fix(server): Claude accounts in a CLIProxyAPI hub show and use their limit resets

apps/server/src/provider/Drivers/ClaudeDriver.ts

@@ -304,8 +304,8 @@ export const ClaudeDriver: ProviderDriver<ClaudeSettings, ClaudeDriverEnv, Path.
     );
 
     // Same rules as Codex: serialised on the config directory that holds the
-    // login, one request id kept until Claude answers (a cooldown or rate
-    // limit is an answer), then a re-probe.
+    // login, one request id per grant kept until Claude answers (a cooldown
+    // or rate limit is an answer), then a re-probe.
     const consumeResetCredit: NonNullable<ProviderInstance["consumeResetCredit"]> = Effect.fn(
       "ClaudeDriver.consumeResetCredit",
     )(
@@ -331,6 +331,7 @@ export const ClaudeDriver: ProviderDriver<ClaudeSettings, ClaudeDriverEnv, Path.
               requestId,
             }),
           ClaudeResetCredits.isSettledClaudeResetCreditFailure,
+          grantId,
         );
       },
       Effect.provideService(HttpClient.HttpClient, httpClient),

apps/server/src/provider/claudeResetCredits.ts

@@ -256,17 +256,60 @@ const CLAIM_OUTCOMES = {
   ineligible: "noCredit",
 } as const satisfies Record<string, ProviderConsumeResetCreditOutcome>;
 
