clauderipple 0.8.10 → 0.9.0

package/dist/router/src/admin.js

@@ -23,12 +23,20 @@ import path from "node:path";
 import http from "node:http";
 import { execFile, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { homeDir, searchProviderFor, validate } from "./config.js";
+import { adminPort, homeDir, searchProviderFor, validate } from "./config.js";
+export { adminPort } from "./config.js";
+import { generatedAgents } from "./agents.js";
+import { isJudgeOnlyModel } from "./model-policy.js";
+import { ModSettingsInputError, readModSettings, validateSettings, validateSettingsSchema, writeModSettings } from "./mod-settings.js";
+import { billingOf, claudeChoices, fillLadder, ladderNeedsFill } from "../../mod/hooks/ladder.js";
+import { normalizeSettings } from "../../mod/hooks/settings.js";
+import { chatPickerModels } from "./picker.js";
 import { PRESETS } from "./presets.js";
 import { resolveCompatibleCaps } from "./compat.js";
 import { CHATGPT_FALLBACK_MODELS } from "./providers/chatgpt/catalog.js";
 import { measureModel, refusedByPlan } from "./capabilities.js";
 import { catalogEntry } from "./catalog.js";
+import { ModelScoreCatalog, buildModelScores } from "./model-scores.js";
 import { ClaudeCodeAuthStore, nativeAnthropicHeaders } from "./providers/anthropic.js";
 import { fetchClaudeModels, newClaudeReleases } from "./providers/anthropic-models.js";
 import { codexEnabled, codexHome } from "../../cli/src/codex.js";
@@ -41,7 +49,7 @@ import { ClaudeOAuthSession } from "./providers/claude-oauth.js";
 import { readClaudeAuthFile } from "./providers/anthropic-token-file.js";
 import { listClaudeAccounts, removeClaudeAccount, renameClaudeAccount, setPreferredClaudeAccount } from "./providers/anthropic-accounts.js";
 import { readChatGptAccounts, removeChatGptAccount, summarize as summarizeChatGptAccount, updateChatGptAccount } from "./providers/chatgpt/accounts.js";
-import { IMAGE_ASPECTS, IMAGE_BACKGROUNDS, IMAGE_FORMATS } from "./providers/chatgpt/index.js";
+import { exhaustedForMs, IMAGE_ASPECTS, IMAGE_BACKGROUNDS, IMAGE_FORMATS } from "./providers/chatgpt/index.js";
 import { ANTIGRAVITY_WARNING, staticAntigravityModels } from "./providers/google/antigravity.js";
 import { readGoogleAccounts, removeGoogleAccount, summarize as summarizeGoogleAccount, updateGoogleAccount } from "./providers/google/accounts.js";
 import { GoogleOAuthSession } from "./providers/google/login.js";
@@ -193,9 +201,6 @@ async function claudeModelList(deps) {
     const live = await deps.claudeModels?.().catch(() => null);
     return live?.length ? live.map(({ line: _line, createdAt: _createdAt, ...model }) => ({ ...model, name: model.name ?? model.id })) : CLAUDE_MODEL_FALLBACK;
 }
-export function adminPort(cfg) {
-    return cfg.admin?.port ?? cfg.listen.port + 1;
-}
 function settingsPath() {
     return process.env.CLAUDE_SETTINGS_PATH ?? path.join(os.homedir(), ".claude", "settings.json");
 }
@@ -217,16 +222,6 @@ function readSettingsEnv() {
         return {};
     }
 }
-/** Whether ClaudeRipple's agent-title hook is registered in settings.json (see packages/cli/src/settings.ts). */
-function agentTitleHookEnabled() {
-    try {
-        const s = JSON.parse(fs.readFileSync(settingsPath(), "utf8"));
-        return (s.hooks?.PreToolUse ?? []).some((e) => e._clauderipple === "agent-title");
-    }
-    catch {
-        return false;
-    }
-}
 /** Newest mtime of the served GUI files; the page reloads itself when this changes (an open window would otherwise run stale JS). */
 function uiRevision() {
     try {
@@ -297,8 +292,119 @@ export function googleHealth(accounts) {
     const inRotation = accounts.filter((a) => a.state !== "paused" && a.state !== "needs-login");
     return inRotation.length > 0 && inRotation.every((a) => a.state === "needs-verification") ? { needsLogin: false, needsVerification: true } : { needsLogin: false };
 }
+/** Shared by status and mod options: refresh old quota, then read per-account rotation state. */
+async function chatgptStatus(deps, opts = {}) {
+    const chatgpt = deps.chatgpt?.() ?? { quota: {}, auth: {} };
+    const staleReasons = {};
+    const now = Date.now();
+    for (const [name, q] of Object.entries(chatgpt.quota)) {
+        if (!chatgpt.refresh)
+            break;
+        const at = q && typeof q.at === "number" ? q.at : 0;
+        if (!opts.refresh && at && now - at < 10 * 60 * 1000)
+            continue;
+        const fresh = await chatgpt.refresh(name);
+        if (fresh)
+            chatgpt.quota[name] = fresh;
+        else
+            staleReasons[name] = opts.refresh ? "refresh requested but lookup failed" : "lookup failed; showing last known value";
+    }
