ldrouter 1.16.2 → 1.16.3

package/CHANGELOG.md

@@ -4,47 +4,18 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
-## [1.16.2] - 2026-09-14
+## [1.16.3] - 2026-09-14
 
 ### Fixed
 
-- npm release failed with `E409 Conflict - Failed to save packument`: the package had been renamed to `latedev-router`, which the registry still holds as an empty package after all of its versions were unpublished, so no new version can be written under that name. The package name is back to `ldrouter` (the name that last published successfully); the CLI still exposes both `ldrouter` and `latedev-router` binaries.
-
-## [1.16.1] - 2026-09-13
-
-### Fixed
-
-- **Test connection** and **Import models** on the Codex accounts group always failed with `Gateway error`: the models request omitted the `client_version` query parameter the Codex endpoint requires, and the response was read from `models[].id` while the endpoint returns `models[].slug`, so discovery came back empty or errored.
-- Deleting a Codex provider failed with `Gateway error`: `codex_accounts.provider_id` is `ON DELETE RESTRICT`, so removing the provider last raised a raw SQLite constraint error. The provider delete now removes the provider and its Codex account pool in one transaction and reports how many accounts were deleted.
-
-## [1.16.0] - 2026-09-13
-
-### Added
-
-- Codex account pool UI: a dedicated Codex accounts group on the Providers page with expand/collapse, account filtering, and pagination — separate from the generic Add provider dialog, which no longer collects Codex credentials.
-- Codex quota panel showing the 5-hour and weekly windows with live reset countdowns, per-account and refresh-all usage refresh, weekly reset-credit count, and a **Reset quota** action that spends one credit.
-- Codex 5-hour window auto-start (opt-in per account): when a window is exhausted and its reset time has passed, the gateway sends one tiny ping so the next window opens immediately. One ping per reset minute, persisted so it survives restarts.
-- Codex model import dialog with search, Select All, and existing-model detection.
-- Connect OpenAI Codex: a browser-based PKCE flow that shows the authorize URL, waits for the loopback callback, and also accepts a pasted callback URL or bare authorization code. The verifier stays server-side and the authorization code is exchanged server-side, so neither ever appears in the UI.
-  - `GET /oauth/codex/callback` captures the Codex CLI loopback redirect (`http://localhost:1455/auth/callback`) and holds the code in memory against its `state`; the dialog polls `GET /api/admin/codex/oauth/:state` and enables **Connect** as soon as a code is captured. The page never echoes the code.
-- Drag-and-drop routing order for Codex accounts (`@dnd-kit/core`, `@dnd-kit/sortable`, `@dnd-kit/modifiers`), replacing the numeric priority prompt. Rows can also be reordered with the keyboard; the saved order is the router's fallback order.
-- `migrations/0006_codex_usage.sql`: usage snapshot, usage error, auto-start flag, and ping bookkeeping columns on `codex_accounts`.
-
-### Fixed
-
-- Codex account API returned `enabled` as SQLite `0`/`1` instead of a boolean, so the enable/disable control could show the wrong state.
-- Codex credential refresh/decrypt failures returned an opaque HTTP 500 with `Gateway error`; they now return a typed 401 naming the fix (re-import the account).
-- Codex model discovery threw a bare error without an HTTP status, so a 401 never triggered the refresh-and-retry path and surfaced as `Gateway error` instead of an auth failure.
