ldrouter 1.17.9 → 1.18.0

package/README.md

@@ -6,7 +6,7 @@ Lightweight self-hosted LLM gateway with a polished admin UI. Presents stable Op
 
 - OpenAI-compatible and Anthropic-compatible gateways (`/v1/chat/completions`, `/v1/responses`, `/v1/messages`, `/v1/messages/count_tokens`, `/v1/models`)
 - Selective model discovery (Fetch → select → import) with **Select All**
-- Virtual **combos** (fallback or weighted round-robin) and one-hop **aliases**
+- Ordered **combos** with fallback routing and one-hop **aliases**
 - Provider API keys encrypted at rest with AES-256-GCM
 - Per-key `ld-` bearer tokens (SHA-256 digest storage, displayed once)
 - IP allow/deny (IPv4 + IPv6 CIDR), trusted-proxy configuration
@@ -19,8 +19,6 @@ Lightweight self-hosted LLM gateway with a polished admin UI. Presents stable Op
 - Consistent backup / restore (SQLite snapshot + checksum + schema validation)
 - Prometheus `/metrics`, structured logs, graceful shutdown
 - One distributable npm package, multi-stage Dockerfile, Docker Compose
-- Native Codex OAuth account pools with encrypted JSON/JSONL import, refresh/rotation, account-aware routing, and admin management
-- Native Qoder account pools driven by personal access tokens, with encrypted storage, live model-catalog discovery, and account-aware routing
 
 ## Quick start
 
@@ -44,69 +42,6 @@ latedev-router --host 0.0.0.0 --port 8787
 
 The data directory defaults to `~/.latedev-router/` and can be overridden via `LATEDEV_DATA_DIR` or `--data-dir`.
 
