clauderipple 0.2.0 → 0.3.1

package/dist/router/src/pool.js

@@ -0,0 +1,233 @@
+// Credential pools and failover: keeping a session alive when one credential, or one provider,
+// stops answering.
+//
+// Two separate problems that share this module because they share a failure vocabulary:
+//
+//   1. A provider may hold several credentials (API keys, or subscription accounts). When one is
+//      rate-limited or rejected, the next one takes over.
+//   2. A route may name fallbacks. When a provider is exhausted altogether, the next provider
+//      answers instead.
+//
+// Three rules the implementation is built around:
+//
+// **Stickiness is not an optimisation, it is the cache.** A conversation that moves to another
+// credential moves to a cold prompt cache, and the acceptance metric for this product is ≥90% cache
+// hit (ARCHITECTURE §4). So a healthy credential keeps the conversation it already has, and only a
+// failure moves it.
+//
+// **Not every failure deserves a retry.** A 400 is our request being wrong; sending it to every
+// credential and then every provider burns the lot and still fails. Only failures that another
+// credential could plausibly answer are worth moving for.
+//
+// **Failover ends at the first byte.** Once any of the answer has reached the client, the turn is
+// committed: replacing it mid-stream produces two half-answers spliced together. The caller
+// enforces this; `Outcome.retryable` only ever means "if nothing has been sent yet".
+/** A rate limit with no stated reset. Long enough not to hammer, short enough to recover a session. */
+const DEFAULT_RATE_LIMIT_MS = 60_000;
+const TRANSIENT_MS = 10_000;
+const EXHAUSTED_MS = 30 * 60_000;
+/** A `Retry-After` beyond this is treated as "not within this session"; the credential is parked. */
+const MAX_COOLDOWN_MS = 6 * 60 * 60_000;
+/**
+ * What an upstream status means for the credential that produced it. `retryAfterMs` comes from a
+ * `Retry-After` header or a vendor reset field when there is one; guessing is a last resort.
+ */
+export function classify(status, retryAfterMs, body = "") {
+    const bounded = (ms) => Math.max(1_000, Math.min(MAX_COOLDOWN_MS, Math.round(ms)));
+    // 401 is the credential being rejected, and that does not heal: park it.
+    if (status === 401)
+        return { retryable: true, kind: "auth", cooldownMs: 0, quarantine: true };
+    // 403 is not only that. It is also a content policy, a blocked region, a model the account may
+    // not use, or an edge refusing what it took for a bot — none of which mean the key is dead.
+    // Parking a working credential until someone notices is the worse mistake, so this waits instead.
+    if (status === 403) {
+        // Except when the vendor says the refusal was not about us. A relay passing on a broken upstream
+        // answers 403, and that is not a statement about the credential at all: charging it a minute of
+        // cooldown made every turn in that minute come back to the user as an authentication error
+        // (2026-09-21, OpenCode Go relaying a 403 for DeepSeek). The credential did nothing, so it is
+        // held for no time at all rather than for a shorter time — any cooldown at all would move the
+        // conversation to another credential and take the prompt cache with it (§4). `bounded` is
+        // bypassed deliberately: its one-second floor is exactly the cache cost this avoids.
+        if (/upstream (request )?failed/i.test(body)) {
+            return { retryable: true, kind: "transient", cooldownMs: 0, quarantine: false };
+        }
+        return { retryable: true, kind: "auth", cooldownMs: bounded(retryAfterMs ?? DEFAULT_RATE_LIMIT_MS), quarantine: false };
+    }
+    if (status === 429)
+        return { retryable: true, kind: "rate-limit", cooldownMs: bounded(retryAfterMs ?? DEFAULT_RATE_LIMIT_MS), quarantine: false };
+    if (status === 402)
+        return { retryable: true, kind: "exhausted", cooldownMs: bounded(retryAfterMs ?? EXHAUSTED_MS), quarantine: false };
+    // 408 and 425 are the server saying "ask again"; 5xx is the server being broken. Both may work
+    // somewhere else. 501 and 505 are the server saying it will never do this, so they are not here.
