ldrouter 1.17.2 → 1.17.4

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.17.4] - 2026-09-18
+
+### Fixed
+
+- **An account that ran out of quota kept being retried instead of leaving the pool.** A quota refusal was classified `unknown`, which is not a routing decision: `isUpstreamHealthFailure` excludes it and `shouldFallback` answers false for it, so the pool selected the same spent account on every request and answered "usage limited". Live production data confirmed the shape — 49 quota refusals (`Codex upstream HTTP 429: The usage limit has been reached`, `Qoder account is out of quota`) recorded over 14 days, every one of them `failure_reason=unknown`, with the same `codex_account_id` / `qoder_account_id` retried each time. Quota is now its own failure class, checked before the error-type switch (a 429 reaches the classifier as `upstream_rate_limit`, which previously returned `http_status` before the quota test could run).
+- **The exhausted account is now disabled, not just marked degraded.** Disabling (`enabled=0`) is the write that actually stops the churn: every selection path — `expandCodexAccountCandidates`, `expandQoderAccountCandidates`, `getCodexAccountForProvider`, `findEligibleQoderAccount` — filters on it, whereas `health_state` alone was overwritten to `healthy` by the next successful request. A Qoder billing block now disables the account too, instead of only degrading it.
+- **A direct model never advanced to the next account.** The retry was gated on `comboPlan ? ... : false`, so the reported case — a direct `qoder/...` model, logged 33 times in production — never retried at all. A quota failure now always advances to the next candidate, combo or not; that is safe precisely because the exhausted account was just disabled, so the retry cannot land on it again.
+- **The upstream 429 body was discarded, hiding the reason.** Quota exhaustion arrives as a plain 429 on OpenAI-compatible providers, with the wording ("you exceeded your current quota") only in the body — which `upstreamHttpError` dropped, leaving an account unclassifiable. The redacted body excerpt is now carried on a 429 too. A 429 without quota wording is still treated as a transient throttle: it retries the same account and does not disable it.
+- **Re-enabling an account in the admin UI did not put it back in the pool.** The enable toggle flipped `enabled` but left `health_state=down`, which every selection filter excludes, so the account stayed unroutable while the panel showed it as enabled. Both the Codex and Qoder routes now clear the health verdict when re-enabling.
+
+### Added
+
+- **Usage and Credits are refreshed as the pool is used.** Both the Codex usage snapshot and the Qoder credits snapshot are re-read in the background after a successful request, throttled per account so a burst of traffic costs at most one extra upstream call, and never awaited — the response path is unaffected.
+
+## [1.17.3] - 2026-09-17
+
+### Added
+
+- **Qoder accounts now show Credits — the account's real usage.** Qoder does not bill in tokens: its chat stream carries no usage block at all, so every Qoder request logged zero tokens and the panel had no usage figure to show. Credits are now read from Qoder's quota API (`GET /api/v2/quota/usage`) and shown per account: plan / add-on / org buckets, percentage used, expiry, and whether the quota is exhausted. A **Refresh credits** action re-reads them for every account.
+- **Promotion-covered models are shown next to Credits.** Qoder keeps a model free by marking its catalog entry `is_free` — currently `qmodel_38max` (Qwen3.8-Max). Such a model spends no Credits, so an account at zero Credits still answers on it while every other model is refused. The panel now pairs **No plan credits** with **Free now: <model>** so a partly-working account reads as intended instead of looking like a router fault.
+
+### Fixed
+
+- **A Qoder quota refusal was reported as a token rejection.** The upstream returns HTTP 200 with a `403 code 112` envelope inside the streamed body for quota/billing refusals; the attempt classifier checked `401/403` before billing, so a depleted account was labelled "job token was rejected after a refresh" and the account was force-re-exchanged on every request. Billing-shaped refusals are no longer mistaken for credential failures.
+- **The account Test button reported a blocked account as working.** It only probed the model catalog, which proves the PAT exchanges and nothing else — the refusal arrives as a `403` envelope inside an HTTP 200 body, so a check that never sends a message cannot see it. Test now sends one real request, preferring a promotion-covered model so testing never spends Credits, and names the free models that still work when the account is out of them.
+
 ## [1.17.2] - 2026-09-17
 
 ### Fixed

package/README.md

@@ -65,6 +65,8 @@ ZIP upload and automatic Codex CLI config-file generation/mutation are not inclu
 
 The account panel shows the 5-hour and weekly quota windows with reset countdowns, per-account and bulk usage refresh, weekly reset credits, an opt-in 5-hour window auto-start, and a **Test** control that probes the upstream account without exposing tokens. Routing order is set by dragging rows; the saved order is the fallback order the router uses. **Delete** is permanent and erases the stored encrypted credentials — past request logs are kept but lose the account reference.
 
