opencode-auth-load-balancer 0.2.2 → 0.4.0

package/dist/usage-refresh.d.ts

@@ -1,5 +1,18 @@
 import type { ProviderAdapter } from './providers/types';
 import type { PoolFile } from './types';
+export declare const USAGE_REFRESH_TTL_MS: number;
+/**
+ * Max lifetime of a TRANSIENT (non-quota) cooldown. fetch.ts cools a thrown
+ * network error or a header-less 429/402 for at most `ACCOUNT_COOLDOWN_MS`
+ * (5min) and an auth 401/403 for `AUTH_COOLDOWN_MS` (2min); ONLY a quota 429's
+ * `Retry-After` writes a cooldown beyond this. So a cooldown whose remainder
+ * still exceeds this bound is necessarily quota-derived — the one class that can
+ * outlive its own usage window after an out-of-band reset (see the stale-cooldown
+ * reconciliation below). Kept `=== ACCOUNT_COOLDOWN_MS` by a drift-guard test;
+ * defined locally because importing it from fetch.ts (which imports THIS module)
+ * would form a cycle.
+ */
+export declare const MAX_TRANSIENT_COOLDOWN_MS: number;
 /**
  * Test-only window into the module-private `lastPoll` throttle map. Never
  * imported by production code — only by usage-refresh tests that need to
@@ -9,22 +22,28 @@ import type { PoolFile } from './types';
  */
 export declare function _lastPollIdsForTests(): Set<string>;
 /**
- * Best-effort: seed/refresh usage for accounts whose WEEKLY snapshot is missing or
- * stale (`capturedAt` is stamped only when a weekly window arrives — see
- * `applyUsagePartial` in fetch.ts), via the provider's dedicated usage endpoint.
- * Throttled per account (at most one poll per account per SEED_TTL_MS). Callers
- * invoke it fire-and-forget, so it adds no latency to the request path; failures
- * are swallowed — response headers remain the primary, always-fresh usage signal
- * and this fixes cold-start blindness AND out-of-band server-side resets (e.g. a
- * promotional weekly-quota reset) that response headers alone don't converge.
- *
- * Returns a promise (for tests / explicit awaiting); request-path callers ignore it.
+ * Refresh stale usage for ONE provider's accounts (see `refreshUsage`).
  *
- * `poolSnapshot` lets the request hot path reuse the pool it JUST read for
- * account selection instead of paying a second serialized file read +
- * JSON.parse per request. The snapshot is only consulted for the staleness
- * gates below; the actual usage write still goes through `mutatePool` (which
- * re-reads under the lock), so a slightly stale snapshot is harmless. Callers
- * without a pool in hand (e.g. the startup seed in index.ts) omit it.
+ * Used by the flows that are inherently scoped to a single provider: the
+ * OAuth login callback (only the just-added account matters) and each
+ * provider plugin's startup seed, which awaits ITS provider's usage before
+ * priming that provider's in-use marker. Ambient callers must NOT use this —
+ * see `refreshAllUsageInBackground`.
  */
 export declare function refreshUsageInBackground(adapter: ProviderAdapter, now: number, poolSnapshot?: PoolFile): Promise<void>;
+/**
+ * Refresh stale usage across EVERY registered provider (see `refreshUsage`).
+ *
+ * This is what the ambient callers — the request hot path and the
+ * `auth_lb_status` dashboard — use, and the distinction is load-bearing:
+ * usage converges to server-side truth from response headers (only for the
+ * provider you are actually sending requests to) or from a usage-endpoint
+ * poll. Scoping that poll to the requesting provider left an IDLE provider
+ * with no refresh cycle whatsoever after its one startup seed, so working all
+ * day in Claude froze the Codex numbers in the dashboard/TUI at whatever they
+ * were when opencode launched (and vice versa). Refreshing the whole registry
+ * instead costs nothing in the steady state — the per-account staleness gate
+ * and `lastPoll` throttle inside `refreshUsage` are unchanged, so an idle
+ * provider is polled at most once per SEED_TTL_MS and a fresh one not at all.
+ */
+export declare function refreshAllUsageInBackground(now: number, poolSnapshot?: PoolFile): Promise<void>;