+    const signedIn = {};
+    for (const [name, p] of Object.entries(deps.config().providers)) {
+        if (p.type === "chatgpt")
+            signedIn[name] = chatgptSignedIn(p.auth);
+    }
+    return {
+        quota: chatgpt.quota, auth: chatgpt.auth, signedIn, accounts: chatgpt.accounts?.() ?? {},
+        ...(Object.keys(staleReasons).length ? { stale: true, staleReason: staleReasons } : {}),
+    };
+}
+const MOD_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+const modEfforts = (levels) => (levels ?? []).filter((level) => MOD_EFFORTS.includes(level));
+async function modOptions(deps, scores) {
+    const cfg = deps.config();
+    const chatgpt = await chatgptStatus(deps);
+    const google = deps.google?.().accounts() ?? {};
+    const credentials = deps.credentials?.() ?? {};
+    const health = deps.providerHealth?.() ?? {};
+    const providers = Object.entries(cfg.providers).map(([name, p]) => {
+        let usable = true;
+        if (p.type === "chatgpt") {
+            const accounts = chatgpt.accounts[name];
+            usable = accounts ? accounts.some(a => a.state === "ready" && !exhaustedForMs(a.quota))
+                : chatgpt.signedIn[name] === true && !exhaustedForMs(chatgpt.quota[name]);
+        }
+        else if (p.type === "google") {
+            usable = p.auth === "antigravity" ? (google[name] ?? []).some(a => a.state === "ready")
+                : !!(p.apiKey || process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY);
+        }
+        else if (p.type === "anthropic") {
+            usable = p.auth === "api-key" ? !!(p.apiKey || process.env.ANTHROPIC_API_KEY) : claudeAuthStore(deps).describeSource() !== null;
+        }
+        if (credentials[name])
+            usable = usable && credentials[name].some(c => c.state === "ready");
+        const exhausted = health[name];
+        return { name, type: p.type, usable: usable && !exhausted, billing: billingOf(p),
+            ...(exhausted ? { reason: exhausted.reason, exhaustedAt: exhausted.at, exhaustedUntil: exhausted.until } : {}), };
+    });
+    const models = Object.entries(cfg.providers).flatMap(([provider, p]) => (p.models ?? []).map(m => ({ model: m.id, provider, name: m.name ?? m.id, judgeOnly: isJudgeOnlyModel(m.id) })));
+    const zen = Object.values(cfg.providers).find(p => {
+        if (!p.models?.some(m => isJudgeOnlyModel(m.id)))
+            return false;
+        if ("preset" in p && p.preset === "opencode-zen")
+            return true;
+        if (!("url" in p) || !p.url)
+            return false;
+        const url = new URL(p.url);
+        return url.hostname === "opencode.ai" && /^\/zen\/v1(?:\/|$)/.test(url.pathname);
+    });
+    const model = zen?.models?.find(m => isJudgeOnlyModel(m.id))?.id ?? null;
+    const catalog = effortLevels(cfg).providers;
+    const agents = generatedAgents(cfg, deps.agentDir, undefined, deps.log).map(a => ({
+        ...a,
+        efforts: modEfforts(catalog[a.provider]?.models?.[a.model] ?? catalog[a.provider]?.default),
+        billing: billingOf(cfg.providers[a.provider], a.model),
+    }));
+    const scored = buildModelScores(cfg, await scores.get());
+    const claudeEfforts = modEfforts(catalog.anthropic?.default);
+    return { agents, models, providers, zen: { configured: model !== null, model }, scores: scored, claudeEfforts };
+}
+/**
+ * What the four workers can be filled from: the generated workers whose provider can run now, with
+ * their ladders, billing and cheapest measured cost, then Claude's own models (always there).
+ */
+function ladderChoices(options) {
+    const usable = new Set(options.providers.filter(p => p.usable).map(p => p.name));
+    return [
+        ...options.agents.filter(a => usable.has(a.provider)).map(a => {
+            const costs = (options.scores.models.find(m => m.model === a.model && m.provider === a.provider)?.variants ?? []).flatMap(v => typeof v.costPerTask === "number" ? [v.costPerTask] : []);
+            return { target: { agent: a.name }, model: a.model, provider: a.provider, billing: a.billing, efforts: a.efforts, ...(costs.length ? { cost: Math.min(...costs) } : {}) };
+        }),
+        ...claudeChoices(options.claudeEfforts),
+    ];
+}
+/**
+ * Fill empty ordered lists in Base and saved modes from the same ticked, connected choices.
+ * Existing lists survive availability and allow-list changes; dispatch handles skips.
+ */
+async function withFilledLadder(deps, scores, settings) {
+    const general = settings.rules.general;
+    if (![general, ...settings.modes].some(set => ladderNeedsFill(set.rungs)))
+        return settings;
+    try {
+        const choices = ladderChoices(await modOptions(deps, scores));
