@antseed/cli 0.1.147 → 0.1.149

package/dist/proxy/buyer-proxy.js

@@ -3,10 +3,12 @@ import { randomUUID } from 'node:crypto';
 import { watchFile, unwatchFile } from 'node:fs';
 import { readFile, writeFile, rename, mkdir, readdir, stat, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
-import { ANTSEED_BUYER_FAULT_ERROR_CODE, ANTSEED_FAULT_ATTRIBUTION_HEADER, ANTSEED_ATTEST_PATH, computeOnChainReputationScore, decodeSweepRequest, faultAttributionOf, faultCodeOf, peerSupportsCooperativeClose, } from '@antseed/node';
+import { ANTSEED_BUYER_FAULT_ERROR_CODE, ANTSEED_FAULT_ATTRIBUTION_HEADER, ANTSEED_ATTEST_PATH, computeOnChainReputationScore, decodeSweepRequest, faultAttributionOf, faultCodeOf, isModelRouteEligible, peerSupportsCooperativeClose, rankModelRoutes, } from '@antseed/node';
+import { canonicalModelKey } from '@antseed/node/model-identity';
 import { createStreamingAdapter, detectRequestServiceApiProtocol, transformRequest, transformResponse, } from './service-api-adapter.js';
 import { DEBUG, log, extractRequestedService, summarizeRequestShape, summarizeErrorResponse, requestWantsStreaming, parsePeerPinnedService, rewritePeerPinnedServiceInBody, substituteRoutedModelAlias, overrideRoutedModelInBody, ROUTED_MODEL_ALIAS, SYSTEM_PROXY_SOURCE_HEADER, SYSTEM_ROUTED_MODEL_HEADER, normalizePeerId, } from './request-utils.js';
-import { findUnannouncedRequestParameters, getExplicitProviderOverride, getExplicitPeerIdOverride, resolvePeerRoutePlan, selectCandidatePeersForRouting, } from './routing.js';
+import { buildNetworkModels, effectiveModelReputationScore, normalizedModelReputationScore, parseModelTypeFilter, } from './network-models.js';
+import { findUnannouncedRequestParameters, findAdvertisedServiceOffer, getExplicitProviderOverride, getExplicitPeerIdOverride, resolvePeerRoutePlan, selectCandidatePeersForRouting, } from './routing.js';
 import { computeResponseTelemetry, attachAntseedTelemetryHeaders, attachStreamingAntseedHeaders, } from './telemetry.js';
 import { DEFAULT_BUYER_PEER_REFRESH_INTERVAL_MS } from '../config/defaults.js';
 import { extractConversationIdentity, extractFirstUserSnippet, isCompletionRequestPath, isTitleGenerationRequest, parseRequestBodyObject, } from './conversation-identity.js';
@@ -15,10 +17,63 @@ import { recordPeerFailureEntry, clearPeerHealthEntry, isCoolingDown, parsePersi
 import { PeerAttributionTracker, HEARTBEAT_MS } from './peer-attribution.js';
 import { estimateAnthropicPromptTokens, isCountTokensPath } from './count-tokens.js';
 import { getCachedVerdict, runVerifier, verifierSupportFingerprint } from '../plugins/verifier.js';
+import { loadConfig } from '../config/loader.js';
 // Re-export for backward compatibility (used by tests and other consumers)
 export { selectCandidatePeersForRouting } from './routing.js';
 export { parsePeerPinnedService, rewritePeerPinnedServiceInBody, substituteRoutedModelAlias, ROUTED_MODEL_ALIAS } from './request-utils.js';
 const RETRYABLE_STATUS_CODES = new Set([408, 429, 500, 502, 503, 504]);
+const MODEL_RATE_LIMIT_MAX_ATTEMPTS_PER_PEER = 3;
+const MODEL_RATE_LIMIT_RETRY_DELAYS_MS = [250, 750];
+const MODEL_RATE_LIMIT_MAX_RETRY_AFTER_MS = 2_000;
+function rateLimitRetryDelayMs(headers, retryIndex) {
+    const retryAfter = headers['retry-after'] ?? headers['Retry-After'];
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds >= 0) {
+            return Math.min(MODEL_RATE_LIMIT_MAX_RETRY_AFTER_MS, Math.round(seconds * 1_000));
+        }
+    }
+    return MODEL_RATE_LIMIT_RETRY_DELAYS_MS[retryIndex] ?? MODEL_RATE_LIMIT_RETRY_DELAYS_MS.at(-1);
+}
+async function waitForRetry(delayMs, signal) {
+    if (signal.aborted)
+        return false;
+    return new Promise((resolve) => {
+        const onAbort = () => {
+            clearTimeout(timeout);
+            resolve(false);
+        };
+        const timeout = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(true);
+        }, delayMs);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * A routed-model target is either a bare `<service>` (automatic peer
+ * selection) or an explicit `<peerId>@<service>` pin. The `antseed` alias
+ * itself can never be a target — it would recurse.