+    if (status === 408 || status === 425 || (status >= 500 && status !== 501 && status !== 505)) {
+        return { retryable: true, kind: "transient", cooldownMs: bounded(retryAfterMs ?? TRANSIENT_MS), quarantine: false };
+    }
+    // 0 is our own connect/DNS failure: nothing reached the provider, so another one may still work.
+    if (status === 0)
+        return { retryable: true, kind: "transient", cooldownMs: TRANSIENT_MS, quarantine: false };
+    // Everything else is the request itself — a bad body, an unknown model, an oversized payload.
+    // Another credential would reject it the same way, so stop.
+    return { retryable: false, reason: `status ${status} is not a credential or provider problem` };
+}
+/**
+ * A vendor's own account of when to come back, from `retry-after` (seconds, or an HTTP date) or a
+ * vendor reset field. Preferred over a guess, and ignored when it is not a number we can use.
+ */
+export function retryAfterMs(headers) {
+    const pick = (name) => {
+        const v = headers[name];
+        return Array.isArray(v) ? v[0] : v;
+    };
+    const header = pick("retry-after");
+    if (header) {
+        const seconds = Number(header);
+        // Anything numeric is seconds, including a negative one — which is not a wait, and must not
+        // fall through to the date branch, where `Date.parse("-5")` succeeds and means something else.
+        if (Number.isFinite(seconds))
+            return seconds >= 0 ? seconds * 1000 : undefined;
+        const at = Date.parse(header);
+        if (Number.isFinite(at))
+            return Math.max(0, at - Date.now());
+    }
+    // The Codex backend states its window this way rather than with retry-after.
+    const codex = Number(pick("x-codex-primary-reset-after-seconds"));
+    if (Number.isFinite(codex) && codex >= 0)
+        return codex * 1000;
+    return undefined;
+}
+/**
+ * Health and stickiness for one router's credentials, keyed `provider/credential`. In memory only:
+ * a cooldown that outlived a restart would be a restart that made things worse, and a quarantine is
+ * re-earned on the first request anyway.
+ */
+export class CredentialPool {
+    health = new Map();
+    /** conversation → durable owner id (or runtime id when there is no owner), preserving its cache across token refreshes. */
+    sticky = new Map();
+    now;
+    /** How long an idle conversation keeps its claim on a credential. */
+    stickyTtlMs;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.stickyTtlMs = opts.stickyTtlMs ?? 60 * 60_000;
+    }
+    key(provider, id) { return `${provider}/${id}`; }
+    healthOf(provider, id) {
+        const key = this.key(provider, id);
+        let h = this.health.get(key);
+        if (!h) {
+            h = { cooldownUntil: 0, quarantined: false, failures: 0 };
+            this.health.set(key, h);
+        }
+        return h;
+    }
+    usable(provider, id) {
+        const h = this.healthOf(provider, id);
+        return !h.quarantined && h.cooldownUntil <= this.now();
+    }
+    /**
+     * The credential to use, or null when every one of them is cooling or quarantined. The
+     * conversation's existing credential wins while it is healthy; otherwise the first usable one in
+     * configured order, which makes the order meaningful rather than incidental.
+     */
+    pick(provider, credentials, conversation) {
+        if (credentials.length === 0)
+            return null;
+        this.expireSticky();
+        if (conversation) {
+            const held = this.sticky.get(conversation);
+            if (held && held.provider === provider) {
+                const current = credentials.find((c) => (c.ownerId ?? c.id) === held.ownerId);
+                if (current && this.usable(provider, current.id)) {
+                    held.at = this.now();
+                    return current;
+                }
+            }
+        }
+        const next = credentials.find((c) => this.usable(provider, c.id));
+        if (!next)
+            return null;
+        if (conversation)
+            this.sticky.set(conversation, { provider, ownerId: next.ownerId ?? next.id, at: this.now() });
+        return next;
+    }
+    /**
+     * Whether this provider has any credential that could answer right now. Asked before a turn is
+     * committed to a provider, so a session whose primary is rate-limited for the next hour goes to
+     * its fallback instead of failing once per request until the window resets.