-- **Delete** on a Codex account was a soft delete that left the encrypted credentials on disk; it is now a hard delete. Past request attempts are unaffected because their account reference is `ON DELETE SET NULL`.
-- The Codex account row rendered two identical Enable/Disable controls.
-
-## [1.15.0] - 2026-09-12
-
-### Added
-
-- Native Codex OAuth account import from redacted JSON, JSON arrays, wrapper objects, and JSONL, with provider-scoped deduplication and encrypted token storage.
-- Codex token refresh/rotation, bounded unauthorized retry, account health tracking, account-aware routing, and attempt attribution.
-- Codex provider setup, account import, refresh status, enable/disable, and safe test controls in the admin UI.
+- **Routing rejections now name the model and the reason.** A request a model could not serve answered `No available model candidates` (direct model) or `No combo member satisfies the request capabilities or availability` (combo) — the same failure described differently, naming neither the model nor the cause. Both paths now share one taxonomy of capability gaps and availability reasons, grouped per model and reported with the model name without its provider prefix (`vl/gpt-5.5` is reported as `gpt-5.5`).
+- **Error codes reached clients again.** `GatewayError.code` was dropped when each gateway route rebuilt the error from the runner outcome, so `rpm_limit`, `tpm_limit`, `quota_limit`, `concurrency_limit`, and `upstream_http_*` never left the process.
+- **Admin-disabled models answered `404 Unknown model`.** The resolver skipped disabled models, so callers looked for a typo in a model that had just been switched off; it now reports `model disabled`. The candidate loader also pre-filtered disabled models and providers, making the recorded reasons unreachable and collapsing every case into `model not found`.
+- **Upstream HTTP failures agreed across paths.** A 429 surfaced as 529 without a code on the non-streaming path and with one on another; all paths now share one mapping (429 → `upstream_http_429`, 401/403 → `upstream_http_401`/`upstream_http_403`, ≥500 → `upstream_http_503`).
+- **No internal JS errors in responses.** A 200 with an unexpected body shape surfaced `Cannot read properties of undefined (reading '0')`; it is now `Upstream response for "<model>" has no "choices" array` with code `upstream_bad_response`.
+- **Combo create/update no longer 500, leave orphans, or rename the public ID.** Uniqueness checked only `publicModelId` while `combos.slug` is its own UNIQUE column, duplicate members hit `UNIQUE(combo_id, model_id)`, and both operations ran outside a transaction — update deleting members before inserting the new ones. Saving the edit form unchanged also rewrote a public ID such as `smart` into `combo/smart`, breaking aliases and API keys. All uniqueness checks share one path, both operations are atomic, and the ID is never derived from the name.
+- **Image requests to image-capable models failed.** `/v1/responses` dropped `input_image` blocks, Anthropic inbound read URLs from `source.data`, and outbound Anthropic conversion emitted `{"type":"url","media_type","data"}` instead of `source.url`.
+- **Model capabilities are no longer guessed.** `inferOpenAICapabilities` wrote `image_input`, `structured_output`, and `reasoning` as `false` whenever a model name missed a substring heuristic, hard-rejecting `gpt-4o-2024-11-20`, `gemini-*`, `qwen-vl-*`, and `grok-*`. Unknown stays unknown; manual admin edits survive re-import.
 
