ldrouter 1.16.4 → 1.17.0

package/dist/server/routes/admin/providers.js

@@ -7,15 +7,15 @@ import { encryptSecret, decryptSecret, encryptCustomHeaders, decryptCustomHeader
 import { uuid, slugify } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
 import { probeProvider, discoverProviderModels } from '../../providers/index.js';
-import { probeCodex, codexModels } from '../../providers/codex.js';
-import { listCodexAccountSummaries } from '../../db/repositories/codex-accounts.js';
-import { codexCredentialError, withCodexCredentials } from '../../providers/codex-refresh.js';
+import { getPooledProvider } from '../../providers/pooled.js';
 import { redactString } from '../../security/redact.js';
 const ProviderCreate = z.object({
-    name: z.string().min(1).max(128),
+    // A pool provider is nothing but a group: the admin clicks once and the server owns every field.
+    // Compatible providers still need name, endpoint, and credential up front (checked in the handler).
+    name: z.string().min(1).max(128).optional(),
     slug: z.string().min(1).max(64).optional(),
-    type: z.enum(['openai', 'anthropic', 'codex']),
-    baseUrl: z.string().url().max(512),
+    type: z.enum(['openai', 'anthropic', 'codex', 'qoder']),
+    baseUrl: z.string().url().max(512).optional(),
     apiKey: z.string().min(1).max(20000).optional(),
     customHeaders: z.record(z.string(), z.string()).optional(),
     enabled: z.boolean().optional(),
@@ -64,24 +64,42 @@ export async function registerProviderRoutes(app) {
     });
     app.post('/api/admin/providers', async (req) => {
         const body = ProviderCreate.parse(req.body);
-        if (body.type !== 'codex' && !body.apiKey) {
+        const pool = getPooledProvider(body.type);
+        const defaults = pool?.defaults;
+        const name = body.name ?? defaults?.name;
+        // Pool defaults win over the request: a stored Codex base URL pointing anywhere but
+        // chatgpt.com makes every upstream call 404 (see CODEX_BASE_URL).
+        const baseUrl = defaults?.baseUrl ?? body.baseUrl;
+        if (!name)
+            throw new GatewayError('invalid_request_error', 'Provider name is required', { status: 400 });
+        // apiKey before baseUrl: a compatible provider created without either must be told the
+        // credential is missing (the UI always supplies baseUrl from its dialog default).
+        if (!pool && !body.apiKey) {
             throw new GatewayError('invalid_request_error', 'API key is required for this provider type', { status: 400 });
         }
+        if (!baseUrl)
+            throw new GatewayError('invalid_request_error', 'Base URL is required', { status: 400 });
         requireMasterKey(); // Need master key to encrypt new credentials
         const db = getDb();
-        const slug = body.slug ? slugify(body.slug) : slugify(body.name);
+        const slug = slugify(body.slug ?? name);
         const dup = db.select().from(schema.providers).where(eq(schema.providers.slug, slug)).get();
-        if (dup)
+        if (dup) {
+            // Pool path carries the code spec §5.7 names, so the UI can render "already added".
+            if (pool)
+                throw new GatewayError('invalid_request_error', `A ${dup.name} provider already exists ('${dup.slug}')`, { status: 400, code: 'slug_taken' });
             throw new GatewayError('invalid_request_error', `Provider slug '${slug}' is already in use`, { status: 400 });
-        const enc = body.apiKey ? encryptSecret(body.apiKey) : null;
+        }
+        // A pool type has no API-key field (spec §5.7): a key sent with `{type}` must not be encrypted
+        // onto the row.
+        const enc = !pool && body.apiKey ? encryptSecret(body.apiKey) : null;
         const headersEnc = body.customHeaders ? encryptCustomHeaders(body.customHeaders) : null;
         const id = uuid();
         db.insert(schema.providers).values({
             id,
-            name: body.name,
+            name,
             slug,
             type: body.type,
-            baseUrl: body.baseUrl,
+            baseUrl,
             encryptedApiKey: enc?.ciphertext ?? null,
             apiKeyNonce: enc?.nonce ?? null,
             apiKeyVersion: enc?.version ?? 1,
@@ -96,7 +114,7 @@ export async function registerProviderRoutes(app) {
             cbFailureThreshold: body.cbFailureThreshold ?? 5,
             cbCooldownSeconds: body.cbCooldownSeconds ?? 60,
         }).run();
-        recordAudit({ action: 'provider.create', success: true, targetType: 'provider', targetId: id, targetName: body.name, ip: req.ip });
+        recordAudit({ action: 'provider.create', success: true, targetType: 'provider', targetId: id, targetName: name, ip: req.ip });
         return { id, slug };
     });
     app.patch('/api/admin/providers', async (req) => {
@@ -107,12 +125,15 @@ export async function registerProviderRoutes(app) {
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         const update = { updatedAt: new Date().toISOString() };
+        // A pool type has no API-key field (spec §5.7). Same rule as the create path: skip the whole
+        // encryption block, so an existing key on the row is not disturbed either.
