;
}
+function DashboardTeamSwitcherFallback() {
+ return
;
+}
+
function DashboardNav({
groups,
trailing,
diff --git a/web/app/[locale]/dashboard/dashboard-team-switcher.tsx b/web/app/[locale]/dashboard/dashboard-team-switcher.tsx
new file mode 100644
index 000000000000..a4f77183068b
--- /dev/null
+++ b/web/app/[locale]/dashboard/dashboard-team-switcher.tsx
@@ -0,0 +1,247 @@
+"use client";
+
+import { Menu } from "@base-ui-components/react/menu";
+import { useUser } from "@stackframe/stack";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useTranslations } from "next-intl";
+import { useSearchParams } from "next/navigation";
+import { usePathname, useRouter } from "@/i18n/navigation";
+import { persistCoderouterOrganizationScope } from "@/services/coderouter/organizationScope";
+
+export type DashboardTeamCatalog = {
+ readonly selectedTeamId: string | null;
+ readonly teams: readonly DashboardCatalogTeam[];
+};
+
+export type DashboardCatalogTeam = {
+ readonly id: string;
+ readonly name: string;
+ readonly personal: boolean;
+ readonly permissions: {
+ readonly use: boolean;
+ readonly manageAccounts: boolean;
+ };
+};
+
+const CATALOG_TIMEOUT_MS = 10_000;
+
+const menuItemClass =
+ "flex min-h-9 w-full cursor-default select-none items-center gap-2 px-2.5 py-2 text-left text-sm text-foreground outline-none data-[highlighted]:bg-code-bg";
+
+/**
+ * The dashboard-wide team scope, shown at the bottom of the sidebar. Every
+ * team-scoped page reads the same persisted scope on the server, so switching
+ * here changes what the whole dashboard shows without a page-level picker.
+ */
+export function DashboardTeamSwitcher() {
+ const t = useTranslations("dashboard.teamSwitcher");
+ const user = useUser({ or: "return-null" });
+ const router = useRouter();
+ const pathname = usePathname();
+ const searchParams = useSearchParams();
+ const queryClient = useQueryClient();
+ const queryKey = ["dashboard-team-catalog", user?.id ?? null] as const;
+ const { data, isPending } = useQuery({
+ queryKey,
+ queryFn: ({ signal }) => loadTeamCatalog(signal),
+ enabled: user !== null,
+ staleTime: 0,
+ refetchOnWindowFocus: "always",
+ refetchOnReconnect: "always",
+ });
+
+ if (!user) return null;
+ if (isPending) {
+ return
;
+ }
+ if (!data) return null;
+
+ const teams = permittedTeams(data);
+ if (teams.length === 0) return null;
+ const selected = selectedTeam(teams, data.selectedTeamId, searchParams.get("team"));
+
+ const switchTeam = (team: DashboardCatalogTeam) => {
+ if (team.id === selected.id) return;
+ // The scope cookie is what the server reads. Persisting it before the
+ // refresh means the very next render already shows the chosen team.
+ persistCoderouterOrganizationScope(user.id, team.id);
+ queryClient.setQueryData
(
+ queryKey,
+ (current) => current ? { ...current, selectedTeamId: team.id } : current,
+ );
+ if (searchParams.has("team")) {
+ // A deep-linked team in the URL would keep overriding the new scope.
+ router.replace(pathname);
+ }
+ router.refresh();
+ };
+
+ return (
+
+
+
+
+
+ {selected.name}
+
+ {selected.personal ? t("personal") : t("team")}
+
+
+
+
+
+
+
+ {t("label")}
+ {teams.map((team) => (
+ switchTeam(team)}
+ >
+
+ {team.name}
+ {team.personal ? (
+ {t("personal")}
+ ) : null}
+ {team.id === selected.id ? : }
+
+ ))}
+
+
+
+
+
{children}
: null,
+ Portal: ({ children }: { children: React.ReactNode }) => <>{children},
+ Backdrop: () => null,
+ Viewport: ({ children }: { children: React.ReactNode }) => {children}
,
+ Popup: ({ children }: { children: React.ReactNode }) => {children}
,
+ Title: ({ children }: { children: React.ReactNode }) => {children}
,
+ Description: ({ children }: { children: React.ReactNode }) => {children}
,
+ Close: ({ children }: { children: React.ReactNode }) => ,
+ },
+}));
+
+const { CoderouterAccountsSection } = await import(
+ "../app/[locale]/dashboard/components/coderouter-accounts"
+);
+
+const claudeAccount = {
+ id: "claude-1",
+ kind: "anthropic_oauth" as const,
+ label: "work",
+ identifier: "sk-ant-oat01-…a1b2",
+ region: null,
+ modelIds: {},
+ state: "active" as const,
+ cooldownUntil: null,
+ lastFailureCode: null,
+ lastUsedAt: "2026-09-07T10:00:00.000Z",
+ createdAt: "2026-09-01T00:00:00.000Z",
+ updatedAt: "2026-09-01T00:00:00.000Z",
+};
+
+const codexAccount = {
+ id: "codex-1",
+ kind: "codex",
+ label: "shared codex",
+ createdAt: "2026-08-20T00:00:00.000Z",
+ health: { ok: true },
+};
+
+describe("coderouter accounts section", () => {
+ test("lists Claude upstream and shared Codex accounts in one table", () => {
+ const html = renderToStaticMarkup(
+ ,
+ );
+
+ expect(html).toContain("2 accounts");
+ expect(html.match(/]*>/g)).toHaveLength(1);
+ expect(html).toContain("Claude Code OAuth");
+ expect(html).toContain("sk-ant-oat01-…a1b2");
+ expect(html).toContain("Codex");
+ expect(html).toContain("shared codex");
+ expect(html).toContain("last used 2 hours ago");
+ expect(html).toContain("added 2026-08-20");
+ // Provider rows are text only.
+ expect(html).not.toContain(" {
+ const html = renderToStaticMarkup(
+ ,
+ );
+
+ const tabs = [...html.matchAll(/role="tab"[^>]*>([^<]+) match[1]);
+ expect(tabs).toEqual([
+ "Anthropic API key",
+ "Claude Code OAuth",
+ "Amazon Bedrock",
+ "Codex",
+ "OpenCode",
+ ]);
+ expect(html).toContain("No accounts yet");
+ expect(html).toContain('name="apiKey"');
+ });
+
+ test("hides management controls for members without account rights", () => {
+ const html = renderToStaticMarkup(
+ ,
+ );
+
+ expect(html).not.toContain('role="tab"');
+ expect(html).not.toContain(">Remove<");
+ expect(html).not.toContain(">Disable<");
+ });
+
+ test("keeps the loaded provider visible when the other one fails", () => {
+ const html = renderToStaticMarkup(
+ ,
+ );
+
+ expect(html).toContain("Some accounts could not load");
+ expect(html).toContain("Claude Code OAuth");
+ expect(html).not.toContain("No accounts yet");
+ });
+
+ test("explains a pending shared-account migration without hiding Claude accounts", () => {
+ const html = renderToStaticMarkup(
+ ,
+ );
+
+ expect(html).toContain("Shared accounts temporarily unavailable");
+ expect(html).toContain("Claude Code OAuth");
+ });
+});
+
+function translator(namespace: string) {
+ const root = valueAtPath(enMessages, namespace);
+ return (key: string, values?: Record) =>
+ interpolate(String(valueAtPath(root, key)), values);
+}
+
+function valueAtPath(root: unknown, path: string): unknown {
+ return path.split(".").reduce((value, part) => {
+ if (value && typeof value === "object" && part in value) {
+ return (value as Record)[part];
+ }
+ return path;
+ }, root);
+}
+
+function interpolate(message: string, values?: Record): string {
+ if (!values) return message;
+ return Object.entries(values).reduce((result, [key, value]) => {
+ const plural = result.match(new RegExp(`\\{${key}, plural, one \\{([^}]*)\\} other \\{([^}]*)\\}\\}`));
+ if (plural) {
+ const form = value === 1 ? plural[1] : plural[2];
+ return result.replace(plural[0], form.replaceAll("#", String(value)));
+ }
+ return result.replaceAll(`{${key}}`, String(value));
+ }, message);
+}
diff --git a/web/tests/dashboard-coderouter-page.test.tsx b/web/tests/dashboard-coderouter-page.test.tsx
index 78925c202e69..9c9dc7f0b85c 100644
--- a/web/tests/dashboard-coderouter-page.test.tsx
+++ b/web/tests/dashboard-coderouter-page.test.tsx
@@ -223,19 +223,29 @@ mock.module("../services/coderouter/teamMachines", () => ({
normalizeVmId: (value: string) => value,
}));
-mock.module("../app/[locale]/dashboard/components/ai-account-forms", () => ({
- AddAiAccountForms: () => null,
- DeleteAiAccountButton: () => null,
+mock.module("../app/[locale]/dashboard/components/coderouter-accounts", () => ({
+ CoderouterAccountsSection: ({
+ shared,
+ claude,
+ canManage,
+ }: {
+ shared: { kind: string };
+ claude: { kind: string };
+ canManage: boolean;
+ }) => (
+
+ ),
}));
mock.module("../services/coderouter/claudeUpstream", () => ({
listClaudeAccounts: async () => [],
}));
-mock.module("../app/[locale]/dashboard/components/claude-upstream-forms", () => ({
- ClaudeUpstreamSection: () => null,
-}));
-
const { default: CoderouterOverviewPage, CoderouterOverviewContent } = await import(
"../app/[locale]/dashboard/coderouter/page"
);
@@ -281,12 +291,13 @@ describe("coderouter dashboard", () => {
});
const html = renderToStaticMarkup(page);
- expect(html).toContain("Accounts could not load");
+ expect(html).toContain("coderouter could not load");
expect(html).toContain('data-testid="coderouter-page-header"');
expect(html).toContain(
"The account service could not be reached. Try again shortly.",
);
expect(html).not.toContain("unexpected redirect");
+ expect(html).not.toContain('data-testid="coderouter-accounts"');
});
test("keeps a legacy-mapped team off hosted accounts until migration finishes", async () => {
@@ -299,10 +310,8 @@ describe("coderouter dashboard", () => {
const html = renderToStaticMarkup(page);
expect(hostedExchangeCalls).toBe(0);
- expect(html).toContain("Accounts temporarily unavailable");
- expect(html).toContain(
- "Shared accounts are temporarily unavailable. Try again shortly.",
- );
+ expect(html).toContain('data-shared="migrationPending"');
+ expect(html).toContain('data-claude="ok"');
});
test("renders recovery UI when the bounded Stack session refresh fails", async () => {
@@ -314,7 +323,7 @@ describe("coderouter dashboard", () => {
});
const html = renderToStaticMarkup(page);
- expect(html).toContain("Accounts could not load");
+ expect(html).toContain("coderouter could not load");
expect(html).toContain(
"The account service could not be reached. Try again shortly.",
);
@@ -330,7 +339,7 @@ describe("coderouter dashboard", () => {
});
const html = renderToStaticMarkup(page);
- expect(html).toContain("AI account management isn't available yet");
+ expect(html).toContain('data-shared="notConfigured"');
expect(hostedExchangeCalls).toBe(0);
});
@@ -351,6 +360,23 @@ describe("coderouter dashboard", () => {
expect(html).not.toContain("stack-user");
});
+ test("renders one combined accounts section without a page-level team switcher", async () => {
+ authorizationAvailable = true;
+ authorizedTeams = [
+ { teamId: "team-1", teamName: "Team One", use: true, manageAccounts: true },
+ { teamId: "team-2", teamName: "Team Two", use: true, manageAccounts: false },
+ ];
+
+ const page = await CoderouterOverviewContent({ locale: "en", team: "team-2" });
+ const html = renderToStaticMarkup(page);
+
+ expect(html.match(/data-testid="coderouter-accounts"/g)).toHaveLength(1);
+ expect(html).toContain('data-shared="ok"');
+ expect(html).toContain('data-can-manage="false"');
+ expect(html).not.toContain("?team=");
+ expect(html).not.toContain("Team One");
+ });
+
test("renders the Machines card for owned machines only", async () => {
authorizationAvailable = true;
diff --git a/web/tests/dashboard-shell.test.tsx b/web/tests/dashboard-shell.test.tsx
index 90132d818546..8324775b8c46 100644
--- a/web/tests/dashboard-shell.test.tsx
+++ b/web/tests/dashboard-shell.test.tsx
@@ -8,6 +8,10 @@ mock.module("../app/[locale]/dashboard/dashboard-account-menu", () => ({
DashboardAccountMenu: () => ,
}));
+mock.module("../app/[locale]/dashboard/dashboard-team-switcher", () => ({
+ DashboardTeamSwitcher: () => ,
+}));
+
mock.module("next-intl", () => ({
NextIntlClientProvider: ({ children }: { children: React.ReactNode }) =>
children,
@@ -49,6 +53,11 @@ describe("dashboard shell", () => {
expect(html.match(/data-testid="account-control"/g)).toHaveLength(1);
expect(html.match(/data-testid="theme-control"/g)).toHaveLength(1);
+ // The team scope lives once in the sidebar footer, above the account row.
+ expect(html.match(/data-testid="team-switcher"/g)).toHaveLength(1);
+ expect(html.indexOf('data-testid="team-switcher"')).toBeLessThan(
+ html.indexOf('data-testid="account-control"'),
+ );
expect(html).toContain('href="/dashboard/coderouter"');
const billingIndex = html.indexOf('href="/dashboard/billing"');
const teamIndex = html.indexOf('href="/dashboard/team"');
@@ -62,7 +71,7 @@ describe("dashboard shell", () => {
/]*id="dashboard-mobile-nav"[^>]*>/,
)?.[0];
expect(controlledNavigation).toContain("hidden");
- expect(html).toContain("pb-28");
+ expect(html).toContain("pb-40");
expect(html).toContain("max-h-[calc(100vh-6rem)]");
});
diff --git a/web/tests/dashboard-team-switcher.test.tsx b/web/tests/dashboard-team-switcher.test.tsx
new file mode 100644
index 000000000000..58bad2ca684e
--- /dev/null
+++ b/web/tests/dashboard-team-switcher.test.tsx
@@ -0,0 +1,146 @@
+import { describe, expect, mock, test } from "bun:test";
+import { renderToStaticMarkup } from "react-dom/server";
+import type React from "react";
+
+type Catalog = {
+ selectedTeamId: string | null;
+ teams: Array<{
+ id: string;
+ name: string;
+ personal: boolean;
+ permissions: { use: boolean; manageAccounts: boolean };
+ }>;
+};
+
+let catalog: Catalog | undefined;
+let pending = false;
+let currentUser: { id: string } | null = { id: "user-1" };
+let searchTeam: string | null = null;
+
+mock.module("@stackframe/stack", () => ({
+ useUser: () => currentUser,
+}));
+
+mock.module("@tanstack/react-query", () => ({
+ useQuery: () => ({ data: catalog, isPending: pending }),
+ useQueryClient: () => ({ setQueryData: () => undefined }),
+}));
+
+mock.module("next-intl", () => ({
+ useTranslations: () => (key: string) => key,
+}));
+
+mock.module("next/navigation", () => ({
+ useSearchParams: () => ({
+ get: (name: string) => (name === "team" ? searchTeam : null),
+ has: (name: string) => name === "team" && searchTeam !== null,
+ }),
+}));
+
+mock.module("@/i18n/navigation", () => ({
+ usePathname: () => "/dashboard/coderouter",
+ useRouter: () => ({ replace: () => undefined, refresh: () => undefined }),
+}));
+
+mock.module("@base-ui-components/react/menu", () => ({
+ Menu: {
+ Root: ({ children }: { children: React.ReactNode }) => {children}
,
+ Trigger: ({ children, ...props }: React.ButtonHTMLAttributes) => (
+
+ ),
+ Portal: ({ children }: { children: React.ReactNode }) => <>{children},
+ Positioner: ({ children }: { children: React.ReactNode }) => {children}
,
+ Popup: ({ children }: { children: React.ReactNode }) => {children}
,
+ Item: ({ children, ...props }: React.HTMLAttributes) => (
+
+ ),
+ },
+}));
+
+const { DashboardTeamSwitcher, parseTeamCatalog, selectedTeam, permittedTeams } = await import(
+ "../app/[locale]/dashboard/dashboard-team-switcher"
+);
+
+const twoTeams: Catalog = {
+ selectedTeamId: "team-2",
+ teams: [
+ {
+ id: "user-1",
+ name: "Lawrence",
+ personal: true,
+ permissions: { use: true, manageAccounts: true },
+ },
+ {
+ id: "team-2",
+ name: "Manaflow",
+ personal: false,
+ permissions: { use: true, manageAccounts: true },
+ },
+ {
+ id: "team-3",
+ name: "No access",
+ personal: false,
+ permissions: { use: false, manageAccounts: false },
+ },
+ ],
+};
+
+describe("dashboard team switcher", () => {
+ test("shows the persisted team as the current scope and lists only permitted teams", () => {
+ catalog = twoTeams;
+ pending = false;
+ searchTeam = null;
+
+ const html = renderToStaticMarkup();
+
+ expect(html).toContain("Manaflow");
+ expect(html.match(/data-testid="team-option"/g)).toHaveLength(2);
+ expect(html).not.toContain("No access");
+ // The trigger names the selected team before the option list does.