package/dist/util.d.ts

@@ -30,11 +30,12 @@ export declare function clamp01(n: number): number;
 export declare function isFiniteNumber(v: unknown): v is number;
 /**
  * True for a plain JSON object (non-null `object`, not an array). Shared
- * trust-boundary predicate for the two consumers that accept arbitrary JSON
+ * trust-boundary predicate for the consumers that accept arbitrary JSON
  * shapes: the user-editable pool file's `lastSelected` / `sessions`
- * containers and session rows (`pool/store.ts`), and the incoming `system`
+ * containers and session rows (`pool/store.ts`), the incoming `system`
  * prompt blocks in the Anthropic request transform
- * (`providers/anthropic/transform.ts`). NOTE:
+ * (`providers/anthropic/transform.ts`), and the Codex `/wham/usage`
+ * `rate_limit` envelope (`providers/openai/usage.ts`). NOTE:
  * `tui/auth-load-balancer-tui.logic.ts` ships its OWN `isPlainRecordValue`
  * copy by design — the TUI runtime cannot import `src/`.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-auth-load-balancer",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "Load-balance opencode requests across multiple Anthropic (Claude) and OpenAI (Codex) OAuth accounts, weighted primarily by weekly usage with drain-before-reset scheduling.",
   "type": "module",
   "license": "MIT",
@@ -41,19 +41,19 @@
     "prepare": "husky"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": ">=1.17.13"
+    "@opencode-ai/plugin": ">=1.18.26"
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "^1.17.13",
-    "@opentui/core": "0.4.2",
-    "@opentui/solid": "0.4.2",
-    "@types/bun": "^1.3.14",
-    "@types/node": "^26.1.0",
-    "eslint-plugin-devup": "^2.0.19",
+    "@opencode-ai/plugin": "^1.18.26",
+    "@opentui/core": "0.5.10",
+    "@opentui/solid": "0.5.10",
+    "@types/bun": "^1.4.0",
+    "@types/node": "^26.4.1",
+    "eslint-plugin-devup": "^2.1.0",
     "husky": "^9.1",
-    "oxlint": "1.72",
-    "solid-js": "1.9.14",
-    "typescript": "^6.0.3"
+    "oxlint": "1.81",
+    "solid-js": "1.9.15",
+    "typescript": "^7.0.2"
   },
   "keywords": [
     "opencode",

package/tui/auth-load-balancer-tui.logic.ts

@@ -66,8 +66,12 @@ export interface PoolAccount {
 /** Loosely-typed view of the on-disk pool JSON (one shape for reads AND read-modify-writes). */
 export interface PoolShape {
   accounts?: PoolAccount[]
+  relogin?: { accountId?: string; providerID?: string; expiresAt?: number }
   lastSelected?: Record<string, string>
-  sessions?: Record<string, { accountId?: string }>
+  sessions?: Record<
+    string,
+    { accountId?: string; fallback?: { from?: string; to?: string } }
+  >
 }
 
