Repository navigation
perf(pricing): give the pricing refresh a verify-only TLS 1.3 rustls provider - #1927
Conversation
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters: 1
📒 Files selected for processing: 6
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ryoppippi
changed the title
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ccusage-guide | 4f483cf | Commit Preview URL Branch Preview URL |
Oct 18 2026, 04:53 PM |
ccusage
@ccusage/ccusage-darwin-arm64
@ccusage/ccusage-darwin-x64
@ccusage/ccusage-linux-arm64
@ccusage/ccusage-linux-x64
@ccusage/ccusage-win32-x64
commit: |
ccusage performance comparisonPR SHA: This compares the Rust PR release binary against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the PR package against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the Rust PR release binary against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the PR package against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ureq's `rustls` feature installs rustls' own ring provider, whose key loader keeps ring's RSA, ECDSA and Ed25519 signing code and PKCS#8 parsing in the binary. The pricing refresh only verifies servers and never presents a client certificate, so none of that is reachable in practice, but LTO cannot prove it. The binary now enables ureq's `rustls-no-provider` and `rustls-webpki-roots` features instead and hands ureq a provider built from the same ring cipher suites, key exchange groups and signature verification algorithms, with system randomness from ring and a key loader that always fails. Negotiation and certificate verification are unchanged. On aarch64-darwin the release binary's sections shrink by 35,090 bytes (3,635,724 -> 3,600,634); the file shrinks by 66,192 bytes because the __TEXT segment drops a page.
raw.githubusercontent.com and models.dev both negotiate TLS 1.3 (checked with `openssl s_client -tls1_3`; both pick X25519 and a TLS 1.3 AEAD suite), so the six TLS 1.2 suites only keep their key schedule, PRF and AEAD glue in the binary. The provider now lists the three TLS 1.3 suites alone, which also means rustls cannot fall back to TLS 1.2. The one setup that could need TLS 1.2 is a TLS-intercepting middlebox, and those already fail certificate verification because the client trusts only the embedded web PKI roots. CONNECT proxies tunnel the origin's own handshake and are unaffected. ureq still enables rustls' `tls12` feature, so the TLS 1.2 handshake state machine stays compiled in for now. Release binary sections on aarch64-darwin: 3,600,634 -> 3,593,067 (-7,567 bytes).
Both pricing hosts select X25519 when it is offered, so the P-256 and P-384 ECDH groups only add their key generation and agreement glue. The provider now offers X25519 alone. ring's P-256 and P-384 arithmetic and its precomputed P-256 table stay: certificate verification still needs them for the ECDSA chain models.dev serves (WE1 -> GTS Root R4). Release binary sections on aarch64-darwin: 3,593,067 -> 3,586,978 (-6,089 bytes).
The CA/Browser Forum Baseline Requirements only permit RSA and ECDSA subscriber and CA keys, and none of the embedded web PKI roots is an Ed25519 key, so no chain the pricing client can accept and no TLS 1.3 CertificateVerify from such a chain uses Ed25519. Dropping it from the verification algorithms lets LTO discard ring's Ed25519 verifier. The X25519 base-point table stays, since key exchange still uses it. Release binary sections on aarch64-darwin: 3,586,978 -> 3,579,431 (-7,547 bytes); the file drops another 16 KiB page.
The ccusage README now lists http.rs and http/ and the ureq, rustls, ring and rustls-webpki dependencies it pulls in. ccusage-core's list drops ureq, which it has not depended on since the client moved into the binary, and gains miniz_oxide, which it does use.
79a90a6 to
4f483cf
Compare
ryoppippi
changed the title
ccusage performance comparisonPR SHA: This compares the Rust PR release binary against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the PR package against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
ℹ️ Minor suggestions only — the narrowing is sound and fail-safe; two small follow-ups below.
Reviewed changes
Reviewed the full stack (6 commits) replacing rustls' own ring provider with a hand-assembled verify-only provider for the pricing refresh:
- Verify-only provider — new
http/tls.rsbuilds aCryptoProviderfrom rustls/ring primitives with ringSystemRandomand a key loader that always fails;http.rshands it to ureq, which moves from therustlsfeature torustls-no-provider+rustls-webpki-roots. - TLS 1.3-only suites — only the three TLS 1.3 cipher suites are offered, with a test pinning that TLS 1.2 cannot negotiate.