+        const pool = getPooledProvider(p.type);
         if (body.name)
             update.name = body.name;
         if (body.slug)
             update.slug = slugify(body.slug);
         if (body.baseUrl)
-            update.baseUrl = body.baseUrl;
+            update.baseUrl = pool?.defaults.baseUrl ?? body.baseUrl;
         if (body.enabled !== undefined)
             update.enabled = body.enabled;
         if (body.connectTimeoutMs !== undefined)
@@ -129,7 +150,7 @@ export async function registerProviderRoutes(app) {
             update.cbFailureThreshold = body.cbFailureThreshold;
         if (body.cbCooldownSeconds !== undefined)
             update.cbCooldownSeconds = body.cbCooldownSeconds;
-        if (body.apiKey) {
+        if (body.apiKey && !pool) {
             const enc = encryptSecret(body.apiKey);
             update.encryptedApiKey = enc.ciphertext;
             update.apiKeyNonce = enc.nonce;
@@ -157,21 +178,25 @@ export async function registerProviderRoutes(app) {
             recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
             return { ok: true, softDisabled: true };
         }
-        // A Codex provider owns its account pool. codex_accounts.provider_id is ON DELETE RESTRICT,
-        // so the accounts must go in the same transaction or the delete fails with a raw SQLite
-        // constraint error (which surfaces as an opaque 500 "Gateway error").
-        let codexAccountsDeleted = 0;
+        // A pool provider owns its account pool. <table>.provider_id is ON DELETE RESTRICT, so the
+        // accounts must go in the same transaction or the delete fails with a raw SQLite constraint
+        // error (which surfaces as an opaque 500 "Gateway error").
+        const pool = getPooledProvider(p.type);
+        let pooledAccountsDeleted = 0;
         try {
             getRawDb().transaction(() => {
-                codexAccountsDeleted = getRawDb().prepare('DELETE FROM codex_accounts WHERE provider_id=?').run(id).changes;
+                // pool.accountsTable is a fixed registry literal, never user input.
+                if (pool)
+                    pooledAccountsDeleted = getRawDb().prepare(`DELETE FROM ${pool.accountsTable} WHERE provider_id=?`).run(id).changes;
                 db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
             })();
         }
         catch (error) {
             throw new GatewayError('invalid_request_error', 'Provider is still referenced and cannot be deleted', { status: 409, cause: error });
         }
-        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { codexAccountsDeleted } });
-        return { ok: true, codexAccountsDeleted };
+        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { pooledAccountsDeleted } });
+        // codexAccountsDeleted kept: pre-existing clients and tests read that field name.