-/** requestId is the claim's idempotency key. */
+const decodeClaimResponse = Schema.decodeUnknownEffect(Schema.fromJsonString(ClaimResponse));
+
+/** The claim request for an organization; requestId is its idempotency key. */
+export const claudeResetClaim = Effect.fn("claudeResetClaim")(function* (input: {
+  readonly grantId: string;
+  readonly requestId: string;
+}) {
+  if (!GRANT_ID.test(input.grantId) || !REQUEST_ID.test(input.requestId)) {
+    return yield* new ClaudeResetCreditError({ reason: "malformedCredit" });
+  }
+  return (organization: string) => ({
+    url: new URL(
+      `/api/organizations/${encodeURIComponent(organization)}/reset_rate_limits`,
+      API_BASE,
+    ).toString(),
+    body: { program: PROGRAM, grant_id: input.grantId, request_id: input.requestId },
+  });
+});
+
+export const claudeResetClaimOutcome = Effect.fn("claudeResetClaimOutcome")(function* <E, R>(
+  status: number,
+  body: Effect.Effect<string, E, R>,
+) {
+  if (status === 429) {
+    return yield* new ClaudeResetCreditError({ reason: "rateLimited" });
+  }
+  if (status === 401 || status === 403) {
+    return yield* new ClaudeResetCreditError({ reason: "signedOut" });
+  }
+  const requestFailed = (cause?: unknown) =>
+    new ClaudeResetCreditError({ reason: "requestFailed", cause });
+  if (status < 200 || status >= 300) return yield* requestFailed();
+  const claim = yield* body.pipe(
+    Effect.flatMap(decodeClaimResponse),
+    Effect.mapError(requestFailed),
+  );
+  if (claim.result === "cooldown") {
+    return yield* new ClaudeResetCreditError({ reason: "coolingDown" });
+  }
+  // Unknown outcomes retain the request ID so retries address the same claim.
+  if (claim.result === "unavailable") {
+    return yield* new ClaudeResetCreditError({ reason: "unconfirmed" });
+  }
+  return CLAIM_OUTCOMES[claim.result];
+});
+
 export const consumeClaudeResetCredit = Effect.fn("consumeClaudeResetCredit")(function* (input: {
   readonly configDir: string;
   readonly accountConfigPath: string;
   readonly version: string;
   readonly grantId: string;
   readonly requestId: string;
 }) {
-  if (!GRANT_ID.test(input.grantId) || !REQUEST_ID.test(input.requestId)) {
-    return yield* new ClaudeResetCreditError({ reason: "malformedCredit" });
-  }
+  const claim = yield* claudeResetClaim(input);
   const token = yield* readAccessToken(input.configDir).pipe(
     Effect.mapError((cause) => new ClaudeResetCreditError({ reason: "loginUnreadable", cause })),
   );
@@ -277,44 +320,21 @@ export const consumeClaudeResetCredit = Effect.fn("consumeClaudeResetCredit")(fu
   if (!token || !organization) {
     return yield* new ClaudeResetCreditError({ reason: "signedOut" });
   }
+  const { url, body } = claim(organization);
   const client = yield* HttpClient.HttpClient;
   const response = yield* client
     .execute(
-      HttpClientRequest.post(
-        new URL(
-          `/api/organizations/${encodeURIComponent(organization)}/reset_rate_limits`,
-          API_BASE,
-        ),
-      ).pipe(
+      HttpClientRequest.post(url).pipe(
         withClaudeHeaders(token, input.version),
-        HttpClientRequest.bodyJsonUnsafe({
-          program: PROGRAM,
-          grant_id: input.grantId,
-          request_id: input.requestId,
-        }),
+        HttpClientRequest.bodyJsonUnsafe(body),
       ),
     )
     .pipe(
       Effect.timeout("25 seconds"),
       Effect.mapError((cause) => new ClaudeResetCreditError({ reason: "requestFailed", cause })),
     );
-  if (response.status === 429) {
-    return yield* new ClaudeResetCreditError({ reason: "rateLimited" });
-  }
-  if (response.status === 401 || response.status === 403) {
-    return yield* new ClaudeResetCreditError({ reason: "signedOut" });
-  }
-  const body = yield* HttpClientResponse.filterStatusOk(response).pipe(
-    Effect.flatMap(HttpClientResponse.schemaBodyJson(ClaimResponse)),
-    Effect.timeout("25 seconds"),
-    Effect.mapError((cause) => new ClaudeResetCreditError({ reason: "requestFailed", cause })),
+  return yield* claudeResetClaimOutcome(
+    response.status,
+    response.text.pipe(Effect.timeout("25 seconds")),
   );
-  if (body.result === "cooldown") {
-    return yield* new ClaudeResetCreditError({ reason: "coolingDown" });
-  }
-  // Unknown outcomes retain the request ID so retries address the same claim.
-  if (body.result === "unavailable") {
-    return yield* new ClaudeResetCreditError({ reason: "unconfirmed" });
-  }
-  return CLAIM_OUTCOMES[body.result];
 });

apps/server/src/provider/resetCreditCoordinator.test.ts

@@ -34,6 +34,25 @@ describe("ResetCreditCoordinator", () => {
     }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
   );
 
+  it.effect("keeps an unanswered key for its own credit when another is redeemed", () =>
+    Effect.gen(function* () {
+      const { redeem } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+      const keys = yield* Ref.make<ReadonlyArray<string>>([]);
+      const consume = (answer: "timed out" | "reset") => (key: string) =>
+        Ref.update(keys, (seen) => [...seen, key]).pipe(
+          Effect.andThen(answer === "reset" ? Effect.succeed(answer) : Effect.fail(answer)),
+        );
+
+      yield* redeem("acct", consume("timed out"), undefined, "weekly").pipe(Effect.result);
+      yield* redeem("acct", consume("reset"), undefined, "fable");
+      yield* redeem("acct", consume("reset"), undefined, "weekly");
+
+      const seen = yield* Ref.get(keys);
+      assert.notStrictEqual(seen[1], seen[0]);
+      assert.strictEqual(seen[2], seen[0]);
+    }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
   it.effect("starts a fresh attempt after a settled failure", () =>
     Effect.gen(function* () {
       const { redeem } = yield* ResetCreditCoordinator.ResetCreditCoordinator;

apps/server/src/provider/resetCreditCoordinator.ts

@@ -11,17 +11,21 @@ import * as Semaphore from "effect/Semaphore";
 