+     */
+    hasUsable(provider, credentials) {
+        return credentials.some((c) => this.usable(provider, c.id));
+    }
+    /** Record a failure. Returns the verdict so the caller can decide whether to try the next one. */
+    penalise(provider, id, status, retryAfterMs, body = "") {
+        const verdict = classify(status, retryAfterMs, body);
+        if (!verdict.retryable)
+            return verdict;
+        const h = this.healthOf(provider, id);
+        h.failures++;
+        if (verdict.quarantine)
+            h.quarantined = true;
+        else
+            h.cooldownUntil = Math.max(h.cooldownUntil, this.now() + verdict.cooldownMs);
+        return verdict;
+    }
+    /**
+     * A credential that answered is not rejected, so a quarantine lifts and the failure count resets.
+     *
+     * An unexpired cooldown is left alone. Requests overlap, and a 200 arriving after a concurrent
+     * 429 does not mean the rate limit went away — clearing it here would send the next turn straight
+     * back into the limit. The cooldown expires on its own soon enough.
+     */
+    succeed(provider, id) {
+        const h = this.healthOf(provider, id);
+        if (h.cooldownUntil <= this.now())
+            h.cooldownUntil = 0;
+        h.quarantined = false;
+        h.failures = 0;
+    }
+    /** Operator action from the dashboard: give a parked credential another chance now. */
+    clear(provider, id) {
+        if (id) {
+            this.health.delete(this.key(provider, id));
+            return;
+        }
+        for (const key of [...this.health.keys()])
+            if (key.startsWith(`${provider}/`))
+                this.health.delete(key);
+    }
+    /** For the Health screen: why a credential is not being used, and for how long. */
+    report(provider, credentials) {
+        const now = this.now();
+        return credentials.map((c) => {
+            const h = this.healthOf(provider, c.id);
+            const cooling = !h.quarantined && h.cooldownUntil > now;
+            return {
+                id: c.id,
+                ...(c.label ? { label: c.label } : {}),
+                state: h.quarantined ? "quarantined" : cooling ? "cooling" : "ready",
+                ...(cooling ? { cooldownSeconds: Math.ceil((h.cooldownUntil - now) / 1000) } : {}),
+                failures: h.failures,
+            };
+        });
+    }
+    expireSticky() {
+        const cutoff = this.now() - this.stickyTtlMs;
+        for (const [conversation, held] of this.sticky)
+            if (held.at < cutoff)
+                this.sticky.delete(conversation);
+    }
+}
+/**
+ * The targets to try, in order, with duplicates removed. A fallback naming the same provider and
+ * model as one already in the list is a configuration mistake rather than a second chance.
+ */
+export function targets(primary, fallbacks = []) {
+    const out = [primary];
+    for (const f of fallbacks) {
+        if (out.some((t) => t.provider === f.provider && t.model === f.model))
+            continue;
+        out.push({ ...f, tag: `${f.provider}/${f.model}` });
+    }
+    return out;
+}

package/dist/router/src/presets.js

@@ -18,8 +18,12 @@ export const PRESETS = [
         // but no accepted effort-level set for its Anthropic endpoint; strip effort rather than guess.
         effortLevels: [],
         thinking: "enabled",
+        // Measured 2026-09-17, not documented: a `web_search_20250305` tool sent to this endpoint came
+        // back with server_tool_use, a web_search_tool_result holding ten hits, and
+        // usage.server_tool_use.web_search_requests = 1. DeepSeek runs the search itself.
+        serverTools: true,
         verified: true,
-        notes: "Anthropic thinking is accepted; budget_tokens is ignored.",
+        notes: "Anthropic thinking is accepted; budget_tokens is ignored. Runs web_search server-side (measured).",
         docsUrl: "https://api-docs.deepseek.com/guides/anthropic_api/",
     },
     // Docs: https://platform.kimi.ai/docs/api/overview
@@ -51,7 +55,13 @@ export const PRESETS = [
         vendorUrl: "https://z.ai/",
         anthropicBaseUrl: "https://api.z.ai/api/anthropic",
         authHeader: "authorization-bearer",
-        fallbackModels: [{ id: "glm-5.2", name: "GLM-5.2" }],
+        // No model list is served, so this list is the picker. glm-5.3-flash is named in
+        // https://docs.z.ai/guides/vlm/glm-5.3-flash; its FlashX sibling is not on the Coding Plan yet (issue #14).
