ldrouter 1.17.8 → 1.18.0

package/dist/server/routes/admin/providers.js

@@ -1,20 +1,17 @@
 import { z } from 'zod';
 import { sql, eq } from 'drizzle-orm';
-import { getDb, getRawDb, schema } from '../../db/index.js';
+import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { encryptSecret, decryptSecret, encryptCustomHeaders, decryptCustomHeaders, isMasterKeyConfigured } from '../../auth/crypto.js';
 import { uuid, slugify } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
 import { probeProvider, discoverProviderModels } from '../../providers/index.js';
-import { getPooledProvider } from '../../providers/pooled.js';
-import { redactString } from '../../security/redact.js';
 const ProviderCreate = z.object({
-    // A pool provider is nothing but a group: the admin clicks once and the server owns every field.
-    // Compatible providers still need name, endpoint, and credential up front (checked in the handler).
+    // Providers use one encrypted API key and a compatible HTTP endpoint.
     name: z.string().min(1).max(128).optional(),
     slug: z.string().min(1).max(64).optional(),
-    type: z.enum(['openai', 'anthropic', 'codex', 'qoder']),
+    type: z.enum(['openai', 'anthropic']),
     baseUrl: z.string().url().max(512).optional(),
     apiKey: z.string().min(1).max(20000).optional(),
     customHeaders: z.record(z.string(), z.string()).optional(),
@@ -51,7 +48,7 @@ export async function registerProviderRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/providers', async () => {
         const db = getDb();
-        const providers = db.select().from(schema.providers).all();
+        const providers = db.select().from(schema.providers).all().filter((provider) => provider.type === 'openai' || provider.type === 'anthropic');
         const modelCounts = db
             .select({ providerId: schema.models.providerId, c: sql `COUNT(*)` })
             .from(schema.models)
@@ -64,17 +61,13 @@ export async function registerProviderRoutes(app) {
     });
     app.post('/api/admin/providers', async (req) => {
         const body = ProviderCreate.parse(req.body);
-        const pool = getPooledProvider(body.type);
-        const defaults = pool?.defaults;
-        const name = body.name ?? defaults?.name;
-        // Pool defaults win over the request: a stored Codex base URL pointing anywhere but
-        // chatgpt.com makes every upstream call 404 (see CODEX_BASE_URL).
-        const baseUrl = defaults?.baseUrl ?? body.baseUrl;
+        const name = body.name;
+        const baseUrl = body.baseUrl;
         if (!name)
             throw new GatewayError('invalid_request_error', 'Provider name is required', { status: 400 });
         // apiKey before baseUrl: a compatible provider created without either must be told the
         // credential is missing (the UI always supplies baseUrl from its dialog default).
-        if (!pool && !body.apiKey) {
+        if (!body.apiKey) {
             throw new GatewayError('invalid_request_error', 'API key is required for this provider type', { status: 400 });
         }
         if (!baseUrl)
@@ -84,14 +77,9 @@ export async function registerProviderRoutes(app) {
         const slug = slugify(body.slug ?? name);
         const dup = db.select().from(schema.providers).where(eq(schema.providers.slug, slug)).get();
         if (dup) {
-            // Pool path carries the code spec §5.7 names, so the UI can render "already added".
-            if (pool)
-                throw new GatewayError('invalid_request_error', `A ${dup.name} provider already exists ('${dup.slug}')`, { status: 400, code: 'slug_taken' });
             throw new GatewayError('invalid_request_error', `Provider slug '${slug}' is already in use`, { status: 400 });
         }
-        // A pool type has no API-key field (spec §5.7): a key sent with `{type}` must not be encrypted
-        // onto the row.
-        const enc = !pool && body.apiKey ? encryptSecret(body.apiKey) : null;
+        const enc = encryptSecret(body.apiKey);
         const headersEnc = body.customHeaders ? encryptCustomHeaders(body.customHeaders) : null;
         const id = uuid();
         db.insert(schema.providers).values({
@@ -125,15 +113,12 @@ export async function registerProviderRoutes(app) {
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         const update = { updatedAt: new Date().toISOString() };
-        // A pool type has no API-key field (spec §5.7). Same rule as the create path: skip the whole
-        // encryption block, so an existing key on the row is not disturbed either.
-        const pool = getPooledProvider(p.type);
         if (body.name)
             update.name = body.name;
         if (body.slug)
             update.slug = slugify(body.slug);
         if (body.baseUrl)