+        return { ok: true, pooledAccountsDeleted, codexAccountsDeleted: pooledAccountsDeleted };
     });
     app.post('/api/admin/providers/:id/test', async (req) => {
         const { id } = req.params;
@@ -179,12 +204,9 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        if (p.type === 'codex') {
-            const account = listCodexAccountSummaries(p.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
-            if (!account)
-                throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
-            const row = getRawDb().prepare('SELECT chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(account.id);
-            const result = await withCodexCredentials(account.id, async (credentials) => probeCodex({ baseUrl: p.baseUrl, accountId: row?.accountId ?? '', accessToken: credentials.accessToken, customHeaders: {}, totalTimeoutMs: Math.min(p.totalTimeoutMs, 20000) })).catch((error) => { throw codexCredentialError(error); });
+        const pool = getPooledProvider(p.type);
+        if (pool) {
+            const result = await pool.probe({ id: p.id, baseUrl: p.baseUrl, totalTimeoutMs: p.totalTimeoutMs });
             db.update(schema.providers).set({ healthState: result.ok ? 'healthy' : 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
             recordAudit({ action: 'provider.test', success: result.ok, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { detail: redactString(result.detail) } });
             return { ...result, detail: redactString(result.detail) };
@@ -217,12 +239,9 @@ export async function registerProviderRoutes(app) {
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         let discovered;
-        if (p.type === 'codex') {
-            const account = listCodexAccountSummaries(p.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
-            if (!account)
-                throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
-            const row = getRawDb().prepare('SELECT chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(account.id);
-            discovered = await withCodexCredentials(account.id, async (credentials) => codexModels({ baseUrl: p.baseUrl, accountId: row?.accountId ?? '', accessToken: credentials.accessToken, customHeaders: {}, totalTimeoutMs: 30000 })).catch((error) => { throw codexCredentialError(error); });
+        const pool = getPooledProvider(p.type);
+        if (pool) {
+            discovered = await pool.discover({ id: p.id, baseUrl: p.baseUrl, totalTimeoutMs: p.totalTimeoutMs });
         }
         else {
             if (!p.encryptedApiKey || !p.apiKeyNonce)

package/dist/server/routes/admin/qoder.js

@@ -0,0 +1,271 @@
+import { z } from 'zod';
+import { GatewayError } from '../../errors.js';
+import { requireAdminAuth, requireAdminCsrf } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { getRawDb } from '../../db/index.js';
+import { uuid } from '../../auth/ids.js';
+import { listQoderAccountSummaries, getQoderAccountDetailById, setQoderAccountHealth, upsertQoderAccount, findQoderAccountForImport, saveQoderCatalog, toQoderAccountSummary, } from '../../db/repositories/qoder-accounts.js';
+import { exchangeQoderPat, fetchQoderCatalog, serializeCatalog } from '../../providers/qoder/catalog.js';
+import { probeQoder } from '../../providers/qoder/client.js';
+import { qoderCredentialsFor, withQoderCredentials } from '../../providers/qoder/credentials.js';
+import { parseQoderImportText, toQoderPreview, qoderTokenFingerprint } from '../../providers/qoder/qoder-import.js';
+import { redactString } from '../../security/redact.js';
+const MAX_BYTES = 2_000_000;
+const MAX_RECORDS = 500;
+const ImportBody = z.object({ providerId: z.string().min(1), selectedIndexes: z.array(z.number().int().min(0)).max(MAX_RECORDS).optional() });
+const MutationOptions = { preHandler: requireAdminCsrf };
+export const QoderAccountUpdate = z.object({
+    enabled: z.boolean().optional(),
+    label: z.string().max(256).nullable().optional(),
+    priority: z.number().int().min(0).max(100000).optional(),
+}).refine((v) => Object.keys(v).length > 0, 'At least one update is required');
+function parseAll(text) {
+    const result = parseQoderImportText(text);
+    const records = [];
+    const failures = [];
+    for (const item of result)
+        ('personalToken' in item ? records : failures).push(item);
+    return { records, failures };
+}
+function providerOrThrow(providerId) {
+    const provider = getRawDb().prepare('SELECT id,type,total_timeout_ms FROM providers WHERE id=?').get(providerId);
+    if (!provider)
+        throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+    if (provider.type !== 'qoder')
+        throw new GatewayError('invalid_request_error', 'Provider must be Qoder', { status: 400 });
+    return provider;
+}
+const TEXT_EXT = /\.(json|jsonl|txt)$/i;
+async function readInput(req, body) {
