diff --git a/.gitattributes b/.gitattributes index 56862bb..33940bb 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,2 +1,3 @@ schemas/*.json text eol=lf crates/model-connector/tests/fixtures/wire_v4/* -text +crates/claude-connector/tests/fixtures/*.cc -text diff --git a/crates/claude-connector/Cargo.toml b/crates/claude-connector/Cargo.toml index bc28e9f..13eaad7 100644 --- a/crates/claude-connector/Cargo.toml +++ b/crates/claude-connector/Cargo.toml @@ -13,7 +13,7 @@ path = "src/main.rs" [dependencies] anyhow = "1" -chrono = { version = "0.4", default-features = false } +chrono = { version = "0.4", default-features = false, features = ["serde"] } hmac = "0.12" cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "a4eae9056152335662f1115f97bf35fb00ab6d23", package = "cultcache-rs" } model-connector = { path = "../model-connector", features = ["daemon"] } @@ -22,7 +22,6 @@ serde = { version = "1", features = ["derive"] } serde_json = "1" sha2 = "0.10" thiserror = "2" -ureq = { version = "2", default-features = false, features = ["tls"] } zeroize = "1" [target.'cfg(unix)'.dependencies] diff --git a/crates/claude-connector/src/backend.rs b/crates/claude-connector/src/backend.rs index 4833521..030ffc0 100644 --- a/crates/claude-connector/src/backend.rs +++ b/crates/claude-connector/src/backend.rs @@ -20,6 +20,12 @@ use crate::process::{ProcessPort, RunningChild, StdoutRead}; use crate::quota::QuotaCell; use crate::stream::{Failure, Finished, Step, StreamState}; +/// The meter's call: the cheapest model, a trivial prompt, and an answer cap +/// that only bounds a runaway. +const METER_MODEL: &str = "claude-haiku-5-5"; +const METER_CALLER: &str = "meter"; +const METER_MAX_OUTPUT_TOKENS: u32 = 16; + /// Where the child's credential comes from, read afresh at every use. The /// connector's own environment is never a source (ruling /// claude-connector-token-credential). @@ -156,6 +162,27 @@ impl ClaudeCodeBackend { self.quota.clone() } + /// The meter's call: the smallest real one, through the same child, + /// stream and cell as any other. The stream's `rate_limit_event` is what + /// the caller wants; this returns what the call billed, or the failure's + /// kind (never its message). + pub(crate) fn read_meter(&self) -> Result { + let mut request = ProviderRequest::new( + METER_CALLER, + METER_CALLER, + METER_MODEL, + "Reply with the single word ok.", + METER_MAX_OUTPUT_TOKENS, + ); + request.input = vec![InputItem::UserText { + text: "ok?".to_string(), + }]; + match self.run(&request, METER_CALLER).1 { + TransportOutcome::Completed { usage, .. } => Ok(usage), + TransportOutcome::Failed { kind, .. } => Err(format!("{kind:?}")), + } + } + /// The one pin check: `ready` and every spawn use it, and nothing caches /// its answer. fn binary_matches_pin(&self) -> bool { diff --git a/crates/claude-connector/src/backend/tests.rs b/crates/claude-connector/src/backend/tests.rs index 61ee59d..9f41654 100644 --- a/crates/claude-connector/src/backend/tests.rs +++ b/crates/claude-connector/src/backend/tests.rs @@ -2746,3 +2746,43 @@ fn a_turn_after_a_schema_turn_is_seeded_not_resumed() { assert!(!argv.iter().any(|a| a == "--resume"), "{argv:?}"); assert!(!argv.iter().any(|a| a == "--json-schema")); } + +// ---- the meter's call ---- + +/// One real call of the pinned CLI (2.1.312), captured on Yggdrasil on +/// 2026-11-03 with the connector's own argv: haiku, no tools, the trivial +/// prompt. Its `rate_limit_event` names only the week. +const METER_CALL: &str = include_str!("../../tests/fixtures/claude-2.1.312-meter-call.jsonl"); + +#[test] +fn the_meter_call_reads_the_week_from_a_real_captured_event() { + let rig = rig(vec![Script::lines( + METER_CALL.lines().map(str::to_string).collect(), + )]); + let usage = rig + .backend + .read_meter() + .expect("the captured call completes"); + assert_eq!((usage.input_tokens, usage.output_tokens), (384, 4)); + // 0.06 of the week used; it resets at 1794261600 (unix s). + assert_eq!( + readings(&rig), + vec![window("seven_day", 60, 1_794_261_600_000)] + ); + let argv = rig.seen().argv; + let after = |flag: &str| argv[argv.iter().position(|a| a == flag).unwrap() + 1].clone(); + assert_eq!(after("--model"), METER_MODEL); + assert_eq!(after("--tools"), "", "the call can use no tool"); + assert_eq!(rig.spawns(), 1, "one child, never run again"); +} + +#[test] +fn a_failed_meter_call_names_its_kind_and_leaves_the_cell_alone() { + let rig = rig(vec![Script::lines(vec![ + init_line(MODEL, SESSION), + error_result_line(r#","api_error_status":500"#), + ])]); + let failed = rig.backend.read_meter().expect_err("the call fails"); + assert!(!failed.is_empty() && !failed.contains(' '), "{failed}"); + assert!(quota_of(&rig).windows.is_empty()); +} diff --git a/crates/claude-connector/src/daemon.rs b/crates/claude-connector/src/daemon.rs index f7ef82f..7102d74 100644 --- a/crates/claude-connector/src/daemon.rs +++ b/crates/claude-connector/src/daemon.rs @@ -23,7 +23,7 @@ use crate::lease::{LeaseCaller, LeaseLimits, serve_leases, user_uid}; #[cfg(target_os = "linux")] use crate::unit::SystemdUnits; #[cfg(unix)] -use crate::usage_poll::UsageClient; +use crate::meter::{SWARM_BRAKE_STORE, SwarmBrakeStore}; use crate::{ ClaudeCodeBackend, ClaudeCodeConfig, ClaudeCodeLimits, CredentialTokenSource, StderrSink, }; @@ -537,13 +537,14 @@ pub fn check_ready(config: &ClaudeConnectorConfig) -> Result<(), ConfigError> { /// Loads the document and serves until the listener fails. #[cfg(unix)] pub fn serve_config(path: &Path) -> Result<(), ConfigError> { - serve_config_with(path, UsageClient::production()) + serve_config_with(path, Path::new(SWARM_BRAKE_STORE)) } -/// [`serve_config`] with the usage poll asking `usage`: the endpoint is not a -/// setting of the document, so a test reaches it only through here. +/// [`serve_config`] with the meter reading the swarm brake at `brake_store`: +/// the brake's place is not a setting of the document, so a test reaches it +/// only through here. #[cfg(unix)] -fn serve_config_with(path: &Path, usage: UsageClient) -> Result<(), ConfigError> { +fn serve_config_with(path: &Path, brake_store: &Path) -> Result<(), ConfigError> { let config = load_config(path)?; let admissions = readiness_of(&config)?; let listen = config.validate()?; @@ -565,14 +566,12 @@ fn serve_config_with(path: &Path, usage: UsageClient) -> Result<(), ConfigError> if let Some(socket) = &config.lease_socket { start_leases(&config, socket, service.clone(), backend.quota())?; } - crate::usage_poll::start( + crate::meter::start( backend.quota(), - Box::new(CredentialTokenSource::from_environment( - config.token_credential.clone(), - )), - usage, + Box::new(backend.clone()), + Box::new(SwarmBrakeStore::new(brake_store)), ) - .map_err(|_| ConfigError::Serving("usage poll"))?; + .map_err(|_| ConfigError::Serving("meter"))?; serve_service(listener, config.serve_limits(), service, backend)?; Ok(()) } @@ -599,16 +598,16 @@ mod tests { } } - /// `serve` starts the usage poll beside the listener, and the poll asks - /// where it was told: a fake on loopback receives its request, bearer - /// token and all, and nothing reaches the provider. + /// `serve` starts the meter beside the listener: with a released brake and + /// no reading of the week, the meter runs the claude binary once and serve + /// stays up. The binary is a script that replays a real captured call. #[cfg(unix)] #[test] - fn serve_config_starts_the_usage_poll_and_stays_up() { - use std::io::{Read, Write}; + fn serve_config_starts_the_meter_and_stays_up() { use std::os::unix::fs::PermissionsExt; - const TOKEN: &str = "sk-ant-oat01-fake-token-for-the-serve-test"; + const CALL: &str = include_str!("../tests/fixtures/claude-2.1.312-meter-call.jsonl"); + const BRAKE: &[u8] = include_bytes!("../tests/fixtures/swarm-brake-live-2026-11-03.cc"); let dir = std::env::temp_dir().join(format!("claude-connector-serve-{}", std::process::id())); let _ = std::fs::remove_dir_all(&dir); @@ -617,15 +616,23 @@ mod tests { std::fs::create_dir_all(at(sub)).unwrap(); } std::fs::set_permissions(at("prompts"), std::fs::Permissions::from_mode(0o700)).unwrap(); - std::fs::write(at("claude"), b"not a real claude binary").unwrap(); + std::fs::write(at("call.jsonl"), CALL).unwrap(); + let script = format!( + "#!/bin/sh\ncat > /dev/null\necho spawned >> '{}'\ncat '{}'\n", + at("spawned").display(), + at("call.jsonl").display() + ); + std::fs::write(at("claude"), &script).unwrap(); + std::fs::set_permissions(at("claude"), std::fs::Permissions::from_mode(0o755)).unwrap(); std::fs::write(at("caller.key"), "k".repeat(48)).unwrap(); - std::fs::write(at("credentials/claude-token"), TOKEN).unwrap(); + std::fs::write(at("swarm.cc"), BRAKE).unwrap(); + std::fs::write(at("credentials/claude-token"), "sk-ant-oat01-fake-token").unwrap(); std::fs::write(at("credentials/claude-handle-secret"), "s".repeat(48)).unwrap(); let config = ClaudeConnectorConfig { listen: "127.0.0.1:0".to_string(), replay_store: at("replay.cc"), claude_binary: at("claude"), - claude_binary_sha256: sha2::Sha256::digest(b"not a real claude binary").into(), + claude_binary_sha256: sha2::Sha256::digest(script.as_bytes()).into(), work_dir: at("work"), config_dir: at("home"), prompt_dir: at("prompts"), @@ -658,34 +665,19 @@ mod tests { // serve thread it starts. unsafe { std::env::set_var("CREDENTIALS_DIRECTORY", at("credentials")) }; - let fake = TcpListener::bind("127.0.0.1:0").unwrap(); - let url = format!