-            update.baseUrl = pool?.defaults.baseUrl ?? body.baseUrl;
+            update.baseUrl = body.baseUrl;
         if (body.enabled !== undefined)
             update.enabled = body.enabled;
         if (body.connectTimeoutMs !== undefined)
@@ -150,7 +135,7 @@ export async function registerProviderRoutes(app) {
             update.cbFailureThreshold = body.cbFailureThreshold;
         if (body.cbCooldownSeconds !== undefined)
             update.cbCooldownSeconds = body.cbCooldownSeconds;
-        if (body.apiKey && !pool) {
+        if (body.apiKey) {
             const enc = encryptSecret(body.apiKey);
             update.encryptedApiKey = enc.ciphertext;
             update.apiKeyNonce = enc.nonce;
@@ -178,25 +163,14 @@ export async function registerProviderRoutes(app) {
             recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
             return { ok: true, softDisabled: true };
         }
-        // A pool provider owns its account pool. <table>.provider_id is ON DELETE RESTRICT, so the
-        // accounts must go in the same transaction or the delete fails with a raw SQLite constraint
-        // error (which surfaces as an opaque 500 "Gateway error").
-        const pool = getPooledProvider(p.type);
-        let pooledAccountsDeleted = 0;
         try {
-            getRawDb().transaction(() => {
-                // pool.accountsTable is a fixed registry literal, never user input.
-                if (pool)
-                    pooledAccountsDeleted = getRawDb().prepare(`DELETE FROM ${pool.accountsTable} WHERE provider_id=?`).run(id).changes;
-                db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
-            })();
+            db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
         }
         catch (error) {
             throw new GatewayError('invalid_request_error', 'Provider is still referenced and cannot be deleted', { status: 409, cause: error });
         }
-        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { pooledAccountsDeleted } });
-        // codexAccountsDeleted kept: pre-existing clients and tests read that field name.
-        return { ok: true, pooledAccountsDeleted, codexAccountsDeleted: pooledAccountsDeleted };
+        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
+        return { ok: true };
     });
     app.post('/api/admin/providers/:id/test', async (req) => {
         const { id } = req.params;
@@ -204,13 +178,6 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        const pool = getPooledProvider(p.type);
-        if (pool) {
-            const result = await pool.probe({ id: p.id, baseUrl: p.baseUrl, totalTimeoutMs: p.totalTimeoutMs });
-            db.update(schema.providers).set({ healthState: result.ok ? 'healthy' : 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
-            recordAudit({ action: 'provider.test', success: result.ok, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { detail: redactString(result.detail) } });
-            return { ...result, detail: redactString(result.detail) };
-        }
         if (!p.encryptedApiKey || !p.apiKeyNonce)
             throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
         const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
@@ -239,24 +206,18 @@ export async function registerProviderRoutes(app) {
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         let discovered;
-        const pool = getPooledProvider(p.type);
-        if (pool) {
-            discovered = await pool.discover({ id: p.id, baseUrl: p.baseUrl, totalTimeoutMs: p.totalTimeoutMs });
-        }
-        else {
-            if (!p.encryptedApiKey || !p.apiKeyNonce)
-                throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
-            const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
-            const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
-            discovered = await discoverProviderModels({
-                type: p.type,
-                baseUrl: p.baseUrl,
-                apiKey,
-                customHeaders: headers,
-                connectTimeoutMs: 5000,
-                totalTimeoutMs: 30000,
-            });
-        }
+        if (!p.encryptedApiKey || !p.apiKeyNonce)
+            throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
+        const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
+        const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
+        discovered = await discoverProviderModels({
+            type: p.type,
+            baseUrl: p.baseUrl,
+            apiKey,
+            customHeaders: headers,
+            connectTimeoutMs: 5000,
+            totalTimeoutMs: 30000,
+        });
         const existing = db
             .select()
             .from(schema.models)