 /**
@@ -222,6 +226,70 @@ export function mutatePoolFile(
   }
 }
 
+/**
+ * Sentinel `disabledReason` the manual disable toggle writes — the TUI copy of
+ * `src/types.ts`'s `MANUAL_DISABLED_REASON` (the TUI runtime cannot import
+ * `src/`; see the `isPlainRecordValue`/`isFiniteNumber` NOTEs above for the
+ * same trust boundary). Kept BYTE-IDENTICAL to the server constant so a manual
+ * disable written here reads back as `disabled` (not `re-login`) everywhere.
+ */
+export const MANUAL_DISABLED_REASON = 'manually disabled'
+
+/**
+ * NOTE: byte-identical copy of `src/types.ts`'s `RELOGIN_TTL_MS`, kept in sync
+ * by hand because the TUI runtime cannot import `src/`; see the
+ * `MANUAL_DISABLED_REASON` NOTE above for the same trust boundary.
+ */
+export const RELOGIN_TTL_MS = 600_000
+
+/**
+ * `now` DEFAULTS to the wall clock so the view can fire this without reading
+ * the clock itself: the call sits in an async re-login handler, and a bare
+ * `Date.now()` written inside a component body is flagged by `react(purity)`
+ * even on a non-render path the rule cannot distinguish. Tests still pass an
+ * explicit `now` — stamping the TTL from an injectable instant is what keeps
+ * the expiry assertion deterministic.
+ */
+export function setReloginTargetInPool(
+  accountId: string,
+  providerID: string,
+  now: number = Date.now(),
+  path: string = POOL_FILE,
+): void {
+  mutatePoolFile((pool) => {
+    pool.relogin = {
+      accountId,
+      providerID,
+      expiresAt: now + RELOGIN_TTL_MS,
+    }
+  }, path)
+}
+
+export function clearReloginTargetInPool(path: string = POOL_FILE): void {
+  mutatePoolFile((pool) => {
+    delete pool.relogin
+  }, path)
+}
+
+/**
+ * Resolve the provider OAuth method by label instead of hardcoding an index:
+ * opencode aggregates auth methods from every plugin registered for a provider,
+ * so this plugin's position is not stable. Prefer its pooled-login label, then
+ * fall back to the provider's first OAuth method when no such label is present.
+ */
+export function pickAuthMethodIndex(
+  methods: readonly { type?: string; label?: string }[] | undefined,
+): number | null {
+  const pooled = methods?.findIndex(
+    (method) =>
+      method.type === 'oauth' &&
+      method.label?.toLowerCase().includes('load balancer'),
+  )
+  if (pooled !== undefined && pooled >= 0) return pooled
+  const oauth = methods?.findIndex((method) => method.type === 'oauth')
+  return oauth !== undefined && oauth >= 0 ? oauth : null
+}
+
 export function renameInPool(
   id: string,
   label: string,
@@ -248,6 +316,23 @@ export function deleteFromPool(id: string, path: string = POOL_FILE): void {
   }, path)
 }
 
+/**
+ * Toggle an account's MANUAL disable flag: `disabled` writes the
+ * `MANUAL_DISABLED_REASON` sentinel (the scheduler then skips it, exactly like
+ * the server's `isAvailable`), `!disabled` clears it. Reversible, so — unlike
+ * Delete — the sidebar calls this straight through with no confirm dialog.
+ */
+export function setDisabledInPool(
+  id: string,
+  disabled: boolean,
+  path: string = POOL_FILE,
+): void {
+  mutatePoolFile((pool) => {
+    const acct = (pool.accounts ?? []).find((a) => a.id === id)
+    if (acct) acct.disabledReason = disabled ? MANUAL_DISABLED_REASON : null
+  }, path)
+}
+
 /**
  * Normalize a raw (loosely-typed) pool account into the strict shape the shared
  * scorer reads. The pool file is user-editable and read RAW here (the server
@@ -284,6 +369,48 @@ export function toScore(a: PoolAccount): ScoreAccount {
   }
 }
 