- X25519-only key exchange — P-256/P-384 ECDH groups dropped while their arithmetic stays for ECDSA chain verification.
- No Ed25519 verification — dropped from
allandmapping, order otherwise preserved from rustls' ring provider. - Dependency rewiring — workspace gains
ring/rustls/rustls-webpkispecs consumed directly by the binary crate; lockfile shows edge-only changes, no version bumps. - README updates —
ccusagedocuments the client and its deps;ccusage-coredrops a staleureqentry and gains the already-realminiz_oxideentry.
Verification, timeouts, ETag/304 caching, and the embedded-pricing fallback are untouched, and every narrowing fails safe into that fallback. No correctness, security, or release-risk concerns found.
ℹ️ Proxy doc names TLS 1.3 but not X25519
The doc comment on provider() in rust/crates/ccusage/src/http/tls.rs says an https:// proxy with a publicly trusted certificate now needs TLS 1.3, but an https:// proxy that terminates TLS without X25519 would fail the handshake the same way, since kx_groups is X25519-only. Worth naming both so the documented proxy requirement matches the offered surface.
ℹ️ X25519-only and Ed25519-absence are unpinned by tests
TLS 1.2 exclusion has a regression test (provider_cannot_negotiate_tls_1_2), but neither the X25519-only kx_groups nor the Ed25519 removal from SIGNATURE_ALGORITHMS does. A later edit widening either would silently undo the size win. Consider pinning the single group and the Ed25519 absence next to that test.
muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏
Upstream tip: c76874e (2026-10-20, chore(pricing): update models.dev snapshot) Previous fork base: 0c58b88 (the upstream commit this fork was synced to) Synced 83 upstream commits on top of 0c58b88: 56 automated pricing snapshot refreshes and the following meaningful ones: 1cd29f5 chore(deps): update pnpm to v12.13.0 (ccusage#1907) e4f63ba chore(deps): update node.js to >=24.22.0 (ccusage#1908) 130e502 ci: regenerate bun.nix automatically (ccusage#1909) 259ec33 feat(adapter): report stored cost in JSON model breakdowns (ccusage#1903) c1eb448 chore: release v20.0.35 (ccusage#1901) 2a0875f ci(pricing): update snapshots on push to main and daily instead of hourly (ccusage#1914) b090428 chore(deps): update github/codeql-action action to v4.39.0 (ccusage#1912) 4dcf7f5 fix(nix): pin models-dev-gen remeda to models.dev's version and stop Renovate drift (ccusage#1915) 46edb28 fix(nix): stop the dev shell from copying the whole repository (ccusage#1917) 58ec8f1 fix(nix): let commits succeed in worktrees without a loaded dev shell (ccusage#1920) a570a6f fix(nix): vendor Cargo deps without import-from-derivation (ccusage#1918) f6d28c5 fix(antigravity): map model IDs 1418/1419 to gemini-4-argon (ccusage#1905) ce439e5 fix(antigravity): map model ID 1050 to gemini-3.1-flash-lite (ccusage#1902) e62a66f chore(deps): update pnpm to v12.14.0 (ccusage#1923) 117ae68 ci(nix): make the macOS Nix cache save a trimmed store with the Crane layers (ccusage#1921) 7a063a0 ci: shorten the Windows native build critical path (ccusage#1924) 85ebca3 perf(rust): move pricing snapshots into a leaf crate (ccusage#1922) 8fe3f47 perf(nix): build Crane layers with the binary's feature resolution (ccusage#1925) ac289aa perf(pricing): give the pricing refresh a verify-only TLS 1.3 rustls provider (ccusage#1927) d097f74 chore(deps): update rust crate rustls to 0.23.46 (ccusage#1928) f8aaf89 docs: use the compact pkg.pr.new URL for bunx previews [ci skip] (ccusage#1929) f56bb3d chore: release v20.0.36 (ccusage#1916) aaafb41 chore(deps): update dependency vitepress-plugin-group-icons to ^1.8.1 (ccusage#1931) 0861e7f fix(claude): count requestless resp_ content blocks once (ccusage#1935) 867c9f3 chore: release v20.0.37 (ccusage#1933) fa40bfd chore(deps): update songmu/tagpr action to