+ */
+function isValidRoutedModelTarget(value) {
+    if (value === ROUTED_MODEL_ALIAS)
+        return false;
+    return !value.includes('@') || parsePeerPinnedService(value) !== null;
+}
+/** Returns `request` with its body's model field rewritten to `serviceId`, or unchanged if nothing rewrote. */
+function withRoutedModel(request, serviceId) {
+    const rewritten = overrideRoutedModelInBody(request.body, request.headers, serviceId);
+    return rewritten.overridden
+        ? { ...request, body: rewritten.body, headers: rewritten.headers }
+        : request;
+}
+function peerAllowedByPolicy(policyRouter, request, peer) {
+    if (policyRouter?.allowsPeerForPolicy)
+        return policyRouter.allowsPeerForPolicy(request, peer);
+    if (policyRouter?.allowsPeerForPricing)
+        return policyRouter.allowsPeerForPricing(request, peer);
+    return true;
+}
 function isControlPlaneServicesPath(path) {
     return path.toLowerCase().startsWith('/v1/models');
 }
@@ -390,6 +445,11 @@ export function parsePersistedPeers(parsed, nowMs = Date.now(), maxAgeMs = CARRY
         if (entry.verificationResults && typeof entry.verificationResults === 'object') {
             peer.verificationResults = entry.verificationResults;
         }
+        if (peer.onChainReputationScore === undefined) {
+            const derivedScore = computeOnChainReputationScore(peer, nowMs);
+            if (derivedScore !== null)
+                peer.onChainReputationScore = derivedScore;
+        }
         peers.push(peer);
     }
     return peers;
@@ -501,10 +561,13 @@ export class BuyerProxy {
     _peerCacheTtlMs;
     _stateDir;
     _stateFile;
+    _configPath;
     _stateFileWatching = false;
+    _configFileWatching = false;
     _pinnedPeer;
     /**
-     * Route substituted for the `antseed` model alias (`<peerId>@<service>`).
+     * Route substituted for the `antseed` model alias (`<service>` for automatic
+     * peer selection, or `<peerId>@<service>` for an explicit seller pin).
      * Set via `POST /_antseed/route` (the desktop keeps it on the current VPR
      * selection) and persisted in buyer.state.json like the session peer pin.
      */
@@ -520,6 +583,8 @@ export class BuyerProxy {
     _verifier;
     _verifyCache = new Map();
     _stateWatchDebounce = null;
+    _configWatchDebounce = null;
+    _routingPreferences;
     _stateWriteChain = Promise.resolve();
     _cachedPeers = [];
     _cacheLastUpdatedAtMs = 0;
@@ -561,8 +626,16 @@ export class BuyerProxy {
         this._peerCacheTtlMs = Math.max(0, config.peerCacheTtlMs ?? Math.max(6 * 60_000, this._bgRefreshIntervalMs + 60_000));
         this._stateDir = config.dataDir;
         this._stateFile = join(config.dataDir, 'buyer.state.json');
+        this._configPath = config.configPath ?? null;
         this._conversations = new ConversationStore(config.dataDir);
         this._pinnedPeer = config.pinnedPeerId?.toLowerCase() ?? null;
+        this._routingPreferences = config.routingPreferences
+            ? {
+                ...config.routingPreferences,
+                allowedPeerIds: [...config.routingPreferences.allowedPeerIds],
+                blockedPeerIds: [...config.routingPreferences.blockedPeerIds],
+            }
+            : null;
         this._now = config.now ?? (() => Date.now());
         this._server = createServer((req, res) => {
             this._handleRequest(req, res).catch((err) => {
@@ -661,6 +734,7 @@ export class BuyerProxy {
         this._startIncrementalDiscoverySweep();
         await this._writeStateFile('connected');
         this._watchStateFile();
+        this._watchConfigFile();
     }
     async _hydratePeersFromStateFile() {
         try {
@@ -699,6 +773,14 @@ export class BuyerProxy {
             unwatchFile(this._stateFile);
             this._stateFileWatching = false;
         }
+        if (this._configWatchDebounce) {
+            clearTimeout(this._configWatchDebounce);
+            this._configWatchDebounce = null;
+        }
+        if (this._configFileWatching && this._configPath) {
+            unwatchFile(this._configPath);
+            this._configFileWatching = false;
+        }
         if (this._bgRefreshHandle) {
             clearInterval(this._bgRefreshHandle);
             this._bgRefreshHandle = null;
@@ -747,13 +829,51 @@ export class BuyerProxy {
                 this._pinnedPeer = pinnedPeer;
             }
             const routedModel = typeof parsed.defaultRoutedModel === 'string' ? parsed.defaultRoutedModel.trim() : '';
-            this._defaultRoutedModel = parsePeerPinnedService(routedModel) ? routedModel : null;
+            this._defaultRoutedModel = routedModel.length > 0 && isValidRoutedModelTarget(routedModel) ? routedModel : null;
             log(`Session overrides reloaded: peer=${this._pinnedPeer ?? 'none'} route=${this._defaultRoutedModel ?? 'none'}`);
         }
         catch {
             // state file unreadable; keep current values
         }
     }
+    _watchConfigFile() {
+        if (!this._configPath)
+            return;
+        try {
+            watchFile(this._configPath, { persistent: false, interval: 500 }, (curr, prev) => {
+                if (curr.mtimeMs === prev.mtimeMs && curr.ino === prev.ino)
+                    return;
+                if (this._configWatchDebounce)
+                    clearTimeout(this._configWatchDebounce);
+                this._configWatchDebounce = setTimeout(() => {
+                    this._configWatchDebounce = null;
+                    void this._reloadRoutingPreferences().catch(() => { });
+                }, 50);
+            });
+            this._configFileWatching = true;
+        }
+        catch {
+            // Config watcher failure is non-fatal; startup preferences remain active.