("http://{}/api/oauth/usage", fake.local_addr().unwrap()); - let (asked, request) = std::sync::mpsc::channel(); - std::thread::spawn(move || { - let (mut stream, _) = fake.accept().unwrap(); - let mut text = vec![0u8; 4096]; - let n = stream.read(&mut text).unwrap(); - let _ = asked.send(String::from_utf8_lossy(&text[..n]).into_owned()); - let _ = stream.write_all( - b"HTTP/1.1 429 Too Many Requests -Content-Length: 0 -Connection: close - -", - ); - }); let path = at("connector.cc"); - let served = std::thread::spawn(move || serve_config_with(&path, UsageClient::new(url))); + let brake = at("swarm.cc"); + let served = std::thread::spawn(move || serve_config_with(&path, &brake)); - let request = request - .recv_timeout(Duration::from_secs(30)) - .expect("the usage poll never asked the fake endpoint"); - assert!(request.starts_with("GET /api/oauth/usage "), "{request}"); - assert!(request.contains(&format!("Bearer {TOKEN}")), "{request}"); - assert!( - !served.is_finished(), - "serve returned after starting the poll" - ); + let deadline = std::time::Instant::now() + Duration::from_secs(30); + while !at("spawned").exists() { + assert!( + std::time::Instant::now() < deadline, + "the meter never ran the claude binary" + ); + std::thread::sleep(Duration::from_millis(50)); + } + assert!(!served.is_finished(), "serve returned after starting the meter"); let _ = std::fs::remove_dir_all(&dir); } diff --git a/crates/claude-connector/src/lib.rs b/crates/claude-connector/src/lib.rs index 1b01d30..671ee36 100644 --- a/crates/claude-connector/src/lib.rs +++ b/crates/claude-connector/src/lib.rs @@ -10,12 +10,12 @@ mod handle; mod launch; #[cfg(target_os = "linux")] mod lease; +mod meter; mod process; mod quota; mod stream; #[cfg(target_os = "linux")] mod unit; -mod usage_poll; pub use backend::{ClaudeCodeBackend, CredentialTokenSource, StderrSink, TokenSource}; pub use config::{ClaudeCodeConfig, ClaudeCodeLimits}; diff --git a/crates/claude-connector/src/meter.rs b/crates/claude-connector/src/meter.rs new file mode 100644 index 0000000..3da2450 --- /dev/null +++ b/crates/claude-connector/src/meter.rs @@ -0,0 +1,523 @@ +//! The meter: keeps the plan's weekly reading fresh. The subscription reports +//! its windows only inside the CLI's `rate_limit_event`, on a call the CLI +//! makes, and Personas make theirs under leases that report nothing back. So +//! when the `seven_day` reading in the [`QuotaCell`] is `STALE` old, the +//! meter makes the smallest real call through the backend's own path (one +//! `claude -p` on the cheapest model with a trivial prompt) and the stream +//! fills the cell exactly as it does for any call. The meter holds no +//! credential, speaks no protocol and writes nothing itself. +//! +//! A held swarm brake spends nothing: the meter reads the swarm's brake store +//! before every call and, like every other organ that acts, treats anything +//! but a decodable released brake as held. A call that fails, or completes +//! without refreshing the reading, is not retried at the staleness period: the +//! wait doubles per consecutive miss, up to `CEILING`. + +use std::path::PathBuf; +use std::sync::Arc; +use std::time::{Duration, SystemTime, UNIX_EPOCH}; + +use chrono::{DateTime, Utc}; +use cultcache_rs::{CultCache, DatabaseEntry, SingleFileMessagePackBackingStore}; +use model_connector::Usage; + +use crate::backend::ClaudeCodeBackend; +use crate::quota::{EXPIRED, QuotaCell}; + +/// Where the swarm's brake is kept: the operator's root-owned, world-readable +/// store, the same file the Minds' organs read before they act. +pub(crate) const SWARM_BRAKE_STORE: &str = "/etc/gamecult/minds/swarm.cc"; +/// The one key the brake document has in its store. +const BRAKE_KEY: &str = "brake"; +/// The window the meter keeps fresh. +const WINDOW: &str = "seven_day"; +/// A reading this old, or older, is stale; also the least gap between calls. +const STALE: Duration = Duration::from_secs(15 * 60); +/// The longest any backoff may wait. +const CEILING: Duration = Duration::from_secs(6 * 60 * 60); +/// How often a held brake is looked at again. +const BRAKE_RECHECK: Duration = Duration::from_secs(60); + +/// The smallest real call, as the backend makes it. +pub(crate) trait Probe: Send { + /// What the call billed, or the failure's kind. Never a message: a + /// provider's words do not enter the meter's log. + fn call(&self) -> Result; +} + +impl Probe for Arc { + fn call(&self) -> Result { + self.read_meter() + } +} + +/// Whether the operator's swarm brake holds. +pub(crate) trait Brake: Send { + fn held(&self) -> bool; +} + +/// The brake document of the operator's control stores. Declared here with the +/// type name and field order the stores are written with; the connector reads +/// it and never writes it. +#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] +#[cultcache(type = "eureka.control.brake.v1")] +struct SwarmBrake { + #[cultcache(key = 0)] + released: bool, + #[cultcache(key = 1)] + set_at: DateTime, + #[cultcache(key = 2)] + set_by: String, +} + +/// The swarm brake read from its store, read-only and without locks. Absent, +/// unreadable, undecodable or unreleased is held. +pub(crate) struct SwarmBrakeStore(PathBuf); + +impl SwarmBrakeStore { + pub(crate) fn new(path: impl Into) -> Self { + Self(path.into()) + } + + fn released(&self) -> Option { + let mut cache = CultCache::new(); + cache.register_entry_type::().ok()?; + for envelope in SingleFileMessagePackBackingStore::new(&self.0) + .pull_all_read_only_snapshot() + .ok()? + { + cache.put_raw_envelope(envelope).ok()?; + } + Some(cache.get::(BRAKE_KEY).ok()??.released) + } +} + +impl Brake for SwarmBrakeStore { + fn held(&self) -> bool { + self.released() != Some(true) + } +} + +/// Why the meter is waiting; logged once per change. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +enum State { + Read, + Braked, + Failed, + Unread, +} + +impl State { + fn line(self) -> &'static str { + match self { + Self::Read => "meter: weekly reading refreshed", + Self::Braked => "meter: swarm brake held, making no call", + Self::Failed => "meter: the call failed, backing off", + Self::Unread => "meter: the call completed without a weekly reading, backing off", + } + } +} + +struct Meter { + cell: Arc, + probe: Box, + brake: Box, + log: Box, + /// No call before this instant, unix ms. + not_before_ms: u64, + /// Consecutive calls that left the reading unrefreshed. + misses: u32, + last_state: Option, +} + +impl Meter { + fn new( + cell: Arc, + probe: Box, + brake: Box, + log: Box, + ) -> Self { + Self { + cell, + probe, + brake, + log, + not_before_ms: 0, + misses: 0, + last_state: None, + } + } + + /// Makes the call if one is due at `now_ms`; returns how long to wait + /// before looking again. Nothing is due while the brake is held, nor + /// before the last miss's backoff has passed, nor while the weekly reading + /// is younger than `STALE`. + fn tick(&mut self, now_ms: u64) -> Duration { + if self.brake.held() { + self.report(State::Braked); + return BRAKE_RECHECK; + } + let due_at = self.due_at_ms(); + if now_ms < due_at { + return Duration::from_millis(due_at - now_ms); + } + let called = self.probe.call(); + let state = if called.is_ok() && self.refreshed_since(now_ms) { + self.misses = 0; + State::Read + } else { + self.misses = self.misses.saturating_add(1); + if called.is_ok() { + State::Unread + } else { + State::Failed + } + }; + self.report(state); + self.not_before_ms = now_ms.saturating_add(duration_ms(backoff(self.misses))); + Duration::from_millis(self.due_at_ms().saturating_sub(now_ms)) + } + + /// The earliest instant the next call may happen. A window past its reset + /// described a week that is over, so it is due at once. + fn due_at_ms(&self) -> u64 { + let stale_at = self + .cell + .snapshot() + .windows + .iter() + .find(|quota| quota.window == WINDOW) + .map_or(0, |quota| { + if quota.status == EXPIRED { + 0 + } else { + quota.observed_at_unix_ms.saturating_add(duration_ms(STALE)) + } + }); + stale_at.max(self.not_before_ms) + } + + fn refreshed_since(&self, since_ms: u64) -> bool { + self.cell + .snapshot() + .windows + .iter() + .any(|quota| quota.window == WINDOW && quota.observed_at_unix_ms >= since_ms) + } + + fn report(&mut self, state: State) { + if self.last_state != Some(state) { + (self.log)(state.line()); + self.last_state = Some(state); + } + } + + fn run(mut self) { + loop { + let wait = self.tick(unix_ms()); + std::thread::sleep(wait); + } + } +} + +/// The wait after `misses` consecutive unrefreshed calls: the staleness +/// period, doubling per miss beyond the first, up to the ceiling. +fn backoff(misses: u32) -> Duration { + let doublings = misses.saturating_sub(1).min(16); + STALE.saturating_mul(1 << doublings).min(CEILING) +} + +fn duration_ms(duration: Duration) -> u64 { + u64::try_from(duration.as_millis()).unwrap_or(u64::MAX) +} + +fn unix_ms() -> u64 { + SystemTime::now() + .duration_since(UNIX_EPOCH) + .map_or(0, duration_ms) +} + +/// Starts the meter thread. It writes only through the calls it makes, and +/// logs one line to stderr when its state changes. +pub(crate) fn start( + cell: Arc, + probe: Box, + brake: Box, +) -> std::io::Result> { + let meter = Meter::new( + cell, + probe, + brake, + Box::new(|line| eprintln!("claude-connector: {line}")), + ); + std::thread::Builder::new() + .name("claude-meter".to_string()) + .spawn(move || meter.run()) +} + +#[cfg(test)] +mod tests { + use super::*; + use model_connector::PlanQuota; + use std::sync::Mutex; + use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering}; + + const MIN: u64 = 60_000; + const NOW: u64 = 1_800_000_000_000; + const RESET: u64 = 4_102_444_800_000; + + fn reading() -> Vec { + vec![PlanQuota { + window: WINDOW.to_string(), + utilization_permille: Some(60), + resets_at_unix_ms: RESET, + status: "allowed".to_string(), + observed_at_unix_ms: 0, + }] + } + + /// A call that answers as scripted and, when it succeeds with a reading, + /// feeds the cell the way the stream does. + struct Calls { + cell: Arc, + made: Arc, + outcome: Arc, String>>>, + } + + impl Probe for Calls { + fn call(&self) -> Result { + self.made.fetch_add(1, Ordering::SeqCst); + match &*self.outcome.lock().unwrap() { + Ok(Some(at)) => self.cell.observe_at(*at, reading()), + Ok(None) => {} + Err(kind) => return Err(kind.clone()), + } + Ok(Usage { + input_tokens: 385, + cache_read_tokens: 0, + cache_write_tokens: 0, + output_tokens: 4, + reasoning_tokens: None, + }) + } + } + + struct Held(Arc); + + impl Brake for Held { + fn held(&self) -> bool { + self.0.load(Ordering::SeqCst) + } + } + + struct Rig { + meter: Meter, + cell: Arc, + made: Arc, + outcome: Arc, String>>>, + braked: Arc, + log: Arc>>, + } + + fn rig() -> Rig { + let cell = Arc::new(QuotaCell::new()); + let made = Arc::new(AtomicUsize::new(0)); + let outcome = Arc::new(Mutex::new(Ok(None))); + let braked = Arc::new(AtomicBool::new(false)); + let log = Arc::new(Mutex::new(Vec::new())); + let sink = log.clone(); + let meter = Meter::new( + cell.clone(), + Box::new(Calls { + cell: cell.clone(), + made: made.clone(), + outcome: outcome.clone(), + }), + Box::new(Held(braked.clone())), + Box::new(move |line| sink.lock().unwrap().push(line.to_string())), + ); + Rig { + meter, + cell, + made, + outcome, + braked, + log, + } + } + + impl Rig { + fn answers(&self, outcome: Result, &str>) { + *self.outcome.lock().unwrap() = outcome.map_err(str::to_string); + } + fn calls(&self) -> usize { + self.made.load(Ordering::SeqCst) + } + } + + #[test] + fn an_unread_week_triggers_one_call_and_the_fresh_reading_ends_the_asking() { + let mut rig = rig(); + rig.answers(Ok(Some(NOW))); + assert_eq!(rig.meter.tick(NOW), STALE, "fresh for the staleness period"); + assert_eq!(rig.calls(), 1); + assert_eq!( + rig.meter.tick(NOW + 5 * MIN), + Duration::from_millis(10 * MIN) + ); + assert_eq!(rig.calls(), 1, "a fresh reading makes no call"); + } + + #[test] + fn a_stale_reading_triggers_a_call_at_the_period_and_not_before() { + let mut rig = rig(); + rig.cell.observe_at(NOW, reading()); + rig.answers(Ok(Some(NOW + 15 * MIN))); + rig.meter.tick(NOW + 15 * MIN - 1); + assert_eq!(rig.calls(), 0, "one millisecond short of stale"); + rig.meter.tick(NOW + 15 * MIN); + assert_eq!(rig.calls(), 1); + } + + #[test] + fn a_window_past_its_reset_is_read_at_once_not_after_the_period() { + let mut rig = rig(); + let now = unix_ms(); + let mut over = reading().remove(0); + over.resets_at_unix_ms = 1; + rig.cell.observe_at(now, vec![over]); + rig.answers(Ok(Some(now))); + rig.meter.tick(now); + assert_eq!(rig.calls(), 1); + } + + #[test] + fn a_held_brake_makes_no_call_however_stale_the_reading() { + let mut rig = rig(); + rig.braked.store(true, Ordering::SeqCst); + for step in 0..10 { + assert_eq!(rig.meter.tick(NOW + step * 60 * MIN), BRAKE_RECHECK); + } + assert_eq!(rig.calls(), 0); + assert_eq!(*rig.log.lock().unwrap(), vec![State::Braked.line()]); + rig.braked.store(false, Ordering::SeqCst); + rig.answers(Ok(Some(NOW + 600 * MIN))); + rig.meter.tick(NOW + 600 * MIN); + assert_eq!(rig.calls(), 1, "released, the stale week is read at once"); + } + + #[test] + fn a_failed_call_leaves_the_cell_and_backs_off_instead_of_hammering() { + let mut rig = rig(); + rig.cell.observe_at(NOW, reading()); + let before = rig.cell.snapshot(); + rig.answers(Err("Provider")); + let mut at = NOW + 15 * MIN; + let mut waits = Vec::new(); + for _ in 0..4 { + waits.push(rig.meter.tick(at)); + at += duration_ms(*waits.last().unwrap()); + } + assert_eq!(rig.calls(), 4); + assert_eq!(rig.cell.snapshot(), before, "the cell is untouched"); + assert_eq!( + waits, + [15, 30, 60, 120].map(|m| Duration::from_secs(m * 60)), + "the wait doubles per consecutive miss" + ); + rig.meter.tick(at - MIN); + assert_eq!(rig.calls(), 4, "nothing is asked before the backoff ends"); + assert_eq!(*rig.log.lock().unwrap(), vec![State::Failed.line()]); + } + + #[test] + fn the_backoff_stops_at_the_ceiling_and_one_good_reading_resets_it() { + assert_eq!(backoff(0), STALE); + assert_eq!(backoff(1), STALE); + assert_eq!(backoff(u32::MAX), CEILING); + let mut rig = rig(); + rig.answers(Err("Provider")); + rig.meter.tick(NOW); + rig.meter.tick(NOW + 15 * MIN); + assert_eq!(rig.meter.misses, 2); + rig.answers(Ok(Some(NOW + 45 * MIN))); + rig.meter.tick(NOW + 45 * MIN); + assert_eq!(rig.meter.misses, 0); + } + + #[test] + fn a_call_that_completes_without_a_weekly_reading_is_a_miss_too() { + let mut rig = rig(); + rig.answers(Ok(None)); + assert_eq!(rig.meter.tick(NOW), STALE); + assert_eq!(rig.meter.tick(NOW + 15 * MIN), 2 * STALE); + assert_eq!(rig.calls(), 2); + assert_eq!(*rig.log.lock().unwrap(), vec![State::Unread.line()]); + } + + #[test] + fn a_reading_from_before_the_call_does_not_count_as_its_answer() { + let mut rig = rig(); + // A slow concurrent sensor stamped earlier than this call began. + rig.answers(Ok(Some(NOW - 1))); + rig.meter.tick(NOW); + assert_eq!(rig.meter.misses, 1); + } + + // ---- the brake store, read as the operator's tool writes it ---- + + /// The swarm store as it stood on Yggdrasil on 2026-11-03 (released), + /// copied byte for byte. + const LIVE_STORE: &[u8] = include_bytes!("../tests/fixtures/swarm-brake-live-2026-11-03.cc"); + + fn store_with(bytes: &[u8]) -> (PathBuf, SwarmBrakeStore) { + static NEXT: AtomicUsize = AtomicUsize::new(0); + let dir = std::env::temp_dir().join(format!( + "claude-meter-brake-{}-{}", + std::process::id(), + NEXT.fetch_add(1, Ordering::SeqCst) + )); + std::fs::create_dir_all(&dir).unwrap(); + let path = dir.join("swarm.cc"); + std::fs::write(&path, bytes).unwrap(); + (dir, SwarmBrakeStore::new(path)) + } + + /// The live store with `released` flipped to false: the msgpack `true` + /// byte that precedes the timestamp string. + fn held_store() -> Vec { + let mut bytes = LIVE_STORE.to_vec(); + let at = bytes + .windows(5) + .position(|w| w == b"\xc3\xbe202") + .expect("the live store holds released=true before its timestamp"); + bytes[at] = 0xc2; + bytes + } + + #[test] + fn the_live_released_store_reads_as_released() { + let (dir, store) = store_with(LIVE_STORE); + assert_eq!(store.released(), Some(true)); + assert!(!store.held()); + let _ = std::fs::remove_dir_all(dir); + } + + #[test] + fn the_same_store_with_the_brake_held_reads_as_held() { + let (dir, store) = store_with(&held_store()); + assert_eq!(store.released(), Some(false)); + assert!(store.held()); + let _ = std::fs::remove_dir_all(dir); + } + + #[test] + fn a_missing_garbled_or_truncated_store_is_held() { + assert!(SwarmBrakeStore::new("/nonexistent-claude-meter/swarm.cc").held()); + for bytes in [&b""[..], b"not a store at all", &LIVE_STORE[..40]] { + let (dir, store) = store_with(bytes); + assert!(store.held(), "{bytes:?