+        fallbackModels: [
+            { id: "glm-5.3", name: "GLM-5.3" },
+            { id: "glm-5.3-flash", name: "GLM-5.3 Flash" },
+            { id: "glm-5.2", name: "GLM-5.2" },
+        ],
         // https://docs.z.ai/devpack/tool/others documents the endpoint but not an Anthropic effort/thinking contract.
         effortLevels: [],
         thinking: "none",
@@ -161,6 +171,157 @@ export const PRESETS = [
         notes: "Responses supports reasoning.effort; Chat Completions may vary by model. Model discovery is used instead of a stale fallback id.",
         docsUrl: "https://docs.x.ai/docs/guides/reasoning",
     },
+    // Docs: https://opencode.ai/docs/go/
+    //
+    // One subscription, one key, one `/models` catalog, three endpoints by which wire each model
+    // speaks: `/responses` for Muse Spark, Grok and GPT; `/chat/completions` for GLM, Kimi, DeepSeek,
+    // LongCat and MiMo; `/messages` (Anthropic) for MiniMax and Qwen. This used to be three presets
+    // because a provider carried one url and one wire; now a model carries its own wire, url and auth
+    // header (`ProviderModel`), so the account is one preset and `providerFor` folds the override in
+    // when the model is known. The provider-level values below are the Responses base — which is where
+    // Muse Spark lives, and the wire a model with no override gets.
+    //
+    // `x-opencode-session` is not optional at all: the vendor answers 400 `MissingSessionID` without
+    // it — "cannot be routed efficiently" — so it gates the request rather than just the cache.
+    //
+    // `/models` lists every model on the plan, the other two endpoints' models among them (measured
+    // 2026-09-18). Discovery therefore offers all three groups, and the wire each needs comes from
+    // this fallback list, which is the only place that fact is written down.
+    {
+        id: "opencode-go",
+        kind: "openai-compatible",
+        name: "OpenCode Go",
+        vendorUrl: "https://opencode.ai/go",
+        anthropicBaseUrl: "https://opencode.ai/zen/go/v1",
+        authHeader: "authorization-bearer",
+        wire: "responses",
+        sessionHeader: "x-opencode-session",
+        modelsUrl: "https://opencode.ai/zen/go/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        // Every wire below is from the endpoint table OpenCode publishes per model
+        // (https://opencode.ai/docs/ko/go/, read 2026-09-22) — the only place any of it is written
+        // down, since `/models` reports ids alone. Reading it off the family name instead is what left
+        // mimo-v2.6-pro on Responses, where the vendor answered 503 and the user saw an unexplained 529.
+        //
+        // No model states an effort ladder. The blanket empty one this list used to carry was an
+        // assumption rather than a measurement, and it was wrong: deepseek-v4.1-flash accepts all eight
+        // levels including max, and mimo-v2.6-pro accepts none/low/medium/high (measured 2026-09-22).
+        // It could not correct itself either — an empty ladder is never measured. Left unstated, each
+        // model's ladder is established on the first save.
+        fallbackModels: [
+            // Responses — the preset's own wire, so these carry no override.
+            { id: "muse-spark-1.3-contributor", name: "Muse Spark 1.3 (Contributor)" },
+            { id: "muse-spark-1.2-contributor", name: "Muse Spark 1.2 (Contributor)" },
+            { id: "grok-4.7", name: "Grok 4.7" },
+            { id: "grok-4.6", name: "Grok 4.6" },
+            { id: "gpt-5.6-luna", name: "GPT-5.6 Luna" },
+            // Chat Completions.
+            { id: "glm-5.3", name: "GLM-5.3", wire: "chat" },
+            { id: "glm-5.3-flash", name: "GLM-5.3 Flash", wire: "chat" },
+            { id: "glm-5.2", name: "GLM-5.2", wire: "chat" },
+            { id: "glm-5.1", name: "GLM-5.1", wire: "chat" },
+            { id: "kimi-k3", name: "Kimi K3", wire: "chat" },
+            { id: "kimi-k2.7-code", name: "Kimi K2.7 Code", wire: "chat" },
+            { id: "kimi-k2.6", name: "Kimi K2.6", wire: "chat" },
+            { id: "longcat-2.0", name: "LongCat 2.0", wire: "chat" },
+            { id: "deepseek-v4.1-flash", name: "DeepSeek V4.1 Flash", wire: "chat" },
+            { id: "deepseek-v4-pro", name: "DeepSeek V4 Pro", wire: "chat" },
+            { id: "deepseek-v4-flash", name: "DeepSeek V4 Flash", wire: "chat" },
+            { id: "mimo-v2.6-pro", name: "MiMo V2.6 Pro", wire: "chat" },
+            { id: "mimo-v2.6-flash", name: "MiMo V2.6 Flash", wire: "chat" },
+            { id: "mimo-v2.5-pro", name: "MiMo V2.5 Pro", wire: "chat" },
+            { id: "mimo-v2.5", name: "MiMo V2.5", wire: "chat" },
+            { id: "hy4-preview", name: "Hy4 Preview", wire: "chat" },
+            { id: "hy3", name: "Hy3", wire: "chat" },
+            // Anthropic Messages, which needs no translation. The url is deliberately one segment shorter
+            // than the provider's: an openai-compatible provider appends the endpoint name (`/responses`),
+            // so its base carries the `/v1`, but an anthropic-compatible one appends the caller's whole
+            // `/v1/messages` — a base ending in `/v1` would ask for `/v1/v1/messages`, which this vendor
+            // answers with its website, as a 404 page of HTML. Each endpoint follows the auth convention of
+            // the API it imitates, so these want Anthropic's header where the two OpenAI-wire groups on the
+            // same key want a bearer: measured 2026-09-18 with a deliberately wrong key, the header it does
+            // not recognise answers "Missing API key" and the one it does answers "Invalid API key".
+            { id: "minimax-m3", name: "MiniMax M3", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+            { id: "minimax-m2.7", name: "MiniMax M2.7", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+            { id: "qwen3.8-max", name: "Qwen3.8 Max", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+            { id: "qwen3.8-flash", name: "Qwen3.8 Flash", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+            { id: "qwen3.7-max", name: "Qwen3.7 Max", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+            { id: "qwen3.7-plus", name: "Qwen3.7 Plus", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+            { id: "qwen3.6-plus", name: "Qwen3.6 Plus", wire: "anthropic", url: "https://opencode.ai/zen/go", authHeader: "x-api-key" },
+        ],
+        // Measured 2026-09-18 against the live endpoint, one effort at a time: none, minimal, low,
+        // medium, high and xhigh are accepted; **max and ultra are refused** with invalid_request_error.
+        // The ladder therefore tops out at xhigh, which is unusual enough that reading it off the model
+        // card would have got it wrong twice — the first list here had max in it and no xhigh. It applies
+        // to the Responses models above; the Chat and Anthropic ones carry their own empty ladder.
+        effortLevels: ["none", "minimal", "low", "medium", "high", "xhigh"],
+        thinking: "none",
+        verified: true,
+        notes: "One subscription and key, three endpoints by wire. Measured 2026-09-18. Responses: Muse Spark answers, effort ladder tops out at xhigh, prompt cache reached 96% on a repeated turn. Chat: glm-5.3, glm-5.3-flash, kimi-k3, kimi-k2.7-code, deepseek-v4.1-flash, deepseek-v4-pro, longcat-2.0 and mimo-v2.5-pro all answered. Anthropic: minimax-m3, qwen3.8-max and qwen3.8-flash answered with the prompt cache at 99% on a repeated turn, while union-alpha, the free row, answered \"Model is unavailable\". The Muse Spark Contributor tier is ~90% cheaper because Meta states those interactions improve its products, and OpenCode refuses the model until the workspace opts in (403 DataPolicyError); it is also limited to some regions.",
+        docsUrl: "https://opencode.ai/docs/go/",
+    },
+    // Docs: https://opencode.ai/docs/zen/
+    //
+    // Zen and Go are two products on one account, not two names for one thing. Measured 2026-09-22:
+    // `/zen/v1/models` lists 76 models and `/zen/go/v1/models` 40, and neither contains the other —
+    // Muse Spark and the MiMo rows are Go's, the Claude and GPT rows are Zen's. The key is shared: a
+    // Go key answered 402 on Zen rather than 401, so what separates them is the base URL. Pointing a
+    // Zen key at Go's preset is what answers "This Go model requires Global regions", because the
+    // model it then asks for is one of Go's.
