better-ccflare 3.5.41 → 3.5.42

package/README.md

@@ -792,7 +792,7 @@ Inspired by [snipeship/ccflare](https://github.com/snipeship/ccflare) - thanks f
 - [@jw409](https://github.com/jw409) - Fixed OAuth account addition in WSL2 and compiled binaries by replacing unreliable prompt() with readline; systemd deployment guide, BUN_JSC_* crash loop analysis, and preflight environment validator (PR #106)
 - [@materemias](https://github.com/materemias) - Testing and validation of Vertex AI provider implementation, thorough debugging of OAuth API key authentication (issue #54), requesting and validating AWS Bedrock support (issue #49), extensive testing of new releases and features; fix request details modal hydration race where payload row committed after parent request row, adding lazy re-fetch via `/api/requests/payload/:id` with 404 fallback (PR #186)
 - [@tqtensor](https://github.com/tqtensor) - Comprehensive memory leak fix preventing OOM kills with smart chunk capping, memory monitoring, and optimized cleanup (PR #67)
-- [@lunetics](https://github.com/lunetics) - Force-reset rate limit feature allowing manual clearing of stale rate-limit locks via API, CLI, and dashboard with immediate usage polling (PR #68), OOM kill prevention with periodic data retention cleanup, 3-day default retention, and time-scoped stats queries (PR #70), model registry sync removing retired models and adding sonnet-4.6 CLI shortcut (PR #71); migrated Anthropic usage handling to the new `limits[]` payload shape — per-account display (session/weekly/per-model rows with severity and overage-credit meter), account ranking/utilization and capacity-guard reads, and model-aware proactive throttling so a per-model weekly cap (e.g. Fable) only throttles matching-model requests instead of the whole account, with flat-window fallback throughout ([#296](https://github.com/tombii/better-ccflare/pull/296)); surfaced usage-window exhaustion that was invisible to both `/health` and the accounts dashboard during the 2026-07-09 incident — added a `usage_exhausted` pool counter (subset of `routable`), extracted `rateLimitStatus` display precedence into a tested pure helper (usage exhaustion > unified header snapshot > legacy cooldown > OK), and a shared staleness guard so a known-past window reset is never reported as exhausted on either surface, with characterization tests pinning the incident's account-wide-bench-to-pool-flap chain ([#299](https://github.com/tombii/better-ccflare/pull/299)); fixed the agent interceptor silently rewriting subagent request models to stale/retired ids via a hardcoded alias map, and unconditionally overriding explicit per-call model choices — rewrites now fire only on an explicit DB preference, with a live Anthropic model catalog (`GET /v1/models`, weekly refresh, console-API accounts only by default to avoid OAuth ban risk, passive capture from pass-through traffic) vetting rewrite targets and backing dashboard model dropdowns/validation; added `original_model`/`applied_model` request-row provenance and an `x-better-ccflare-model-rewrite` response header, post-rewrite-aware account/combo routing, agent model provenance (`modelSource`, revert-to-inherit) with a redesigned two-mechanism dashboard edit dialog separating the agent-file default from the runtime preference override ([#300](https://github.com/tombii/better-ccflare/pull/300)); persisted `requires_reauth` detection for dead OAuth refresh tokens after a real incident where two accounts' tokens silently failed for ~43h undetected — preserves the machine-readable OAuth error code ahead of `error_description` in the Anthropic/Codex/xAI providers (previously discarded, so detection could never match), routing exclusion at the single `isAccountAvailable` choke point plus all proactive refresh paths, clear-sites across every reauth flow (CLI, dashboard, Qwen/Codex HTTP handlers), a new `auth_failure` webhook/SSE