fix(quota): avoid CLIProxyAPI core route collision

[turnercore]

Summary

Rename the plugin-owned quota data route from /plugins/opencode-go-cliproxyapi/quota to /plugins/opencode-go-cliproxyapi/quota-usage.

CLIProxyAPI v7.2.159 added native GET/POST/DELETE /v0/management/plugins/:id/quota routes. Plugin management handlers are reached through the server's NoRoute fallback, so the native POST route now intercepts the quota page's {key_id: ...} request and returns {"error":"auth_index is required"} before this plugin receives it.

The renamed path does not match a core route and reaches the existing plugin management handler. The Management Center resource/menu URL remains unchanged.

Changes

• advertise /plugins/opencode-go-cliproxyapi/quota-usage during management registration
• accept that path in HandleManagement
• update the embedded quota page fetch URL
• update quota registration and handler tests

Verification

• go test -buildvcs=false ./...
• go vet ./...
• built with go build -buildvcs=false -buildmode=c-shared
• loaded the resulting plugin in CLIProxyAPI v7.2.159
• verified the embedded resource page calls the renamed endpoint
• verified credential listing and live rolling/weekly/monthly quota refresh
• regression-tested Chat Completions (glm-5.2), Anthropic Messages (kimi-k3), and Responses (gpt-5.5)

[Copilot]

🟢 Approval recommended

Remaining findings are minor test-coverage nits and do not block approval.

Pull request overview

Renames the plugin quota API route to avoid collision with CLIProxyAPI core routes while preserving the Management Center resource URL.

Changes:

• Uses /quota-usage for registration, handling, and page requests.
• Updates quota route tests.
• Preserves the existing resource/menu path.

File summaries

File	Reviewed changes
resources/quota_page.html	Uses the renamed quota endpoint.
internal/plugin/quota.go	Handles the renamed route.
internal/plugin/quota_test.go	Updates route and handler tests.
internal/plugin/plugin.go	Advertises the renamed route.

Review details

Suppressed comments (2)

internal/plugin/quota_test.go:24

• This registration assertion does not cover the embedded page's independently hard-coded endpoint. A future mismatch could leave the page posting to the still-colliding /quota path while both the registration and handler tests pass; add an assertion that resources.QuotaPage contains /v0/management/plugins/ + pluginName + /quota-usage.

	if len(got.Routes) != 1 || got.Routes[0].Method != http.MethodPost || got.Routes[0].Path != "/plugins/"+pluginName+"/quota-usage" {

resources/quota_page.html:108

• This literal is the runtime contract between the embedded page and HandleManagement, but the existing page tests only check unrelated markers. The registration and handler tests can therefore pass if this URL drifts, leaving the Management Center page to hit a 404 or a core route; add a regression assertion for the exact /v0/management/plugins/opencode-go-cliproxyapi/quota-usage endpoint in quota_test.go.

  const endpoint = "/v0/management/plugins/opencode-go-cliproxyapi/quota-usage";

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.