 ## [1.14.1] - 2026-09-12
 

package/README.md

@@ -19,7 +19,6 @@ Lightweight self-hosted LLM gateway with a polished admin UI. Presents stable Op
 - Consistent backup / restore (SQLite snapshot + checksum + schema validation)
 - Prometheus `/metrics`, structured logs, graceful shutdown
 - One distributable npm package, multi-stage Dockerfile, Docker Compose
-- Native Codex OAuth account pools with encrypted JSON/JSONL import, refresh/rotation, account-aware routing, and admin management
 
 ## Quick start
 
@@ -37,33 +36,12 @@ Then visit `http://localhost:8787/` and complete the first-run admin setup.
 ### Using npm
 
 ```bash
-npx ldrouter
+npx latedev-router
 latedev-router --host 0.0.0.0 --port 8787
 ```
 
 The data directory defaults to `~/.latedev-router/` and can be overridden via `LATEDEV_DATA_DIR` or `--data-dir`.
 
-### Codex OAuth setup
-
-1. Set `LATEDEV_MASTER_KEY` before creating or importing credentials. Use a strong random base64 key; it encrypts Codex access, refresh, and ID tokens at rest.
-2. In **Providers**, create a provider with type **Codex**. Codex providers do not use the generic API-key field.
-3. Open the Codex account panel and import a redacted copy of a Codex OAuth `auth.json`, a JSON array, an `{ "accounts": [...] }` wrapper, or JSONL with one record per line. Records may contain a `tokens` object with access/refresh/ID tokens. For example:
-
-   `{ "accountId": "acct-…masked", "email": "admin@example.invalid", "tokens": { "accessToken": "[REDACTED]", "refreshToken": "[REDACTED]" } }`
-
-   JSONL stores one similarly redacted object per line; an array uses the same records: `[ { "accountId": "acct-…masked", "tokens": { "accessToken": "[REDACTED]" } } ]`.
-
-   Alternatively, use **Connect Codex** to authorize a ChatGPT account in the browser. The dialog shows the Codex CLI PKCE authorize URL, waits for the loopback callback, and also accepts a pasted callback URL or bare authorization code. The PKCE verifier and the authorization code stay server-side and never appear in the UI. The Codex CLI callback (`http://localhost:1455/auth/callback`) is captured by `GET /oauth/codex/callback`; because browsers block that cross-origin redirect, paste the address bar URL into step 2 when the auto-capture page fails to load.
-4. Review the preview and import only the records you want. Account/workspace identity is preferred for deduplication; email alone never merges unrelated accounts. Re-importing the same identity updates its encrypted tokens while preserving its enabled state.
-
-Raw tokens are accepted only by the authenticated import pipeline and are never returned in previews, API responses, UI state, audit logs, request logs, errors, or database backups. JWT claims are decoded for metadata only; token signatures are not verified locally. Tokens are refreshed proactively near expiry and once after an upstream 401/403, with rotated values persisted atomically.
-
-The import endpoint requires the normal admin session and CSRF token (`x-csrf-token`) for mutations, including multipart uploads. Use HTTPS for remote administration and protect the master key like any encryption key. Back up the SQLite data directory consistently; restoring encrypted credentials requires the matching master key, otherwise re-save/re-import credentials after restore.
-
-ZIP upload and automatic Codex CLI config-file generation/mutation are not included in this release. LateDev Router does not modify Codex CLI files.
-
-The account panel shows the 5-hour and weekly quota windows with reset countdowns, per-account and bulk usage refresh, weekly reset credits, an opt-in 5-hour window auto-start, and a **Test** control that probes the upstream account without exposing tokens. Routing order is set by dragging rows; the saved order is the fallback order the router uses. **Delete** is permanent and erases the stored encrypted credentials — past request logs are kept but lose the account reference.
-
 ## Environment variables
 
 | Variable | Description | Default |

package/dist/server/app.js

@@ -4,7 +4,6 @@ import cookie from '@fastify/cookie';
 import helmet from '@fastify/helmet';
 import cors from '@fastify/cors';
 import staticPlugin from '@fastify/static';
-import multipart from '@fastify/multipart';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -44,7 +43,6 @@ export async function buildApp(opts = {}) {
         crossOriginEmbedderPolicy: false,
     });
     await app.register(cors, { origin: false, credentials: true });
-    await app.register(multipart, { limits: { fileSize: 2_000_000, files: 20, parts: 25 } });
     // Every request is logged as structured JSON for Docker. Bodies and headers
     // are intentionally excluded; sensitive values must never reach logs.
     app.addHook('onRequest', async (req) => {
@@ -65,12 +63,7 @@ export async function buildApp(opts = {}) {
         const normalized = err instanceof ZodError
             ? new GatewayError('invalid_request_error', err.issues.map((i) => `${i.path.join('.') || 'body'}: ${i.message}`).join('; '), { status: 400 })
             : err;
-        const multipartTooLarge = normalized.code === 'FST_REQ_FILE_TOO_LARGE';
-        const g = normalized instanceof GatewayError
-            ? normalized
-            : multipartTooLarge
-                ? new GatewayError('invalid_request_error', 'Import exceeds maximum size', { status: 413 })
-                : null;
+        const g = normalized instanceof GatewayError ? normalized : null;
         const status = g?.status ?? 500;
         const requestId = req.id;
         // Fastify runs with `logger: false`, so req.log is a silent no-op — use the app
@@ -198,8 +191,6 @@ export async function startApp() {
     process.once('SIGTERM', () => void close('SIGTERM'));
     process.once('SIGINT', () => void close('SIGINT'));
     await app.listen({ host: cfg.host, port: cfg.port });
-    const { startCodexAutostart } = await import('./providers/codex-autostart.js');
-    startCodexAutostart();
     return app;
 }
 // re-export for convenience