+**A quota-exhausted account leaves the pool on its own.** When an account refuses for quota reasons — Codex `429 The usage limit has been reached`, or Qoder `out of credits` — it is marked `down` *and disabled*, so the very next request picks a different account in the pool rather than retrying the spent one. This applies to direct `codex/...` and `qoder/...` models too, not only combos. Re-enable the account in the panel once its window resets. Both Codex usage and Qoder credits are also refreshed in the background after a successful request (throttled, and never on the response path), so the panel figures track real usage without pressing **Refresh**.
+
 ### Qoder setup
 
 Qoder providers use a personal access token (PAT) instead of an API key. Create one at `https://qoder.com/account/integrations`; it starts with `pt-`.
@@ -81,6 +83,30 @@ Because the gateway serves model discovery from that live catalog, a new account
 
 The panel shows the masked user id, job-token expiry, when the catalog was last fetched, health, and an enabled toggle. Routing order is set by dragging rows, exactly as with Codex.
 
+### Qoder usage, Credits and promotions
+
+Qoder does not meter models in tokens: its chat stream carries no usage block at all, so request logs
+show zero tokens for every Qoder model and the panel's **Credits** column is the account's real
+usage. It is read from Qoder's quota API (`GET /api/v2/quota/usage` on `openapi.qoder.sh`) and shows
+the plan / add-on / org buckets, the percentage used, and whether the account is exhausted.
+
+**Credits and free models are different things, and the panel shows both.** Qoder keeps promoting a
+model — currently `qmodel_38max`, the Qwen3.8-Max route — by marking its catalog entry `is_free`.
+Such a model spends no Credits, so an account at **zero Credits** still answers on it while every
+other model returns an envelope `403 code 112` with a `pricingUrl`. That pairing is what makes an
+"out of credits" account look partly broken: the panel labels the column **No plan credits** next to
+**Free now: qmodel_38max** so the contradiction is visible instead of looking like a router fault.
+
+There is an upstream edge worth knowing when reading logs: a quota refusal arrives as **HTTP 200**
+with a `403` envelope inside the streamed body, so it is not an HTTP error at the transport layer.
+
+Use **Refresh credits** to re-read the snapshot for every account. It deliberately reuses the live
+`job token` instead of exchanging the PAT again — a fresh exchange invalidates the token a
+concurrent request may be using.
+
+**Test** sends one real message, because a catalog probe cannot see a quota refusal. It picks a
+promotion-covered model when the account has one, so testing never spends Credits.
+
 ## Environment variables
 