 interface AccountRedemptionState {
   readonly lock: Semaphore.Semaphore;
-  readonly pendingKey: Ref.Ref<string | null>;
+  readonly pendingKeys: Ref.Ref<ReadonlyMap<string, string>>;
 }
 
 export class ResetCreditCoordinator extends Context.Service<
   ResetCreditCoordinator,
   {
-    /** Reuse the idempotency key until an outcome or settled failure; timeouts keep it for retry. */
+    /**
+     * Reuse the idempotency key until an outcome or settled failure; timeouts keep it for retry.
+     * `credit` names what is redeemed when an account holds several, so each keeps its own key.
+     */
     readonly redeem: <E, R>(
       accountKey: string,
       consume: (idempotencyKey: string) => Effect.Effect<ProviderConsumeResetCreditOutcome, E, R>,
       isSettled?: (error: E) => boolean,
+      credit?: string,
     ) => Effect.Effect<ProviderConsumeResetCreditOutcome, E | PlatformError.PlatformError, R>;
   }
 >()("t3/provider/resetCreditCoordinator") {}
@@ -37,7 +41,7 @@ export const make = Effect.gen(function* () {
     if (existing) return existing;
     const candidate = {
       lock: yield* Semaphore.make(1),
-      pendingKey: yield* Ref.make<string | null>(null),
+      pendingKeys: yield* Ref.make<ReadonlyMap<string, string>>(new Map()),
     };
     return yield* Ref.modify(statesRef, (states) => {
       const current = states.get(accountKey);
@@ -50,19 +54,24 @@ export const make = Effect.gen(function* () {
 
   const redeem: ResetCreditCoordinator["Service"]["redeem"] = Effect.fn(
     "resetCreditCoordinator.redeem",
-  )(function* (accountKey, consume, isSettled) {
+  )(function* (accountKey, consume, isSettled, credit = "") {
     const state = yield* stateFor(accountKey);
+    const settle = Ref.update(state.pendingKeys, (pending) => {
+      const next = new Map(pending);
+      next.delete(credit);
+      return next;
+    });
     return yield* state.lock.withPermits(1)(
       Effect.gen(function* () {
-        const existing = yield* Ref.get(state.pendingKey);
+        const existing = (yield* Ref.get(state.pendingKeys)).get(credit);
         const idempotencyKey = existing ?? (yield* random.uuidV4());
-        yield* Ref.set(state.pendingKey, idempotencyKey);
+        yield* Ref.update(state.pendingKeys, (pending) =>
+          new Map(pending).set(credit, idempotencyKey),
+        );
         const outcome = yield* consume(idempotencyKey).pipe(
-          Effect.tapError((error) =>
-            isSettled?.(error) ? Ref.set(state.pendingKey, null) : Effect.void,
-          ),
+          Effect.tapError((error) => (isSettled?.(error) ? settle : Effect.void)),
         );
-        yield* Ref.set(state.pendingKey, null);
+        yield* settle;
         return outcome;
       }),
     );

apps/server/src/usage/cliproxyApi.test.ts

@@ -346,7 +346,7 @@ describe("CLIProxyAPI built-in management API", () => {
         accounts: [{ ...accounts[0]!, provider: "claude" }],
         // The usage endpoint answers 429 to requests without a Claude Code user agent.
         upstream: (request) => ({
-          status: request.header?.["User-Agent"]?.startsWith("claude-code/") ? 200 : 429,
+          status: request.header?.["User-Agent"]?.startsWith("claude-cli/") ? 200 : 429,
           body: {
             five_hour: { utilization: 10, resets_at: null },
             seven_day: { utilization: 50, resets_at: "2099-01-01T00:00:00Z" },
@@ -373,6 +373,47 @@ describe("CLIProxyAPI built-in management API", () => {
     }),
   );
 