+        }
+    }
+    async _reloadRoutingPreferences() {
+        if (!this._configPath)
+            return;
+        try {
+            const config = await loadConfig(this._configPath);
+            const next = config.buyer.routingPreferences;
+            this._routingPreferences = {
+                ...next,
+                allowedPeerIds: [...next.allowedPeerIds],
+                blockedPeerIds: [...next.blockedPeerIds],
+            };
+            log(`Routing preferences reloaded: minTrust=${next.minTrustScore} maxInput=${next.maxInputUsdPerMillion} `
+                + `preferFree=${next.preferFreePeers} allow=${next.allowedPeerIds.length} block=${next.blockedPeerIds.length}`);
+        }
+        catch (err) {
+            log(`Routing preferences reload ignored: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     /** Stamp the last model-request activity time (dispatch or streamed frame). */
     _markModelActivity() {
         this._lastModelActivityAt = Date.now();
@@ -1309,9 +1429,9 @@ export class BuyerProxy {
                 res.end(JSON.stringify({ ok: false, error: 'Invalid JSON body' }));
                 return;
             }
-            if (model.length > 0 && !parsePeerPinnedService(model)) {
+            if (model.length > 0 && !isValidRoutedModelTarget(model)) {
                 res.writeHead(400, { 'content-type': 'application/json' });
-                res.end(JSON.stringify({ ok: false, error: 'model must be "<peerId>@<service>" (or empty to clear)' }));
+                res.end(JSON.stringify({ ok: false, error: 'model must be "<service>", "<peerId>@<service>", or empty to clear' }));
                 return;
             }
             this._defaultRoutedModel = model.length > 0 ? model : null;
@@ -1326,6 +1446,24 @@ export class BuyerProxy {
             res.end(JSON.stringify({ ok: true, conversations: this._conversations.list() }));
             return;
         }
+        const conversationMatch = path.match(/^\/_antseed\/conversations\/(.+)$/);
+        if (conversationMatch && method === 'GET') {
+            let id = '';
+            try {
+                id = decodeURIComponent(conversationMatch[1] ?? '');
+            }
+            catch {
+                res.writeHead(400, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: 'Invalid conversation id' }));
+                return;
+            }
+            const conversation = this._conversations.get(id);
+            res.writeHead(conversation ? 200 : 404, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(conversation
+                ? { ok: true, conversation }
+                : { ok: false, error: 'Unknown conversation' }));
+            return;
+        }
         if (path === '/_antseed/conversations/update' && method === 'POST') {
             const chunks = [];
             let totalSize = 0;
@@ -1367,9 +1505,9 @@ export class BuyerProxy {
             }
             if ('pinnedModel' in parsed) {
                 const pin = typeof parsed.pinnedModel === 'string' ? parsed.pinnedModel.trim() : '';
-                if (pin.length > 0 && !parsePeerPinnedService(pin)) {
+                if (pin.length > 0 && !isValidRoutedModelTarget(pin)) {
                     res.writeHead(400, { 'content-type': 'application/json' });
-                    res.end(JSON.stringify({ ok: false, error: 'pinnedModel must be "<peerId>@<service>" (or empty to clear)' }));
+                    res.end(JSON.stringify({ ok: false, error: 'pinnedModel must be "<service>", "<peerId>@<service>", or empty to clear' }));
                     return;
                 }
                 // 'user' marks a seller the user chose for this specific chat — the
@@ -1556,6 +1694,63 @@ export class BuyerProxy {
         res.writeHead(404, { 'content-type': 'application/json' });
         res.end(JSON.stringify({ ok: false, error: 'Unknown control-plane endpoint' }));
     }
+    /**
+     * GET /v1/models[?type=text|images] and GET /v1/models/:id — answered
+     * locally from the discovered-peer cache, aggregated across the network. The
+     * `x-antseed-request-id` response header keeps the port-reuse probe in
+     * `buyer start` recognizing this as an AntSeed proxy.