 | Variable | Description | Default |

package/dist/server/db/repositories/qoder-accounts.js

@@ -5,6 +5,18 @@ import { decryptSecret, encryptSecret } from '../../auth/crypto.js';
 import { uuid } from '../../auth/ids.js';
 import { createHash } from 'node:crypto';
 import { getRawDb } from '../index.js';
+/** A corrupted or absent snapshot reads as "no data", never as a thrown error on a list call. */
+function parseStoredCredits(json) {
+    if (!json)
+        return null;
+    try {
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
 export function maskQoderValue(value) {
     if (!value)
         return null;
@@ -18,7 +30,7 @@ export function identityFromQoderRecord(record) {
         label: record.label,
     };
 }
-const SUMMARY_COLUMNS = 'id,provider_id AS providerId,label,email,qoder_user_id AS qoderUserId,machine_id AS machineId,enabled,health_state AS healthState,priority,job_token_expires_at AS jobTokenExpiresAt,catalog_fetched_at AS catalogFetchedAt,last_error AS lastError,consecutive_failures AS consecutiveFailures,created_at AS createdAt,updated_at AS updatedAt';
+const SUMMARY_COLUMNS = 'id,provider_id AS providerId,label,email,qoder_user_id AS qoderUserId,machine_id AS machineId,enabled,health_state AS healthState,priority,job_token_expires_at AS jobTokenExpiresAt,catalog_fetched_at AS catalogFetchedAt,credits_json AS creditsJson,credits_updated_at AS creditsUpdatedAt,credits_error AS creditsError,last_error AS lastError,consecutive_failures AS consecutiveFailures,created_at AS createdAt,updated_at AS updatedAt';
 export function toQoderAccountSummary(row) {
     return {
         id: row.id,
@@ -31,6 +43,9 @@ export function toQoderAccountSummary(row) {
         priority: row.priority,
         jobTokenExpiresAt: row.jobTokenExpiresAt,
         catalogFetchedAt: row.catalogFetchedAt,
+        credits: (row.credits ?? null) || parseStoredCredits(row.creditsJson ?? null),
+        creditsUpdatedAt: row.creditsUpdatedAt ?? null,
+        creditsError: row.creditsError ?? null,
         lastError: row.lastError,
         consecutiveFailures: row.consecutiveFailures,
         createdAt: row.createdAt,
@@ -140,11 +155,16 @@ export function persistQoderJobToken(id, update) {
        health_state='healthy', last_error=NULL, updated_at=? WHERE id=?`)
         .run(jobToken.ciphertext, jobToken.nonce, jobToken.version, update.expiresAt, update.catalogJson ?? null, update.catalogFetchedAt ?? null, nextUpdatedAt(id), id);
 }
-export function setQoderAccountHealth(id, healthState, lastError = null) {
+/** `enabled` mirrors the Codex setter: pass `false` to take an exhausted account out of the pool. */
+export function setQoderAccountHealth(id, healthState, lastError = null, enabled) {
     const failures = healthState === 'healthy' ? 0 : null;
-    getRawDb()
-        .prepare(`UPDATE qoder_accounts SET health_state=?, last_error=?, consecutive_failures=COALESCE(?, consecutive_failures), updated_at=? WHERE id=?`)
-        .run(healthState, lastError, failures, nextUpdatedAt(id), id);
+    const fields = enabled === undefined
+        ? 'health_state=?, last_error=?, consecutive_failures=COALESCE(?, consecutive_failures), updated_at=?'
+        : 'health_state=?, last_error=?, consecutive_failures=COALESCE(?, consecutive_failures), enabled=?, updated_at=?';
+    const values = enabled === undefined
+        ? [healthState, lastError, failures, nextUpdatedAt(id), id]
+        : [healthState, lastError, failures, enabled ? 1 : 0, nextUpdatedAt(id), id];
+    getRawDb().prepare(`UPDATE qoder_accounts SET ${fields} WHERE id=?`).run(...values);
 }
 export function readQoderCatalog(id) {
     const row = getRawDb()
@@ -157,6 +177,17 @@ export function saveQoderCatalog(id, catalogJson, fetchedAt) {
         .prepare('UPDATE qoder_accounts SET catalog_json=?, catalog_fetched_at=?, updated_at=? WHERE id=?')
         .run(catalogJson, fetchedAt ?? new Date().toISOString(), nextUpdatedAt(id), id);
 }
+/** When the Credits snapshot was last written; null when it never has been. */
+export function readQoderCreditsUpdatedAt(id) {
+    const row = getRawDb().prepare('SELECT credits_updated_at AS at FROM qoder_accounts WHERE id=?').get(id);
+    return row?.at ?? null;
+}
+/** Credits are observability, not routing state: a failed fetch is recorded without touching health. */
+export function saveQoderCredits(id, creditsJson, error, fetchedAt) {
+    getRawDb()
+        .prepare('UPDATE qoder_accounts SET credits_json=COALESCE(?, credits_json), credits_updated_at=?, credits_error=?, updated_at=? WHERE id=?')
+        .run(creditsJson, fetchedAt, error, nextUpdatedAt(id), id);
+}
 // Keeps `updated_at` strictly increasing even within the same millisecond, so a caller can
 // detect a write it just made. Copied from the Codex repository for consistency.
 function nextUpdatedAt(id) {