+        const { rungs } = fillLadder(general.rungs, settings.allow, choices);
+        const modes = settings.modes.map(mode => ({ ...mode, rungs: fillLadder(mode.rungs, settings.allow, choices).rungs }));
+        return { ...settings, rules: { general: { mode: "ladder", rungs } }, modes };
+    }
+    catch (error) {
+        deps.log.warn(`admin: filling the worker ladder failed: ${error.message}`);
+        return settings;
+    }
+}
 async function buildStatus(deps, opts = {}) {
     const cfg = deps.config();
+    const health = deps.providerHealth?.() ?? {};
     const providers = {};
     // Keyed in the order the config lists them. Assigning inside the Promise.all callbacks ordered
     // them by whichever TCP check answered first, so the Health list reshuffled on every poll.
@@ -316,6 +422,8 @@ async function buildStatus(deps, opts = {}) {
                 url,
                 type: p.type,
                 reachable,
+                usable: reachable && !health[name],
+                ...(health[name] ? { exhaustion: health[name] } : {}),
                 // Whether the router could run a `WebSearch` side request through this provider, so the
                 // Clients screen can say so beside a model name. Nothing on that screen said which ones
                 // those are, and a `smallFast` slot pointed at one turns every search into a visible failure
@@ -348,35 +456,7 @@ async function buildStatus(deps, opts = {}) {
     }));
     for (const [name, entry] of checked)
         providers[name] = entry;
-    const chatgpt = deps.chatgpt?.() ?? { quota: {}, auth: {} };
-    // A snapshot from response headers ages the moment GPT traffic stops: measured 2026-09-20, the
-    // status route showed 1% from 11 hours earlier while the account was at 40%. Past ten minutes,
-    // ask the backend directly. The lookup shares one in-flight promise per provider, so concurrent
-    // status polls (the GUI does one every 5s) collapse into a single request. A failed lookup keeps
-    // the last good numbers and says why, rather than blanking the read the budget decision uses.
-    const STALE_MS = 10 * 60 * 1000;
-    const staleReasons = {};
-    const refresh = deps.chatgpt?.().refresh;
-    if (refresh) {
-        const now = Date.now();
-        for (const [name, q] of Object.entries(chatgpt.quota)) {
-            const at = q && typeof q.at === "number" ? q.at : 0;
-            if (!opts.refresh && at && now - at < STALE_MS)
-                continue;
-            const fresh = await refresh(name);
-            if (fresh)
-                chatgpt.quota[name] = fresh;
-            else
-                staleReasons[name] = opts.refresh ? "refresh requested but lookup failed" : "lookup failed; showing last known value";
-        }
-    }
-    const stale = Object.keys(staleReasons).length > 0;
-    const signedIn = {};
-    for (const [name, p] of Object.entries(cfg.providers)) {
-        if (p.type !== "chatgpt")
-            continue;
-        signedIn[name] = chatgptSignedIn(p.auth);
-    }
+    const chatgpt = await chatgptStatus(deps, opts);
     const env = readSettingsEnv();
     const wantProxy = `http://127.0.0.1:${cfg.listen.port}`;
     const picker = deps.picker?.() ?? { enabled: false, hosts: [], last: null };
@@ -420,15 +500,14 @@ async function buildStatus(deps, opts = {}) {
         cliVersion: cliVersion(),
         // `quota` stays one snapshot per provider (the account in use) for the readers that want one
         // number; `accounts` is the per-account view, read after the refresh above so it is as fresh.
-        chatgpt: { ...chatgpt, signedIn, accounts: chatgpt.accounts?.() ?? {}, ...(stale ? { stale: true, staleReason: staleReasons } : {}) },
+        chatgpt,
         ...(deps.claudeUsage && hasClaudeSubscription(cfg) ? { claude: { accounts: await claudeAccountUsage(deps) } } : {}),
         // Only present for providers that declare a pool; a provider with one credential has nothing
         // to report and would only add a row that never changes.
         credentials: deps.credentials?.() ?? {},
         picker,
-        agentTitle: agentTitleHookEnabled(),
         statusMod: statusModEnabled(),
-        pickerModels: cfg.cli.extraModels.map((m) => m.name || m.model),
+        pickerModels: chatPickerModels(cfg).map((m) => m.name || m.model),
         uiRevision: uiRevision(),
     };
 }
@@ -581,15 +660,17 @@ export function parseImageRequest(raw) {
     }
     return out;
 }
-function readBody(req, limit = MAX_BODY) {
+function readBody(req, limit = MAX_BODY, overflowError) {
     return new Promise((resolveP, reject) => {
         const chunks = [];
         let n = 0;
         req.on("data", (c) => {
             n += c.length;
             if (n > limit) {
-                reject(new Error("body too large"));
-                req.destroy();
+                chunks.length = 0;
+                reject(overflowError ?? new Error("body too large"));
+                if (!overflowError)
+                    req.destroy(); // mod saves must receive their 413, not a reset
                 return;
             }
             chunks.push(c);
@@ -1224,7 +1305,7 @@ async function pickerModels(deps) {
         const injected = new Set(deps.config().cli.extraModels.map((m) => m.model));
         const seen = new Set();
         const models = entries.filter((e) => {
-            if (injected.has(e.id) || seen.has(e.id))
+            if (injected.has(e.id) || seen.has(e.id) || isJudgeOnlyModel(e.id))
                 return false;
             seen.add(e.id);
             return true;
@@ -1246,7 +1327,9 @@ function tailLines(file, n) {
 }
 function safeStaticPath(urlPath) {
     const decoded = decodeURIComponent(urlPath.split("?")[0] ?? "/");
-    const rel = decoded === "/" ? "index.html" : decoded.replace(/^\/+/, "");
+    // Clients that ask for /favicon.ico without reading the page's <link rel="icon"> get the PNG;
+    // browsers sniff the bytes, so a PNG served for .ico shows.
+    const rel = decoded === "/" ? "index.html" : decoded === "/favicon.ico" ? "favicon-32.png" : decoded.replace(/^\/+/, "");
     const full = path.resolve(UI_ROOT, rel);
     const rootWithSep = UI_ROOT.endsWith(path.sep) ? UI_ROOT : UI_ROOT + path.sep;
     if (full !== UI_ROOT && !full.startsWith(rootWithSep))
@@ -1290,6 +1373,7 @@ function serveStatic(urlPath, res) {
     });
 }
 export function startAdmin(deps) {
+    const scores = new ModelScoreCatalog({ home: homeDir(), warn: message => deps.log.warn(message), ...(deps.modelScoresFetch ? { fetch: deps.modelScoresFetch } : {}) });
     // Set again once the socket is bound (port 0 in tests); the Origin check below compares against it.
     let boundPort = adminPort(deps.config());
     const server = http.createServer((req, res) => {
@@ -1349,6 +1433,36 @@ export function startAdmin(deps) {
                 sendJson(res, 200, await buildStatus(deps, { refresh }));
                 return;
             }
+            if (pathname === "/api/mod-settings" && method === "GET") {
+                const snapshot = readModSettings();
+                // Filled here as well as on save, so a ladder with empty rungs (Auto migrated, or never set) reads whole to every surface.
+                sendJson(res, 200, { ...snapshot, settings: await withFilledLadder(deps, scores, snapshot.settings) });
+                return;
+            }
+            if (pathname === "/api/mod-settings" && method === "PUT") {
+                const bytes = await readBody(req, MAX_BODY, new ModSettingsInputError("body too large", 413));
+                let parsed;
+                try {
+                    parsed = JSON.parse(bytes.toString("utf8"));
+                }
+                catch {
+                    throw new ModSettingsInputError("invalid JSON");
+                }
+                validateSettingsSchema(parsed);
+                const body = parsed;
+                if (body && typeof body === "object" && body.settings && typeof body.settings === "object" && !Array.isArray(body.settings)) {
+                    // Checked before normalizing, which would drop a credential field the check is there to refuse.
+                    validateSettings(body.settings);
+                    body.settings = await withFilledLadder(deps, scores, normalizeSettings(body.settings));
+                }
+                const result = writeModSettings(parsed);
+                sendJson(res, result.stale ? 409 : 200, result.current);
+                return;
+            }
+            if (pathname === "/api/mod-options" && method === "GET") {
+                sendJson(res, 200, await modOptions(deps, scores));
+                return;
+            }
             if (pathname === "/api/presets" && method === "GET") {
                 sendJson(res, 200, { presets: PRESETS });
                 return;
@@ -2070,6 +2184,10 @@ export function startAdmin(deps) {
             sendJson(res, 404, { error: "not found" });
         }
         catch (e) {
+            if (e instanceof ModSettingsInputError && !res.headersSent) {
+                sendJson(res, e.status, { error: e.message });
+                return;
+            }
             deps.log.error(`admin error: ${e.stack ?? e}`);
             if (!res.headersSent)
                 sendJson(res, 500, { error: e.message });