+    const contentType = String(req.headers['content-type'] ?? '');
+    if (contentType.includes('multipart/form-data')) {
+        const parts = req.parts();
+        let providerId = '';
+        let selectedIndexes;
+        const texts = [];
+        let bytes = 0;
+        for await (const part of parts) {
+            if (part.type === 'file') {
+                const chunks = [];
+                for await (const chunk of part.file) {
+                    bytes += chunk.length;
+                    if (bytes > MAX_BYTES)
+                        throw new GatewayError('invalid_request_error', 'Import exceeds maximum size', { status: 413 });
+                    chunks.push(chunk);
+                }
+                const raw = Buffer.concat(chunks).toString('utf8');
+                texts.push(TEXT_EXT.test(part.filename ?? '') ? raw : Buffer.from(raw, 'base64').toString('utf8'));
+            }
+            else if (part.fieldname === 'providerId')
+                providerId = String(part.value);
+            else if (part.fieldname === 'selectedIndexes') {
+                let parsedIndexes;
+                try {
+                    parsedIndexes = JSON.parse(String(part.value));
+                }
+                catch {
+                    throw new GatewayError('invalid_request_error', 'selectedIndexes must be JSON', { status: 400 });
+                }
+                selectedIndexes = z.array(z.number().int().min(0)).max(MAX_RECORDS).parse(parsedIndexes);
+            }
+            else if (part.fieldname === 'text')
+                texts.push(String(part.value));
+        }
+        return { providerId, text: texts.join('\n'), selectedIndexes };
+    }
+    const parsed = ImportBody.extend({ text: z.union([z.string(), z.record(z.string(), z.unknown()), z.array(z.unknown())]) }).parse(body);
+    const text = typeof parsed.text === 'string' ? parsed.text : JSON.stringify(parsed.text);
+    if (Buffer.byteLength(text, 'utf8') > MAX_BYTES)
+        throw new GatewayError('invalid_request_error', 'Import exceeds maximum size', { status: 413 });
+    return { providerId: parsed.providerId, text, selectedIndexes: parsed.selectedIndexes };
+}
+function summaryOrThrow(id) {
+    const row = getQoderAccountDetailById(id);
+    if (!row)
+        throw new GatewayError('invalid_request_error', 'Qoder account not found', { status: 404 });
+    return toQoderAccountSummary(row);
+}
+/**
+ * A PAT that works but a catalog that 502s is recoverable — the operator retries later — so the
+ * exchange result is stored even when the catalog fetch fails. When the exchange itself fails
+ * nothing is written and the error is redacted.
+ */
+async function exchangeAndCatalog(personalToken, machineId) {
+    let exchanged;
+    try {
+        exchanged = await exchangeQoderPat(personalToken);
+    }
+    catch (error) {
+        throw new GatewayError('authentication_error', redactString(error instanceof Error ? error.message : 'Qoder personal access token was rejected'), { status: 401 });
+    }
+    let catalog = null;
+    let catalogError = null;
+    try {
+        catalog = await fetchQoderCatalog({ jobToken: exchanged.jobToken, userId: exchanged.qoderUserId, machineId });
+        // fetchQoderCatalog reports failure by returning null rather than throwing, so a null here is
+        // exactly the "token works, catalog did not" case the account survives.
+        if (!catalog || catalog.entries.size === 0)
+            catalogError = 'Qoder model catalog could not be fetched';
+    }
+    catch (error) {
+        catalogError = redactString(error instanceof Error ? error.message : 'Qoder model catalog could not be fetched');
+    }
+    return {
+        record: {
+            personalToken, jobToken: exchanged.jobToken, jobTokenExpiresAt: exchanged.jobTokenExpiresAt,
+            qoderUserId: exchanged.qoderUserId, machineId, email: exchanged.email, label: exchanged.label,
+        },
+        catalog,
+        catalogError,
+    };
+}
+export async function registerQoderRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    /** Add one account: exchange first, then store, so a bad PAT never reaches the database. */
+    app.post('/api/admin/qoder/accounts', MutationOptions, async (req) => {
+        const body = z.object({ providerId: z.string().min(1), personalToken: z.string().min(1).max(200_000), label: z.string().max(256).nullable().optional() }).parse(req.body);
+        providerOrThrow(body.providerId);
+        const { record, catalog, catalogError } = await exchangeAndCatalog(body.personalToken, uuid());
+        const result = upsertQoderAccount(body.providerId, { ...record, index: 0, label: body.label ?? record.label, source: 'manual' });
+        // The catalog fetched during the exchange is the proof the PAT works, so persist it rather
+        // than throwing it away and leaving the account with no routable models until a manual refresh.