-### Codex OAuth setup
-
-1. Set `LATEDEV_MASTER_KEY` before creating or importing credentials. Use a strong random base64 key; it encrypts Codex access, refresh, and ID tokens at rest.
-2. In **Providers**, create a provider with type **Codex**. Codex providers do not use the generic API-key field.
-3. Open the Codex account panel and import a redacted copy of a Codex OAuth `auth.json`, a JSON array, an `{ "accounts": [...] }` wrapper, or JSONL with one record per line. Records may contain a `tokens` object with access/refresh/ID tokens. For example:
-
-   `{ "accountId": "acct-…masked", "email": "admin@example.invalid", "tokens": { "accessToken": "[REDACTED]", "refreshToken": "[REDACTED]" } }`
-
-   JSONL stores one similarly redacted object per line; an array uses the same records: `[ { "accountId": "acct-…masked", "tokens": { "accessToken": "[REDACTED]" } } ]`.
-
-   Alternatively, use **Connect Codex** to authorize a ChatGPT account in the browser. The dialog shows the Codex CLI PKCE authorize URL, waits for the loopback callback, and also accepts a pasted callback URL or bare authorization code. The PKCE verifier and the authorization code stay server-side and never appear in the UI. The Codex CLI callback (`http://localhost:1455/auth/callback`) is captured by `GET /oauth/codex/callback`; because browsers block that cross-origin redirect, paste the address bar URL into step 2 when the auto-capture page fails to load.
-4. Review the preview and import only the records you want. Account/workspace identity is preferred for deduplication; email alone never merges unrelated accounts. Re-importing the same identity updates its encrypted tokens while preserving its enabled state.
-
-Raw tokens are accepted only by the authenticated import pipeline and are never returned in previews, API responses, UI state, audit logs, request logs, errors, or database backups. JWT claims are decoded for metadata only; token signatures are not verified locally. Tokens are refreshed proactively near expiry and once after an upstream 401/403, with rotated values persisted atomically.
-
-The import endpoint requires the normal admin session and CSRF token (`x-csrf-token`) for mutations, including multipart uploads. Use HTTPS for remote administration and protect the master key like any encryption key. Back up the SQLite data directory consistently; restoring encrypted credentials requires the matching master key, otherwise re-save/re-import credentials after restore.
-
-ZIP upload and automatic Codex CLI config-file generation/mutation are not included in this release. LateDev Router does not modify Codex CLI files.
-
-The account panel shows the 5-hour and weekly quota windows with reset countdowns, per-account and bulk usage refresh, weekly reset credits, an opt-in 5-hour window auto-start, and a **Test** control that probes the upstream account without exposing tokens. Routing order is set by dragging rows; the saved order is the fallback order the router uses. **Delete** is permanent and erases the stored encrypted credentials — past request logs are kept but lose the account reference.
-
-**A quota-exhausted account leaves the pool on its own.** When an account refuses for quota reasons — Codex `429 The usage limit has been reached`, or Qoder `out of credits` — it is marked `down` *and disabled*, so the very next request picks a different account in the pool rather than retrying the spent one. This applies to direct `codex/...` and `qoder/...` models too, not only combos. Re-enable the account in the panel once its window resets. Both Codex usage and Qoder credits are also refreshed in the background after a successful request (throttled, and never on the response path), so the panel figures track real usage without pressing **Refresh**.
-
-### Qoder setup
-
-Qoder providers use a personal access token (PAT) instead of an API key. Create one at `https://qoder.com/account/integrations`; it starts with `pt-`.
-
-1. Set `LATEDEV_MASTER_KEY` before adding a token. It encrypts both the PAT and the derived job token at rest.
-2. In **Providers**, click **Add Qoder**. The server creates the provider with its fixed endpoint — there is no base URL or API key to fill in.
-3. In the Qoder account panel, click **Add token** and paste the PAT, or **Import tokens** to paste/upload a list: one token per line, a JSON array of strings, an `{ "accounts": [...] }` wrapper, or JSONL of strings/objects (`token`, `pt_token`, `personal_token`, `access_token`; optional `label`/`name`/`email`). Only `pt-` tokens are accepted — a `dt-` device token or a `jt-` job token is rejected with that reason rather than failing later upstream.
-
-Adding a token exchanges it immediately for a short-lived job token and fetches the model list; inference then runs against `api2.qoder.sh` using that job token. The PAT is kept so a new job token can always be minted — the operator never has to touch it again. If the token works but the model list cannot be fetched, the account is still stored (health `unknown`, with the error recorded) so you can retry with **Catalog**.
-
-Because the gateway serves model discovery from that live catalog, a new account has no routable models until its first successful fetch. Use **Import models** on the provider row to pull the discovered models in.
-
-**Operational caveat:** a revoked or expired PAT is a durable failure. The account is marked `down` with "personal access token rejected — replace it" and routing skips it; nothing retries it forever. Re-add the account with a fresh token. Deleting an account is permanent and erases the stored encrypted PAT — past request logs are kept but lose the account reference.
-
-The panel shows the masked user id, job-token expiry, when the catalog was last fetched, health, and an enabled toggle. Routing order is set by dragging rows, exactly as with Codex.
-
-### Qoder usage, Credits and promotions
-
-Qoder does not meter models in tokens: its chat stream carries no usage block at all, so request logs
-show zero tokens for every Qoder model and the panel's **Credits** column is the account's real
-usage. It is read from Qoder's quota API (`GET /api/v2/quota/usage` on `openapi.qoder.sh`) and shows
-the plan / add-on / org buckets, the percentage used, and whether the account is exhausted.
-
-**Credits and free models are different things, and the panel shows both.** Qoder keeps promoting a
-model — currently `qmodel_38max`, the Qwen3.8-Max route — by marking its catalog entry `is_free`.
-Such a model spends no Credits, so an account at **zero Credits** still answers on it while every
-other model returns an envelope `403 code 112` with a `pricingUrl`. That pairing is what makes an
-"out of credits" account look partly broken: the panel labels the column **No plan credits** next to
-**Free now: qmodel_38max** so the contradiction is visible instead of looking like a router fault.
-
-There is an upstream edge worth knowing when reading logs: a quota refusal arrives as **HTTP 200**
-with a `403` envelope inside the streamed body, so it is not an HTTP error at the transport layer.
-
-Use **Refresh credits** to re-read the snapshot for every account. It deliberately reuses the live
-`job token` instead of exchanging the PAT again — a fresh exchange invalidates the token a
-concurrent request may be using.
-
-**Test** sends one real message, because a catalog probe cannot see a quota refusal. It picks a
-promotion-covered model when the account has one, so testing never spends Credits.
-
 ## Environment variables
 
 | Variable | Description | Default |

package/dist/server/app.js

@@ -198,8 +198,6 @@ export async function startApp() {
     process.once('SIGTERM', () => void close('SIGTERM'));
     process.once('SIGINT', () => void close('SIGINT'));
     await app.listen({ host: cfg.host, port: cfg.port });
-    const { startCodexAutostart } = await import('./providers/codex-autostart.js');
-    startCodexAutostart();
     return app;
 }
 // re-export for convenience