+     */
+    async _handleNetworkModels(res, rawPath) {
+        const url = new URL(rawPath, 'http://localhost');
+        const responseHeaders = { 'content-type': 'application/json', 'x-antseed-request-id': randomUUID() };
+        const peers = await this._getPeers();
+        const models = buildNetworkModels(peers, this._now(), {
+            routingPreferences: this._routingPreferences,
+            peerHealth: this._peerHealth,
+        });
+        const modelIdRaw = url.pathname.replace(/^\/v1\/models\/?/i, '');
+        if (modelIdRaw.length > 0) {
+            let modelId;
+            try {
+                modelId = decodeURIComponent(modelIdRaw).trim();
+            }
+            catch {
+                modelId = modelIdRaw.trim();
+            }
+            const modelKey = canonicalModelKey(modelId);
+            const model = models.find((entry) => canonicalModelKey(entry.id) === modelKey);
+            if (!model) {
+                res.writeHead(404, responseHeaders);
+                res.end(JSON.stringify({
+                    error: {
+                        message: `Model "${modelId}" was not found on the network.`,
+                        type: 'invalid_request_error',
+                        code: 'model_not_found',
+                    },
+                }));
+                return;
+            }
+            res.writeHead(200, responseHeaders);
+            res.end(JSON.stringify(model));
+            return;
+        }
+        const typeFilter = parseModelTypeFilter(url.searchParams.get('type'));
+        if (typeFilter === 'invalid') {
+            res.writeHead(400, responseHeaders);
+            res.end(JSON.stringify({
+                error: {
+                    message: `Unknown model type "${url.searchParams.get('type') ?? ''}" — expected "text" or "images".`,
+                    type: 'invalid_request_error',
+                    param: 'type',
+                },
+            }));
+            return;
+        }
+        const data = typeFilter === 'all' ? models : models.filter((entry) => entry.type === typeFilter);
+        log(`GET /v1/models answered locally: ${data.length} models across ${peers.length} peers${typeFilter ? ` (type=${typeFilter})` : ''}`);
+        res.writeHead(200, responseHeaders);
+        res.end(JSON.stringify({ object: 'list', data }));
+    }
     async _handleRequest(req, res) {
         const method = req.method ?? 'GET';
         const path = req.url ?? '/';
@@ -1577,6 +1772,13 @@ export class BuyerProxy {
             res.end(JSON.stringify({ error: { message: 'Not found', type: 'invalid_request_error' } }));
             return;
         }
+        // `/v1/models` is answered locally from the discovered-peer cache: one
+        // entry per model across the whole network, with the peers serving it.
+        // Routed to a single pinned seller it would only cover that seller's
+        // services — and would require a pin just to browse the network.
+        if (method === 'GET' && normalizedPath.startsWith('/v1/models')) {
+            return this._handleNetworkModels(res, path);
+        }
         // Collect request body
         const chunks = [];
         for await (const chunk of req) {
@@ -1622,12 +1824,10 @@ export class BuyerProxy {
         // _reloadSessionOverrides() cannot change routing mid-request.
         const effectivePinnedPeer = this._pinnedPeer;
         // Per-chat routing: completion requests carry a stable per-conversation
-        // identity (see conversation-identity.ts). A chat pinned to a model
-        // overrides the session default when resolving the `antseed` alias;
-        // subagent sessions inherit their parent chat's pin. The default route
-        // only steers a chat's first request — the model that serves it becomes
-        // the chat's own pin (ConversationStore.touch), so changing the default
-        // later applies to new chats only.
+        // identity (see conversation-identity.ts). Explicit chat pins remain hard;
+        // automatically selected routes become soft affinity, so later turns stay
+        // on the same seller unless it is cooling, unavailable, or fails retryably.
+        // Subagent sessions inherit their parent chat's route.
         const isConversationRequest = method === 'POST' && isCompletionRequestPath(path);
         const conversationBody = isConversationRequest
             ? parseRequestBodyObject(serializedReq.body, serializedReq.headers)
@@ -1638,13 +1838,22 @@ export class BuyerProxy {
         // Internal marker from the system proxy: source profile used only for
         // local conversation attribution. Stripped here so it never reaches a seller.
         delete serializedReq.headers[SYSTEM_PROXY_SOURCE_HEADER];
-        const chatPinnedModel = conversationIdentity
-            ? this._conversations.getPinnedModel(conversationIdentity.tool, conversationIdentity.sessionKey)
-                ?? (conversationIdentity.parentSessionKey
-                    ? this._conversations.getPinnedModel(conversationIdentity.tool, conversationIdentity.parentSessionKey)
-                    : null)
+        const trackedConversationKey = conversationIdentity
+            ? conversationIdentity.parentSessionKey ?? conversationIdentity.sessionKey
             : null;
+        const storedConversation = conversationIdentity && trackedConversationKey
+            ? this._conversations.get(`${conversationIdentity.tool}:${trackedConversationKey}`)
+            : null;
+        const storedAutoRoute = storedConversation?.peerSource === 'auto' && storedConversation.pinnedModel
+            ? parsePeerPinnedService(storedConversation.pinnedModel)
+            : null;
+        const chatPinnedModel = storedConversation?.peerSource === 'user'
+            ? storedConversation.pinnedModel
+            : storedAutoRoute?.service ?? storedConversation?.pinnedModel ?? null;
+        const preferredPeerHeader = normalizePeerId(serializedReq.headers['x-antseed-prefer-peer'] ?? '');
+        const preferredConversationPeerId = preferredPeerHeader ?? storedAutoRoute?.peerId ?? null;
         const effectiveRoutedModel = chatPinnedModel ?? this._defaultRoutedModel;
+        let trackedConversationId = storedConversation?.id ?? null;
         // Resolve the `antseed` model alias to the session's default route first,
         // so the regular `<peerId>@<service>` pin rewrite below picks up the
         // substituted value. Tool configs written by the desktop carry the alias
@@ -1713,6 +1922,13 @@ export class BuyerProxy {
                     snippet,
                     lastModel: titleTurn ? null : resolvedModel,
                 });
+                const explicitConversationPin = resolvedModel && (parsePeerPinnedService(rawModel)
+                    || (aliasResult.substituted && parsePeerPinnedService(effectiveRoutedModel ?? ''))
+                    || (chatPinOverrideApplied && parsePeerPinnedService(chatPinnedModel ?? '')));
+                if (explicitConversationPin) {
+                    this._conversations.setPinnedModel(tracked.id, resolvedModel, 'user');
+                }
+                trackedConversationId = tracked.id;
                 // Bind the request to the chat so its cost can be attributed when the
                 // payment layer signs for it (see _attributeSpend).
                 this._trackRequestConversation(serializedReq.requestId, tracked.id);
@@ -1749,21 +1965,10 @@ export class BuyerProxy {
         const explicitProvider = getExplicitProviderOverride(serializedReq);
         const explicitPeerId = getExplicitPeerIdOverride(serializedReq, effectivePinnedPeer ?? undefined, bodyPinnedPeer);
         log(`Routing hints: provider=${explicitProvider ?? 'auto'} pin-peer=${explicitPeerId ?? 'none'}`);
-        // Auto peer selection is disabled. Every request MUST target a specific
-        // peer, either via the per-request `x-antseed-pin-peer` header, a
-        // `<peerId>@<model>` model prefix, or a session-wide pin set by
-        // `antseed buyer connection set --peer <peerId>`.
-        //
-        // Surface the error in the structured shape OpenAI/Anthropic SDKs expect
-        // (`{ error: { type, code, message, ... } }`) so callers see a proper
-        // .message on their error objects instead of a raw text/plain body. We
-        // use HTTP 400 — the request is missing required information the buyer
-        // cannot infer on its own — which is what SDK retry/error logic treats
-        // as a non-retryable client mistake.
-        if (!explicitPeerId) {
-            log('Request rejected: no peer pinned');
-            const errorMessage = 'No peer pinned. Auto-selection is disabled.\n'
-                + 'Pin a peer one of three ways:\n'
+        if (!explicitPeerId && !requestedService) {
+            log('Request rejected: no peer pinned and no model requested');
+            const errorMessage = 'No model or peer was specified.\n'
+                + 'Set the request model, or pin a peer one of three ways:\n'
                 + '  • Per-request header:   x-antseed-pin-peer: <peerId>    (40-char hex EVM address)\n'
                 + '  • Model name prefix:    <peerId>@<model>\n'
                 + '  • Session pin:          antseed buyer connection set --peer <peerId>\n'
@@ -1771,10 +1976,10 @@ export class BuyerProxy {
             res.writeHead(400, { 'content-type': 'application/json' });
             res.end(JSON.stringify({
                 error: {
-                    type: 'no_peer_pinned',
-                    code: 'no_peer_pinned',
+                    type: 'missing_routing_target',
+                    code: 'missing_routing_target',
                     message: errorMessage,
-                    param: 'x-antseed-pin-peer',
+                    param: 'model',
                     help: {
                         perRequestHeader: 'x-antseed-pin-peer: <peerId>',
                         modelPrefix: '<peerId>@<model>',
@@ -1793,6 +1998,146 @@ export class BuyerProxy {
             res.end('No sellers available on the network. Is a seeder running?');
             return;
         }
+        if (!explicitPeerId && requestedService) {
+            const selectModelPeers = (candidateSources) => selectCandidatePeersForRouting(candidateSources, requestProtocol, requestedService, explicitProvider, 'strict');
+            let discoveredPeers = peers;
+            let { candidatePeers: modelPeers, routePlanByPeerId: modelPlans } = selectModelPeers(discoveredPeers);
+            const cacheAgeMs = Date.now() - this._cacheLastUpdatedAtMs;
+            if (modelPeers.length === 0 || cacheAgeMs > this._peerCacheTtlMs) {
+                discoveredPeers = await this._getPeers({ forceRefresh: true });
+                ({ candidatePeers: modelPeers, routePlanByPeerId: modelPlans } = selectModelPeers(discoveredPeers));
+            }
+            const router = this._node.router;
+            const policyRouter = router;
+            const routeCandidates = modelPeers
+                .map((peer) => {
+                const plan = modelPlans.get(peer.peerId)
+                    ?? resolvePeerRoutePlan(peer, requestProtocol, requestedService, explicitProvider, 'strict');
+                if (!plan?.serviceId)
+                    return null;
+                const offer = findAdvertisedServiceOffer(peer, plan.provider, plan.serviceId);
+                if (!offer)
+                    return null;
+                const requestForPolicy = withRoutedModel(serializedReq, plan.serviceId);
+                if (!peerAllowedByPolicy(policyRouter, requestForPolicy, peer))
+                    return null;
+                return {
+                    peer,
+                    serviceId: plan.serviceId,
+                    request: requestForPolicy,
+                    reputation: normalizedModelReputationScore(peer, this._now()) ?? -1,
+                    hasCachedInputPricing: offer.cachedInputUsdPerMillion !== undefined,
+                    inputUsdPerMillion: offer.inputUsdPerMillion ?? null,
+                    outputUsdPerMillion: offer.outputUsdPerMillion ?? null,
+                    minImageUsdPerImage: offer.minImageUsdPerImage ?? null,
+                };
+            })
+                .filter((candidate) => candidate !== null);
+            const now = this._now();
+            const preferCachedPricing = routeCandidates.some((candidate) => candidate.hasCachedInputPricing);
+            const ranked = routeCandidates.map((candidate) => {
+                const health = this._peerHealth.get(candidate.peer.peerId);
+                return {
+                    ...candidate,
+                    peerId: candidate.peer.peerId,
+                    effectiveReputationScore: effectiveModelReputationScore(candidate.reputation >= 0 ? candidate.reputation : null, candidate.hasCachedInputPricing, preferCachedPricing),
+                    peerCooldownUntil: health?.cooldownUntil ?? null,
+                    peerFailureStreak: health?.failureStreak ?? 0,
+                };
+            });
+            let candidates;
+            const routingPreferences = this._routingPreferences;
+            if (routingPreferences) {
+                candidates = rankModelRoutes(ranked, routingPreferences, now)
+                    .filter((candidate) => isModelRouteEligible(candidate, routingPreferences));
+            }
+            else {
+                ranked.sort((a, b) => (b.effectiveReputationScore ?? -1) - (a.effectiveReputationScore ?? -1)
+                    || a.peer.peerId.localeCompare(b.peer.peerId));
+                const ready = ranked.filter((candidate) => !isCoolingDown(this._peerHealth.get(candidate.peer.peerId), now));
+                candidates = ready.length > 0 ? ready : ranked;
+            }
+            if (preferredConversationPeerId) {
+                const preferredIndex = candidates.findIndex((candidate) => (candidate.peer.peerId.toLowerCase() === preferredConversationPeerId
+                    && !isCoolingDown(this._peerHealth.get(candidate.peer.peerId), now)));
+                if (preferredIndex > 0) {
+                    const [preferred] = candidates.splice(preferredIndex, 1);
+                    if (preferred)
+                        candidates.unshift(preferred);
+                }
+            }
+            if (candidates.length === 0) {
+                res.writeHead(502, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: {
+                        type: 'model_not_found',
+                        code: 'model_not_found',
+                        message: `No policy-allowed peer currently serves model "${requestedService}".`,
+                        param: 'model',
+                    },
+                }));
+                return;
+            }
+            let lastRetry = null;