+        if (catalog)
+            saveQoderCatalog(result.id, serializeCatalog(catalog), catalog.fetchedAt);
+        if (catalogError)
+            setQoderAccountHealth(result.id, 'unknown', catalogError);
+        recordAudit({ action: 'qoder.accounts.add', success: true, targetType: 'qoder_account', targetId: result.id, targetName: record.label ?? undefined, ip: req.ip, metadata: { status: result.status, catalogError: catalogError ? 'yes' : 'no' } });
+        return { account: summaryOrThrow(result.id), status: result.status, catalogError };
+    });
+    app.post('/api/admin/qoder/accounts/preview', MutationOptions, async (req) => {
+        const input = await readInput(req, req.body);
+        providerOrThrow(input.providerId);
+        const parsed = parseAll(input.text);
+        const seen = new Map();
+        const records = parsed.records.map((record) => {
+            const fingerprint = qoderTokenFingerprint(record.personalToken);
+            const duplicateOf = seen.get(fingerprint);
+            seen.set(fingerprint, record.index);
+            const existing = findQoderAccountForImport(input.providerId, record.personalToken);
+            const resolved = duplicateOf === undefined ? (existing ?? null) : String(duplicateOf);
+            return toQoderPreview(record, resolved);
+        });
+        return {
+            records: [...records, ...parsed.failures.map((f) => ({ index: f.index, source: f.source, valid: false, error: f.error }))],
+            validCount: records.length,
+            invalidCount: parsed.failures.length,
+        };
+    });
+    app.post('/api/admin/qoder/accounts/import', MutationOptions, async (req) => {
+        const input = await readInput(req, req.body);
+        providerOrThrow(input.providerId);
+        const parsed = parseAll(input.text);
+        const selected = input.selectedIndexes ? new Set(input.selectedIndexes) : null;
+        const results = [];
+        let added = 0;
+        let updated = 0;
+        let skipped = 0;
+        let failed = 0;
+        for (const failure of parsed.failures) {
+            if (!selected || selected.has(failure.index)) {
+                failed++;
+                results.push({ index: failure.index, status: 'failed', error: failure.error });
+            }
+            else
+                skipped++;
+        }
+        for (const record of parsed.records) {
+            if (selected && !selected.has(record.index)) {
+                skipped++;
+                continue;
+            }
+            try {
+                const { record: exchanged, catalog, catalogError } = await exchangeAndCatalog(record.personalToken, uuid());
+                const result = upsertQoderAccount(input.providerId, { ...exchanged, index: record.index, label: record.label, source: record.source });
+                if (catalog)
+                    saveQoderCatalog(result.id, serializeCatalog(catalog), catalog.fetchedAt);
+                if (catalogError)
+                    setQoderAccountHealth(result.id, 'unknown', catalogError);
+                if (result.status === 'inserted')
+                    added++;
+                else
+                    updated++;
+                results.push({ index: record.index, status: result.status, label: record.label, masked: toQoderPreview(record).personalTokenMasked });
+            }
+            catch (error) {
+                failed++;
+                results.push({ index: record.index, status: 'failed', error: redactString(error instanceof Error ? error.message : 'Import failed') });
+            }
+        }
+        recordAudit({ action: 'qoder.accounts.import', success: failed === 0, targetType: 'provider', targetId: input.providerId, ip: req.ip, metadata: { added, updated, skipped, failed } });
+        return { added, updated, skipped, failed, results };
+    });
+    app.get('/api/admin/qoder/accounts', async (req) => {
+        const providerId = z.object({ providerId: z.string().min(1) }).parse(req.query).providerId;
+        providerOrThrow(providerId);
+        return { accounts: listQoderAccountSummaries(providerId) };
+    });
+    const ReorderBody = z.object({ providerId: z.string().min(1), ids: z.array(z.string().min(1)).min(1).max(MAX_RECORDS) });
+    app.post('/api/admin/qoder/accounts/reorder', MutationOptions, async (req) => {
+        const { providerId, ids } = ReorderBody.parse(req.body);
+        providerOrThrow(providerId);
+        const owned = new Set(listQoderAccountSummaries(providerId).map((account) => account.id));
+        if (ids.some((id) => !owned.has(id)))
+            throw new GatewayError('invalid_request_error', 'Account list does not match the provider', { status: 400 });
+        const raw = getRawDb();
+        const now = new Date().toISOString();
+        const update = raw.prepare('UPDATE qoder_accounts SET priority=?, updated_at=? WHERE id=?');
+        raw.transaction(() => ids.forEach((id, index) => update.run(index, now, id)))();
+        recordAudit({ action: 'qoder.accounts.reorder', success: true, targetType: 'provider', targetId: providerId, ip: req.ip, metadata: { count: ids.length } });
+        return { accounts: listQoderAccountSummaries(providerId) };
+    });
+    app.patch('/api/admin/qoder/accounts/:id', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const body = QoderAccountUpdate.parse(req.body);
+        summaryOrThrow(id);
+        const raw = getRawDb();
+        const fields = [];
+        const values = [];
+        for (const [key, value] of Object.entries(body)) {
+            const column = { enabled: 'enabled', label: 'label', priority: 'priority' }[key];
+            if (column) {
+                fields.push(`${column}=?`);
+                values.push(typeof value === 'boolean' ? (value ? 1 : 0) : value);
+            }
+        }
+        fields.push('updated_at=?');
+        values.push(new Date().toISOString(), id);
+        raw.prepare(`UPDATE qoder_accounts SET ${fields.join(',')} WHERE id=?`).run(...values);
+        recordAudit({ action: 'qoder.accounts.update', success: true, targetType: 'qoder_account', targetId: id, ip: req.ip, metadata: { fields: Object.keys(body) } });
+        return { account: summaryOrThrow(id) };
+    });
+    app.delete('/api/admin/qoder/accounts/:id', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const account = summaryOrThrow(id);
+        // Hard delete: the encrypted PAT must not linger on disk. Historical attempts survive via
+        // request_attempts.qoder_account_id ON DELETE SET NULL.
+        getRawDb().prepare('DELETE FROM qoder_accounts WHERE id=?').run(id);
+        recordAudit({ action: 'qoder.accounts.delete', success: true, targetType: 'qoder_account', targetId: id, targetName: account.label ?? undefined, ip: req.ip });
+        return { ok: true, deleted: true };
+    });
+    app.post('/api/admin/qoder/accounts/:id/test', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const account = getQoderAccountDetailById(id);
+        if (!account)
+            throw new GatewayError('invalid_request_error', 'Qoder account not found', { status: 404 });
+        const provider = providerOrThrow(account.providerId);
+        const result = await withQoderCredentials(id, (config) => probeQoder({ ...config, accountRecordId: id, totalTimeoutMs: Math.min(provider.total_timeout_ms, 20_000) }));
+        setQoderAccountHealth(id, result.ok ? 'healthy' : 'down', result.ok ? null : redactString(result.detail));
+        recordAudit({ action: 'qoder.accounts.test', success: result.ok, targetType: 'qoder_account', targetId: id, ip: req.ip, metadata: { detail: redactString(result.detail) } });
+        return { ok: result.ok, detail: redactString(result.detail), latencyMs: result.latencyMs, modelCount: result.modelCount ?? null };
+    });
+    /** Force-mint a job token and re-fetch the catalog. Returns counts and keys, never the blob. */
+    app.post('/api/admin/qoder/accounts/:id/catalog', MutationOptions, async (req) => {
+        const { id } = req.params;
+        if (!getQoderAccountDetailById(id))
+            throw new GatewayError('invalid_request_error', 'Qoder account not found', { status: 404 });
+        const { config } = await qoderCredentialsFor(id, { force: true });
+        const keys = config.catalog ? [...config.catalog.entries.keys()] : [];
+        recordAudit({ action: 'qoder.accounts.catalog', success: Boolean(config.catalog), targetType: 'qoder_account', targetId: id, ip: req.ip, metadata: { modelCount: keys.length } });
+        return { modelCount: keys.length, modelKeys: keys, catalogFetchedAt: config.catalog?.fetchedAt ?? null };
+    });
+}

package/dist/server/routes/admin.js

@@ -14,6 +14,7 @@ import { registerSettingsRoutes } from './admin/settings.js';
 import { registerBackupRoutes } from './admin/backup.js';
 import { registerDashboardRoutes } from './admin/dashboard.js';
 import { registerCodexRoutes, registerCodexOAuthCallbackRoute } from './admin/codex.js';
+import { registerQoderRoutes } from './admin/qoder.js';
 export async function registerAdminRoutes(app) {
     // Setup routes are always reachable (used on first run).
     await app.register(async (instance) => {
@@ -44,8 +45,14 @@ export async function registerAdminRoutes(app) {
         await registerStatsRoutes(instance);
         await registerAuditRoutes(instance);
         await registerSettingsRoutes(instance);
-        await registerBackupRoutes(instance);
         await registerDashboardRoutes(instance);
         await registerCodexRoutes(instance);
+        await registerQoderRoutes(instance);
+    });
+    // Backup routes get their own scope. The first-run import (setup.tsx) must be reachable before
+    // any admin account exists, but this scope's parent runs the other admin modules' auth hooks,
+    // and a preHandler cannot short-circuit a later one — so the exemption has to be the only hook.