package/dist/server/routes/admin/requests.js

@@ -32,9 +32,12 @@ export function toSummary(r, maps) {
         endpoint: r.endpoint,
         requestedModel: r.requestedModel,
         resolvedTargetKind: r.resolvedTargetKind,
+        resolvedTargetId: r.resolvedTargetId,
         finalModelPublicId: finalModel?.publicModelId ?? null,
+        finalModelUpstreamId: finalModel?.upstreamModelId ?? null,
         providerId: provider ? finalModel.providerId : null,
         providerName: provider?.name ?? null,
+        providerSlug: provider?.slug ?? null,
         providerType: provider?.type ?? null,
         streaming: Boolean(r.streaming),
         httpStatus: r.httpStatus,
@@ -53,6 +56,27 @@ export function toSummary(r, maps) {
         gatewayCacheHit: Boolean(r.gatewayCacheHit),
     };
 }
+function quoteCurlJson(value) {
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function buildReproductionCurl(request, redactedPayload) {
+    const endpoint = request.protocol === 'anthropic'
+        ? '/v1/messages'
+        : `/v1/${request.endpoint.replace(/^\/?v1\/?/, '')}`;
+    let body = { model: request.requestedModel };
+    if (redactedPayload) {
+        try {
+            const parsed = JSON.parse(redactedPayload);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                body = { ...parsed, model: request.requestedModel };
+        }
+        catch { }
+    }
+    const headers = request.protocol === 'anthropic'
+        ? "-H 'x-api-key: REPLACE_WITH_LD_KEY' -H 'anthropic-version: 2023-06-01'"
+        : "-H 'Authorization: Bearer ld-REPLACE_WITH_KEY'";
+    return `curl http://localhost:8787${endpoint} -H 'content-type: application/json' ${headers} --data-raw ${quoteCurlJson(JSON.stringify(body))}`;
+}
 export async function registerRequestRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/requests', async (req) => {
@@ -205,7 +229,12 @@ export async function registerRequestRoutes(app) {
                 endpoint: r.endpoint,
                 requestedModel: r.requestedModel,
                 resolvedTargetKind: r.resolvedTargetKind,
+                resolvedTargetId: r.resolvedTargetId,
                 finalModelPublicId: finalModel?.publicModelId ?? null,
+                finalModelUpstreamId: finalModel?.upstreamModelId ?? null,
+                providerId: finalModel?.providerId ?? null,
+                providerName: providerMap.get(finalModel?.providerId ?? '')?.name ?? null,
+                providerSlug: providerMap.get(finalModel?.providerId ?? '')?.slug ?? null,
                 streaming: Boolean(r.streaming),
                 httpStatus: r.httpStatus,
                 success: Boolean(r.success),
@@ -222,6 +251,8 @@ export async function registerRequestRoutes(app) {
                 errorMessage: r.errorMessage,
                 requestPayload: redactJsonString(r.requestPayloadJson),
                 responsePayload: redactJsonString(r.responsePayloadJson),
+                reproductionCurl: buildReproductionCurl(r, redactJsonString(r.requestPayloadJson)),
+                fallbackReasons: [...new Set(attempts.map((a) => a.failureReason).filter((reason) => Boolean(reason)))],
                 gatewayCacheHit: Boolean(r.gatewayCacheHit),
             },
             attempts: attempts.map((a) => ({
@@ -231,6 +262,7 @@ export async function registerRequestRoutes(app) {
                 providerName: providerMap.get(a.providerId)?.name ?? '',
                 modelId: a.modelId,
                 modelPublicId: modelMap.get(a.modelId)?.publicModelId ?? '',
+                upstreamModelId: modelMap.get(a.modelId)?.upstreamModelId ?? '',
                 codexAccountId: a.codexAccountId,
                 startedAt: a.startedAt,
                 completedAt: a.completedAt,