package/dist/server/db/migrate.js

@@ -188,7 +188,7 @@ function buildInitialSchemaSql() {
       name TEXT NOT NULL,
       slug TEXT NOT NULL UNIQUE,
       public_model_id TEXT NOT NULL UNIQUE,
-      mode TEXT NOT NULL CHECK (mode IN ('fallback','weighted_round_robin')),
+      mode TEXT NOT NULL CHECK (mode IN ('fallback')),
       enabled INTEGER NOT NULL DEFAULT 1,
       max_total_attempts INTEGER NOT NULL DEFAULT 3,
       fallback_on_connection INTEGER NOT NULL DEFAULT 1,
@@ -208,7 +208,6 @@ function buildInitialSchemaSql() {
       combo_id TEXT NOT NULL REFERENCES combos(id) ON DELETE CASCADE,
       model_id TEXT NOT NULL REFERENCES models(id) ON DELETE RESTRICT,
       position INTEGER NOT NULL,
-      weight INTEGER NOT NULL DEFAULT 1,
       enabled INTEGER NOT NULL DEFAULT 1
     );
     CREATE UNIQUE INDEX IF NOT EXISTS uniq_combo_model ON combo_members(combo_id, model_id);

package/dist/server/db/schema.js

@@ -209,7 +209,7 @@ export const combos = sqliteTable('combos', {
     name: text('name').notNull(),
     slug: text('slug').notNull().unique(),
     publicModelId: text('public_model_id').notNull().unique(),
-    mode: text('mode', { enum: ['fallback', 'weighted_round_robin'] }).notNull(),
+    mode: text('mode', { enum: ['fallback'] }).notNull(),
     enabled: integer('enabled', { mode: 'boolean' }).notNull().notNull().default(true),
     maxTotalAttempts: integer('max_total_attempts').notNull().default(3),
     fallbackOnConnection: integer('fallback_on_connection', { mode: 'boolean' }).notNull().notNull().default(true),
@@ -235,7 +235,6 @@ export const comboMembers = sqliteTable('combo_members', {
         .notNull()
         .references(() => models.id, { onDelete: 'restrict' }),
     position: integer('position').notNull(),
-    weight: integer('weight').notNull().default(1),
     enabled: integer('enabled', { mode: 'boolean' }).notNull().notNull().default(true),
 }, (t) => ({
     uniqMember: uniqueIndex('uniq_combo_model').on(t.comboId, t.modelId),

package/dist/server/gateway/runner.js

@@ -432,6 +432,7 @@ export class GatewayRunner {
         const candidate = {
             modelId: m.id,
             publicModelId: m.publicModelId,
+            upstreamModelId: m.upstreamModelId,
             providerId: m.providerId,
             enabled: m.enabled,
             providerEnabled: p.enabled,
@@ -489,6 +490,7 @@ export class GatewayRunner {
         return models.map((m) => ({
             modelId: m.id,
             publicModelId: m.publicModelId,
+            upstreamModelId: m.upstreamModelId,
             providerId: m.providerId,
             enabled: m.enabled,
             providerEnabled: providerEnabled.get(m.providerId),
@@ -508,7 +510,7 @@ export class GatewayRunner {
         return this.runNonStreamingAttempt(req, candidate, cfg, ctx);
     }
     async runNonStreamingAttempt(req, candidate, cfg, ctx) {
-        const upstreamModel = candidate.publicModelId.split('/').slice(1).join('/');
+        const upstreamModel = candidate.upstreamModelId;
         if (cfg.type === 'codex') {
             const out = await callCodexNonStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel });
             return { statusCode: out.status, ttftMs: null, upstreamRequestId: out.upstreamRequestId, usage: out.usage, result: { text: out.text, toolCalls: out.toolCalls, finishReason: out.finishReason } };
@@ -569,7 +571,7 @@ export class GatewayRunner {
         return { statusCode: call.status, ttftMs: call.ttftMs, upstreamRequestId: call.upstreamRequestId, usage, result };
     }
     async runStreamingAttempt(req, ctx, candidate, cfg, onStreamStart, onFirstToken) {
-        const upstreamModel = candidate.publicModelId.split('/').slice(1).join('/');
+        const upstreamModel = candidate.upstreamModelId;
         const encoder = req.protocol === 'openai' ? openaiStreamEncoder : anthropicStreamEncoder;
         // Hard streaming invariant: the client SSE head is NOT written until the
         // upstream confirms by delivering its first chunk (or completes). Before