+    //
+    // Zen bills from a balance, not from the Go subscription: on an account holding a Go plan and no
+    // Zen credit, all three wires answered 402 "Insufficient account funds".
+    //
+    // It wants no session header. Go refuses a request without `x-opencode-session` (400
+    // MissingSessionID); Zen answered the same with it and without it, so none is sent.
+    {
+        id: "opencode-zen",
+        kind: "openai-compatible",
+        name: "OpenCode Zen",
+        vendorUrl: "https://opencode.ai/zen",
+        anthropicBaseUrl: "https://opencode.ai/zen/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://opencode.ai/zen/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        wire: "chat",
+        // Every wire here is from the endpoint table OpenCode publishes per model
+        // (https://opencode.ai/docs/ko/zen/, read 2026-09-22), not from guessing by family — guessing
+        // put Grok on Chat when it is on Responses, and Gemini on Chat when it is on neither.
+        //
+        // Two families are left out on purpose. Gemini is served at /zen/v1/models/<id>, Google's own
+        // shape, and jev at /systemone; ClaudeRipple speaks Chat Completions, Responses and Anthropic
+        // Messages, so there is nothing here that could carry them. They are still in the catalogue, so
+        // discovery will offer them; the measurement then finds no wire that answers and writes none.
+        //
+        // The Chat rows come first because the connection test posts to Chat Completions and takes the
+        // preset's first Chat model — deepseek-v4.1-flash, which the table says is served there.
+        fallbackModels: [
+            { id: "deepseek-v4.1-flash", name: "DeepSeek V4.1 Flash", wire: "chat" },
+            { id: "deepseek-v4-pro", name: "DeepSeek V4 Pro", wire: "chat" },
+            { id: "minimax-m3", name: "MiniMax M3", wire: "chat" },
+            { id: "glm-5.3", name: "GLM 5.3", wire: "chat" },
+            { id: "kimi-k3", name: "Kimi K3", wire: "chat" },
+            { id: "gpt-6-astra", name: "GPT 6 Astra", wire: "responses" },
+            { id: "gpt-5.6-sol", name: "GPT 5.6 Sol", wire: "responses" },
+            { id: "gpt-5.6-terra", name: "GPT 5.6 Terra", wire: "responses" },
+            { id: "gpt-5.6-luna", name: "GPT 5.6 Luna", wire: "responses" },
+            { id: "grok-4.7", name: "Grok 4.7", wire: "responses" },
+            { id: "muse-spark-1.3", name: "Muse Spark 1.3", wire: "responses" },
+            { id: "claude-opus-5", name: "Claude Opus 5", wire: "anthropic", url: "https://opencode.ai/zen", authHeader: "x-api-key" },
+            { id: "claude-sonnet-5", name: "Claude Sonnet 5", wire: "anthropic", url: "https://opencode.ai/zen", authHeader: "x-api-key" },
+            { id: "claude-fable-5-1", name: "Claude Fable 5.1", wire: "anthropic", url: "https://opencode.ai/zen", authHeader: "x-api-key" },
+            { id: "claude-haiku-4-5", name: "Claude Haiku 4.5", wire: "anthropic", url: "https://opencode.ai/zen", authHeader: "x-api-key" },
+            { id: "qwen3.8-flash", name: "Qwen3.8 Flash", wire: "anthropic", url: "https://opencode.ai/zen", authHeader: "x-api-key" },
+        ],
+        // A starting point for the measurement, not a measurement: an empty ladder would tell the
+        // router this provider takes no effort at all, and a model whose ladder is empty is never
+        // measured, so the levels Zen does take could never be found.