package/dist/server/gateway/runner.js

@@ -8,7 +8,9 @@ import { loadCombo, selectCandidates, orderCandidates, shouldFallback, expandCod
 import { listCodexAccountsForProvider, setCodexAccountHealth } from '../db/repositories/codex-accounts.js';
 import { listQoderAccountsForProvider, setQoderAccountHealth } from '../db/repositories/qoder-accounts.js';
 import { qoderAttemptFailure, qoderCredentialsFor } from '../providers/qoder/credentials.js';
+import { refreshQoderCreditsIfStale } from '../providers/qoder/credits.js';
 import { callQoderNonStreaming, callQoderStreaming } from '../providers/qoder/client.js';
+import { refreshCodexUsageIfStale } from '../providers/codex-autostart.js';
 import { getEffectiveState, isOpen, recordSuccess, recordFailure, halfOpenProbeAllowed } from '../routing/circuit.js';
 import { checkRpm, checkTpm, acquireConcurrent, releaseConcurrent } from '../routing/ratelimit.js';
 import { checkDailyMonthly, consumeUsage } from '../routing/quota.js';
@@ -279,6 +281,13 @@ export class GatewayRunner {
                         setCodexAccountHealth(candidate.codexAccountId, 'healthy');
                     if (candidate.qoderAccountId)
                         setQoderAccountHealth(candidate.qoderAccountId, 'healthy');
+                    // Refresh the quota snapshot in the background so the dashboard reflects real usage.
+                    // Never awaited: it is a second upstream call, and the response is already complete.
+                    // Throttled inside each helper, so a burst of requests costs at most one refresh.
+                    if (candidate.codexAccountId)
+                        void refreshCodexUsageIfStale(candidate.codexAccountId).catch(() => { });
+                    if (candidate.qoderAccountId)
+                        void refreshQoderCreditsIfStale(candidate.qoderAccountId).catch(() => { });
                     getDb().update(schema.providers).set({ healthState: 'healthy', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
                     attempts.push(attempt);
                     sentToClient = out.streamStarted ?? false;
@@ -286,15 +295,19 @@ export class GatewayRunner {
                 }
                 catch (e) {
                     const err = e instanceof GatewayError ? e : new GatewayError('upstream_error', e.message, { cause: e });
+                    const quotaFailure = isQuotaFailure(err);
                     debugUpstream(ctx.requestId, 'ATTEMPT ERROR', [
                         `attempt=${i + 1}`,
                         `provider=${provider.name}`,
                         `model=${candidate.publicModelId}`,
                         `type=${err.type}`,
                         `status=${err.status}`,
-                        `willFallback=${comboPlan ? shouldFallback(comboPlan, { type: classifyFailure(err), status: err.status }) : false}`,
+                        `willFallback=${shouldRetryAttempt(comboPlan, err)}`,
                     ]);
-                    const shouldRetry = comboPlan ? shouldFallback(comboPlan, { type: classifyFailure(err), status: err.status }) : false;
+                    // Quota failures always advance (see shouldRetryAttempt): the next candidate for a pool
+                    // provider is the next account, and the exhausted one was just disabled so the retry cannot
+                    // land on it again.
+                    const shouldRetry = shouldRetryAttempt(comboPlan, err);
                     attempt.statusCode = err.status;
                     attempt.success = false;
                     attempt.latencyMs = Date.now() - attemptStart;
@@ -312,6 +325,10 @@ export class GatewayRunner {
                     }
                     attempts.push(attempt);
                     lastError = err;
+                    // An exhausted account leaves the pool outright: without this the combo retried the same
+                    // dead account on every request for hours (verified live) and answered "usage limited".
+                    if (quotaFailure)
+                        markQuotaExhausted(candidate, err.message);
                     if (isUpstreamHealthFailure(err)) {
                         recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
                         if (candidate.codexAccountId)
@@ -971,7 +988,71 @@ export class GatewayRunner {
 export function isUpstreamHealthFailure(err) {
     return ['connection_error', 'connect_timeout', 'first_token_timeout', 'http_status', 'upstream_rate_limit'].includes(classifyFailure(err));
 }
+/**
+ * An exhausted quota is a durable, per-account verdict — the account cannot serve anything again
+ * until its window resets, so it must leave the pool instead of being retried.
+ *
+ * Deliberately NOT part of `isUpstreamHealthFailure`: that path opens the provider's circuit
+ * breaker, which here would take down every sibling account of a healthy pool because one member
+ * ran dry. The exhaustion is applied account-by-account by `markQuotaExhausted` instead.
+ *
+ * Detection needs both signals because the two upstreams refuse differently, and neither reports a
+ * status the router can trust alone:
+ *  - Codex answers 429 but the credential layer re-wraps it (status 502, cause 429), and a plain
+ *    rate limit is also a 429 — the "usage limit"/"quota" wording is what distinguishes "come back
+ *    in an hour" from "this account is spent".
+ *  - Qoder refuses with a billing envelope carrying status 403/code 112, surfaced as the
+ *    `qoder_billing_block` code.
+ * Wording is only consulted when the status is quota-shaped, so a 400 that merely mentions the word
+ * "quota" cannot disable a working account.
+ */
+export function isQuotaFailure(err) {
+    if (err.code === 'qoder_billing_block')
+        return true;
+    const cause = err.cause;
+    const upstreamStatus = typeof cause?.status === 'number' ? cause.status : err.status;
+    if (upstreamStatus !== 429 && upstreamStatus !== 403)
+        return false;
+    return /usage[_ -]?limit|quota|out of credits|insufficient[_ -]?(credit|balance)|exceeded your current quota|billing/i.test(err.message);
+}
+/**
+ * Take an exhausted account out of the pool: mark it down and disable it.
+ *
+ * `enabled=0` (not just `health_state='down'`) is what the operator asked for and what actually
+ * stops the churn: every selection path — `expandCodexAccountCandidates`,
+ * `expandQoderAccountCandidates`, `getCodexAccountForProvider`, `findEligibleQoderAccount` — filters
+ * on `enabled`, so disabling is the one write that makes the next request pick a different account.
+ * The account stays visible in the admin UI, where re-enabling it after the window resets is a
+ * one-click action.
+ */
+export function markQuotaExhausted(candidate, message) {
+    const reason = redactString(message);
+    if (candidate.codexAccountId)
+        setCodexAccountHealth(candidate.codexAccountId, 'down', reason, false);
+    if (candidate.qoderAccountId)
+        setQoderAccountHealth(candidate.qoderAccountId, 'down', reason, false);
+}
+/**
+ * Whether a failed attempt should advance to the next candidate.
+ *
+ * A quota failure always advances, with or without a combo plan. For a pool provider the next
+ * candidate is the next *account*, so requiring a combo plan left a direct `codex/…` or `qoder/…`
+ * request pinned to the exhausted account — the reported bug ("does not switch to a new account,
+ * just answers usage limited"). Safe because the exhausted account was just disabled: the retry
+ * cannot land on it again. Everything else keeps the combo's configured triggers, where no combo
+ * plan means no fallback.
+ */
+export function shouldRetryAttempt(comboPlan, err) {
+    if (isQuotaFailure(err))
+        return true;
+    return comboPlan ? shouldFallback(comboPlan, { type: classifyFailure(err), status: err.status }) : false;
+}
 export function classifyFailure(err) {
+    // Checked first, before the type switch: a quota refusal arrives as `upstream_rate_limit` (a
+    // 429) or `upstream_error` (Codex rewraps it as a 502 with a 429 cause; Qoder uses code 112) and
+    // must not fall through to `http_status`/`unknown`, neither of which is a routing decision.
+    if (isQuotaFailure(err))
+        return 'quota';
     switch (err.type) {
         case 'timeout_error':
             return err.message.includes('first token') ? 'first_token_timeout' : 'connect_timeout';