}"); + let _ = std::fs::remove_dir_all(dir); + } + } +} diff --git a/crates/claude-connector/src/quota.rs b/crates/claude-connector/src/quota.rs index b319d4c..af342e0 100644 --- a/crates/claude-connector/src/quota.rs +++ b/crates/claude-connector/src/quota.rs @@ -1,9 +1,9 @@ //! The plan's own usage windows, as the subscription reports them. The -//! subscription decides how much a plan may burn, and two sensors observe it: -//! the CLI's `rate_limit_event` on the connector's own calls, and the usage -//! poll of `usage_poll` while that stream is quiet. The latest observation of -//! each window, from either, is kept here and published as the usage readout -//! and lent with each lease. +//! subscription decides how much a plan may burn, and one sensor observes it: +//! the CLI's `rate_limit_event` on the connector's own calls, which the +//! `meter` makes when the week's reading goes stale. The latest observation of +//! each window is kept here and published as the usage readout and lent with +//! each lease. use std::collections::BTreeMap; use std::sync::Mutex; @@ -29,26 +29,17 @@ impl QuotaCell { self.observe_at(unix_ms(), windows); } - /// Records readings taken at `at` (unix ms): the moment the sensor asked, - /// not the moment its answer arrived. The cell alone decides how a reading - /// combines with the one it holds for that window, and every sensor goes - /// through this decision: - /// - /// - a reading older than the held one is dropped, so a slow answer cannot - /// replace what a faster sensor saw meanwhile; - /// - the provider's rejection stands until its window resets, or until a - /// reading that itself carries a verdict from the provider replaces it: - /// a [`POLLED`] reading reports utilization only, and says nothing about - /// whether the provider accepts calls. - /// - /// Windows the readings did not mention stay as they were, stamp included. - pub fn observe_at(&self, at: u64, windows: impl IntoIterator) { + /// Records readings taken at `at` (unix ms). A reading older than the + /// held one is dropped, so a slow call cannot replace what a faster one + /// saw meanwhile. Windows the readings did not mention stay as they were, + /// stamp included. +(&self, at: u64, windows: impl IntoIterator) { let mut held = self.0.lock().unwrap_or_else(|e| e.into_inner()); for mut quota in windows { quota.observed_at_unix_ms = at; if held .get("a.window) - .is_none_or(|current| supersedes(current, "a)) + .is_none_or(|current| quota.observed_at_unix_ms >= current.observed_at_unix_ms) { held.insert(quota.window.clone(), quota); } @@ -81,24 +72,7 @@ impl QuotaCell { } /// The status of a window whose reset has passed since it was observed. -const EXPIRED: &str = "expired"; -/// The status of a window the provider refuses calls on. -pub(crate) const REJECTED: &str = "rejected"; -/// The status of a window read from the usage endpoint: utilization and reset -/// time, with no verdict on whether calls are accepted. -pub(crate) const POLLED: &str = "polled"; - -/// Whether `incoming` (already stamped with its own reading time) replaces -/// `current` for the same window. -fn supersedes(current: &PlanQuota, incoming: &PlanQuota) -> bool { - if incoming.observed_at_unix_ms < current.observed_at_unix_ms { - return false; - } - let rejection_stands = current.status == REJECTED - && incoming.status == POLLED - && incoming.observed_at_unix_ms < current.resets_at_unix_ms; - !rejection_stands -} +pub(crate) const EXPIRED: &str = "expired"; fn unix_ms() -> u64 { SystemTime::now() @@ -194,33 +168,13 @@ mod tests { } #[test] - fn a_rejection_stands_against_a_poll_until_the_window_resets() { + fn a_newer_reading_lifts_a_rejection() { let cell = QuotaCell::new(); - let polled = with_status(quota("five_hour", 500, 0), POLLED); - cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), REJECTED)]); - cell.observe_at(200, [polled.clone()]); - assert_eq!(held(&cell), (REJECTED.to_string(), Some(1000), 100)); - // The window the rejection described is over: a poll of the next one lands. - cell.observe_at(RESET, [polled]); - assert_eq!(cell.snapshot_at(RESET - 1).windows[0].status, POLLED); - } - - #[test] - fn a_newer_reading_that_carries_its_own_verdict_lifts_a_rejection() { - let cell = QuotaCell::new(); - cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), REJECTED)]); + cell.observe_at(100, [with_status(quota("five_hour", 1000, 0), "rejected")]); cell.observe_at(200, [quota("five_hour", 300, 0)]); assert_eq!(held(&cell), ("allowed".to_string(), Some(300), 200)); } - #[test] - fn a_poll_replaces_what_is_not_a_rejection() { - let cell = QuotaCell::new(); - cell.observe_at(100, [quota("five_hour", 300, 0)]); - cell.observe_at(200, [with_status(quota("five_hour", 400, 0), POLLED)]); - assert_eq!(held(&cell), (POLLED.to_string(), Some(400), 200)); - } - #[test] fn the_live_clock_stamps_and_expires() { let cell = QuotaCell::new(); diff --git a/crates/claude-connector/src/usage_poll.rs b/crates/claude-connector/src/usage_poll.rs deleted file mode 100644 index f5e4578..0000000 --- a/crates/claude-connector/src/usage_poll.rs +++ /dev/null @@ -1,1077 +0,0 @@ -//! The second sensor of the plan's usage windows. The CLI's `rate_limit_event` -//! only arrives when the connector's own calls run, so while the swarm is -//! quiet the weekly reading goes stale; this thread asks the subscription's -//! usage endpoint when the `seven_day` reading is `STALE` or older, and -//! records the answer in the same [`QuotaCell`] the stream feeds. Neither -//! sensor owns the reading: the cell decides how a reading combines with the -//! one it holds, and a poll is stamped with the moment it asked. A failed -//! poll never touches the cell; only the cell's own reset rule retires a -//! window. -//! -//! The endpoint is undocumented (the shape is the one Claude Code 2.1.312 -//! parses), so every answer it can give is handled and none is trusted to -//! change the schedule beyond the rules below. - -use std::io::Read; -use std::sync::Arc; -use std::time::{Duration, SystemTime, UNIX_EPOCH}; - -use model_connector::PlanQuota; -use serde_json::Value; -use sha2::{Digest, Sha256}; -use zeroize::Zeroizing; - -use crate::backend::TokenSource; -use crate::quota::{POLLED, QuotaCell}; - -/// The usage endpoint. -const ENDPOINT: &str = "https://api.anthropic.com/api/oauth/usage"; -/// A reading this old, or older, is stale; also the least gap between polls. -const STALE: Duration = Duration::from_secs(15 * 60); -/// The longest any backoff may wait. -const CEILING: Duration = Duration::from_secs(6 * 60 * 60); -const TIMEOUT: Duration = Duration::from_secs(10); -/// A usage body is a few hundred bytes; this is a ceiling, not an expectation. -const MAX_BODY: u64 = 1 << 20; - -/// What the endpoint said, reduced to what the schedule needs. It never holds -/// the token. -#[derive(Debug, PartialEq, Eq)] -enum Answer { - Body(String), - Status(u16, Option), - Unreachable, -} - -/// Why the poller is waiting; logged once per change. -#[derive(Debug, Clone, Copy, PartialEq, Eq)] -enum State { - Polled, - NoToken, - RateLimited, - Refused, - NotFound, - Unreadable, - Unexpected, - Unreachable, -} - -impl State { - fn line(self) -> &'static str { - match self { - Self::Polled => "usage poll: reading recorded", - Self::NoToken => "usage poll: no token to ask with", - Self::RateLimited => "usage poll: rate limited, waiting", - Self::Refused => { - "usage poll: refused (401/403), the token likely lacks the user:profile scope; not asking again until the token changes" - } - Self::NotFound => "usage poll: endpoint not found, backing off", - Self::Unreadable => "usage poll: answer not readable, backing off", - Self::Unexpected => "usage poll: unexpected status, retrying later", - Self::Unreachable => "usage poll: endpoint unreachable, retrying later", - } - } -} - -#[derive(Debug, PartialEq)] -struct Verdict { - windows: Vec, - /// How long until the next poll may happen. - wait: Duration, - state: State, -} - -/// What one answer means: the windows to record (only a readable body has -/// any), how long to wait, and the state to report. -fn judge(answer: &Answer) -> Verdict { - let (windows, wait, state) = match answer { - Answer::Body(body) => match parse_usage(body) { - Some(windows) => (windows, STALE, State::Polled), - None => (Vec::new(), CEILING, State::Unreadable), - }, - Answer::Status(429, retry_after) => ( - Vec::new(), - retry_after.unwrap_or_default().clamp(STALE, CEILING), - State::RateLimited, - ), - Answer::Status(401 | 403, _) => (Vec::new(), STALE, State::Refused), - Answer::Status(404, _) => (Vec::new(), CEILING, State::NotFound), - Answer::Status(..) => (Vec::new(), STALE, State::Unexpected), - Answer::Unreachable => (Vec::new(), STALE, State::Unreachable), - }; - Verdict { - windows, - wait, - state, - } -} - -/// The plan windows a usage body reports: `five_hour` and `seven_day`, each -/// `{utilization: percent 0-100, resets_at: ISO 8601}`. A window missing -/// either field, or reporting nonsense, is skipped, and an unknown reading is -/// never zero. Other keys are ignored. `None` when the body is not a JSON -/// object at all. -fn parse_usage(body: &str) -> Option> { - let usage: Value = serde_json::from_str(body).ok()?; - let usage = usage.as_object()?; - Some( - ["five_hour", "seven_day"] - .into_iter() - .filter_map(|window| { - let