context-doctor 0.31.0 → 0.32.0

package/dist/parse.js

@@ -51,6 +51,23 @@ function flattenContent(content) {
                 hasBinary = true;
                 text += `[${b.type}]`;
                 break;
+            // OpenAI's media blocks (Chat Completions and Responses). Stringified,
+            // a 300 KB base64 data URL counted as ~75k text tokens and tripped the
+            // base64 finding; it is an attachment, counted like Anthropic's above.
+            case "image_url":
+            case "input_image":
+                hasBinary = true;
+                text += "[image]";
+                break;
+            case "input_audio":
+                hasBinary = true;
+                text += "[audio]";
+                break;
+            case "file":
+            case "input_file":
+                hasBinary = true;
+                text += "[file]";
+                break;
             case "thinking":
                 // Count the thinking text but NOT the signature — it is an opaque
                 // base64 blob the API requires, not something the user can trim.
@@ -71,7 +88,8 @@ function normalizeMessage(rawInput, index) {
     const raw = rawInput && typeof rawInput === "object" ? rawInput : {};
     const role = String(raw.role ?? "user");
     const flat = flattenContent(raw.content);
-    let kind = flat.kind ?? (["system", "user", "assistant"].includes(role) ? role : "other");
+    // OpenAI's "developer" role is the system prompt under its newer name (o1 onward).
+    let kind = flat.kind ?? (role === "developer" ? "system" : ["system", "user", "assistant"].includes(role) ? role : "other");
     let toolName = flat.toolName;
     let text = flat.text;
     let toolCallText = flat.toolCallText;
@@ -93,30 +111,36 @@ function normalizeMessage(rawInput, index) {
     }
     return { index, role, kind, text, toolName, toolCallText, hasBinary: flat.hasBinary, isError: flat.isError };
 }
+/** Raw text: the whole input as one user message, so profiling still works for raw prompts. */
+function rawText(input, parseError) {
+    // If it LOOKS like JSON, the user handed us a broken conversation file and
+    // deserves to be told, not given a report about a single 9-token "message".
+    const head = input.trimStart()[0];
+    const parseWarning = input.trim() === ""
+        ? "Input is empty — nothing to profile."
+        : parseError && (head === "{" || head === "[")
+            ? `Input starts like JSON but does not parse (${parseError.message}). Profiling it as raw text, which is almost certainly not what you want.`
+            : undefined;
+    return {
+        sourceFormat: "text",
+        parseWarning,
+        // Empty input has no message: reporting "1 message, ~4 tokens" for it
+        // would be inventing content that is not there.
+        messages: input.trim() === "" ? [] : [{ index: 0, role: "user", kind: "user", text: input, hasBinary: false }],
+    };
+}
 export function parseConversation(input) {
     let data;
     try {
         data = JSON.parse(input);
     }
     catch (e) {
-        // Not JSON — treat the whole thing as one user message so profiling still
-        // works for raw prompts. But if it LOOKS like JSON, the user handed us a
-        // broken conversation file and deserves to be told, not given a report
-        // about a single 9-token "message".
-        const head = input.trimStart()[0];
-        const parseWarning = input.trim() === ""
-            ? "Input is empty — nothing to profile."
-            : head === "{" || head === "["
-                ? `Input starts like JSON but does not parse (${e.message}). Profiling it as raw text, which is almost certainly not what you want.`
-                : undefined;
-        return {
-            sourceFormat: "text",
-            parseWarning,
-            // Empty input has no message: reporting "1 message, ~4 tokens" for it
-            // would be inventing content that is not there.
-            messages: input.trim() === "" ? [] : [{ index: 0, role: "user", kind: "user", text: input, hasBinary: false }],
-        };
+        return rawText(input, e);
     }
+    // A prompt can happen to be valid JSON ("2024", a quoted sentence, null):
+    // that is still a raw prompt, not a conversation with no messages.
+    if (data === null || typeof data !== "object")
+        return rawText(input);
     if (Array.isArray(data)) {
         const looksLikeMessages = data.length === 0 || data.some((m) => m && typeof m === "object" && "role" in m);
         return {

package/dist/pricing.d.ts

@@ -1,21 +1,73 @@
 /**
  * Per-model pricing for cost estimation, USD per million tokens.
  *
- * Anthropic prices are current as of mid-2026 (first-party API list rates).
- * OpenAI/Google figures are approximate public list prices and drift over
- * time — all cost output is labeled as an estimate. One table, one file,
- * easy to update: PRs welcome when prices change.
+ * Anthropic prices are first-party API list rates, checked against
+ * Anthropic's price list in October 2026. OpenAI/Google figures are
+ * approximate public list prices and drift over time — all cost output is
+ * labeled as an estimate. One table, one file, easy to update: PRs welcome
+ * when prices change.
  */
 export interface ModelPricing {
     /** USD per 1M input tokens. */
     inputPerM: number;
     /** USD per 1M output tokens (unused by the profiler, kept for reference). */
     outputPerM: number;
-    /** USD per 1M cached input tokens read (≈10% of input for Claude/OpenAI). */
+    /** USD per 1M cached input tokens read (2.5-10% of input, depending on the Claude model). */
     cacheReadPerM: number;
 }
+/** Anthropic cache writes, relative to the input price: 5-minute TTL and 1-hour TTL. */
+export declare const CACHE_WRITE_5M = 1.25;
+export declare const CACHE_WRITE_1H = 2;
 export declare function pricingFor(model?: string): ModelPricing | undefined;
 export declare function inputCostUsd(tokens: number, pricing: ModelPricing): number;
+/** `usage` as the API returns it and Claude Code records it on each reply. */
+export interface RecordedUsage {
+    input_tokens?: unknown;
+    cache_creation_input_tokens?: unknown;
+    cache_read_input_tokens?: unknown;
+    output_tokens?: unknown;
+    /** The cache writes split by TTL; absent in older transcripts. */
+    cache_creation?: {
+        ephemeral_5m_input_tokens?: unknown;
+        ephemeral_1h_input_tokens?: unknown;
+    } | null;
+}
+export interface UsageCost {
+    /** Uncached input. */
+    inputUsd: number;
+    /** Cache writes, each TTL at its own price. */
+    writeUsd: number;
+    readUsd: number;
+    outputUsd: number;
+    /** input + writes + reads: what the prompt cost. */
+    promptUsd: number;
+    totalUsd: number;
+}
+/**
+ * A request's cache writes by TTL. Claude Code's main thread writes almost
+ * everything at the 1-hour TTL (2x input) and subagents at 5 minutes
+ * (1.25x), so a single 1.25x multiplier underpriced most writes by 37%.
+ * Usage recorded without the split counts as 5-minute writes, the API's
+ * default TTL.
+ */
+export declare function cacheWriteSplit(usage: RecordedUsage | undefined | null): {
+    fiveMinute: number;
+    oneHour: number;
+};
+/**
+ * The write price, relative to input, of a mix of 5-minute and 1-hour
+ * writes. Simulations that charge a write that never happened (a cold
+ * re-read, a compaction's fresh context) use the session's own mix, since
+ * that is the TTL its harness would have written at; 1.25x when nothing was
+ * written to learn from.
+ */
+export declare function writeMultiplier(fiveMinute: number, oneHour: number): number;
+/**
+ * What one recorded request cost: uncached input, cache writes priced by
+ * TTL, cache reads, output. The one place recorded usage is priced, so every
+ * report agrees with the others and with the bill.
+ */
+export declare function usageCost(usage: RecordedUsage | undefined | null, pricing: ModelPricing): UsageCost;
 /**
  * Rough time-to-first-token impact of input size. Prompt processing on major
  * providers runs on the order of tens of thousands of tokens per second;