package/dist/server/providers/codex-autostart.js

@@ -16,6 +16,27 @@ function providerFor(providerId) {
 function accountFor(accountId) {
     return getRawDb().prepare('SELECT id,chatgpt_account_id FROM codex_accounts WHERE id=?').get(accountId) ?? null;
 }
+/**
+ * Keep the quota snapshot honest while the account is in use.
+ *
+ * The usage API is a second upstream call, so this is throttled rather than run per request: a
+ * snapshot younger than the interval is left alone. Before this, usage only refreshed when an admin
+ * pressed the button or on the 10-minute autostart tick for opted-in accounts, so a dashboard could
+ * show hours-old consumption for an account actively serving traffic.
+ */
+export const CODEX_USAGE_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+export async function refreshCodexUsageIfStale(accountId, now = new Date()) {
+    const row = getRawDb().prepare('SELECT provider_id AS providerId,chatgpt_account_id AS chatgptAccountId,codex_usage_updated_at AS at FROM codex_accounts WHERE id=?').get(accountId);
+    if (!row)
+        return;
+    const provider = providerFor(row.providerId);
+    if (!provider)
+        return;
+    const last = row.at ? Date.parse(row.at) : NaN;
+    if (Number.isFinite(last) && now.getTime() - last < CODEX_USAGE_REFRESH_INTERVAL_MS)
+        return;
+    await refreshStoredCodexUsage(accountId, provider, { id: accountId, chatgpt_account_id: row.chatgptAccountId });
+}
 /** Reads fresh usage; stores the snapshot or a sanitized reason on failure. */
 export async function refreshStoredCodexUsage(accountId, provider, account) {
     try {

package/dist/server/providers/pooled.js

@@ -6,7 +6,7 @@ import { listCodexAccountSummaries, chatgptAccountIdOf } from '../db/repositorie
 import { listQoderAccountSummaries } from '../db/repositories/qoder-accounts.js';
 import { probeCodex, codexModels, CODEX_BASE_URL } from './codex.js';
 import { withCodexCredentials, codexCredentialError } from './codex-refresh.js';
-import { probeQoder, qoderModels } from './qoder/client.js';
+import { probeQoderInference, qoderModels } from './qoder/client.js';
 import { withQoderCredentials } from './qoder/credentials.js';
 import { QODER_INFERENCE_BASE } from './qoder/constants.js';
 export const POOLED_PROVIDER_TYPES = ['codex', 'qoder'];
@@ -49,7 +49,9 @@ const qoderStrategy = {
     // through the credential seam so a stale job token is refreshed before the upstream is asked.
     probe: async (provider) => {
         const account = firstEligible(qoderStrategy.listAccounts(provider.id));
-        return withQoderCredentials(account.id, (config) => probeQoder({ ...config, accountRecordId: account.id, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 20_000) }))
+        // Inference, not just the catalog — see probeQoderInference: a catalog probe cannot see the
+        // billing envelope that Qoder returns with HTTP 200 when an account is out of Credits.
+        return withQoderCredentials(account.id, (config) => probeQoderInference({ ...config, accountRecordId: account.id, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 30_000) }))
             .catch((error) => { throw qoderCredentialError(error); });
     },
     discover: async (provider) => {

package/dist/server/providers/qoder/catalog.js

@@ -43,6 +43,7 @@ export function parseCatalog(body, fetchedAt) {
             enabled: raw.enable !== false,
             isReasoning: raw.is_reasoning === true,
             isVl: raw.is_vl === true,
+            isFree: raw.is_free === true,
             maxInputTokens: numberOr(raw.max_input_tokens, 0),
             maxOutputTokens: numberOr(raw.max_output_tokens, 0),
             raw,
@@ -65,9 +66,13 @@ export function deserializeCatalog(raw) {
         const parsed = JSON.parse(raw);
         const entries = new Map();
         if (Array.isArray(parsed.entries)) {
-            for (const entry of parsed.entries)
-                if (entry?.key)
-                    entries.set(entry.key, entry);
+            for (const entry of parsed.entries) {
+                if (!entry?.key)
+                    continue;
+                // Catalogs cached before `isFree` existed carry only `raw.is_free`, so re-derive it
+                // rather than showing an empty free-model list until the next catalog refresh.
+                entries.set(entry.key, entry.isFree === undefined ? { ...entry, isFree: entry.raw?.is_free === true } : entry);
+            }
         }
         return { entries, fetchedAt: typeof parsed.fetchedAt === 'string' ? parsed.fetchedAt : '' };
     }

package/dist/server/providers/qoder/client.js

@@ -229,6 +229,52 @@ export async function probeQoder(cfg) {
     }
     return { ok: true, detail: 'Connected (catalog loaded)', latencyMs: Date.now() - started, modelCount: catalogue.entries.size };
 }
+/**
+ * A catalog probe proves the PAT exchanges, nothing more. Qoder refuses inference with an
+ * envelope-level 403 (code 112, billing) on an HTTP 200 response, so an account can pass the
+ * catalog probe while every chat it serves is refused — which reads as "the API key is fine"
+ * right up until a real request fails. This probe sends one real message to settle it.
+ *
+ * It prefers a catalog entry marked `is_free` (a promotion spends no Credits) so testing an
+ * account never consumes paid quota.
+ */
+export async function probeQoderInference(cfg) {
+    const started = Date.now();
+    const catalogue = cfg.catalog;
+    if (!catalogue || catalogue.entries.size === 0) {
+        return { ok: false, detail: 'Model catalog is empty — check the personal access token', latencyMs: Date.now() - started };
+    }
+    const entries = [...catalogue.entries.values()];
+    const model = entries.find((entry) => entry.isFree) ?? entries[0];
+    const probe = {
+        model: model.key,
+        messages: [{ role: 'user', content: [{ type: 'text', text: 'ping' }] }],
+        maxOutputTokens: 16,
+        stream: false,
+    };
+    try {
+        await callQoderNonStreaming({ ...cfg, totalTimeoutMs: Math.min(cfg.totalTimeoutMs, 30_000) }, probe);
+        return { ok: true, detail: `Inference OK (${model.key}${model.isFree ? ', free' : ''})`, latencyMs: Date.now() - started, modelCount: entries.length };
+    }
+    catch (error) {
+        if (error instanceof QoderUpstreamError && error.billing) {
+            const free = freeModelHint(entries);
+            return {
+                ok: false,
+                detail: `Account is out of Credits — ${model.key} was refused as billing. ${free ?? 'No promotion-covered model is available on this account, so nothing it serves will work until Credits are added.'}`,
+                latencyMs: Date.now() - started,
+                modelCount: entries.length,
+            };
+        }
+        const detail = error instanceof QoderUpstreamError ? `HTTP ${error.status}: ${error.message}` : error instanceof Error ? error.message : 'inference probe failed';
+        return { ok: false, detail: redactString(detail), latencyMs: Date.now() - started, modelCount: entries.length };
+    }
+}
+/** Null when the account has no promotion-covered model — the caller words that case itself. */
+function freeModelHint(entries) {
+    const free = entries.filter((entry) => entry.isFree).map((entry) => entry.key);
+    return free.length > 0 ? `Free models (promotions) still work: ${free.join(', ')}` : null;
+}
 /** Catalog entries become discovered models; hidden (enable:false) keys stay routable. */
 export function qoderModels(catalog) {
     return [...catalog.entries.values()].map((entry) => ({