+ expect(html.indexOf("Manaflow")).toBeLessThan(html.indexOf('data-testid="team-option"'));
+ });
+
+ test("lets a ?team= deep link win over the persisted scope, like the server", () => {
+ catalog = twoTeams;
+ searchTeam = "user-1";
+
+ const html = renderToStaticMarkup();
+
+ expect(html.indexOf("Lawrence")).toBeLessThan(html.indexOf('data-testid="team-option"'));
+ });
+
+ test("renders a placeholder while loading and nothing when signed out", () => {
+ catalog = undefined;
+ pending = true;
+ expect(renderToStaticMarkup()).toContain("animate-pulse");
+
+ pending = false;
+ currentUser = null;
+ expect(renderToStaticMarkup()).toBe("");
+ currentUser = { id: "user-1" };
+ });
+
+ test("selection order matches the coderouter page", () => {
+ const teams = permittedTeams(twoTeams);
+ expect(teams.map((team) => team.id)).toEqual(["user-1", "team-2"]);
+ expect(selectedTeam(teams, "team-2", null).id).toBe("team-2");
+ expect(selectedTeam(teams, "team-2", "user-1").id).toBe("user-1");
+ expect(selectedTeam(teams, "stale", "missing").id).toBe("user-1");
+ expect(selectedTeam(teams, null, null).id).toBe("user-1");
+ });
+
+ test("rejects malformed catalogs instead of rendering them", () => {
+ expect(parseTeamCatalog({ selectedTeamId: null, teams: [] })).toEqual({
+ selectedTeamId: null,
+ teams: [],
+ });
+ expect(parseTeamCatalog({ teams: [{ id: "a" }] })).toBeNull();
+ expect(
+ parseTeamCatalog({
+ selectedTeamId: null,
+ teams: [twoTeams.teams[0], twoTeams.teams[0]],
+ }),
+ ).toBeNull();
+ expect(parseTeamCatalog({ selectedTeamId: " padded ", teams: [] })).toBeNull();
+ });
+});
From dd979a4183288400642a4f24ccea219c0c8c166d Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 22:58:09 -0700
Subject: [PATCH 02/12] web(dashboard): put the team picker inside the account
menu
The team scope was a separate row above the account row. It is now a
Team entry inside the bottom-left account menu, next to Settings and
Billing, that opens a submenu listing every permitted team with the
current one checked. The trigger shows the current team under the user
name. The scope hook moves to dashboard-team-scope.ts and keeps the
cookie-based switch. The sidebar shell is back to its main layout.
The "not configured" notice now says Codex accounts are hidden because
the hosted account service is not configured on this deployment.
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
.../dashboard/dashboard-account-menu.tsx | 97 ++++++++++++-
.../[locale]/dashboard/dashboard-shell.tsx | 12 +-
...m-switcher.tsx => dashboard-team-scope.ts} | 131 +++---------------
web/messages/en.json | 5 +-
web/messages/ja.json | 5 +-
web/tests/dashboard-account-menu.test.tsx | 44 +++++-
web/tests/dashboard-shell.test.tsx | 11 +-
...test.tsx => dashboard-team-scope.test.tsx} | 67 ++++-----
8 files changed, 189 insertions(+), 183 deletions(-)
rename web/app/[locale]/dashboard/{dashboard-team-switcher.tsx => dashboard-team-scope.ts} (54%)
rename web/tests/{dashboard-team-switcher.test.tsx => dashboard-team-scope.test.tsx} (57%)
diff --git a/web/app/[locale]/dashboard/dashboard-account-menu.tsx b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
index 6d2e15e433b1..f3b42b45a740 100644
--- a/web/app/[locale]/dashboard/dashboard-account-menu.tsx
+++ b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
@@ -7,6 +7,7 @@ import { useState } from "react";
import { localizedVaultPath, vaultSignInHref } from "@/app/lib/vault-auth";
import { Link, useRouter } from "@/i18n/navigation";
import { clearCoderouterOrganizationScope } from "@/services/coderouter/organizationScope";
+import { useDashboardTeamScope, type DashboardCatalogTeam } from "./dashboard-team-scope";
const menuItemClass =
"flex min-h-9 w-full cursor-default select-none items-center gap-2 px-2.5 py-2 text-left text-sm text-foreground no-underline outline-none data-[highlighted]:bg-code-bg";
@@ -16,6 +17,7 @@ export function DashboardAccountMenu() {
const locale = useLocale();
const router = useRouter();
const user = useUser({ or: "return-null" });
+ const teamScope = useDashboardTeamScope(user?.id ?? null);
const [signOutPending, setSignOutPending] = useState(false);
const [signOutError, setSignOutError] = useState(false);
const signInHref = vaultSignInHref(localizedVaultPath(locale, "/dashboard"));
@@ -41,8 +43,15 @@ export function DashboardAccountMenu() {
aria-label={t("label")}
>
-
- {user.displayName || user.primaryEmail}
+
+
+ {user.displayName || user.primaryEmail}
+
+ {teamScope.status === "ready" ? (
+
+ {teamScope.selected.name}
+
+ ) : null}
@@ -65,6 +74,13 @@ export function DashboardAccountMenu() {
{t("billing")}
+ {teamScope.status === "ready" ? (
+
+ ) : null}
void;
+}) {
+ const t = useTranslations("dashboard.teamSwitcher");
+ return (
+
+
+
+
+
+ {t("label")}
+ {selected.name}
+
+
+
+
+
+
+
+ {teams.map((team) => (
+ onSelect(team)}
+ >
+ {team.name}
+ {team.personal ? (
+ {t("personal")}
+ ) : null}
+ {team.id === selected.id ? : }
+
+ ))}
+
+
+
+
+ );
+}
+
+function TeamIcon() {
+ return (
+
+ );
+}
+
+function ChevronRight() {
+ return (
+
+ );
+}
+
+function CheckIcon() {
+ return (
+
+ );
+}
+
function ChevronsUpDown() {
return (
}
- className="flex-1 overflow-y-auto px-2 py-3 pb-40"
+ className="flex-1 overflow-y-auto px-2 py-3 pb-28"
/>
-
- }>
-
-
-
;
}
-function DashboardTeamSwitcherFallback() {
- return
;
-}
-
function DashboardNav({
groups,
trailing,
diff --git a/web/app/[locale]/dashboard/dashboard-team-switcher.tsx b/web/app/[locale]/dashboard/dashboard-team-scope.ts
similarity index 54%
rename from web/app/[locale]/dashboard/dashboard-team-switcher.tsx
rename to web/app/[locale]/dashboard/dashboard-team-scope.ts
index a4f77183068b..2b71ac2b9e55 100644
--- a/web/app/[locale]/dashboard/dashboard-team-switcher.tsx
+++ b/web/app/[locale]/dashboard/dashboard-team-scope.ts
@@ -1,9 +1,6 @@
"use client";
-import { Menu } from "@base-ui-components/react/menu";
-import { useUser } from "@stackframe/stack";
import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { useTranslations } from "next-intl";
import { useSearchParams } from "next/navigation";
import { usePathname, useRouter } from "@/i18n/navigation";
import { persistCoderouterOrganizationScope } from "@/services/coderouter/organizationScope";
@@ -23,48 +20,50 @@ export type DashboardCatalogTeam = {
};
};
-const CATALOG_TIMEOUT_MS = 10_000;
+export type DashboardTeamScope =
+ | { readonly status: "loading" }
+ | { readonly status: "unavailable" }
+ | {
+ readonly status: "ready";
+ readonly teams: readonly DashboardCatalogTeam[];
+ readonly selected: DashboardCatalogTeam;
+ readonly switchTeam: (team: DashboardCatalogTeam) => void;
+ };
-const menuItemClass =
- "flex min-h-9 w-full cursor-default select-none items-center gap-2 px-2.5 py-2 text-left text-sm text-foreground outline-none data-[highlighted]:bg-code-bg";
+const CATALOG_TIMEOUT_MS = 10_000;
/**
- * The dashboard-wide team scope, shown at the bottom of the sidebar. Every
- * team-scoped page reads the same persisted scope on the server, so switching
- * here changes what the whole dashboard shows without a page-level picker.
+ * The dashboard-wide team scope. Every team-scoped page reads the same
+ * persisted cookie on the server, so switching here changes what the whole
+ * dashboard shows without a page-level picker.
*/
-export function DashboardTeamSwitcher() {
- const t = useTranslations("dashboard.teamSwitcher");
- const user = useUser({ or: "return-null" });
+export function useDashboardTeamScope(userId: string | null): DashboardTeamScope {
const router = useRouter();
const pathname = usePathname();
const searchParams = useSearchParams();
const queryClient = useQueryClient();
- const queryKey = ["dashboard-team-catalog", user?.id ?? null] as const;
+ const queryKey = ["dashboard-team-catalog", userId] as const;
const { data, isPending } = useQuery({
queryKey,
queryFn: ({ signal }) => loadTeamCatalog(signal),
- enabled: user !== null,
+ enabled: userId !== null,
staleTime: 0,
refetchOnWindowFocus: "always",
refetchOnReconnect: "always",
});
- if (!user) return null;
- if (isPending) {
- return
;
- }
- if (!data) return null;
-
+ if (userId === null) return { status: "unavailable" };
+ if (isPending) return { status: "loading" };
+ if (!data) return { status: "unavailable" };
const teams = permittedTeams(data);
- if (teams.length === 0) return null;
+ if (teams.length === 0) return { status: "unavailable" };
const selected = selectedTeam(teams, data.selectedTeamId, searchParams.get("team"));
const switchTeam = (team: DashboardCatalogTeam) => {
if (team.id === selected.id) return;
// The scope cookie is what the server reads. Persisting it before the
// refresh means the very next render already shows the chosen team.
- persistCoderouterOrganizationScope(user.id, team.id);
+ persistCoderouterOrganizationScope(userId, team.id);
queryClient.setQueryData
(
queryKey,
(current) => current ? { ...current, selectedTeamId: team.id } : current,
@@ -76,46 +75,7 @@ export function DashboardTeamSwitcher() {
router.refresh();
};
- return (
-
-
-
-
-
- {selected.name}
-
- {selected.personal ? t("personal") : t("team")}
-
-
-
-
-
-
-
- {t("label")}
- {teams.map((team) => (
- switchTeam(team)}
- >
-
- {team.name}
- {team.personal ? (
- {t("personal")}
- ) : null}
- {team.id === selected.id ? : }
-
- ))}
-
-
-
-
-
,
+ SubmenuRoot: ({ children }: { children: React.ReactNode }) => {children}
,
+ SubmenuTrigger: ({ children, ...props }: React.HTMLAttributes) => (
+
+ ),
},
}));
+let teamScope: unknown = { status: "unavailable" };
+mock.module("../app/[locale]/dashboard/dashboard-team-scope", () => ({
+ useDashboardTeamScope: () => teamScope,
+}));
+
mock.module("next/navigation", () => ({
...createNextNavigationMock((target: unknown) => {
throw new Error(`redirect:${target}`);
@@ -87,9 +96,38 @@ describe("dashboard account menu", () => {
expect(html).toContain('href="/dashboard/team"');
expect(html).toContain('href="/dashboard/billing"');
expect(html).toContain("signOut");
- // No Stack auth team picker should render in the bottom-left.
- expect(html).not.toContain("team-switcher");
- expect(html).not.toContain("data-team-id");
+ // Without a team catalog the menu has no team entry at all.
+ expect(html).not.toContain("team-submenu");
+ });
+
+ test("lists every permitted team in a submenu and shows the current one on the trigger", () => {
+ currentUser = {
+ id: "user-lawrence",
+ displayName: "Lawrence",
+ primaryEmail: "lawrence@example.com",
+ signOut: async () => undefined,
+ };
+ const teams = [
+ { id: "user-lawrence", name: "Lawrence", personal: true, permissions: { use: true, manageAccounts: true } },
+ { id: "team-2", name: "Manaflow", personal: false, permissions: { use: true, manageAccounts: true } },
+ { id: "team-3", name: "Side project", personal: false, permissions: { use: true, manageAccounts: false } },
+ ];
+ teamScope = { status: "ready", teams, selected: teams[1], switchTeam: () => undefined };
+ const html = renderToStaticMarkup();
+ teamScope = { status: "unavailable" };
+
+ expect(html.match(/data-testid="team-submenu"/g)).toHaveLength(1);
+ const submenu = html.slice(html.indexOf('data-testid="team-submenu"'));
+ expect(submenu).toContain("Manaflow");
+ expect(submenu).toContain("Side project");
+ expect(submenu).toContain(">Lawrence<");
+ expect(submenu.match(/aria-checked="true"/g)).toHaveLength(1);
+ expect(submenu.match(/aria-checked="false"/g)).toHaveLength(2);
+ // The trigger row names the current team under the user's name.
+ expect(html.indexOf("Manaflow")).toBeLessThan(html.indexOf("/dashboard/team"));
+ // The team entry sits after settings and billing, before sign out.
+ expect(html.indexOf('data-testid="team-submenu"')).toBeGreaterThan(html.indexOf("/dashboard/billing"));
+ expect(html.indexOf('data-testid="team-submenu"')).toBeLessThan(html.indexOf("signOut"));
});
test("uses the unlocalized auth handler and names the compact sign-in link", () => {
diff --git a/web/tests/dashboard-shell.test.tsx b/web/tests/dashboard-shell.test.tsx
index 8324775b8c46..90132d818546 100644
--- a/web/tests/dashboard-shell.test.tsx
+++ b/web/tests/dashboard-shell.test.tsx
@@ -8,10 +8,6 @@ mock.module("../app/[locale]/dashboard/dashboard-account-menu", () => ({
DashboardAccountMenu: () => ,
}));
-mock.module("../app/[locale]/dashboard/dashboard-team-switcher", () => ({
- DashboardTeamSwitcher: () => ,
-}));
-
mock.module("next-intl", () => ({
NextIntlClientProvider: ({ children }: { children: React.ReactNode }) =>
children,
@@ -53,11 +49,6 @@ describe("dashboard shell", () => {
expect(html.match(/data-testid="account-control"/g)).toHaveLength(1);
expect(html.match(/data-testid="theme-control"/g)).toHaveLength(1);
- // The team scope lives once in the sidebar footer, above the account row.
- expect(html.match(/data-testid="team-switcher"/g)).toHaveLength(1);
- expect(html.indexOf('data-testid="team-switcher"')).toBeLessThan(
- html.indexOf('data-testid="account-control"'),
- );
expect(html).toContain('href="/dashboard/coderouter"');
const billingIndex = html.indexOf('href="/dashboard/billing"');
const teamIndex = html.indexOf('href="/dashboard/team"');
@@ -71,7 +62,7 @@ describe("dashboard shell", () => {
/]*id="dashboard-mobile-nav"[^>]*>/,
)?.[0];
expect(controlledNavigation).toContain("hidden");
- expect(html).toContain("pb-40");
+ expect(html).toContain("pb-28");
expect(html).toContain("max-h-[calc(100vh-6rem)]");
});
diff --git a/web/tests/dashboard-team-switcher.test.tsx b/web/tests/dashboard-team-scope.test.tsx
similarity index 57%
rename from web/tests/dashboard-team-switcher.test.tsx
rename to web/tests/dashboard-team-scope.test.tsx
index 58bad2ca684e..101fd9975457 100644
--- a/web/tests/dashboard-team-switcher.test.tsx
+++ b/web/tests/dashboard-team-scope.test.tsx
@@ -1,6 +1,5 @@
import { describe, expect, mock, test } from "bun:test";
import { renderToStaticMarkup } from "react-dom/server";
-import type React from "react";
type Catalog = {
selectedTeamId: string | null;
@@ -14,22 +13,13 @@ type Catalog = {
let catalog: Catalog | undefined;
let pending = false;
-let currentUser: { id: string } | null = { id: "user-1" };
let searchTeam: string | null = null;
-mock.module("@stackframe/stack", () => ({
- useUser: () => currentUser,
-}));
-
mock.module("@tanstack/react-query", () => ({
useQuery: () => ({ data: catalog, isPending: pending }),
useQueryClient: () => ({ setQueryData: () => undefined }),
}));
-mock.module("next-intl", () => ({
- useTranslations: () => (key: string) => key,
-}));
-
mock.module("next/navigation", () => ({
useSearchParams: () => ({
get: (name: string) => (name === "team" ? searchTeam : null),
@@ -42,25 +32,21 @@ mock.module("@/i18n/navigation", () => ({
useRouter: () => ({ replace: () => undefined, refresh: () => undefined }),
}));
-mock.module("@base-ui-components/react/menu", () => ({
- Menu: {
- Root: ({ children }: { children: React.ReactNode }) => {children}
,
- Trigger: ({ children, ...props }: React.ButtonHTMLAttributes) => (
-
- ),
- Portal: ({ children }: { children: React.ReactNode }) => <>{children},
- Positioner: ({ children }: { children: React.ReactNode }) => {children}
,
- Popup: ({ children }: { children: React.ReactNode }) => {children}
,
- Item: ({ children, ...props }: React.HTMLAttributes) => (
-
- ),
- },
-}));
-
-const { DashboardTeamSwitcher, parseTeamCatalog, selectedTeam, permittedTeams } = await import(
- "../app/[locale]/dashboard/dashboard-team-switcher"
+const { useDashboardTeamScope, parseTeamCatalog, selectedTeam, permittedTeams } = await import(
+ "../app/[locale]/dashboard/dashboard-team-scope"
);
+function Probe({ userId }: { userId: string | null }) {
+ const scope = useDashboardTeamScope(userId);
+ return (
+
+ {scope.status === "ready"
+ ? JSON.stringify({ selected: scope.selected.id, teams: scope.teams.map((team) => team.id) })
+ : ""}
+
+ );
+}
+
const twoTeams: Catalog = {
selectedTeamId: "team-2",
teams: [
@@ -85,39 +71,36 @@ const twoTeams: Catalog = {
],
};
-describe("dashboard team switcher", () => {
- test("shows the persisted team as the current scope and lists only permitted teams", () => {
+describe("dashboard team scope", () => {
+ test("exposes the persisted team as current and only permitted teams", () => {
catalog = twoTeams;
pending = false;
searchTeam = null;
- const html = renderToStaticMarkup();
+ const html = renderToStaticMarkup();
- expect(html).toContain("Manaflow");
- expect(html.match(/data-testid="team-option"/g)).toHaveLength(2);
- expect(html).not.toContain("No access");
- // The trigger names the selected team before the option list does.
- expect(html.indexOf("Manaflow")).toBeLessThan(html.indexOf('data-testid="team-option"'));
+ expect(html).toContain('data-status="ready"');
+ expect(html).toContain(""selected":"team-2"");
+ expect(html).toContain("["user-1","team-2"]");
+ expect(html).not.toContain("team-3");
});
test("lets a ?team= deep link win over the persisted scope, like the server", () => {
catalog = twoTeams;
searchTeam = "user-1";
- const html = renderToStaticMarkup();
+ const html = renderToStaticMarkup();
- expect(html.indexOf("Lawrence")).toBeLessThan(html.indexOf('data-testid="team-option"'));
+ expect(html).toContain(""selected":"user-1"");
});
- test("renders a placeholder while loading and nothing when signed out", () => {
+ test("reports loading while the catalog loads and unavailable when signed out", () => {
catalog = undefined;
pending = true;
- expect(renderToStaticMarkup()).toContain("animate-pulse");
+ expect(renderToStaticMarkup()).toContain('data-status="loading"');
pending = false;
- currentUser = null;
- expect(renderToStaticMarkup()).toBe("");
- currentUser = { id: "user-1" };
+ expect(renderToStaticMarkup()).toContain('data-status="unavailable"');
});
test("selection order matches the coderouter page", () => {
From fd92a8e211416df72a21274f3128a16d2b69df61 Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 23:05:20 -0700
Subject: [PATCH 03/12] web(dashboard): move the theme switch into the account
menu
The sidebar footer had a standalone sun/moon button next to the account
menu. The switch is now a menu item after Team, named after the theme it
switches to, and the footer holds only the account control. The toggle
logic is a shared useThemeToggle hook so the site header keeps its button.
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
.../dashboard/dashboard-account-menu.tsx | 26 +++++++++++++++++++
.../[locale]/dashboard/dashboard-shell.tsx | 2 --
web/app/[locale]/theme.tsx | 9 ++++++-
web/messages/en.json | 3 ++-
web/messages/ja.json | 3 ++-
web/tests/dashboard-account-menu.test.tsx | 22 ++++++++++++++++
web/tests/dashboard-shell.test.tsx | 9 +++----
7 files changed, 63 insertions(+), 11 deletions(-)
diff --git a/web/app/[locale]/dashboard/dashboard-account-menu.tsx b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
index f3b42b45a740..37a75ad2860d 100644
--- a/web/app/[locale]/dashboard/dashboard-account-menu.tsx
+++ b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
@@ -7,6 +7,7 @@ import { useState } from "react";
import { localizedVaultPath, vaultSignInHref } from "@/app/lib/vault-auth";
import { Link, useRouter } from "@/i18n/navigation";
import { clearCoderouterOrganizationScope } from "@/services/coderouter/organizationScope";
+import { useThemeToggle } from "@/app/[locale]/theme";
import { useDashboardTeamScope, type DashboardCatalogTeam } from "./dashboard-team-scope";
const menuItemClass =
@@ -18,6 +19,7 @@ export function DashboardAccountMenu() {
const router = useRouter();
const user = useUser({ or: "return-null" });
const teamScope = useDashboardTeamScope(user?.id ?? null);
+ const theme = useThemeToggle();
const [signOutPending, setSignOutPending] = useState(false);
const [signOutError, setSignOutError] = useState(false);
const signInHref = vaultSignInHref(localizedVaultPath(locale, "/dashboard"));
@@ -81,6 +83,17 @@ export function DashboardAccountMenu() {
onSelect={teamScope.switchTeam}
/>
) : null}
+ {
+ event.preventDefault();
+ theme.toggle();
+ }}
+ >
+
+ {theme.resolvedTheme === "dark" ? t("themeLight") : t("themeDark")}
+
+
+
+
+ ) : (
+
+ );
+}
+
function TeamIcon() {
return (
{
@@ -35,6 +36,12 @@ export function ThemeToggle() {
});
};
+ return { resolvedTheme, toggle };
+}
+
+export function ThemeToggle() {
+ const { toggle } = useThemeToggle();
+
return (
-
+
-
{copy.estimate.replace("{version}", metrics.rateCardVersion)}
+ {unpricedShare > 0
+ ? ` ${copy.unpriced.replace("{share}", percent.format(unpricedShare))}`
+ : ""}
);
@@ -409,12 +417,12 @@ function metricsCopy(locale: string) {
outputTokens: "出力トークン",
tokens: "合計トークン",
apiEquivalent: "API換算額",
- pricingCoverage: "価格対応率",
+ unpriced: "全トークンの {share} は価格が不明なモデルのもので、換算額に含まれていません。",
chartLabel: "日別のCodeRouterトークン使用量",
privacy:
"プロンプト、出力、アカウントラベル、メンバーIDは記録・表示しません。",
estimate:
- "API換算額は公開定価（レート表 {version}）による推定で、実際の請求額ではありません。価格不明のモデルは換算額から除外されます。",
+ "API換算額は、同じトークンを公開定価（レート表 {version}）で API 利用した場合の推定額で、実際の請求額ではありません。",
unavailable: "チーム使用状況は現在利用できません。",
};
}
@@ -426,12 +434,12 @@ function metricsCopy(locale: string) {
outputTokens: "Output tokens",
tokens: "Total tokens",
apiEquivalent: "API-equivalent value",
- pricingCoverage: "Pricing coverage",
+ unpriced: "{share} of these tokens came from models without a list price and are left out of that value.",
chartLabel: "Daily CodeRouter token usage",
privacy:
"No prompts, outputs, account labels, or member identities are recorded or shown.",
estimate:
- "API-equivalent value is an estimate using public list prices (rate card {version}), not actual spend. Models without a known price are excluded.",
+ "API-equivalent value is what these tokens would have cost at public API list prices (rate card {version}). It is not what you paid.",
unavailable: "Team usage is temporarily unavailable.",
};
}
@@ -494,6 +502,14 @@ async function loadSharedAccounts(
}
}
+async function loadNativeAccounts(teamId: string): Promise
{
+ try {
+ return { kind: "ok", accounts: await listNativeAccounts(teamId) };
+ } catch {
+ return { kind: "error" };
+ }
+}
+
async function loadClaudeAccounts(teamId: string): Promise {
try {
return { kind: "ok", accounts: await listClaudeAccounts(teamId) };
diff --git a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
index c297fcbda005..1089e0334a89 100644
--- a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
+++ b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
@@ -11,6 +11,7 @@ import type {
ClaudeUpstreamKind,
} from "../../../../services/coderouter/claudeUpstream";
import type { SubrouterAccount } from "../../../../services/subrouter/types";
+import type { CodeRouterAccountSummary } from "../../../../services/coderouter/types";
/**
* Every account the team routes through, in one list: the Claude upstream
@@ -23,6 +24,11 @@ export type ClaudeAccountsState =
| { readonly kind: "ok"; readonly accounts: readonly ClaudeAccountDescription[] }
| { readonly kind: "error" };
+/** Accounts `cr add` stores: Codex and OpenCode Go sign-ins routed by coderouter. */
+export type NativeAccountsState =
+ | { readonly kind: "ok"; readonly accounts: readonly CodeRouterAccountSummary[] }
+ | { readonly kind: "error" };
+
export type SharedAccountsState =
| { readonly kind: "ok"; readonly accounts: readonly SubrouterAccount[] }
| { readonly kind: "migrationPending" }
@@ -61,18 +67,21 @@ export function CoderouterAccountsSection({
teamId,
canManage,
claude,
+ native,
shared,
}: {
readonly teamId: string;
readonly canManage: boolean;
readonly claude: ClaudeAccountsState;
+ readonly native: NativeAccountsState;
readonly shared: SharedAccountsState;
}) {
const t = useTranslations("dashboard.coderouterAccounts");
const claudeAccounts = claude.kind === "ok" ? claude.accounts : [];
+ const nativeAccounts = native.kind === "ok" ? native.accounts : [];
const sharedAccounts = shared.kind === "ok" ? shared.accounts : [];
- const total = claudeAccounts.length + sharedAccounts.length;
- const partialFailure = claude.kind === "error" || shared.kind === "error";
+ const total = claudeAccounts.length + nativeAccounts.length + sharedAccounts.length;
+ const partialFailure = claude.kind === "error" || native.kind === "error" || shared.kind === "error";
return (
@@ -120,6 +129,14 @@ export function CoderouterAccountsSection({
canManage={canManage}
/>
))}
+ {nativeAccounts.map((account) => (
+
+ ))}
{sharedAccounts.map((account) => (
now.getTime();
+ const status = account.state === "broken"
+ ? t("stateBroken")
+ : account.state === "expired"
+ ? t("stateExpired")
+ : cooling
+ ? t("coolingDown", {
+ until: format.dateTime(new Date(account.cooldownUntil!), { timeStyle: "short" }),
+ })
+ : t("stateActive");
+ const sessions = t("activeSessions", { count: account.activeSessions });
+ return (
+ : null}
+ t={t}
+ />
+ );
+}
+
+function NativeAccountActions({
+ teamId,
+ accountId,
+}: {
+ readonly teamId: string;
+ readonly accountId: string;
+}) {
+ const t = useTranslations("dashboard.coderouterAccounts");
+ const router = useRouter();
+ const [status, setStatus] = useState(idleStatus);
+ const [confirmOpen, setConfirmOpen] = useState(false);
+
+ const remove = async () => {
+ if (status.state === "submitting") return;
+ setConfirmOpen(false);
+ setStatus({ state: "submitting" });
+ try {
+ const response = await fetch(
+ `/api/coderouter/accounts/${encodeURIComponent(accountId)}`,
+ { method: "DELETE", headers: { "x-cmux-team-id": teamId } },
+ );
+ if (!response.ok && response.status !== 404) {
+ setStatus({ state: "error", message: errorMessageForStatus(response.status, t, t("removeError")) });
+ return;
+ }
+ setStatus(idleStatus);
+ router.refresh();
+ } catch {
+ setStatus({ state: "error", message: t("removeError") });
+ }
+ };
+
+ return (
+
+ );
+}
+
function SharedAccountRow({
teamId,
account,
@@ -655,6 +759,16 @@ function addKindLabel(kind: AddKind, t: Translator): string {
}
}
+/** Provider names for accounts `cr add` stores. */
+function nativeKindLabel(kind: CodeRouterAccountSummary["provider"], t: Translator): string {
+ switch (kind) {
+ case "codex":
+ return t("kindCodex");
+ case "opencode-go":
+ return t("kindOpencodeGo");
+ }
+}
+
/** Provider names for accounts held by the hosted subrouter. */
function sharedKindLabel(kind: string, t: Translator): string {
switch (kind) {
diff --git a/web/messages/en.json b/web/messages/en.json
index 29b8c649190d..d24c9aceefa7 100644
--- a/web/messages/en.json
+++ b/web/messages/en.json
@@ -258,16 +258,21 @@
"kindBedrock": "Amazon Bedrock",
"kindCodex": "Codex",
"kindOpencode": "OpenCode",
+ "kindOpencodeGo": "OpenCode Go",
"kindOpenAiApiKey": "OpenAI API key",
"kindUnknown": "Unknown provider",
"stateActive": "Active",
"stateDisabled": "Disabled",
+ "stateRefreshing": "Refreshing",
+ "stateExpired": "Expired",
+ "stateBroken": "Sign-in broken",
"stateUnhealthy": "Needs attention",
"coolingDown": "Cooling down until {until}",
"lastFailure": "last failure {code}",
"lastUsed": "last used {at}",
"neverUsed": "never used",
"createdAt": "added {at}",
+ "activeSessions": "{count, plural, =0 {no active sessions} one {# active session} other {# active sessions}}",
"addTitle": "Add account",
"kindSelectorLabel": "Account kind",
"labelField": "Label",
@@ -298,6 +303,7 @@
"removeError": "Account could not be removed.",
"removeConfirmTitle": "Remove this account?",
"removeClaudeConfirmBody": "Machines pinned to it move to the team's other accounts. If it is the last one, Claude requests from this team fail until a new account is added.",
+ "removeNativeConfirmBody": "Sessions pinned to it move to the team's other accounts. Adding it back means signing in again with cr add.",
"removeSharedConfirmBody": "This removes the account for the whole team. Adding it back requires signing in again.",
"cancelAction": "Cancel"
},
diff --git a/web/messages/ja.json b/web/messages/ja.json
index 5e7f280f3c97..726875668659 100644
--- a/web/messages/ja.json
+++ b/web/messages/ja.json
@@ -258,16 +258,21 @@
"kindBedrock": "Amazon Bedrock",
"kindCodex": "Codex",
"kindOpencode": "OpenCode",
+ "kindOpencodeGo": "OpenCode Go",
"kindOpenAiApiKey": "OpenAI APIキー",
"kindUnknown": "不明なプロバイダー",
"stateActive": "有効",
"stateDisabled": "無効",
+ "stateRefreshing": "更新中",
+ "stateExpired": "期限切れ",
+ "stateBroken": "サインインが無効",
"stateUnhealthy": "要確認",
"coolingDown": "{until} までクールダウン中",
"lastFailure": "最後の失敗 {code}",
"lastUsed": "最終使用 {at}",
"neverUsed": "未使用",
"createdAt": "追加日 {at}",
+ "activeSessions": "{count} 件のアクティブセッション",
"addTitle": "アカウントを追加",
"kindSelectorLabel": "アカウントの種類",
"labelField": "ラベル",
@@ -298,6 +303,7 @@
"removeError": "アカウントを削除できませんでした。",
"removeConfirmTitle": "このアカウントを削除しますか?",
"removeClaudeConfirmBody": "このアカウントに固定されたマシンはチームの他のアカウントに移ります。最後のアカウントの場合、新しいアカウントを追加するまでこのチームからの Claude リクエストは失敗します。",
+ "removeNativeConfirmBody": "このアカウントに固定されたセッションはチームの他のアカウントに移ります。再追加には cr add で再度サインインが必要です。",
"removeSharedConfirmBody": "チーム全体からこのアカウントが削除されます。再追加には再度サインインが必要です。",
"cancelAction": "キャンセル"
},
diff --git a/web/tests/coderouter-accounts.test.tsx b/web/tests/coderouter-accounts.test.tsx
index 0422a89d4312..70b75275ca9b 100644
--- a/web/tests/coderouter-accounts.test.tsx
+++ b/web/tests/coderouter-accounts.test.tsx
@@ -59,6 +59,18 @@ const codexAccount = {
health: { ok: true },
};
+const nativeCodexAccount = {
+ id: "native-1",
+ provider: "codex" as const,
+ providerAccountId: "acct_9f3",
+ label: "lawrence@example.com",
+ state: "active" as const,
+ credentialExpiresAt: "2026-09-08T00:00:00.000Z",
+ lastFailureCode: null,
+ cooldownUntil: null,
+ activeSessions: 3,
+};
+
describe("coderouter accounts section", () => {
test("lists Claude upstream and shared Codex accounts in one table", () => {
const html = renderToStaticMarkup(
@@ -66,11 +78,14 @@ describe("coderouter accounts section", () => {
teamId="team-1"
canManage
claude={{ kind: "ok", accounts: [claudeAccount] }}
+ native={{ kind: "ok", accounts: [nativeCodexAccount] }}
shared={{ kind: "ok", accounts: [codexAccount] }}
/>,
);
- expect(html).toContain("2 accounts");
+ expect(html).toContain("3 accounts");
+ expect(html).toContain("lawrence@example.com");
+ expect(html).toContain("3 active sessions");
expect(html.match(/]*>/g)).toHaveLength(1);
expect(html).toContain("Claude Code OAuth");
expect(html).toContain("sk-ant-oat01-…a1b2");
@@ -88,6 +103,7 @@ describe("coderouter accounts section", () => {
teamId="team-1"
canManage
claude={{ kind: "ok", accounts: [] }}
+ native={{ kind: "ok", accounts: [] }}
shared={{ kind: "ok", accounts: [] }}
/>,
);
@@ -110,6 +126,7 @@ describe("coderouter accounts section", () => {
teamId="team-1"
canManage={false}
claude={{ kind: "ok", accounts: [claudeAccount] }}
+ native={{ kind: "ok", accounts: [nativeCodexAccount] }}
shared={{ kind: "ok", accounts: [codexAccount] }}
/>,
);
@@ -125,6 +142,7 @@ describe("coderouter accounts section", () => {
teamId="team-1"
canManage
claude={{ kind: "ok", accounts: [claudeAccount] }}
+ native={{ kind: "ok", accounts: [] }}
shared={{ kind: "error" }}
/>,
);
@@ -140,6 +158,7 @@ describe("coderouter accounts section", () => {
teamId="team-1"
canManage
claude={{ kind: "ok", accounts: [claudeAccount] }}
+ native={{ kind: "ok", accounts: [] }}
shared={{ kind: "migrationPending" }}
/>,
);
@@ -167,9 +186,12 @@ function valueAtPath(root: unknown, path: string): unknown {
function interpolate(message: string, values?: Record): string {
if (!values) return message;
return Object.entries(values).reduce((result, [key, value]) => {
- const plural = result.match(new RegExp(`\\{${key}, plural, one \\{([^}]*)\\} other \\{([^}]*)\\}\\}`));
+ const plural = result.match(new RegExp(`\\{${key}, plural, ((?:=\\d+ \\{[^}]*\\} )?)one \\{([^}]*)\\} other \\{([^}]*)\\}\\}`));
if (plural) {
- const form = value === 1 ? plural[1] : plural[2];
+ const exact = plural[1].match(/^=(\d+) \{([^}]*)\} $/);
+ const form = exact && Number(exact[1]) === value
+ ? exact[2]
+ : value === 1 ? plural[2] : plural[3];
return result.replace(plural[0], form.replaceAll("#", String(value)));
}
return result.replaceAll(`{${key}}`, String(value));
diff --git a/web/tests/dashboard-coderouter-page.test.tsx b/web/tests/dashboard-coderouter-page.test.tsx
index 9c9dc7f0b85c..ddc1653fd9fc 100644
--- a/web/tests/dashboard-coderouter-page.test.tsx
+++ b/web/tests/dashboard-coderouter-page.test.tsx
@@ -227,16 +227,19 @@ mock.module("../app/[locale]/dashboard/components/coderouter-accounts", () => ({
CoderouterAccountsSection: ({
shared,
claude,
+ native,
canManage,
}: {
shared: { kind: string };
claude: { kind: string };
+ native: { kind: string };
canManage: boolean;
}) => (
),
@@ -246,6 +249,10 @@ mock.module("../services/coderouter/claudeUpstream", () => ({
listClaudeAccounts: async () => [],
}));
+mock.module("../services/coderouter/repository", () => ({
+ listAccounts: async () => [],
+}));
+
const { default: CoderouterOverviewPage, CoderouterOverviewContent } = await import(
"../app/[locale]/dashboard/coderouter/page"
);
@@ -312,6 +319,7 @@ describe("coderouter dashboard", () => {
expect(hostedExchangeCalls).toBe(0);
expect(html).toContain('data-shared="migrationPending"');
expect(html).toContain('data-claude="ok"');
+ expect(html).toContain('data-native="ok"');
});
test("renders recovery UI when the bounded Stack session refresh fails", async () => {
@@ -356,6 +364,9 @@ describe("coderouter dashboard", () => {
expect(html).toContain("30-day usage");
expect(html).toContain("1.3K");
expect(html).toContain("$4.25");
+ // Every token was priced, so no coverage caveat and no coverage card.
+ expect(html).not.toContain("Pricing coverage");
+ expect(html).not.toContain("without a list price");
expect(html).toContain("No prompts, outputs, account labels, or member identities");
expect(html).not.toContain("stack-user");
});
From 1c30f5d2e831da56f9b52b2de6037aac900c8c5d Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Mon, 7 Sep 2026 23:20:06 -0700
Subject: [PATCH 05/12] coderouter: route Responses calls through OpenAI and
OpenRouter API keys
Teams can add an OpenAI API key or an OpenRouter API key as a coderouter
account next to their Codex sign-ins. The Responses surface
(/v1/responses, /v1/models) now selects from a provider pool: Codex
sign-ins go to the ChatGPT backend as before, an OpenAI key goes to
api.openai.com, and an OpenRouter key goes to openrouter.ai with bare
OpenAI model ids rewritten to openai/. Session stickiness,
placement spread, rate-limit cooldown and failover are unchanged; a key
the provider rejects is marked broken with last failure api_key_rejected
and the request moves on.
Keys are stored like every other credential (KMS envelope, AAD bound to
team/account/provider). The provider account id is a SHA-256 fingerprint
of the key, so re-adding a key updates the same row and the row never
carries the secret. API keys have no expiry and skip the refresher.
Migration 20260907150000 widens the provider CHECK on the three
coderouter tables. Run it on staging and production before merging.
The dashboard add panel gains OpenAI API key and OpenRouter API key
tabs posting to /api/coderouter/accounts.
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
.../components/coderouter-accounts.tsx | 97 +++++-
.../migration.sql | 20 ++
web/db/schema.ts | 8 +-
web/messages/en.json | 3 +
web/messages/ja.json | 3 +
web/services/coderouter/accounts.ts | 47 ++-
web/services/coderouter/analytics.ts | 1 +
web/services/coderouter/codexProxy.ts | 138 +++++++--
web/services/coderouter/encryption.ts | 12 +
web/services/coderouter/refresh.ts | 31 +-
web/services/coderouter/repository.ts | 73 +++--
web/services/coderouter/types.ts | 77 ++++-
web/tests/coderouter-accounts.test.tsx | 2 +
.../coderouter-api-key-providers.test.ts | 278 ++++++++++++++++++
web/tests/coderouter-models-proxy.test.ts | 2 +-
web/tests/coderouter-opencode-proxy.test.ts | 3 +-
web/tests/coderouter-refresh.test.ts | 8 +-
web/tests/coderouter-responses-proxy.test.ts | 14 +-
web/tests/coderouter-session-selector.test.ts | 5 +-
19 files changed, 744 insertions(+), 78 deletions(-)
create mode 100644 web/db/migrations/20260907150000_coderouter_api_key_providers/migration.sql
create mode 100644 web/tests/coderouter-api-key-providers.test.ts
diff --git a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
index 1089e0334a89..bbc4730d03c4 100644
--- a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
+++ b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
@@ -43,11 +43,14 @@ type FormStatus = {
const idleStatus: FormStatus = { state: "idle" };
/** Everything the add panel offers, in display order. */
-type AddKind = ClaudeUpstreamKind | "codex" | "opencode";
+type ApiKeyAddKind = "openai-apikey" | "openrouter-apikey";
+type AddKind = ClaudeUpstreamKind | ApiKeyAddKind | "codex" | "opencode";
const ADD_KINDS: readonly AddKind[] = [
"anthropic_api_key",
"anthropic_oauth",
"bedrock",
+ "openai-apikey",
+ "openrouter-apikey",
"codex",
"opencode",
];
@@ -81,6 +84,8 @@ export function CoderouterAccountsSection({
const nativeAccounts = native.kind === "ok" ? native.accounts : [];
const sharedAccounts = shared.kind === "ok" ? shared.accounts : [];
const total = claudeAccounts.length + nativeAccounts.length + sharedAccounts.length;
+ // Field ids are per form, so switching the add tab never leaves two inputs
+ // with one id.
const partialFailure = claude.kind === "error" || native.kind === "error" || shared.kind === "error";
return (
@@ -565,6 +570,8 @@ function AddAccountPanel({ teamId }: { readonly teamId: string }) {
command="npx coderouter@latest add opencode"
t={t}
/>
+ ) : kind === "openai-apikey" || kind === "openrouter-apikey" ? (
+
) : (
)}
@@ -593,6 +600,86 @@ function CliInstructions({
);
}
+/**
+ * Stores an OpenAI or OpenRouter key as a coderouter account. Codex on this
+ * team's machines then routes Responses calls through it, next to any Codex
+ * sign-ins, and moves off it on a rate limit or a rejected key.
+ */
+function ApiKeyForm({
+ teamId,
+ kind,
+}: {
+ readonly teamId: string;
+ readonly kind: ApiKeyAddKind;
+}) {
+ const t = useTranslations("dashboard.coderouterAccounts");
+ const router = useRouter();
+ const [status, setStatus] = useState(idleStatus);
+
+ const submit = async (event: FormEvent) => {
+ event.preventDefault();
+ if (status.state === "submitting") return;
+ const form = event.currentTarget;
+ const data = new FormData(form);
+ const label = String(data.get("label") ?? "").trim();
+ setStatus({ state: "submitting" });
+ try {
+ const response = await fetch("/api/coderouter/accounts", {
+ method: "POST",
+ headers: { "content-type": "application/json", "x-cmux-team-id": teamId },
+ body: JSON.stringify({
+ provider: kind,
+ apiKey: String(data.get("apiKey") ?? "").trim(),
+ ...(label ? { label } : {}),
+ }),
+ });
+ if (!response.ok) {
+ setStatus({
+ state: "error",
+ message: errorMessageForStatus(response.status, t, t("saveError")),
+ });
+ return;
+ }
+ form.reset();
+ setStatus({ state: "success", message: t("saveSuccess") });
+ router.refresh();
+ } catch {
+ setStatus({ state: "error", message: t("saveError") });
+ }
+ };
+
+ return (
+
+ );
+}
+
function ClaudeUpstreamForm({
teamId,
kind,
@@ -754,6 +841,10 @@ function addKindLabel(kind: AddKind, t: Translator): string {
return t("kindCodex");
case "opencode":
return t("kindOpencode");
+ case "openai-apikey":
+ return t("kindOpenAiApiKey");
+ case "openrouter-apikey":
+ return t("kindOpenRouterApiKey");
default:
return claudeKindLabel(kind, t);
}
@@ -766,6 +857,10 @@ function nativeKindLabel(kind: CodeRouterAccountSummary["provider"], t: Translat
return t("kindCodex");
case "opencode-go":
return t("kindOpencodeGo");
+ case "openai-apikey":
+ return t("kindOpenAiApiKey");
+ case "openrouter-apikey":
+ return t("kindOpenRouterApiKey");
}
}
diff --git a/web/db/migrations/20260907150000_coderouter_api_key_providers/migration.sql b/web/db/migrations/20260907150000_coderouter_api_key_providers/migration.sql
new file mode 100644
index 000000000000..c636b996c996
--- /dev/null
+++ b/web/db/migrations/20260907150000_coderouter_api_key_providers/migration.sql
@@ -0,0 +1,20 @@
+-- coderouter routes the OpenAI Responses surface through pasted OpenAI and
+-- OpenRouter API keys as well as Codex sign-ins. The provider check on every
+-- coderouter table widens to admit the two key-based providers.
+ALTER TABLE "coderouter_accounts"
+ DROP CONSTRAINT IF EXISTS "coderouter_accounts_provider_check";
+ALTER TABLE "coderouter_accounts"
+ ADD CONSTRAINT "coderouter_accounts_provider_check"
+ CHECK ("provider" IN ('codex', 'opencode-go', 'openai-apikey', 'openrouter-apikey'));
+
+ALTER TABLE "coderouter_credentials"
+ DROP CONSTRAINT IF EXISTS "coderouter_credentials_provider_check";
+ALTER TABLE "coderouter_credentials"
+ ADD CONSTRAINT "coderouter_credentials_provider_check"
+ CHECK ("provider" IN ('codex', 'opencode-go', 'openai-apikey', 'openrouter-apikey'));
+
+ALTER TABLE "coderouter_session_accounts"
+ DROP CONSTRAINT IF EXISTS "coderouter_session_accounts_provider_check";
+ALTER TABLE "coderouter_session_accounts"
+ ADD CONSTRAINT "coderouter_session_accounts_provider_check"
+ CHECK ("provider" IN ('codex', 'opencode-go', 'openai-apikey', 'openrouter-apikey'));
diff --git a/web/db/schema.ts b/web/db/schema.ts
index 63b1e7dcacaa..41a7f7fb2815 100644
--- a/web/db/schema.ts
+++ b/web/db/schema.ts
@@ -1085,12 +1085,14 @@ export const subrouterTenants = pgTable(
* live in the envelope-encrypted coderouterCredentials table; this table
* coordinates selection and rotating refresh-token leases.
*/
+type CodeRouterProviderColumn = "codex" | "opencode-go" | "openai-apikey" | "openrouter-apikey";
+
export const coderouterAccounts = pgTable(
"coderouter_accounts",
{
id: uuid("id").defaultRandom().primaryKey(),
teamId: text("team_id").notNull(),
- provider: text("provider").$type<"codex" | "opencode-go">().notNull(),
+ provider: text("provider").$type().notNull(),
providerAccountId: text("provider_account_id").notNull(),
label: text("label").notNull(),
state: text("state")
@@ -1166,7 +1168,7 @@ export const coderouterCredentials = pgTable(
.primaryKey()
.references(() => coderouterAccounts.id, { onDelete: "cascade" }),
teamId: text("team_id").notNull(),
- provider: text("provider").$type<"codex" | "opencode-go">().notNull(),
+ provider: text("provider").$type().notNull(),
credentialRevision: bigint("credential_revision", { mode: "number" })
.notNull(),
algorithm: text("algorithm").notNull().default("aes-256-gcm"),
@@ -1219,7 +1221,7 @@ export const coderouterSessionAccounts = pgTable(
"coderouter_session_accounts",
{
teamId: text("team_id").notNull(),
- provider: text("provider").$type<"codex" | "opencode-go">().notNull(),
+ provider: text("provider").$type().notNull(),
sessionKey: text("session_key").notNull(),
accountId: uuid("account_id")
.notNull()
diff --git a/web/messages/en.json b/web/messages/en.json
index d24c9aceefa7..cc9ce559db84 100644
--- a/web/messages/en.json
+++ b/web/messages/en.json
@@ -260,6 +260,7 @@
"kindOpencode": "OpenCode",
"kindOpencodeGo": "OpenCode Go",
"kindOpenAiApiKey": "OpenAI API key",
+ "kindOpenRouterApiKey": "OpenRouter API key",
"kindUnknown": "Unknown provider",
"stateActive": "Active",
"stateDisabled": "Disabled",
@@ -280,6 +281,8 @@
"apiKeyField": "API key",
"oauthTokenField": "OAuth token",
"oauthHint": "Create a long-lived token on your own machine with",
+ "openAiKeyHint": "Codex on this team's machines sends Responses API calls to api.openai.com with this key, alongside any Codex sign-ins. Billing goes to the OpenAI project that owns the key.",
+ "openRouterKeyHint": "Codex on this team's machines sends Responses API calls to OpenRouter with this key. Bare OpenAI model ids are sent as openai/.",
"regionField": "AWS region",
"accessKeyIdField": "Access key ID",
"secretAccessKeyField": "Secret access key",
diff --git a/web/messages/ja.json b/web/messages/ja.json
index 726875668659..f7be3c37cd6e 100644
--- a/web/messages/ja.json
+++ b/web/messages/ja.json
@@ -260,6 +260,7 @@
"kindOpencode": "OpenCode",
"kindOpencodeGo": "OpenCode Go",
"kindOpenAiApiKey": "OpenAI APIキー",
+ "kindOpenRouterApiKey": "OpenRouter APIキー",
"kindUnknown": "不明なプロバイダー",
"stateActive": "有効",
"stateDisabled": "無効",
@@ -280,6 +281,8 @@
"apiKeyField": "APIキー",
"oauthTokenField": "OAuthトークン",
"oauthHint": "自分のマシンで次のコマンドを実行して長期トークンを作成します:",
+ "openAiKeyHint": "このチームのマシン上の Codex は、Codex サインインと並んでこのキーで api.openai.com に Responses API を送信します。請求はキーを所有する OpenAI プロジェクトに行われます。",
+ "openRouterKeyHint": "このチームのマシン上の Codex は、このキーで OpenRouter に Responses API を送信します。ベンダー接頭辞のない OpenAI モデル ID は openai/ として送られます。",
"regionField": "AWSリージョン",
"accessKeyIdField": "アクセスキーID",
"secretAccessKeyField": "シークレットアクセスキー",
diff --git a/web/services/coderouter/accounts.ts b/web/services/coderouter/accounts.ts
index 4a7574508417..3e8177d13a06 100644
--- a/web/services/coderouter/accounts.ts
+++ b/web/services/coderouter/accounts.ts
@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
import {
findAccountByProviderIdentity,
deleteAccount,
@@ -8,7 +8,11 @@ import {
withVaultLease,
} from "./repository";
import { encryptCredential } from "./encryption";
-import type { CodeRouterCredential } from "./types";
+import {
+ CODEROUTER_API_KEY_PROVIDERS,
+ type CodeRouterApiKeyProvider,
+ type CodeRouterCredential,
+} from "./types";
import { deleteVaultCredential } from "./vault";
import { reportCoderouterFailure } from "./observability";
@@ -97,9 +101,14 @@ export const removeAccount = createAccountRemover({
report: reportCoderouterFailure,
});
+const MAX_API_KEY_LENGTH = 512;
+const MAX_LABEL_LENGTH = 120;
+const API_KEY_PATTERN = /^[A-Za-z0-9._~+/=-]+$/;
+
export function parseCredential(value: unknown): CodeRouterCredential | null {
if (!isRecord(value)) return null;
const provider = value.provider;
+ if (isApiKeyProviderName(provider)) return parseApiKeyCredential(provider, value);
const accessToken = boundedString(value.accessToken, 32_768);
const refreshToken = boundedString(value.refreshToken, 32_768);
const accountId = boundedString(value.accountId, 512);
@@ -147,6 +156,40 @@ export function parseCredential(value: unknown): CodeRouterCredential | null {
return null;
}
+function isApiKeyProviderName(value: unknown): value is CodeRouterApiKeyProvider {
+ return typeof value === "string" &&
+ (CODEROUTER_API_KEY_PROVIDERS as readonly string[]).includes(value);
+}
+
+/**
+ * `{ provider, apiKey, label? }` from the dashboard or `cr add`. The key is
+ * validated as one printable token; the fingerprint becomes the provider
+ * account id, so re-adding the same key updates the existing row.
+ */
+function parseApiKeyCredential(
+ provider: CodeRouterApiKeyProvider,
+ value: Record,
+): CodeRouterCredential | null {
+ const apiKey = typeof value.apiKey === "string" ? value.apiKey.trim() : "";
+ if (apiKey.length < 16 || apiKey.length > MAX_API_KEY_LENGTH || !API_KEY_PATTERN.test(apiKey)) {
+ return null;
+ }
+ const rawLabel = value.label;
+ if (rawLabel !== undefined && rawLabel !== null && typeof rawLabel !== "string") return null;
+ const label = typeof rawLabel === "string" ? rawLabel.trim() : "";
+ if (label.length > MAX_LABEL_LENGTH) return null;
+ return {
+ provider,
+ apiKey,
+ accountId: apiKeyFingerprint(provider, apiKey),
+ label,
+ };
+}
+
+export function apiKeyFingerprint(provider: CodeRouterApiKeyProvider, apiKey: string): string {
+ return createHash("sha256").update(`${provider}\n${apiKey}`).digest("hex").slice(0, 24);
+}
+
function boundedString(value: unknown, max: number): string | null {
return typeof value === "string" && value.length > 0 && value.length <= max
? value
diff --git a/web/services/coderouter/analytics.ts b/web/services/coderouter/analytics.ts
index 16629dc91fa9..7a27d13f65c9 100644
--- a/web/services/coderouter/analytics.ts
+++ b/web/services/coderouter/analytics.ts
@@ -418,6 +418,7 @@ function accountProvider(value: unknown): string | null {
"openai-apikey",
"anthropic-apikey",
"opencode-go",
+ "openrouter-apikey",
]);
}
diff --git a/web/services/coderouter/codexProxy.ts b/web/services/coderouter/codexProxy.ts
index 154a04b62e37..c2a8de0f36d7 100644
--- a/web/services/coderouter/codexProxy.ts
+++ b/web/services/coderouter/codexProxy.ts
@@ -6,6 +6,7 @@ import {
} from "./repository";
import { freshCredential } from "./refresh";
import { fetchProviderRead } from "./providerFetch";
+import { RESPONSES_PROVIDERS, type CodeRouterCredential } from "./types";
import { captureCoderouterEvent } from "./analytics";
import {
addCoderouterBreadcrumb,
@@ -37,6 +38,10 @@ import {
const CODEX_UPSTREAM = "https://chatgpt.com/backend-api/codex/responses";
const CODEX_MODELS_UPSTREAM = "https://chatgpt.com/backend-api/codex/models";
+const OPENAI_UPSTREAM = "https://api.openai.com/v1/responses";
+const OPENAI_MODELS_UPSTREAM = "https://api.openai.com/v1/models";
+const OPENROUTER_UPSTREAM = "https://openrouter.ai/api/v1/responses";
+const OPENROUTER_MODELS_UPSTREAM = "https://openrouter.ai/api/v1/models";
const ALLOWED_REQUEST_HEADERS = [
"accept",
"content-encoding",
@@ -228,7 +233,7 @@ async function proxyCodexRequestWith(
runtime.now,
(signal) => dependencies.select({
teamId: identity.teamId,
- provider: "codex",
+ provider: RESPONSES_PROVIDERS,
sessionKey,
excludedAccountIds: attempted,
signal,
@@ -308,7 +313,7 @@ async function proxyCodexRequestWith(
if (tag === "CodeRouterCredentialBroken") continue;
throw error;
}
- if (credential.provider !== "codex") continue;
+ if (!servesResponses(credential)) continue;
throwIfRequestAborted(request);
const headersTimeoutMs = remainingUpstreamHeadersTimeoutMs(
upstreamHeaderDeadlineAt,
@@ -321,7 +326,7 @@ async function proxyCodexRequestWith(
}
const upstreamStartedAt = performance.now();
try {
- upstream = await sendCodex(
+ upstream = await sendResponses(
request.clone(),
forwardedHeaders,
credential,
@@ -331,7 +336,7 @@ async function proxyCodexRequestWith(
recordCoderouterSpan({
name: "upstream_attempt",
startedAt: upstreamStartedAt,
- attributes: { provider: "codex", attempt: attempt + 1, status: upstream.status },
+ attributes: { provider: credential.provider, attempt: attempt + 1, status: upstream.status },
});
} catch (error) {
if (request.signal.aborted) throw error;
@@ -387,7 +392,7 @@ async function proxyCodexRequestWith(
break;
}
const retryStartedAt = performance.now();
- upstream = await sendCodex(
+ upstream = await sendResponses(
request.clone(),
forwardedHeaders,
refreshed,
@@ -547,7 +552,7 @@ export function createCodexModelsProxy(dependencies: CodexModelsDependencies) {
const selectStartedAt = performance.now();
const account = await dependencies.select(
identity.teamId,
- "codex",
+ RESPONSES_PROVIDERS,
attempted,
);
recordCoderouterSpan({
@@ -568,19 +573,13 @@ export function createCodexModelsProxy(dependencies: CodexModelsDependencies) {
failureStage = "credential_refresh";
continue;
}
- if (credential.provider !== "codex") continue;
- const upstreamUrl = new URL(CODEX_MODELS_UPSTREAM);
- upstreamUrl.search = new URL(request.url).search;
+ if (!servesResponses(credential)) continue;
+ const models = modelsRequest(credential, request);
const upstreamStartedAt = performance.now();
try {
upstream = await dependencies.providerRead(() =>
- fetch(upstreamUrl, {
- headers: {
- authorization: `Bearer ${credential.accessToken}`,
- "chatgpt-account-id": credential.accountId,
- originator: "codex_cli_rs",
- "user-agent": request.headers.get("user-agent") ?? "coderouter",
- },
+ fetch(models.url, {
+ headers: models.headers,
cache: "no-store",
signal: AbortSignal.timeout(5_000),
}),
@@ -669,29 +668,122 @@ export const proxyCodexModels = createCodexModelsProxy({
providerRead: fetchProviderRead,
});
-async function sendCodex(
+type ResponsesCredential = Extract<
+ CodeRouterCredential,
+ { provider: "codex" | "openai-apikey" | "openrouter-apikey" }
+>;
+
+function servesResponses(credential: CodeRouterCredential): credential is ResponsesCredential {
+ return (RESPONSES_PROVIDERS as readonly string[]).includes(credential.provider);
+}
+
+/**
+ * Forwards one Responses call to the account's own upstream. Codex sign-ins go
+ * to the ChatGPT backend with the account header; an OpenAI key goes to the
+ * public API; an OpenRouter key goes to OpenRouter, whose model catalog is
+ * vendor-prefixed, so a bare OpenAI model id is rewritten to `openai/`.
+ */
+async function sendResponses(
request: Request,
forwardedHeaders: Headers,
- credential: { accessToken: string; accountId: string },
+ credential: ResponsesCredential,
fetchImpl: typeof fetch,
headersTimeoutMs: number,
): Promise {
const headers = new Headers(forwardedHeaders);
- headers.set("authorization", `Bearer ${credential.accessToken}`);
- headers.set("chatgpt-account-id", credential.accountId);
- headers.set("originator", "coderouter");
+ let url = CODEX_UPSTREAM;
+ let body: BodyInit | null = request.body;
+ switch (credential.provider) {
+ case "codex":
+ headers.set("authorization", `Bearer ${credential.accessToken}`);
+ headers.set("chatgpt-account-id", credential.accountId);
+ headers.set("originator", "coderouter");
+ break;
+ case "openai-apikey":
+ url = OPENAI_UPSTREAM;
+ headers.set("authorization", `Bearer ${credential.apiKey}`);
+ headers.delete("session_id");
+ break;
+ case "openrouter-apikey":
+ url = OPENROUTER_UPSTREAM;
+ headers.set("authorization", `Bearer ${credential.apiKey}`);
+ headers.set("http-referer", "https://cmux.com");
+ headers.set("x-title", "cmux coderouter");
+ headers.delete("session_id");
+ headers.delete("openai-beta");
+ body = await openRouterBody(request);
+ break;
+ }
// Bounded to headers only: a hung upstream fails over instead of holding
// the function for the full maxDuration; the body streams unbounded.
- return await fetchWithHeadersTimeout(fetchImpl, CODEX_UPSTREAM, {
+ return await fetchWithHeadersTimeout(fetchImpl, url, {
method: "POST",
headers,
- body: request.body,
+ body,
signal: request.signal,
duplex: "half",
cache: "no-store",
} as RequestInit & { duplex: "half" }, headersTimeoutMs);
}
+/** Rewrites a bare model id to OpenRouter's `openai/`; anything else passes through. */
+async function openRouterBody(request: Request): Promise {
+ const text = await request.text();
+ try {
+ const parsed: unknown = JSON.parse(text);
+ if (
+ parsed && typeof parsed === "object" && !Array.isArray(parsed) &&
+ typeof (parsed as { model?: unknown }).model === "string"
+ ) {
+ return JSON.stringify({ ...parsed, model: openRouterModelId((parsed as { model: string }).model) });
+ }
+ } catch {
+ // Not JSON: forward as received and let OpenRouter answer.
+ }
+ return text;
+}
+
+export function openRouterModelId(model: string): string {
+ return model.includes("/") ? model : `openai/${model}`;
+}
+
+function modelsRequest(
+ credential: ResponsesCredential,
+ request: Request,
+): { readonly url: URL; readonly headers: Record } {
+ const userAgent = request.headers.get("user-agent") ?? "coderouter";
+ switch (credential.provider) {
+ case "codex": {
+ const url = new URL(CODEX_MODELS_UPSTREAM);
+ url.search = new URL(request.url).search;
+ return {
+ url,
+ headers: {
+ authorization: `Bearer ${credential.accessToken}`,
+ "chatgpt-account-id": credential.accountId,
+ originator: "codex_cli_rs",
+ "user-agent": userAgent,
+ },
+ };
+ }
+ case "openai-apikey":
+ return {
+ url: new URL(OPENAI_MODELS_UPSTREAM),
+ headers: { authorization: `Bearer ${credential.apiKey}`, "user-agent": userAgent },
+ };
+ case "openrouter-apikey":
+ return {
+ url: new URL(OPENROUTER_MODELS_UPSTREAM),
+ headers: {
+ authorization: `Bearer ${credential.apiKey}`,
+ "http-referer": "https://cmux.com",
+ "x-title": "cmux coderouter",
+ "user-agent": userAgent,
+ },
+ };
+ }
+}
+
function rateLimitDelay(headers: Headers): number {
const retryAfter = headers.get("retry-after");
if (retryAfter && /^\d+$/.test(retryAfter)) {
diff --git a/web/services/coderouter/encryption.ts b/web/services/coderouter/encryption.ts
index 7c1408ff3f32..4f42c8e02200 100644
--- a/web/services/coderouter/encryption.ts
+++ b/web/services/coderouter/encryption.ts
@@ -285,6 +285,9 @@ function strictBase64(value: string, label: string): Buffer {
function parseCredential(value: unknown): CodeRouterCredential | null {
if (!isRecord(value)) return null;
+ if (value.provider === "openai-apikey" || value.provider === "openrouter-apikey") {
+ return parseApiKeyCredential(value.provider, value);
+ }
const {
accessToken,
refreshToken,
@@ -333,6 +336,15 @@ function parseCredential(value: unknown): CodeRouterCredential | null {
return null;
}
+function parseApiKeyCredential(
+ provider: "openai-apikey" | "openrouter-apikey",
+ value: Record,
+): CodeRouterCredential | null {
+ return string(value.apiKey) && string(value.accountId) && typeof value.label === "string"
+ ? { provider, apiKey: value.apiKey, accountId: value.accountId, label: value.label }
+ : null;
+}
+
function string(value: unknown): value is string {
return typeof value === "string" && value.length > 0;
}
diff --git a/web/services/coderouter/refresh.ts b/web/services/coderouter/refresh.ts
index 5c5962079169..1ee81b380a0a 100644
--- a/web/services/coderouter/refresh.ts
+++ b/web/services/coderouter/refresh.ts
@@ -10,7 +10,7 @@ import {
encryptCredential,
type EncryptedCredential,
} from "./encryption";
-import type { CodeRouterCredential } from "./types";
+import { isApiKeyCredential, type ApiKeyCredential, type CodeRouterCredential } from "./types";
import { addCoderouterBreadcrumb, reportCoderouterFailure } from "./observability";
const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
@@ -73,6 +73,9 @@ export function createCredentialRefresher(
if (!input.signal?.aborted) reportCoderouterFailure("credential_decrypt", error);
throw error;
}
+ if (isApiKeyCredential(before.credential)) {
+ return await settleApiKeyCredential(dependencies, input, before.credential);
+ }
if (!input.force && before.credential.expiresAt > Date.now() + REFRESH_SKEW_MS) {
return before.credential;
}
@@ -97,7 +100,7 @@ export function createCredentialRefresher(
throwIfAborted(input.signal);
if (
!input.force &&
- current.credential.expiresAt > Date.now() + REFRESH_SKEW_MS
+ credentialExpiryMs(current.credential) > Date.now() + REFRESH_SKEW_MS
) {
await dependencies.release(input.accountId, leaseId, input.signal);
throwIfAborted(input.signal);
@@ -153,6 +156,29 @@ export function createCredentialRefresher(
};
}
+/**
+ * An API key has nothing to refresh. A forced refresh after a 401 means the
+ * provider rejected the key itself, so the account is marked broken (visible
+ * in the dashboard) and the request moves to the next account.
+ */
+async function settleApiKeyCredential(
+ dependencies: CredentialRefreshDependencies,
+ input: FreshCredentialInput,
+ credential: ApiKeyCredential,
+): Promise {
+ if (!input.force) return credential;
+ const leaseId = await dependencies.claim(input.accountId, new Date(), input.signal);
+ if (!leaseId) throw new CodeRouterRefreshBusy("credential refresh already in progress");
+ await dependencies.fail(input.accountId, leaseId, true, "api_key_rejected", input.signal)
+ .catch(() => undefined);
+ throw new CodeRouterCredentialBroken("provider rejected the API key");
+}
+
+/** API keys never expire; only a forced refresh reaches the provider for them. */
+function credentialExpiryMs(credential: CodeRouterCredential): number {
+ return isApiKeyCredential(credential) ? Number.POSITIVE_INFINITY : credential.expiresAt;
+}
+
function currentProvider(credential: CodeRouterCredential): string {
return credential.provider;
}
@@ -185,6 +211,7 @@ export async function refreshProviderCredential(
credential: CodeRouterCredential,
signal?: AbortSignal,
): Promise {
+ if (isApiKeyCredential(credential)) return credential;
if (credential.provider === "codex") {
const token = await postForm("https://auth.openai.com/oauth/token", {
grant_type: "refresh_token",
diff --git a/web/services/coderouter/repository.ts b/web/services/coderouter/repository.ts
index 2b8f6bf3b26c..8547c7ca6798 100644
--- a/web/services/coderouter/repository.ts
+++ b/web/services/coderouter/repository.ts
@@ -10,10 +10,12 @@ import {
coderouterVaultLeases,
} from "../../db/schema";
import type { EncryptedCredential } from "./encryption";
-import type {
- CodeRouterAccountSummary,
- CodeRouterCredential,
- CodeRouterProvider,
+import {
+ credentialExpiresAt,
+ credentialLabel,
+ type CodeRouterAccountSummary,
+ type CodeRouterCredential,
+ type CodeRouterProvider,
} from "./types";
const ROUTE_TOKEN_LIFETIME_MS = 30 * 24 * 60 * 60 * 1_000;
@@ -325,7 +327,7 @@ export async function insertAccountWithCredential(input: {
label,
state: "active",
vaultRevision: input.encrypted.credentialRevision,
- credentialExpiresAt: new Date(input.credential.expiresAt),
+ credentialExpiresAt: credentialExpiresAt(input.credential),
updatedAt: new Date(),
})
.onConflictDoNothing({
@@ -369,7 +371,7 @@ export async function replaceAccountCredential(input: {
label: credentialLabel(input.credential),
state: "active",
vaultRevision: input.encrypted.credentialRevision,
- credentialExpiresAt: new Date(input.credential.expiresAt),
+ credentialExpiresAt: credentialExpiresAt(input.credential),
refreshLeaseId: null,
refreshLeaseExpiresAt: null,
lastFailureCode: null,
@@ -419,7 +421,7 @@ export async function importEncryptedCredential(input: {
.set({
label: credentialLabel(input.credential),
vaultRevision: input.encrypted.credentialRevision,
- credentialExpiresAt: new Date(input.credential.expiresAt),
+ credentialExpiresAt: credentialExpiresAt(input.credential),
updatedAt: new Date(),
})
.where(and(
@@ -437,11 +439,7 @@ export async function upsertAccountMetadata(input: {
readonly vaultRevision: number;
}): Promise {
const providerAccountId = input.credential.accountId;
- const label = input.credential.email ||
- (input.credential.provider === "opencode-go"
- ? input.credential.orgName
- : undefined) ||
- providerAccountId;
+ const label = credentialLabel(input.credential);
await cloudDb()
.insert(coderouterAccounts)
.values({
@@ -452,7 +450,7 @@ export async function upsertAccountMetadata(input: {
label,
state: "active",
vaultRevision: input.vaultRevision,
- credentialExpiresAt: new Date(input.credential.expiresAt),
+ credentialExpiresAt: credentialExpiresAt(input.credential),
updatedAt: new Date(),
})
.onConflictDoUpdate({
@@ -465,7 +463,7 @@ export async function upsertAccountMetadata(input: {
label,
state: "active",
vaultRevision: input.vaultRevision,
- credentialExpiresAt: new Date(input.credential.expiresAt),
+ credentialExpiresAt: credentialExpiresAt(input.credential),
lastFailureCode: null,
updatedAt: new Date(),
},
@@ -495,10 +493,24 @@ export async function findAccountByProviderIdentity(
export type RoutedAccount = {
id: string;
+ provider: CodeRouterProvider;
vaultRevision: number;
credentialExpiresAt: Date | null;
};
+/** One provider or a pool of providers that serve the same API surface. */
+export type ProviderPool = CodeRouterProvider | readonly CodeRouterProvider[];
+
+function providerList(pool: ProviderPool): readonly CodeRouterProvider[] {
+ return typeof pool === "string" ? [pool] : pool;
+}
+
+function providerMatch(column: ReturnType, pool: ProviderPool) {
+ const providers = providerList(pool);
+ if (providers.length === 1) return sql`${column} = ${providers[0]}`;
+ return sql`${column} in (${sql.join(providers.map((provider) => sql`${provider}`), sql`, `)})`;
+}
+
export type StickyRoutedAccount = RoutedAccount & {
/** True when the session's existing account binding was honored. */
sticky: boolean;
@@ -538,7 +550,7 @@ async function sweepExpiredRefreshLeases(
*/
export async function findSessionAccount(
teamId: string,
- provider: CodeRouterProvider,
+ provider: ProviderPool,
sessionKey: string,
excludedAccountIds: readonly string[] = [],
signal?: AbortSignal,
@@ -571,7 +583,7 @@ export async function findSessionAccount(
async function findSessionAccountStatement(
teamId: string,
- provider: CodeRouterProvider,
+ provider: ProviderPool,
sessionKey: string,
excludedAccountIds: readonly string[],
signal?: AbortSignal,
@@ -581,7 +593,7 @@ async function findSessionAccountStatement(
set "last_seen_at" = now()
from "coderouter_accounts" as account
where binding."team_id" = ${teamId}
- and binding."provider" = ${provider}
+ and ${providerMatch(sql`binding."provider"`, provider)}
and binding."session_key" = ${sessionKey}
and account."id" = binding."account_id"
-- 'refreshing' is a healthy account with a credential refresh in
@@ -592,6 +604,7 @@ async function findSessionAccountStatement(
${accountExclusion(sql`account."id"`, excludedAccountIds)}
returning
account."id" as "id",
+ account."provider" as "provider",
account."vault_revision" as "vaultRevision",
account."credential_expires_at" as "credentialExpiresAt"
`));
@@ -607,7 +620,7 @@ async function findSessionAccountStatement(
*/
export async function claimAccountForPlacement(
teamId: string,
- provider: CodeRouterProvider,
+ provider: ProviderPool,
excludedAccountIds: readonly string[] = [],
signal?: AbortSignal,
): Promise {
@@ -623,7 +636,7 @@ export async function claimAccountForPlacement(
async function claimWithOrdering(
teamId: string,
- provider: CodeRouterProvider,
+ provider: ProviderPool,
excludedAccountIds: readonly string[],
withSessionLoad: boolean,
signal?: AbortSignal,
@@ -654,7 +667,7 @@ async function claimWithOrdering(
async function claimStatement(
teamId: string,
- provider: CodeRouterProvider,
+ provider: ProviderPool,
excludedAccountIds: readonly string[],
skipLocked: boolean,
withSessionLoad: boolean,
@@ -665,7 +678,7 @@ async function claimStatement(
select account."id"
from "coderouter_accounts" as account
where account."team_id" = ${teamId}
- and account."provider" = ${provider}
+ and ${providerMatch(sql`account."provider"`, provider)}
and account."state" = 'active'
and (account."cooldown_until" is null or account."cooldown_until" <= now())
${accountExclusion(sql`account."id"`, excludedAccountIds)}
@@ -689,6 +702,7 @@ async function claimStatement(
where claimed."id" = candidate."id"
returning
claimed."id" as "id",
+ claimed."provider" as "provider",
claimed."vault_revision" as "vaultRevision",
claimed."credential_expires_at" as "credentialExpiresAt"
`));
@@ -773,7 +787,7 @@ export function createSessionAccountSelector(
dependencies: SessionAccountSelectorDependencies,
): (input: {
teamId: string;
- provider: CodeRouterProvider;
+ provider: ProviderPool;
sessionKey: string | null;
excludedAccountIds?: readonly string[];
signal?: AbortSignal;
@@ -803,9 +817,11 @@ export function createSessionAccountSelector(
throwIfAborted(input.signal);
if (!placed) return null;
if (input.sessionKey) {
+ // The binding records the account's own provider, so a pooled surface
+ // (Codex sign-ins plus API keys) still finds it under any pool shape.
await dependencies.bind(
input.teamId,
- input.provider,
+ placed.provider,
input.sessionKey,
placed.id,
input.signal,
@@ -830,7 +846,7 @@ export const selectAccountForSession = createSessionAccountSelector({
export async function selectAccountForRequest(
teamId: string,
- provider: CodeRouterProvider,
+ provider: ProviderPool,
excludedAccountIds: readonly string[] = [],
signal?: AbortSignal,
): Promise {
@@ -855,6 +871,7 @@ function accountExclusion(
function routedAccountRow(row: Record): RoutedAccount {
return {
id: String(row.id),
+ provider: String(row.provider) as CodeRouterProvider,
vaultRevision: Number(row.vaultRevision),
credentialExpiresAt: row.credentialExpiresAt instanceof Date
? row.credentialExpiresAt
@@ -939,7 +956,7 @@ export async function completeRefreshLease(input: {
.set({
state: "active",
vaultRevision: input.encrypted.credentialRevision,
- credentialExpiresAt: new Date(input.credential.expiresAt),
+ credentialExpiresAt: credentialExpiresAt(input.credential),
refreshLeaseId: null,
refreshLeaseExpiresAt: null,
lastFailureCode: null,
@@ -1043,12 +1060,6 @@ export async function withVaultLease(
}
}
-function credentialLabel(credential: CodeRouterCredential): string {
- return credential.email ||
- (credential.provider === "opencode-go" ? credential.orgName : undefined) ||
- credential.accountId;
-}
-
function encryptedValues(encrypted: EncryptedCredential) {
return {
accountId: encrypted.accountId,
diff --git a/web/services/coderouter/types.ts b/web/services/coderouter/types.ts
index 390c30485cac..5cb1e7d2432b 100644
--- a/web/services/coderouter/types.ts
+++ b/web/services/coderouter/types.ts
@@ -1,4 +1,26 @@
-export type CodeRouterProvider = "codex" | "opencode-go";
+export type CodeRouterProvider =
+ | "codex"
+ | "opencode-go"
+ | "openai-apikey"
+ | "openrouter-apikey";
+
+/** Providers whose credentials are OAuth tokens that expire and refresh. */
+export type CodeRouterOAuthProvider = "codex" | "opencode-go";
+
+/** Providers whose credential is one long-lived API key. */
+export type CodeRouterApiKeyProvider = "openai-apikey" | "openrouter-apikey";
+
+export const CODEROUTER_API_KEY_PROVIDERS: readonly CodeRouterApiKeyProvider[] = [
+ "openai-apikey",
+ "openrouter-apikey",
+];
+
+/** Every provider that can serve the OpenAI Responses surface (`/v1/responses`, `/v1/models`). */
+export const RESPONSES_PROVIDERS: readonly CodeRouterProvider[] = [
+ "codex",
+ "openai-apikey",
+ "openrouter-apikey",
+];
export type CodexCredential = {
readonly provider: "codex";
@@ -21,7 +43,58 @@ export type OpenCodeGoCredential = {
readonly expiresAt: number;
};
-export type CodeRouterCredential = CodexCredential | OpenCodeGoCredential;
+/**
+ * A pasted OpenAI or OpenRouter API key. `accountId` is a fingerprint of the
+ * key, so the same key added twice is one account and the row never carries
+ * the key itself. `label` is what the dashboard shows; the masked key is the
+ * fallback. API keys have no expiry, so there is no refresh token.
+ */
+export type ApiKeyCredential = {
+ readonly provider: CodeRouterApiKeyProvider;
+ readonly apiKey: string;
+ readonly accountId: string;
+ readonly label: string;
+};
+
+export type OAuthCredential = CodexCredential | OpenCodeGoCredential;
+
+export type CodeRouterCredential = OAuthCredential | ApiKeyCredential;
+
+export function isApiKeyCredential(
+ credential: CodeRouterCredential,
+): credential is ApiKeyCredential {
+ return credential.provider === "openai-apikey" || credential.provider === "openrouter-apikey";
+}
+
+export function isApiKeyProvider(
+ provider: CodeRouterProvider,
+): provider is CodeRouterApiKeyProvider {
+ return provider === "openai-apikey" || provider === "openrouter-apikey";
+}
+
+/** When the stored credential stops working on its own. API keys never do. */
+export function credentialExpiresAt(credential: CodeRouterCredential): Date | null {
+ return isApiKeyCredential(credential) ? null : new Date(credential.expiresAt);
+}
+
+/** The dashboard name for an account: the sign-in email, org, label, or a masked key. */
+export function credentialLabel(credential: CodeRouterCredential): string {
+ if (isApiKeyCredential(credential)) {
+ return credential.label || maskApiKey(credential.apiKey);
+ }
+ return credential.email ||
+ (credential.provider === "opencode-go" ? credential.orgName : undefined) ||
+ credential.accountId;
+}
+
+/** `sk-or-v1-…a1b2`: enough to tell keys apart, never enough to use one. */
+export function maskApiKey(apiKey: string): string {
+ const trimmed = apiKey.trim();
+ if (trimmed.length <= 12) return "…";
+ const prefixEnd = trimmed.lastIndexOf("-", 12);
+ const prefix = prefixEnd > 0 ? trimmed.slice(0, prefixEnd + 1) : trimmed.slice(0, 5);
+ return `${prefix}…${trimmed.slice(-4)}`;
+}
export type VaultAccount = {
readonly revision: number;
diff --git a/web/tests/coderouter-accounts.test.tsx b/web/tests/coderouter-accounts.test.tsx
index 70b75275ca9b..8a7cb17f5bc4 100644
--- a/web/tests/coderouter-accounts.test.tsx
+++ b/web/tests/coderouter-accounts.test.tsx
@@ -113,6 +113,8 @@ describe("coderouter accounts section", () => {
"Anthropic API key",
"Claude Code OAuth",
"Amazon Bedrock",
+ "OpenAI API key",
+ "OpenRouter API key",
"Codex",
"OpenCode",
]);
diff --git a/web/tests/coderouter-api-key-providers.test.ts b/web/tests/coderouter-api-key-providers.test.ts
new file mode 100644
index 000000000000..070e7b99aa6c
--- /dev/null
+++ b/web/tests/coderouter-api-key-providers.test.ts
@@ -0,0 +1,278 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { apiKeyFingerprint, parseCredential } from "../services/coderouter/accounts";
+import {
+ CodeRouterCredentialBroken,
+ createCredentialRefresher,
+ type CredentialRefreshDependencies,
+} from "../services/coderouter/refresh";
+import type { EncryptedCredential } from "../services/coderouter/encryption";
+import {
+ credentialExpiresAt,
+ credentialLabel,
+ maskApiKey,
+ type ApiKeyCredential,
+ type CodeRouterCredential,
+} from "../services/coderouter/types";
+
+type UpstreamCall = { url: string; headers: Headers; body: string };
+let upstreamCalls: UpstreamCall[] = [];
+let upstreamStatuses: number[] = [];
+let accountsToServe: { id: string; credential: CodeRouterCredential }[] = [];
+let cooldowns: { accountId: string; durationMs: number }[] = [];
+let forcedRefreshes: string[] = [];
+
+const originalFetch = globalThis.fetch;
+beforeAll(() => {
+ globalThis.fetch = mock(async (...args: unknown[]) => {
+ const input = args[0] as string | URL | Request;
+ const init = args[1] as RequestInit | undefined;
+ const request = input instanceof Request ? input : new Request(input, init);
+ upstreamCalls.push({
+ url: request.url,
+ headers: request.headers,
+ body: request.method === "POST" ? await request.text() : "",
+ });
+ const status = upstreamStatuses.shift() ?? 200;
+ return new Response("data: done\n\n", {
+ status,
+ headers: { "content-type": "text/event-stream" },
+ });
+ }) as typeof fetch;
+});
+afterAll(() => {
+ globalThis.fetch = originalFetch;
+});
+
+const { createCodexModelsProxy, createCodexResponsesProxy, openRouterModelId } = await import(
+ "../services/coderouter/codexProxy"
+);
+
+const openAiKey: ApiKeyCredential = {
+ provider: "openai-apikey",
+ apiKey: "sk-proj-0123456789abcdef0123456789abcdef",
+ accountId: "fp-openai",
+ label: "team openai",
+};
+const openRouterKey: ApiKeyCredential = {
+ provider: "openrouter-apikey",
+ apiKey: "sk-or-v1-0123456789abcdef0123456789abcdef",
+ accountId: "fp-openrouter",
+ label: "",
+};
+const codexSignIn: CodeRouterCredential = {
+ provider: "codex",
+ accessToken: "codex-access",
+ refreshToken: "codex-refresh",
+ idToken: "codex-id",
+ accountId: "chatgpt-account",
+ email: "person@example.com",
+ expiresAt: Date.now() + 60_000,
+};
+
+const authenticate = async () => ({ teamId: "team-1", stackUserId: "user-1", vmId: null });
+const credentialFor = () => {
+ const served = accountsToServe.find((account) => account.id === lastSelected);
+ if (!served) throw new Error("no credential for account");
+ return served.credential;
+};
+let lastSelected = "";
+const nextAccount = () => {
+ const next = accountsToServe[selectIndex++];
+ if (!next) return null;
+ lastSelected = next.id;
+ return { id: next.id, provider: next.credential.provider, vaultRevision: 1, credentialExpiresAt: null };
+};
+let selectIndex = 0;
+
+const responses = createCodexResponsesProxy({
+ authenticate,
+ select: async () => {
+ const account = nextAccount();
+ return account ? { ...account, sticky: false } : null;
+ },
+ credential: async (input) => {
+ const credential = credentialFor();
+ if (input.force) {
+ forcedRefreshes.push(input.accountId);
+ if (credential.provider === "openai-apikey" || credential.provider === "openrouter-apikey") {
+ // What the real refresher does: mark the key broken, then throw.
+ throw new CodeRouterCredentialBroken("provider rejected the API key");
+ }
+ }
+ return credential;
+ },
+ cooldown: async (accountId, durationMs) => {
+ cooldowns.push({ accountId, durationMs });
+ },
+});
+
+const models = createCodexModelsProxy({
+ authenticate,
+ select: async () => nextAccount(),
+ credential: async () => credentialFor(),
+ cooldown: async () => {},
+ providerRead: async (request) => await request(),
+});
+
+beforeEach(() => {
+ upstreamCalls = [];
+ upstreamStatuses = [];
+ accountsToServe = [];
+ cooldowns = [];
+ forcedRefreshes = [];
+ selectIndex = 0;
+ lastSelected = "";
+});
+
+function responsesRequest(body: unknown = { model: "gpt-5.3-codex", input: [] }): Request {
+ return new Request("https://coderouter.dev/v1/responses", {
+ method: "POST",
+ headers: {
+ authorization: "Bearer crt_token",
+ "content-type": "application/json",
+ session_id: "session-1",
+ "openai-beta": "responses=experimental",
+ },
+ body: JSON.stringify(body),
+ });
+}
+
+describe("API key credentials", () => {
+ test("parses a pasted key into a fingerprinted account with no secret in the id", () => {
+ const parsed = parseCredential({
+ provider: "openrouter-apikey",
+ apiKey: " sk-or-v1-0123456789abcdef0123456789abcdef ",
+ label: " personal ",
+ });
+ expect(parsed).toEqual({
+ provider: "openrouter-apikey",
+ apiKey: "sk-or-v1-0123456789abcdef0123456789abcdef",
+ accountId: apiKeyFingerprint("openrouter-apikey", "sk-or-v1-0123456789abcdef0123456789abcdef"),
+ label: "personal",
+ });
+ expect(parsed?.accountId).not.toContain("sk-or");
+ expect(parsed?.accountId).toHaveLength(24);
+ });
+
+ test("rejects short, malformed, or mistyped keys", () => {
+ expect(parseCredential({ provider: "openai-apikey", apiKey: "short" })).toBeNull();
+ expect(parseCredential({ provider: "openai-apikey", apiKey: "sk-proj-with spaces inside the key" })).toBeNull();
+ expect(parseCredential({ provider: "openai-apikey", apiKey: 42 })).toBeNull();
+ expect(parseCredential({ provider: "openai-apikey", apiKey: "sk-proj-0123456789abcdef", label: 1 })).toBeNull();
+ expect(parseCredential({ provider: "anthropic-apikey", apiKey: "sk-ant-0123456789abcdef" })).toBeNull();
+ });
+
+ test("labels fall back to a masked key and API keys never expire", () => {
+ expect(credentialLabel(openAiKey)).toBe("team openai");
+ expect(credentialLabel(openRouterKey)).toBe("sk-or-v1-…cdef");
+ expect(maskApiKey("sk-proj-0123456789abcdef0123456789abcdef")).toBe("sk-proj-…cdef");
+ expect(credentialExpiresAt(openAiKey)).toBeNull();
+ expect(credentialExpiresAt(codexSignIn)).toBeInstanceOf(Date);
+ });
+
+ test("the refresher returns an API key as-is, and a forced refresh marks the account broken", async () => {
+ let claims = 0;
+ let failed: { terminal: boolean; code: string } | null = null;
+ const envelope: EncryptedCredential = {
+ accountId: "00000000-0000-4000-8000-000000000001",
+ teamId: "team-1",
+ provider: "openai-apikey",
+ credentialRevision: 1,
+ algorithm: "aes-256-gcm",
+ ciphertext: "c",
+ nonce: "n",
+ authTag: "t",
+ encryptedDataKey: "k",
+ kmsKeyId: "kms",
+ };
+ const dependencies: CredentialRefreshDependencies = {
+ read: async () => ({ envelope, credential: openAiKey }),
+ decrypt: async () => openAiKey,
+ claim: async () => {
+ claims += 1;
+ return "lease";
+ },
+ release: async () => {},
+ refresh: async (credential) => credential,
+ encrypt: async () => envelope,
+ complete: async () => {},
+ fail: async (_accountId, _leaseId, terminal, code) => {
+ failed = { terminal, code };
+ },
+ isTerminal: () => false,
+ failureCode: () => "n/a",
+ };
+ const refresh = createCredentialRefresher(dependencies);
+ expect(await refresh({ teamId: "team-1", accountId: envelope.accountId, expectedRevision: 1 })).toBe(openAiKey);
+ expect(claims).toBe(0);
+ await expect(
+ refresh({ teamId: "team-1", accountId: envelope.accountId, expectedRevision: 1, force: true }),
+ ).rejects.toBeInstanceOf(CodeRouterCredentialBroken);
+ expect(claims).toBe(1);
+ expect(failed).toEqual({ terminal: true, code: "api_key_rejected" });
+ });
+});
+
+describe("responses routing through API keys", () => {
+ test("sends an OpenAI key to api.openai.com with a bearer header and no ChatGPT account header", async () => {
+ accountsToServe = [{ id: "acct-openai", credential: openAiKey }];
+ const response = await responses(responsesRequest());
+ expect(response.status).toBe(200);
+ expect(upstreamCalls).toHaveLength(1);
+ const call = upstreamCalls[0]!;
+ expect(call.url).toBe("https://api.openai.com/v1/responses");
+ expect(call.headers.get("authorization")).toBe(`Bearer ${openAiKey.apiKey}`);
+ expect(call.headers.get("chatgpt-account-id")).toBeNull();
+ expect(call.headers.get("session_id")).toBeNull();
+ expect(call.headers.get("openai-beta")).toBe("responses=experimental");
+ expect(JSON.parse(call.body)).toEqual({ model: "gpt-5.3-codex", input: [] });
+ });
+
+ test("sends an OpenRouter key to openrouter.ai and vendor-prefixes a bare model id", async () => {
+ accountsToServe = [{ id: "acct-or", credential: openRouterKey }];
+ const response = await responses(responsesRequest({ model: "gpt-5.3-codex", input: [], store: false }));
+ expect(response.status).toBe(200);
+ const call = upstreamCalls[0]!;
+ expect(call.url).toBe("https://openrouter.ai/api/v1/responses");
+ expect(call.headers.get("authorization")).toBe(`Bearer ${openRouterKey.apiKey}`);
+ expect(call.headers.get("x-title")).toBe("cmux coderouter");
+ expect(call.headers.get("openai-beta")).toBeNull();
+ expect(JSON.parse(call.body)).toEqual({ model: "openai/gpt-5.3-codex", input: [], store: false });
+ });
+
+ test("keeps a vendor-prefixed model id untouched for OpenRouter", () => {
+ expect(openRouterModelId("anthropic/claude-sonnet-4")).toBe("anthropic/claude-sonnet-4");
+ expect(openRouterModelId("gpt-5")).toBe("openai/gpt-5");
+ });
+
+ test("a Codex sign-in in the same pool still goes to the ChatGPT backend", async () => {
+ accountsToServe = [{ id: "acct-codex", credential: codexSignIn }];
+ await responses(responsesRequest());
+ const call = upstreamCalls[0]!;
+ expect(call.url).toBe("https://chatgpt.com/backend-api/codex/responses");
+ expect(call.headers.get("chatgpt-account-id")).toBe("chatgpt-account");
+ });
+
+ test("a rejected API key is treated as broken and the request fails over", async () => {
+ accountsToServe = [
+ { id: "acct-or", credential: openRouterKey },
+ { id: "acct-codex", credential: codexSignIn },
+ ];
+ upstreamStatuses = [401, 200];
+ const response = await responses(responsesRequest());
+ expect(response.status).toBe(200);
+ expect(forcedRefreshes).toEqual(["acct-or"]);
+ expect(cooldowns).toEqual([]);
+ expect(upstreamCalls.map((call) => new URL(call.url).host)).toEqual(["openrouter.ai", "chatgpt.com"]);
+ });
+
+ test("model discovery uses each provider's own catalog", async () => {
+ accountsToServe = [{ id: "acct-or", credential: openRouterKey }];
+ const listed = await models(new Request("https://coderouter.dev/v1/models?client_version=1", {
+ headers: { authorization: "Bearer crt_route" },
+ }));
+ expect(listed.status).toBe(200);
+ expect(upstreamCalls[0]!.url).toBe("https://openrouter.ai/api/v1/models");
+ expect(upstreamCalls[0]!.headers.get("authorization")).toBe(`Bearer ${openRouterKey.apiKey}`);
+ });
+});
diff --git a/web/tests/coderouter-models-proxy.test.ts b/web/tests/coderouter-models-proxy.test.ts
index 6e9637fe4708..c0735c73a17b 100644
--- a/web/tests/coderouter-models-proxy.test.ts
+++ b/web/tests/coderouter-models-proxy.test.ts
@@ -32,7 +32,7 @@ const proxyCodexModels = createCodexModelsProxy({
select: async () => {
const id = selectedAccounts.shift();
return id
- ? { id, vaultRevision: 1, credentialExpiresAt: new Date() }
+ ? { id, provider: "codex" as const, vaultRevision: 1, credentialExpiresAt: new Date() }
: null;
},
credential: async ({ accountId }) => {
diff --git a/web/tests/coderouter-opencode-proxy.test.ts b/web/tests/coderouter-opencode-proxy.test.ts
index 42211bba3bb7..ba826ec320a0 100644
--- a/web/tests/coderouter-opencode-proxy.test.ts
+++ b/web/tests/coderouter-opencode-proxy.test.ts
@@ -76,7 +76,7 @@ describe("coderouter OpenCode Go proxy", () => {
selected.push(...(excluded ?? []));
const id = ids.shift();
return id
- ? { id, vaultRevision: 1, credentialExpiresAt: new Date() }
+ ? { id, provider: "codex" as const, vaultRevision: 1, credentialExpiresAt: new Date() }
: null;
},
credential: async ({ accountId }) => {
@@ -119,6 +119,7 @@ describe("coderouter OpenCode Go proxy VM-bound route tokens", () => {
},
select: async () => ({
id: "acct-1",
+ provider: "codex" as const,
vaultRevision: 1,
credentialExpiresAt: new Date(),
}),
diff --git a/web/tests/coderouter-refresh.test.ts b/web/tests/coderouter-refresh.test.ts
index 254da6f21c3d..bd0bbb38f5cf 100644
--- a/web/tests/coderouter-refresh.test.ts
+++ b/web/tests/coderouter-refresh.test.ts
@@ -60,7 +60,7 @@ describe("coderouter credential refresh coordination", () => {
await didClaim;
await expect(refresh(input())).rejects.toBeInstanceOf(CodeRouterRefreshBusy);
releaseProvider();
- expect((await first).refreshToken).toBe("new-refresh");
+ expect(((await first) as CodexCredential).refreshToken).toBe("new-refresh");
});
test("an abandoned lease becomes claimable after expiry", async () => {
@@ -76,7 +76,7 @@ describe("coderouter credential refresh coordination", () => {
const refresh = createCredentialRefresher(dependencies);
await expect(refresh(input())).rejects.toBeInstanceOf(CodeRouterRefreshBusy);
now = 1_001;
- expect((await refresh(input())).accessToken).toBe("new-access");
+ expect(((await refresh(input())) as CodexCredential).accessToken).toBe("new-access");
});
test("persists a rotated provider refresh token at the next revision", async () => {
@@ -88,9 +88,9 @@ describe("coderouter credential refresh coordination", () => {
completed = value;
},
}));
- const result = await refresh(input());
+ const result = (await refresh(input())) as CodexCredential;
expect(result.refreshToken).toBe("new-refresh");
- expect(completed?.credential.refreshToken).toBe("new-refresh");
+ expect((completed?.credential as CodexCredential | undefined)?.refreshToken).toBe("new-refresh");
expect(completed?.encrypted.credentialRevision).toBe(2);
});
diff --git a/web/tests/coderouter-responses-proxy.test.ts b/web/tests/coderouter-responses-proxy.test.ts
index 6f8439297fdc..b7ff29ffd6cd 100644
--- a/web/tests/coderouter-responses-proxy.test.ts
+++ b/web/tests/coderouter-responses-proxy.test.ts
@@ -4,7 +4,7 @@ import { VM_PLACEHOLDER_API_KEY } from "../services/coderouter/routeTokenAuth";
type SelectInput = {
teamId: string;
- provider: string;
+ provider: string | readonly string[];
sessionKey: string | null;
excludedAccountIds?: readonly string[];
signal?: AbortSignal;
@@ -53,6 +53,7 @@ const proxy = createCodexResponsesProxy({
return next
? {
id: next.id,
+ provider: "codex" as const,
vaultRevision: 1,
credentialExpiresAt: null,
sticky: next.sticky,
@@ -113,7 +114,8 @@ describe("codex responses proxy session routing", () => {
expect(selectInputs).toHaveLength(1);
expect(selectInputs[0]?.sessionKey).toBe("session-abc");
expect(selectInputs[0]?.teamId).toBe("team-1");
- expect(selectInputs[0]?.provider).toBe("codex");
+ // The Responses surface pools Codex sign-ins with OpenAI and OpenRouter keys.
+ expect(selectInputs[0]?.provider).toEqual(["codex", "openai-apikey", "openrouter-apikey"]);
});
test("selects without a session key when the header is missing", async () => {
@@ -163,7 +165,7 @@ describe("codex responses proxy session routing", () => {
select: async () => {
const id = `acct-${selected.length + 1}`;
selected.push(id);
- return { id, vaultRevision: 1, credentialExpiresAt: null, sticky: false };
+ return { id, provider: "codex" as const, vaultRevision: 1, credentialExpiresAt: null, sticky: false };
},
credential: async ({ accountId }) => ({
provider: "codex" as const,
@@ -227,7 +229,7 @@ describe("codex responses proxy session routing", () => {
stackUserId: "stack-user-1",
vmId: null,
}),
- select: async () => ({ id: "acct-1", vaultRevision: 1, credentialExpiresAt: null, sticky: false }),
+ select: async () => ({ id: "acct-1", provider: "codex" as const, vaultRevision: 1, credentialExpiresAt: null, sticky: false }),
credential: async (input) => {
credentialSignal = (input as typeof input & { signal?: AbortSignal }).signal;
return await new Promise(() => undefined);
@@ -264,7 +266,7 @@ describe("codex responses proxy session routing", () => {
select: async () => {
const id = `acct-${selected.length + 1}`;
selected.push(id);
- return { id, vaultRevision: 1, credentialExpiresAt: null, sticky: false };
+ return { id, provider: "codex" as const, vaultRevision: 1, credentialExpiresAt: null, sticky: false };
},
credential: async ({ accountId }) => ({
provider: "codex" as const,
@@ -329,7 +331,7 @@ describe("codex models proxy outcomes", () => {
select: async () => {
if (selected) return null;
selected = true;
- return { id: "acct-1", vaultRevision: 1, credentialExpiresAt: null };
+ return { id: "acct-1", provider: "codex" as const, vaultRevision: 1, credentialExpiresAt: null };
},
credential: async () => ({
provider: "codex" as const,
diff --git a/web/tests/coderouter-session-selector.test.ts b/web/tests/coderouter-session-selector.test.ts
index 9f4b5014a744..8e46b631234e 100644
--- a/web/tests/coderouter-session-selector.test.ts
+++ b/web/tests/coderouter-session-selector.test.ts
@@ -5,8 +5,8 @@ import { createSessionAccountSelector } from "../services/coderouter/repository"
type Call = { fn: string; args: unknown[] };
function makeDependencies(options: {
- bound?: { id: string; vaultRevision: number; credentialExpiresAt: Date | null } | null;
- placed?: { id: string; vaultRevision: number; credentialExpiresAt: Date | null } | null;
+ bound?: { id: string; provider: "codex"; vaultRevision: number; credentialExpiresAt: Date | null } | null;
+ placed?: { id: string; provider: "codex"; vaultRevision: number; credentialExpiresAt: Date | null } | null;
}) {
const calls: Call[] = [];
return {
@@ -32,6 +32,7 @@ function makeDependencies(options: {
const account = (id: string) => ({
id,
+ provider: "codex" as const,
vaultRevision: 3,
credentialExpiresAt: null,
});
From 94d88ed71848048f07b753ff15a15383bdab706e Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:19:10 -0700
Subject: [PATCH 06/12] web(dashboard): account menu order is settings, theme,
billing, team
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
.../dashboard/dashboard-account-menu.tsx | 22 +++++++++----------
web/tests/dashboard-account-menu.test.tsx | 12 +++++-----
2 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/web/app/[locale]/dashboard/dashboard-account-menu.tsx b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
index 37a75ad2860d..68f51a9d0e04 100644
--- a/web/app/[locale]/dashboard/dashboard-account-menu.tsx
+++ b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
@@ -72,17 +72,6 @@ export function DashboardAccountMenu() {
{t("settings")}
- } className={menuItemClass}>
-
- {t("billing")}
-
- {teamScope.status === "ready" ? (
-
- ) : null}
{theme.resolvedTheme === "dark" ? t("themeLight") : t("themeDark")}
+ } className={menuItemClass}>
+
+ {t("billing")}
+
+ {teamScope.status === "ready" ? (
+
+ ) : null}
{
resolvedTheme = "light";
const html = renderToStaticMarkup();
expect(html).toContain(">themeDark<");
- expect(html.indexOf(">themeDark<")).toBeGreaterThan(html.indexOf("/dashboard/billing"));
- expect(html.indexOf(">themeDark<")).toBeLessThan(html.indexOf("signOut"));
+ expect(html.indexOf(">themeDark<")).toBeGreaterThan(html.indexOf("/dashboard/team"));
+ expect(html.indexOf(">themeDark<")).toBeLessThan(html.indexOf("/dashboard/billing"));
});
test("lists every permitted team in a submenu and shows the current one on the trigger", () => {
@@ -147,9 +147,11 @@ describe("dashboard account menu", () => {
expect(submenu.match(/aria-checked="false"/g)).toHaveLength(2);
// The trigger row names the current team under the user's name.
expect(html.indexOf("Manaflow")).toBeLessThan(html.indexOf("/dashboard/team"));
- // The team entry sits after settings and billing, before sign out.
- expect(html.indexOf('data-testid="team-submenu"')).toBeGreaterThan(html.indexOf("/dashboard/billing"));
- expect(html.indexOf('data-testid="team-submenu"')).toBeLessThan(html.indexOf("signOut"));
+ // Order: settings, theme, billing, team, then sign out.
+ const order = ["/dashboard/team", ">themeLight<", "/dashboard/billing", 'data-testid="team-submenu"', "signOut"]
+ .map((marker) => html.indexOf(marker));
+ expect(order.every((index) => index >= 0)).toBe(true);
+ expect([...order].sort((a, b) => a - b)).toEqual(order);
});
test("uses the unlocalized auth handler and names the compact sign-in link", () => {
From 98d7ef1227e928084391a3e20b9a2cc9c35675b7 Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:19:33 -0700
Subject: [PATCH 07/12] web(dashboard): pin the theme in the menu order test
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
web/tests/dashboard-account-menu.test.tsx | 1 +
1 file changed, 1 insertion(+)
diff --git a/web/tests/dashboard-account-menu.test.tsx b/web/tests/dashboard-account-menu.test.tsx
index dd7c68a9ded8..1bdf8d4d0bf8 100644
--- a/web/tests/dashboard-account-menu.test.tsx
+++ b/web/tests/dashboard-account-menu.test.tsx
@@ -135,6 +135,7 @@ describe("dashboard account menu", () => {
{ id: "team-3", name: "Side project", personal: false, permissions: { use: true, manageAccounts: false } },
];
teamScope = { status: "ready", teams, selected: teams[1], switchTeam: () => undefined };
+ resolvedTheme = "dark";
const html = renderToStaticMarkup();
teamScope = { status: "unavailable" };
From e9ccefcca001cc4c991508b5f5a26ebf644ea714 Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:27:11 -0700
Subject: [PATCH 08/12] web(dashboard): address review findings on the accounts
page and menu
Base UI Tabs replace the hand-rolled tab buttons in the add panel, so
arrow keys and roving focus work. Team items in the account menu are a
Menu.RadioGroup, which owns the checked state. The accounts section is
keyed by team so a team switch never keeps a half-filled form. A team
switch drops only the team query parameter. A 503 from a Claude account
route shows the Claude save or remove error, not the shared-account
copy. The hosted-subrouter notice is shown to account managers only and
now says which accounts it is about. Test fixtures reset per test.
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
.../[locale]/dashboard/coderouter/page.tsx | 1 +
.../components/coderouter-accounts.tsx | 86 ++++++++++---------
.../dashboard/dashboard-account-menu.tsx | 33 ++++---
.../dashboard/dashboard-team-scope.ts | 5 +-
web/messages/en.json | 4 +-
web/messages/ja.json | 4 +-
web/tests/coderouter-accounts.test.tsx | 18 +++-
web/tests/dashboard-account-menu.test.tsx | 9 ++
web/tests/dashboard-team-scope.test.tsx | 8 +-
9 files changed, 108 insertions(+), 60 deletions(-)
diff --git a/web/app/[locale]/dashboard/coderouter/page.tsx b/web/app/[locale]/dashboard/coderouter/page.tsx
index 00cd90f66e29..676b7f56cf14 100644
--- a/web/app/[locale]/dashboard/coderouter/page.tsx
+++ b/web/app/[locale]/dashboard/coderouter/page.tsx
@@ -179,6 +179,7 @@ export async function CoderouterOverviewContent({
/>
- {shared.kind === "notConfigured" ? (
+ {shared.kind === "notConfigured" && canManage ? (
) : null}
{shared.kind === "migrationPending" ? (
@@ -454,7 +455,10 @@ function SharedAccountActions({
{ method: "DELETE" },
);
if (!response.ok) {
- setStatus({ state: "error", message: errorMessageForStatus(response.status, t, t("removeError")) });
+ setStatus({
+ state: "error",
+ message: errorMessageForStatus(response.status, t, t("removeError"), t("notConfiguredTitle")),
+ });
return;
}
setStatus(idleStatus);
@@ -534,41 +538,40 @@ function AddAccountPanel({ teamId }: { readonly teamId: string }) {
return (
{t("addTitle")}
-
- {ADD_KINDS.map((candidate) => (
-
- ))}
-
-
- {kind === "codex" ? (
-
- ) : kind === "opencode" ? (
-
- ) : (
-
- )}
-
+
setKind(value as AddKind)}
+ className="mt-2"
+ >
+
+ {ADD_KINDS.map((candidate) => (
+
+ {addKindLabel(candidate, t)}
+
+ ))}
+
+
+ {kind === "codex" ? (
+
+ ) : kind === "opencode" ? (
+
+ ) : (
+
+ )}
+
+
);
}
@@ -785,9 +788,14 @@ function sharedKindLabel(kind: string, t: Translator): string {
}
}
-function errorMessageForStatus(status: number, t: Translator, fallback: string): string {
+function errorMessageForStatus(
+ status: number,
+ t: Translator,
+ fallback: string,
+ unavailable: string = fallback,
+): string {
if (status === 400) return t("validationError");
if (status === 403) return t("teamAccessError");
- if (status === 503) return t("notConfiguredTitle");
+ if (status === 503) return unavailable;
return fallback;
}
diff --git a/web/app/[locale]/dashboard/dashboard-account-menu.tsx b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
index 68f51a9d0e04..4d4337761ec2 100644
--- a/web/app/[locale]/dashboard/dashboard-account-menu.tsx
+++ b/web/app/[locale]/dashboard/dashboard-account-menu.tsx
@@ -160,20 +160,25 @@ function TeamSubmenu({
- {teams.map((team) => (
- onSelect(team)}
- >
- {team.name}
- {team.personal ? (
- {t("personal")}
- ) : null}
- {team.id === selected.id ? : }
-
- ))}
+ {
+ const team = teams.find((candidate) => candidate.id === value);
+ if (team) onSelect(team);
+ }}
+ >
+ {teams.map((team) => (
+
+ {team.name}
+ {team.personal ? (
+ {t("personal")}
+ ) : null}
+
+
+
+
+ ))}
+
diff --git a/web/app/[locale]/dashboard/dashboard-team-scope.ts b/web/app/[locale]/dashboard/dashboard-team-scope.ts
index 2b71ac2b9e55..6c5fba3a46e5 100644
--- a/web/app/[locale]/dashboard/dashboard-team-scope.ts
+++ b/web/app/[locale]/dashboard/dashboard-team-scope.ts
@@ -70,7 +70,10 @@ export function useDashboardTeamScope(userId: string | null): DashboardTeamScope
);
if (searchParams.has("team")) {
// A deep-linked team in the URL would keep overriding the new scope.
