@wardby/cli 0.2.1 → 0.4.0

package/dist/providers/coding-proxy/prisma-ledger.js

@@ -1,3 +1,19 @@
+import { logger } from "../../core/logger.js";
+import { normalizeProxyModelTerms } from "./types.js";
+const log = logger.child({ module: "coding-proxy-ledger" });
+/** How long a ledger transaction waits for a pool connection (Prisma's
+ *  default is 2 s). A model request fails outright when this runs out, so it
+ *  gets more room than the default; its pool is also kept apart from the
+ *  package registry's (coding-proxy/main.ts). */
+export const LEDGER_TRANSACTION_MAX_WAIT_MS = 5_000;
+/** How long a ledger transaction may run once started (Prisma's default is
+ *  5 s). Each is a handful of small queries, but a proxy busy with package
+ *  installs (the registry's dependency walk parses large npm documents on the
+ *  same event loop) can stall between them; a live lockfile install expired
+ *  one ("A commit cannot be executed on an expired transaction") and failed
+ *  the model request. The row lock it holds is per session, so a longer
+ *  window only delays that run's own next request. */
+export const LEDGER_TRANSACTION_TIMEOUT_MS = 20_000;
 function sessionFromRow(row) {
     if (!Array.isArray(row.allowedModels) || !row.allowedModels.every((model) => typeof model === "string")) {
         throw new Error("invalid_proxy_session_models");
@@ -15,8 +31,24 @@ function sessionFromRow(row) {
         deadlineAt: row.deadlineAt,
         budgetUsd: Number(row.budgetUsd),
         status: row.status,
+        registryTokenHash: row.registryTokenHash,
+        budgetExhaustedAt: row.budgetExhaustedAt ?? null,
+        upstreamFailure: row.upstreamFailure ?? null,
+        terms: sessionTerms(row),
     };
 }
+/**
+ * The session's stored model terms. Null only when both columns are null (a session from before
+ * the catalog, which prices from the shipped fallback); terms that are partly present or cannot be
+ * read throw, so the session is refused rather than billed at fallback rates.
+ */
+function sessionTerms(row) {
+    const version = row.pricingVersion ?? null;
+    const stored = row.catalogEntry ?? null;
+    if (version === null && stored === null)
+        return null;
+    return normalizeProxyModelTerms({ version, entry: stored });
+}
 function requestFromRow(row) {
     const pricing = row.pricingSnapshot;
     const hasUsage = row.inputTokens !== null && row.outputTokens !== null;
@@ -57,26 +89,36 @@ export class PrismaProxyLedger {
     constructor(db) {
         this.db = db;
     }
+    transaction(fn) {
+        return this.db.$transaction(fn, {
+            maxWait: LEDGER_TRANSACTION_MAX_WAIT_MS,
+            timeout: LEDGER_TRANSACTION_TIMEOUT_MS,
+        });
+    }
     async createSession(input) {
         const models = JSON.stringify(input.allowedModels);
+        const terms = input.terms ? normalizeProxyModelTerms(input.terms) : undefined;
         await this.db.$executeRaw `
       INSERT INTO "CodingProxySession"
         ("id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt",
-         "budgetUsd", "status", "createdAt", "updatedAt")
+         "budgetUsd", "status", "registryTokenHash", "pricingVersion", "catalogEntry", "createdAt", "updatedAt")
       VALUES
         (${input.id}, ${input.runId}, ${input.capabilityHash}, ${input.credentialRef}, ${input.protocol}, ${models}::jsonb,
-         ${input.deadlineAt}, ${input.budgetUsd}, 'active', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+         ${input.deadlineAt}, ${input.budgetUsd}, 'active', ${input.registryTokenHash},
+         ${terms?.version ?? null}, ${terms ? JSON.stringify(terms.entry) : null}::jsonb,
+         CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
     `;
     }
     async findSessionByCapabilityHash(capabilityHash) {
         const rows = await this.db.$queryRaw `
-      SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status"
+      SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status", "registryTokenHash",
+             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry"
       FROM "CodingProxySession" WHERE "capabilityHash" = ${capabilityHash}
     `;
         return rows[0] ? sessionFromRow(rows[0]) : null;
     }
     async reserve(input) {
-        return this.db.$transaction(async (tx) => {
+        return this.transaction(async (tx) => {
             const sessions = await tx.$queryRaw `
           SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status"