package/dist/server/auth/middleware.js

@@ -1,45 +1,9 @@
 // Auth middleware: admin session validation.
 import { getDb, schema } from '../db/index.js';
 import { sql } from 'drizzle-orm';
-import { sha256Hex, uuid } from './ids.js';
-import crypto from 'node:crypto';
-const CSRF_TOKEN_MAX_AGE = 60 * 60 * 12; // 12h, aligned with admin sessions
-function csrfExpiry() {
-    return new Date(Date.now() + CSRF_TOKEN_MAX_AGE * 1000).toISOString();
-}
+import { sha256Hex } from './ids.js';
 import { GatewayError } from '../errors.js';
 import { recordAudit } from '../db/repositories/audit.js';
-import { timingSafeEqual } from 'node:crypto';
-const CsrfHeader = 'x-csrf-token';
-export async function requireAdminCsrf(req) {
-    const token = req.headers[CsrfHeader];
-    if (typeof token !== 'string' || !req.adminSessionId)
-        throw new GatewayError('authentication_error', 'CSRF token required', { status: 403 });
-    const row = getDb().select().from(schema.csrfTokens).where(sql `session_id = ${req.adminSessionId}`).get();
-    const expected = row?.token;
-    if (!expected || new Date(row.expiresAt).getTime() < Date.now())
-        throw new GatewayError('authentication_error', 'Invalid CSRF token', { status: 403 });
-    const actualBytes = Buffer.from(token);
-    const expectedBytes = Buffer.from(expected);
-    if (actualBytes.length !== expectedBytes.length || !timingSafeEqual(actualBytes, expectedBytes))
-        throw new GatewayError('authentication_error', 'Invalid CSRF token', { status: 403 });
-}
-export function csrfTokenForSession(sessionId) {
-    const db = getDb();
-    const row = db.select().from(schema.csrfTokens).where(sql `session_id = ${sessionId}`).get();
-    if (row && new Date(row.expiresAt).getTime() >= Date.now())
-        return row.token;
-    const token = crypto.randomBytes(32).toString('base64url');
-    const expiresAt = csrfExpiry();
-    if (row) {
-        db.update(schema.csrfTokens).set({ token, expiresAt }).where(sql `id = ${row.id}`).run();
-    }
-    else {
-        db.insert(schema.csrfTokens).values({ id: uuid(), sessionId, token, expiresAt }).run();
-    }
-    return token;
-}
-export { CsrfHeader };
 const SessionCookie = 'ld_session';
 export async function requireAdminAuth(req, _reply) {
     const token = req.cookies[SessionCookie];

package/dist/server/db/index.js

@@ -61,9 +61,4 @@ export function getDb() {
         throw new Error('Database not opened');
     return _db;
 }
-export function getRawDb() {
-    if (!_raw)
-        throw new Error('Database not opened');
-    return _raw;
-}
 export { schema };

package/dist/server/db/migrate.js

@@ -140,10 +140,10 @@ function buildInitialSchemaSql() {
       id TEXT PRIMARY KEY,
       name TEXT NOT NULL,
       slug TEXT NOT NULL UNIQUE,
-      type TEXT NOT NULL CHECK (type IN ('openai','anthropic','codex')),
-            base_url TEXT NOT NULL,
-            encrypted_api_key TEXT,
-            api_key_nonce TEXT,
+      type TEXT NOT NULL CHECK (type IN ('openai','anthropic')),
+      base_url TEXT NOT NULL,
+      encrypted_api_key TEXT NOT NULL,
+      api_key_nonce TEXT NOT NULL,
       api_key_version INTEGER NOT NULL DEFAULT 1,
       custom_headers_encrypted TEXT,
       custom_headers_nonce TEXT,
@@ -302,37 +302,6 @@ function buildInitialSchemaSql() {
     CREATE INDEX IF NOT EXISTS idx_request_requested ON requests(requested_model, created_at);
     CREATE INDEX IF NOT EXISTS idx_request_protocol ON requests(protocol, created_at);
 