+/**
+ * The account the CURRENT opencode session is pinned to for a provider — i.e.
+ * what THIS session is actually using — read from the pool's session map. The
+ * key is `<providerID>:s:<sessionID>`, exactly what `deriveSessionKey` +
+ * `recordSuccess` (src/fetch.ts) write on each served request. Returns
+ * `undefined` when there is no session (home screen) or the session has not yet
+ * pinned an account for this provider. The in-use (▶) marker uses this so it
+ * reflects the VIEWER's OWN session, not the global `lastSelected` (whichever
+ * session served most recently across the whole pool — misleading while several
+ * sessions run at once).
+ */
+export function sessionAccountId(
+  pool: PoolShape,
+  providerID: string,
+  sessionId: string | undefined,
+): string | undefined {
+  if (!sessionId) return undefined
+  return pool.sessions?.[`${providerID}:s:${sessionId}`]?.accountId
+}
+
+/**
+ * The active model downgrade for THIS session on `providerID`, or `undefined`
+ * when the session's latest request ran on the model it asked for (or there is
+ * no session). `{ from, to }` are the raw model ids (requested → served) the
+ * server recorded in {@link SessionAssignment.fallback}. The bottom bar shows it
+ * so a session silently running on a fallback model is visible even after the
+ * transient switch toast is gone. Both fields are re-validated as strings (a
+ * hand-edited pool could hold anything) — a malformed `fallback` reads as "no
+ * downgrade" rather than rendering `undefined`.
+ */
+export function sessionFallback(
+  pool: PoolShape,
+  providerID: string,
+  sessionId: string | undefined,
+): { from: string; to: string } | undefined {
+  if (!sessionId) return undefined
+  const fb = pool.sessions?.[`${providerID}:s:${sessionId}`]?.fallback
+  if (!fb || typeof fb.from !== 'string' || typeof fb.to !== 'string')
+    return undefined
+  return { from: fb.from, to: fb.to }
+}
+
 /**
  * Byte-deterministic ASCII string comparator (never `localeCompare` — keeps
  * tier/provider ordering byte-identical regardless of host locale). Ships its
@@ -307,16 +434,17 @@ export function until(resetAt: number | undefined, now: number): string {
   if (!isFiniteNumber(resetAt) || resetAt <= now) return '-'
   // Mirror the server's `relTime` (src/status.ts) semantics: floor minutes at 1
   // (a sub-30s future reset must not render "0m" — '-' is reserved for elapsed)
-  // and FLOOR the day figure (36h is "1d", not "2d") so the TUI bar's day/minute
-  // rounding can never disagree with the CLI/tool dashboard's. NOTE: this is
+  // keep <=48h as hours (47h is "47h", not "1d") before FLOORing the day
+  // figure so the TUI bar's day/minute rounding can never disagree with the
+  // CLI/tool dashboard's. NOTE: this is
   // coarser than the CLI within the hour band on purpose (bar-width budget) —
-  // the CLI renders `${hrs}h${mins % 60}m` (e.g. "3h25m"), this renders just
-  // `${hrs}h` (e.g. "3h"). Same day-level bucket, less precision inside it —
+  // after the <=120m minute band, the CLI renders `${hrs}h${mins % 60}m`
+  // (e.g. "3h25m"), this renders just `${hrs}h` (e.g. "3h"). Same day-level bucket, less precision inside it —
   // not byte-identical output.
   const mins = Math.max(1, Math.round((resetAt - now) / 60_000))
-  if (mins < 60) return `${mins}m`
+  if (mins <= 120) return `${mins}m`
   const hrs = Math.floor(mins / 60)
-  if (hrs < 24) return `${hrs}h`
+  if (mins <= 48 * 60) return `${hrs}h`
   return `${Math.floor(hrs / 24)}d`
 }
 /** A window's utilization for the bar: "-" when absent, "0%" once it has reset (stale value dropped). */
@@ -351,7 +479,10 @@ export function stateOf(
   tiers: [string, number][],
   now: number,
 ): string {
-  if (sa.disabledReason) return 're-login'
+  if (sa.disabledReason)
+    return sa.disabledReason === MANUAL_DISABLED_REASON
+      ? 'disabled'
+      : 're-login'
   if (sa.cooldownUntil > now) return `cooldown ${until(sa.cooldownUntil, now)}`
   if (isExhausted(sa, cfg, now)) return 'full'
   // A model-tier limit keeps the account usable (other models + downgrade),