package/dist/server/routes/admin/combos.js

@@ -6,11 +6,12 @@ import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { uuid } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
-const MemberSpec = z.object({ modelId: z.string(), position: z.number().int().min(0), weight: z.number().int().min(1).default(1), enabled: z.boolean().default(true) });
+import { circuitBlocks } from '../../routing/circuit.js';
+const MemberSpec = z.object({ modelId: z.string(), position: z.number().int().min(0), enabled: z.boolean().default(true) });
 const ComboCreate = z.object({
     name: z.string().min(1).max(128),
     slug: z.string().min(1).max(64).optional(),
-    mode: z.enum(['fallback', 'weighted_round_robin']),
+    mode: z.literal('fallback').default('fallback'),
     maxTotalAttempts: z.number().int().min(1).max(8).optional(),
     enabled: z.boolean().optional(),
     fallbackOnConnection: z.boolean().optional(),
@@ -84,6 +85,45 @@ function assertModelsExist(db, members) {
         throw new GatewayError('invalid_request_error', 'One or more members are not valid physical models', { status: 400 });
     }
 }
+const capabilityKeys = ['chat', 'responses', 'streaming', 'tools', 'structured_output', 'image_input', 'audio_input', 'reasoning', 'embeddings'];
+function modelCapabilities(model) {
+    try {
+        return JSON.parse(model.capabilitiesJson);
+    }
+    catch {
+        return {};
+    }
+}
+function memberStatus(model, provider, enabled) {
+    if (!enabled)
+        return { state: 'unavailable', reason: 'member_disabled' };
+    if (!model)
+        return { state: 'unavailable', reason: 'model_missing' };
+    if (!provider?.enabled)
+        return { state: 'unavailable', reason: 'provider_disabled' };
+    if (provider.healthState === 'down')
+        return { state: 'unavailable', reason: 'provider_down' };
+    if (provider.healthState === 'circuit_open')
+        return { state: 'unavailable', reason: 'circuit_open' };
+    if (!model.enabled)
+        return { state: 'unavailable', reason: 'model_disabled' };
+    if (!model.upstreamAvailable)
+        return { state: 'unavailable', reason: 'upstream_unavailable' };
+    if (circuitBlocks(model.providerId, provider.cbCooldownSeconds))
+        return { state: 'unavailable', reason: 'circuit_open' };
+    if (modelCapabilities(model).chat === false)
+        return { state: 'unavailable', reason: 'chat_capability_unavailable' };
+    return { state: 'ready', reason: provider.healthState === 'degraded' ? 'provider_degraded' : 'ready' };
+}
+function capabilityWarnings(models) {
+    return capabilityKeys.filter((key) => {
+        const values = new Set(models.map((model) => {
+            const value = modelCapabilities(model)[key];
+            return value === true ? 'yes' : value === false ? 'no' : 'unknown';
+        }));
+        return values.size > 1;
+    });
+}
 export async function registerComboRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/combos', async () => {
@@ -92,13 +132,14 @@ export async function registerComboRoutes(app) {
         const allMembers = db.select().from(schema.comboMembers).all();
         const models = db.select().from(schema.models).all();
         const modelMap = new Map(models.map((m) => [m.id, m]));
+        const providerMap = new Map(db.select().from(schema.providers).all().map((p) => [p.id, p]));
         return {
             combos: combos.map((c) => {
                 const members = allMembers.filter((m) => m.comboId === c.id);
-                const healthy = members.filter((m) => {
-                    const model = modelMap.get(m.modelId);
-                    return model && model.enabled && model.upstreamAvailable;
-                });
+                const statuses = members.map((m) => memberStatus(modelMap.get(m.modelId), providerMap.get(modelMap.get(m.modelId)?.providerId ?? ''), m.enabled));
+                const readyCount = statuses.filter((status) => status.state === 'ready').length;
+                const reasons = [...new Set(statuses.filter((status) => status.state === 'unavailable').map((status) => status.reason))];
+                const comboModels = members.map((m) => modelMap.get(m.modelId)).filter((m) => Boolean(m));
                 return {
                     id: c.id,
                     name: c.name,
@@ -107,7 +148,10 @@ export async function registerComboRoutes(app) {
                     mode: c.mode,
                     enabled: c.enabled,
                     memberCount: members.length,
-                    healthyMemberCount: healthy.length,
+                    healthyMemberCount: readyCount,
+                    status: !c.enabled ? 'disabled' : readyCount > 0 ? 'ready' : 'unavailable',
+                    unavailableReasons: reasons,
+                    capabilityWarnings: capabilityWarnings(comboModels),
                 };
             }),
         };
@@ -124,6 +168,9 @@ export async function registerComboRoutes(app) {
             .sort((a, b) => a.position - b.position);
         const models = db.select().from(schema.models).all();
         const modelMap = new Map(models.map((m) => [m.id, m]));
+        const providers = db.select().from(schema.providers).all();
+        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        const comboModels = members.map((m) => modelMap.get(m.modelId));
         return {
             combo: {
                 ...c,
@@ -131,15 +178,85 @@ export async function registerComboRoutes(app) {
                     id: m.id,
                     modelId: m.modelId,