package/dist/router/src/agents.js

@@ -12,9 +12,9 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { homeDir } from "./config.js";
+import { adminPort, homeDir } from "./config.js";
 import { declaredBy } from "./routing.js";
-import { adminPort } from "./admin.js";
+import { isJudgeOnlyModel } from "./model-policy.js";
 import { shortName } from "../../cli/src/hooks/agent-title.js";
 /** Where Claude Code's Agent tool reads its worker definitions. */
 export function defaultAgentDir() {
@@ -33,8 +33,8 @@ const BODY = [
     "너는 이 세션의 실행자다. 위임받은 작업을 직접 끝내고 직접 검증해서 결론만 간결히 보고한다.",
     "파일 전문·코드 덤프는 보고에 넣지 않는다. 추측은 추측이라 명시하고 근거는 파일:줄번호로 댄다.",
     "다른 에이전트에게 넘기지 않는다. 프롬프트 첫 줄의 `[[ripple: …]]` 표식은 라우팅용이니 무시한다.",
-    "**작업 디렉터리(cwd)에 어떤 파일도 만들지 않는다.** 조사·감사처럼 \"읽기만\" 하는 일이어도 마찬가지다.",
-    "임시 파일이 필요하면 `/tmp` 아래에만 만들고, 끝나면 지운다. 사본을 작업 폴더에 떨구지 마라.",
+    "**시키지 않은 파일은 만들지 않는다.** 작업 지시에 결과물 경로가 없으면 조사·감사라도 작업 디렉터리(cwd)에 아무 파일도 남기지 않는다.",
+    "작업 지시가 결과물 경로(파일·폴더)를 정했으면 조사·감사·대조 작업이라도 그 경로에는 반드시 만든다. 그 밖의 메모·사본·임시 파일은 `/tmp` 아래에만 만들고, 끝나면 지운다.",
 ].join("\n");
 /**
  * Added to the body when a ChatGPT provider is configured: how a worker makes an image. A worker has
@@ -134,7 +134,7 @@ function scanDir(dir, log) {
 export function agentAliases(dir, log) {
     const out = {};
     for (const entry of scanDir(dir, log).values()) {
-        if (!entry.model)
+        if (!entry.model || isJudgeOnlyModel(entry.model))
             continue;
         out[entry.name] = entry.model.replace(/@[a-z]+$/i, "");
     }
@@ -190,6 +190,23 @@ function readManifest(file) {
     }
     return { agents: [] };
 }
+/** Owned files that still exist and name a configured worker, not hand-written agents. */
+export function generatedAgents(cfg, dir = defaultAgentDir(), manifestPath = path.join(homeDir(), "generated-agents.json"), log) {
+    const owned = new Set(readManifest(manifestPath).agents);
+    const result = [];
+    for (const entry of scanDir(dir, log).values()) {
+        if (!owned.has(entry.name) || !entry.model || isJudgeOnlyModel(entry.model))
+            continue;
+        const model = entry.model.replace(/@[a-z]+$/i, "");
+        const owners = declaredBy(model, cfg);
+        const provider = owners.length === 1 ? owners[0] : undefined;
+        const target = provider ? cfg.providers[provider] : undefined;
+        if (!provider || !target || (target.type === "anthropic" && !target.accountPool))
+            continue;
+        result.push({ name: entry.name, model, provider });
+    }
+    return result.sort((a, b) => a.name.localeCompare(b.name));
+}
 function writeManifest(file, manifest, log) {
     try {
         fs.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n");
@@ -224,6 +241,8 @@ export function syncAgentFiles(cfg, dir, log, opts = {}) {
         if (provider.type === "anthropic" && !provider.accountPool)
             continue;
         for (const model of provider.models ?? []) {
+            if (isJudgeOnlyModel(model.id))
+                continue;
             const owners = declaredBy(model.id, cfg);
             if (owners.length !== 1) {
                 if (owners.length > 1)

