@timo972/cc-router 0.9.0 → 0.10.0-rc.0

package/dist/proxy/server.js

@@ -4,16 +4,19 @@ import { ServerResponse } from "http";
 import { timingSafeEqual } from "crypto";
 import { TokenPool } from "./token-pool.js";
 import { needsRefresh, refreshAccountIfCurrent, saveAccounts, startRefreshLoop } from "./token-refresher.js";
-import { loadAccounts, loadOpenAIAccounts, saveOpenAIAccounts, accountsFileExists, readAccountsFromPath, readConfig, writeConfig, getProxyRequestTimeoutMs, migrateLegacyAccountProviders, setProviderAccountsEnabled } from "../config/manager.js";
+import { loadAccounts, loadOpenAIAccounts, saveOpenAIAccountsToPath, accountsFileExists, readAccountsFromPath, readConfig, writeConfig, getProxyRequestTimeoutMs, migrateLegacyAccountProviders, setProviderAccountsEnabled } from "../config/manager.js";
 import { checkForUpdate, performUpdate, restartSelf, printUpdateBanner } from "../utils/self-update.js";
 import { trackEvent, startHeartbeat } from "../utils/telemetry.js";
 import { loadTelemetryState } from "../config/telemetry.js";
 import { logRoute, logError, logStartup } from "./logger.js";
 import { createLocalRoutingErrorLog, stats } from "./stats.js";
-import { PROXY_PORT, LITELLM_URL } from "../config/paths.js";
+import { PROXY_PORT, LITELLM_URL, ACCOUNTS_PATH } from "../config/paths.js";
 import { writePid, removePid } from "../daemon/pid.js";
-import { createOpenAIAccountPicker } from "../providers/openai/account-pool.js";
-import { prepareOpenAIAccountForRequest, startOpenAIRefreshLoop } from "../providers/openai/token-refresher.js";
+import { applyOpenAIAccountPatch, validateAccountPatchBody } from "./account-patch.js";
+import { hasPendingCredentialWrite, markOpenAICredentialsPersisted, prepareOpenAIAccountForRequest, refreshAndPersistOpenAIAccount, startOpenAIRefreshLoop, } from "../providers/openai/token-refresher.js";
+import { createOpenAIAccount } from "../providers/openai/account-state.js";
+import { OpenAITokenPool } from "../providers/openai/token-pool.js";
+import { DEFAULT_CODEX_LIMIT_ID } from "../providers/openai/usage.js";
 import { mountResponsesRoutes } from "./responses-server.js";
 import { mountMessagesCrossProviderRoute } from "./messages-cross-route.js";
 import { mountModelsRoute } from "./models-server.js";
@@ -68,10 +71,10 @@ export function createOperationalStatus(opts) {
         },
     };
 }
-export function createHealthAccountViews(anthropicAccounts, openAIAccounts, resolveRoutingMetrics = zeroRoutingMetrics) {
+export function createHealthAccountViews(anthropicAccounts, openAIAccounts, resolveRoutingMetrics = zeroRoutingMetrics, resolveOpenAIRouting) {
     return [
         ...anthropicAccounts.map(account => (publicAnthropicAccountView(account, resolveRoutingMetrics(account.id)))),
-        ...openAIAccounts.map(publicOpenAIAccountView),
+        ...openAIAccounts.map(account => publicOpenAIAccountView(account, resolveOpenAIRouting?.(account.id) ?? { metrics: zeroRoutingMetrics(account.id), cooldowns: { globalUntilMs: 0, bucketCooldowns: [] } })),
     ];
 }
 function publicAnthropicAccountView(a, metrics) {
@@ -182,23 +185,87 @@ function publicRepresentativeClaim(claim) {
     }
     return "unknown";
 }
-function publicOpenAIAccountView(a) {
+function publicOpenAIAccountView(a, routing) {
     const expiresInMs = a.expiresAt - Date.now();
     return {
         id: a.id,
         provider: "openai_subscription",
         enabled: a.enabled !== false,
-        healthy: a.enabled !== false && expiresInMs > 0,
-        busy: false,
-        inFlightRequests: 0,
-        activeSessions: 0,
-        requestCount: 0,
-        errorCount: 0,
+        sessionLimitPercent: a.sessionLimitPercent,
+        weeklyLimitPercent: a.weeklyLimitPercent,