                     publicModelId: modelMap.get(m.modelId)?.publicModelId ?? '',
+                    upstreamModelId: modelMap.get(m.modelId)?.upstreamModelId ?? '',
                     displayName: modelMap.get(m.modelId)?.displayName ?? '',
-                    providerSlug: '',
+                    providerSlug: providerMap.get(modelMap.get(m.modelId)?.providerId ?? '')?.slug ?? '',
                     position: m.position,
-                    weight: m.weight,
                     enabled: m.enabled,
+                    upstreamAvailable: modelMap.get(m.modelId)?.upstreamAvailable ?? false,
+                    providerEnabled: providerMap.get(modelMap.get(m.modelId)?.providerId ?? '')?.enabled ?? false,
+                    providerHealth: providerMap.get(modelMap.get(m.modelId)?.providerId ?? '')?.healthState ?? 'unknown',
+                    circuitOpen: circuitBlocks(modelMap.get(m.modelId)?.providerId ?? '', providerMap.get(modelMap.get(m.modelId)?.providerId ?? '')?.cbCooldownSeconds ?? 0),
+                    capabilities: modelMap.get(m.modelId) ? modelCapabilities(modelMap.get(m.modelId)) : {},
+                    status: memberStatus(modelMap.get(m.modelId), providerMap.get(modelMap.get(m.modelId)?.providerId ?? ''), m.enabled),
                 })),
+                capabilityWarnings: capabilityWarnings(comboModels.filter((m) => Boolean(m))),
             },
         };
     });
+    app.post('/api/admin/combos/:id/test', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const combo = db.select().from(schema.combos).where(eq(schema.combos.id, id)).get();
+        if (!combo)
+            throw new GatewayError('invalid_request_error', 'Combo not found', { status: 404 });
+        const { GatewayRunner } = await import('../../gateway/runner.js');
+        const runner = new GatewayRunner();
+        const canonicalReq = {
+            model: combo.publicModelId,
+            messages: [{ role: 'user', content: [{ type: 'text', text: 'Bạn là model gì?' }] }],
+            stream: false,
+            maxOutputTokens: 256,
+            temperature: 0.7,
+        };
+        const ctx = {
+            requestId: 'combo-test-' + uuid(),
+            clientIp: req.ip,
+            protocol: 'openai',
+            endpoint: 'chat/completions',
+            requestedModel: combo.publicModelId,
+            key: null,
+            reply: { raw: {} },
+        };
+        const gatewayReq = { canonical: canonicalReq, protocol: 'openai', endpoint: 'chat/completions' };
+        let outcome;
+        try {
+            outcome = await runner.execute(gatewayReq, ctx);
+        }
+        catch (e) {
+            if (e instanceof GatewayError)
+                throw e;
+            throw new GatewayError('gateway_error', e.message, { cause: e });
+        }
+        const models = db.select().from(schema.models).all();
+        const providers = db.select().from(schema.providers).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        const selected = outcome.attempts.find((attempt) => attempt.success);
+        const selectedModel = selected ? modelMap.get(selected.modelId) : undefined;
+        recordAudit({ action: 'combo.test', success: outcome.success, targetType: 'combo', targetId: id, targetName: combo.publicModelId, ip: req.ip });
+        return {
+            success: outcome.success,
+            text: outcome.text ?? '',
+            latencyMs: outcome.latencyMs,
+            selectedModel: selectedModel ? {
+                publicModelId: selectedModel.publicModelId,
+                upstreamModelId: selectedModel.upstreamModelId,
+                providerSlug: providerMap.get(selectedModel.providerId)?.slug ?? '',
+            } : null,
+            attempts: outcome.attempts.map((attempt) => {
+                const model = modelMap.get(attempt.modelId);
+                return {
+                    publicModelId: model?.publicModelId ?? attempt.modelId,
+                    upstreamModelId: model?.upstreamModelId ?? '',
+                    providerName: attempt.providerName,
+                    latencyMs: attempt.latencyMs,
+                    success: attempt.success,
+                    failureReason: attempt.failureReason,
+                };
+            }),
+        };
+    });
     app.post('/api/admin/combos', async (req) => {
         const body = ComboCreate.parse(req.body);
         const db = getDb();
@@ -170,7 +287,7 @@ export async function registerComboRoutes(app) {
                 configVersion: 1,
             }).run();
             for (const m of body.members) {
-                tx.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+                tx.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, enabled: m.enabled ?? true }).run();
             }
         });
         recordAudit({ action: 'combo.create', success: true, targetType: 'combo', targetId: id, targetName: body.name, ip: req.ip, metadata: { members: body.members.length, mode: body.mode } });
@@ -223,7 +340,7 @@ export async function registerComboRoutes(app) {
                 tx.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
                 tx.delete(schema.comboMembers).where(eq(schema.comboMembers.comboId, body.id)).run();
                 for (const m of body.members) {
-                    tx.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+                    tx.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, enabled: m.enabled ?? true }).run();
                 }
             });
         }