-    CREATE TABLE IF NOT EXISTS codex_accounts (
-      id TEXT PRIMARY KEY,
-      provider_id TEXT NOT NULL REFERENCES providers(id) ON DELETE RESTRICT,
-      email TEXT,
-      workspace_id TEXT,
-      chatgpt_account_id TEXT,
-      plan_type TEXT,
-      encrypted_access_token TEXT NOT NULL,
-      access_token_nonce TEXT NOT NULL,
-      access_token_version INTEGER NOT NULL DEFAULT 1,
-      encrypted_refresh_token TEXT NOT NULL,
-      refresh_token_nonce TEXT NOT NULL,
-      refresh_token_version INTEGER NOT NULL DEFAULT 1,
-      encrypted_id_token TEXT,
-      id_token_nonce TEXT,
-      id_token_version INTEGER NOT NULL DEFAULT 1,
-      token_expires_at TEXT NOT NULL,
-      last_refresh_at TEXT,
-      auth_method TEXT NOT NULL DEFAULT 'oauth' CHECK (auth_method IN ('oauth','access_token')),
-      enabled INTEGER NOT NULL DEFAULT 1,
-      health_state TEXT NOT NULL DEFAULT 'unknown' CHECK (health_state IN ('healthy','degraded','down','unknown')),
-      last_error TEXT,
-      consecutive_failures INTEGER NOT NULL DEFAULT 0,
-      priority INTEGER NOT NULL DEFAULT 0,
-      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
-      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
-    );
-    CREATE INDEX IF NOT EXISTS idx_codex_account_provider_enabled_priority ON codex_accounts(provider_id, enabled, priority);
-    CREATE INDEX IF NOT EXISTS idx_codex_account_provider_email ON codex_accounts(provider_id, email);
-    CREATE INDEX IF NOT EXISTS idx_codex_account_provider_chatgpt ON codex_accounts(provider_id, chatgpt_account_id);
-
     CREATE TABLE IF NOT EXISTS request_attempts (
       id TEXT PRIMARY KEY,
       request_id TEXT NOT NULL REFERENCES requests(id) ON DELETE CASCADE,
@@ -355,11 +324,9 @@ function buildInitialSchemaSql() {
       selection_reason TEXT NOT NULL,
       failure_reason TEXT,
       error_message TEXT,
-      upstream_request_id TEXT,
-      codex_account_id TEXT REFERENCES codex_accounts(id) ON DELETE SET NULL
+      upstream_request_id TEXT
     );
     CREATE INDEX IF NOT EXISTS idx_attempt_request ON request_attempts(request_id, attempt_number);
-    CREATE INDEX IF NOT EXISTS idx_attempt_codex_account ON request_attempts(codex_account_id, started_at);
     CREATE INDEX IF NOT EXISTS idx_attempt_provider_model ON request_attempts(provider_id, model_id, started_at);
 