package/dist/server/routes/admin.js

@@ -13,8 +13,6 @@ import { registerAuditRoutes } from './admin/audit.js';
 import { registerSettingsRoutes } from './admin/settings.js';
 import { registerBackupRoutes } from './admin/backup.js';
 import { registerDashboardRoutes } from './admin/dashboard.js';
-import { registerCodexRoutes, registerCodexOAuthCallbackRoute } from './admin/codex.js';
-import { registerQoderRoutes } from './admin/qoder.js';
 export async function registerAdminRoutes(app) {
     // Setup routes are always reachable (used on first run).
     await app.register(async (instance) => {
@@ -25,10 +23,6 @@ export async function registerAdminRoutes(app) {
     await app.register(async (instance) => {
         await registerAuthRoutes(instance);
     });
-    // The Codex OAuth loopback callback is hit by the browser's redirect, so it is public too.
-    await app.register(async (instance) => {
-        await registerCodexOAuthCallbackRoute(instance);
-    });
     // Authenticated admin routes
     await app.register(async (instance) => {
         instance.addHook('preHandler', requireAdminAuth);
@@ -46,8 +40,6 @@ export async function registerAdminRoutes(app) {
         await registerAuditRoutes(instance);
         await registerSettingsRoutes(instance);
         await registerDashboardRoutes(instance);
-        await registerCodexRoutes(instance);
-        await registerQoderRoutes(instance);
     });
     // Backup routes get their own scope. The first-run import (setup.tsx) must be reachable before
     // any admin account exists, but this scope's parent runs the other admin modules' auth hooks,

package/dist/server/routing/circuit.js

@@ -35,3 +35,16 @@ export function getEffectiveState(providerId, cooldownSeconds) {
 export function halfOpenProbeAllowed(providerId) {
     return circuitState(providerId) === 'half_open';
 }
+/**
+ * Should the candidate filter refuse this provider outright?
+ *
+ * `isOpen()` reports the raw state, which stays `'open'` until a request walks the
+ * attempt loop — so a tripped breaker rejected every candidate for the lifetime of the
+ * process and made the provider unroutable until a restart (the combo path and the
+ * direct-model path both read the flag off the candidate record). A candidate must be
+ * allowed through once the cooldown has elapsed so the probe that closes the breaker
+ * can actually run; `getEffectiveState` is what performs that open -> half_open decay.
+ */
+export function circuitBlocks(providerId, cooldownSeconds) {
+    return getEffectiveState(providerId, cooldownSeconds) === 'open';
+}

package/dist/server/routing/combo.js

@@ -1,4 +1,4 @@
-// Combo routing: fallback (ordered) or weighted round-robin.
+// Combo routing: ordered fallback.
 import { eq } from 'drizzle-orm';
 import { getDb, schema } from '../db/index.js';
 import { firstMissingCapability } from './capabilities.js';
@@ -10,9 +10,9 @@ export function loadCombo(comboId) {
     const members = db.select().from(schema.comboMembers).where(eq(schema.comboMembers.comboId, comboId)).all();
     return {
         comboId: c.id,
-        mode: c.mode,
+        mode: 'fallback',
         maxTotalAttempts: c.maxTotalAttempts,
-        members: members.map((m) => ({ id: m.id, modelId: m.modelId, position: m.position, weight: m.weight, enabled: m.enabled })),
+        members: members.map((m) => ({ id: m.id, modelId: m.modelId, position: m.position, enabled: m.enabled })),
         trigger: {
             connection: c.fallbackOnConnection,
             connectTimeout: c.fallbackOnConnectTimeout,
@@ -89,35 +89,12 @@ export function selectCandidates(combo, allModels, req, onReject) {
     return candidates;
 }
 export function orderCandidates(combo, candidates) {
-    if (combo.mode === 'fallback') {
-        // Preserve declared position order
-        return [...candidates].sort((a, b) => {
-            const am = combo.members.find((m) => m.modelId === a.modelId);
-            const bm = combo.members.find((m) => m.modelId === b.modelId);
-            return (am?.position ?? 0) - (bm?.position ?? 0);
-        });
-    }
-    // Weighted round-robin: stable order with weighted lead bias.
-    // We rotate via a process-local cursor keyed by combo id.
-    const cursor = nextCursor(combo.comboId, combo.members, candidates);
-    return cursor;
-}
-const comboCursors = new Map();
-function nextCursor(comboId, members, candidates) {
-    if (candidates.length === 0)
-        return [];
-    // Repeat each available member according to its configured positive weight,
-    // then advance one slot per request. This is deterministic weighted RR.
-    const slots = members.flatMap((member) => {
-        const candidate = candidates.find((c) => c.modelId === member.modelId);
-        if (!candidate)
-            return [];
-        return Array.from({ length: Math.max(1, member.weight) }, () => candidate);
+    // Preserve declared position order.
+    return [...candidates].sort((a, b) => {
+        const am = combo.members.find((m) => m.modelId === a.modelId);
+        const bm = combo.members.find((m) => m.modelId === b.modelId);
+        return (am?.position ?? 0) - (bm?.position ?? 0);
     });
-    const cur = (comboCursors.get(comboId) ?? 0) % Math.max(1, slots.length);
-    comboCursors.set(comboId, cur + 1);
-    const selected = slots[cur] ?? candidates[0];
-    return [selected, ...candidates.filter((candidate) => candidate !== selected)];
 }
 export function shouldFallback(combo, reason) {
     switch (reason.type) {

