boolean") {
+            return { ok: false, error: "enabled must be boolean" };
+        }
+        patch.enabled = body.enabled;
+    }
+    for (const key of ["sessionLimitPercent", "weeklyLimitPercent"]) {
+        const v = body[key];
+        if (v === undefined)
+            continue;
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0 || v > 100) {
+            return { ok: false, error: `${key} must be a number between 0 and 100` };
+        }
+        patch[key] = v;
+    }
+    return { ok: true, patch };
+}
+/**
+ * Apply an already-validated patch to a runtime OpenAI account in place and
+ * persist it — the OpenAI counterpart of `TokenPool.updateAccount` for
+ * Claude, which `OpenAITokenPool` has no equivalent of.
+ *
+ * Returns the updated account, or `undefined` if no account with that id
+ * exists in `accounts` (the caller should respond 404). On persistence
+ * failure the in-memory mutation is rolled back before the error is
+ * re-thrown, mirroring `addOpenAIAccountTransaction`'s rollback contract.
+ */
+export function applyOpenAIAccountPatch(options) {
+    const account = options.accounts.find(a => a.id === options.id);
+    if (!account)
+        return undefined;
+    const prev = {
+        enabled: account.enabled,
+        sessionLimitPercent: account.sessionLimitPercent,
+        weeklyLimitPercent: account.weeklyLimitPercent,
+    };
+    if (options.patch.enabled !== undefined)
+        account.enabled = options.patch.enabled;
+    if (options.patch.sessionLimitPercent !== undefined) {
+        account.sessionLimitPercent = clampPercent(options.patch.sessionLimitPercent);
+    }
+    if (options.patch.weeklyLimitPercent !== undefined) {
+        account.weeklyLimitPercent = clampPercent(options.patch.weeklyLimitPercent);
+    }
+    try {
+        options.persist(options.accounts);
+    }
+    catch (err) {
+        account.enabled = prev.enabled;
+        account.sessionLimitPercent = prev.sessionLimitPercent;
+        account.weeklyLimitPercent = prev.weeklyLimitPercent;
+        throw err;
+    }
+    return account;
+}

package/dist/proxy/account-pool.js

@@ -0,0 +1,19 @@
+export class EmptyPoolError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "EmptyPoolError";
+    }
+}
+export class NoEligibleAccountError extends Error {
+    reason;
+    retryAtMs;
+    blockedAccounts;
+    constructor(reason, blockedAccounts, retryAtMs) {
+        super("no account is currently eligible for routing");
+        this.name = "NoEligibleAccountError";
+        this.reason = reason;
+        this.blockedAccounts = blockedAccounts;
+        if (retryAtMs !== undefined)
+            this.retryAtMs = retryAtMs;
+    }
+}

package/dist/proxy/anthropic-routing.js

@@ -22,7 +22,7 @@ export function extractClaudeSessionId(request) {
     return normalizeSessionId(values[0]);
 }
 const NO_ELIGIBLE_ACCOUNT_MESSAGE = "All configured accounts are unavailable for the requested model";
-function sendNoEligibleAccountResponse(error, response, now) {
+export function sendAnthropicNoEligibleResponse(error, response, now) {
     if (error.reason === "rate_limited") {
         if (error.retryAtMs !== undefined) {
             const retryAfterSeconds = Math.max(0, Math.ceil((error.retryAtMs - now) / 1_000));
@@ -63,7 +63,7 @@ export function createAnthropicRoutingMiddleware(options) {
             }
             if (error instanceof NoEligibleAccountError) {
                 options.onNoEligibleAccount?.(error, request, response);
-                sendNoEligibleAccountResponse(error, response, (options.now ?? Date.now)());
+                sendAnthropicNoEligibleResponse(error, response, (options.now ?? Date.now)());
                 return;
             }
             next(error);

package/dist/proxy/lease-lifecycle.js

@@ -49,12 +49,12 @@ function header(headers, name) {
     }
     return undefined;
 }
-function futureExpiry(expiryMs, nowMs) {
+export function futureExpiry(expiryMs, nowMs) {
     if (!Number.isFinite(expiryMs) || expiryMs <= nowMs)
         return undefined;
     return expiryMs - nowMs <= MAX_RATE_LIMIT_COOLDOWN_MS ? expiryMs : undefined;
 }
-function retryAfterExpiry(value, nowMs) {
+export function retryAfterExpiry(value, nowMs) {
     if (typeof value !== "string" && typeof value !== "number")
         return undefined;
     if (typeof value === "string" && value.trim().length === 0)
@@ -69,14 +69,16 @@ function retryAfterExpiry(value, nowMs) {
         return undefined;
     return futureExpiry(Date.parse(value), nowMs);
 }
-function resetHeaderExpiry(value, nowMs) {
+export function resetHeaderExpiry(value, nowMs) {
     if (typeof value !== "string" && typeof value !== "number")
         return undefined;
     if (typeof value === "string" && value.trim().length === 0)
         return undefined;
     const numeric = Number(value);
     if (Number.isFinite(numeric)) {
-        const milliseconds = numeric < 10_000_000_000 ? numeric * 1_000 : numeric;
+        // Threshold matches usage.ts's MS_TIMESTAMP_THRESHOLD, so a seconds- vs.
+        // milliseconds-epoch reset value is classified the same way across providers.
+        const milliseconds = numeric < 100_000_000_000 ? numeric * 1_000 : numeric;
         return futureExpiry(milliseconds, nowMs);
     }
     if (typeof value !== "string")