+        healthy: a.enabled !== false && a.healthy && expiresInMs > 0,
+        busy: routing.metrics.coolingDown,
+        cooldownUntilMs: routing.metrics.cooldownUntilMs ?? 0,
+        globalCooldownUntilMs: routing.cooldowns.globalUntilMs,
+        inFlightRequests: routing.metrics.inFlightRequests,
+        activeSessions: routing.metrics.activeSessions,
+        requestCount: a.requestCount,
+        errorCount: a.errorCount,
         expiresInMs,
-        lastUsedMs: 0,
-        lastRefreshMs: 0,
+        lastUsedMs: a.lastUsed,
+        lastRefreshMs: a.lastRefresh,
+        codexRateLimits: publicCodexRateLimits(a, routing.cooldowns),
+        ...(hasPendingCredentialWrite(a) ? { credentialsPendingWrite: true } : {}),
+    };
+}
+function publicCodexRateLimits(a, cooldowns) {
+    const rl = a.rateLimits;
+    // A bucket cooldown can exist without any snapshot for that bucket: a
+    // header-only 429 (an `x-codex-active-limit` with no accompanying
+    // rate-limit headers) sets a cooldown the pool enforces in `hardBlock`.
+    // Synthesizing a window-less entry for those keeps the health view honest —
+    // otherwise the account renders fully available while it is actually being
+    // skipped for that model.
+    const cooldownOnly = cooldowns.bucketCooldowns
+        .filter(cooldown => !rl.buckets.has(cooldown.limitId))
+        .map(cooldown => ({ limitId: cooldown.limitId }));
+    const buckets = [...rl.buckets.values(), ...cooldownOnly]
+        .sort((left, right) => left.limitId === DEFAULT_CODEX_LIMIT_ID ? -1
+        : right.limitId === DEFAULT_CODEX_LIMIT_ID ? 1
+            : left.limitId.localeCompare(right.limitId))
+        .slice(0, 8)
+        .map(bucket => ({
+        limitId: publicCodexLimitId(bucket.limitId),
+        label: publicCodexLabel(bucket),
+        ...(bucket.primary ? { primary: publicCodexWindow(bucket.primary) } : {}),
+        ...(bucket.secondary ? { secondary: publicCodexWindow(bucket.secondary) } : {}),
+        cooldownUntilMs: publicTimestamp(cooldowns.bucketCooldowns.find(c => c.limitId === bucket.limitId)?.untilMs ?? 0),
+    }));
+    const credits = rl.credits;
+    const balance = typeof credits?.balance === "string"
+        ? credits.balance.replace(/[\x00-\x1f\x7f]/g, "").trim().slice(0, 32)
+        : "";
+    return {
+        status: rl.status === "rate_limited" ? "rate_limited" : "ok",
+        plan: publicCodexPlan(rl.plan),
+        buckets,
+        ...(credits ? {
+            credits: {
+                hasCredits: credits.hasCredits === true,
+                unlimited: credits.unlimited === true,
+                ...(balance ? { balance } : {}),
+            },
+        } : {}),
+        lastUpdated: publicTimestamp(rl.lastUpdated),
+    };
+}
+function publicCodexWindow(window) {
+    return {
+        utilization: publicUtilization(window.utilization),
+        resetAt: publicTimestamp(window.resetAt),
+        windowMinutes: publicNonNegativeInteger(window.windowMinutes),
     };
 }
+function publicCodexLimitId(value) {
+    return /^[a-z0-9_]{1,64}$/.test(value) ? value : "unknown";
+}
+function publicCodexLabel(bucket) {
+    const name = bucket.limitName?.replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, 64);
+    return name || publicCodexLimitId(bucket.limitId);
+}
+function publicCodexPlan(value) {
+    return typeof value === "string" && /^[a-z0-9_-]{1,32}$/.test(value) ? value : "";
+}
 function providerStatus(accounts) {
     return {
         configured: accounts.length > 0,
@@ -258,6 +325,23 @@ export function applyRateLimitHeaders(account, headers) {
     account.rateLimits = { ...account.rateLimits, ...rateLimits };
     return true;
 }
+/**
+ * Build the single function through which this server writes OpenAI accounts.