reading = usage.get(window)?; - let percent = reading.get("utilization")?.as_f64()?; - let resets_at = reading.get("resets_at")?.as_str()?; - if !percent.is_finite() || percent < 0.0 { - return None; - } - let resets_at = chrono::DateTime::parse_from_rfc3339(resets_at).ok()?; - Some(PlanQuota { - window: window.to_string(), - // `as` saturates a float at the integer's bounds. - utilization_permille: Some((percent * 10.0).round() as u32), - resets_at_unix_ms: u64::try_from(resets_at.timestamp_millis()).ok()?, - status: POLLED.to_string(), - // Stamped by the cell that keeps it. - observed_at_unix_ms: 0, - }) - }) - .collect(), - ) -} - -/// The blocking HTTPS client: 10 s end to end, no redirects (the token must -/// not follow one anywhere). -pub(crate) struct UsageClient { - agent: ureq::Agent, - url: String, - timeout: Duration, -} - -impl UsageClient { - /// The client that asks the provider's usage endpoint. - pub(crate) fn production() -> Self { - Self::new(ENDPOINT) - } - - /// A client for another endpoint: a test's fake server. - pub(crate) fn new(url: impl Into) -> Self { - Self::with_timeout(url, TIMEOUT) - } - - fn with_timeout(url: impl Into, timeout: Duration) -> Self { - Self { - agent: ureq::AgentBuilder::new().redirects(0).build(), - url: url.into(), - timeout, - } - } - - /// Asks the endpoint. Our copy of the header value is zeroized when it - /// drops; ureq copies it into its own request buffers, which are freed - /// without zeroing. - fn ask(&self, token: &Zeroizing) -> Answer { - let bearer = Zeroizing::new(format!("Bearer {}", token.as_str())); - let sent = self - .agent - .get(&self.url) - .timeout(self.timeout) - .set("Authorization", bearer.as_str()) - .set("anthropic-beta", "oauth-2025-04-20") - .call(); - match sent { - Ok(response) if response.status() == 200 => { - let mut body = String::new(); - match response - .into_reader() - .take(MAX_BODY) - .read_to_string(&mut body) - { - Ok(_) => Answer::Body(body), - Err(_) => Answer::Unreachable, - } - } - Ok(response) => Answer::Status(response.status(), None), - Err(ureq::Error::Status(code, response)) => { - let retry_after = response - .header("retry-after") - .and_then(|value| retry_after(value, unix_ms())); - Answer::Status(code, retry_after) - } - Err(ureq::Error::Transport(_)) => Answer::Unreachable, - } - } -} - -/// A `Retry-After` value as a wait from `now_ms`: delay-seconds, or an -/// HTTP-date (RFC 9110 10.2.3, all three forms) measured from now, a date -/// already past being a zero wait. `None` when it is neither. -fn retry_after(value: &str, now_ms: u64) -> Option { - let value = value.trim(); - if let Ok(seconds) = value.parse::() { - return Some(Duration::from_secs(seconds)); - } - let until = http_date_ms(value, now_ms)?; - Some(Duration::from_millis(until.saturating_sub(now_ms))) -} - -/// An HTTP-date as Unix milliseconds: IMF-fixdate (RFC 2822 reads it), the -/// obsolete RFC 850 form `Sunday, 06-Nov-94 08:49:37 GMT`, or asctime -/// `Sun Nov 6 08:49:37 1994`. Weekday names are not checked. -fn http_date_ms(value: &str, now_ms: u64) -> Option { - use chrono::Datelike; - if let Ok(date) = chrono::DateTime::parse_from_rfc2822(value) { - return u64::try_from(date.timestamp_millis()).ok(); - } - let fields: Vec<&str> = value.split_whitespace().collect(); - let (day, month, year, time) = match fields.as_slice() { - [weekday, date, time, "GMT"] if weekday.ends_with(',') => { - let mut parts = date.split('-'); - let (day, month, year) = (parts.next()?, parts.next()?, parts.next()?); - if parts.next().is_some() || year.len() != 2 { - return None; - } - // A two-digit year more than 50 years ahead is the latest past - // year with those digits. - let now_year = - chrono::DateTime::from_timestamp_millis(i64::try_from(now_ms).ok()?)?.year(); - let year = now_year - now_year.rem_euclid(100) + year.parse::().ok()?; - let year = if year > now_year + 50 { - year - 100 - } else { - year - }; - (day, month, year, *time) - } - [_, month, day, time, year] => (*day, *month, year.parse::().ok()?, *time), - _ => return None, - }; - const MONTHS: [&str; 12] = [ - "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec", - ]; - let month = MONTHS - .iter() - .position(|name| name.eq_ignore_ascii_case(month))?; - let mut clock = time.split(':'); - let (hour, minute, second) = (clock.next()?, clock.next()?, clock.next()?); - if clock.next().is_some() { - return None; - } - let moment = - chrono::NaiveDate::from_ymd_opt(year, u32::try_from(month + 1).ok()?, day.parse().ok()?)? - .and_hms_opt( - hour.parse().ok()?, - minute.parse().ok()?, - second.parse().ok()?, - )?; - u64::try_from(moment.and_utc().timestamp_millis()).ok() -} - -/// The schedule and the thing it drives. Time comes in as an argument so the -/// schedule is testable without waiting. -struct Poller { - cell: Arc, - tokens: Box, - client: UsageClient, - log: Box, - /// No poll before this instant, unix ms: the last answer's own wait. - not_before_ms: u64, - started: bool, - /// The digest of the token the endpoint last refused: while the token - /// reads the same, the poller does not ask again. - refused_token: Option<[u8; 32]>, - last_state: Option, -} - -impl Poller { - fn new( - cell: Arc, - tokens: Box, - client: UsageClient, - log: Box, - ) -> Self { - Self { - cell, - tokens, - client, - log, - not_before_ms: 0, - started: false, - refused_token: None, - last_state: None, - } - } - - /// Polls if a poll is due at `now_ms`; returns how long to wait before - /// asking again. - /// - /// The first call polls. After that a poll is due only when the cell's - /// `seven_day` observation is `STALE` old or older (or absent), and never - /// before the last answer's own wait has passed. A token the endpoint - /// refused is not sent again until it reads differently. - fn tick(&mut self, now_ms: u64) -> Duration { - let due_at = self.due_at_ms(); - if now_ms < due_at { - return Duration::from_millis(due_at - now_ms); - } - self.started = true; - let token = self.tokens.read(); - if let (Some(refused), Some(token)) = (&self.refused_token, &token) - && digest(token) != *refused - { - self.refused_token = None; - } - let verdict = match token { - _ if self.refused_token.is_some() => Verdict { - windows: Vec::new(), - wait: STALE, - state: State::Refused, - }, - Some(token) => { - let verdict = judge(&self.client.ask(&token)); - if verdict.state == State::Refused { - self.refused_token = Some(digest(&token)); - } - verdict - } - None => Verdict { - windows: Vec::new(), - wait: STALE, - state: State::NoToken, - }, - }; - // The reading is as old as the question: an answer that arrives after - // the stream spoke does not outrank it. - self.cell.observe_at(now_ms, verdict.windows); - if self.last_state != Some(verdict.state) { - (self.log)(verdict.state.line()); - self.last_state = Some(verdict.state); - } - self.not_before_ms = now_ms.saturating_add(duration_ms(verdict.wait)); - Duration::from_millis(self.due_at_ms().saturating_sub(now_ms)) - } - - /// The earliest instant the next poll may happen. - fn due_at_ms(&self) -> u64 { - if !self.started { - return 0; - } - let stale_at = self - .cell - .snapshot() - .windows - .iter() - .find(|quota| quota.window == "seven_day") - .map_or(0, |quota| { - quota.observed_at_unix_ms.saturating_add(duration_ms(STALE)) - }); - stale_at.max(self.not_before_ms) - } - - fn run(mut self) { - loop { - let wait = self.tick(unix_ms()); - std::thread::sleep(wait); - } - } -} - -fn digest(token: &Zeroizing) -> [u8; 32] { - Sha256::digest(token.as_bytes()).into() -} - -fn duration_ms(duration: Duration) -> u64 { - u64::try_from(duration.as_millis()).unwrap_or(u64::MAX) -} - -fn unix_ms() -> u64 { - SystemTime::now() - .duration_since(UNIX_EPOCH) - .map_or(0, duration_ms) -} - -/// Starts the poll thread. It reads the token afresh at each poll, writes -/// only to `cell`, and logs one line to stderr when its state changes. -pub(crate) fn start( - cell: Arc, - tokens: Box, - client: UsageClient, -) -> std::io::Result> { - let poller = Poller::new( - cell, - tokens, - client, - Box::new(|line| eprintln!("claude-connector: {line}")), - ); - std::thread::Builder::new() - .name("claude-usage-poll".to_string()) - .spawn(move || poller.run()) -} - -#[cfg(test)] -mod tests { - use super::*; - use std::io::Write; - use std::net::TcpListener; - use std::sync::Mutex; - - const MIN: u64 = 60_000; - const CANARY: &str = "sk-ant-oat01-CANARY-must-never-surface"; - const FAR: &str = "2100-01-01T00:00:00+00:00"; - const FAR_MS: u64 = 4_102_444_800_000; - - fn body(five: &str, seven: &str) -> String { - format!( - r#"{{"five_hour":{five},"seven_day":{seven},"seven_day_opus":null,"extra_usage":{{"x":1}}}}"# - ) - } - - fn reading(percent: f64) -> String { - format!(r#"{{"utilization":{percent},"resets_at":"{FAR}"}}"#) - } - - fn secs(s: u64) -> Duration { - Duration::from_secs(s) - } - - // ---- mapping ---- - - #[test] - fn usage_body_maps_percent_to_permille() { - let windows = parse_usage(&body(&reading(6.0), &reading(35.0))).unwrap(); - let expect = |window: &str, permille| PlanQuota { - window: window.to_string(), - utilization_permille: Some(permille), - resets_at_unix_ms: FAR_MS, - status: "polled".to_string(), - observed_at_unix_ms: 0, - }; - assert_eq!( - windows, - vec![expect("five_hour", 60), expect("seven_day", 350)] - ); - } - - #[test] - fn usage_percent_rounds_to_the_nearest_permille() { - let windows = parse_usage(&body(&reading(12.34), &reading(0.06))).unwrap(); - assert_eq!(windows[0].utilization_permille, Some(123)); - assert_eq!(windows[1].utilization_permille, Some(1)); - let zero = parse_usage(&body(&reading(0.0), "null")).unwrap(); - assert_eq!(zero[0].utilization_permille, Some(0), "a real zero stays"); - } - - #[test] - fn resets_at_is_parsed_with_its_offset_to_unix_ms() { - let seven = r#"{"utilization":1.0,"resets_at":"2026-11-07T12:30:15.250+02:00"}"#; - let windows = parse_usage(&body("null", seven)).unwrap(); - // 2026-11-07T10:30:15.250Z - assert_eq!(windows[0].resets_at_unix_ms, 1_794_047_415_250); - } - - #[test] - fn a_window_missing_a_field_or_reading_nonsense_is_skipped_not_zero() { - let no_percent = format!(r#"{{"utilization":null,"resets_at":"{FAR}"}}"#); - let no_reset = r#"{"utilization":50.0,"resets_at":null}"#; - assert_eq!(parse_usage(&body(&no_percent, no_reset)).unwrap(), vec![]); - let junk = r#"{"utilization":5.0,"resets_at":"soon"}"#; - assert_eq!(parse_usage(&body(&reading(-1.0), junk)).unwrap(), vec![]); - let before_epoch = r#"{"utilization":5.0,"resets_at":"1969-01-01T00:00:00Z"}"#; - assert_eq!(parse_usage(&body(before_epoch, "null")).unwrap(), vec![]); - // One good window survives its neighbour's null. - let one = parse_usage(&body(&no_percent, &reading(35.0))).unwrap(); - assert_eq!(one.len(), 1); - assert_eq!(one[0].window, "seven_day"); - } - - #[test] - fn a_body_that_is_not_an_object_is_unreadable() { - for bad in ["", "not json", "[1,2]", "42", "null"] { - assert_eq!(parse_usage(bad), None, "{bad:?}"); - } - assert_eq!(parse_usage("{}"), Some(vec![])); - } - - // ---- judgement ---- - - fn wait_of(answer: &Answer) -> Duration { - judge(answer).wait - } - - #[test] - fn rate_limit_waits_the_longer_of_retry_after_and_the_floor_capped() { - let limited = |after| wait_of(&Answer::Status(429, after)); - assert_eq!(limited(Some(secs(3600))), secs(3600)); - assert_eq!(limited(Some(secs(20 * 60))), secs(20 * 60)); - assert_eq!(limited(Some(secs(10))), STALE); - assert_eq!(limited(None), STALE); - assert_eq!(limited(Some(secs(100_000))), CEILING); - assert_eq!(limited(Some(secs(6 * 3600))), CEILING); - assert_eq!(judge(&Answer::Status(429, None)).state, State::RateLimited); - } - - #[test] - fn refusal_backs_off_like_the_rest() { - assert_eq!(wait_of(&Answer::Status(401, None)), STALE); - assert_eq!(wait_of(&Answer::Status(403, Some(secs(5)))), STALE); - assert_eq!(judge(&Answer::Status(403, None)).state, State::Refused); - assert_eq!(wait_of(&Answer::Status(404, None)), CEILING); - assert_eq!(wait_of(&Answer::Body("".to_string())), CEILING); - assert_eq!(wait_of(&Answer::Unreachable), STALE); - assert_eq!(wait_of(&Answer::Status(503, None)), STALE); - assert_eq!(wait_of(&Answer::Body(body(&reading(1.0), "null"))), STALE); - } - - // ---- a fake server, a poller, and the cell ---- - - /// Serves each canned reply to one connection in turn and remembers the - /// requests. - fn serve(replies: Vec) -> (String, Arc>>) { - let listener = TcpListener::bind("127.0.0.1:0").unwrap(); - let url = format!("http://{}/api/oauth/usage", listener.local_addr().unwrap()); - let seen = Arc::new(Mutex::new(Vec::new())); - let record = seen.clone(); - std::thread::spawn(move || { - for reply in replies { - let Ok((mut stream, _)) = listener.accept() else { - return; - }; - let mut request = vec![0u8; 4096]; - let n = stream.read(&mut request).unwrap_or(0); - record - .lock() - .unwrap() - .push(String::from_utf8_lossy(&request[..n]).into_owned()); - let _ = stream.write_all(reply.as_bytes()); - } - }); - (url, seen) - } - - fn http(status: &str, headers: &str, body: &str) -> String { - format!( - "HTTP/1.1 {status}\r\n{headers}Content-Length: {}\r\nConnection: close\r\n\r\n{body}", - body.len() - ) - } - - struct Fixed(Option<&'static str>); - impl TokenSource for Fixed { - fn read(&self) -> Option> { - self.0.map(|t| Zeroizing::new(t.to_string())) - } - } - - type Lines = Arc>>; - - fn make_poller( - cell: &Arc, - url: &str, - token: Option<&'static str>, - ) -> (Poller, Lines) { - let lines = Arc::new(Mutex::new(Vec::new())); - let sink = lines.clone(); - let poller = Poller::new( - cell.clone(), - Box::new(Fixed(token)), - UsageClient::new(url), - Box::new(move |line| sink.lock().unwrap().push(line.to_string())), - ); - (poller, lines) - } - - fn window(cell: &QuotaCell, name: &str) -> Option { - cell.snapshot() - .windows - .into_iter() - .find(|q| q.window == name) - } - - fn stream_reading(window: &str, permille: u32) -> PlanQuota { - PlanQuota { - window: window.to_string(), - utilization_permille: Some(permille), - resets_at_unix_ms: FAR_MS, - status: "allowed".to_string(), - observed_at_unix_ms: 0, - } - } - - fn requests(seen: &Arc>>) -> usize { - seen.lock().unwrap().len() - } - - #[test] - fn the_first_tick_polls_and_records_what_the_endpoint_said() { - let (url, seen) = serve(vec![http( - "200 OK", - "Content-Type: application/json\r\n", - &body(&reading(6.0), &reading(35.0)), - )]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY)); - let wait = poller.tick(unix_ms()); - let windows = cell.snapshot().windows; - assert_eq!(windows.len(), 2); - assert_eq!(windows[0].status, "polled"); - assert_eq!(windows[1].utilization_permille, Some(350)); - assert!( - (STALE..STALE + secs(5)).contains(&wait), - "a fresh reading waits until it is stale: {wait:?}" - ); - let request = seen.lock().unwrap()[0].to_lowercase(); - assert!(request.contains(&format!("authorization: bearer {}", CANARY.to_lowercase()))); - assert!(request.contains("anthropic-beta: oauth-2025-04-20")); - assert_eq!(lines.lock().unwrap().len(), 1); - } - - #[test] - fn stale_only_polls() { - let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 3]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, _) = make_poller(&cell, &url, Some(CANARY)); - poller.tick(unix_ms()); - assert_eq!(requests(&seen), 1, "the startup poll"); - let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms; - - // 5 min old: no request, and the wait is the time left. - let wait = poller.tick(observed + 5 * MIN); - assert_eq!(requests(&seen), 1); - assert_eq!(wait, Duration::from_millis(10 * MIN)); - // One millisecond short of 15 min: still none. - poller.tick(observed + 15 * MIN - 1); - assert_eq!(requests(&seen), 1); - // 16 min old: one request. - poller.tick(observed + 16 * MIN); - assert_eq!(requests(&seen), 2); - // That poll's answer holds its own 15 min, whatever the stamp says. - poller.tick(observed + 16 * MIN + 1); - assert_eq!(requests(&seen), 2); - } - - #[test] - fn a_reading_is_stale_at_exactly_fifteen_minutes() { - let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0))); 2]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, _) = make_poller(&cell, &url, Some(CANARY)); - poller.tick(unix_ms()); - let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms; - poller.tick(observed + 15 * MIN); - assert_eq!(requests(&seen), 2); - } - - #[test] - fn a_stream_observation_keeps_the_poll_quiet() { - let (url, seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, _) = make_poller(&cell, &url, Some(CANARY)); - poller.tick(unix_ms()); - std::thread::sleep(Duration::from_millis(20)); - // The stream reports seven_day afresh, after the poll. - cell.observe([stream_reading("seven_day", 400)]); - let observed = window(&cell, "seven_day").unwrap().observed_at_unix_ms; - let wait = poller.tick(observed + 14 * MIN); - assert_eq!(requests(&seen), 1); - assert_eq!(wait, Duration::from_millis(MIN)); - } - - #[test] - fn failures_never_touch_the_cell() { - let limited = |headers: &str| http("429 Too Many Requests", headers, "{}"); - let cases = [ - (limited("Retry-After: 3600\r\n"), 60), - (limited(""), 15), - ( - limited("Retry-After: Wed, 21 Oct 2026 07:28:00 GMT\r\n"), - 15, - ), - ( - limited("Retry-After: Fri, 31 Dec 2100 23:59:59 GMT\r\n"), - 360, - ), - (http("403 Forbidden", "", "{}"), 15), - (http("401 Unauthorized", "", "{}"), 15), - (http("404 Not Found", "", "{}"), 360), - (http("200 OK", "", "not json"), 360), - ( - http("302 Found", "Location: http://127.0.0.1:9/\r\n", ""), - 15, - ), - ]; - for (reply, minutes) in cases { - let (url, _) = serve(vec![reply.clone()]); - let cell = Arc::new(QuotaCell::new()); - cell.observe([ - stream_reading("five_hour", 120), - stream_reading("seven_day", 300), - ]); - let before = cell.snapshot(); - let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY)); - let wait = poller.tick(unix_ms()); - assert_eq!