package/dist/server/providers/qoder/constants.js

@@ -9,6 +9,8 @@ export const QODER_INFERENCE_BASE = 'https://api2.qoder.sh';
 export const QODER_LOGIN_URL = 'https://qoder.com/account/integrations';
 export const QODER_JOB_TOKEN_EXCHANGE_URL = `${QODER_OPENAPI_BASE}/api/v1/jobToken/exchange`;
 export const QODER_USERINFO_URL = `${QODER_OPENAPI_BASE}/api/v1/userinfo`;
+// Credits (Qoder's billing unit) live on openapi, not on the inference host.
+export const QODER_CREDITS_URL = `${QODER_OPENAPI_BASE}/api/v2/quota/usage`;
 export const QODER_CHAT_SIG_PATH = '/api/v2/service/pro/sse/agent_chat_generation';
 export const QODER_CHAT_URL = `${QODER_INFERENCE_BASE}/algo${QODER_CHAT_SIG_PATH}?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1`;
 export const QODER_MODEL_LIST_URL = `${QODER_INFERENCE_BASE}/algo/api/v2/model/list`;

package/dist/server/providers/qoder/credentials.js

@@ -102,6 +102,17 @@ export async function qoderCredentialsFor(accountRecordId, options = {}) {
 export async function qoderAttemptFailure(accountRecordId, error) {
     const status = error.status ?? 502;
     const billing = Boolean(error.billing);
+    // Billing is checked first because a quota refusal carries status 403 (code 112) and would
+    // otherwise be classified as a rejected credential: that mislabels the cause, force-re-exchanges
+    // a perfectly good PAT on every request, and hides the real answer (the account is out of quota).
+    if (billing) {
+        // Disabled, not merely degraded: a depleted account cannot serve paid models until its Credits
+        // refill, and leaving it eligible made the pool retry it on every request while the client saw
+        // "usage limited". The operator re-enables it (or adds Credits) from the admin UI; Credits
+        // refresh keeps the snapshot honest in the meantime.
+        setQoderAccountHealth(accountRecordId, 'down', 'out of Credits — re-enable after topping up', false);
+        throw new GatewayError('upstream_error', 'Qoder account is out of quota', { status: 502, code: 'qoder_billing_block' });
+    }
     if (status === 401 || status === 403) {
         // The PAT may still be valid — the job token may merely have expired mid-request. Force one
         // exchange before condemning the account; a second rejection is the PAT's fault.
@@ -112,10 +123,6 @@ export async function qoderAttemptFailure(accountRecordId, error) {
         }
         throw new GatewayError('upstream_auth_error', 'Qoder job token was rejected after a refresh', { status: 502, code: 'qoder_auth_failed' });
     }
-    if (billing) {
-        setQoderAccountHealth(accountRecordId, 'degraded', 'upstream reported a quota or billing block');
-        throw new GatewayError('upstream_error', 'Qoder account is out of quota', { status: 502, code: 'qoder_billing_block' });
-    }
     throw upstreamHttpError(status, '', error);
 }
 /** Probe/discover share this: a catalog is the only proof the PAT works end to end. */