+            let lastVerificationError = null;
+            for (const [index, selected] of candidates.entries()) {
+                if (this._verifier) {
+                    const makeReach = (chosenId) => makeVerifierReach(this._node, selected.peer, chosenId, clientAbortController.signal);
+                    const outcome = await this._verifyPeer(selected.peer, makeReach, clientAbortController.signal);
+                    if (!outcome.ok) {
+                        lastVerificationError = `Peer ${selected.peer.peerId.slice(0, 12)}... failed required verification (${outcome.reason ?? 'failed'}).`;
+                        log(`${lastVerificationError} Trying the next model peer.`);
+                        continue;
+                    }
+                }
+                for (let peerAttempt = 0; peerAttempt < MODEL_RATE_LIMIT_MAX_ATTEMPTS_PER_PEER; peerAttempt += 1) {
+                    log(`Auto-selected peer ${selected.peer.peerId.slice(0, 12)}... for model="${requestedService}" `
+                        + `service="${selected.serviceId}" reputation=${selected.reputation} `
+                        + `effective=${selected.effectiveReputationScore ?? 'unknown'} peer=${index + 1}/${candidates.length} `
+                        + `attempt=${peerAttempt + 1}/${MODEL_RATE_LIMIT_MAX_ATTEMPTS_PER_PEER}`);
+                    const result = await this._dispatchToPeer(res, selected.request, selected.peer, modelPlans, requestProtocol, selected.serviceId, explicitProvider, router, RETRYABLE_STATUS_CODES, clientAbortController.signal);
+                    if (result.done) {
+                        if (trackedConversationId) {
+                            this._conversations.recordRoutedModel(trackedConversationId, `${selected.peer.peerId}@${selected.serviceId}`);
+                        }
+                        return;
+                    }
+                    lastRetry = result;
+                    if (result.responseHeaders[ANTSEED_FAULT_ATTRIBUTION_HEADER]?.toLowerCase() === 'buyer') {
+                        res.writeHead(result.statusCode, result.responseHeaders);
+                        res.end(result.responseBody);
+                        return;
+                    }
+                    const retrySamePeer = result.statusCode === 429
+                        && peerAttempt + 1 < MODEL_RATE_LIMIT_MAX_ATTEMPTS_PER_PEER;
+                    if (!retrySamePeer)
+                        break;
+                    const delayMs = rateLimitRetryDelayMs(result.responseHeaders, peerAttempt);
+                    log(`Peer ${selected.peer.peerId.slice(0, 12)}... is rate-limited; retrying in ${delayMs}ms.`);
+                    if (!await waitForRetry(delayMs, clientAbortController.signal))
+                        return;
+                }
+                if (index + 1 < candidates.length) {
+                    log(`Peer ${selected.peer.peerId.slice(0, 12)}... failed retryably; trying next model peer.`);
+                }
+            }
+            if (lastRetry) {
+                res.writeHead(lastRetry.statusCode, lastRetry.responseHeaders);
+                res.end(lastRetry.responseBody);
+            }
+            else {
+                res.writeHead(502, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: {
+                        type: 'peer_verification_failed',
+                        code: 'peer_verification_failed',
+                        message: lastVerificationError ?? `No verified peer currently serves model "${requestedService}".`,
+                    },
+                }));
+            }
+            return;
+        }
+        const pinnedPeerId = explicitPeerId;
         // Narrow the candidate set to just the pinned peer (if we already know
         // about it) before running the per-peer protocol/service match. This
         // avoids wasting work — and spamming "Service strict-miss" log lines —
@@ -1800,7 +2145,7 @@ export class BuyerProxy {
         // fall through with the full list so the "not in candidate set → force
         // refresh" path still works.
         const narrowToPinned = (sources) => {
-            const match = sources.find((p) => p.peerId.toLowerCase() === explicitPeerId);
+            const match = sources.find((p) => p.peerId.toLowerCase() === pinnedPeerId);
             return match ? [match] : sources;
         };
         const selectPeers = (candidateSources) => selectCandidatePeersForRouting(narrowToPinned(candidateSources), requestProtocol, requestedService, explicitProvider, 'lenient');
@@ -1821,7 +2166,7 @@ export class BuyerProxy {
         let routingPeers = candidatePeers;
         let routingPlans = routePlanByPeerId;
         let discoveredPeers = peers;
-        const isPinnedDiscovered = () => discoveredPeers.some((peer) => peer.peerId.toLowerCase() === explicitPeerId);
+        const isPinnedDiscovered = () => discoveredPeers.some((peer) => peer.peerId.toLowerCase() === pinnedPeerId);
         // Single refresh guard covers all three doubts about the cache: pin
         // missing, candidate filter empty, or cache past TTL.