(cell.snapshot(), before, "{reply}"); - assert_eq!(wait.as_secs() / 60, minutes, "{reply}"); - assert_eq!(lines.lock().unwrap().len(), 1, "{reply}"); - } - } - - #[test] - fn an_unreachable_endpoint_waits_the_floor_and_a_missing_token_never_asks() { - // Nothing listens here: bind, learn the port, drop. - let port = TcpListener::bind("127.0.0.1:0") - .unwrap() - .local_addr() - .unwrap() - .port(); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, lines) = - make_poller(&cell, &format!("http://127.0.0.1:{port}/u"), Some(CANARY)); - assert_eq!(poller.tick(unix_ms()), STALE); - assert!(cell.snapshot().windows.is_empty()); - assert_eq!(lines.lock().unwrap().len(), 1); - - let (url, seen) = serve(vec![http("200 OK", "", "{}")]); - let (mut poller, lines) = make_poller(&cell, &url, None); - assert_eq!(poller.tick(unix_ms()), STALE); - assert_eq!(requests(&seen), 0); - assert_eq!(lines.lock().unwrap()[0], State::NoToken.line()); - } - - #[test] - fn a_state_is_logged_once_until_it_changes() { - let limited = http("429 Too Many Requests", "", "{}"); - let (url, _) = serve(vec![ - limited.clone(), - limited, - http("200 OK", "", &body("null", &reading(35.0))), - ]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY)); - let t = unix_ms(); - poller.tick(t); - poller.tick(t + 16 * MIN); - assert_eq!(lines.lock().unwrap().len(), 1, "same state, one line"); - poller.tick(t + 32 * MIN); - let lines = lines.lock().unwrap(); - assert_eq!(lines.len(), 2); - assert_eq!(lines[1], State::Polled.line()); - } - - #[test] - fn nothing_logged_or_stored_holds_the_token() { - let echo = format!(r#"{{"echo":"{CANARY}"}}"#); - let (url, _) = serve(vec![ - http("429 Too Many Requests", "Retry-After: 60\r\n", &echo), - http( - "200 OK", - "", - &format!(r#"{{"five_hour":{},"note":"{CANARY}"}}"#, reading(1.0)), - ), - http("403 Forbidden", "", CANARY), - ]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY)); - let t = unix_ms(); - poller.tick(t); - poller.tick(t + 16 * MIN); - poller.tick(t + 32 * MIN); - let lines = lines.lock().unwrap(); - assert_eq!(lines.len(), 3, "one line per change of state"); - let seen = format!("{lines:?} {:?}", cell.snapshot()); - assert!(!seen.contains("CANARY"), "{seen}"); - } - - #[test] - fn stream_and_poll_share_one_cell() { - let (url, _) = serve(vec![http( - "200 OK", - "", - &body(&reading(6.0), &reading(35.0)), - )]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, _) = make_poller(&cell, &url, Some(CANARY)); - poller.tick(unix_ms()); - assert_eq!(window(&cell, "five_hour").unwrap().status, "polled"); - // A later stream reading of one window replaces the poll's; the other - // window keeps the poll's. - cell.observe([stream_reading("five_hour", 90)]); - let five = window(&cell, "five_hour").unwrap(); - assert_eq!( - (five.status.as_str(), five.utilization_permille), - ("allowed", Some(90)) - ); - assert_eq!(window(&cell, "seven_day").unwrap().status, "polled"); - // And a later poll replaces the stream's. - let (url, _) = serve(vec![http("200 OK", "", &body(&reading(7.0), "null"))]); - let (mut again, _) = make_poller(&cell, &url, Some(CANARY)); - again.tick(unix_ms()); - assert_eq!( - window(&cell, "five_hour").unwrap().utilization_permille, - Some(70) - ); - } - - /// A token the test can rotate. - struct Rotating(Arc>>); - impl TokenSource for Rotating { - fn read(&self) -> Option> { - self.0.lock().unwrap().clone().map(Zeroizing::new) - } - } - - #[test] - fn a_refused_token_is_not_sent_again_until_it_changes() { - let (url, seen) = serve(vec![ - http("403 Forbidden", "", "{}"), - http("200 OK", "", &body("null", &reading(35.0))), - ]); - let token = Arc::new(Mutex::new(Some("first".to_string()))); - let lines = Arc::new(Mutex::new(Vec::new())); - let sink = lines.clone(); - let cell = Arc::new(QuotaCell::new()); - let mut poller = Poller::new( - cell.clone(), - Box::new(Rotating(token.clone())), - UsageClient::new(&url), - Box::new(move |line| sink.lock().unwrap().push(line.to_string())), - ); - let t = unix_ms(); - poller.tick(t); - assert_eq!(requests(&seen), 1); - assert!(lines.lock().unwrap()[0].contains("user:profile")); - // The same token, a quarter hour on and again: the endpoint is not asked. - assert_eq!(poller.tick(t + 16 * MIN), STALE); - poller.tick(t + 32 * MIN); - assert_eq!(requests(&seen), 1); - assert_eq!(lines.lock().unwrap().len(), 1, "one state, one line"); - // A credential that vanishes does not count as a new one. - *token.lock().unwrap() = None; - poller.tick(t + 48 * MIN); - assert_eq!(requests(&seen), 1); - // A rotated credential is tried at the next due time. - *token.lock().unwrap() = Some("second".to_string()); - poller.tick(t + 64 * MIN); - assert_eq!(requests(&seen), 2); - assert!(window(&cell, "seven_day").is_some()); - assert_eq!(lines.lock().unwrap()[1], State::Polled.line()); - } - - /// 2026-11-01 07:28:00 UTC, a Sunday. - fn sunday_morning_ms() -> u64 { - chrono::NaiveDate::from_ymd_opt(2026, 11, 1) - .unwrap() - .and_hms_opt(7, 28, 0) - .unwrap() - .and_utc() - .timestamp_millis() as u64 - } - - #[test] - fn retry_after_reads_all_three_http_date_forms() { - let now = sunday_morning_ms(); - for form in [ - "Sun, 01 Nov 2026 08:28:00 GMT", - "Sunday, 01-Nov-26 08:28:00 GMT", - "Sun Nov 1 08:28:00 2026", - "Sun Nov 1 08:28:00 2026", - ] { - assert_eq!(retry_after(form, now), Some(secs(3600)), "{form}"); - } - } - - #[test] - fn a_two_digit_year_more_than_fifty_years_ahead_is_the_past() { - let now = sunday_morning_ms(); - let on = |yy: &str| retry_after(&format!("Friday, 01-Jan-{yy} 00:00:00 GMT"), now); - assert!(on("76").unwrap() > Duration::ZERO, "2076 is 50 years ahead"); - assert_eq!(on("77"), Some(Duration::ZERO), "1977, not 2077"); - assert!(on("33").unwrap() > Duration::ZERO, "2033"); - assert_eq!(on("94"), Some(Duration::ZERO), "1994"); - } - - #[test] - fn retry_after_reads_seconds_and_http_dates() { - const DATE: &str = "Wed, 21 Oct 2026 07:28:00 GMT"; - let at = chrono::DateTime::parse_from_rfc2822(DATE) - .unwrap() - .timestamp_millis() as u64; - let three_hours = 3 * 3600 * 1000; - assert_eq!(retry_after(DATE, at - three_hours), Some(secs(3 * 3600))); - assert_eq!(retry_after(DATE, at), Some(Duration::ZERO)); - assert_eq!(retry_after(DATE, at + 1), Some(Duration::ZERO), "past"); - assert_eq!(retry_after("3600", at), Some(secs(3600))); - assert_eq!(retry_after(" 3600 ", at), Some(secs(3600))); - for bad in [ - "", - "soon", - "-5", - "3600.5", - "1, 2", - "Wed, 21 Oct 2026", - "Wednesday, 21-Oct-26-1 07:28:00 GMT", - "Wednesday, 21-Oct-2026 07:28:00 GMT", - "Wednesday, 21-Foo-26 07:28:00 GMT", - "Wednesday 21-Oct-26 07:28:00 GMT", - "Wednesday, 21-Oct-26 07:28 GMT", - "Wed Oct 21 07:28:00:01 2026", - "Wed Oct 32 07:28:00 2026", - "Wed Oct 21 25:28:00 2026", - ] { - assert_eq!(retry_after(bad, at), None, "{bad:?}"); - } - } - - #[test] - fn keys_beyond_the_two_plan_windows_are_not_windows() { - let populated = reading(77.0); - let body = format!( - r#"{{"five_hour":{},"seven_day":{},"seven_day_opus":{populated},"seven_day_sonnet":{populated},"extra_usage":{populated}}}"#, - reading(6.0), - reading(35.0) - ); - let names: Vec<_> = parse_usage(&body) - .unwrap() - .into_iter() - .map(|quota| quota.window) - .collect(); - assert_eq!(names, ["five_hour", "seven_day"]); - } - - #[test] - fn a_redirect_is_not_followed_with_the_token() { - let (target, target_seen) = serve(vec![http("200 OK", "", &body("null", &reading(35.0)))]); - let (url, _) = serve(vec![http( - "302 Found", - &format!("Location: {target}\r\n"), - "", - )]); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, lines) = make_poller(&cell, &url, Some(CANARY)); - poller.tick(unix_ms()); - assert_eq!(requests(&target_seen), 0, "the redirect target was asked"); - assert!(cell.snapshot().windows.is_empty()); - assert_eq!(lines.lock().unwrap()[0], State::Unexpected.line()); - } - - #[test] - fn a_silent_endpoint_frees_the_poll_at_its_timeout() { - let listener = TcpListener::bind("127.0.0.1:0").unwrap(); - let url = format!("http://{}/u", listener.local_addr().unwrap()); - let holder = std::thread::spawn(move || { - // Accept, say nothing, keep the connection open. - let held = listener.accept(); - std::thread::sleep(Duration::from_secs(3)); - drop(held); - }); - let started = std::time::Instant::now(); - let answer = UsageClient::with_timeout(url, Duration::from_millis(300)) - .ask(&Zeroizing::new(CANARY.to_string())); - assert_eq!(answer, Answer::Unreachable); - assert!(started.elapsed() < Duration::from_secs(2)); - holder.join().unwrap(); - } - - #[test] - fn the_production_client_asks_the_provider_and_gives_up_after_ten_seconds() { - let client = UsageClient::production(); - assert_eq!(client.url, "https://api.anthropic.com/api/oauth/usage"); - assert_eq!(client.timeout, secs(10)); - assert_eq!