package/dist/server/routes/admin/dashboard.js

@@ -2,6 +2,7 @@
 import { and, desc, gte, sql } from 'drizzle-orm';
 import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
+import { circuitBlocks } from '../../routing/circuit.js';
 export async function registerDashboardRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/dashboard', async () => {
@@ -27,6 +28,27 @@ export async function registerDashboardRoutes(app) {
             .orderBy(desc(schema.requests.createdAt))
             .limit(5)
             .all();
+        const recentAttempts = db.select().from(schema.requestAttempts).where(gte(schema.requestAttempts.startedAt, new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString())).orderBy(desc(schema.requestAttempts.startedAt)).limit(500).all();
+        const models = db.select().from(schema.models).all();
+        const providers = db.select().from(schema.providers).all();
+        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        const modelHealth = models.map((m) => {
+            const provider = providerMap.get(m.providerId);
+            const attempts = recentAttempts.filter((a) => a.modelId === m.id);
+            const lastFailure = attempts.find((a) => !a.success);
+            const circuitOpen = circuitBlocks(m.providerId, provider?.cbCooldownSeconds ?? 0);
+            const state = !provider?.enabled ? 'disabled' : provider.healthState === 'down' ? 'provider_down' : provider.healthState === 'circuit_open' || circuitOpen ? 'circuit_open' : !m.enabled ? 'disabled' : !m.upstreamAvailable ? 'unavailable' : 'ready';
+            return { id: m.id, publicModelId: m.publicModelId, upstreamModelId: m.upstreamModelId, providerId: m.providerId, providerName: provider?.name ?? null, state, attempts: attempts.length, failures: attempts.filter((a) => !a.success).length, lastFailureAt: lastFailure?.startedAt ?? null, lastFailureReason: lastFailure?.failureReason ?? null };
+        });
+        const modelHealthMap = new Map(modelHealth.map((m) => [m.id, m]));
+        const combos = db.select().from(schema.combos).all();
+        const comboMembers = db.select().from(schema.comboMembers).all();
+        const comboHealth = combos.map((combo) => {
+            const members = comboMembers.filter((member) => member.comboId === combo.id);
+            const readyMembers = members.filter((member) => member.enabled && modelHealthMap.get(member.modelId)?.state === 'ready');
+            const reasons = [...new Set(members.filter((member) => !member.enabled || modelHealthMap.get(member.modelId)?.state !== 'ready').map((member) => modelHealthMap.get(member.modelId)?.state ?? 'model_missing'))];
+            return { id: combo.id, publicModelId: combo.publicModelId, enabled: combo.enabled, state: !combo.enabled ? 'disabled' : readyMembers.length > 0 ? 'ready' : 'unavailable', readyMembers: readyMembers.length, memberCount: members.length, reasons };
+        });
         return {
             today: {
                 total: Number(today?.total ?? 0),
@@ -50,6 +72,8 @@ export async function registerDashboardRoutes(app) {
                 errorMessage: r.errorMessage,
                 httpStatus: r.httpStatus,
             })),
+            models: modelHealth,
+            combos: comboHealth,
         };
     });
 }