package/dist/router/src/bootstrap.js

@@ -6,6 +6,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { agentAliases } from "./agents.js";
+import { isJudgeOnlyModel } from "./model-policy.js";
+import { chatPickerModels } from "./picker.js";
 export const BOOTSTRAP_PATH = "/api/claude_cli/bootstrap";
 /**
  * Model ids named in the user's agent definitions (~/.claude/agents/*.md frontmatter `model:`),
@@ -27,7 +29,7 @@ export function agentModelIds(dirs = [path.join(os.homedir(), ".claude", "agents
             try {
                 const head = fs.readFileSync(path.join(dir, f), "utf8").slice(0, 8192);
                 const m = /^model:\s*['"]?([A-Za-z0-9._\/:\-]+(?:@[a-z]+)?)/m.exec(head);
-                if (m)
+                if (m && !isJudgeOnlyModel(m[1]))
                     out.add(m[1]);
             }
             catch {
@@ -60,7 +62,7 @@ export function injectBootstrap(body, cfg, agentDirs) {
         // An "<model>@<effort>" entry is the same model with a different effort, so it has the same window.
         return { model: id, name: `${named?.name ?? base}${effort ? ` · ${effort}` : ""}`, ...(named?.contextWindow ? { contextWindow: named.contextWindow } : {}) };
     });
-    const extra = [...cfg.cli.extraModels, ...fromAgents];
+    const extra = chatPickerModels({ ...cfg, aliases, cli: { ...cfg.cli, extraModels: [...cfg.cli.extraModels, ...fromAgents] } });
     const win = cfg.cli.autoCompactWindow;
     // Routed models do not share a context window; the global value is only the fallback for entries
     // that do not name their own, so a per-entry window alone is reason enough to write the map.

package/dist/router/src/config.js

@@ -117,6 +117,9 @@ export const DEFAULTS = {
     health: { maxConsecutiveUpstreamFailures: 20 },
     log: { maxBytes: 5 * 1024 * 1024, keep: 3 },
 };
+export function adminPort(cfg) {
+    return cfg.admin?.port ?? cfg.listen.port + 1;
+}
 export function homeDir() {
     return process.env.CLAUDERIPPLE_HOME ?? path.join(os.homedir(), ".clauderipple");
 }

package/dist/router/src/health.js

@@ -2,6 +2,39 @@
 // stays bad (observed: 10h of ENOTFOUND, 11 remote-control workers lost). After N
 // consecutive upstream *connect-level* failures with no success in between, exit
 // with a distinctive code so the supervisor restarts a fresh process.
+/** Only definite billing/quota exhaustion, never a bare rate limit or RESOURCE_EXHAUSTED.
+ * 402 is already `exhausted` in pool.ts; Codex's usage_limit_reached is named in
+ * providers/chatgpt/translate.ts. Other vendors share the explicit billing vocabulary.
+ * Reasons are codes, not upstream prose (which can contain credentials).
+ */
+export function providerExhaustion(status, body = "", retryMs, now = Date.now()) {
+    if (status !== 402 && status !== 429)
+        return undefined;
+    const balance = /\b(?:insufficient[_ -]+(?:balance|credits?|funds)|(?:balance|credits?)[_ -]+(?:insufficient|exhausted|depleted))\b/i.test(body);
+    const billing = /\bbilling[_ -]+(?:hard[_ -]+)?(?:limit|exhausted|quota)|\b(?:exhausted|exceeded|insufficient)[_ -]+billing\b/i.test(body);
+    const quota = /\b(?:insufficient_quota|usage_limit_reached|quota[_ -]+exhausted|exhausted[_ -]+quota)\b/i.test(body);
+    if (status !== 402 && !balance && !billing && !quota)
+        return undefined;
+    const reason = balance ? "insufficient_balance" : billing || status === 402 ? "billing_exhausted" : "quota_exhausted";
+    const wait = retryMs !== undefined && Number.isFinite(retryMs) && retryMs > 0 ? retryMs : 30 * 60_000;
+    return { reason, at: now, until: now + wait };
+}
+/** Per router instance, advisory only: manual traffic can prove a topped-up provider healthy. */
+export class ProviderHealth {
+    exhausted = new Map();
+    observe(provider, status, exhaustion) {
+        if (exhaustion)
+            this.exhausted.set(provider, exhaustion);
+        else if (status >= 200 && status < 300)
+            this.exhausted.delete(provider);
+    }
+    snapshot(now = Date.now()) {
+        for (const [name, value] of this.exhausted)
+            if (value.until <= now)
+                this.exhausted.delete(name);
+        return Object.fromEntries(this.exhausted);
+    }
+}
 export const EXIT_UPSTREAM_UNREACHABLE = 75;
 const CONNECT_ERRORS = new Set([
     "ENOTFOUND",

package/dist/router/src/index.js

@@ -144,6 +144,7 @@ proxy
         log: log,
         stats: () => proxy.stats,
         health: () => health.consecutiveFailures,
+        providerHealth: () => proxy.providerHealth.snapshot(),
         version: VERSION,
         requests,
         chatgpt: () => ({

package/dist/router/src/ingress/models.js

@@ -3,11 +3,12 @@
 // `GET /v1/models` and by the Codex model catalog that puts these names in the Codex app picker.
 import { effortLevels } from "../admin.js";
 import { claudeSupportsEffort } from "./translate.js";
+import { isJudgeOnlyModel } from "../model-policy.js";
 export function ingressModels(cfg) {
     const levels = effortLevels(cfg).providers;
     const out = new Map();
     const add = (id, provider, name, explicit) => {
-        if (out.has(id))
+        if (out.has(id) || isJudgeOnlyModel(id))
             return;
         const p = cfg.providers[provider];
         if (!p || (p.type !== "anthropic" && p.type !== "anthropic-compatible"))
@@ -22,6 +23,8 @@ export function ingressModels(cfg) {
             add(model.id, name, model.name, model.effortLevels);
     }
     for (const [id, route] of Object.entries(cfg.routes)) {
+        if (isJudgeOnlyModel(route.model))
+            continue;
         const target = cfg.providers[route.provider]?.models?.find((m) => m.id === route.model);
         add(id, route.provider, target?.name, target?.effortLevels);
     }

package/dist/router/src/mod-settings.js

@@ -0,0 +1,119 @@
+// Persistence and normalization have one source each: the router's locked store
+// and the mod's pure schema (no claude-code runtime dependency).
+import fs from "node:fs";
+import path from "node:path";
+import { homeDir } from "./config.js";
+import { withFileLock, writeJsonAtomic } from "./locked-file.js";
+import { MOD_SETTINGS_SCHEMA_VERSION, hadRetiredRouting, normalizeSettings } from "../../mod/hooks/settings.js";
+export const MAX_MOD_SETTINGS_BYTES = 64 * 1024;
+export class ModSettingsInputError extends Error {
+    status;
+    constructor(message, status = 400) { super(message); this.status = status; }
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function revision(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+/**
+ * A field that holds a credential: its last word is key, token, secret, password or the like
+ * (`apiKey`, `access_token`, `typesafeKey`). The last word decides, so a count such as
+ * `keepWarmMinTokens` — a setting the mod has — is not mistaken for one.
+ */
+function isSecretName(key) {
+    const last = key.split(/[^A-Za-z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).filter(Boolean).at(-1)?.toLowerCase() ?? "";
+    return ["key", "apikey", "token", "secret", "password", "passwd", "authorization", "credential", "credentials", "bearer"].includes(last);
+}
+/** Iterative traversal also checks objects nested in arrays, without a recursion limit. */
+function hasSecretKey(settings) {
+    const pending = [settings];
+    while (pending.length) {
+        const value = pending.pop();
+        if (Array.isArray(value))
+            pending.push(...value);
+        else if (object(value)) {
+            for (const [key, child] of Object.entries(value)) {
+                if (isSecretName(key))
+                    return true;
+                pending.push(child);
+            }
+        }
+    }
+    return false;
+}
+export function validateSettings(settings) {
+    if (!object(settings))
+        throw new ModSettingsInputError("settings must be a JSON object");
+    if (Buffer.byteLength(JSON.stringify(settings), "utf8") > MAX_MOD_SETTINGS_BYTES)
+        throw new ModSettingsInputError("settings exceeds 64 KiB", 413);
+    if (hasSecretKey(settings))
+        throw new ModSettingsInputError("settings must not contain credential fields (key, token, secret, password)");
+}
+export function readModSettings(home = homeDir()) {
+    let text;
+    try {
+        text = fs.readFileSync(path.join(home, "mod-settings.json"), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { settings: normalizeSettings(null), revision: 0, stored: false };
+        throw error;
+    }
+    // Corruption is not an empty store: fail rather than silently overwrite it.
+    const stored = JSON.parse(text);
+    if (!object(stored) || !revision(stored.revision) || stored.revision < 1)
+        throw new Error("invalid mod settings store");
+    validateSettings(stored.settings);
+    // Auto and field rules are gone: the dashboard says so once, until the next save drops them.
+    return { settings: normalizeSettings(stored.settings), revision: stored.revision, stored: true, ...(hadRetiredRouting(stored.settings) ? { legacy: true } : {}) };
+}
+/** Reject old writers before normalization/fill can erase evidence of their format. */
+export function validateSettingsSchema(body) {
+    if (!object(body))
+        throw new ModSettingsInputError("body must be a JSON object");
+    if (body.schemaVersion !== MOD_SETTINGS_SCHEMA_VERSION)
+        throw new ModSettingsInputError("settings schema unsupported; reload ClaudeRipple before saving", 426);
+}
+/** Exact previous bytes, not the normalized read view; backup failure aborts the write. */
+function backupModSettings(file, previousRevision) {
+    const backup = `${file}.bak-${previousRevision}`;
+    fs.copyFileSync(file, backup);
+    fs.chmodSync(backup, 0o600);
+    const fd = fs.openSync(backup, "r");
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const backups = fs.readdirSync(path.dirname(file)).filter(name => /^mod-settings\.json\.bak-\d+$/.test(name))
+        .sort((a, b) => Number(b.split("-").at(-1)) - Number(a.split("-").at(-1)));
+    for (const name of backups.slice(10))
+        fs.unlinkSync(path.join(path.dirname(file), name));
+}
+/** Compare-and-swap and revision increment share the account stores' cross-process lock. */
+export function writeModSettings(body, home = homeDir()) {
+    if (!object(body))
+        throw new ModSettingsInputError("body must be a JSON object");
+    validateSettingsSchema(body);
+    validateSettings(body.settings);
+    if (body.revision !== undefined && !revision(body.revision))
+        throw new ModSettingsInputError("revision must be a non-negative safe integer");
+    const settings = normalizeSettings(body.settings);
+    validateSettings(settings);
+    const expected = body.revision;
+    const file = path.join(home, "mod-settings.json");
+    return withFileLock(file, () => {
+        const current = readModSettings(home);
+        if (expected !== undefined && expected !== current.revision)
+            return { stale: true, current };
+        if (current.revision === Number.MAX_SAFE_INTEGER)
+            throw new Error("mod settings revision exhausted");
+        const next = { settings, revision: current.revision + 1, stored: true };
+        if (current.stored)
+            backupModSettings(file, current.revision);
+        writeJsonAtomic(file, next);
+        return { stale: false, current: next };
+    });
+}

package/dist/router/src/model-policy.js

@@ -0,0 +1,6 @@
+// OpenCode Zen's presets.ts note documents jev's /systemone-only judging shape:
+// it cannot answer an ordinary chat/Responses/Messages turn. Keep it configurable
+// for judges, but never advertise it as a chat model or generate a worker for it.
+export function isJudgeOnlyModel(modelId) {
+    return modelId.toLowerCase().startsWith("jev");
+}