package/dist/pricing.js

@@ -1,16 +1,55 @@
 /**
  * Per-model pricing for cost estimation, USD per million tokens.
  *
- * Anthropic prices are current as of mid-2026 (first-party API list rates).
- * OpenAI/Google figures are approximate public list prices and drift over
- * time — all cost output is labeled as an estimate. One table, one file,
- * easy to update: PRs welcome when prices change.
+ * Anthropic prices are first-party API list rates, checked against
+ * Anthropic's price list in October 2026. OpenAI/Google figures are
+ * approximate public list prices and drift over time — all cost output is
+ * labeled as an estimate. One table, one file, easy to update: PRs welcome
+ * when prices change.
  */
+/** Anthropic cache writes, relative to the input price: 5-minute TTL and 1-hour TTL. */
+export const CACHE_WRITE_5M = 1.25;
+export const CACHE_WRITE_1H = 2;
+const rate = (inputPerM, outputPerM, cacheReadPerM) => ({ inputPerM, outputPerM, cacheReadPerM });
+/**
+ * One Claude version, whatever wraps the id: a date (-20251101, @20251101),
+ * "[1m]", a Bedrock prefix. Prices differ between a major and its minor
+ * releases (Opus 5 is $5 in, Opus 5.5 is $4), so neither may match the
+ * other: a minor is one or two digits after the major, a date suffix is
+ * eight, and that is what the lookaheads tell apart.
+ */
+function claude(families, major, minor) {
+    return minor === undefined
+        ? new RegExp(`claude-(?:${families})-${major}(?![.\\d]|-\\d{1,2}(?!\\d))`, "i")
+        : new RegExp(`claude-(?:${families})-${major}[-.]${minor}(?!\\d)`, "i");
+}
 const PRICING = [
-    [/claude.*fable|claude.*mythos/i, { inputPerM: 10, outputPerM: 50, cacheReadPerM: 1 }],
-    [/claude.*opus/i, { inputPerM: 5, outputPerM: 25, cacheReadPerM: 0.5 }],
-    [/claude.*sonnet/i, { inputPerM: 3, outputPerM: 15, cacheReadPerM: 0.3 }],
-    [/claude.*haiku/i, { inputPerM: 1, outputPerM: 5, cacheReadPerM: 0.1 }],
+    // Specific Claude versions first: the family rows below are only a
+    // fallback for ids this table does not know yet.
+    [claude("fable|mythos", 5, 1), rate(10, 50, 0.25)],
+    [claude("fable|mythos", 5), rate(10, 50, 1)],
+    [claude("opus", 5, 5), rate(4, 20, 0.2)],
+    [claude("opus", 5), rate(5, 25, 0.5)],
+    [claude("opus", 4, 8), rate(5, 25, 0.5)],
+    [claude("opus", 4, 7), rate(5, 25, 0.5)],
+    [claude("opus", 4, 6), rate(5, 25, 0.5)],
+    [claude("opus", 4, 5), rate(5, 25, 0.5)],
+    [claude("opus", 4, 1), rate(15, 75, 1.5)],
+    [claude("opus", 4), rate(15, 75, 1.5)],
+    [/claude-3-opus/i, rate(15, 75, 1.5)],
+    [claude("sonnet", 5, 5), rate(2, 10, 0.2)],
+    [claude("sonnet", 5), rate(2, 10, 0.2)],
+    // Haiku 5.5's rates hold for prompts up to 100k tokens; longer prompts
+    // bill higher, a tier this per-token table does not model.
+    [claude("haiku", 5, 5), rate(0.1, 0.5, 0.01)],
+    [claude("haiku", 4, 5), rate(1, 5, 0.1)],
+    [/claude-3-5-haiku/i, rate(0.8, 4, 0.08)],
+    [/claude-3-haiku/i, rate(0.25, 1.25, 0.03)],
+    // Sonnet 4.6, 4.5, 4 and the 3.x Sonnets are all $3 / $15 / $0.30: the family row.
+    [/claude.*fable|claude.*mythos/i, rate(10, 50, 1)],
+    [/claude.*opus/i, rate(5, 25, 0.5)],
+    [/claude.*sonnet/i, rate(3, 15, 0.3)],
+    [/claude.*haiku/i, rate(1, 5, 0.1)],
     [/gpt-5.*(mini|nano)/i, { inputPerM: 0.25, outputPerM: 2, cacheReadPerM: 0.025 }],
     [/gpt-5/i, { inputPerM: 1.25, outputPerM: 10, cacheReadPerM: 0.125 }],
     [/gpt-4o-mini/i, { inputPerM: 0.15, outputPerM: 0.6, cacheReadPerM: 0.075 }],
@@ -32,6 +71,53 @@ export function pricingFor(model) {
 export function inputCostUsd(tokens, pricing) {
     return (tokens / 1_000_000) * pricing.inputPerM;
 }
+/** A token count from recorded usage: numbers and numeric strings, anything else is 0. */
+function count(v) {
+    const n = typeof v === "number" ? v : typeof v === "string" && v.trim() !== "" ? Number(v) : Number.NaN;
+    return Number.isFinite(n) && n > 0 ? n : 0;
+}
+/**
+ * A request's cache writes by TTL. Claude Code's main thread writes almost
+ * everything at the 1-hour TTL (2x input) and subagents at 5 minutes
+ * (1.25x), so a single 1.25x multiplier underpriced most writes by 37%.
+ * Usage recorded without the split counts as 5-minute writes, the API's
+ * default TTL.
+ */
+export function cacheWriteSplit(usage) {
+    const total = count(usage?.cache_creation_input_tokens);
+    const split = usage?.cache_creation;
+    if (!split || typeof split !== "object")
+        return { fiveMinute: total, oneHour: 0 };
+    const all = total || count(split.ephemeral_5m_input_tokens) + count(split.ephemeral_1h_input_tokens);
+    const oneHour = Math.min(all, count(split.ephemeral_1h_input_tokens));
+    return { fiveMinute: all - oneHour, oneHour };
+}
+/**
+ * The write price, relative to input, of a mix of 5-minute and 1-hour
+ * writes. Simulations that charge a write that never happened (a cold
+ * re-read, a compaction's fresh context) use the session's own mix, since
+ * that is the TTL its harness would have written at; 1.25x when nothing was
+ * written to learn from.
+ */
+export function writeMultiplier(fiveMinute, oneHour) {
+    const total = fiveMinute + oneHour;
+    return total > 0 ? (fiveMinute * CACHE_WRITE_5M + oneHour * CACHE_WRITE_1H) / total : CACHE_WRITE_5M;
+}
+/**
+ * What one recorded request cost: uncached input, cache writes priced by
+ * TTL, cache reads, output. The one place recorded usage is priced, so every
+ * report agrees with the others and with the bill.
+ */
+export function usageCost(usage, pricing) {
+    const { fiveMinute, oneHour } = cacheWriteSplit(usage);
+    const perM = (tokens, usd) => (tokens * usd) / 1_000_000;
+    const inputUsd = perM(count(usage?.input_tokens), pricing.inputPerM);
+    const writeUsd = perM(fiveMinute * CACHE_WRITE_5M + oneHour * CACHE_WRITE_1H, pricing.inputPerM);
+    const readUsd = perM(count(usage?.cache_read_input_tokens), pricing.cacheReadPerM);
+    const outputUsd = perM(count(usage?.output_tokens), pricing.outputPerM);
+    const promptUsd = inputUsd + writeUsd + readUsd;
+    return { inputUsd, writeUsd, readUsd, outputUsd, promptUsd, totalUsd: promptUsd + outputUsd };
+}
 /**
  * Rough time-to-first-token impact of input size. Prompt processing on major
  * providers runs on the order of tens of thousands of tokens per second;