package/dist/server/routes/admin/models.js

@@ -5,6 +5,7 @@ import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { uuid } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
+import { circuitBlocks } from '../../routing/circuit.js';
 const ImportModelsBody = z.object({
     providerId: z.string(),
     modelIds: z.array(z.string().min(1)).min(1),
@@ -66,6 +67,9 @@ export async function registerModelRoutes(app) {
             displayName: m.displayName,
             enabled: m.enabled,
             upstreamAvailable: m.upstreamAvailable,
+            providerEnabled: providerMap.get(m.providerId)?.enabled ?? false,
+            providerHealth: providerMap.get(m.providerId)?.healthState ?? 'unknown',
+            circuitOpen: circuitBlocks(m.providerId, providerMap.get(m.providerId)?.cbCooldownSeconds ?? 0),
             capabilities: safeJson(m.capabilitiesJson),
             discoveredCapabilities: m.discoveredMetadataJson ? safeJson(m.discoveredMetadataJson) : null,
             maxContextTokens: m.maxContextTokens,

package/dist/server/routes/admin/providers.js

@@ -1,20 +1,17 @@
 import { z } from 'zod';
 import { sql, eq } from 'drizzle-orm';
-import { getDb, getRawDb, schema } from '../../db/index.js';
+import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { encryptSecret, decryptSecret, encryptCustomHeaders, decryptCustomHeaders, isMasterKeyConfigured } from '../../auth/crypto.js';
 import { uuid, slugify } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
 import { probeProvider, discoverProviderModels } from '../../providers/index.js';
-import { getPooledProvider } from '../../providers/pooled.js';
-import { redactString } from '../../security/redact.js';
 const ProviderCreate = z.object({
-    // A pool provider is nothing but a group: the admin clicks once and the server owns every field.
-    // Compatible providers still need name, endpoint, and credential up front (checked in the handler).
+    // Providers use one encrypted API key and a compatible HTTP endpoint.
     name: z.string().min(1).max(128).optional(),
     slug: z.string().min(1).max(64).optional(),
-    type: z.enum(['openai', 'anthropic', 'codex', 'qoder']),
+    type: z.enum(['openai', 'anthropic']),
     baseUrl: z.string().url().max(512).optional(),
     apiKey: z.string().min(1).max(20000).optional(),
     customHeaders: z.record(z.string(), z.string()).optional(),
@@ -51,7 +48,7 @@ export async function registerProviderRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/providers', async () => {
         const db = getDb();
-        const providers = db.select().from(schema.providers).all();
+        const providers = db.select().from(schema.providers).all().filter((provider) => provider.type === 'openai' || provider.type === 'anthropic');
         const modelCounts = db
             .select({ providerId: schema.models.providerId, c: sql `COUNT(*)` })
             .from(schema.models)
@@ -64,17 +61,13 @@ export async function registerProviderRoutes(app) {
     });
     app.post('/api/admin/providers', async (req) => {
         const body = ProviderCreate.parse(req.body);
-        const pool = getPooledProvider(body.type);
-        const defaults = pool?.defaults;
-        const name = body.name ?? defaults?.name;
-        // Pool defaults win over the request: a stored Codex base URL pointing anywhere but
-        // chatgpt.com makes every upstream call 404 (see CODEX_BASE_URL).
-        const baseUrl = defaults?.baseUrl ?? body.baseUrl;
+        const name = body.name;
+        const baseUrl = body.baseUrl;
         if (!name)
             throw new GatewayError('invalid_request_error', 'Provider name is required', { status: 400 });
         // apiKey before baseUrl: a compatible provider created without either must be told the
         // credential is missing (the UI always supplies baseUrl from its dialog default).
-        if (!pool && !body.apiKey) {
+        if (!body.apiKey) {
             throw new GatewayError('invalid_request_error', 'API key is required for this provider type', { status: 400 });
         }
         if (!baseUrl)
@@ -84,14 +77,9 @@ export async function registerProviderRoutes(app) {
         const slug = slugify(body.slug ?? name);
         const dup = db.select().from(schema.providers).where(eq(schema.providers.slug, slug)).get();
         if (dup) {
-            // Pool path carries the code spec §5.7 names, so the UI can render "already added".
-            if (pool)
-                throw new GatewayError('invalid_request_error', `A ${dup.name} provider already exists ('${dup.slug}')`, { status: 400, code: 'slug_taken' });
             throw new GatewayError('invalid_request_error', `Provider slug '${slug}' is already in use`, { status: 400 });
         }
-        // A pool type has no API-key field (spec §5.7): a key sent with `{type}` must not be encrypted
-        // onto the row.
-        const enc = !pool && body.apiKey ? encryptSecret(body.apiKey) : null;
+        const enc = encryptSecret(body.apiKey);
         const headersEnc = body.customHeaders ? encryptCustomHeaders(body.customHeaders) : null;
         const id = uuid();
         db.insert(schema.providers).values({
@@ -125,15 +113,12 @@ export async function registerProviderRoutes(app) {