+    await app.register(async (instance) => {
+        await registerBackupRoutes(instance);
     });
 }

package/dist/server/routing/capabilities.js

@@ -57,6 +57,7 @@ const NON_CAPABILITY_TEXT = {
     combo_disabled: 'combo disabled',
     member_disabled: 'disabled in this combo',
     codex_account_unavailable: 'no available Codex account',
+    qoder_account_unavailable: 'no enabled Qoder account is available — check the account group',
 };
 const REASON_TEXT = {
     ...NON_CAPABILITY_TEXT,

package/dist/server/routing/combo.js

@@ -23,10 +23,29 @@ export function loadCombo(comboId) {
         },
     };
 }
-export function expandCodexAccountCandidates(candidate, accounts, now = new Date()) {
-    if (!candidate.publicModelId.startsWith('codex/'))
+/**
+ * One Qoder candidate per eligible account so account-level fallback works without touching the
+ * combo plan. Keyed off the resolved provider type, never a hardcoded slug prefix.
+ *
+ * A `degraded` account stays eligible: it is a warning (last migration of a billing/quota block),
+ * not a verdict — the runner retries it and the upstream answers honestly. Only `down` and
+ * `disabled` are excluded.
+ */
+export function expandQoderAccountCandidates(candidate, accounts) {
+    if (candidate.providerType !== 'qoder')
         return [candidate];
-    const usable = accounts.filter((a) => a.enabled && (a.healthState === 'healthy' || a.healthState === 'unknown') && Date.parse(a.tokenExpiresAt) > now.getTime())
+    const usable = accounts
+        .filter((account) => account.enabled && account.healthState !== 'down')
+        .sort((a, b) => a.priority - b.priority || a.id.localeCompare(b.id));
+    return usable.map((account) => ({ ...candidate, qoderAccountId: account.id, qoderUserId: account.qoderUserId, selectionReason: 'qoder_account' }));
+}
+export function expandCodexAccountCandidates(candidate, accounts) {
+    if (candidate.providerType !== 'codex')
+        return [candidate];
+    // No token-expiry filter here: `withCodexCredentials` refreshes before the upstream call, so an
+    // expired token is still routable. Gating on it rejected exactly the accounts most in need of a
+    // refresh, turning a recoverable state into "no available Codex account".
+    const usable = accounts.filter((a) => a.enabled && a.healthState !== 'down')
         .sort((a, b) => a.priority - b.priority || a.id.localeCompare(b.id));
     return usable.map((a) => ({ ...candidate, codexAccountId: a.id, codexChatgptAccountId: a.chatgptAccountId, selectionReason: 'codex_account' }));
 }

package/dist/server/upstream/client.js

@@ -4,6 +4,7 @@ import { GatewayError } from '../errors.js';
 import { buildHeaders, stripSlash } from '../providers/index.js';
 import { redactString } from '../security/redact.js';
 import { getCodexAccountForProvider, getCodexAccountById } from '../db/repositories/codex-accounts.js';
+import { findEligibleQoderAccount } from '../db/repositories/qoder-accounts.js';
 import { debugUpstream, errorLine, formatError, truncate } from '../logging/debug.js';
 export function providerToUpstreamConfig(p, codexAccountId) {
     let apiKey;
@@ -19,6 +20,19 @@ export function providerToUpstreamConfig(p, codexAccountId) {
             codexAccountId: account.chatgptAccountId, accountRecordId: account.id,
         };
     }
+    if (p.type === 'qoder') {
+        // Account-pool provider: no API key on the row. The runner normally overrides the account
+        // from the expanded candidate; this resolves the first eligible one for direct callers.
+        const account = findEligibleQoderAccount(p.id);
+        if (!account)
+            throw new GatewayError('authentication_error', 'No usable Qoder account is configured', { status: 503 });
+        return {
+            type: 'qoder', baseUrl: p.baseUrl, customHeaders: {},
+            connectTimeoutMs: p.connectTimeoutMs, firstTokenTimeoutMs: p.firstTokenTimeoutMs,
+            streamIdleTimeoutMs: p.streamIdleTimeoutMs, totalTimeoutMs: p.totalTimeoutMs,
+            qoderUserId: account.qoderUserId, qoderAccountRecordId: account.id,
+        };
+    }
     if (!p.encryptedApiKey || !p.apiKeyNonce) {
         throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
     }