+ *
+ * Two things have to be true of every such write, so they live together here
+ * rather than at each call site. It must land in the file the process was
+ * started against — a custom `--accounts <path>` must never silently fall back
+ * to the default accounts.json. And it must report its own durability: an add,
+ * patch, or delete rewrites the same file from the same live array, so it puts
+ * a rotation that failed to persist earlier on disk even though no refresh was
+ * involved, and the pending-write bookkeeping has to clear with it.
+ */
+export function createOpenAIPersister(accountsPath) {
+    return (accountsToSave) => {
+        saveOpenAIAccountsToPath(accountsToSave, accountsPath ?? ACCOUNTS_PATH);
+        markOpenAICredentialsPersisted(accountsToSave);
+    };
+}
 export async function startServer(opts = {}) {
     const port = opts.port ?? PROXY_PORT;
     // Direct-to-Anthropic (standalone) or via LiteLLM (full mode).
@@ -266,6 +350,7 @@ export async function startServer(opts = {}) {
     const target = litellmUrl ?? "https://api.anthropic.com";
     const mode = litellmUrl ? "litellm" : "standalone";
     const accountsPath = opts.accountsPath;
+    const persistOpenAIAccounts = createOpenAIPersister(accountsPath);
     if (!accountsFileExists(accountsPath)) {
         console.error(chalk.red("\n✗ accounts.json not found."));
         console.error(chalk.yellow("  Run: cc-router setup\n"));
@@ -273,7 +358,7 @@ export async function startServer(opts = {}) {
     }
     migrateLegacyAccountProviders(accountsPath);
     const accounts = accountsPath ? readAccountsFromPath(accountsPath) : loadAccounts();
-    const openAIAccounts = loadOpenAIAccounts(accountsPath);
+    const openAIAccounts = loadOpenAIAccounts(accountsPath).map(createOpenAIAccount);
     if (accounts.length === 0 && openAIAccounts.length === 0) {
         console.error(chalk.red("\n✗ No accounts found in accounts.json."));
         console.error(chalk.yellow("  Run: cc-router setup\n"));
@@ -295,7 +380,28 @@ export async function startServer(opts = {}) {
             };
         };
     };
-    const pickOpenAIAccount = createOpenAIAccountPicker(openAIAccounts);
+    const openAIPool = new OpenAITokenPool(openAIAccounts);
+    const openAIRouter = new SessionRouter(openAIPool);
+    // Factory, mirroring `createRoutingMetricsResolver`: the active-session
+    // snapshot is taken once per request rather than rebuilt (sweeping every
+    // binding and copying the map) for each account, and the cooldown view is
+    // computed once per account instead of three times.
+    const createOpenAIRoutingResolver = () => {
+        const activeSessionCounts = openAIRouter.getActiveSessionCountsSnapshot();
+        return (accountId) => {
+            const cooldowns = openAIPool.getCooldownView(accountId);
+            return {
+                metrics: {
+                    inFlightRequests: openAIPool.getInFlight(accountId),
+                    activeSessions: activeSessionCounts.get(accountId) ?? 0,
+                    coolingDown: cooldowns.globalUntilMs > 0,
+                    cooldownUntilMs: cooldowns.globalUntilMs,
+                },
+                cooldowns,
+            };
+        };
+    };
+    const resolveOpenAIRouting = (accountId) => createOpenAIRoutingResolver()(accountId);
     const initialConfig = readConfig();
     const modelRouting = initialConfig.modelRouting ?? {};
     // Log when the pool falls back to a capped account — makes the cap bypass
@@ -311,8 +417,15 @@ export async function startServer(opts = {}) {
         const msg = `${a.id} cooldown expired — rate limit cleared`;
         stats.addLog({ ts: Date.now(), accountId: a.id, model: "-", type: "route", details: msg });
     };
+    openAIPool.onCapBypass = (a) => {
+        const msg = `all OpenAI accounts capped — routing to ${a.id}`;
+        stats.addLog({ ts: Date.now(), accountId: a.id, model: "-", type: "error", details: msg });
+    };
+    openAIPool.onCooldownExpired = (a) => {
+        stats.addLog({ ts: Date.now(), accountId: a.id, model: "-", type: "route", details: `${a.id} cooldown expired — rate limit cleared` });
+    };
     startRefreshLoop(accounts);
-    startOpenAIRefreshLoop(openAIAccounts, saveOpenAIAccounts);
+    startOpenAIRefreshLoop(openAIAccounts, persistOpenAIAccounts);
     const usageRefresher = new AnthropicUsageRefresher(pool);
     usageRefresher.start();
     const app = express();
@@ -364,8 +477,9 @@ export async function startServer(opts = {}) {
         // Sweep expired cooldowns on each poll so the dashboard reflects recovery
         // even during idle periods when no /v1 request would trigger getNext().
         pool.sweepExpiredCooldowns();
+        openAIPool.sweepExpiredCooldowns();
         const resolveRoutingMetrics = createRoutingMetricsResolver();
-        const accountViews = createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics);
+        const accountViews = createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics, createOpenAIRoutingResolver());
         const status = accountViews.some(a => a.healthy) ? "ok" : "degraded";
         if (secretBuf && !secretMatches(presentedSecret(req))) {
             res.json({ status });
@@ -404,7 +518,7 @@ export async function startServer(opts = {}) {
     accountsRouter.get("/", (_req, res) => {
         const resolveRoutingMetrics = createRoutingMetricsResolver();
         res.json({
-            accounts: createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics),
+            accounts: createHealthAccountViews(pool.getAll(), openAIAccounts, resolveRoutingMetrics, createOpenAIRoutingResolver()),
         });
     });
     accountsRouter.patch("/providers/:provider", (req, res) => {
@@ -448,12 +562,31 @@ export async function startServer(opts = {}) {
         };
         applyRuntime(enabled);
         try {
+            const isAnthropic = provider === "anthropic_subscription";
             const changed = persistProviderEnabledState({
                 provider,
                 enabled,
-                accountIds: pool.getAll().map(account => account.id),
-                persist: () => setProviderAccountsEnabled(provider, enabled, accountsPath),
-                invalidateAccount: accountId => sessionRouter.invalidateAccount(accountId),
+                accountIds: isAnthropic
+                    ? pool.getAll().map(account => account.id)
+                    : openAIAccounts.map(account => account.id),
+                // OpenAI accounts are written from the live pool rather than by
+                // rewriting whatever is on disk. A refresh may have rotated
+                // credentials that never reached a file, and re-serializing that
+                // stale record would report this PATCH a success while the only
+                // valid refresh token stayed in memory — one crash from forcing a
+                // re-login. Going through the live persister saves it and clears the
+                // pending marker. Anthropic has no such in-memory rotation to lose.
+                persist: () => {
+                    if (isAnthropic)
+                        return setProviderAccountsEnabled(provider, enabled, accountsPath);
+                    persistOpenAIAccounts(openAIAccounts);
+                    // Same count `setProviderAccountsEnabled` reports, so the response
+                    // keeps its shape for both providers: every account of this provider
+                    // the write covered, not only those whose flag flipped.
+                    return openAIAccounts.length;
+                },
+                invalidateAccount: accountId => (isAnthropic ? sessionRouter : openAIRouter)
+                    .invalidateAccount(accountId),
             });
             res.json({ provider, enabled, changed });
         }
@@ -488,51 +621,69 @@ export async function startServer(opts = {}) {
     accountsRouter.patch("/:id", (req, res) => {
         const { id } = req.params;
         const body = (req.body ?? {});
-        const patch = {};
-        if (body.enabled !== undefined) {
-            if (typeof body.enabled !== "boolean") {
-                res.status(400).json({ error: "enabled must be boolean" });
+        const validation = validateAccountPatchBody(body);
+        if (!validation.ok) {
+            res.status(400).json({ error: validation.error });
+            return;
+        }
+        const patch = validation.patch;
+        // Snapshot the previous values so we can roll back on persistence failure
+        const existing = pool.findById(id);
+        if (existing) {
+            const prev = {
+                enabled: existing.enabled,
+                sessionLimitPercent: existing.sessionLimitPercent,
+                weeklyLimitPercent: existing.weeklyLimitPercent,
+            };
+            const updated = pool.updateAccount(id, patch);
+            if (!updated) {
+                res.status(404).json({ error: `Account "${id}" not found` });
                 return;
             }
-            patch.enabled = body.enabled;
-        }
-        for (const key of ["sessionLimitPercent", "weeklyLimitPercent"]) {
-            const v = body[key];
-            if (v === undefined)
-                continue;
-            if (typeof v !== "number" || !Number.isFinite(v) || v < 0 || v > 100) {
-                res.status(400).json({ error: `${key} must be a number between 0 and 100` });
+            const result = tryPersist(() => {
+                pool.updateAccount(id, prev);
+            });
+            if (!result.ok) {
+                res.status(500).json({ error: `Failed to persist accounts.json: ${result.message}` });
                 return;
             }
-            patch[key] = v;
-        }
-        // Snapshot the previous values so we can roll back on persistence failure
-        const existing = pool.findById(id);
-        if (!existing) {
-            res.status(404).json({ error: `Account "${id}" not found` });
+            if (patch.enabled === false)
+                sessionRouter.invalidateAccount(id);
+            res.json({
+                account: publicAnthropicAccountView(updated, createRoutingMetricsResolver()(updated.id)),
+            });
             return;
         }
-        const prev = {
-            enabled: existing.enabled,
-            sessionLimitPercent: existing.sessionLimitPercent,
-            weeklyLimitPercent: existing.weeklyLimitPercent,
-        };
-        const updated = pool.updateAccount(id, patch);
-        if (!updated) {
-            res.status(404).json({ error: `Account "${id}" not found` });
+        // Not a Claude account — try the OpenAI pool. `OpenAITokenPool` has no
+        // `updateAccount` of its own, so the runtime `OpenAIAccount` is patched
+        // and persisted directly via the same transaction contract used to add
+        // and delete OpenAI accounts.
+        let updatedOpenAI;
+        try {
+            updatedOpenAI = applyOpenAIAccountPatch({
+                id,
+                patch,
+                accounts: openAIAccounts,
+                persist: persistOpenAIAccounts,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logError("accounts", 0, `Failed to persist accounts.json: ${message}`);
+            res.status(500).json({ error: `Failed to persist accounts.json: ${message}` });
             return;
         }
-        const result = tryPersist(() => {
-            pool.updateAccount(id, prev);
-        });
-        if (!result.ok) {
-            res.status(500).json({ error: `Failed to persist accounts.json: ${result.message}` });
+        if (!updatedOpenAI) {
+            res.status(404).json({ error: `Account "${id}" not found` });
             return;
         }
+        // Same contract as the Anthropic branch above: disabling an account drops
+        // its sticky bindings immediately instead of leaving them (and their
+        // active-session counts) attributed to it until the binding TTL expires.
         if (patch.enabled === false)
-            sessionRouter.invalidateAccount(id);
+            openAIRouter.invalidateAccount(id);
         res.json({
-            account: publicAnthropicAccountView(updated, createRoutingMetricsResolver()(updated.id)),
+            account: publicOpenAIAccountView(updatedOpenAI, resolveOpenAIRouting(updatedOpenAI.id)),
         });
     });
     accountsRouter.post("/", (req, res) => {
@@ -549,8 +700,18 @@ export async function startServer(opts = {}) {
             res.status(400).json({ error: "Invalid field types on account record" });
             return;
         }
+        // Same cap validation the PATCH endpoint applies, so the two writers of
+        // these fields agree instead of POST silently clamping a bad value to 100.
+        const capValidation = validateAccountPatchBody({
+            sessionLimitPercent: body.sessionLimitPercent,
+            weeklyLimitPercent: body.weeklyLimitPercent,
+        });
+        if (!capValidation.ok) {
+            res.status(400).json({ error: capValidation.error });
+            return;
+        }
         // IDs are unique across providers, so a new account may not collide with an
-        // existing account in either the Claude pool or the OpenAI picker.
+        // existing account in either the Claude pool or the OpenAI pool.
         if (pool.findById(body.id) || openAIAccounts.some(a => a.id === body.id)) {
             res.status(409).json({ error: `Account "${body.id}" already exists` });
             return;
@@ -565,9 +726,11 @@ export async function startServer(opts = {}) {
                         refreshToken: body.refreshToken,
                         expiresAt: body.expiresAt,
                         enabled: body.enabled,
+                        sessionLimitPercent: body.sessionLimitPercent,
+                        weeklyLimitPercent: body.weeklyLimitPercent,
                     },
                     accounts: openAIAccounts,
-                    persist: saveOpenAIAccounts,
+                    persist: persistOpenAIAccounts,
                 });
             }
             catch (err) {
@@ -576,7 +739,7 @@ export async function startServer(opts = {}) {
                 res.status(500).json({ error: `Failed to persist accounts.json: ${message}` });
                 return;
             }
-            res.status(201).json({ account: publicOpenAIAccountView(addedOpenAI) });
+            res.status(201).json({ account: publicOpenAIAccountView(addedOpenAI, resolveOpenAIRouting(addedOpenAI.id)) });
             return;
         }
         const record = {
@@ -622,7 +785,9 @@ export async function startServer(opts = {}) {
                     id,
                     accounts: openAIAccounts,
                     otherAccountCount: pool.getAll().length,
-                    persist: saveOpenAIAccounts,
+                    persist: persistOpenAIAccounts,
+                    forgetAccount: account => openAIPool.forgetAccount(account),
+                    invalidateAccount: accountId => { openAIRouter.invalidateAccount(accountId); },
                 });
             }
             catch (err) {
@@ -678,17 +843,28 @@ export async function startServer(opts = {}) {
             Object.assign(modelRouting, next);
             writeConfig({ ...readConfig(), modelRouting: next });
         },
-        prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, saveOpenAIAccounts),
+        prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, persistOpenAIAccounts),
     });
+    // A relayed upstream 401 means the subscription token is stale — kick off a
+    // refresh in the background so the *next* request succeeds without making
+    // this client wait on it. Best-effort: failures are swallowed here since
+    // the ingress lifecycle has already recorded the 401 for this request.
+    const onOpenAIUpstreamAuthFailure = (account) => {
+        refreshAndPersistOpenAIAccount(account, openAIAccounts, persistOpenAIAccounts).catch(() => { });
+    };
     mountResponsesRoutes(app, {
-        getOpenAIAccount: pickOpenAIAccount,
-        prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, saveOpenAIAccounts),
+        openAIRouter,
+        openAIPool,
+        prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, persistOpenAIAccounts),
         modelRouting,
+        onUpstreamAuthFailure: onOpenAIUpstreamAuthFailure,
     });
     mountMessagesCrossProviderRoute(app, {
-        getOpenAIAccount: pickOpenAIAccount,
-        prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, saveOpenAIAccounts),
+        openAIRouter,
+        openAIPool,
+        prepareOpenAIAccount: (account) => prepareOpenAIAccountForRequest(account, openAIAccounts, persistOpenAIAccounts),
         modelRouting,
+        onUpstreamAuthFailure: onOpenAIUpstreamAuthFailure,
     });
     // ─── Proxy middleware ──────────────────────────────────────────────────────
     // IMPORTANT: selfHandleResponse must be false (default) for SSE streaming to

package/dist/proxy/stats.js

@@ -1,9 +1,27 @@
+/**
+ * Longest model identifier retained in an activity entry. Model names arrive
+ * in request bodies the JSON parsers accept up to megabytes, and every entry
+ * stays resident until MAX_LOG_ENTRIES newer ones push it out — and is
+ * re-serialized into each health response meanwhile. Retaining one verbatim
+ * would let a handful of requests pin hundreds of megabytes. Real model names
+ * are far shorter than this; the same 64 that `normalizeModelSlug` and
+ * `normalizeModelFamily` already clamp their identifiers to.
+ */
+const MAX_LOG_MODEL_LENGTH = 64;
+/**
+ * Clamp a caller-supplied model identifier to a length that is safe to retain.
+ * Truncation only — an empty model stays empty so routing lookups behave
+ * exactly as they did on the untruncated value.
+ */
+export function boundModelId(model) {
+    return model.length > MAX_LOG_MODEL_LENGTH ? model.slice(0, MAX_LOG_MODEL_LENGTH) : model;
+}
 /** Build a bounded diagnostic for a request rejected before account selection. */
 export function createLocalRoutingErrorLog(reason, modelFamily, now = Date.now()) {
     return {
         ts: now,
         accountId: "proxy",
-        model: modelFamily ?? "-",
+        model: modelFamily ? boundModelId(modelFamily) : "-",
         type: "error",
         details: `no-eligible:${reason.replace("_", "-")}`,
         statusCode: reason === "rate_limited" ? 429 : 503,
@@ -34,3 +52,14 @@ class ProxyStats {
 }
 // Singleton — shared across server and health endpoint
 export const stats = new ProxyStats();
+/** Record Codex token usage on both the request's log entry and the running totals. */
+export function applyCodexUsage(entry, usage) {
+    if (!usage)
+        return;
+    entry.inputTokens = usage.inputTokens;
+    entry.outputTokens = usage.outputTokens;
+    entry.cacheReadTokens = usage.cachedInputTokens;
+    stats.totalInputTokens += usage.inputTokens;
+    stats.totalOutputTokens += usage.outputTokens;
+    stats.totalCacheReadTokens += usage.cachedInputTokens;
+}

package/dist/proxy/token-pool.js

@@ -1,24 +1,8 @@
 import { DEFAULT_RATE_LIMITS, ACCOUNT_USER_DEFAULTS, clampPercent } from "./types.js";
 import { canUseExtraUsage, normalizeModelFamily } from "../providers/anthropic/usage.js";
-export class EmptyPoolError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "EmptyPoolError";
-    }
-}
-export class NoEligibleAccountError extends Error {
-    reason;
-    retryAtMs;
-    blockedAccounts;
-    constructor(reason, blockedAccounts, retryAtMs) {
-        super("no account is currently eligible for routing");
-        this.name = "NoEligibleAccountError";
-        this.reason = reason;
-        this.blockedAccounts = blockedAccounts;
-        if (retryAtMs !== undefined)
-            this.retryAtMs = retryAtMs;
-    }
-}
+import { EmptyPoolError, NoEligibleAccountError, } from "./account-pool.js";
+// Re-export so existing importers (anthropic-routing.ts, tests) keep working.
+export { EmptyPoolError, NoEligibleAccountError };
 const MAX_TRUSTED_RATE_LIMIT_RESET_MS = 8 * 24 * 60 * 60 * 1_000;
 /**
  * Returns the reset timestamp (seconds) that must pass before the account