- router.replace(pathname);
+ const next = new URLSearchParams(searchParams.toString());
+ next.delete("team");
+ const query = next.toString();
+ router.replace(query ? `${pathname}?${query}` : pathname);
}
router.refresh();
};
diff --git a/web/messages/en.json b/web/messages/en.json
index d24c9aceefa7..9a38d1767a98 100644
--- a/web/messages/en.json
+++ b/web/messages/en.json
@@ -240,8 +240,8 @@
"accountsCount": "{count, plural, one {# account} other {# accounts}}",
"emptyTitle": "No accounts yet",
"emptyBody": "Requests from this team fail until an account is added.",
- "notConfiguredTitle": "Codex accounts are hidden on this deployment",
- "notConfiguredBody": "The hosted account service is not configured here, so Codex accounts cannot be listed or added. Anthropic and Bedrock accounts still work.",
+ "notConfiguredTitle": "Accounts shared from the cmux app are not listed here",
+ "notConfiguredBody": "The hosted account service is not configured on this deployment. Accounts added with cr add, and Anthropic and Bedrock accounts, still work.",
"migrationPendingTitle": "Shared accounts temporarily unavailable",
"migrationPendingBody": "Shared Codex accounts are temporarily unavailable. Try again shortly.",
"loadErrorTitle": "Some accounts could not load",
diff --git a/web/messages/ja.json b/web/messages/ja.json
index 726875668659..cca7da9bd8ef 100644
--- a/web/messages/ja.json
+++ b/web/messages/ja.json
@@ -240,8 +240,8 @@
"accountsCount": "{count} 件のアカウント",
"emptyTitle": "まだアカウントがありません",
"emptyBody": "アカウントを追加するまで、このチームからのリクエストは失敗します。",
- "notConfiguredTitle": "このデプロイでは Codex アカウントは表示されません",
- "notConfiguredBody": "ホスト型アカウントサービスが設定されていないため、Codex アカウントの一覧表示と追加はできません。Anthropic と Bedrock のアカウントは引き続き使えます。",
+ "notConfiguredTitle": "cmux アプリから共有されたアカウントはここには表示されません",
+ "notConfiguredBody": "このデプロイではホスト型アカウントサービスが設定されていません。cr add で追加したアカウントと、Anthropic および Bedrock のアカウントは引き続き使えます。",
"migrationPendingTitle": "共有アカウントを一時的に利用できません",
"migrationPendingBody": "共有 Codex アカウントは一時的に利用できません。しばらくしてからもう一度お試しください。",
"loadErrorTitle": "一部のアカウントを読み込めませんでした",
diff --git a/web/tests/coderouter-accounts.test.tsx b/web/tests/coderouter-accounts.test.tsx
index 70b75275ca9b..2228ec055987 100644
--- a/web/tests/coderouter-accounts.test.tsx
+++ b/web/tests/coderouter-accounts.test.tsx
@@ -109,6 +109,8 @@ describe("coderouter accounts section", () => {
);
const tabs = [...html.matchAll(/role="tab"[^>]*>([^<]+) match[1]);
+ expect(html).toContain('role="tablist"');
+ expect(html).toContain('role="tabpanel"');
expect(tabs).toEqual([
"Anthropic API key",
"Claude Code OAuth",
@@ -131,11 +133,25 @@ describe("coderouter accounts section", () => {
/>,
);
- expect(html).not.toContain('role="tab"');
+ expect(html).not.toContain('role="tablist"');
expect(html).not.toContain(">Remove<");
expect(html).not.toContain(">Disable<");
});
+ test("hides the deployment notice from members who cannot manage accounts", () => {
+ const render = (canManage: boolean) => renderToStaticMarkup(
+
,
+ );
+ expect(render(true)).toContain("not listed here");
+ expect(render(false)).not.toContain("not listed here");
+ });
+
test("keeps the loaded provider visible when the other one fails", () => {
const html = renderToStaticMarkup(
({
),
}));
+let radioGroupValue = "";
mock.module("@base-ui-components/react/menu", () => ({
Menu: {
Root: ({ children }: { children: React.ReactNode }) => {children}
,
@@ -39,6 +40,14 @@ mock.module("@base-ui-components/react/menu", () => ({
: ,
Separator: () =>
,
SubmenuRoot: ({ children }: { children: React.ReactNode }) => {children}
,
+ RadioGroup: ({ children, value }: { children: React.ReactNode; value: string }) => {
+ radioGroupValue = value;
+ return {children}
;
+ },
+ RadioItem: ({ children, value, ...props }: React.HTMLAttributes & { value: string }) => (
+ {children}
+ ),
+ RadioItemIndicator: ({ children }: { children: React.ReactNode }) => {children},
SubmenuTrigger: ({ children, ...props }: React.HTMLAttributes) => (
),
diff --git a/web/tests/dashboard-team-scope.test.tsx b/web/tests/dashboard-team-scope.test.tsx
index 101fd9975457..0fb0248351e6 100644
--- a/web/tests/dashboard-team-scope.test.tsx
+++ b/web/tests/dashboard-team-scope.test.tsx
@@ -1,4 +1,4 @@
-import { describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
import { renderToStaticMarkup } from "react-dom/server";
type Catalog = {
@@ -72,6 +72,12 @@ const twoTeams: Catalog = {
};
describe("dashboard team scope", () => {
+ beforeEach(() => {
+ catalog = twoTeams;
+ pending = false;
+ searchTeam = null;
+ });
+
test("exposes the persisted team as current and only permitted teams", () => {
catalog = twoTeams;
pending = false;
From e4598ca49dabbd5e4f82ff2068b4f97df28c9b0f Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:32:52 -0700
Subject: [PATCH 09/12] web(dashboard): style the active add tab with Base UI's
data-active
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
web/app/[locale]/dashboard/components/coderouter-accounts.tsx | 2 +-
web/tests/coderouter-accounts.test.tsx | 4 ++++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
index add5694af551..3ef9919a26e1 100644
--- a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
+++ b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
@@ -548,7 +548,7 @@ function AddAccountPanel({ teamId }: { readonly teamId: string }) {
{addKindLabel(candidate, t)}
diff --git a/web/tests/coderouter-accounts.test.tsx b/web/tests/coderouter-accounts.test.tsx
index 2228ec055987..d344da15103c 100644
--- a/web/tests/coderouter-accounts.test.tsx
+++ b/web/tests/coderouter-accounts.test.tsx
@@ -111,6 +111,10 @@ describe("coderouter accounts section", () => {
const tabs = [...html.matchAll(/role="tab"[^>]*>([^<]+) match[1]);
expect(html).toContain('role="tablist"');
expect(html).toContain('role="tabpanel"');
+ // Base UI marks the current tab with data-active; the selected styles key off it.
+ const activeTab = html.match(/]*role="tab"[^>]*data-active[^>]*>([^<]+)
Date: Tue, 8 Sep 2026 00:33:39 -0700
Subject: [PATCH 10/12] web(dashboard): assert the active tab without assuming
attribute order
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
web/tests/coderouter-accounts.test.tsx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/web/tests/coderouter-accounts.test.tsx b/web/tests/coderouter-accounts.test.tsx
index d344da15103c..534ab2268ec6 100644
--- a/web/tests/coderouter-accounts.test.tsx
+++ b/web/tests/coderouter-accounts.test.tsx
@@ -112,7 +112,7 @@ describe("coderouter accounts section", () => {
expect(html).toContain('role="tablist"');
expect(html).toContain('role="tabpanel"');
// Base UI marks the current tab with data-active; the selected styles key off it.
- const activeTab = html.match(/]*role="tab"[^>]*data-active[^>]*>([^<]+)]*\bdata-active=""[^>]*>([^<]+)
Date: Tue, 8 Sep 2026 00:38:49 -0700
Subject: [PATCH 11/12] web(dashboard): show account identifiers to managers
only, label refreshing state
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
.../[locale]/dashboard/components/coderouter-accounts.tsx | 8 +++++---
web/tests/coderouter-accounts.test.tsx | 4 ++++
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
index 3ef9919a26e1..7e2061ac0c78 100644
--- a/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
+++ b/web/app/[locale]/dashboard/components/coderouter-accounts.tsx
@@ -191,7 +191,7 @@ function ClaudeAccountRow({
return (
{
expect(html).not.toContain('role="tablist"');
expect(html).not.toContain(">Remove<");
expect(html).not.toContain(">Disable<");
+ // Provider account identifiers are for account managers only.
+ expect(html).not.toContain("acct_9f3");
+ expect(html).not.toContain("sk-ant-oat01-…a1b2");
+ expect(html).toContain("Claude Code OAuth");
});
test("hides the deployment notice from members who cannot manage accounts", () => {
From 8b4b167f72ec62d6d1c616da4414ea35588d524e Mon Sep 17 00:00:00 2001
From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:48:07 -0700
Subject: [PATCH 12/12] coderouter: admit API-key providers in the envelope
identity, one session binding per surface, models 401 failover
The envelope identity check still listed only codex and opencode-go, so an
OpenAI or OpenRouter key could not be encrypted or decrypted. It now reads
the shared provider list. Session bindings are stored under the surface's
first provider, so a session that moves between a Codex sign-in and a key
replaces its row instead of adding a second one. Model discovery on a 401
forces a refresh, which marks a rejected key broken, and tries the next
account.
Claude-Session: https://claude.ai/code/session_01LMP2oJjwAkLbLxLaWmLaLS
---
web/services/coderouter/codexProxy.ts | 25 ++++++
web/services/coderouter/encryption.ts | 9 +-
web/services/coderouter/repository.ts | 16 +++-
web/services/coderouter/types.ts | 8 ++
.../coderouter-api-key-providers.test.ts | 82 ++++++++++++++++++-
5 files changed, 131 insertions(+), 9 deletions(-)
diff --git a/web/services/coderouter/codexProxy.ts b/web/services/coderouter/codexProxy.ts
index c2a8de0f36d7..969d2d918f5a 100644
--- a/web/services/coderouter/codexProxy.ts
+++ b/web/services/coderouter/codexProxy.ts
@@ -621,6 +621,10 @@ export function createCodexModelsProxy(dependencies: CodexModelsDependencies) {
);
continue;
}
+ if (upstream.status === 401) {
+ await retireRejectedCredential(dependencies, identity.teamId, account);
+ continue;
+ }
break;
}
if (!upstream) {
@@ -747,6 +751,27 @@ export function openRouterModelId(model: string): string {
return model.includes("/") ? model : `openai/${model}`;
}
+/**
+ * A 401 on model discovery: force a refresh so an expired sign-in rotates and
+ * a rejected API key is marked broken, then let the loop pick another account.
+ */
+async function retireRejectedCredential(
+ dependencies: Pick,
+ teamId: string,
+ account: { readonly id: string; readonly vaultRevision: number },
+): Promise {
+ try {
+ await dependencies.credential({
+ teamId,
+ accountId: account.id,
+ expectedRevision: account.vaultRevision,
+ force: true,
+ });
+ } catch {
+ // Busy or broken: either way this account is not used for this request.
+ }
+}
+
function modelsRequest(
credential: ResponsesCredential,
request: Request,
diff --git a/web/services/coderouter/encryption.ts b/web/services/coderouter/encryption.ts
index 4f42c8e02200..c29ad039d5ae 100644
--- a/web/services/coderouter/encryption.ts
+++ b/web/services/coderouter/encryption.ts
@@ -10,9 +10,10 @@ import {
KMSClient,
} from "@aws-sdk/client-kms";
import { awsCredentialsProvider } from "@vercel/oidc-aws-credentials-provider";
-import type {
- CodeRouterCredential,
- CodeRouterProvider,
+import {
+ CODEROUTER_PROVIDERS,
+ type CodeRouterCredential,
+ type CodeRouterProvider,
} from "./types";
const ALGORITHM = "aes-256-gcm" as const;
@@ -257,7 +258,7 @@ function assertIdentity(input: {
if (
!input.accountId ||
!input.teamId ||
- !["codex", "opencode-go"].includes(input.provider) ||
+ !CODEROUTER_PROVIDERS.includes(input.provider) ||
!Number.isSafeInteger(input.credentialRevision) ||
input.credentialRevision < 1
) {
diff --git a/web/services/coderouter/repository.ts b/web/services/coderouter/repository.ts
index 8547c7ca6798..0091a4c97336 100644
--- a/web/services/coderouter/repository.ts
+++ b/web/services/coderouter/repository.ts
@@ -505,6 +505,16 @@ function providerList(pool: ProviderPool): readonly CodeRouterProvider[] {
return typeof pool === "string" ? [pool] : pool;
}
+/**
+ * The provider under which a surface's session bindings are stored: the pool's
+ * first entry. One row per (team, surface, session) means a session that moves
+ * from a Codex sign-in to an API key replaces its binding instead of adding a
+ * second one that could later pull it back and drop its prompt cache.
+ */
+export function bindingProvider(pool: ProviderPool): CodeRouterProvider {
+ return providerList(pool)[0];
+}
+
function providerMatch(column: ReturnType, pool: ProviderPool) {
const providers = providerList(pool);
if (providers.length === 1) return sql`${column} = ${providers[0]}`;
@@ -593,7 +603,7 @@ async function findSessionAccountStatement(
set "last_seen_at" = now()
from "coderouter_accounts" as account
where binding."team_id" = ${teamId}
- and ${providerMatch(sql`binding."provider"`, provider)}
+ and binding."provider" = ${bindingProvider(provider)}
and binding."session_key" = ${sessionKey}
and account."id" = binding."account_id"
-- 'refreshing' is a healthy account with a credential refresh in
@@ -817,11 +827,9 @@ export function createSessionAccountSelector(
throwIfAborted(input.signal);
if (!placed) return null;
if (input.sessionKey) {
- // The binding records the account's own provider, so a pooled surface
- // (Codex sign-ins plus API keys) still finds it under any pool shape.
await dependencies.bind(
input.teamId,
- placed.provider,
+ bindingProvider(input.provider),
input.sessionKey,
placed.id,
input.signal,
diff --git a/web/services/coderouter/types.ts b/web/services/coderouter/types.ts
index 5cb1e7d2432b..f0b763cdc90c 100644
--- a/web/services/coderouter/types.ts
+++ b/web/services/coderouter/types.ts
@@ -4,6 +4,14 @@ export type CodeRouterProvider =
| "openai-apikey"
| "openrouter-apikey";
+/** Every provider a coderouter account row may carry. Mirrors the DB CHECK. */
+export const CODEROUTER_PROVIDERS: readonly CodeRouterProvider[] = [
+ "codex",
+ "opencode-go",
+ "openai-apikey",
+ "openrouter-apikey",
+];
+
/** Providers whose credentials are OAuth tokens that expire and refresh. */
export type CodeRouterOAuthProvider = "codex" | "opencode-go";
diff --git a/web/tests/coderouter-api-key-providers.test.ts b/web/tests/coderouter-api-key-providers.test.ts
index 070e7b99aa6c..1e254620cc53 100644
--- a/web/tests/coderouter-api-key-providers.test.ts
+++ b/web/tests/coderouter-api-key-providers.test.ts
@@ -1,4 +1,11 @@
import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import {
+ decryptCredential,
+ encryptCredential,
+ type CredentialKeyService,
+} from "../services/coderouter/encryption";
+import { bindingProvider, createSessionAccountSelector } from "../services/coderouter/repository";
import { apiKeyFingerprint, parseCredential } from "../services/coderouter/accounts";
import {
CodeRouterCredentialBroken,
@@ -109,7 +116,14 @@ const responses = createCodexResponsesProxy({
const models = createCodexModelsProxy({
authenticate,
select: async () => nextAccount(),
- credential: async () => credentialFor(),
+ credential: async (input) => {
+ const credential = credentialFor();
+ if (input.force) {
+ forcedRefreshes.push(input.accountId);
+ throw new CodeRouterCredentialBroken("provider rejected the API key");
+ }
+ return credential;
+ },
cooldown: async () => {},
providerRead: async (request) => await request(),
});
@@ -213,6 +227,58 @@ describe("API key credentials", () => {
});
});
+describe("API key storage and placement", () => {
+ test("an API key credential round-trips through the KMS envelope", async () => {
+ const dataKey = randomBytes(32);
+ const keys: CredentialKeyService = {
+ async generateDataKey() {
+ return { plaintext: Buffer.from(dataKey), encrypted: Buffer.from(dataKey) };
+ },
+ async decryptDataKey() {
+ return Buffer.from(dataKey);
+ },
+ };
+ const encrypted = await encryptCredential({
+ accountId: "00000000-0000-4000-8000-000000000002",
+ teamId: "team-1",
+ provider: "openrouter-apikey",
+ credentialRevision: 1,
+ credential: openRouterKey,
+ keyId: "test-key",
+ keys,
+ });
+ expect(JSON.stringify(encrypted)).not.toContain(openRouterKey.apiKey);
+ expect(await decryptCredential(encrypted, keys)).toEqual(openRouterKey);
+ });
+
+ test("a pooled surface keeps one binding row per session under its first provider", async () => {
+ expect(bindingProvider(["codex", "openai-apikey", "openrouter-apikey"])).toBe("codex");
+ expect(bindingProvider("opencode-go")).toBe("opencode-go");
+ const bindCalls: unknown[][] = [];
+ const select = createSessionAccountSelector({
+ sweepLeases: async () => {},
+ findBound: async () => null,
+ claim: async () => ({
+ id: "acct-or",
+ provider: "openrouter-apikey" as const,
+ vaultRevision: 1,
+ credentialExpiresAt: null,
+ }),
+ bind: async (...args: unknown[]) => {
+ bindCalls.push(args);
+ },
+ });
+ await select({
+ teamId: "team-1",
+ provider: ["codex", "openai-apikey", "openrouter-apikey"],
+ sessionKey: "session-1",
+ });
+ // The placed account is an OpenRouter key, but the row is stored under the
+ // surface's provider so a later move back to Codex replaces it.
+ expect(bindCalls).toEqual([["team-1", "codex", "session-1", "acct-or", undefined]]);
+ });
+});
+
describe("responses routing through API keys", () => {
test("sends an OpenAI key to api.openai.com with a bearer header and no ChatGPT account header", async () => {
accountsToServe = [{ id: "acct-openai", credential: openAiKey }];
@@ -266,6 +332,20 @@ describe("responses routing through API keys", () => {
expect(upstreamCalls.map((call) => new URL(call.url).host)).toEqual(["openrouter.ai", "chatgpt.com"]);
});
+ test("model discovery fails over when a key is rejected", async () => {
+ accountsToServe = [
+ { id: "acct-or", credential: openRouterKey },
+ { id: "acct-openai", credential: openAiKey },
+ ];
+ upstreamStatuses = [401, 200];
+ const listed = await models(new Request("https://coderouter.dev/v1/models", {
+ headers: { authorization: "Bearer crt_route" },
+ }));
+ expect(listed.status).toBe(200);
+ expect(forcedRefreshes).toEqual(["acct-or"]);
+ expect(upstreamCalls.map((call) => new URL(call.url).host)).toEqual(["openrouter.ai", "api.openai.com"]);
+ });
+
test("model discovery uses each provider's own catalog", async () => {
accountsToServe = [{ id: "acct-or", credential: openRouterKey }];
const listed = await models(new Request("https://coderouter.dev/v1/models?client_version=1", {