alert with cooldown dedup, and a dashboard "Needs authentication" badge, backed by ~120 new tests ([#311](https://github.com/tombii/better-ccflare/pull/311)); added opt-in model-scoped capacity routing (`MODEL_SCOPED_CAPACITY_ROUTING=exhausted`) that filters accounts whose per-model-family weekly cap is exhausted, combining telemetry-based `weekly_scoped` usage windows with a reactive 5-minute in-memory negative cache fed by observed `out_of_credits` 429 responses (provenance-tagged `recent_upstream_rejection` vs. `telemetry_confirmed` for honest client messaging), plus a new `session-drain-soonest` load-balancing strategy (`LB_STRATEGY=session-drain-soonest`) that preserves session-stickiness while ranking fresh-selection candidates by earliest future `weekly_all` reset to consume capacity before it expires ([#325](https://github.com/tombii/better-ccflare/pull/325))
+- [@lunetics](https://github.com/lunetics) - Force-reset rate limit feature allowing manual clearing of stale rate-limit locks via API, CLI, and dashboard with immediate usage polling (PR #68), OOM kill prevention with periodic data retention cleanup, 3-day default retention, and time-scoped stats queries (PR #70), model registry sync removing retired models and adding sonnet-4.6 CLI shortcut (PR #71); migrated Anthropic usage handling to the new `limits[]` payload shape — per-account display (session/weekly/per-model rows with severity and overage-credit meter), account ranking/utilization and capacity-guard reads, and model-aware proactive throttling so a per-model weekly cap (e.g. Fable) only throttles matching-model requests instead of the whole account, with flat-window fallback throughout ([#296](https://github.com/tombii/better-ccflare/pull/296)); surfaced usage-window exhaustion that was invisible to both `/health` and the accounts dashboard during the 2026-07-09 incident — added a `usage_exhausted` pool counter (subset of `routable`), extracted `rateLimitStatus` display precedence into a tested pure helper (usage exhaustion > unified header snapshot > legacy cooldown > OK), and a shared staleness guard so a known-past window reset is never reported as exhausted on either surface, with characterization tests pinning the incident's account-wide-bench-to-pool-flap chain ([#299](https://github.com/tombii/better-ccflare/pull/299)); fixed the agent interceptor silently rewriting subagent request models to stale/retired ids via a hardcoded alias map, and unconditionally overriding explicit per-call model choices — rewrites now fire only on an explicit DB preference, with a live Anthropic model catalog (`GET /v1/models`, weekly refresh, console-API accounts only by default to avoid OAuth ban risk, passive capture from pass-through traffic) vetting rewrite targets and backing dashboard model dropdowns/validation; added `original_model`/`applied_model` request-row provenance and an `x-better-ccflare-model-rewrite` response header, post-rewrite-aware account/combo routing, agent model provenance (`modelSource`, revert-to-inherit) with a redesigned two-mechanism dashboard edit dialog separating the agent-file default from the runtime preference override ([#300](https://github.com/tombii/better-ccflare/pull/300)); persisted `requires_reauth` detection for dead OAuth refresh tokens after a real incident where two accounts' tokens silently failed for ~43h undetected — preserves the machine-readable OAuth error code ahead of `error_description` in the Anthropic/Codex/xAI providers (previously discarded, so detection could never match), routing exclusion at the single `isAccountAvailable` choke point plus all proactive refresh paths, clear-sites across every reauth flow (CLI, dashboard, Qwen/Codex HTTP handlers), a new `auth_failure` webhook/SSE alert with cooldown dedup, and a dashboard "Needs authentication" badge, backed by ~120 new tests ([#311](https://github.com/tombii/better-ccflare/pull/311)); added opt-in model-scoped capacity routing (`MODEL_SCOPED_CAPACITY_ROUTING=exhausted`) that filters accounts whose per-model-family weekly cap is exhausted, combining telemetry-based `weekly_scoped` usage windows with a reactive 5-minute in-memory negative cache fed by observed `out_of_credits` 429 responses (provenance-tagged `recent_upstream_rejection` vs. `telemetry_confirmed` for honest client messaging), plus a new `session-drain-soonest` load-balancing strategy (`LB_STRATEGY=session-drain-soonest`) that preserves session-stickiness while ranking fresh-selection candidates by earliest future `weekly_all` reset to consume capacity before it expires ([#325](https://github.com/tombii/better-ccflare/pull/325)); Routing settings card on the Settings tab wiring the strategy selector and model-scoped capacity routing toggle from PR #325 to the dashboard — a shared `resolveEnvFileSetting<T>()` resolver backs `getStrategySource()`/`getModelScopedCapacityRoutingSource()` so the env>file>default precedence can't drift between the getter and its source twin, both controls show an env-locked badge and disable themselves when overridden by `LB_STRATEGY`/`MODEL_SCOPED_CAPACITY_ROUTING`, an active-but-unlisted strategy renders as a disabled "(current)" item instead of a blank Select that could be silently overwritten, and a strategy switch now also invalidates the accounts query so the "Primary" badge updates immediately instead of drifting for up to 60s ([#329](https://github.com/tombii/better-ccflare/pull/329)); guarded logger `JSON.stringify` call sites (`Logger.formatMessage`, `LogFileWriter.write`) against circular references and `BigInt` values that previously threw uncaught out of routine `log.debug/info/warn/error` calls into caller code, with a sanitized fallback that preserves `ts`/`level`/`msg` and byte-identical output for normal serializable events ([#330](https://github.com/tombii/better-ccflare/pull/330)); fixed a false auto-pause chain where a legitimately usage-throttled account's `five_hour` window reset triggered an auto-refresh probe, but `applyUsageThrottling` had no exemption for internal synthetic probes and returned better-ccflare's own 529 back to the scheduler, which counted it as a genuine endpoint failure toward `FAILURE_THRESHOLD` — exempted requests carrying the pre-existing `x-better-ccflare-auto-refresh`/`x-better-ccflare-keepalive` loop-prevention headers from usage throttling entirely, and stopped counting a 529 probe response toward the consecutive-failure pause threshold as defense in depth, with TDD regression tests proving both failure modes pre-fix ([#331](https://github.com/tombii/better-ccflare/pull/331)); `docs/routing-architecture.md`, a technical reference documenting the account-selection pipeline end-to-end — the four load-balancing strategies, usage-throttling's pacing-line model, model-scoped capacity routing, and auto-fallback — each with a plain-English explanation and a Mermaid flowchart cross-checked against source, including accuracy fixes from two rounds of Greptile review (combo-routed requests skip model-scoped weekly windows; `out_of_credits`/keepalive 429s don't apply an account cooldown; a request with no `clientSessionId` isn't recorded as a sticky session-affinity mapping; `checkForAutoFallbackAccounts` and `wouldAutoUnpause` are two distinct eligibility rules, not one shared rule) plus a correction for the synthetic-probe throttle exemption landed by PR #331 after this doc branched ([#332](https://github.com/tombii/better-ccflare/pull/332)); fixed the `build:linux-*`/`build:macos-*`/`build:windows-x64` platform-specific build scripts omitting the `--define __BETTER_CCFLARE_VERSION__` flag that the plain `build` script sets, causing locally-built platform binaries to misreport their version via the unrelated `CLAUDE_CLI_VERSION` fallback in `getVersionSync()` ([#333](https://github.com/tombii/better-ccflare/pull/333))
 - [@troykelly](https://github.com/troykelly) - Comprehensive PostgreSQL compatibility fixes including boolean type handling, identifier case preservation, BIGINT string coercion, UNION ALL type alignment, HAVING clause compatibility, parameter ordering corrections, worker initialization, and connection pooling (issue #81); detailed bug report and root cause analysis for `/api/accounts` Invalid Date error affecting PostgreSQL BIGINT columns (issue #88)
 - [@cowwoc](https://github.com/cowwoc) - Compact reliability fixes, space breakdown after cleanup, requests tab without payloads (PR #149); clear stale rate_limited_until when usage API shows capacity restored (PR #150); prevent manually-paused accounts from being selected as auto-fallback candidates (PR #151); balance new sessions by utilization within same-priority accounts using water-filling algorithm (PR #152); fix ModuleNotFound crash in compiled binary when using Compact Database by embedding vacuum-worker at build time (PR #155); expected usage position indicator on rate limit bars showing projected pacing vs. reset window (PR #156); show explicit rate-limited state when usage data unavailable on startup (PR #161); deduplicate concurrent fetchAndCache calls per account to prevent redundant Anthropic requests (PR #159); make GET /api/accounts cache-only and await usage fetch in refresh endpoint, eliminating blind 5s timeout (PR #162); mark account rate-limited when all models exhausted to prevent stale-state retry loops (PR #163); use retry-after header for dynamic model-exhaustion cooldown instead of hardcoded 1 hour (PR #164); remove implicit sonnet catch-all in getModelList preventing silent unexpected model remaps (PR #165); reduce log noise by aggregating auto-unpause skip messages and suppressing identity model mapping logs (PR #167); reasoning effort compatibility layer for OpenAI/Codex routes with deterministic downgrade mapping and count_tokens path support (PR #172, implemented in PR #188); unified Codex model mapping path (PR #203)
 - [@wonkooklee](https://github.com/wonkooklee) - Fixed ZlibError on startup caused by Bun auto-decompressing upstream 404 responses while leaving stale `content-encoding: gzip` headers intact — applied `withSanitizedProxyHeaders` to the model-not-found early-return path, matching every other forward path (PR #243)

package/package.json

@@ -1,58 +1,58 @@
 {
-  "name": "better-ccflare",
-  "version": "3.5.41",
-  "description": "Load balancer proxy for Claude API with intelligent distribution across multiple OAuth accounts to avoid rate limiting",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tombii/better-ccflare.git"
-  },
-  "homepage": "https://github.com/tombii/better-ccflare#readme",
-  "bugs": {
-    "url": "https://github.com/tombii/better-ccflare/issues"
-  },
-  "bin": {
-    "better-ccflare": "dist/better-ccflare"
-  },
-  "type": "module",
-  "scripts": {
-    "dev": "bun run src/main.ts",
-    "build": "mkdir -p dist && bun -e \"const fs=require('fs'); if (!fs.existsSync('../../packages/database/src/inline-vacuum-worker.ts')) { fs.writeFileSync('../../packages/database/src/inline-vacuum-worker.ts', 'export const EMBEDDED_VACUUM_WORKER_CODE = \\\"\\\";'); }\" && bun -e \"const fs=require('fs'); if (!fs.existsSync('../../packages/database/src/inline-incremental-vacuum-worker.ts')) { fs.writeFileSync('../../packages/database/src/inline-incremental-vacuum-worker.ts', 'export const EMBEDDED_INCREMENTAL_VACUUM_WORKER_CODE = \\\"\\\";'); }\" && bun -e \"const fs=require('fs'); if (!fs.existsSync('../../packages/database/src/inline-integrity-check-worker.ts')) { fs.writeFileSync('../../packages/database/src/inline-integrity-check-worker.ts', 'export const EMBEDDED_INTEGRITY_CHECK_WORKER_CODE = \\\"\\\";'); }\" && bun build ../../packages/database/src/vacuum-worker.ts --outfile dist/vacuum-worker.js --target=bun --minify && bun -e \"const fs=require('fs'); const code=fs.readFileSync('dist/vacuum-worker.js','utf8'); const encoded=Buffer.from(code).toString('base64'); fs.writeFileSync('../../packages/database/src/inline-vacuum-worker.ts', 'export const EMBEDDED_VACUUM_WORKER_CODE = \\\"' + encoded + '\\\";');\" && bun build ../../packages/database/src/incremental-vacuum-worker.ts --outfile dist/incremental-vacuum-worker.js --target=bun --minify && bun -e \"const fs=require('fs'); const code=fs.readFileSync('dist/incremental-vacuum-worker.js','utf8'); const encoded=Buffer.from(code).toString('base64'); fs.writeFileSync('../../packages/database/src/inline-incremental-vacuum-worker.ts', 'export const EMBEDDED_INCREMENTAL_VACUUM_WORKER_CODE = \\\"' + encoded + '\\\";');\" && bun build ../../packages/database/src/integrity-check-worker.ts --outfile dist/integrity-check-worker.js --target=bun --minify && bun -e \"const fs=require('fs'); const code=fs.readFileSync('dist/integrity-check-worker.js','utf8'); const encoded=Buffer.from(code).toString('base64'); fs.writeFileSync('../../packages/database/src/inline-integrity-check-worker.ts', 'export const EMBEDDED_INTEGRITY_CHECK_WORKER_CODE = \\\"' + encoded + '\\\";');\" && rm -f dist/better-ccflare && bun build src/main.ts --compile --outfile dist/better-ccflare --target=bun --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"' && rm -f dist/vacuum-worker.js dist/incremental-vacuum-worker.js dist/integrity-check-worker.js",
-    "build:multi": "bun run build-multi-arch.ts",
-    "build:linux-amd64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-linux-amd64 --target=bun-linux-amd64 --minify",
-    "build:linux-arm64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-linux-arm64 --target=bun-linux-arm64 --minify",
-    "build:macos-x86_64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-macos-x86_64 --target=bun-darwin-x64 --minify",
-    "build:macos-arm64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-macos-arm64 --target=bun-darwin-arm64 --minify",
-    "build:windows-x64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-windows-x64.exe --target=bun-windows-x64 --minify",
-    "prepublishOnly": "cp ../../README.md . && bun run --cwd ../.. build:dashboard && bun run build && jq 'del(.dependencies[\"@better-ccflare/cli-commands\", \"@better-ccflare/config\", \"@better-ccflare/core\", \"@better-ccflare/core-di\", \"@better-ccflare/database\", \"@better-ccflare/logger\", \"@better-ccflare/server\"])' package.json > package.json.tmp && mv package.json.tmp package.json",
-    "postpublish": "chmod +x dist/better-ccflare"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0"
-  },
-  "dependencies": {
-    "dotenv": "^17.4.0"
-  },
-  "files": [
-    "dist/better-ccflare",
-    "README.md"
-  ],
-  "keywords": [
-    "claude",
-    "anthropic",
-    "api",
-    "proxy",
-    "load-balancer",
-    "rate-limiting",
-    "oauth",
-    "cli",
-    "analytics",
-    "monitoring"
-  ],
-  "publishConfig": {
-    "access": "public"
-  }
+	"name": "better-ccflare",
+	"version": "3.5.42",
+	"description": "Load balancer proxy for Claude API with intelligent distribution across multiple OAuth accounts to avoid rate limiting",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/tombii/better-ccflare.git"
+	},
+	"homepage": "https://github.com/tombii/better-ccflare#readme",
+	"bugs": {
+		"url": "https://github.com/tombii/better-ccflare/issues"
+	},
+	"bin": {
+		"better-ccflare": "dist/better-ccflare"
+	},
+	"type": "module",
+	"scripts": {
+		"dev": "bun run src/main.ts",