package/dist/proxy.d.ts

@@ -48,7 +48,7 @@ export interface ProxyOptions extends OptimizeOptions {
     googleUpstream?: string;
 }
 /** Reported by /health so `autopilot status` can tell an outdated service from a current one. */
-export declare const PROXY_VERSION = "0.31.0";
+export declare const PROXY_VERSION = "0.32.0";
 /**
  * Remove a leading `/t/<token>` from a request path, or return undefined when
  * the prefix is absent or the token differs. The comparison is constant time
@@ -61,7 +61,12 @@ export declare function stripToken(url: string, token: string): string | undefin
  * Code under autopilot, an SDK) also lists models, uploads files, counts
  * tokens. Until 0.24 those got a 404 and broke the feature for that client.
  * Unknown paths go to Anthropic when the request says it is one (Anthropic
- * clients always send anthropic-version, or x-api-key), else to OpenAI.
+ * clients always send anthropic-version, or x-api-key; OAuth calls send
+ * anthropic-beta; Anthropic keys and tokens start sk-ant-), else to OpenAI.
+ * Under autopilot the default flips: Claude Code is the client it is
+ * installed for, and a Bearer-only request from it (its OAuth token) sent to
+ * OpenAI would hand an Anthropic credential to another company. There only a
+ * request carrying an OpenAI-style key (sk-..., not sk-ant-...) goes to OpenAI.
  * Google's Gemini API (GOOGLE_GEMINI_BASE_URL) is recognised by its key
  * header, its /v1beta paths, or a `model:method` path such as
  * /v1/models/gemini-3-pro:generateContent.
@@ -108,4 +113,10 @@ export interface RouteConfig {
     keepRecent?: number;
     maxToolResultTokens?: number;
 }
+/**
+ * Which account a request belongs to, as a salted hash of its credential: the
+ * proxy remembers per account whether the API refuses edited history, and
+ * never keeps the key itself.
+ */
+export declare function accountKey(headers: http.IncomingHttpHeaders): string;
 export declare function startProxy(opts?: ProxyOptions): http.Server;