package/dist/server/upstream/client.js

@@ -3,35 +3,12 @@ import { decryptSecret, decryptCustomHeaders } from '../auth/crypto.js';
 import { GatewayError } from '../errors.js';
 import { buildHeaders, stripSlash } from '../providers/index.js';
 import { redactString } from '../security/redact.js';
-import { getCodexAccountForProvider, getCodexAccountById } from '../db/repositories/codex-accounts.js';
-import { findEligibleQoderAccount } from '../db/repositories/qoder-accounts.js';
 import { debugUpstream, errorLine, formatError, truncate } from '../logging/debug.js';
-export function providerToUpstreamConfig(p, codexAccountId) {
+export function providerToUpstreamConfig(p, _codexAccountId) {
     let apiKey;
     let customHeaders;
-    if (p.type === 'codex') {
-        const account = codexAccountId ? getCodexAccountById(codexAccountId) : getCodexAccountForProvider(p.id);
-        if (!account)
-            throw new GatewayError('authentication_error', 'No usable Codex account is configured', { status: 503 });
-        return {
-            type: 'codex', baseUrl: p.baseUrl, customHeaders: {},
-            connectTimeoutMs: p.connectTimeoutMs, firstTokenTimeoutMs: p.firstTokenTimeoutMs,
-            streamIdleTimeoutMs: p.streamIdleTimeoutMs, totalTimeoutMs: p.totalTimeoutMs,
-            codexAccountId: account.chatgptAccountId, accountRecordId: account.id,
-        };
-    }
-    if (p.type === 'qoder') {
-        // Account-pool provider: no API key on the row. The runner normally overrides the account
-        // from the expanded candidate; this resolves the first eligible one for direct callers.
-        const account = findEligibleQoderAccount(p.id);
-        if (!account)
-            throw new GatewayError('authentication_error', 'No usable Qoder account is configured', { status: 503 });
-        return {
-            type: 'qoder', baseUrl: p.baseUrl, customHeaders: {},
-            connectTimeoutMs: p.connectTimeoutMs, firstTokenTimeoutMs: p.firstTokenTimeoutMs,
-            streamIdleTimeoutMs: p.streamIdleTimeoutMs, totalTimeoutMs: p.totalTimeoutMs,
-            qoderUserId: account.qoderUserId, qoderAccountRecordId: account.id,
-        };
+    if (p.type === 'codex' || p.type === 'qoder') {
+        throw new GatewayError('invalid_request_error', `${p.type} providers are no longer supported`, { status: 410 });
     }
     if (!p.encryptedApiKey || !p.apiKeyNonce) {
         throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });