diff --git a/src/shared/constants/providers.ts b/src/shared/constants/providers.ts
index 05dbcb5d46..3c01070b24 100644
--- a/src/shared/constants/providers.ts
+++ b/src/shared/constants/providers.ts
@@ -1880,6 +1880,20 @@ export function isSelfHostedChatProvider(providerId: unknown): boolean {
return typeof providerId === "string" && SELF_HOSTED_CHAT_PROVIDER_IDS.has(providerId);
}
+// ── System Providers (virtual, not user-connectable) ──────────────────────────
+export const SYSTEM_PROVIDERS = {
+ auto: {
+ id: "auto",
+ alias: "auto",
+ name: "Auto (Zero-Config)",
+ icon: "auto_awesome",
+ color: "#6366F1",
+ textIcon: "Auto",
+ systemOnly: true,
+ description: "Zero-config auto-routing with LKGP across all connected providers",
+ },
+};
+
// All providers (combined)
export const AI_PROVIDERS = {
...FREE_PROVIDERS,
@@ -1890,6 +1904,8 @@ export const AI_PROVIDERS = {
...SEARCH_PROVIDERS,
...AUDIO_ONLY_PROVIDERS,
...UPSTREAM_PROXY_PROVIDERS,
+ ...CLOUD_AGENT_PROVIDERS,
+ ...SYSTEM_PROVIDERS, // <-- system providers included
};
export type AiProviderId = keyof typeof AI_PROVIDERS;
@@ -1946,9 +1962,11 @@ export const USAGE_SUPPORTED_PROVIDERS = [
"github",
"codex",
"claude",
+ "cursor",
"kimi-coding",
"glm",
"glm-cn",
+ "zai",
"glmt",
"minimax",
"minimax-cn",
@@ -1968,3 +1986,4 @@ validateProviders(LOCAL_PROVIDERS, "LOCAL_PROVIDERS");
validateProviders(SEARCH_PROVIDERS, "SEARCH_PROVIDERS");
validateProviders(AUDIO_ONLY_PROVIDERS, "AUDIO_ONLY_PROVIDERS");
validateProviders(UPSTREAM_PROXY_PROVIDERS, "UPSTREAM_PROXY_PROVIDERS");
+validateProviders(CLOUD_AGENT_PROVIDERS, "CLOUD_AGENT_PROVIDERS");
diff --git a/src/shared/constants/sidebarVisibility.ts b/src/shared/constants/sidebarVisibility.ts
index 300a75d86c..35805f7e60 100644
--- a/src/shared/constants/sidebarVisibility.ts
+++ b/src/shared/constants/sidebarVisibility.ts
@@ -14,6 +14,7 @@ export const HIDEABLE_SIDEBAR_ITEM_IDS = [
"limits",
"cli-tools",
"agents",
+ "cloud-agents",
"memory",
"skills",
"translator",
@@ -69,6 +70,7 @@ const PRIMARY_SIDEBAR_ITEMS: readonly SidebarItemDefinition[] = [
const CLI_SIDEBAR_ITEMS: readonly SidebarItemDefinition[] = [
{ id: "cli-tools", href: "/dashboard/cli-tools", i18nKey: "cliToolsShort", icon: "terminal" },
{ id: "agents", href: "/dashboard/agents", i18nKey: "agents", icon: "smart_toy" },
+ { id: "cloud-agents", href: "/dashboard/cloud-agents", i18nKey: "cloudAgents", icon: "cloud" },
{ id: "memory", href: "/dashboard/memory", i18nKey: "memory", icon: "psychology" },
{ id: "skills", href: "/dashboard/skills", i18nKey: "skills", icon: "auto_fix_high" },
];
diff --git a/src/shared/utils/circuitBreaker.ts b/src/shared/utils/circuitBreaker.ts
index f94d73949a..e6ba3a17f2 100644
--- a/src/shared/utils/circuitBreaker.ts
+++ b/src/shared/utils/circuitBreaker.ts
@@ -19,6 +19,7 @@ import {
deleteCircuitBreakerState,
deleteAllCircuitBreakerStates,
} from "../../lib/db/domainState";
+import type { FailureKind } from "./classify429";
const STATE = {
CLOSED: "CLOSED",
@@ -34,6 +35,25 @@ interface CircuitBreakerOptions {
halfOpenRequests?: number;
onStateChange?: ((name: string, oldState: string, newState: string) => void) | null;
isFailure?: (error: unknown) => boolean;
+ /**
+ * Per-failure-kind cooldown override (Issue #2100).
+ *
+ * When set, `_timeUntilReset()` and `_shouldAttemptReset()` use
+ * `cooldownByKind[lastFailureKind]` instead of `resetTimeout` whenever
+ * the last failure had a known kind. Use this to give a longer cooldown
+ * to `quota_exhausted` (period-end may be hours away) than to
+ * `rate_limit` (typically 60s).
+ */
+ cooldownByKind?: Partial
>;
+ /**
+ * Optional classifier called on `execute()` errors (Issue #2100).
+ * Returns the kind to record. When omitted, all failures are recorded
+ * as `lastFailureKind = null` (existing behavior preserved).
+ *
+ * Pair with `classify429()` from `./classify429.ts` for HTTP responses,
+ * or supply a custom classifier for non-HTTP errors.
+ */
+ classifyError?: (error: unknown) => FailureKind | undefined;
}
export class CircuitBreaker {
@@ -48,6 +68,9 @@ export class CircuitBreaker {
successCount: number;
lastFailureTime: number | null;
halfOpenAllowed: number;
+ cooldownByKind: Partial>;
+ classifyError: ((error: unknown) => FailureKind | undefined) | null;
+ lastFailureKind: FailureKind | null;
constructor(name: string, options: CircuitBreakerOptions = {}) {
this.name = name;
@@ -62,6 +85,9 @@ export class CircuitBreaker {
this.successCount = 0;
this.lastFailureTime = null;
this.halfOpenAllowed = 0;
+ this.cooldownByKind = options.cooldownByKind ?? {};
+ this.classifyError = options.classifyError ?? null;
+ this.lastFailureKind = null;
// Try to restore state from DB
this._restoreFromDb();
@@ -151,7 +177,17 @@ export class CircuitBreaker {
return result;
} catch (error) {
if (this.isFailure(error)) {
- this._onFailure();
+ let kind: FailureKind | undefined;
+ if (this.classifyError) {
+ try {
+ kind = this.classifyError(error);
+ } catch {
+ // A user-supplied classifier must not mask the original error
+ // or change failure-counting semantics; fall back to no kind.
+ kind = undefined;
+ }
+ }
+ this._onFailure(kind);
}
throw error;
}
@@ -205,6 +241,7 @@ export class CircuitBreaker {
this.failureCount = 0;
this.successCount = 0;
this.lastFailureTime = null;
+ this.lastFailureKind = null;
this._persistToDb();
}
@@ -218,10 +255,12 @@ export class CircuitBreaker {
this.failureCount = 0;
this.successCount = 0;
this.lastFailureTime = null;
+ this.lastFailureKind = null;
} else if (this.state === STATE.HALF_OPEN) {
this.successCount++;
this._transition(STATE.CLOSED);
this.failureCount = 0;
+ this.lastFailureKind = null;
} else {
// In CLOSED state, just reset failure count
this.failureCount = 0;
@@ -229,9 +268,10 @@ export class CircuitBreaker {
this._persistToDb();
}
- _onFailure() {
+ _onFailure(kind?: FailureKind | null) {
this.failureCount++;
this.lastFailureTime = Date.now();
+ this.lastFailureKind = kind ?? null;
if (this.state === STATE.OPEN) {
// Already OPEN — just update persistence (re-tripped by combo path)
@@ -245,12 +285,31 @@ export class CircuitBreaker {
_shouldAttemptReset() {
if (!this.lastFailureTime) return true;
- return Date.now() - this.lastFailureTime >= this.resetTimeout;
+ const cooldown = this._effectiveCooldown();
+ return Date.now() - this.lastFailureTime >= cooldown;
+ }
+
+ /**
+ * Resolve the cooldown for the current `lastFailureKind`. Falls back to
+ * `resetTimeout` when no kind was recorded, no override exists for it,
+ * or the override is not a finite non-negative number (NaN / Infinity /
+ * negative all silently fall through to `resetTimeout`).
+ * @private
+ */
+ _effectiveCooldown() {
+ if (this.lastFailureKind !== null) {
+ const override = this.cooldownByKind[this.lastFailureKind];
+ if (typeof override === "number" && Number.isFinite(override) && override >= 0) {
+ return override;
+ }
+ }
+ return this.resetTimeout;
}
_timeUntilReset() {
if (!this.lastFailureTime) return 0;
- return Math.max(0, this.resetTimeout - (Date.now() - this.lastFailureTime));
+ const cooldown = this._effectiveCooldown();
+ return Math.max(0, cooldown - (Date.now() - this.lastFailureTime));
}
_refreshOpenState() {
@@ -315,6 +374,18 @@ export function getCircuitBreaker(name: string, options?: CircuitBreakerOptions)
if (typeof options.isFailure === "function") {
breaker.isFailure = options.isFailure;
}
+ if (options.cooldownByKind) {
+ // Merge keys, don't replace: callers that add different kinds
+ // (e.g. one sets `quota_exhausted`, another `rate_limit`) should
+ // not silently lose each other's overrides.
+ breaker.cooldownByKind = {
+ ...breaker.cooldownByKind,
+ ...options.cooldownByKind,
+ };
+ }
+ if (typeof options.classifyError === "function") {
+ breaker.classifyError = options.classifyError;
+ }
breaker._persistToDb();
}
return breaker;
diff --git a/src/shared/utils/classify429.ts b/src/shared/utils/classify429.ts
new file mode 100644
index 0000000000..df0c8ea027
--- /dev/null
+++ b/src/shared/utils/classify429.ts
@@ -0,0 +1,243 @@
+/**
+ * 429 response classifier — distinguish rate-limit from quota-exhausted.
+ *
+ * Most LLM providers return HTTP 429 for two semantically different reasons:
+ *
+ * 1. **Rate-limit**: short transient back-off ("too many requests in
+ * the last minute"). Fix: wait the Retry-After window and retry.
+ * 2. **Quota-exhausted**: long-period cap hit ("daily/monthly limit
+ * reached"). Fix: wait until the period rolls over (could be hours
+ * or days). Retrying every 60s wastes calls and burns alerts.
+ *
+ * The HTTP status alone cannot disambiguate. This helper inspects the
+ * response body and headers to return a `FailureKind` the circuit
+ * breaker can use to pick the right cooldown.
+ *
+ * Companion to OmniRoute issue #2100.
+ *
+ * @module shared/utils/classify429
+ */
+
+export type FailureKind = "rate_limit" | "quota_exhausted" | "transient";
+
+/**
+ * Heuristic regexes for "explicit quota exhausted" vs "rate-limited"
+ * detection in 429 error bodies. A 429 alone never implies quota
+ * exhausted — only an explicit keyword does.
+ *
+ * Patterns observed across OpenAI, Anthropic, Groq, Cerebras, Mistral,
+ * Google Gemini, and OpenRouter free-tier responses.
+ */
+const QUOTA_PATTERNS: ReadonlyArray = [
+ /daily.*limit/i,
+ /daily.*quota/i,
+ /per.?day.*limit/i,
+ /monthly.*limit/i,
+ /monthly.*quota/i,
+ /per.?month.*limit/i,
+ /quota.*exceed/i,
+ /exceed.*quota/i,
+ /insufficient.*quota/i,
+ /billing.*cap/i,
+ /credit.*exhaust/i,
+ /out of credits/i,
+ /hard.?limit/i,
+ /plan.*limit/i,
+];
+
+/**
+ * Best-effort case-insensitive header lookup.
+ */
+function getHeader(headers: Record | undefined, name: string): string | undefined {
+ if (!headers) return undefined;
+ const target = name.toLowerCase();
+ for (const [k, v] of Object.entries(headers)) {
+ if (k.toLowerCase() === target) return v;
+ }
+ return undefined;
+}
+
+/**
+ * Coerce a body of unknown shape to a string for keyword scanning.
+ * - string: returned as-is
+ * - object: JSON-stringified (so nested error.message gets scanned)
+ * - undefined/null: empty string
+ */
+function bodyToText(body: unknown): string {
+ if (typeof body === "string") return body;
+ if (body == null) return "";
+ try {
+ return JSON.stringify(body);
+ } catch {
+ return "";
+ }
+}
+
+/**
+ * Returns true if the body looks like an explicit quota-exhausted
+ * error — i.e. the upstream is telling us a long-period cap was hit.
+ */
+export function looksLikeQuotaExhausted(body: unknown): boolean {
+ const text = bodyToText(body);
+ if (!text) return false;
+ return QUOTA_PATTERNS.some((pat) => pat.test(text));
+}
+
+/**
+ * Classify a 429 (or any) response into a `FailureKind`.
+ *
+ * Decision order:
+ * 1. status !== 429 → `"transient"` (don't pretend to know more than
+ * the caller does about non-429 failures).
+ * 2. body matches a quota keyword → `"quota_exhausted"`.
+ * 3. otherwise → `"rate_limit"` (default for 429 — even without
+ * Retry-After, a 429 is per definition a rate-limit signal).
+ *
+ * @param response - the upstream response with status, optional headers,
+ * optional body. Headers are looked up
+ * case-insensitively.
+ */
+export function classify429(response: {
+ status: number;
+ headers?: Record;
+ body?: unknown;
+}): FailureKind {
+ if (response.status !== 429) return "transient";
+ if (looksLikeQuotaExhausted(response.body)) return "quota_exhausted";
+ return "rate_limit";
+}
+
+/**
+ * Parse a `Retry-After` header value into seconds.
+ *
+ * Accepts:
+ * - integer seconds: `"60"`
+ * - HTTP date: `"Wed, 08 May 2026 03:00:00 GMT"`
+ * - Groq-style relative: `"60s"`, `"5m"`, `"2h"`
+ *
+ * Returns `null` if unparseable.
+ *
+ * Note: integer seconds vs Groq relative units are easy to confuse —
+ * `parseInt("5m", 10)` returns `5` (parses leading digits and ignores
+ * trailing). This helper checks the relative-unit pattern FIRST.
+ */
+export function parseRetryAfter(headerValue: string | undefined): number | null {
+ if (!headerValue) return null;
+ const trimmed = headerValue.trim();
+ if (!trimmed) return null;
+
+ // Groq-style relative: must check BEFORE plain int parse.
+ const relMatch = trimmed.match(/^(\d+)([smh])$/i);
+ if (relMatch) {
+ const n = Number(relMatch[1]);
+ const unit = relMatch[2].toLowerCase();
+ if (Number.isFinite(n)) {
+ if (unit === "s") return n;
+ if (unit === "m") return n * 60;
+ if (unit === "h") return n * 3600;
+ }
+ }
+
+ // Pure integer seconds.
+ if (/^\d+$/.test(trimmed)) {
+ const n = Number(trimmed);
+ return Number.isFinite(n) ? n : null;
+ }
+
+ // HTTP date.
+ const ts = Date.parse(trimmed);
+ if (Number.isFinite(ts)) {
+ return Math.max(0, Math.floor((ts - Date.now()) / 1000));
+ }
+
+ return null;
+}
+
+/**
+ * Convenience wrapper: pull the Retry-After from a response's headers
+ * and parse it to seconds. Returns null if absent or unparseable.
+ */
+export function retryAfterFromResponse(response: {
+ headers?: Record;
+}): number | null {
+ return parseRetryAfter(getHeader(response.headers, "retry-after"));
+}
+
+/**
+ * Normalize an unknown headers-like value into a plain `Record`.
+ * Native `Headers` (from `fetch`) does NOT respond to `Object.entries` — it
+ * exposes `.entries()` instead. Without this normalization, `getHeader` would
+ * silently miss every header on a Headers instance.
+ */
+function normalizeHeaders(raw: unknown): Record | undefined {
+ if (raw === null || typeof raw !== "object") return undefined;
+ const maybeIter = (raw as { entries?: unknown }).entries;
+ if (typeof maybeIter === "function") {
+ try {
+ return Object.fromEntries((raw as { entries: () => Iterable<[string, string]> }).entries());
+ } catch {
+ // fall through to plain-object treatment
+ }
+ }
+ return raw as Record;
+}
+
+/**
+ * Adapter that takes an error thrown by an HTTP client (fetch wrapper, axios,
+ * upstream SDK, etc.) and produces a {@link FailureKind} suitable for the
+ * `classifyError` option of the circuit breaker.
+ *
+ * Recognises the common error shapes:
+ * - `err.status` + `err.headers` + `err.body` (low-level fetch wrapper)
+ * - `err.response.status` + `err.response.headers` + `err.response.data` (axios-style)
+ * - `err.message` (last-resort body for keyword scan)
+ *
+ * Returns `undefined` when the error doesn't carry enough information to
+ * classify, so the breaker can decide what to do without a kind tag.
+ *
+ * Companion to issue #2100 follow-up.
+ */
+export function classify429FromError(err: unknown): FailureKind | undefined {
+ if (err === null || typeof err !== "object") return undefined;
+ const e = err as Record;
+
+ let status: number | undefined;
+ let headers: Record | undefined;
+ let body: unknown;
+
+ if (typeof e.status === "number") {
+ status = e.status;
+ }
+ if (typeof e.statusCode === "number" && status === undefined) {
+ status = e.statusCode;
+ }
+
+ if (e.response && typeof e.response === "object") {
+ const resp = e.response as Record;
+ if (typeof resp.status === "number" && status === undefined) {
+ status = resp.status;
+ }
+ if (resp.headers && typeof resp.headers === "object") {
+ headers = normalizeHeaders(resp.headers);
+ }
+ if (resp.data !== undefined) {
+ body = resp.data;
+ } else if (typeof resp.body !== "undefined") {
+ body = resp.body;
+ }
+ }
+
+ if (headers === undefined && e.headers && typeof e.headers === "object") {
+ headers = normalizeHeaders(e.headers);
+ }
+ if (body === undefined) {
+ if (typeof e.body !== "undefined") {
+ body = e.body;
+ } else if (typeof e.message === "string") {
+ body = e.message;
+ }
+ }
+
+ if (typeof status !== "number") return undefined;
+ return classify429({ status, headers, body });
+}
diff --git a/src/shared/utils/providerHints.ts b/src/shared/utils/providerHints.ts
new file mode 100644
index 0000000000..e5a375575b
--- /dev/null
+++ b/src/shared/utils/providerHints.ts
@@ -0,0 +1,73 @@
+/**
+ * Per-provider default policy for upstream 429 hint trust.
+ *
+ * @see Issue #2100 follow-up — surface a user-overridable per-profile toggle
+ * that decides whether the circuit breaker uses upstream 429 body / Retry-After
+ * hints (`classify429`, `cooldownByKind`) to differentiate rate-limit from
+ * quota-exhausted failure cooldowns.
+ *
+ * This helper returns the **default** answer for a given provider. The actual
+ * runtime decision is the user override (if any) OR this default. See
+ * `accountFallback.ts` / `chat.ts` / `chatHelpers.ts` for the resolution
+ * call sites:
+ *
+ * ```ts
+ * const userValue = providerProfile.useUpstream429BreakerHints; // boolean | undefined
+ * const useHints = userValue !== undefined
+ * ? userValue
+ * : defaultUseUpstream429BreakerHints(provider);
+ * ```
+ *
+ * Default policy: direct cloud providers default `true` because their 429
+ * bodies and `Retry-After` headers are authoritative. Reverse-proxy /
+ * self-hosted / CLI-backed providers default `false` because forwarded 429
+ * metadata is often unreliable or fabricated by the proxy.
+ *
+ * @module shared/utils/providerHints
+ */
+
+import {
+ UPSTREAM_PROXY_PROVIDERS,
+ SELF_HOSTED_CHAT_PROVIDER_IDS,
+ isLocalProvider,
+ isClaudeCodeCompatibleProvider,
+} from "../constants/providers";
+
+/**
+ * Conservative per-provider default for `useUpstream429BreakerHints`.
+ *
+ * Returns `false` for any provider whose 429 metadata may be forwarded by
+ * an intermediary (proxy, self-hosted runtime, CLI wrapper). Returns `true`
+ * for direct cloud providers where the upstream response is authoritative.
+ */
+export function defaultUseUpstream429BreakerHints(providerId: string): boolean {
+ if (Object.prototype.hasOwnProperty.call(UPSTREAM_PROXY_PROVIDERS, providerId)) {
+ return false;
+ }
+ if (isLocalProvider(providerId)) {
+ return false;
+ }
+ if (SELF_HOSTED_CHAT_PROVIDER_IDS.has(providerId)) {
+ return false;
+ }
+ if (isClaudeCodeCompatibleProvider(providerId)) {
+ return false;
+ }
+ return true;
+}
+
+/**
+ * Resolve the effective `useHints` decision: the user override wins if set,
+ * otherwise fall back to the per-provider default.
+ *
+ * `undefined` means "not user-set" and triggers the default lookup.
+ */
+export function resolveUseUpstream429BreakerHints(
+ providerId: string,
+ userValue: boolean | undefined
+): boolean {
+ if (userValue !== undefined) {
+ return userValue;
+ }
+ return defaultUseUpstream429BreakerHints(providerId);
+}
diff --git a/src/shared/utils/runtimeTimeouts.ts b/src/shared/utils/runtimeTimeouts.ts
index 672466a1c2..14e0e67afb 100644
--- a/src/shared/utils/runtimeTimeouts.ts
+++ b/src/shared/utils/runtimeTimeouts.ts
@@ -11,7 +11,7 @@ export const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 600_000;
export const DEFAULT_STREAM_READINESS_TIMEOUT_MS = 30_000;
export const DEFAULT_FETCH_CONNECT_TIMEOUT_MS = 30_000;
export const DEFAULT_FETCH_KEEPALIVE_TIMEOUT_MS = 4_000;
-export const DEFAULT_API_BRIDGE_PROXY_TIMEOUT_MS = 30_000;
+export const DEFAULT_API_BRIDGE_PROXY_TIMEOUT_MS = 600_000;
export const DEFAULT_API_BRIDGE_SERVER_REQUEST_TIMEOUT_MS = 300_000;
export const DEFAULT_API_BRIDGE_SERVER_HEADERS_TIMEOUT_MS = 60_000;
export const DEFAULT_API_BRIDGE_SERVER_KEEPALIVE_TIMEOUT_MS = 5_000;
diff --git a/src/shared/validation/schemas.ts b/src/shared/validation/schemas.ts
index ae5aeb25cb..6dba0a55dc 100644
--- a/src/shared/validation/schemas.ts
+++ b/src/shared/validation/schemas.ts
@@ -775,6 +775,11 @@ const connectionCooldownProfileSchema = z
.object({
baseCooldownMs: z.number().int().min(0).optional(),
useUpstreamRetryHints: z.boolean().optional(),
+ // Issue #2100 follow-up: per-profile toggle for upstream 429 hint trust.
+ // `null` is an explicit unset sentinel — PATCH handler deletes the key
+ // from stored settings so the per-provider default resolves at runtime.
+ // `undefined` (key omitted) means "leave existing value unchanged".
+ useUpstream429BreakerHints: z.boolean().nullable().optional(),
maxBackoffSteps: z.number().int().min(0).optional(),
})
.strict();
diff --git a/src/shared/validation/settingsSchemas.ts b/src/shared/validation/settingsSchemas.ts
index 2e4973b22b..7a5b1b3411 100644
--- a/src/shared/validation/settingsSchemas.ts
+++ b/src/shared/validation/settingsSchemas.ts
@@ -104,6 +104,11 @@ export const updateSettingsSchema = z.object({
lkgpEnabled: z.boolean().optional(),
backgroundDegradation: z.unknown().optional(),
bruteForceProtection: z.boolean().optional(),
+ // Auto-routing settings
+ autoRoutingEnabled: z.boolean().optional(),
+ autoRoutingDefaultVariant: z
+ .enum(["lkgp", "coding", "fast", "cheap", "offline", "smart"])
+ .optional(),
});
export const databaseSettingsSchema = z.object(
diff --git a/src/sse/handlers/chat.ts b/src/sse/handlers/chat.ts
index 56cbee63d9..e816960249 100644
--- a/src/sse/handlers/chat.ts
+++ b/src/sse/handlers/chat.ts
@@ -3,6 +3,8 @@ import {
getProviderCredentialsWithQuotaPreflight,
markAccountUnavailable,
extractApiKey,
+ isValidApiKey,
+ extractSessionAffinityKey,
} from "../services/auth";
import {
getRuntimeProviderProfile,
@@ -23,6 +25,7 @@ import {
getModelTargetFormat,
PROVIDER_ID_TO_ALIAS,
} from "@omniroute/open-sse/config/providerModels.ts";
+import type { AutoVariant } from "@omniroute/open-sse/services/autoCombo/autoPrefix.ts";
import * as log from "../utils/logger";
import { checkAndRefreshToken } from "../services/tokenRefresh";
import { deleteHandoff, getHandoff } from "@/lib/db/contextHandoffs";
@@ -43,6 +46,8 @@ import {
} from "./chatHelpers";
// Pipeline integration — wired modules
+import { classify429FromError, type FailureKind } from "@/shared/utils/classify429";
+import { resolveUseUpstream429BreakerHints } from "@/shared/utils/providerHints";
import { getCircuitBreaker } from "../../shared/utils/circuitBreaker";
import { markAccountExhaustedFrom429 } from "../../domain/quotaCache";
import { RequestTelemetry, recordTelemetry } from "../../shared/utils/requestTelemetry";
@@ -208,6 +213,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
// T04: client-provided external session header has priority over generated fingerprint.
const externalSessionId = extractExternalSessionId(request.headers);
const sessionId = externalSessionId || generateStableSessionId(body);
+ const sessionAffinityKey = extractSessionAffinityKey(body, request.headers) || sessionId;
const requestedConnectionId = request.headers.get("x-omniroute-connection")?.trim() || null;
if (sessionId) {
touchSession(sessionId);
@@ -229,9 +235,9 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
// Guardrail pre-call pipeline — prompt injection, PII masking, and future custom rules.
telemetry.startPhase("validate");
const preCallGuardrails = await guardrailRegistry.runPreCallHooks(body, {
- apiKeyInfo,
+ apiKeyInfo: apiKeyInfo as any,
disabledGuardrails: resolveDisabledGuardrails({
- apiKeyInfo: apiKeyInfo as Record | null,
+ apiKeyInfo: (apiKeyInfo ?? null) as any,
body,
headers: request.headers,
}),
@@ -295,6 +301,44 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
telemetry.endPhase();
}
+ // ── Zero-Config Auto-Routing (auto and auto/ prefix) ────────────────────────
+ // If the model ID is "auto" or starts with "auto/", bypass DB combo lookup
+ // entirely and generate a virtual auto-combo on-the-fly from connected providers.
+ let autoVariant: AutoVariant | undefined;
+ let isAutoRouting = resolvedModelStr === "auto" || resolvedModelStr.startsWith("auto/");
+ if (isAutoRouting) {
+ // C2: Enforce autoRoutingEnabled setting
+ const settings = await getSettings();
+ if (settings?.autoRoutingEnabled === false) {
+ return errorResponse(
+ HTTP_STATUS.BAD_REQUEST,
+ "Auto routing is disabled. Enable it in Settings > Routing."
+ );
+ }
+
+ try {
+ const { parseAutoPrefix } =
+ await import("@omniroute/open-sse/services/autoCombo/autoPrefix.ts");
+ const parsed = parseAutoPrefix(resolvedModelStr);
+ if (parsed.valid) {
+ autoVariant = parsed.variant;
+ // C3: Apply autoRoutingDefaultVariant from settings when bare "auto" is used
+ if (autoVariant === undefined && settings?.autoRoutingDefaultVariant) {
+ autoVariant = settings.autoRoutingDefaultVariant as AutoVariant;
+ }
+ log.info(
+ "AUTO",
+ `Zero-config routing variant: ${autoVariant || "default"} (model=${resolvedModelStr})`
+ );
+ } else {
+ log.warn("AUTO", `Invalid auto prefix format: ${resolvedModelStr}`);
+ }
+ } catch (err) {
+ log.error("AUTO", "Failed to load auto-prefix parser", { err });
+ }
+ }
+ // ────────────────────────────────────────────────────────────────────────────
+
// Check if model is a combo (has multiple models with fallback)
telemetry.startPhase("resolve");
let combo: any = await getComboForModel(resolvedModelStr);
@@ -312,6 +356,23 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
}
}
+ // Auto-prefix short-circuit: if auto/ prefix was detected, replace combo with virtual one
+ if (isAutoRouting && combo === null) {
+ try {
+ const { createVirtualAutoCombo } =
+ await import("@omniroute/open-sse/services/autoCombo/virtualFactory.ts");
+ const virtualCombo = await createVirtualAutoCombo(autoVariant);
+ virtualCombo.name = resolvedModelStr;
+ virtualCombo.id = resolvedModelStr;
+ combo = virtualCombo;
+ log.info(
+ "AUTO",
+ `Virtual auto-combo created: ${combo.name} (${virtualCombo.candidatePool?.length || 0} candidates)`
+ );
+ } catch (err) {
+ log.error("AUTO", "Failed to create virtual auto-combo", { err });
+ }
+ }
if (combo) {
log.info(
"CHAT",
@@ -358,6 +419,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
allowedConnections,
resolvedModel,
{
+ sessionKey: sessionAffinityKey,
...(target?.connectionId ? { forcedConnectionId: target.connectionId } : {}),
}
);
@@ -388,6 +450,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
connectionId?: string | null;
executionKey?: string | null;
stepId?: string | null;
+ allowedConnectionIds?: string[] | null;
}
) =>
handleSingleModelChat(
@@ -400,6 +463,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
telemetry,
{
sessionId,
+ sessionAffinityKey,
forceLiveComboTest: isComboLiveTest,
forcedConnectionId: target?.connectionId ?? null,
allowedConnectionIds: target?.allowedConnectionIds ?? null,
@@ -450,7 +514,12 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
combo.name,
apiKeyInfo,
telemetry,
- { sessionId, emergencyFallbackTried: true, forceLiveComboTest: isComboLiveTest },
+ {
+ sessionId,
+ sessionAffinityKey,
+ emergencyFallbackTried: true,
+ forceLiveComboTest: isComboLiveTest,
+ },
combo.strategy,
true
);
@@ -486,6 +555,7 @@ export async function handleChat(request: any, clientRawRequest: any = null) {
telemetry,
{
sessionId,
+ sessionAffinityKey,
forceLiveComboTest: isComboLiveTest,
forcedConnectionId: requestedConnectionId,
},
@@ -524,6 +594,7 @@ async function handleSingleModelChat(
emergencyFallbackTried?: boolean;
forceLiveComboTest?: boolean;
sessionId?: string | null;
+ sessionAffinityKey?: string | null;
forcedConnectionId?: string | null;
allowedConnectionIds?: string[] | null;
comboStepId?: string | null;
@@ -615,11 +686,25 @@ async function handleSingleModelChat(
});
if (gate) return gate;
+ // Issue #2100 follow-up: opt-in upstream 429 hint trust per provider.
+ const useHints429 = resolveUseUpstream429BreakerHints(
+ provider,
+ (providerProfile as { useUpstream429BreakerHints?: boolean }).useUpstream429BreakerHints
+ );
const breaker = getCircuitBreaker(provider, {
failureThreshold: providerProfile.failureThreshold,
resetTimeout: providerProfile.resetTimeoutMs,
onStateChange: (name: string, from: string, to: string) =>
log.info("CIRCUIT", `${name}: ${from} → ${to}`),
+ ...(useHints429
+ ? {
+ cooldownByKind: {
+ rate_limit: 60_000,
+ quota_exhausted: 3_600_000,
+ } satisfies Partial>,
+ classifyError: classify429FromError,
+ }
+ : {}),
});
const userAgent = request?.headers?.get("user-agent") || "";
@@ -670,6 +755,7 @@ async function handleSingleModelChat(
effectiveAllowedConnections,
model,
{
+ sessionKey: runtimeOptions.sessionAffinityKey ?? runtimeOptions.sessionId ?? null,
excludeConnectionIds: Array.from(excludedConnectionIds),
...(forceLiveComboTest
? {
@@ -861,6 +947,25 @@ async function handleSingleModelChat(
return result.response;
}
+ if (result.errorType === "account_semaphore_capacity") {
+ // Local concurrency pressure is not an upstream quota failure. Prefer another
+ // account when possible; pinned combo steps fall through to combo orchestration.
+ if (hasForcedConnection) {
+ return result.response;
+ }
+
+ log.warn(
+ "AUTH",
+ `Account ${accountId}... at local concurrency cap, trying fallback account`
+ );
+ excludedConnectionIds.add(credentials.connectionId);
+ lastError = result.error;
+ lastStatus = result.status;
+ requestRetryLastError = result.error;
+ requestRetryLastStatus = result.status;
+ continue;
+ }
+
// Emergency fallback for budget exhaustion (402 / billing / quota keywords):
// reroute to a free model (default provider/model: nvidia + openai/gpt-oss-120b) exactly once.
if (!runtimeOptions.emergencyFallbackTried) {
diff --git a/src/sse/handlers/chatHelpers.ts b/src/sse/handlers/chatHelpers.ts
index 3792a2b26a..fdac283a01 100644
--- a/src/sse/handlers/chatHelpers.ts
+++ b/src/sse/handlers/chatHelpers.ts
@@ -25,6 +25,9 @@ import {
} from "@omniroute/open-sse/utils/proxyFetch.ts";
import { resolveProxyForConnection } from "@/lib/localDb";
import { CircuitBreakerOpenError, getCircuitBreaker } from "../../shared/utils/circuitBreaker";
+import { classify429FromError, type FailureKind } from "../../shared/utils/classify429";
+import { resolveUseUpstream429BreakerHints } from "../../shared/utils/providerHints";
+
import { logProxyEvent } from "../../lib/proxyLogger";
import { logTranslationEvent } from "../../lib/translatorEvents";
import { getRuntimeProviderProfile } from "@omniroute/open-sse/services/accountFallback.ts";
@@ -238,11 +241,25 @@ export async function checkPipelineGates(
) {
const bypassReason = options.bypassReason || "pipeline override";
const providerProfile = options.providerProfile ?? (await getRuntimeProviderProfile(provider));
+ // Issue #2100 follow-up: opt-in upstream 429 hint trust per provider.
+ const useHints429 = resolveUseUpstream429BreakerHints(
+ provider,
+ (providerProfile as { useUpstream429BreakerHints?: boolean }).useUpstream429BreakerHints
+ );
const breaker = getCircuitBreaker(provider, {
failureThreshold: providerProfile.failureThreshold ?? providerProfile.circuitBreakerThreshold,
resetTimeout: providerProfile.resetTimeoutMs ?? providerProfile.circuitBreakerReset,
onStateChange: (name: string, from: string, to: string) =>
log.info("CIRCUIT", `${name}: ${from} → ${to}`),
+ ...(useHints429
+ ? {
+ cooldownByKind: {
+ rate_limit: 60_000,
+ quota_exhausted: 3_600_000,
+ } satisfies Partial>,
+ classifyError: classify429FromError,
+ }
+ : {}),
});
if (options.ignoreCircuitBreaker && !breaker.canExecute()) {
log.info("CIRCUIT", `Bypassing OPEN circuit breaker for ${provider} (${bypassReason})`);
diff --git a/tests/unit/account-fallback-service.test.ts b/tests/unit/account-fallback-service.test.ts
index 4d0d9e5a77..d3dac846d1 100644
--- a/tests/unit/account-fallback-service.test.ts
+++ b/tests/unit/account-fallback-service.test.ts
@@ -759,3 +759,58 @@ test("recordModelLockoutFailure uses regular backoff for non-quota reasons", ()
clearModelLock("modelscope", "test-conn-modelscope-2", "qwen/Qwen2.5-Coder-32B-Instruct");
}
});
+
+// Test for hour quota related error messages
+test("checkFallbackError classifies hour quota errors correctly", () => {
+ // For OAuth providers (e.g., codex), hour quota errors should be QUOTA_EXHAUSTED
+ const result1 = checkFallbackError(
+ 429,
+ "Coding Plan hour quota has been exceeded",
+ 0,
+ null,
+ "codex"
+ );
+ assert.equal(result1.shouldFallback, true);
+ assert.equal(result1.reason, RateLimitReason.QUOTA_EXHAUSTED);
+
+ const result2 = checkFallbackError(429, "hour quota exceeded", 0, null, "codex");
+ assert.equal(result2.shouldFallback, true);
+ assert.equal(result2.reason, RateLimitReason.QUOTA_EXHAUSTED);
+
+ const result3 = checkFallbackError(429, "Your hour quota is exceeded", 0, null, "codex");
+ assert.equal(result3.shouldFallback, true);
+ assert.equal(result3.reason, RateLimitReason.QUOTA_EXHAUSTED);
+
+ const result4 = checkFallbackError(429, "hour quota depleted", 0, null, "codex");
+ assert.equal(result4.shouldFallback, true);
+ assert.equal(result4.reason, RateLimitReason.QUOTA_EXHAUSTED);
+
+ // For API-key providers with 402 status, hour quota errors should be QUOTA_EXHAUSTED
+ const result5 = checkFallbackError(402, "hour quota has been exceeded", 0, null, "openai");
+ assert.equal(result5.shouldFallback, true);
+ assert.equal(result5.reason, RateLimitReason.QUOTA_EXHAUSTED);
+
+ const result6 = checkFallbackError(
+ 403,
+ "Coding Plan hour quota has been exceeded",
+ 0,
+ null,
+ "openai"
+ );
+ assert.equal(result6.shouldFallback, true);
+ assert.equal(result6.reason, RateLimitReason.QUOTA_EXHAUSTED);
+});
+
+// Test for classifyErrorText function with hour quota
+test("classifyErrorText handles hour quota messages", () => {
+ const { classifyErrorText } = accountFallback;
+
+ assert.equal(
+ classifyErrorText("Coding Plan hour quota has been exceeded"),
+ RateLimitReason.QUOTA_EXHAUSTED
+ );
+ assert.equal(classifyErrorText("hour quota exceeded"), RateLimitReason.QUOTA_EXHAUSTED);
+ assert.equal(classifyErrorText("Your hour quota is exceeded"), RateLimitReason.QUOTA_EXHAUSTED);
+ assert.equal(classifyErrorText("hour quota has been exceeded"), RateLimitReason.QUOTA_EXHAUSTED);
+ assert.equal(classifyErrorText("quota has been exceeded"), RateLimitReason.QUOTA_EXHAUSTED);
+});
diff --git a/tests/unit/audio-speech-handler.test.ts b/tests/unit/audio-speech-handler.test.ts
index 0cd3f39ead..49d24998c9 100644
--- a/tests/unit/audio-speech-handler.test.ts
+++ b/tests/unit/audio-speech-handler.test.ts
@@ -2,6 +2,7 @@ import test from "node:test";
import assert from "node:assert/strict";
const { handleAudioSpeech } = await import("../../open-sse/handlers/audioSpeech.ts");
+const { AUDIO_SPEECH_PROVIDERS } = await import("../../open-sse/config/audioRegistry.ts");
test("handleAudioSpeech requires model", async () => {
const response = await handleAudioSpeech({
@@ -486,7 +487,7 @@ test("handleAudioSpeech maps Inworld requests to basic auth and wav output", asy
try {
const response = await handleAudioSpeech({
body: {
- model: "inworld/inworld-tts-1.5-max",
+ model: "inworld/inworld-tts-2",
input: "inworld text",
voice: "voice-9",
response_format: "wav",
@@ -498,8 +499,8 @@ test("handleAudioSpeech maps Inworld requests to basic auth and wav output", asy
assert.deepEqual(captured.body, {
text: "inworld text",
voiceId: "voice-9",
- modelId: "inworld-tts-1.5-max",
- audioConfig: { audioEncoding: "LINEAR16" },
+ modelId: "inworld-tts-2",
+ audioConfig: { audioEncoding: "WAV" },
});
assert.equal(response.headers.get("content-type"), "audio/wav");
assert.deepEqual(Array.from(new Uint8Array(await response.arrayBuffer())), [1, 2, 3, 4]);
@@ -508,6 +509,60 @@ test("handleAudioSpeech maps Inworld requests to basic auth and wav output", asy
}
});
+test("Inworld speech registry exposes supported formats without flac", () => {
+ assert.deepEqual(AUDIO_SPEECH_PROVIDERS.inworld.supportedFormats, ["mp3", "wav", "opus", "pcm"]);
+});
+
+test("handleAudioSpeech maps Inworld opus output and rejects flac", async () => {
+ const originalFetch = globalThis.fetch;
+ let captured;
+ let callCount = 0;
+
+ globalThis.fetch = async (_url, options = {}) => {
+ callCount += 1;
+ captured = JSON.parse(String(options.body || "{}"));
+
+ return new Response(JSON.stringify({ audioContent: "BQY=", contentType: "audio/opus" }), {
+ status: 200,
+ headers: { "content-type": "application/json" },
+ });
+ };
+
+ try {
+ const opusResponse = await handleAudioSpeech({
+ body: {
+ model: "inworld/inworld-tts-2",
+ input: "inworld text",
+ response_format: "opus",
+ },
+ credentials: { apiKey: "encoded-basic-token" },
+ });
+
+ assert.deepEqual(captured.audioConfig, { audioEncoding: "OPUS" });
+ assert.equal(opusResponse.headers.get("content-type"), "audio/opus");
+ assert.deepEqual(Array.from(new Uint8Array(await opusResponse.arrayBuffer())), [5, 6]);
+
+ const flacResponse = await handleAudioSpeech({
+ body: {
+ model: "inworld/inworld-tts-2",
+ input: "inworld text",
+ response_format: "flac",
+ },
+ credentials: { apiKey: "encoded-basic-token" },
+ });
+ const payload = (await flacResponse.json()) as any;
+
+ assert.equal(flacResponse.status, 400);
+ assert.equal(
+ payload.error.message,
+ "Inworld TTS supports response_format mp3, wav, opus, or pcm only"
+ );
+ assert.equal(callCount, 1);
+ } finally {
+ globalThis.fetch = originalFetch;
+ }
+});
+
test("handleAudioSpeech supports local Coqui providers without credentials", async () => {
const originalFetch = globalThis.fetch;
let captured;
diff --git a/tests/unit/authz/classify.test.ts b/tests/unit/authz/classify.test.ts
index 7f6021992e..5870d8ed30 100644
--- a/tests/unit/authz/classify.test.ts
+++ b/tests/unit/authz/classify.test.ts
@@ -16,7 +16,7 @@ const cases: Case[] = [
{ name: "root /", path: "/", expectedClass: "MANAGEMENT", expectedNormalized: "/" },
{ name: "dashboard root", path: "/dashboard", expectedClass: "MANAGEMENT" },
{ name: "dashboard nested", path: "/dashboard/settings", expectedClass: "MANAGEMENT" },
- { name: "dashboard onboarding", path: "/dashboard/onboarding", expectedClass: "MANAGEMENT" },
+ { name: "dashboard onboarding", path: "/dashboard/onboarding", expectedClass: "PUBLIC" },
{
name: "/api/v1 base",
diff --git a/tests/unit/autoPrefix.test.ts b/tests/unit/autoPrefix.test.ts
new file mode 100644
index 0000000000..cb0588dc61
--- /dev/null
+++ b/tests/unit/autoPrefix.test.ts
@@ -0,0 +1,89 @@
+import { parseAutoPrefix } from "../../open-sse/services/autoCombo/autoPrefix.ts";
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+describe("parseAutoPrefix", () => {
+ it('should return valid for "auto" with no variant', () => {
+ const result = parseAutoPrefix("auto");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, undefined);
+ });
+
+ it('should return valid for "auto/" with no variant', () => {
+ const result = parseAutoPrefix("auto/");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, undefined);
+ });
+
+ it('should return valid for "auto/coding" with coding variant', () => {
+ const result = parseAutoPrefix("auto/coding");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, "coding");
+ });
+
+ it('should return valid for "auto/fast" with fast variant', () => {
+ const result = parseAutoPrefix("auto/fast");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, "fast");
+ });
+
+ it('should return valid for "auto/cheap" with cheap variant', () => {
+ const result = parseAutoPrefix("auto/cheap");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, "cheap");
+ });
+
+ it('should return valid for "auto/offline" with offline variant', () => {
+ const result = parseAutoPrefix("auto/offline");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, "offline");
+ });
+
+ it('should return valid for "auto/smart" with smart variant', () => {
+ const result = parseAutoPrefix("auto/smart");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, "smart");
+ });
+
+ it('should return valid for "auto/lkgp" with lkgp variant', () => {
+ const result = parseAutoPrefix("auto/lkgp");
+ assert.strictEqual(result.valid, true);
+ assert.strictEqual(result.variant, "lkgp");
+ });
+
+ it('should return invalid for "autocoding" (invalid format)', () => {
+ const result = parseAutoPrefix("autocoding");
+ assert.strictEqual(result.valid, false);
+ assert.match(result.error || "", /Invalid auto prefix format/);
+ });
+
+ it('should return invalid for "auto/unknown" (invalid variant)', () => {
+ const result = parseAutoPrefix("auto/unknown");
+ assert.strictEqual(result.valid, false);
+ assert.match(result.error || "", /Invalid auto variant: unknown/);
+ });
+
+ it("should return invalid for a non-auto prefixed model", () => {
+ const result = parseAutoPrefix("otherModel");
+ assert.strictEqual(result.valid, false);
+ assert.match(result.error || "", /Not an auto-prefixed model/);
+ });
+
+ it("should return invalid for empty string", () => {
+ const result = parseAutoPrefix("");
+ assert.strictEqual(result.valid, false);
+ assert.match(result.error || "", /Not an auto-prefixed model/);
+ });
+
+ it("should return invalid for null/undefined input (handled by TS but for robustness)", () => {
+ // @ts-ignore testing invalid input that TS normally prevents
+ const result = parseAutoPrefix(null);
+ assert.strictEqual(result.valid, false);
+ assert.match(result.error || "", /Not an auto-prefixed model/);
+
+ // @ts-ignore
+ const result2 = parseAutoPrefix(undefined);
+ assert.strictEqual(result2.valid, false);
+ assert.match(result2.error || "", /Not an auto-prefixed model/);
+ });
+});
diff --git a/tests/unit/cc-compatible-provider.test.ts b/tests/unit/cc-compatible-provider.test.ts
index 0f03139ddf..5eac9493c8 100644
--- a/tests/unit/cc-compatible-provider.test.ts
+++ b/tests/unit/cc-compatible-provider.test.ts
@@ -571,6 +571,91 @@ test("handleChatCore forces SSE upstream for CC compatible providers while retur
assert.equal(payload.usage.completion_tokens, 5);
});
+test("handleChatCore stops buffering CC-compatible SSE once a non-stream response completes", async () => {
+ const encoder = new TextEncoder();
+ let upstreamCancelled = false;
+ const upstreamChunks = [
+ "data:\n\n",
+ [
+ "event: message_start",
+ 'data: {"type":"message_start","message":{"id":"msg_3","type":"message","role":"assistant","model":"claude-sonnet-4-6","usage":{"input_tokens":4,"output_tokens":0}}}',
+ "",
+ "event: content_block_delta",
+ 'data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Finished but connection stayed open"}}',
+ "",
+ "event: message_delta",
+ 'data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":6}}',
+ "",
+ "event: message_stop",
+ 'data: {"type":"message_stop"}',
+ "",
+ ].join("\n"),
+ ];
+ let chunkIndex = 0;
+
+ globalThis.fetch = async () =>
+ new Response(
+ new ReadableStream({
+ pull(controller) {
+ if (chunkIndex < upstreamChunks.length) {
+ controller.enqueue(encoder.encode(upstreamChunks[chunkIndex++]));
+ }
+ },
+ cancel() {
+ upstreamCancelled = true;
+ },
+ }),
+ {
+ status: 200,
+ headers: {
+ "content-type": "text/event-stream",
+ },
+ }
+ );
+
+ const result = await handleChatCore({
+ body: {
+ model: "claude-sonnet-4-6",
+ messages: [{ role: "user", content: "Ping" }],
+ stream: false,
+ },
+ modelInfo: {
+ provider: "anthropic-compatible-cc-test",
+ model: "claude-sonnet-4-6",
+ extendedContext: false,
+ },
+ credentials: {
+ apiKey: "sk-test",
+ providerSpecificData: {
+ baseUrl: "https://proxy.example.com",
+ chatPath: CLAUDE_CODE_COMPATIBLE_DEFAULT_CHAT_PATH,
+ },
+ },
+ clientRawRequest: {
+ endpoint: "/v1/chat/completions",
+ body: {
+ model: "claude-sonnet-4-6",
+ messages: [{ role: "user", content: "Ping" }],
+ stream: false,
+ },
+ headers: new Headers({ accept: "application/json" }),
+ },
+ userAgent: "unit-test",
+ log: {
+ debug() {},
+ info() {},
+ warn() {},
+ error() {},
+ },
+ });
+
+ assert.equal(result.success, true);
+ assert.equal(upstreamCancelled, true);
+ const payload = (await result.response.json()) as any;
+ assert.equal(payload.choices[0].message.content, "Finished but connection stayed open");
+ assert.equal(payload.usage.completion_tokens, 6);
+});
+
test("handleChatCore preserves client cache markers for Claude Code requests to CC-compatible providers", async () => {
const calls = [];
globalThis.fetch = async (url, init = {}) => {
diff --git a/tests/unit/circuit-breaker-failure-kind.test.ts b/tests/unit/circuit-breaker-failure-kind.test.ts
new file mode 100644
index 0000000000..d9498f1a0a
--- /dev/null
+++ b/tests/unit/circuit-breaker-failure-kind.test.ts
@@ -0,0 +1,231 @@
+/**
+ * Tests for circuit breaker per-failure-kind cooldowns (Issue #2100).
+ *
+ * Each test creates a uniquely-named breaker so SQLite-backed state from
+ * `loadCircuitBreakerState()` cannot leak between tests when run in any
+ * order or with --test-concurrency > 1.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+ CircuitBreaker,
+ resetAllCircuitBreakers,
+ getCircuitBreaker,
+} from "../../src/shared/utils/circuitBreaker.ts";
+import type { FailureKind } from "../../src/shared/utils/classify429.ts";
+
+const uniqueName = (suffix: string) =>
+ `cb-test-#2100-${suffix}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+
+test("default behavior unchanged when neither cooldownByKind nor classifyError is set", () => {
+ const cb = new CircuitBreaker(uniqueName("legacy"), {
+ failureThreshold: 2,
+ resetTimeout: 30_000,
+ });
+ cb._onFailure();
+ cb._onFailure();
+ assert.equal(cb.state, "OPEN");
+ assert.equal(cb.lastFailureKind, null);
+ // Cooldown is the legacy resetTimeout — not biased by kind.
+ const t = cb._timeUntilReset();
+ assert.ok(t > 29_000 && t <= 30_000, `expected ~30s, got ${t}`);
+ cb.reset();
+});
+
+test("cooldownByKind: quota_exhausted gets longer cooldown than rate_limit", () => {
+ const cb = new CircuitBreaker(uniqueName("kind-cooldown"), {
+ failureThreshold: 1,
+ resetTimeout: 30_000,
+ cooldownByKind: {
+ rate_limit: 60_000,
+ quota_exhausted: 3_600_000,
+ },
+ });
+
+ cb._onFailure("rate_limit");
+ assert.equal(cb.state, "OPEN");
+ assert.equal(cb.lastFailureKind, "rate_limit");
+ const tRate = cb._timeUntilReset();
+ assert.ok(tRate > 59_000 && tRate <= 60_000, `rate_limit cooldown: expected ~60s, got ${tRate}`);
+
+ cb.reset();
+ cb._onFailure("quota_exhausted");
+ const tQuota = cb._timeUntilReset();
+ assert.ok(
+ tQuota > 3_599_000 && tQuota <= 3_600_000,
+ `quota_exhausted cooldown: expected ~3600s, got ${tQuota}`
+ );
+
+ cb.reset();
+});
+
+test("cooldownByKind falls back to resetTimeout when no override for the kind", () => {
+ const cb = new CircuitBreaker(uniqueName("partial-cooldown"), {
+ failureThreshold: 1,
+ resetTimeout: 45_000,
+ cooldownByKind: {
+ quota_exhausted: 3_600_000,
+ // rate_limit intentionally omitted — should use resetTimeout
+ },
+ });
+ cb._onFailure("rate_limit");
+ const t = cb._timeUntilReset();
+ assert.ok(t > 44_000 && t <= 45_000, `expected ~45s fallback, got ${t}`);
+ cb.reset();
+});
+
+test("cooldownByKind falls back to resetTimeout when lastFailureKind is null", () => {
+ const cb = new CircuitBreaker(uniqueName("null-kind"), {
+ failureThreshold: 1,
+ resetTimeout: 30_000,
+ cooldownByKind: {
+ rate_limit: 60_000,
+ quota_exhausted: 3_600_000,
+ },
+ });
+ // Old-style call site that doesn't classify — kind stays null.
+ cb._onFailure();
+ assert.equal(cb.lastFailureKind, null);
+ const t = cb._timeUntilReset();
+ assert.ok(t > 29_000 && t <= 30_000, `expected resetTimeout fallback, got ${t}`);
+ cb.reset();
+});
+
+test("classifyError on execute() routes errors to the correct kind", async () => {
+ const cb = new CircuitBreaker(uniqueName("classifier"), {
+ failureThreshold: 1,
+ resetTimeout: 1_000,
+ cooldownByKind: { quota_exhausted: 600_000 },
+ classifyError: (err: unknown): FailureKind | undefined => {
+ if (err instanceof Error && err.message.includes("daily limit")) {
+ return "quota_exhausted";
+ }
+ return "transient";
+ },
+ });
+
+ await assert.rejects(async () => {
+ await cb.execute(async () => {
+ throw new Error("You exceeded your daily limit");
+ });
+ });
+
+ assert.equal(cb.state, "OPEN");
+ assert.equal(cb.lastFailureKind, "quota_exhausted");
+ const t = cb._timeUntilReset();
+ assert.ok(t > 599_000 && t <= 600_000, `expected ~600s quota cooldown, got ${t}`);
+ cb.reset();
+});
+
+test("_onSuccess clears lastFailureKind on close transition", () => {
+ const cb = new CircuitBreaker(uniqueName("success-clear"), {
+ failureThreshold: 1,
+ resetTimeout: 100,
+ cooldownByKind: { rate_limit: 100 },
+ });
+ cb._onFailure("rate_limit");
+ assert.equal(cb.lastFailureKind, "rate_limit");
+ // simulate elapsed time & success path through _onSuccess (which the
+ // combo path uses); after success, kind should clear and breaker close.
+ cb._onSuccess();
+ assert.equal(cb.lastFailureKind, null);
+ assert.equal(cb.state, "CLOSED");
+});
+
+test("reset() clears lastFailureKind", () => {
+ const cb = new CircuitBreaker(uniqueName("reset-clear"), {
+ failureThreshold: 1,
+ cooldownByKind: { rate_limit: 60_000 },
+ });
+ cb._onFailure("rate_limit");
+ assert.equal(cb.lastFailureKind, "rate_limit");
+ cb.reset();
+ assert.equal(cb.lastFailureKind, null);
+});
+
+test("getCircuitBreaker registry merges new options on subsequent calls", () => {
+ const name = uniqueName("registry-merge");
+ const cb1 = getCircuitBreaker(name, { failureThreshold: 5 });
+ // First call: no cooldownByKind, classifyError null
+ assert.deepEqual(cb1.cooldownByKind, {});
+ assert.equal(cb1.classifyError, null);
+ // Second call: add overrides
+ const cb2 = getCircuitBreaker(name, {
+ cooldownByKind: { rate_limit: 60_000 },
+ classifyError: () => "rate_limit" as FailureKind,
+ });
+ assert.equal(cb1, cb2, "registry returns same instance");
+ assert.deepEqual(cb1.cooldownByKind, { rate_limit: 60_000 });
+ assert.ok(typeof cb1.classifyError === "function");
+ cb1.reset();
+});
+
+test("registry MERGES cooldownByKind across calls (does not replace)", () => {
+ // Regression test for codex audit MEDIUM #1: if two registrations supply
+ // disjoint keys, both must survive. Without spread-merge the second call
+ // wiped the first.
+ const name = uniqueName("registry-merge-keys");
+ const cb1 = getCircuitBreaker(name, {
+ cooldownByKind: { quota_exhausted: 3_600_000 },
+ });
+ assert.deepEqual(cb1.cooldownByKind, { quota_exhausted: 3_600_000 });
+ const cb2 = getCircuitBreaker(name, {
+ cooldownByKind: { rate_limit: 60_000 },
+ });
+ assert.equal(cb1, cb2);
+ assert.deepEqual(cb1.cooldownByKind, {
+ quota_exhausted: 3_600_000,
+ rate_limit: 60_000,
+ });
+ cb1.reset();
+});
+
+test("classifyError throwing does not mask original error or skip _onFailure", async () => {
+ // Regression test for codex audit MEDIUM #2.
+ const cb = new CircuitBreaker(uniqueName("classifier-throws"), {
+ failureThreshold: 1,
+ resetTimeout: 1_000,
+ classifyError: () => {
+ throw new Error("classifier itself blew up");
+ },
+ });
+ let caught: unknown;
+ try {
+ await cb.execute(async () => {
+ throw new Error("original error");
+ });
+ } catch (e) {
+ caught = e;
+ }
+ assert.ok(caught instanceof Error);
+ assert.equal((caught as Error).message, "original error");
+ assert.equal(cb.state, "OPEN", "failure was still recorded");
+ assert.equal(cb.lastFailureKind, null, "kind defaults to null when classifier throws");
+ cb.reset();
+});
+
+test("invalid cooldownByKind values (NaN, Infinity, negative) fall back to resetTimeout", () => {
+ // Regression test for codex audit MEDIUM #3.
+ const cb = new CircuitBreaker(uniqueName("invalid-cooldown"), {
+ failureThreshold: 1,
+ resetTimeout: 30_000,
+ cooldownByKind: {
+ rate_limit: NaN,
+ quota_exhausted: -5_000,
+ transient: Number.POSITIVE_INFINITY,
+ },
+ });
+ for (const kind of ["rate_limit", "quota_exhausted", "transient"] as const) {
+ cb.reset();
+ cb._onFailure(kind);
+ const t = cb._timeUntilReset();
+ assert.ok(t > 29_000 && t <= 30_000, `expected resetTimeout fallback for ${kind}, got ${t}`);
+ }
+ cb.reset();
+});
+
+// Cleanup: clear the registry (and SQLite-persisted breaker state) so this
+// test file does not leak into others when --test-concurrency=10.
+test("teardown — reset all circuit breakers", () => {
+ resetAllCircuitBreakers();
+});
diff --git a/tests/unit/classify429.test.ts b/tests/unit/classify429.test.ts
new file mode 100644
index 0000000000..75d1a4fbd3
--- /dev/null
+++ b/tests/unit/classify429.test.ts
@@ -0,0 +1,156 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+ classify429,
+ looksLikeQuotaExhausted,
+ parseRetryAfter,
+ retryAfterFromResponse,
+ type FailureKind,
+} from "../../src/shared/utils/classify429.ts";
+
+test("classify429: non-429 status returns 'transient'", () => {
+ const out: FailureKind = classify429({ status: 500 });
+ assert.equal(out, "transient");
+});
+
+test("classify429: 429 with no body or hints returns 'rate_limit'", () => {
+ assert.equal(classify429({ status: 429 }), "rate_limit");
+ assert.equal(classify429({ status: 429, body: "" }), "rate_limit");
+ assert.equal(classify429({ status: 429, body: undefined }), "rate_limit");
+});
+
+test("classify429: 429 with quota keyword in string body returns 'quota_exhausted'", () => {
+ assert.equal(
+ classify429({ status: 429, body: "You exceeded your daily limit." }),
+ "quota_exhausted"
+ );
+ assert.equal(
+ classify429({ status: 429, body: "Monthly quota reached. Resets on the 1st." }),
+ "quota_exhausted"
+ );
+ assert.equal(
+ classify429({ status: 429, body: "Out of credits — top up your account." }),
+ "quota_exhausted"
+ );
+ assert.equal(classify429({ status: 429, body: "plan limit reached" }), "quota_exhausted");
+});
+
+test("classify429: 429 with quota keyword in nested object body returns 'quota_exhausted'", () => {
+ assert.equal(
+ classify429({
+ status: 429,
+ body: { error: { message: "You have exceeded your monthly quota." } },
+ }),
+ "quota_exhausted"
+ );
+ assert.equal(
+ classify429({
+ status: 429,
+ body: { error: { type: "insufficient_quota", message: "..." } },
+ }),
+ "quota_exhausted"
+ );
+});
+
+test("classify429: 429 without quota keyword returns 'rate_limit'", () => {
+ // Plain rate-limit message — keyword 'rate' alone is NOT in QUOTA_PATTERNS
+ // so classifier should default to "rate_limit" for any 429.
+ assert.equal(
+ classify429({ status: 429, body: "Too many requests. Try again in 60s." }),
+ "rate_limit"
+ );
+ assert.equal(
+ classify429({
+ status: 429,
+ body: "Rate limit reached for requests. Please retry.",
+ }),
+ "rate_limit"
+ );
+});
+
+test("looksLikeQuotaExhausted: detects all known keyword variants", () => {
+ for (const body of [
+ "daily limit exceeded",
+ "daily quota reached",
+ "per-day limit reached",
+ "monthly limit",
+ "monthly quota",
+ "per-month limit",
+ "quota exceeded",
+ "exceeded quota",
+ "insufficient_quota",
+ "billing cap reached",
+ "credit exhausted",
+ "out of credits",
+ "hard limit",
+ "hard-limit",
+ "plan limit",
+ ]) {
+ assert.equal(looksLikeQuotaExhausted(body), true, `failed for: ${body}`);
+ }
+});
+
+test("looksLikeQuotaExhausted: rejects empty / null / non-quota text", () => {
+ assert.equal(looksLikeQuotaExhausted(undefined), false);
+ assert.equal(looksLikeQuotaExhausted(null), false);
+ assert.equal(looksLikeQuotaExhausted(""), false);
+ assert.equal(looksLikeQuotaExhausted("rate limit, please retry in 60s"), false);
+ assert.equal(looksLikeQuotaExhausted("server error 500"), false);
+});
+
+test("ambiguous 'daily rate limit' messages classify as quota_exhausted (intentional)", () => {
+ // Codex audit LOW: messages combining 'daily' or 'monthly' with 'limit'
+ // match the quota regex even when paired with 'rate'. This is intentional
+ // because daily/monthly caps semantically warrant a long cooldown — even
+ // when the upstream calls them "rate limits". Locking it down here so a
+ // future regex tweak doesn't silently change the behavior.
+ assert.equal(classify429({ status: 429, body: "daily rate limit exceeded" }), "quota_exhausted");
+ assert.equal(
+ classify429({ status: 429, body: "monthly rate limit exceeded" }),
+ "quota_exhausted"
+ );
+});
+
+test("parseRetryAfter: integer seconds", () => {
+ assert.equal(parseRetryAfter("60"), 60);
+ assert.equal(parseRetryAfter("3600"), 3600);
+ assert.equal(parseRetryAfter("0"), 0);
+});
+
+test("parseRetryAfter: Groq-style relative units", () => {
+ // Regression for the parseInt-trap: parseInt("5m", 10) returns 5,
+ // which would be wrong (5s instead of 300s). The relative-unit
+ // pattern must be checked BEFORE plain integer parse.
+ assert.equal(parseRetryAfter("60s"), 60);
+ assert.equal(parseRetryAfter("5m"), 300);
+ assert.equal(parseRetryAfter("2h"), 7200);
+ assert.equal(parseRetryAfter("1H"), 3600);
+});
+
+test("parseRetryAfter: HTTP-date in the future", () => {
+ const future = new Date(Date.now() + 60_000).toUTCString();
+ const secs = parseRetryAfter(future);
+ assert.ok(secs !== null);
+ assert.ok(secs! >= 50 && secs! <= 65, `expected ~60, got ${secs}`);
+});
+
+test("parseRetryAfter: HTTP-date in the past clamps to 0", () => {
+ const past = new Date(Date.now() - 5 * 60_000).toUTCString();
+ assert.equal(parseRetryAfter(past), 0);
+});
+
+test("parseRetryAfter: unparseable returns null", () => {
+ assert.equal(parseRetryAfter(undefined), null);
+ assert.equal(parseRetryAfter(""), null);
+ assert.equal(parseRetryAfter(" "), null);
+ assert.equal(parseRetryAfter("not-a-date"), null);
+ assert.equal(parseRetryAfter("60xyz"), null);
+});
+
+test("retryAfterFromResponse: case-insensitive header lookup", () => {
+ assert.equal(retryAfterFromResponse({ headers: { "Retry-After": "30" } }), 30);
+ assert.equal(retryAfterFromResponse({ headers: { "retry-after": "45" } }), 45);
+ assert.equal(retryAfterFromResponse({ headers: { "RETRY-AFTER": "60s" } }), 60);
+ assert.equal(retryAfterFromResponse({ headers: {} }), null);
+ assert.equal(retryAfterFromResponse({}), null);
+});
diff --git a/tests/unit/cloudAgent-types.test.ts b/tests/unit/cloudAgent-types.test.ts
new file mode 100644
index 0000000000..f1d8dcb620
--- /dev/null
+++ b/tests/unit/cloudAgent-types.test.ts
@@ -0,0 +1,166 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { CLOUD_AGENT_STATUS, CloudAgentStatusSchema, CloudAgentTask } =
+ await import("../../src/lib/cloudAgent/types.ts");
+const { CreateCloudAgentTaskSchema, UpdateCloudAgentTaskSchema } =
+ await import("../../src/lib/cloudAgent/types.ts");
+const { isCloudAgentProvider, getAgent, getAvailableAgents } =
+ await import("../../src/lib/cloudAgent/registry.ts");
+
+test("CLOUD_AGENT_STATUS has correct values", () => {
+ assert.strictEqual(CLOUD_AGENT_STATUS.QUEUED, "queued");
+ assert.strictEqual(CLOUD_AGENT_STATUS.RUNNING, "running");
+ assert.strictEqual(CLOUD_AGENT_STATUS.AWAITING_APPROVAL, "awaiting_approval");
+ assert.strictEqual(CLOUD_AGENT_STATUS.COMPLETED, "completed");
+ assert.strictEqual(CLOUD_AGENT_STATUS.FAILED, "failed");
+ assert.strictEqual(CLOUD_AGENT_STATUS.CANCELLED, "cancelled");
+});
+
+test("CloudAgentStatusSchema validates valid statuses", () => {
+ const validStatuses = [
+ "queued",
+ "running",
+ "awaiting_approval",
+ "completed",
+ "failed",
+ "cancelled",
+ ];
+ for (const status of validStatuses) {
+ const result = CloudAgentStatusSchema.safeParse(status);
+ assert.strictEqual(result.success, true, `Status ${status} should be valid`);
+ }
+});
+
+test("CloudAgentStatusSchema rejects invalid status", () => {
+ const result = CloudAgentStatusSchema.safeParse("invalid");
+ assert.strictEqual(result.success, false);
+});
+
+test("CreateCloudAgentTaskSchema validates valid input", () => {
+ const validInput = {
+ providerId: "jules",
+ prompt: "Fix the bug in auth.ts",
+ source: {
+ repoName: "my-repo",
+ repoUrl: "https://github.com/user/my-repo",
+ branch: "main",
+ },
+ options: {
+ autoCreatePr: true,
+ planApprovalRequired: true,
+ },
+ };
+ const result = CreateCloudAgentTaskSchema.safeParse(validInput);
+ assert.strictEqual(result.success, true);
+});
+
+test("CreateCloudAgentTaskSchema rejects missing required fields", () => {
+ const invalidInput = {
+ providerId: "jules",
+ };
+ const result = CreateCloudAgentTaskSchema.safeParse(invalidInput);
+ assert.strictEqual(result.success, false);
+});
+
+test("CreateCloudAgentTaskSchema rejects invalid providerId", () => {
+ const invalidInput = {
+ providerId: "invalid-provider",
+ prompt: "Test",
+ source: {
+ repoName: "test",
+ repoUrl: "https://github.com/test/test",
+ },
+ };
+ const result = CreateCloudAgentTaskSchema.safeParse(invalidInput);
+ assert.strictEqual(result.success, false);
+});
+
+test("CreateCloudAgentTaskSchema rejects invalid repoUrl", () => {
+ const invalidInput = {
+ providerId: "jules",
+ prompt: "Test",
+ source: {
+ repoName: "test",
+ repoUrl: "not-a-url",
+ },
+ };
+ const result = CreateCloudAgentTaskSchema.safeParse(invalidInput);
+ assert.strictEqual(result.success, false);
+});
+
+test("UpdateCloudAgentTaskSchema validates approve action", () => {
+ const validInput = {
+ id: "123e4567-e89b-12d3-a456-426614174000",
+ action: "approve",
+ };
+ const result = UpdateCloudAgentTaskSchema.safeParse(validInput);
+ assert.strictEqual(result.success, true);
+});
+
+test("UpdateCloudAgentTaskSchema validates cancel action", () => {
+ const validInput = {
+ id: "123e4567-e89b-12d3-a456-426614174000",
+ action: "cancel",
+ };
+ const result = UpdateCloudAgentTaskSchema.safeParse(validInput);
+ assert.strictEqual(result.success, true);
+});
+
+test("UpdateCloudAgentTaskSchema validates message action with content", () => {
+ const validInput = {
+ id: "123e4567-e89b-12d3-a456-426614174000",
+ action: "message",
+ message: "Please continue with the next step",
+ };
+ const result = UpdateCloudAgentTaskSchema.safeParse(validInput);
+ assert.strictEqual(result.success, true);
+});
+
+test("UpdateCloudAgentTaskSchema allows message without content (optional)", () => {
+ const validInput = {
+ id: "123e4567-e89b-12d3-a456-426614174000",
+ action: "message",
+ };
+ const result = UpdateCloudAgentTaskSchema.safeParse(validInput);
+ assert.strictEqual(result.success, true);
+});
+
+test("getAvailableAgents returns all registered agents", () => {
+ const agents = getAvailableAgents();
+ assert.strictEqual(agents.includes("jules"), true);
+ assert.strictEqual(agents.includes("devin"), true);
+ assert.strictEqual(agents.includes("codex-cloud"), true);
+ assert.strictEqual(agents.length, 3);
+});
+
+test("getAgent returns correct agent for valid providerId", () => {
+ const jules = getAgent("jules");
+ assert.notStrictEqual(jules, null);
+ assert.strictEqual(jules?.providerId, "jules");
+
+ const devin = getAgent("devin");
+ assert.notStrictEqual(devin, null);
+ assert.strictEqual(devin?.providerId, "devin");
+
+ const codex = getAgent("codex-cloud");
+ assert.notStrictEqual(codex, null);
+ assert.strictEqual(codex?.providerId, "codex-cloud");
+});
+
+test("getAgent returns null for invalid providerId", () => {
+ const result = getAgent("invalid-provider");
+ assert.strictEqual(result, null);
+});
+
+test("isCloudAgentProvider returns true for valid providers", () => {
+ assert.strictEqual(isCloudAgentProvider("jules"), true);
+ assert.strictEqual(isCloudAgentProvider("devin"), true);
+ assert.strictEqual(isCloudAgentProvider("codex-cloud"), true);
+});
+
+test("isCloudAgentProvider returns false for invalid providers", () => {
+ assert.strictEqual(isCloudAgentProvider("openai"), false);
+ assert.strictEqual(isCloudAgentProvider("anthropic"), false);
+ assert.strictEqual(isCloudAgentProvider("invalid"), false);
+});
diff --git a/tests/unit/compression/rtk-code-stripper.test.ts b/tests/unit/compression/rtk-code-stripper.test.ts
index a191d31160..bba15c0264 100644
--- a/tests/unit/compression/rtk-code-stripper.test.ts
+++ b/tests/unit/compression/rtk-code-stripper.test.ts
@@ -23,7 +23,7 @@ describe("RTK code stripper", () => {
);
assert.ok(js.text.includes("// comment"));
- assert.match(js.text, /https:\/\/example\.com\/a\/\/b/);
+ assert.ok(js.text.includes("https://example.com/a//b"));
assert.ok(js.text.includes("/* block */"));
});
diff --git a/tests/unit/cursor-usage-fetcher.test.ts b/tests/unit/cursor-usage-fetcher.test.ts
new file mode 100644
index 0000000000..60cc78d63c
--- /dev/null
+++ b/tests/unit/cursor-usage-fetcher.test.ts
@@ -0,0 +1,238 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const usageService = await import("../../open-sse/services/usage.ts");
+
+const CURSOR_USAGE_URL = "https://cursor.com/api/dashboard/get-current-period-usage";
+
+function makeJwt(payload: Record): string {
+ const b64url = (input: string) =>
+ Buffer.from(input)
+ .toString("base64")
+ .replace(/=+$/, "")
+ .replace(/\+/g, "-")
+ .replace(/\//g, "_");
+ const header = b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+ const body = b64url(JSON.stringify(payload));
+ return `${header}.${body}.signature`;
+}
+
+const SAMPLE_RESPONSE = {
+ billingCycleStart: "1776672371000",
+ billingCycleEnd: "1779264371000",
+ planUsage: {
+ totalSpend: 1529,
+ includedSpend: 1529,
+ remaining: 471,
+ limit: 2000,
+ autoPercentUsed: 13.20952380952381,
+ apiPercentUsed: 3.155555555555556,
+ totalPercentUsed: 10.193333333333333,
+ },
+ spendLimitUsage: { limitType: "user" },
+ enabled: true,
+};
+
+interface CapturedRequest {
+ url: string;
+ init: RequestInit;
+}
+
+function installFetchMock(
+ responder: (url: string, init: RequestInit) => Response | Promise
+): { restore: () => void; calls: CapturedRequest[] } {
+ const calls: CapturedRequest[] = [];
+ const original = globalThis.fetch;
+ globalThis.fetch = (async (input: any, init: RequestInit = {}) => {
+ const url = typeof input === "string" ? input : (input as Request).url;
+ calls.push({ url, init });
+ return await responder(url, init);
+ }) as typeof fetch;
+ return {
+ restore: () => {
+ globalThis.fetch = original;
+ },
+ calls,
+ };
+}
+
+test("cursor usage: happy path returns three windows with correct percentages and reset", async () => {
+ const userId = "user_01TESTSTOREDID";
+ const accessToken = makeJwt({ sub: `google-oauth2|${userId}` });
+
+ const mock = installFetchMock(
+ async () =>
+ new Response(JSON.stringify(SAMPLE_RESPONSE), {
+ status: 200,
+ headers: { "content-type": "application/json" },
+ })
+ );
+
+ try {
+ const usage = await usageService.getUsageForProvider({
+ provider: "cursor",
+ accessToken,
+ providerSpecificData: { userId },
+ });
+
+ assert.equal(usage.plan, "Cursor Pro");
+ assert.deepEqual(Object.keys(usage.quotas), ["Total", "Auto + Composer", "API"]);
+
+ const total = usage.quotas.Total;
+ assert.equal(total.total, 20); // limit 2000 cents = $20
+ assert.equal(total.used, 15.29); // totalSpend 1529 cents = $15.29
+ assert.equal(total.remaining, 4.71);
+ assert.ok(Math.abs(total.remainingPercentage - (100 - 10.193333333333333)) < 1e-6);
+ assert.equal(total.unlimited, false);
+ assert.equal(total.resetAt, new Date(Number("1779264371000")).toISOString());
+
+ const auto = usage.quotas["Auto + Composer"];
+ assert.equal(auto.total, 20);
+ // 2000 cents * 13.2095% ≈ 264 cents = $2.64
+ assert.equal(auto.used, 2.64);
+ assert.ok(Math.abs(auto.remainingPercentage - (100 - 13.20952380952381)) < 1e-6);
+
+ const api = usage.quotas.API;
+ assert.equal(api.total, 20);
+ // 2000 cents * 3.1556% ≈ 63 cents = $0.63
+ assert.equal(api.used, 0.63);
+ assert.ok(Math.abs(api.remainingPercentage - (100 - 3.155555555555556)) < 1e-6);
+ } finally {
+ mock.restore();
+ }
+});
+
+test("cursor usage: sends correct cookie, origin, body, and method", async () => {
+ const userId = "user_01HEADERCHECK";
+ const accessToken = makeJwt({ sub: userId });
+
+ const mock = installFetchMock(
+ async () =>
+ new Response(JSON.stringify(SAMPLE_RESPONSE), {
+ status: 200,
+ headers: { "content-type": "application/json" },
+ })
+ );
+
+ try {
+ await usageService.getUsageForProvider({
+ provider: "cursor",
+ accessToken,
+ providerSpecificData: { userId },
+ });
+
+ assert.equal(mock.calls.length, 1);
+ const { url, init } = mock.calls[0];
+ assert.equal(url, CURSOR_USAGE_URL);
+ assert.equal(init.method, "POST");
+ assert.equal(init.body, "{}");
+
+ const headers = init.headers as Record;
+ assert.equal(headers.Cookie, `WorkosCursorSessionToken=${userId}::${accessToken}`);
+ assert.equal(headers.Origin, "https://cursor.com");
+ assert.match(headers.Referer, /^https:\/\/cursor\.com\/dashboard/);
+ assert.equal(headers["Content-Type"], "application/json");
+ assert.ok(headers["User-Agent"]);
+ } finally {
+ mock.restore();
+ }
+});
+
+test("cursor usage: falls back to JWT sub when providerSpecificData.userId is missing", async () => {
+ const userId = "user_01JWTFALLBACK";
+ const accessToken = makeJwt({ sub: `google-oauth2|${userId}` });
+
+ const mock = installFetchMock(
+ async () =>
+ new Response(JSON.stringify(SAMPLE_RESPONSE), {
+ status: 200,
+ headers: { "content-type": "application/json" },
+ })
+ );
+
+ try {
+ const usage = await usageService.getUsageForProvider({
+ provider: "cursor",
+ accessToken,
+ providerSpecificData: {},
+ });
+
+ assert.equal(usage.plan, "Cursor Pro");
+ assert.equal(mock.calls.length, 1);
+ const headers = mock.calls[0].init.headers as Record;
+ // Cookie should use the full sub claim (google-oauth2|user_...) since Cursor accepts both forms.
+ assert.equal(
+ headers.Cookie,
+ `WorkosCursorSessionToken=google-oauth2|${userId}::${accessToken}`
+ );
+ } finally {
+ mock.restore();
+ }
+});
+
+test("cursor usage: returns message and skips fetch when userId is unrecoverable", async () => {
+ const mock = installFetchMock(async () => new Response("should not be called", { status: 500 }));
+
+ try {
+ const usage = await usageService.getUsageForProvider({
+ provider: "cursor",
+ accessToken: "not-a-jwt-and-too-short",
+ providerSpecificData: {},
+ });
+
+ assert.equal(mock.calls.length, 0);
+ assert.match(usage.message, /missing user id/i);
+ assert.equal(usage.quotas, undefined);
+ } finally {
+ mock.restore();
+ }
+});
+
+test("cursor usage: 307 redirect surfaces as expired session message", async () => {
+ const accessToken = makeJwt({ sub: "user_01EXPIRED" });
+ const mock = installFetchMock(
+ async () =>
+ new Response("", {
+ status: 307,
+ headers: { Location: "https://api.workos.com/user_management/authorize?..." },
+ })
+ );
+
+ try {
+ const usage = await usageService.getUsageForProvider({
+ provider: "cursor",
+ accessToken,
+ providerSpecificData: { userId: "user_01EXPIRED" },
+ });
+
+ assert.equal(usage.plan, "Cursor");
+ assert.match(usage.message, /session expired|Re-import/i);
+ assert.equal(usage.quotas, undefined);
+ } finally {
+ mock.restore();
+ }
+});
+
+test("cursor usage: empty planUsage returns informational message", async () => {
+ const accessToken = makeJwt({ sub: "user_01EMPTY" });
+ const mock = installFetchMock(
+ async () =>
+ new Response(
+ JSON.stringify({ billingCycleStart: "0", billingCycleEnd: "0", planUsage: {} }),
+ { status: 200, headers: { "content-type": "application/json" } }
+ )
+ );
+
+ try {
+ const usage = await usageService.getUsageForProvider({
+ provider: "cursor",
+ accessToken,
+ providerSpecificData: { userId: "user_01EMPTY" },
+ });
+
+ assert.equal(usage.plan, "Cursor");
+ assert.match(usage.message, /No active plan usage/i);
+ } finally {
+ mock.restore();
+ }
+});
diff --git a/tests/unit/db-migration-runner.test.ts b/tests/unit/db-migration-runner.test.ts
index a0595ad532..519fcebf74 100644
--- a/tests/unit/db-migration-runner.test.ts
+++ b/tests/unit/db-migration-runner.test.ts
@@ -857,6 +857,141 @@ test(
}
);
+test(
+ "runMigrations ignores superseded 041 session affinity duplicate when 050 exists",
+ serial,
+ async () => {
+ const runner = await importFresh("src/lib/db/migrationRunner.ts");
+ const db = createDb();
+
+ try {
+ const count = withMockedMigrationFs(
+ {
+ "038_compression_analytics.sql": `
+ CREATE TABLE compression_analytics (
+ id TEXT PRIMARY KEY,
+ request_id TEXT
+ );
+ `,
+ "041_compression_receipts.sql": "-- handled by migrationRunner",
+ "041_session_account_affinity.sql": `
+ CREATE TABLE duplicate_041_session_account_affinity (id TEXT PRIMARY KEY);
+ `,
+ "050_session_account_affinity.sql": `
+ CREATE TABLE IF NOT EXISTS session_account_affinity (
+ session_key TEXT NOT NULL,
+ provider TEXT NOT NULL,
+ connection_id TEXT NOT NULL,
+ created_at INTEGER NOT NULL,
+ last_seen_at INTEGER NOT NULL,
+ PRIMARY KEY (session_key, provider)
+ );
+ `,
+ },
+ () => runner.runMigrations(db)
+ );
+
+ assert.equal(count, 3);
+ assert.equal(
+ db.prepare("SELECT name FROM _omniroute_migrations WHERE version = ?").get("041")?.name,
+ "compression_receipts"
+ );
+ assert.equal(
+ db.prepare("SELECT name FROM _omniroute_migrations WHERE version = ?").get("050")?.name,
+ "session_account_affinity"
+ );
+ assert.deepEqual(
+ db
+ .prepare(
+ "SELECT name FROM sqlite_master WHERE type = 'table' AND name IN (?, ?) ORDER BY name"
+ )
+ .all("duplicate_041_session_account_affinity", "session_account_affinity"),
+ [{ name: "session_account_affinity" }]
+ );
+ } finally {
+ db.close();
+ }
+ }
+);
+
+test(
+ "reconcileRenumberedMigrations moves legacy 041 session affinity marker to 050",
+ serial,
+ async () => {
+ const runner = await importFresh("src/lib/db/migrationRunner.ts");
+ const db = createDb();
+
+ try {
+ db.exec(`
+ CREATE TABLE _omniroute_migrations (
+ version TEXT PRIMARY KEY,
+ name TEXT NOT NULL,
+ applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+ );
+ CREATE TABLE compression_analytics (
+ id TEXT PRIMARY KEY,
+ request_id TEXT
+ );
+ `);
+ db.prepare("INSERT INTO _omniroute_migrations (version, name) VALUES (?, ?)").run(
+ "041",
+ "session_account_affinity"
+ );
+
+ const consoleErrors: string[] = [];
+ const originalError = console.error;
+ console.error = (...args: any[]) => {
+ consoleErrors.push(args.map(String).join(" "));
+ };
+
+ try {
+ const count = withMockedMigrationFs(
+ {
+ "041_compression_receipts.sql": "-- handled by migrationRunner",
+ "041_session_account_affinity.sql": `
+ CREATE TABLE duplicate_041_session_account_affinity (id TEXT PRIMARY KEY);
+ `,
+ "050_session_account_affinity.sql": `
+ CREATE TABLE IF NOT EXISTS session_account_affinity (
+ session_key TEXT NOT NULL,
+ provider TEXT NOT NULL,
+ connection_id TEXT NOT NULL,
+ created_at INTEGER NOT NULL,
+ last_seen_at INTEGER NOT NULL,
+ PRIMARY KEY (session_key, provider)
+ );
+ `,
+ },
+ () => runner.runMigrations(db)
+ );
+
+ assert.equal(count, 1);
+ assert.equal(
+ db.prepare("SELECT name FROM _omniroute_migrations WHERE version = ?").get("041")?.name,
+ "compression_receipts"
+ );
+ assert.equal(
+ db.prepare("SELECT name FROM _omniroute_migrations WHERE version = ?").get("050")?.name,
+ "session_account_affinity"
+ );
+
+ const renumberingWarnings = consoleErrors.filter(
+ (e) => e.includes("CRITICAL") && e.includes("renumbered")
+ );
+ assert.equal(
+ renumberingWarnings.length,
+ 0,
+ `Expected no renumbering warnings, got: ${renumberingWarnings.join("; ")}`
+ );
+ } finally {
+ console.error = originalError;
+ }
+ } finally {
+ db.close();
+ }
+ }
+);
+
test(
"full upgrade simulation: all 3 renumbered migrations reconciled without CRITICAL warnings",
serial,
diff --git a/tests/unit/fix-2130-system-passthrough.test.ts b/tests/unit/fix-2130-system-passthrough.test.ts
new file mode 100644
index 0000000000..f45fe072f8
--- /dev/null
+++ b/tests/unit/fix-2130-system-passthrough.test.ts
@@ -0,0 +1,103 @@
+/**
+ * Regression test for #2130: system prompt missing for Claude Code OAuth on Linux.
+ *
+ * Claude Code sends requests to /v1/chat/completions with `body.system` as a
+ * native Anthropic array (not as role="system" messages). The openai→claude
+ * translator must preserve body.system when no role="system" messages exist.
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { openaiToClaudeRequest } from "../../open-sse/translator/request/openai-to-claude.ts";
+
+describe("#2130: body.system passthrough in openai→claude translator", () => {
+ it("preserves body.system array when no role=system messages exist", () => {
+ const body = {
+ model: "claude-opus-4-7",
+ max_tokens: 2048,
+ stream: false,
+ messages: [
+ {
+ role: "user",
+ content: [{ type: "text", text: "hi" }],
+ },
+ ],
+ system: [
+ {
+ type: "text",
+ text: "You are Claude Code, Anthropic's official CLI for Claude.",
+ },
+ ],
+ };
+
+ const result = openaiToClaudeRequest("claude-opus-4-7", body, false);
+
+ assert.ok(result.system, "result.system must be defined");
+ assert.ok(Array.isArray(result.system), "result.system must be an array");
+ assert.ok(
+ result.system.some((b) => b.text && b.text.includes("You are Claude Code")),
+ "result.system must contain the Claude Code system prompt"
+ );
+ });
+
+ it("preserves body.system string when no role=system messages exist", () => {
+ const body = {
+ model: "claude-sonnet-4-6",
+ max_tokens: 4096,
+ messages: [{ role: "user", content: "hello" }],
+ system: "You are a helpful assistant.",
+ };
+
+ const result = openaiToClaudeRequest("claude-sonnet-4-6", body, true);
+
+ assert.ok(result.system, "result.system must be defined");
+ assert.ok(Array.isArray(result.system), "result.system must be an array");
+ assert.equal(result.system[0].text, "You are a helpful assistant.");
+ });
+
+ it("merges body.system with role=system messages", () => {
+ const body = {
+ model: "claude-opus-4-7",
+ max_tokens: 2048,
+ messages: [
+ { role: "system", content: "Be concise." },
+ { role: "user", content: "hi" },
+ ],
+ system: [
+ {
+ type: "text",
+ text: "You are Claude Code, Anthropic's official CLI for Claude.",
+ },
+ ],
+ };
+
+ const result = openaiToClaudeRequest("claude-opus-4-7", body, false);
+
+ assert.ok(result.system, "result.system must be defined");
+ assert.ok(Array.isArray(result.system), "result.system must be an array");
+ // Should have the original body.system + the extracted role=system text
+ assert.ok(
+ result.system.some((b) => b.text && b.text.includes("You are Claude Code")),
+ "must contain the body.system content"
+ );
+ assert.ok(
+ result.system.some((b) => b.text && b.text.includes("Be concise")),
+ "must contain the role=system message content"
+ );
+ });
+
+ it("works correctly when neither body.system nor role=system messages exist", () => {
+ const body = {
+ model: "claude-sonnet-4-6",
+ max_tokens: 2048,
+ messages: [{ role: "user", content: "hello" }],
+ };
+
+ const result = openaiToClaudeRequest("claude-sonnet-4-6", body, true);
+
+ assert.equal(
+ result.system,
+ undefined,
+ "result.system should be undefined when no system input exists"
+ );
+ });
+});
diff --git a/tests/unit/management-auth-hardening.test.ts b/tests/unit/management-auth-hardening.test.ts
index 2b14e81a3e..dd9540b3a5 100644
--- a/tests/unit/management-auth-hardening.test.ts
+++ b/tests/unit/management-auth-hardening.test.ts
@@ -43,3 +43,76 @@ test("compression analytics route requires management authentication before retu
content.indexOf("getCompressionAnalyticsSummary(")
);
});
+
+test("administrative pricing and routing routes require management authentication", () => {
+ const routePaths = [
+ "src/app/api/pricing/route.ts",
+ "src/app/api/pricing/sync/route.ts",
+ "src/app/api/model-combo-mappings/route.ts",
+ "src/app/api/model-combo-mappings/[id]/route.ts",
+ ];
+
+ for (const routePath of routePaths) {
+ const content = fs.readFileSync(routePath, "utf8");
+ assert.ok(content.includes('from "@/lib/api/requireManagementAuth"'), routePath);
+ assert.ok(
+ content.includes("const authError = await requireManagementAuth(request);"),
+ routePath
+ );
+ assert.ok(content.includes("if (authError) return authError;"), routePath);
+ }
+});
+
+test("memory management routes require management authentication", () => {
+ const routePaths = ["src/app/api/memory/route.ts", "src/app/api/memory/[id]/route.ts"];
+
+ for (const routePath of routePaths) {
+ const content = fs.readFileSync(routePath, "utf8");
+ assert.ok(content.includes('from "@/lib/api/requireManagementAuth"'), routePath);
+ assert.ok(
+ content.includes("const authError = await requireManagementAuth(request);"),
+ routePath
+ );
+ assert.ok(content.includes("if (authError) return authError;"), routePath);
+ }
+});
+
+test("provider validation routes require management authentication before reading credentials", () => {
+ const routePaths = [
+ "src/app/api/provider-nodes/validate/route.ts",
+ "src/app/api/providers/validate/route.ts",
+ ];
+
+ for (const routePath of routePaths) {
+ const content = fs.readFileSync(routePath, "utf8");
+ assert.ok(content.includes('from "@/lib/api/requireManagementAuth"'), routePath);
+ assert.ok(
+ content.includes("const authError = await requireManagementAuth(request);"),
+ routePath
+ );
+ assert.ok(content.includes("if (authError) return authError;"), routePath);
+ assert.ok(
+ content.indexOf("requireManagementAuth(request)") < content.indexOf("request.json()"),
+ `${routePath} should authenticate before parsing submitted provider credentials`
+ );
+ }
+});
+
+test("usage analytics and request log routes require management authentication", () => {
+ const routePaths = [
+ "src/app/api/usage/analytics/route.ts",
+ "src/app/api/usage/history/route.ts",
+ "src/app/api/usage/request-logs/route.ts",
+ "src/app/api/usage/logs/route.ts",
+ ];
+
+ for (const routePath of routePaths) {
+ const content = fs.readFileSync(routePath, "utf8");
+ assert.ok(content.includes('from "@/lib/api/requireManagementAuth"'), routePath);
+ assert.ok(
+ content.includes("const authError = await requireManagementAuth(request);"),
+ routePath
+ );
+ assert.ok(content.includes("if (authError) return authError;"), routePath);
+ }
+});
diff --git a/tests/unit/pack-artifact-policy.test.ts b/tests/unit/pack-artifact-policy.test.ts
index e47925474f..21f09440f1 100644
--- a/tests/unit/pack-artifact-policy.test.ts
+++ b/tests/unit/pack-artifact-policy.test.ts
@@ -73,6 +73,8 @@ test("findMissingArtifactPaths flags missing root runtime files in the tarball",
"app/open-sse/services/compression/rules/en/filler.json",
"app/responses-ws-proxy.mjs",
"app/server-ws.mjs",
+ "bin/cli-commands.mjs",
+ "bin/cli/index.mjs",
"bin/mcp-server.mjs",
"bin/nodeRuntimeSupport.mjs",
"scripts/native-binary-compat.mjs",
diff --git a/tests/unit/provider-header-profiles.test.ts b/tests/unit/provider-header-profiles.test.ts
index df7e79b340..46e2f0a0da 100644
--- a/tests/unit/provider-header-profiles.test.ts
+++ b/tests/unit/provider-header-profiles.test.ts
@@ -2,7 +2,6 @@ import test from "node:test";
import assert from "node:assert/strict";
import {
- CURSOR_REGISTRY_VERSION,
GITHUB_COPILOT_API_VERSION,
GITHUB_COPILOT_CHAT_PLUGIN_VERSION,
GITHUB_COPILOT_CHAT_USER_AGENT,
@@ -12,7 +11,6 @@ import {
KIRO_AMZ_USER_AGENT,
KIRO_SDK_USER_AGENT,
QWEN_CLI_VERSION,
- getCursorUsageHeaders,
getQwenCliUserAgent,
getGitHubCopilotChatHeaders,
getGitHubCopilotInternalUserHeaders,
@@ -39,7 +37,7 @@ test("provider header profiles expose current GitHub chat and internal headers",
assert.equal(internalHeaders["X-GitHub-Api-Version"], GITHUB_COPILOT_API_VERSION);
});
-test("provider header profiles expose dedicated refresh, qwen, qoder, kiro and cursor variants", () => {
+test("provider header profiles expose dedicated refresh, qwen, qoder and kiro variants", () => {
const refreshHeaders = getGitHubCopilotRefreshHeaders("token gh-access");
assert.equal(refreshHeaders.Authorization, "token gh-access");
assert.equal(refreshHeaders["User-Agent"], GITHUB_COPILOT_REFRESH_USER_AGENT);
@@ -65,12 +63,6 @@ test("provider header profiles expose dedicated refresh, qwen, qoder, kiro and c
assert.equal(kiroHeaders.Accept, "application/json");
assert.equal(kiroHeaders["User-Agent"], KIRO_SDK_USER_AGENT);
assert.equal(kiroHeaders["X-Amz-User-Agent"], KIRO_AMZ_USER_AGENT);
-
- const cursorHeaders = getCursorUsageHeaders("cursor-token");
- assert.equal(cursorHeaders.Authorization, "Bearer cursor-token");
- assert.equal(cursorHeaders["User-Agent"], `Cursor/${CURSOR_REGISTRY_VERSION}`);
- assert.equal(cursorHeaders["x-cursor-user-agent"], `Cursor/${CURSOR_REGISTRY_VERSION}`);
- assert.equal(cursorHeaders["x-cursor-client-version"], CURSOR_REGISTRY_VERSION);
});
test("provider header profiles tolerate browser-like process shims", async () => {
diff --git a/tests/unit/provider-hints.test.ts b/tests/unit/provider-hints.test.ts
new file mode 100644
index 0000000000..ddbf966753
--- /dev/null
+++ b/tests/unit/provider-hints.test.ts
@@ -0,0 +1,58 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+ defaultUseUpstream429BreakerHints,
+ resolveUseUpstream429BreakerHints,
+} from "../../src/shared/utils/providerHints.ts";
+
+test("defaultUseUpstream429BreakerHints: direct cloud providers default true", () => {
+ for (const id of ["openai", "anthropic", "groq", "cerebras", "mistral", "google"]) {
+ assert.equal(defaultUseUpstream429BreakerHints(id), true, `expected true for ${id}`);
+ }
+});
+
+test("defaultUseUpstream429BreakerHints: cliproxyapi defaults false", () => {
+ assert.equal(defaultUseUpstream429BreakerHints("cliproxyapi"), false);
+});
+
+test("defaultUseUpstream429BreakerHints: self-hosted chat providers default false", () => {
+ for (const id of [
+ "lm-studio",
+ "vllm",
+ "lemonade",
+ "llamafile",
+ "triton",
+ "xinference",
+ "oobabooga",
+ ]) {
+ assert.equal(defaultUseUpstream429BreakerHints(id), false, `expected false for ${id}`);
+ }
+});
+
+test("defaultUseUpstream429BreakerHints: claude-code-* prefix defaults false", () => {
+ for (const id of [
+ "anthropic-compatible-cc-direct",
+ "anthropic-compatible-cc-bedrock",
+ "anthropic-compatible-cc-vertex",
+ ]) {
+ assert.equal(defaultUseUpstream429BreakerHints(id), false, `expected false for ${id}`);
+ }
+});
+
+test("resolveUseUpstream429BreakerHints: user override wins (both directions)", () => {
+ // Cloud provider with user override OFF → false
+ assert.equal(resolveUseUpstream429BreakerHints("openai", false), false);
+ // Cloud provider with user override ON → true (no-op vs default)
+ assert.equal(resolveUseUpstream429BreakerHints("openai", true), true);
+ // Proxy provider with user override ON → true (user explicitly trusted it)
+ assert.equal(resolveUseUpstream429BreakerHints("cliproxyapi", true), true);
+ // Proxy provider with user override OFF → false (no-op vs default)
+ assert.equal(resolveUseUpstream429BreakerHints("cliproxyapi", false), false);
+});
+
+test("resolveUseUpstream429BreakerHints: undefined falls back to per-provider default", () => {
+ // Critical: this is the v3 regression-test for the v1 default-vs-gate bug.
+ assert.equal(resolveUseUpstream429BreakerHints("openai", undefined), true);
+ assert.equal(resolveUseUpstream429BreakerHints("cliproxyapi", undefined), false);
+ assert.equal(resolveUseUpstream429BreakerHints("lm-studio", undefined), false);
+});
diff --git a/tests/unit/resilience-settings-upstream429-breaker.test.ts b/tests/unit/resilience-settings-upstream429-breaker.test.ts
new file mode 100644
index 0000000000..b22a2d95c9
--- /dev/null
+++ b/tests/unit/resilience-settings-upstream429-breaker.test.ts
@@ -0,0 +1,96 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+ DEFAULT_RESILIENCE_SETTINGS,
+ mergeResilienceSettings,
+ resolveResilienceSettings,
+ type ResilienceSettings,
+} from "../../src/lib/resilience/settings.ts";
+
+function cloneDefaults(): ResilienceSettings {
+ // structuredClone is enough for the plain-object settings shape.
+ return structuredClone(DEFAULT_RESILIENCE_SETTINGS);
+}
+
+test("defaults: useUpstream429BreakerHints omitted (undefined) on both profiles", () => {
+ const settings = cloneDefaults();
+ assert.equal(settings.connectionCooldown.oauth.useUpstream429BreakerHints, undefined);
+ assert.equal(settings.connectionCooldown.apikey.useUpstream429BreakerHints, undefined);
+});
+
+test("mergeResilienceSettings: explicit true is stored", () => {
+ const current = cloneDefaults();
+ const next = mergeResilienceSettings(current, {
+ connectionCooldown: { oauth: { useUpstream429BreakerHints: true } },
+ });
+ assert.equal(next.connectionCooldown.oauth.useUpstream429BreakerHints, true);
+ // apikey unchanged
+ assert.equal(next.connectionCooldown.apikey.useUpstream429BreakerHints, undefined);
+});
+
+test("mergeResilienceSettings: explicit false is stored", () => {
+ const current = cloneDefaults();
+ const next = mergeResilienceSettings(current, {
+ connectionCooldown: { apikey: { useUpstream429BreakerHints: false } },
+ });
+ assert.equal(next.connectionCooldown.apikey.useUpstream429BreakerHints, false);
+});
+
+test("mergeResilienceSettings: null sentinel deletes the field (back to undefined)", () => {
+ // Start with explicit false on oauth
+ const start = mergeResilienceSettings(cloneDefaults(), {
+ connectionCooldown: { oauth: { useUpstream429BreakerHints: false } },
+ });
+ assert.equal(start.connectionCooldown.oauth.useUpstream429BreakerHints, false);
+ // PATCH with null should reset to undefined
+ const next = mergeResilienceSettings(start, {
+ connectionCooldown: {
+ oauth: { useUpstream429BreakerHints: null as unknown as boolean },
+ },
+ });
+ assert.equal(next.connectionCooldown.oauth.useUpstream429BreakerHints, undefined);
+ // Key should not appear in JSON
+ const serialized = JSON.parse(JSON.stringify(next.connectionCooldown.oauth));
+ assert.equal(
+ "useUpstream429BreakerHints" in serialized,
+ false,
+ "key should be absent in serialized JSON"
+ );
+});
+
+test("mergeResilienceSettings: omitted key (partial-merge) leaves existing value", () => {
+ // Start with explicit true on apikey
+ const start = mergeResilienceSettings(cloneDefaults(), {
+ connectionCooldown: { apikey: { useUpstream429BreakerHints: true } },
+ });
+ // PATCH oauth only — apikey must keep its value
+ const next = mergeResilienceSettings(start, {
+ connectionCooldown: { oauth: { baseCooldownMs: 5000 } },
+ });
+ assert.equal(next.connectionCooldown.apikey.useUpstream429BreakerHints, true);
+});
+
+test("resolveResilienceSettings: omitted field in record stays undefined (no toBoolean coercion)", () => {
+ const record = {
+ connectionCooldown: {
+ oauth: { baseCooldownMs: 1000, useUpstreamRetryHints: true, maxBackoffSteps: 5 },
+ apikey: { baseCooldownMs: 2000, useUpstreamRetryHints: false, maxBackoffSteps: 3 },
+ },
+ };
+ const resolved = resolveResilienceSettings(
+ record as Parameters[0]
+ );
+ assert.equal(resolved.connectionCooldown.oauth.useUpstream429BreakerHints, undefined);
+ assert.equal(resolved.connectionCooldown.apikey.useUpstream429BreakerHints, undefined);
+});
+
+test("mixed-provider round-trip: oauth=false + apikey=true survives merge", () => {
+ const next = mergeResilienceSettings(cloneDefaults(), {
+ connectionCooldown: {
+ oauth: { useUpstream429BreakerHints: false },
+ apikey: { useUpstream429BreakerHints: true },
+ },
+ });
+ assert.equal(next.connectionCooldown.oauth.useUpstream429BreakerHints, false);
+ assert.equal(next.connectionCooldown.apikey.useUpstream429BreakerHints, true);
+});
diff --git a/tests/unit/runtime-timeouts.test.ts b/tests/unit/runtime-timeouts.test.ts
index 3ac71b5de6..2a588a63b6 100644
--- a/tests/unit/runtime-timeouts.test.ts
+++ b/tests/unit/runtime-timeouts.test.ts
@@ -94,3 +94,10 @@ test("API bridge timeouts align request timeout with long proxy timeout by defau
serverSocketTimeoutMs: 0,
});
});
+
+test("API bridge proxy timeout defaults to the long upstream request window", () => {
+ const config = runtimeTimeouts.getApiBridgeTimeoutConfig({});
+
+ assert.equal(config.proxyTimeoutMs, 600000);
+ assert.equal(config.serverRequestTimeoutMs, 600000);
+});
diff --git a/tests/unit/shared/components/AutoRoutingBanner.test.tsx b/tests/unit/shared/components/AutoRoutingBanner.test.tsx
new file mode 100644
index 0000000000..d7a8153812
--- /dev/null
+++ b/tests/unit/shared/components/AutoRoutingBanner.test.tsx
@@ -0,0 +1,96 @@
+// @vitest-environment jsdom
+import React from "react";
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+const cleanupCallbacks: Array<() => void> = [];
+
+function makeContainer(): HTMLElement {
+ const container = document.createElement("div");
+ document.body.appendChild(container);
+ cleanupCallbacks.push(() => {
+ container.remove();
+ });
+ return container;
+}
+
+describe("AutoRoutingBanner", () => {
+ beforeEach(() => {
+ (
+ globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
+ ).IS_REACT_ACT_ENVIRONMENT = true;
+ localStorage.clear();
+ });
+
+ afterEach(() => {
+ while (cleanupCallbacks.length > 0) {
+ cleanupCallbacks.pop()?.();
+ }
+ document.body.innerHTML = "";
+ localStorage.clear();
+ });
+
+ it("renders banner on first mount", async () => {
+ const { default: AutoRoutingBanner } = await import("@/shared/components/AutoRoutingBanner");
+ const container = makeContainer();
+ const root = createRoot(container);
+ await act(async () => {
+ root.render();
+ });
+ expect(container.querySelector('[role="banner"]')).toBeTruthy();
+ expect(container.textContent).toContain("Auto-Routing Active");
+ });
+
+ it("includes link to Combos page", async () => {
+ const { default: AutoRoutingBanner } = await import("@/shared/components/AutoRoutingBanner");
+ const container = makeContainer();
+ const root = createRoot(container);
+ await act(async () => {
+ root.render();
+ });
+ const link = container.querySelector('a[href="/dashboard/combos"]');
+ expect(link).toBeTruthy();
+ });
+
+ it("can be dismissed by clicking close button", async () => {
+ const { default: AutoRoutingBanner } = await import("@/shared/components/AutoRoutingBanner");
+ const container = makeContainer();
+ const root = createRoot(container);
+ await act(async () => {
+ root.render();
+ });
+ expect(container.querySelector('[role="banner"]')).toBeTruthy();
+ const closeButton = container.querySelector('button[aria-label="Dismiss auto-routing banner"]');
+ expect(closeButton).toBeTruthy();
+ await act(async () => {
+ closeButton?.click();
+ });
+ expect(container.querySelector('[role="banner"]')).toBeFalsy();
+ });
+
+ it("persists dismissal to localStorage", async () => {
+ const { default: AutoRoutingBanner } = await import("@/shared/components/AutoRoutingBanner");
+ const container = makeContainer();
+ const root = createRoot(container);
+ await act(async () => {
+ root.render();
+ });
+ const closeButton = container.querySelector('button[aria-label="Dismiss auto-routing banner"]');
+ await act(async () => {
+ closeButton?.click();
+ });
+ expect(localStorage.getItem("auto-routing-banner-dismissed")).toBe("true");
+ });
+
+ it("remains hidden after dismissal on remount", async () => {
+ localStorage.setItem("auto-routing-banner-dismissed", "true");
+ const { default: AutoRoutingBanner } = await import("@/shared/components/AutoRoutingBanner");
+ const container = makeContainer();
+ const root = createRoot(container);
+ await act(async () => {
+ root.render();
+ });
+ expect(container.querySelector('[role="banner"]')).toBeFalsy();
+ });
+});
diff --git a/tests/unit/sse-auth.test.ts b/tests/unit/sse-auth.test.ts
index 7ac60df468..23f3f5419d 100644
--- a/tests/unit/sse-auth.test.ts
+++ b/tests/unit/sse-auth.test.ts
@@ -14,7 +14,6 @@ const settingsDb = await import("../../src/lib/db/settings.ts");
const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
const auth = await import("../../src/sse/services/auth.ts");
const quotaCache = await import("../../src/domain/quotaCache.ts");
-const { COOLDOWN_MS } = await import("../../open-sse/config/constants.ts");
async function resetStorage() {
core.resetDbInstance();
@@ -45,7 +44,6 @@ async function seedConnection(provider: string, overrides: any = {}) {
lastErrorSource: overrides.lastErrorSource,
errorCode: overrides.errorCode,
backoffLevel: overrides.backoffLevel,
- maxConcurrent: overrides.maxConcurrent,
providerSpecificData: overrides.providerSpecificData || {},
lastUsedAt: overrides.lastUsedAt,
consecutiveUseCount: overrides.consecutiveUseCount,
@@ -135,7 +133,7 @@ test("getProviderCredentials enforces generic quota policy unless explicitly byp
},
});
const resetAt = futureIso();
- quotaCache.setQuotaCache((connection as any).id, "openai", {
+ quotaCache.setQuotaCache(connection.id, "openai", {
daily: { remainingPercentage: 10, resetAt },
});
@@ -179,38 +177,6 @@ test("getProviderCredentialsWithQuotaPreflight skips exhausted preflight account
assert.equal((selected as any).connectionId, healthy.id);
});
-test("getProviderCredentials includes per-account maxConcurrent caps", async () => {
- const connection = await seedConnection("openai", {
- name: "openai-concurrency-cap",
- maxConcurrent: 2,
- });
-
- const selected = await auth.getProviderCredentials("openai");
-
- assert.equal(selected.connectionId, connection.id);
- assert.equal(selected.maxConcurrent, 2);
-});
-
-test("getProviderCredentials skips connections that exclude the requested model and selects the next eligible account", async () => {
- const excluded = await seedConnection("openai", {
- name: "excluded-first",
- priority: 1,
- providerSpecificData: {
- excludedModels: ["gpt-4o*"],
- },
- });
- const allowed = await seedConnection("openai", {
- name: "allowed-second",
- priority: 2,
- apiKey: "sk-allowed",
- });
-
- const selected = await auth.getProviderCredentials("openai", null, null, "gpt-4o-mini");
-
- assert.equal(selected.connectionId, allowed.id);
- assert.notEqual(selected.connectionId, excluded.id);
-});
-
test("getProviderCredentialsWithQuotaPreflight returns allRateLimited when a forced connection is blocked by preflight", async () => {
const blocked = await seedConnection("openai", {
name: "quota-preflight-forced",
@@ -237,6 +203,62 @@ test("getProviderCredentialsWithQuotaPreflight returns allRateLimited when a for
assert.match(selected.lastError, /quota preflight/i);
});
+test("getProviderCredentials keeps separate codex affinity per session", async () => {
+ await settingsDb.updateSettings({ fallbackStrategy: "round-robin", stickyRoundRobinLimit: 10 });
+ const first = await seedConnection("codex", {
+ name: "codex-affinity-a",
+ lastUsedAt: new Date(Date.now() - 20_000).toISOString(),
+ });
+ const second = await seedConnection("codex", {
+ name: "codex-affinity-b",
+ lastUsedAt: new Date(Date.now() - 10_000).toISOString(),
+ });
+
+ const sessionA1 = await auth.getProviderCredentials("codex", null, null, "gpt-5.5", {
+ sessionKey: "session-a",
+ });
+ const sessionB1 = await auth.getProviderCredentials("codex", null, null, "gpt-5.5", {
+ sessionKey: "session-b",
+ });
+ const sessionA2 = await auth.getProviderCredentials("codex", null, null, "gpt-5.5", {
+ sessionKey: "session-a",
+ });
+ const sessionB2 = await auth.getProviderCredentials("codex", null, null, "gpt-5.5", {
+ sessionKey: "session-b",
+ });
+
+ assert.equal(sessionA1.connectionId, first.id);
+ assert.equal(sessionB1.connectionId, second.id);
+ assert.equal(sessionA2.connectionId, first.id);
+ assert.equal(sessionB2.connectionId, second.id);
+});
+
+test("getProviderCredentials rebinds codex session when affinity connection is excluded", async () => {
+ await settingsDb.updateSettings({ fallbackStrategy: "round-robin", stickyRoundRobinLimit: 10 });
+ const first = await seedConnection("codex", {
+ name: "codex-affinity-excluded-a",
+ lastUsedAt: new Date(Date.now() - 20_000).toISOString(),
+ });
+ const second = await seedConnection("codex", {
+ name: "codex-affinity-excluded-b",
+ lastUsedAt: new Date(Date.now() - 10_000).toISOString(),
+ });
+
+ const initial = await auth.getProviderCredentials("codex", null, null, "gpt-5.5", {
+ sessionKey: "session-excluded",
+ });
+ const rebound = await auth.getProviderCredentials("codex", first.id, null, "gpt-5.5", {
+ sessionKey: "session-excluded",
+ });
+ const sticky = await auth.getProviderCredentials("codex", null, null, "gpt-5.5", {
+ sessionKey: "session-excluded",
+ });
+
+ assert.equal(initial.connectionId, first.id);
+ assert.equal(rebound.connectionId, second.id);
+ assert.equal(sticky.connectionId, second.id);
+});
+
test("resolveQuotaLimitPolicy normalizes Codex windows, thresholds, and defaults", () => {
const normalized = auth.resolveQuotaLimitPolicy("codex", {
limitPolicy: {
@@ -264,7 +286,7 @@ test("resolveQuotaLimitPolicy normalizes Codex windows, thresholds, and defaults
});
assert.deepEqual(defaults, {
enabled: true,
- thresholdPercent: 99,
+ thresholdPercent: 90,
windows: ["session", "weekly"],
});
assert.deepEqual(generic, {
@@ -314,17 +336,17 @@ test("getProviderCredentials round-robin stays on the current account while belo
priority: 2,
});
- await providersDb.updateProviderConnection((current as any).id, {
+ await providersDb.updateProviderConnection(current.id, {
lastUsedAt: new Date().toISOString(),
consecutiveUseCount: 1,
});
- await providersDb.updateProviderConnection((other as any).id, {
+ await providersDb.updateProviderConnection(other.id, {
lastUsedAt: new Date(Date.now() - 60_000).toISOString(),
consecutiveUseCount: 0,
});
const selected = await auth.getProviderCredentials("openai");
- const updated = await providersDb.getProviderConnectionById((current as any).id);
+ const updated = await providersDb.getProviderConnectionById(current.id);
assert.equal(selected.connectionId, current.id);
assert.equal(updated.consecutiveUseCount, 2);
@@ -428,7 +450,7 @@ test("getProviderCredentials retains terminal accounts for combo live tests", as
const bypassed = await auth.getProviderCredentials("openai", null, null, null, {
allowSuppressedConnections: true,
});
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(blocked, null);
assert.equal(bypassed.connectionId, connection.id);
@@ -469,15 +491,9 @@ test("getProviderCredentials reports allRateLimited when every account is model-
name: "gemini-model-lock-second",
});
+ await auth.markAccountUnavailable(first.id, 429, "too many requests", "gemini", "gemini-2.5-pro");
await auth.markAccountUnavailable(
- (first as any).id,
- 429,
- "too many requests",
- "gemini",
- "gemini-2.5-pro"
- );
- await auth.markAccountUnavailable(
- (second as any).id,
+ second.id,
429,
"too many requests",
"gemini",
@@ -504,7 +520,7 @@ test("getProviderCredentials auto-decays stale backoff metadata for recovered ac
const selected = await auth.getProviderCredentials("openai");
await flushWrites();
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(selected.connectionId, connection.id);
assert.equal(updated.backoffLevel, 0);
@@ -522,7 +538,7 @@ test("getProviderCredentials falls back to a five-minute retry window when quota
},
});
- quotaCache.setQuotaCache((connection as any).id, "openai", {
+ quotaCache.setQuotaCache(connection.id, "openai", {
daily: { remainingPercentage: 0, resetAt: null },
});
@@ -547,10 +563,10 @@ test("getProviderCredentials prioritizes accounts that still have quota availabl
apiKey: "sk-available",
});
- quotaCache.setQuotaCache((exhausted as any).id, "openai", {
+ quotaCache.setQuotaCache(exhausted.id, "openai", {
daily: { remainingPercentage: 0, resetAt: futureIso() },
});
- quotaCache.setQuotaCache((available as any).id, "openai", {
+ quotaCache.setQuotaCache(available.id, "openai", {
daily: { remainingPercentage: 65, resetAt: futureIso() },
});
@@ -574,17 +590,17 @@ test("getProviderCredentials round-robin switches to the least recently used acc
priority: 2,
});
- await providersDb.updateProviderConnection((current as any).id, {
+ await providersDb.updateProviderConnection(current.id, {
lastUsedAt: new Date().toISOString(),
consecutiveUseCount: 2,
});
- await providersDb.updateProviderConnection((fallback as any).id, {
+ await providersDb.updateProviderConnection(fallback.id, {
lastUsedAt: new Date(Date.now() - 120_000).toISOString(),
consecutiveUseCount: 0,
});
const selected = await auth.getProviderCredentials("openai");
- const updated = await providersDb.getProviderConnectionById((fallback as any).id);
+ const updated = await providersDb.getProviderConnectionById(fallback.id);
assert.equal(selected.connectionId, fallback.id);
assert.equal(updated.consecutiveUseCount, 1);
@@ -604,17 +620,17 @@ test("getProviderCredentials round-robin fallback mode excludes the failed accou
priority: 2,
});
- await providersDb.updateProviderConnection((failed as any).id, {
+ await providersDb.updateProviderConnection(failed.id, {
lastUsedAt: new Date().toISOString(),
consecutiveUseCount: 3,
});
- await providersDb.updateProviderConnection((fallback as any).id, {
+ await providersDb.updateProviderConnection(fallback.id, {
lastUsedAt: new Date(Date.now() - 120_000).toISOString(),
consecutiveUseCount: 0,
});
- const selected = await auth.getProviderCredentials("openai" as any, (failed as any).id);
- const updated = await providersDb.getProviderConnectionById((fallback as any).id);
+ const selected = await auth.getProviderCredentials("openai", failed.id);
+ const updated = await providersDb.getProviderConnectionById(fallback.id);
assert.equal(selected.connectionId, fallback.id);
assert.equal(updated.consecutiveUseCount, 1);