v1.21.3 (ccusage#1937) de99d15 chore(deps): update rust crate zstd to 0.14.3 (ccusage#1936) Fork wins kept: the SQLite on-disk cache with --live-only and the per-namespace ledger, the pi adapter and its per-path namespaces, the OpenCode V2 loader, the FxHash/Cow hot paths, the table renderer, clear-cache, and the tag-only release workflow. Upstream's own release and tagpr machinery stays out. Hand-resolved conflicts: rust/adapters/claude/src/lib.rs: upstream's resp_ message-id dedupe (ccusage#1935) lands beside the fork's requestless replay and collapse_replays rules. rust/adapters/claude/src/README.md: upstream's wording for the msg_/resp_ exception. rust/Cargo.toml: zstd 0.14.3, keeping the fork's exact `=` pin style. .github/workflows/release.yaml: the fork's tag-only release, without upstream's tagpr job or the songmu/tagpr action bump. apps/ccusage/package.json, docs/package.json, package.json: keep 20.0.34; upstream's 20.0.37 bump is dropped. packages/ccusage-*/package.json (6 files): stay deleted; the fork ships no npm wrapper packages and the release workflow does not read them. rust/adapters/claude/src/daily.rs: stays deleted; the fork's daily path lives in lib.rs and shares the dedupe helper the fix changes. Fixes made while landing this sync, folded in so the merge stands green on its own: fix(ci): save the Nix store from the native build composites. The nested cache-nix-action read an empty primary-key at post-job and every native build failed; upstream's defer-save pattern is the fix. fix(rust): keep the agent-recorded cost for deleted sources. The recorded_cost ledger column carries it, so storedCost survives a deleted file. The ledger schema version stays at 2: the column is not a LedgerEntry field, so the blob layout is unchanged and the previously released binary keeps working. fix(rust): make the file fingerprint helper private, the one hawk finding. It is inherited from the pre-sync master, not introduced here. Keep 20.0.34 numbering; DO NOT push a v20.0.34 tag from this fork (release.yaml would publish fork bytes under upstream identity).
Stack created with GitHub Stacks CLI • Give Feedback 💬
Summary
Shrinks the release binary by 66,272 bytes (3,661,648 → 3,595,376 on aarch64-darwin, -1.8%) by narrowing the rustls configuration the online pricing refresh uses. The HTTP client stays ureq; no networking code is reimplemented. The refresh behaves the same: both endpoints, ETag/304 revalidation, the 10 s deadline, the 64 MiB cap, validation, proxies, and the fallback to embedded pricing.
What Changed
rustls-no-providerand receives a verify-only rustlsCryptoProviderassembled from rustls' and webpki's own ring building blocks (http/tls.rs). It uses ring'sSystemRandomlike rustls' ring provider, and refuses to load private keys, which drops ring's signing and PKCS#8 code.ureqentry).Why
An earlier revision of this PR replaced ureq with a ~600-line in-house HTTP/1.1 client and gzip decoder for a further ~215 KB. We dropped that in favor of keeping a well-maintained client: owning HTTP parsing is not worth the size for two GET requests per run. The remaining trims only select from rustls' existing building blocks.
Behavior differences (each fails safe by falling back to embedded pricing): if either host stopped offering TLS 1.3 or X25519, the refresh would use embedded pricing, and an
https://proxy with a publicly trusted certificate now also needs TLS 1.3. TLS-intercepting proxies already failed before, because only the embedded web PKI roots are trusted.Testing
LOG_LEVEL=5(304 path);--offlinepriced the same.cargo test -p ccusage(82 passed), including tests that the provider builds a client config, cannot negotiate TLS 1.2, and loads no keys.-D warnings, treefmt, gitleaks, cargo test.nix build .#ccusageon aarch64-darwin: 3,595,376 bytes, linking onlylibSystem.