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         const update = { updatedAt: new Date().toISOString() };
-        // A pool type has no API-key field (spec §5.7). Same rule as the create path: skip the whole
-        // encryption block, so an existing key on the row is not disturbed either.
-        const pool = getPooledProvider(p.type);
         if (body.name)
             update.name = body.name;
         if (body.slug)
             update.slug = slugify(body.slug);
         if (body.baseUrl)
-            update.baseUrl = pool?.defaults.baseUrl ?? body.baseUrl;
+            update.baseUrl = body.baseUrl;
         if (body.enabled !== undefined)
             update.enabled = body.enabled;
         if (body.connectTimeoutMs !== undefined)
@@ -150,7 +135,7 @@ export async function registerProviderRoutes(app) {
             update.cbFailureThreshold = body.cbFailureThreshold;
         if (body.cbCooldownSeconds !== undefined)
             update.cbCooldownSeconds = body.cbCooldownSeconds;
-        if (body.apiKey && !pool) {
+        if (body.apiKey) {
             const enc = encryptSecret(body.apiKey);
             update.encryptedApiKey = enc.ciphertext;
             update.apiKeyNonce = enc.nonce;
@@ -178,25 +163,14 @@ export async function registerProviderRoutes(app) {
             recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
             return { ok: true, softDisabled: true };
         }
-        // A pool provider owns its account pool. <table>.provider_id is ON DELETE RESTRICT, so the
-        // accounts must go in the same transaction or the delete fails with a raw SQLite constraint
-        // error (which surfaces as an opaque 500 "Gateway error").
-        const pool = getPooledProvider(p.type);
-        let pooledAccountsDeleted = 0;
         try {
-            getRawDb().transaction(() => {
-                // pool.accountsTable is a fixed registry literal, never user input.
-                if (pool)
-                    pooledAccountsDeleted = getRawDb().prepare(`DELETE FROM ${pool.accountsTable} WHERE provider_id=?`).run(id).changes;
-                db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
-            })();
+            db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
         }
         catch (error) {
             throw new GatewayError('invalid_request_error', 'Provider is still referenced and cannot be deleted', { status: 409, cause: error });
         }
-        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { pooledAccountsDeleted } });
-        // codexAccountsDeleted kept: pre-existing clients and tests read that field name.
-        return { ok: true, pooledAccountsDeleted, codexAccountsDeleted: pooledAccountsDeleted };
+        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
+        return { ok: true };
     });
     app.post('/api/admin/providers/:id/test', async (req) => {
         const { id } = req.params;
@@ -204,13 +178,6 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        const pool = getPooledProvider(p.type);
-        if (pool) {
-            const result = await pool.probe({ id: p.id, baseUrl: p.baseUrl, totalTimeoutMs: p.totalTimeoutMs });
-            db.update(schema.providers).set({ healthState: result.ok ? 'healthy' : 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
-            recordAudit({ action: 'provider.test', success: result.ok, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { detail: redactString(result.detail) } });
-            return { ...result, detail: redactString(result.detail) };
-        }
         if (!p.encryptedApiKey || !p.apiKeyNonce)
             throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
         const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
@@ -239,24 +206,18 @@ export async function registerProviderRoutes(app) {
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         let discovered;
-        const pool = getPooledProvider(p.type);
-        if (pool) {
-            discovered = await pool.discover({ id: p.id, baseUrl: p.baseUrl, totalTimeoutMs: p.totalTimeoutMs });
-        }
-        else {
-            if (!p.encryptedApiKey || !p.apiKeyNonce)
-                throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
-            const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
-            const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
-            discovered = await discoverProviderModels({
-                type: p.type,
-                baseUrl: p.baseUrl,
-                apiKey,
-                customHeaders: headers,
-                connectTimeoutMs: 5000,
-                totalTimeoutMs: 30000,
-            });
-        }
+        if (!p.encryptedApiKey || !p.apiKeyNonce)
+            throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
+        const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
+        const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
+        discovered = await discoverProviderModels({
+            type: p.type,
+            baseUrl: p.baseUrl,
+            apiKey,
+            customHeaders: headers,
+            connectTimeoutMs: 5000,
+            totalTimeoutMs: 30000,
+        });
         const existing = db
             .select()
             .from(schema.models)