           FROM "CodingProxySession" WHERE "id" = ${input.sessionId} FOR UPDATE
@@ -107,6 +149,10 @@ export class PrismaProxyLedger {
           FROM "CodingProxyRequest" WHERE "sessionId" = ${input.sessionId}
         `;
             if (Number(totals[0]?.held ?? 0) + input.reservationUsd >= Number(row.budgetUsd)) {
+                await tx.$executeRaw `
+            UPDATE "CodingProxySession" SET "budgetExhaustedAt" = COALESCE("budgetExhaustedAt", ${input.now})
+            WHERE "id" = ${input.sessionId}
+          `;
                 return { outcome: "budget_exhausted" };
             }
             const pricing = JSON.stringify({
@@ -132,7 +178,7 @@ export class PrismaProxyLedger {
         });
     }
     async complete(requestId, usage, actualCostUsd, upstreamStatus) {
-        return this.db.$transaction(async (tx) => {
+        return this.transaction(async (tx) => {
             const initial = await requestById(tx, requestId);
             if (!initial)
                 throw new Error("unknown_proxy_request");
@@ -167,20 +213,54 @@ export class PrismaProxyLedger {
               "completedAt" = CURRENT_TIMESTAMP, "updatedAt" = CURRENT_TIMESTAMP
           WHERE "id" = ${requestId} AND "status" IN ('reserved', 'uncertain')
         `;
-            await tx.$executeRaw `
+            const [updatedRun] = await tx.$queryRaw `
           UPDATE "Run" AS r
-          SET "tokensIn" = totals."tokensIn", "tokensOut" = totals."tokensOut", "costUsd" = totals."costUsd"
+          SET "tokensIn" = totals."tokensIn", "tokensOut" = totals."tokensOut", "costUsd" = totals."costUsd",
+              "turns" = totals."turns"
           FROM (
             SELECT s."runId", COALESCE(SUM(q."inputTokens"), 0)::integer AS "tokensIn",
                    COALESCE(SUM(q."outputTokens"), 0)::integer AS "tokensOut",
-                   COALESCE(SUM(q."actualCostUsd"), 0) AS "costUsd"
+                   COALESCE(SUM(q."actualCostUsd"), 0) AS "costUsd",
+                   COUNT(*)::integer AS "turns"
             FROM "CodingProxySession" s
             JOIN "CodingProxyRequest" q ON q."sessionId" = s."id" AND q."status" = 'completed'
             WHERE s."id" = ${prior.sessionId}
             GROUP BY s."runId"
           ) AS totals
           WHERE r."id" = totals."runId"
+          RETURNING r."id"
         `;
+            // Per-model usage (RunModelUsage), recomputed for this request's model and set, never incremented.
+            // Best effort inside a savepoint: Run totals and the ledger are the budget truth, so a failed
+            // write here (e.g. a role without the RunModelUsage grant) must never fail the completion.
+            await tx.$executeRaw `SAVEPOINT run_model_usage`;
+            try {
+                await tx.$executeRaw `
+            INSERT INTO "RunModelUsage"
+              ("runId", "model", "freshInputTokens", "cachedInputTokens", "cacheWriteTokens", "outputTokens", "costUsd")
+            SELECT s."runId", q."model",
+                   COALESCE(SUM(COALESCE(q."inputTokens", 0) - COALESCE(q."cachedInputTokens", 0)), 0)::integer,
+                   COALESCE(SUM(q."cachedInputTokens"), 0)::integer,
+                   COALESCE(SUM(q."cacheWriteTokens"), 0)::integer,
+                   COALESCE(SUM(q."outputTokens"), 0)::integer,
+                   COALESCE(SUM(q."actualCostUsd"), 0)
+            FROM "CodingProxySession" s
+            JOIN "CodingProxyRequest" q ON q."sessionId" = s."id" AND q."status" = 'completed'
+            WHERE s."id" = ${prior.sessionId} AND q."model" = ${prior.model}
+            GROUP BY s."runId", q."model"
+            ON CONFLICT ("runId", "model") DO UPDATE SET
+              "freshInputTokens" = EXCLUDED."freshInputTokens",
+              "cachedInputTokens" = EXCLUDED."cachedInputTokens",
+              "cacheWriteTokens" = EXCLUDED."cacheWriteTokens",
+              "outputTokens" = EXCLUDED."outputTokens",
+              "costUsd" = EXCLUDED."costUsd"
+          `;
+                await tx.$executeRaw `RELEASE SAVEPOINT run_model_usage`;
+            }
+            catch (err) {
+                await tx.$executeRaw `ROLLBACK TO SAVEPOINT run_model_usage`;
+                log.warn({ err, runId: updatedRun?.id, sessionId: prior.sessionId, model: prior.model }, "could not record the run's model usage");
+            }
             const request = await requestById(tx, requestId);
             if (!request)
                 throw new Error("proxy_completion_not_persisted");
@@ -207,6 +287,24 @@ export class PrismaProxyLedger {
       WHERE "id" = ${sessionId} AND "status" = 'active'
     `;
     }
+    async budgetExhausted(sessionId) {
+        const rows = await this.db.$queryRaw `
+      SELECT "id" FROM "CodingProxySession" WHERE "id" = ${sessionId} AND "budgetExhaustedAt" IS NOT NULL
+    `;
+        return rows.length > 0;
+    }
+    async recordUpstreamFailure(sessionId, code) {
+        await this.db.$executeRaw `
+      UPDATE "CodingProxySession" SET "upstreamFailure" = ${code}, "updatedAt" = CURRENT_TIMESTAMP
+      WHERE "id" = ${sessionId} AND "upstreamFailure" IS NULL
+    `;
+    }
+    async upstreamFailure(sessionId) {
+        const rows = await this.db.$queryRaw `
+      SELECT "upstreamFailure" FROM "CodingProxySession" WHERE "id" = ${sessionId}
+    `;
+        return rows[0]?.upstreamFailure ?? null;
+    }
     getRequest(requestId) {
         return requestById(this.db, requestId);
     }

package/dist/providers/coding-proxy/proxy.d.ts

@@ -1,9 +1,21 @@
-import { type ModelPricing } from "../llm/pricing.js";
-import type { CredentialResolver, ProxyAuditSink, ProxyLedger, ProxyProtocol } from "./types.js";
+import type { ModelPricing } from "../llm/pricing-core.js";
+import type { CredentialResolver, ProxyAuditSink, ProxyLedger, ProxyModelTerms, ProxyProtocol } from "./types.js";
 export declare const PROXY_MAX_BODY_BYTES: number;
 export declare const PROXY_MAX_OUTPUT_TOKENS = 1000000;
 export declare const PROXY_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
 export declare const CLAUDE_CODE_ANTHROPIC_BETAS: readonly ["claude-code-20250219", "context-management-2025-06-27", "effort-2025-11-24", "interleaved-thinking-2025-05-14", "mid-conversation-system-2026-04-07", "prompt-caching-scope-2026-01-05", "thinking-token-count-2026-05-13"];
+/**
+ * Betas Claude Code sends only for some models. per-turn-control is sent for Claude Opus 5.5; it is
+ * required only by an effort-only system message (per-turn effort), and every body field is still
+ * checked against the reviewed shape, so the header alone unlocks nothing.
+ */
+export declare const OPTIONAL_ANTHROPIC_BETAS: readonly ["per-turn-control-2026-07-01"];
+/**
+ * The longest run_command timeout the Claude tool runner offers the model (its MAX_TIMEOUT_MS,
+ * src/claude-tool-runner/command.mjs; the proxy tests keep the two equal). A lower limit here let the
+ * command run, then refused the next request, which replays that tool call, as unsupported.
+ */
+export declare const MAX_COMMAND_TIMEOUT_MS = 120000;
 export declare class CodingProxyError extends Error {
     readonly status: number;
     readonly code: string;
@@ -29,6 +41,8 @@ export interface CreateCodingProxySession {
     allowedModels: string[];
     deadlineAt: Date;
     budgetUsd: number;
+    /** The run's catalog entry recorded at dispatch; the session then prices and shapes requests from it. */
+    terms?: ProxyModelTerms;
 }
 export interface CreatedCodingProxySession {
     id: string;
@@ -51,6 +65,7 @@ export interface CodingProxyOptions {
     pricing?: (model: string, protocol: ProxyProtocol) => ModelPricing;
     pricingVersion?: string;
 }
+export declare function capabilityHash(capability: string): string;
 export declare class CodingProxy {
     private readonly ledger;
     private readonly credentials;
@@ -64,12 +79,20 @@ export declare class CodingProxy {
     constructor(options: CodingProxyOptions);
     createSession(input: CreateCodingProxySession): Promise<CreatedCodingProxySession>;
     cancelSession(sessionId: string): Promise<void>;
+    /** Whether this session's run was refused a model request for budget. */
+    budgetExhausted(sessionId: string): Promise<boolean>;
+    /** The code of the first upstream failure relayed for this session's run, if any. */
+    upstreamFailure(sessionId: string): Promise<string | null>;
     execute(input: ExecuteProxyRequest, sink: ProxyResponseSink): Promise<void>;
+    /** A session's model terms: its stored catalog entry, or the fallback for sessions from before the catalog. */
+    private termsFor;
     private authenticate;
     private trackActive;
     private handleDuplicate;
     private complete;
     private forwardJson;
     private forwardStream;
+    /** Best effort: the executor reads it to name the failure; it must never break the relay. */
+    private recordUpstreamFailure;
     private markUncertain;
 }