+  it.effect("reads Claude reset grants through the hub", () =>
+    Effect.gen(function* () {
+      const test = fixture({
+        accounts: [{ ...accounts[0]!, provider: "claude" }],
+        // Claude only reports grants for cedar_ember=1 from a current Claude CLI user agent.
+        upstream: (request) => {
+          const url = new URL(request.url!);
+          const eligible =
+            url.searchParams.get("cedar_ember") === "1" &&
+            /^claude-cli\/\S+ \(external, cli\)$/.test(request.header?.["User-Agent"] ?? "");
+          return {
+            status: 200,
+            body: {
+              five_hour: { utilization: 10, resets_at: null },
+              cedar_ember: eligible
+                ? {
+                    eligible: true,
+                    next_grant_id: "grant_a",
+                    grants: [
+                      {
+                        id: "grant_a",
+                        resets_left: 1,
+                        usable_now: true,
+                        ends_at: "2099-01-01T00:00:00Z",
+                        clears: ["five_hour", "seven_day"],
+                      },
+                    ],
+                  }
+                : null,
+            },
+          };
+        },
+      });
+      const result = yield* (yield* test.api).readAccounts(config);
+      expect(result[0]?.usageLimits.resetCredits).toMatchObject({
+        availableCount: 1,
+        nextCreditId: "grant_a",
+      });
+    }),
+  );
+
   it.effect.each([
     {
       name: "spend budget",
@@ -691,6 +732,51 @@ describe("CLIProxyAPI built-in management API", () => {
     }),
   );
 
+  it.effect("claims a Claude grant in the account's organization, keeping an unanswered id", () =>
+    Effect.gen(function* () {
+      let claims = 0;
+      const test = fixture({
+        accounts: [{ ...accounts[0]!, provider: "claude" }],
+        upstream: (request) =>
+          request.url?.endsWith("/api/oauth/profile")
+            ? { status: 200, body: { organization: { uuid: "org a" } } }
+            : ++claims === 1
+              ? { status: 503, body: {} }
+              : { status: 200, body: { result: "reset" } },
+      });
+      const api = yield* test.api;
+      expect((yield* api.consume(config, "first.json", "grant_a").pipe(Effect.result))._tag).toBe(
+        "Failure",
+      );
+      // Another grant claimed while grant_a is unanswered must not take grant_a's request id.
+      expect(yield* api.consume(config, "first.json", "grant_b")).toEqual({ outcome: "reset" });
+      expect(yield* api.consume(config, "first.json", "grant_a")).toEqual({ outcome: "reset" });
+      const claimed = () =>
+        test.requests.flatMap(({ body }) =>
+          body?.method === "POST" ? [{ url: body.url, data: body.data }] : [],
+        );
+      const sent = claimed();
+      expect(sent).toHaveLength(3);
+      expect(sent[0]).toEqual(sent[2]);
+      expect(sent[1]?.data).toContain('"grant_id":"grant_b"');
+      expect(sent[1]?.data).not.toBe(sent[0]?.data?.replace("grant_a", "grant_b"));
+      expect(sent[0]?.url).toBe(
+        "https://api.anthropic.com/api/organizations/org%20a/reset_rate_limits",
+      );
+      expect(sent[0]?.data).toMatch(
+        /^\{"program":"cedar_ember","grant_id":"grant_a","request_id":"[0-9a-f-]{36}"\}$/,
+      );
+      expect(
+        test.requests
+          .filter((request) => request.path.endsWith("/reset-quota"))
+          .map((request) => request.body?.auth_index),
+      ).toEqual(["a", "a"]);
+      const refused = yield* api.consume(config, "first.json", "Not A Grant").pipe(Effect.flip);
+      expect(refused.detail).toBe("Claude returned a malformed reset credit.");
+      expect(claimed()).toHaveLength(3);
+    }),
+  );
+
   it.effect("rejects unknown accounts without forwarding a redemption", () =>
     Effect.gen(function* () {
       const test = fixture();