+        effortLevels: ["none", "minimal", "low", "medium", "high", "xhigh"],
+        thinking: "none",
+        verified: true,
+        notes: "Separate from OpenCode Go and separately billed: Zen draws on a credit balance while Go is the subscription, and the two catalogues differ (76 models against 40, neither a subset of the other). Measured 2026-09-22: the key is shared \u2014 a Go key reached Zen's billing rather than being refused \u2014 and no session header is required, unlike Go. Each model's endpoint is published per model and the three wires are split across families: DeepSeek, MiniMax, GLM and Kimi on Chat Completions, the GPT and Grok rows plus Muse Spark on Responses, and the Claude and Qwen rows on Anthropic Messages. Gemini (/zen/v1/models/<id>) and jev (/systemone) are served in shapes ClaudeRipple does not speak and are not offered here. Effort ladders are unverified: the account had no Zen balance, so the per-model measurement settles them on the first save.",
+        docsUrl: "https://opencode.ai/docs/zen/",
+    },
     // Docs: https://docs.mistral.ai/api/endpoint/chat and https://docs.mistral.ai/api/endpoint/models
     {
         id: "mistral",

package/dist/router/src/providers/anthropic-account-pool.js

@@ -0,0 +1,139 @@
+// Runtime view of Claude subscription accounts: current Claude Code/Desktop login first, followed by
+// ClaudeRipple-owned OAuth accounts. Stored grants are refreshed just before expiry and projected as
+// ordinary proxy credentials, so the shared CredentialPool supplies affinity, cooldown and retry.
+import crypto from "node:crypto";
+import { redactErrorText } from "../redact.js";
+import { markClaudeAccountNeedsReauth, readClaudeOAuthAccounts, replaceClaudeOAuthAccount, } from "./anthropic-accounts.js";
+import { ClaudeCodeAuthStore, nativeAnthropicHeaders, observedAnthropicHeaders, } from "./anthropic.js";
+import { CLAUDE_OAUTH, ClaudeOAuthTokenError, refreshClaudeOAuth, } from "./claude-oauth.js";
+function credentialId(ownerId, ...generation) {
+    // A fresh access or refresh token must not inherit the previous generation's quarantine. The digest
+    // is local runtime identity only; ownerId remains the durable account id shown by admin surfaces.
+    const hash = crypto.createHash("sha256");
+    for (const part of generation)
+        hash.update(String(part.length)).update(":").update(part);
+    return `${ownerId}:${hash.digest("hex").slice(0, 12)}`;
+}
+/** All account projections in this process share refresh work; the key contains no token material. */
+const refreshing = new Map();
+function refreshKey(home, account) {
+    const generation = crypto.createHash("sha256").update(account.refreshToken).digest("hex");
+    return `${home}\0${account.id}\0${generation}`;
+}
+export class ClaudeAccountAuthPool {
+    home;
+    now;
+    log;
+    fetchImpl;
+    current;
+    constructor(options) {
+        this.home = options.home;
+        this.now = options.now ?? Date.now;
+        this.log = options.log;
+        this.fetchImpl = options.fetch;
+        this.current = options.current ?? new ClaudeCodeAuthStore(undefined, {
+            home: options.home,
+            ...(options.observed ? { observed: options.observed } : {}),
+            ...(options.env ? { env: options.env } : {}),
+            ...(options.now ? { now: options.now } : {}),
+        });
+    }
+    /** Refresh all due stored accounts, with one network request per account in this process. */
+    async refreshIfNeeded() {
+        const due = readClaudeOAuthAccounts(this.home).filter((account) => !account.needsReauth && this.now() >= account.expiresAt - CLAUDE_OAUTH.refreshLeadMs);
+        await Promise.all(due.map((account) => this.refresh(account)));
+    }
+    refresh(account) {
+        const key = refreshKey(this.home, account);
+        const running = refreshing.get(key);
+        if (running)
+            return running;
+        const task = refreshClaudeOAuth(account.refreshToken, {
+            ...(this.fetchImpl ? { fetch: this.fetchImpl } : {}),
+            now: this.now,
+        }).then((grant) => {
+            if (replaceClaudeOAuthAccount(this.home, account.id, account.refreshToken, grant)) {
+                this.log.info(`claude account ${account.id.slice(0, 8)}: token refreshed, valid until ${new Date(grant.expiresAt).toISOString()}`);
+            }
+        }, (error) => {
+            // Only a definitive refresh-token rejection asks the user to sign in again. Network and 5xx
+            // failures leave the account recoverable; if its access token expires it simply drops out.