(TIMEOUT, secs(10)); - } - - /// Answers one connection after `delay`, as a slow endpoint does. - fn serve_slowly(delay: Duration, reply: String) -> String { - let listener = TcpListener::bind("127.0.0.1:0").unwrap(); - let url = format!("http://{}/api/oauth/usage", listener.local_addr().unwrap()); - std::thread::spawn(move || { - let Ok((mut stream, _)) = listener.accept() else { - return; - }; - let mut request = vec![0u8; 4096]; - let _ = stream.read(&mut request); - std::thread::sleep(delay); - let _ = stream.write_all(reply.as_bytes()); - }); - url - } - - fn stream_event(window: &str, permille: u32, status: &str) -> PlanQuota { - PlanQuota { - status: status.to_string(), - ..stream_reading(window, permille) - } - } - - /// The stream speaks while a poll is in flight; the poll then answers - /// with a reading older than the stream's. Returns the cell after both. - fn stream_speaks_while_the_poll_is_in_flight(status: &str) -> Arc { - let url = serve_slowly( - Duration::from_millis(500), - http("200 OK", "", &body(&reading(50.0), &reading(35.0))), - ); - let cell = Arc::new(QuotaCell::new()); - let (mut poller, _) = make_poller(&cell, &url, Some(CANARY)); - std::thread::scope(|scope| { - let polling = scope.spawn(|| poller.tick(unix_ms())); - std::thread::sleep(Duration::from_millis(150)); - cell.observe([stream_event("five_hour", 1000, status)]); - polling.join().unwrap(); - }); - cell - } - - #[test] - fn a_poll_answered_late_does_not_replace_what_the_stream_saw_meanwhile() { - let cell = stream_speaks_while_the_poll_is_in_flight("allowed"); - let five = window(&cell, "five_hour").unwrap(); - assert_eq!( - (five.status.as_str(), five.utilization_permille), - ("allowed", Some(1000)) - ); - let seven = window(&cell, "seven_day").unwrap(); - assert_eq!( - (seven.status.as_str(), seven.utilization_permille), - ("polled", Some(350)), - "the window the stream did not name takes the poll's reading" - ); - } - - #[test] - fn a_slow_poll_cannot_lift_the_rejection_the_stream_reported_meanwhile() { - let cell = stream_speaks_while_the_poll_is_in_flight("rejected"); - let five = window(&cell, "five_hour").unwrap(); - assert_eq!( - (five.status.as_str(), five.utilization_permille), - ("rejected", Some(1000)) - ); - } - - #[test] - fn a_later_poll_does_not_lift_a_rejection_the_provider_reported_earlier() { - let (url, _) = serve(vec![http("200 OK", "", &body(&reading(50.0), "null"))]); - let cell = Arc::new(QuotaCell::new()); - cell.observe([stream_event("five_hour", 1000, "rejected")]); - let (mut poller, _) = make_poller(&cell, &url, Some(CANARY)); - poller.tick(unix_ms() + MIN); - let five = window(&cell, "five_hour").unwrap(); - assert_eq!( - (five.status.as_str(), five.utilization_permille), - ("rejected", Some(1000)) - ); - } - - #[test] - fn every_state_has_its_own_line() { - let states = [ - State::Polled, - State::NoToken, - State::RateLimited, - State::Refused, - State::NotFound, - State::Unreadable, - State::Unexpected, - State::Unreachable, - ]; - let lines: std::collections::BTreeSet<_> = states.iter().map(|s| s.line()).collect(); - assert_eq!(lines.len(), states.len()); - assert!(lines.iter().all(|line| line.starts_with("usage poll: "))); - } -} diff --git a/crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl b/crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl new file mode 100644 index 0000000..f7238e1 --- /dev/null +++ b/crates/claude-connector/tests/fixtures/claude-2.1.312-meter-call.jsonl @@ -0,0 +1,4 @@ +{"type":"system","subtype":"init","cwd":"/tmp/meter-probe.Ye68uq/work","session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01","tools":[],"mcp_servers":[],"model":"claude-haiku-5-5","permissionMode":"bypassPermissions","slash_commands":[],"apiKeySource":"none","claude_code_version":"2.1.312","output_style":"default","agents":["claude","Explore","general-purpose","Plan","statusline-setup"],"skills":[],"plugins":[{"name":"cc-plugin-sec-default","path":"builtin","source":"cc-plugin-sec-default@builtin"},{"name":"cc-plugin-agents-md","path":"builtin","source":"cc-plugin-agents-md@builtin"},{"name":"cc-plugin-telemetry","path":"builtin","source":"cc-plugin-telemetry@builtin"},{"name":"cc-plugin-plugin-authoring","path":"builtin","source":"cc-plugin-plugin-authoring@builtin"}],"capabilities":["interrupt_receipt_v1","interrupt_cancel_queued_v1","interrupt_send_now_v1","interrupt_requeue_taken_v1","msg_lifecycle_v1","request_marker_lists_v1","ask_user_question_unanswered_v1","lifecycle_wakeup_source_v1","sdk_mcp_tools_list_changed","sdk_mcp_manifests","mcp_read_resource_v1","mcp_tool_ui_meta_v1","ui_surface_v1","mcp_call_result_not_for_model_v1"],"analytics_disabled":false,"product_feedback_disabled":false,"uuid":"8ad7f8d7-2831-43f2-a221-8af6323dcbd9","memory_paths":{"auto":"/tmp/meter-probe.Ye68uq/home/projects/-tmp-meter-probe-Ye68uq-work/memory/"},"original_cwd":"/tmp/meter-probe.Ye68uq/work","additional_directories":[],"messaging_socket_path":"/tmp/cc-socks/2838104.sock","fast_mode_state":"off","fast_mode_disabled_reason":"sdk_opt_in_required","per_turn_effort_active":true,"view_mode":"default"} +{"type":"assistant","message":{"model":"claude-haiku-5-5","id":"msg_011Cgfu1sQvRAVmjwWNHc58s","type":"message","role":"assistant","content":[{"type":"text","text":"ok"}],"container":null,"stop_reason":null,"stop_sequence":null,"stop_details":null,"usage":{"input_tokens":384,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":4,"service_tier":"standard","inference_geo":"global","speed":"standard"},"input_transformations":[],"diagnostics":null,"context_management":null},"parent_tool_use_id":null,"session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01","uuid":"f80db687-b098-415c-ac44-51c40a6cb63a","timestamp":"2026-11-03T11:14:35.024Z","request_id":"req_011Cgfu1sCXBsDrfz8a1LoMd"} +{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1794261600,"rateLimitType":"seven_day","overageStatus":"rejected","overageDisabledReason":"org_level_disabled","isUsingOverage":false,"unifiedWindows":{"seven_day":{"utilization":0.06,"resetsAt":1794261600,"status":"allowed"}}},"uuid":"acb3b364-a218-4965-b967-f73028254f8b","session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01"} +{"duration_api_ms":995,"stop_reason":"end_turn","session_id":"1c3d29e9-8277-4ee0-86df-efc86d994f01","total_cost_usd":0.000040400000000000006,"usage":{"input_tokens":384,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":4,"output_tokens_details":{"thinking_tokens":0},"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"global","iterations":[{"input_tokens":384,"output_tokens":4,"cache_read_input_tokens":0,"cache_creation_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"type":"message"}],"speed":"standard","fallback_credit":null},"modelUsage":{"claude-haiku-5-5":{"inputTokens":384,"outputTokens":4,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000040400000000000006,"contextWindow":1000000,"maxOutputTokens":128000,"thinkingTokens":0,"cacheCreationEphemeral5mInputTokens":0,"cacheCreationEphemeral1hInputTokens":0,"canonicalModel":"claude-haiku-5-5","provider":"firstParty","costBasis":"list"}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","fast_mode_disabled_reason":"sdk_opt_in_required","subagent_stats":{"spawned":0,"requested":{"background":0,"foreground":0,"unset":0},"started_in_background":0,"max_depth":0,"spawned_by_subagents":0,"completed":0,"failed":0,"killed":{"parent":0,"user":0,"system":0},"refused":{"depth_limit":0,"concurrency_limit":0,"budget":0},"by_type":{}},"safety_stops":0,"is_error":false,"num_turns":1,"subtype":"success","api_error_status":null,"result":"ok","ttft_ms":1210,"type":"result","duration_ms":1228,"uuid":"d0b1b31b-1428-45aa-b90e-d35903c9b91b","ttft_stream_ms":1209,"time_to_request_ms":232,"first_content_frame_ms":1209,"queued_turn_count":0,"result_index":0,"model_usage_since_last_result":{"claude-haiku-5-5":{"inputTokens":384,"outputTokens":4,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000040400000000000006,"contextWindow":1000000,"maxOutputTokens":128000,"thinkingTokens":0,"cacheCreationEphemeral5mInputTokens":0,"cacheCreationEphemeral1hInputTokens":0,"canonicalModel":"claude-haiku-5-5","provider":"firstParty","costBasis":"list"}}} diff --git a/crates/claude-connector/tests/fixtures/swarm-brake-live-2026-11-03.cc b/crates/claude-connector/tests/fixtures/swarm-brake-live-2026-11-03.cc new file mode 100644 index 0000000..837a882 --- /dev/null +++ b/crates/claude-connector/tests/fixtures/swarm-brake-live-2026-11-03.cc @@ -0,0 +1 @@ +“²cultcache.store.v1‘—·eureka.control.brake.v1·eureka.control.brake.v1ºeureka.control.brake.v1.v1·eureka.control.brake.v1Ùb{"schemaName":"eureka.control.brake.v1","schemaVersion":"eureka.control.brake.v1.v1","members":[]}‘·eureka.control.brake.v1‘”¥brake·eureka.control.brake.v1´2026-11-03T08:45:01ZÄ/“þ2026-11-03T08:45:01.468996363Z­gamecultadmin \ No newline at end of file