package/dist/server/providers/qoder/credits.js

@@ -0,0 +1,101 @@
+// Qoder Credits: the account's real usage. Qoder bills in Credits, not tokens — its chat
+// stream carries no usage block at all — so the quota API is the only upstream truth about
+// consumption. `is_free` on a catalog entry is the separate signal that a model is covered
+// by a promotion (e.g. Qwen3.8-Max) and therefore does not draw on Credits at all.
+import { QODER_CREDITS_URL } from './constants.js';
+import { qoderCredentialsFor } from './credentials.js';
+import { readQoderCreditsUpdatedAt, saveQoderCredits } from '../../db/repositories/qoder-accounts.js';
+const FETCH_TIMEOUT_MS = 10_000;
+const numberOr = (value, fallback) => {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback;
+};
+function isoOrNull(value) {
+    const ms = typeof value === 'number' ? value : Number(value);
+    // 253402214400000 is the far-future sentinel Qoder sends for "no expiry".
+    if (!Number.isFinite(ms) || ms >= 253402214400000)
+        return null;
+    return new Date(ms).toISOString();
+}
+function bucket(label, raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const value = raw;
+    const total = numberOr(value.total, 0);
+    if (total <= 0)
+        return null;
+    const used = numberOr(value.used, 0);
+    return {
+        label,
+        total,
+        used,
+        remaining: numberOr(value.remaining, Math.max(0, total - used)),
+        unit: typeof value.unit === 'string' && value.unit ? value.unit : 'credits',
+    };
+}
+export function parseQoderCredits(body, freeModels, fetchedAt) {
+    const raw = (body && typeof body === 'object' ? body : {});
+    const buckets = [bucket('Plan credits', raw.userQuota), bucket('Add-on credits', raw.addOnQuota), bucket('Org resource package', raw.orgResourcePackage)].filter((entry) => entry !== null);
+    return {
+        userType: typeof raw.userType === 'string' ? raw.userType : 'unknown',
+        freeModels,
+        buckets,
+        totalUsedPercent: numberOr(raw.totalUsagePercentage, 0),
+        exhausted: raw.isQuotaExceeded === true,
+        expiresAt: isoOrNull(raw.expiresAt),
+        upgradeUrl: typeof raw.upgradeUrl === 'string' && raw.upgradeUrl ? raw.upgradeUrl : null,
+        fetchedAt,
+    };
+}
+/**
+ * Live Credits snapshot. A failure is reported as `unavailable` rather than thrown: Credits are
+ * observability, and an account that cannot report them must keep serving requests.
+ */
+export async function fetchQoderCredits(creds, freeModels, deps = {}) {
+    const fetchedAt = new Date().toISOString();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? FETCH_TIMEOUT_MS);
+    try {
+        const response = await (deps.fetchImpl ?? fetch)(QODER_CREDITS_URL, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${creds.jobToken}`, accept: 'application/json', 'user-agent': 'qodercli/1.0.0' },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return { ...parseQoderCredits({}, freeModels, fetchedAt), unavailable: `HTTP ${response.status}` };
+        return parseQoderCredits(await response.json(), freeModels, fetchedAt);
+    }
+    catch (error) {
+        return { ...parseQoderCredits({}, freeModels, fetchedAt), unavailable: error instanceof Error ? error.message : 'Credits request failed' };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Fetch and persist one account's Credits snapshot. Free models come from the account's cached
+ * catalog because `is_free` is a catalog property, not a quota one — it is why an account at zero
+ * Credits can still serve a promotional model.
+ *
+ * Lives here rather than in the admin route so the gateway can reuse it: Credits are the only
+ * upstream truth about consumption (Qoder's chat stream reports no usage at all), so the snapshot
+ * has to be kept fresh as accounts are actually used, not only when an admin opens the page.
+ */
+export async function refreshStoredQoderCredits(accountRecordId) {
+    const { config } = await qoderCredentialsFor(accountRecordId);
+    const freeModels = config.catalog ? [...config.catalog.entries.values()].filter((entry) => entry.isFree).map((entry) => entry.key) : [];
+    const credits = await fetchQoderCredits({ jobToken: config.jobToken }, freeModels, { timeoutMs: FETCH_TIMEOUT_MS });
+    saveQoderCredits(accountRecordId, credits.unavailable ? null : JSON.stringify(credits), credits.unavailable ?? null, credits.fetchedAt);
+    return credits;
+}
+/** Same throttle as Codex usage: the Credits endpoint is a second upstream call per account. */
+export const QODER_CREDITS_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+export async function refreshQoderCreditsIfStale(accountRecordId, now = new Date()) {
+    const row = readQoderCreditsUpdatedAt(accountRecordId);
+    const last = row ? Date.parse(row) : NaN;
+    if (Number.isFinite(last) && now.getTime() - last < QODER_CREDITS_REFRESH_INTERVAL_MS)
+        return;
+    // Never throws, matching `refreshStoredCodexUsage`: this runs in the background after a response
+    // has already been delivered, so a dead credential or unreachable quota API must not surface.
+    await refreshStoredQoderCredits(accountRecordId).catch(() => { });
+}

package/dist/server/routes/admin/codex.js

@@ -274,6 +274,12 @@ export async function registerCodexRoutes(app) {
                 values.push(typeof value === 'boolean' ? (value ? 1 : 0) : value);
             }
         }
+        // Re-enabling must also clear a quota verdict: every selection path excludes `health_state='down'`,
+        // so flipping `enabled` alone would leave the account unreachable while the UI showed it as on.
+        if (body.enabled === true) {
+            fields.push('health_state=?');
+            values.push('unknown');
+        }
         fields.push('updated_at=?');
         values.push(new Date().toISOString(), id);
         raw.prepare(`UPDATE codex_accounts SET ${fields.join(',')} WHERE id=?`).run(...values);