+            if (error instanceof ClaudeOAuthTokenError && error.needsReauth) {
+                markClaudeAccountNeedsReauth(this.home, account.id, account.refreshToken);
+                this.log.warn(`claude account ${account.id.slice(0, 8)}: refresh rejected; sign-in required`);
+            }
+            else {
+                const detail = redactErrorText(error.message, [account.token, account.refreshToken], 300);
+                this.log.warn(`claude account ${account.id.slice(0, 8)}: refresh failed: ${detail}`);
+            }
+        }).finally(() => refreshing.delete(key));
+        refreshing.set(key, task);
+        return task;
+    }
+    /** Fresh credentials for one turn. No token leaves this return value except as an HTTP header. */
+    async credentials() {
+        const ready = this.peekCredentials();
+        const refreshing = this.refreshIfNeeded();
+        // A due-but-unexpired access token remains usable while its refresh runs. Do not turn the
+        // five-minute refresh lead into request latency; wait only when no credential can be sent now.
+        if (ready.length > 0) {
+            void refreshing.catch((error) => this.log.warn(`claude account refresh task failed: ${error.message}`));
+            return ready;
+        }
+        await refreshing;
+        return this.peekCredentials();
+    }
+    /** Current projection without network I/O, used by status and pre-routing health checks. */
+    peekCredentials() {
+        const out = [];
+        const current = this.current.get();
+        let currentToken;
+        if (!(current instanceof Error)) {
+            if (current.source === "observed") {
+                currentToken = current.observed.authorization.replace(/^Bearer\s+/i, "");
+                out.push({
+                    id: credentialId("current", currentToken),
+                    ownerId: "current",
+                    label: "Current Claude session",
+                    headers: observedAnthropicHeaders(current.observed),
+                });
+            }
+            else {
+                currentToken = current.credentials.accessToken;
+                out.push({
+                    id: credentialId("current", currentToken),
+                    ownerId: "current",
+                    label: "Current Claude login",
+                    headers: nativeAnthropicHeaders({ type: "anthropic", auth: "claude-code" }, current.credentials),
+                });
+            }
+        }
+        for (const account of readClaudeOAuthAccounts(this.home)) {
+            if (account.needsReauth || this.now() >= account.expiresAt)
+                continue;
+            // The legacy single-account file is also what ClaudeCodeAuthStore read as current. Until the
+            // first migration write, omit that duplicate instead of trying the same token twice.
+            if (currentToken && account.token === currentToken)
+                continue;
+            out.push({
+                id: credentialId(account.id, account.token, account.refreshToken),
+                ownerId: account.id,
+                label: account.label,
+                headers: nativeAnthropicHeaders({ type: "anthropic", auth: "claude-code" }, { accessToken: account.token, expiresAt: account.expiresAt }),
+            });
+        }
+        return out;
+    }
+    /** Persist a rejected stored account as requiring re-login. The current CLI account stays external. */
+    reject(id) {
+        const ownerId = id.split(":", 1)[0];
+        if (ownerId === "current")
+            return;
+        const account = readClaudeOAuthAccounts(this.home).find((candidate) => candidate.id === ownerId);
+        // The 401 belongs to the token generation that made the request. A refresh or re-login may have
+        // replaced it while the request was in flight; never quarantine that newer grant for an old 401.
+        if (!account || credentialId(ownerId, account.token, account.refreshToken) !== id)
+            return;
+        markClaudeAccountNeedsReauth(this.home, ownerId, account.refreshToken);
+    }
+}