@@ -644,10 +660,10 @@ test("getProviderCredentials least-used prefers accounts that were never used",
name: "least-used-never",
priority: 9,
});
- await providersDb.updateProviderConnection((recentlyUsed as any).id, {
+ await providersDb.updateProviderConnection(recentlyUsed.id, {
lastUsedAt: new Date().toISOString(),
});
- await providersDb.updateProviderConnection((neverUsed as any).id, {
+ await providersDb.updateProviderConnection(neverUsed.id, {
lastUsedAt: null,
});
@@ -668,10 +684,10 @@ test("getProviderCredentials least-used prefers the oldest timestamp when all ac
priority: 1,
});
- await providersDb.updateProviderConnection((oldest as any).id, {
+ await providersDb.updateProviderConnection(oldest.id, {
lastUsedAt: new Date(Date.now() - 120_000).toISOString(),
});
- await providersDb.updateProviderConnection((newest as any).id, {
+ await providersDb.updateProviderConnection(newest.id, {
lastUsedAt: new Date().toISOString(),
});
@@ -723,10 +739,10 @@ test("getProviderCredentials p2c prefers the account with more quota headroom ov
},
});
- (quotaCache as any).setQuotaCache(nearLimit.id, "openai", {
+ quotaCache.setQuotaCache(nearLimit.id, "openai", {
daily: { remainingPercentage: 12, resetAt: futureIso(180_000) },
});
- (quotaCache as any).setQuotaCache(healthy.id, "openai", {
+ quotaCache.setQuotaCache(healthy.id, "openai", {
daily: { remainingPercentage: 78, resetAt: futureIso(180_000) },
});
@@ -786,7 +802,7 @@ test("getProviderCredentials exposes copilotToken when present in providerSpecif
assert.equal(selected.copilotToken, "copilot-token-value");
});
-test("markAccountUnavailable keeps local 404 failures model-scoped with the local not-found cooldown", async () => {
+test("markAccountUnavailable uses configured cooldowns for local 404 model lockouts", async () => {
await settingsDb.updateSettings({
providerProfiles: {
apikey: {
@@ -807,13 +823,13 @@ test("markAccountUnavailable keeps local 404 failures model-scoped with the loca
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
404,
"model not found",
"openai",
"local-model"
);
- const updated = await (providersDb as any).getProviderConnectionById(connection.id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.equal(result.cooldownMs, 250);
@@ -829,14 +845,14 @@ test("markAccountUnavailable applies a model-only lockout for Gemini 429 respons
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
429,
"too many requests",
"gemini",
"gemini-2.5-pro"
);
await flushWrites();
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.ok(result.cooldownMs > 0);
@@ -852,14 +868,14 @@ test("markAccountUnavailable applies a model-only lockout for compatible provide
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
429,
"The upstream compatible service exhausted its capacity",
"openai-compatible-custom-node",
"custom-model-a"
);
await flushWrites();
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.ok(result.cooldownMs > 0);
@@ -869,7 +885,7 @@ test("markAccountUnavailable applies a model-only lockout for compatible provide
assert.equal(Number(updated.errorCode), 429);
});
-test("markAccountUnavailable uses the unified configured api-key connection cooldown", async () => {
+test("markAccountUnavailable honors configured api-key rate-limit cooldowns", async () => {
await settingsDb.updateSettings({
providerProfiles: {
apikey: {
@@ -887,7 +903,7 @@ test("markAccountUnavailable uses the unified configured api-key connection cool
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
429,
"too many requests",
"openai",
@@ -909,20 +925,20 @@ test("markAccountUnavailable stores Codex scope-specific cooldowns without a glo
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
429,
"quota reached",
"codex",
"codex-spark-mini"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
const selected = await auth.getProviderCredentials("codex", null, null, "codex-spark-mini");
assert.equal(result.shouldFallback, true);
assert.ok(result.cooldownMs > 0);
assert.equal(updated.testStatus, "unavailable");
assert.equal(updated.rateLimitedUntil, undefined);
- assert.ok((updated.providerSpecificData as any).codexScopeRateLimitedUntil.spark);
+ assert.ok(updated.providerSpecificData.codexScopeRateLimitedUntil.spark);
assert.equal(selected.allRateLimited, true);
});
@@ -932,13 +948,13 @@ test("markAccountUnavailable returns without fallback on bad requests", async ()
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
400,
"schema mismatch",
"openai",
"gpt-4o"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.deepEqual(result, { shouldFallback: false, cooldownMs: 0 });
assert.equal(updated.testStatus, "active");
@@ -952,13 +968,8 @@ test("markAccountUnavailable preserves terminal statuses without overwriting the
rateLimitedUntil: null,
});
- const result = await auth.markAccountUnavailable(
- (connection as any).id,
- 503,
- "upstream error",
- "openai"
- );
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const result = await auth.markAccountUnavailable(connection.id, 503, "upstream error", "openai");
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.equal(result.cooldownMs, 0);
@@ -973,13 +984,8 @@ test("markAccountUnavailable reuses an existing connection-wide cooldown", async
rateLimitedUntil: retryAfter,
});
- const result = await auth.markAccountUnavailable(
- (connection as any).id,
- 503,
- "upstream error",
- "openai"
- );
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const result = await auth.markAccountUnavailable(connection.id, 503, "upstream error", "openai");
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.ok(result.cooldownMs > 0);
@@ -1003,21 +1009,18 @@ test("markAccountUnavailable reuses an existing Codex scope cooldown", async ()
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
429,
"quota reached",
"codex",
"codex-spark-mini"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.ok(result.cooldownMs > 0);
assert.equal(updated.rateLimitedUntil, undefined);
- (assert as any).equal(
- (updated.providerSpecificData as any).codexScopeRateLimitedUntil.spark,
- retryAfter
- );
+ assert.equal(updated.providerSpecificData.codexScopeRateLimitedUntil.spark, retryAfter);
});
test("markAccountUnavailable uses a connection-wide cooldown for non-local 404 errors", async () => {
@@ -1029,13 +1032,13 @@ test("markAccountUnavailable uses a connection-wide cooldown for non-local 404 e
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
404,
"model not found",
"openai",
"gpt-missing"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.ok(result.cooldownMs > 0);
@@ -1050,17 +1053,17 @@ test("markAccountUnavailable auto-disables permanently banned accounts when the
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
401,
"Verify your account to continue",
"openai",
"gpt-4o"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.equal(updated.isActive, false);
- assert.equal(updated.testStatus, "banned");
+ assert.equal(updated.testStatus, "unavailable");
});
test("markAccountUnavailable leaves permanently banned accounts active when auto-disable is disabled", async () => {
@@ -1070,17 +1073,17 @@ test("markAccountUnavailable leaves permanently banned accounts active when auto
});
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
401,
"Verify your account to continue",
"openai",
"gpt-4o"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.equal(updated.isActive, true);
- assert.equal(updated.testStatus, "banned");
+ assert.equal(updated.testStatus, "unavailable");
});
test("markAccountUnavailable swallows auto-disable persistence errors", async () => {
@@ -1114,17 +1117,17 @@ test("markAccountUnavailable swallows auto-disable persistence errors", async ()
try {
const result = await auth.markAccountUnavailable(
- (connection as any).id,
+ connection.id,
401,
"Verify your account to continue",
"openai",
"gpt-4o"
);
- const updated = await providersDb.getProviderConnectionById((connection as any).id);
+ const updated = await providersDb.getProviderConnectionById(connection.id);
assert.equal(result.shouldFallback, true);
assert.equal(updated.isActive, true);
- assert.equal(updated.testStatus, "banned");
+ assert.equal(updated.testStatus, "unavailable");
} finally {
db.prepare = originalPrepare;
}
diff --git a/tests/unit/sse-parser.test.ts b/tests/unit/sse-parser.test.ts
index 82b4fd655f..3d8bbfdf7f 100644
--- a/tests/unit/sse-parser.test.ts
+++ b/tests/unit/sse-parser.test.ts
@@ -114,6 +114,26 @@ test("parseSSEToClaudeResponse parses text, thinking, tool_use, and usage events
assert.deepEqual(parsed.usage, { input_tokens: 10, output_tokens: 4 });
});
+test("parseSSEToClaudeResponse tolerates event-only types and missing blank separators", () => {
+ const rawSSE = [
+ "event: message_start",
+ 'data: {"message":{"id":"msg_event_fallback","model":"claude-sonnet-4-6","role":"assistant","usage":{"input_tokens":3}}}',
+ "event: content_block_delta",
+ 'data: {"index":0,"delta":{"text":"event fallback ok"}}',
+ "event: message_delta",
+ 'data: {"delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":2}}',
+ "event: message_stop",
+ "data: {}",
+ ].join("\n");
+
+ const parsed = parseSSEToClaudeResponse(rawSSE, "fallback-model");
+
+ assert.equal(parsed.id, "msg_event_fallback");
+ assert.equal(parsed.model, "claude-sonnet-4-6");
+ assert.equal((parsed.content[0] as any).text, "event fallback ok");
+ assert.deepEqual(parsed.usage, { input_tokens: 3, output_tokens: 2 });
+});
+
test("parseSSEToClaudeResponse ignores malformed payloads and returns null when nothing valid remains", () => {
const parsed = parseSSEToClaudeResponse(
["event: content_block_delta", "data: not-json", "", "data: [DONE]"].join("\n"),
diff --git a/tests/unit/stream-readiness.test.ts b/tests/unit/stream-readiness.test.ts
index a86c37dd31..15eb22654d 100644
--- a/tests/unit/stream-readiness.test.ts
+++ b/tests/unit/stream-readiness.test.ts
@@ -3,6 +3,7 @@ import assert from "node:assert/strict";
import {
ensureStreamReadiness,
+ hasStreamReadinessSignal,
hasUsefulStreamContent,
} from "../../open-sse/utils/streamReadiness.ts";
@@ -20,6 +21,46 @@ function streamFromChunks(chunks: string[], delayMs = 0): ReadableStream {
+ return new ReadableStream({
+ async start(controller) {
+ controller.enqueue(
+ encoder.encode(
+ [
+ "event: message_start",
+ `data: ${JSON.stringify({
+ message: {
+ id: "msg_1",
+ type: "message",
+ role: "assistant",
+ model: "claude-sonnet-4-6",
+ usage: { input_tokens: 10, output_tokens: 0 },
+ },
+ })}`,
+ "",
+ ].join("\n")
+ )
+ );
+
+ await new Promise((resolve) => setTimeout(resolve, 30));
+ controller.enqueue(
+ encoder.encode(
+ [
+ "event: content_block_delta",
+ `data: ${JSON.stringify({
+ type: "content_block_delta",
+ index: 0,
+ delta: { type: "text_delta", text: "slow hello" },
+ })}`,
+ "",
+ ].join("\n")
+ )
+ );
+ controller.close();
+ },
+ });
+}
+
test("hasUsefulStreamContent ignores keepalives and lifecycle-only chunks", () => {
assert.equal(hasUsefulStreamContent(": keepalive\n\n"), false);
assert.equal(hasUsefulStreamContent("event: ping\ndata: {}\n\n"), false);
@@ -80,6 +121,51 @@ test("hasUsefulStreamContent detects text, reasoning, and tool deltas", () => {
);
});
+test("hasStreamReadinessSignal accepts Claude stream start events", () => {
+ assert.equal(hasStreamReadinessSignal(": keepalive\n\n"), false);
+ assert.equal(hasStreamReadinessSignal("event: ping\ndata: {}\n\n"), false);
+ assert.equal(
+ hasStreamReadinessSignal(`data: ${JSON.stringify({ type: "response.created" })}\n\n`),
+ false
+ );
+ assert.equal(
+ hasStreamReadinessSignal(
+ `event: message_start\ndata: ${JSON.stringify({
+ type: "message_start",
+ message: {
+ id: "msg_1",
+ type: "message",
+ role: "assistant",
+ model: "claude-sonnet-4-6",
+ },
+ })}\n\n`
+ ),
+ true
+ );
+ assert.equal(
+ hasStreamReadinessSignal(
+ `event: message_start\ndata: ${JSON.stringify({
+ message: {
+ id: "msg_2",
+ type: "message",
+ role: "assistant",
+ model: "claude-sonnet-4-6",
+ },
+ })}\n\n`
+ ),
+ true
+ );
+ assert.equal(
+ hasStreamReadinessSignal(
+ `event: content_block_start\ndata: ${JSON.stringify({
+ index: 0,
+ content_block: { type: "text", text: "" },
+ })}\n\n`
+ ),
+ true
+ );
+});
+
test("ensureStreamReadiness preserves buffered chunks when stream starts", async () => {
const response = new Response(
streamFromChunks([
@@ -98,6 +184,23 @@ test("ensureStreamReadiness preserves buffered chunks when stream starts", async
assert.match(text, / world/);
});
+test("ensureStreamReadiness hands off long Claude streams after message_start", async () => {
+ const response = new Response(delayedClaudeStartStream(), {
+ status: 200,
+ headers: { "Content-Type": "text/event-stream" },
+ });
+
+ const result = await ensureStreamReadiness(response, {
+ timeoutMs: 10,
+ provider: "anthropic-compatible-cc-test",
+ model: "claude-sonnet-4-6",
+ });
+ assert.equal(result.ok, true);
+ const text = await result.response.text();
+ assert.match(text, /message_start/);
+ assert.match(text, /slow hello/);
+});
+
test("ensureStreamReadiness returns 504 when no useful content arrives before timeout", async () => {
const response = new Response(
streamFromChunks(
diff --git a/tests/unit/usage-service-hardening.test.ts b/tests/unit/usage-service-hardening.test.ts
index 3b77cff9dd..3e2d19e404 100644
--- a/tests/unit/usage-service-hardening.test.ts
+++ b/tests/unit/usage-service-hardening.test.ts
@@ -1119,68 +1119,6 @@ test("usage service treats MiniMax token-plan counts as used usage", async () =>
assert.ok(Date.parse(usage.quotas["session (5h)"].resetAt) >= beforeCall + 240_000);
});
-test("usage service parses Cursor team quotas and clamps on-demand ratio", async () => {
- const calls: any[] = [];
- globalThis.fetch = async (url, init = {}) => {
- calls.push({ url: String(url), init });
-
- if (String(url).endsWith("/api/usage")) {
- return new Response(
- JSON.stringify({
- numRequestsTotal: 450,
- hard_limit: 100,
- teamMaxRequestUsage: 500,
- onDemand: {
- numRequests: 600,
- },
- }),
- { status: 200 }
- );
- }
-
- if (String(url).endsWith("/api/auth/me")) {
- return new Response(
- JSON.stringify({
- plan: "team",
- teamInfo: { id: "team-1", name: "Core Team" },
- }),
- { status: 200 }
- );
- }
-
- if (String(url).endsWith("/api/subscription")) {
- return new Response(
- JSON.stringify({
- teamMaxMonthlyRequests: 500,
- }),
- { status: 200 }
- );
- }
-
- throw new Error(`unexpected fetch: ${url}`);
- };
-
- const usage: any = await usageService.getUsageForProvider({
- provider: "cursor",
- accessToken: "cursor-token",
- });
-
- assert.equal(calls.length, 3);
- for (const call of calls) {
- assert.equal(call.init.headers.Authorization, "Bearer cursor-token");
- assert.equal(call.init.headers["User-Agent"], "Cursor/3.3");
- assert.equal(call.init.headers["x-cursor-client-version"], "3.3");
- }
-
- assert.equal(usage.plan, "Cursor Team");
- assert.equal(usage.quotas.requests.total, 500);
- assert.equal(usage.quotas.requests.used, 450);
- assert.equal(usage.quotas.requests.remainingPercentage, 10);
- assert.equal(usage.quotas.on_demand.total, 500);
- assert.equal(usage.quotas.on_demand.used, 500);
- assert.equal(usage.quotas.on_demand.remainingPercentage, 0);
-});
-
test("usage helper branches cover reset parsing, GitHub quota math, and plan inference fallbacks", () => {
const fixedDate = new Date("2026-01-02T03:04:05.000Z");
@@ -1279,32 +1217,6 @@ test("usage helper branches cover reset parsing, GitHub quota math, and plan inf
"Copilot Student"
);
assert.equal(__testing.inferGitHubPlanName({}, null), "GitHub Copilot");
-
- assert.deepEqual(__testing.buildCursorUsageHeaders("cursor-token"), {
- Authorization: "Bearer cursor-token",
- Accept: "application/json",
- "User-Agent": "Cursor/3.3",
- "x-cursor-client-version": "3.3",
- "x-cursor-user-agent": "Cursor/3.3",
- });
- assert.equal(
- __testing.getCursorMonthlyRequestLimit(
- { hard_limit: 100, teamMaxRequestUsage: 400 },
- { teamMaxMonthlyRequests: 500 }
- ),
- 500
- );
- assert.equal(__testing.getCursorOnDemandLimit({ onDemand: { maxRequests: 120 } }, {}), 120);
- assert.deepEqual(__testing.formatCursorQuota(150, 100, null), {
- used: 100,
- total: 100,
- remaining: 0,
- remainingPercentage: 0,
- resetAt: null,
- unlimited: false,
- });
- assert.equal(__testing.inferCursorPlanName({ teamInfo: { id: "team-1" } }, {}), "Cursor Team");
- assert.equal(__testing.inferCursorPlanName({ plan: "pro" }, {}), "Cursor Pro");
});
test("usage helper branches cover Gemini CLI and Antigravity plan label fallbacks", () => {
diff --git a/vitest.config.ts b/vitest.config.ts
index 8fb8eb8c6e..95d3dc286f 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -13,6 +13,7 @@ export default defineConfig({
"src/lib/memory/__tests__/**/*.test.ts",
"src/lib/skills/__tests__/**/*.test.ts",
"tests/unit/encryption.test.ts",
+ "tests/unit/**/*.test.tsx",
"open-sse/**/__tests__/**/*.test.ts",
"open-sse/services/**/__tests__/**/*.test.ts",
"tests/e2e/ecosystem.test.ts",
diff --git a/vitest.mcp.config.ts b/vitest.mcp.config.ts
index da4324af0b..acd2360f04 100644
--- a/vitest.mcp.config.ts
+++ b/vitest.mcp.config.ts
@@ -9,6 +9,9 @@ export default defineConfig({
"open-sse/mcp-server/__tests__/**/*.test.ts",
"open-sse/services/autoCombo/__tests__/**/*.test.ts",
"tests/unit/encryption.spec.ts",
+ "src/shared/components/**/*.test.tsx",
+ "src/shared/hooks/__tests__/**/*.test.tsx",
+ "src/app/(dashboard)/**/__tests__/**/*.test.tsx",
],
exclude: ["**/node_modules/**", "**/.git/**"],
coverage: {