     CREATE TABLE IF NOT EXISTS audit_logs (

package/dist/server/db/schema.js

@@ -81,10 +81,10 @@ export const providers = sqliteTable('providers', {
     id: text('id').primaryKey(),
     name: text('name').notNull(),
     slug: text('slug').notNull().unique(),
-    type: text('type', { enum: ['openai', 'anthropic', 'codex'] }).notNull(),
+    type: text('type', { enum: ['openai', 'anthropic'] }).notNull(),
     baseUrl: text('base_url').notNull(),
-    encryptedApiKey: text('encrypted_api_key'),
-    apiKeyNonce: text('api_key_nonce'),
+    encryptedApiKey: text('encrypted_api_key').notNull(),
+    apiKeyNonce: text('api_key_nonce').notNull(),
     apiKeyVersion: integer('api_key_version').notNull().default(1),
     customHeadersEncrypted: text('custom_headers_encrypted'),
     customHeadersNonce: text('custom_headers_nonce'),
@@ -106,45 +106,6 @@ export const providers = sqliteTable('providers', {
 }, (t) => ({
     slugIdx: uniqueIndex('uniq_provider_slug').on(t.slug),
 }));
-export const codexAccounts = sqliteTable('codex_accounts', {
-    id: text('id').primaryKey(),
-    providerId: text('provider_id').notNull().references(() => providers.id, { onDelete: 'restrict' }),
-    email: text('email'),
-    workspaceId: text('workspace_id'),
-    chatgptAccountId: text('chatgpt_account_id'),
-    planType: text('plan_type'),
-    encryptedAccessToken: text('encrypted_access_token').notNull(),
-    accessTokenNonce: text('access_token_nonce').notNull(),
-    accessTokenVersion: integer('access_token_version').notNull().default(1),
-    encryptedRefreshToken: text('encrypted_refresh_token').notNull(),
-    refreshTokenNonce: text('refresh_token_nonce').notNull(),
-    refreshTokenVersion: integer('refresh_token_version').notNull().default(1),
-    encryptedIdToken: text('encrypted_id_token'),
-    idTokenNonce: text('id_token_nonce'),
-    idTokenVersion: integer('id_token_version').notNull().default(1),
-    tokenExpiresAt: text('token_expires_at').notNull(),
-    lastRefreshAt: text('last_refresh_at'),
-    authMethod: text('auth_method', { enum: ['oauth', 'access_token'] }).notNull().default('oauth'),
-    enabled: integer('enabled', { mode: 'boolean' }).notNull().default(true),
-    healthState: text('health_state', { enum: ['healthy', 'degraded', 'down', 'unknown'] }).notNull().default('unknown'),
-    lastError: text('last_error'),
-    consecutiveFailures: integer('consecutive_failures').notNull().default(0),
-    priority: integer('priority').notNull().default(0),
-    // Codex quota snapshot (wham/usage) and 5-hour window auto-start state (v1.15.0).
-    codexUsageJson: text('codex_usage_json'),
-    codexUsageUpdatedAt: text('codex_usage_updated_at'),
-    codexUsageError: text('codex_usage_error'),
-    codexAutostartEnabled: integer('codex_autostart_enabled', { mode: 'boolean' }).notNull().default(false),
-    lastPingedResetAt: text('last_pinged_reset_at'),
-    lastPingedResetKey: text('last_pinged_reset_key'),
-    lastPingAt: text('last_ping_at'),
-    createdAt: text('created_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
-    updatedAt: text('updated_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
-}, (t) => ({
-    providerEnabledPriorityIdx: index('idx_codex_account_provider_enabled_priority').on(t.providerId, t.enabled, t.priority),
-    providerEmailIdx: index('idx_codex_account_provider_email').on(t.providerId, t.email),
-    providerChatgptIdx: index('idx_codex_account_provider_chatgpt').on(t.providerId, t.chatgptAccountId),
-}));
 // ============================================================================
 // Models
 // ============================================================================
@@ -326,7 +287,6 @@ export const requestAttempts = sqliteTable('request_attempts', {
     attemptNumber: integer('attempt_number').notNull(),
     providerId: text('provider_id').notNull(),
     modelId: text('model_id').notNull(),
-    codexAccountId: text('codex_account_id').references(() => codexAccounts.id, { onDelete: 'set null' }),
     startedAt: text('started_at').notNull(),
     completedAt: text('completed_at'),
     statusCode: integer('status_code'),
@@ -347,7 +307,6 @@ export const requestAttempts = sqliteTable('request_attempts', {
 }, (t) => ({
     requestIdx: index('idx_attempt_request').on(t.requestId, t.attemptNumber),
     providerModelIdx: index('idx_attempt_provider_model').on(t.providerId, t.modelId, t.startedAt),
-    codexAccountIdx: index('idx_attempt_codex_account').on(t.codexAccountId, t.startedAt),
 }));
 // ============================================================================
 // Audit logs (immutable, excluded from request retention)

package/dist/server/errors.js

@@ -63,3 +63,14 @@ export function toAnthropicError(g, requestId) {
         ...(requestId ? { request_id: requestId } : {}),
     };
 }
+/**
+ * Rehydrate the error for the client from a gateway outcome. `errorCode` matters:
+ * without it every propagated failure lost its specific code (rpm_limit,
+ * upstream_http_429, …) and arrived as a bare type.
+ */
+export function outcomeError(outcome) {
+    return new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', {
+        status: outcome.httpStatus,
+        ...(outcome.errorCode ? { code: outcome.errorCode } : {}),
+    });
+}