+		"build": "mkdir -p dist && bun -e \"const fs=require('fs'); if (!fs.existsSync('../../packages/database/src/inline-vacuum-worker.ts')) { fs.writeFileSync('../../packages/database/src/inline-vacuum-worker.ts', 'export const EMBEDDED_VACUUM_WORKER_CODE = \\\"\\\";'); }\" && bun -e \"const fs=require('fs'); if (!fs.existsSync('../../packages/database/src/inline-incremental-vacuum-worker.ts')) { fs.writeFileSync('../../packages/database/src/inline-incremental-vacuum-worker.ts', 'export const EMBEDDED_INCREMENTAL_VACUUM_WORKER_CODE = \\\"\\\";'); }\" && bun -e \"const fs=require('fs'); if (!fs.existsSync('../../packages/database/src/inline-integrity-check-worker.ts')) { fs.writeFileSync('../../packages/database/src/inline-integrity-check-worker.ts', 'export const EMBEDDED_INTEGRITY_CHECK_WORKER_CODE = \\\"\\\";'); }\" && bun build ../../packages/database/src/vacuum-worker.ts --outfile dist/vacuum-worker.js --target=bun --minify && bun -e \"const fs=require('fs'); const code=fs.readFileSync('dist/vacuum-worker.js','utf8'); const encoded=Buffer.from(code).toString('base64'); fs.writeFileSync('../../packages/database/src/inline-vacuum-worker.ts', 'export const EMBEDDED_VACUUM_WORKER_CODE = \\\"' + encoded + '\\\";');\" && bun build ../../packages/database/src/incremental-vacuum-worker.ts --outfile dist/incremental-vacuum-worker.js --target=bun --minify && bun -e \"const fs=require('fs'); const code=fs.readFileSync('dist/incremental-vacuum-worker.js','utf8'); const encoded=Buffer.from(code).toString('base64'); fs.writeFileSync('../../packages/database/src/inline-incremental-vacuum-worker.ts', 'export const EMBEDDED_INCREMENTAL_VACUUM_WORKER_CODE = \\\"' + encoded + '\\\";');\" && bun build ../../packages/database/src/integrity-check-worker.ts --outfile dist/integrity-check-worker.js --target=bun --minify && bun -e \"const fs=require('fs'); const code=fs.readFileSync('dist/integrity-check-worker.js','utf8'); const encoded=Buffer.from(code).toString('base64'); fs.writeFileSync('../../packages/database/src/inline-integrity-check-worker.ts', 'export const EMBEDDED_INTEGRITY_CHECK_WORKER_CODE = \\\"' + encoded + '\\\";');\" && rm -f dist/better-ccflare && bun build src/main.ts --compile --outfile dist/better-ccflare --target=bun --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"' && rm -f dist/vacuum-worker.js dist/incremental-vacuum-worker.js dist/integrity-check-worker.js",
+		"build:multi": "bun run build-multi-arch.ts",
+		"build:linux-amd64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-linux-amd64 --target=bun-linux-amd64 --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"'",
+		"build:linux-arm64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-linux-arm64 --target=bun-linux-arm64 --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"'",
+		"build:macos-x86_64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-macos-x86_64 --target=bun-darwin-x64 --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"'",
+		"build:macos-arm64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-macos-arm64 --target=bun-darwin-arm64 --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"'",
+		"build:windows-x64": "bun run build && bun build src/main.ts --compile --outfile dist/better-ccflare-windows-x64.exe --target=bun-windows-x64 --minify --define __BETTER_CCFLARE_VERSION__='\\\"'$(node -p \"require('./package.json').version\")'\\\"'",
+		"prepublishOnly": "cp ../../README.md . && bun run --cwd ../.. build:dashboard && bun run build && jq 'del(.dependencies[\"@better-ccflare/cli-commands\", \"@better-ccflare/config\", \"@better-ccflare/core\", \"@better-ccflare/core-di\", \"@better-ccflare/database\", \"@better-ccflare/logger\", \"@better-ccflare/server\"])' package.json > package.json.tmp && mv package.json.tmp package.json",
+		"postpublish": "chmod +x dist/better-ccflare"
+	},
+	"engines": {
+		"node": ">=18.0.0"
+	},
+	"devDependencies": {
+		"@types/node": "^20.0.0"
+	},
+	"dependencies": {
+		"dotenv": "^17.4.0"
+	},
+	"files": [
+		"dist/better-ccflare",
+		"README.md"
+	],
+	"keywords": [
+		"claude",
+		"anthropic",
+		"api",
+		"proxy",
+		"load-balancer",
+		"rate-limiting",
+		"oauth",
+		"cli",
+		"analytics",
+		"monitoring"
+	],
+	"publishConfig": {
+		"access": "public"
+	}
 }