         const cacheAgeMs = Date.now() - this._cacheLastUpdatedAtMs;
@@ -1837,16 +2182,16 @@ export class BuyerProxy {
                     ? 'model peer prefix'
                     : '--peer flag or session pin';
             const diagnostics = this._formatPeerSelectionDiagnostics(discoveredPeers);
-            log(`Pinned peer ${explicitPeerId.slice(0, 12)}... not discoverable in DHT (${logSource})`);
+            log(`Pinned peer ${pinnedPeerId.slice(0, 12)}... not discoverable in DHT (${logSource})`);
             res.writeHead(502, { 'content-type': 'text/plain' });
-            res.end(`Pinned peer ${explicitPeerId.slice(0, 12)}... is not reachable right now. `
+            res.end(`Pinned peer ${pinnedPeerId.slice(0, 12)}... is not reachable right now. `
                 + 'It may be offline, not announcing, or temporarily unreachable. '
                 + 'Pick a different service in Discover or try again later. '
                 + diagnostics);
             return;
         }
         if (routingPeers.length === 0) {
-            const pinnedPeer = discoveredPeers.find((peer) => peer.peerId.toLowerCase() === explicitPeerId) ?? null;
+            const pinnedPeer = discoveredPeers.find((peer) => peer.peerId.toLowerCase() === pinnedPeerId) ?? null;
             const protocolLabel = requestProtocol ? `protocol=${requestProtocol}` : 'protocol=unknown';
             const providerLabel = explicitProvider ? `provider=${explicitProvider}` : 'provider=auto';
             const serviceLabel = requestedService ? `service=${requestedService}` : 'service=none';
@@ -1857,41 +2202,40 @@ export class BuyerProxy {
                     .filter((provider) => provider.length > 0);
                 if (!providers.includes(explicitProvider)) {
                     const providerList = providers.length > 0 ? providers.join(', ') : 'none';
-                    log(`Pinned peer ${explicitPeerId.slice(0, 12)}... does not offer explicit provider=${explicitProvider}`);
+                    log(`Pinned peer ${pinnedPeerId.slice(0, 12)}... does not offer explicit provider=${explicitProvider}`);
                     res.writeHead(502, { 'content-type': 'text/plain' });
-                    res.end(`Pinned peer ${explicitPeerId.slice(0, 12)}... does not offer provider=${explicitProvider}. `
+                    res.end(`Pinned peer ${pinnedPeerId.slice(0, 12)}... does not offer provider=${explicitProvider}. `
                         + `Available providers: ${providerList}. `
                         + 'Remove or change the x-antseed-provider header, or pick a different peer. '
                         + diagnostics);
                     return;
                 }
             }
-            log(`Pinned peer ${explicitPeerId.slice(0, 12)}... filtered out by protocol/service match`);
+            log(`Pinned peer ${pinnedPeerId.slice(0, 12)}... filtered out by protocol/service match`);
             res.writeHead(502, { 'content-type': 'text/plain' });
-            res.end(`Pinned peer ${explicitPeerId.slice(0, 12)}... does not support this request `
+            res.end(`Pinned peer ${pinnedPeerId.slice(0, 12)}... does not support this request `
                 + `(${protocolLabel}, ${providerLabel}, ${serviceLabel}). `
                 + `Pick a different service in Discover. ${diagnostics}`);
             return;
         }
         log(`Routing candidates: ${routingPeers.length} peer(s)`);
         const router = this._node.router;
-        const selectedPeer = routingPeers.find((p) => p.peerId.toLowerCase() === explicitPeerId) ?? null;
+        const selectedPeer = routingPeers.find((p) => p.peerId.toLowerCase() === pinnedPeerId) ?? null;
         // Defence in depth: the discovered+narrowed checks above should make this
         // branch unreachable. Keep a structured fallback so we don't silently hang
         // if an invariant breaks.
         if (!selectedPeer) {
-            log(`Invariant: pinned peer ${explicitPeerId.slice(0, 12)}... present in DHT but missing from narrowed candidate list`);
+            log(`Invariant: pinned peer ${pinnedPeerId.slice(0, 12)}... present in DHT but missing from narrowed candidate list`);
             res.writeHead(502, { 'content-type': 'text/plain' });
-            res.end(`Pinned peer ${explicitPeerId.slice(0, 12)}... is currently unreachable. Try again in a moment.`);
+            res.end(`Pinned peer ${pinnedPeerId.slice(0, 12)}... is currently unreachable. Try again in a moment.`);
             return;
         }
         const policyRouter = router;
-        const policyAllowed = policyRouter?.allowsPeerForPolicy
-            ? policyRouter.allowsPeerForPolicy(serializedReq, selectedPeer)
-            : policyRouter?.allowsPeerForPricing
-                ? policyRouter.allowsPeerForPricing(serializedReq, selectedPeer)
-                : true;
-        if (!policyAllowed) {
+        const selectedPlan = routingPlans.get(selectedPeer.peerId)
+            ?? resolvePeerRoutePlan(selectedPeer, requestProtocol, requestedService, explicitProvider, 'lenient');
+        const pinnedServiceId = selectedPlan?.serviceId ?? requestedService;
+        const pinnedRequest = pinnedServiceId ? withRoutedModel(serializedReq, pinnedServiceId) : serializedReq;
+        if (!peerAllowedByPolicy(policyRouter, pinnedRequest, selectedPeer)) {
             log(`Pinned peer ${selectedPeer.peerId.slice(0, 12)}... filtered out by buyer routing policy`);
             res.writeHead(502, { 'content-type': 'text/plain' });
             res.end(`Pinned peer ${selectedPeer.peerId.slice(0, 12)}... is outside your buyer routing policy. `
@@ -1916,10 +2260,13 @@ export class BuyerProxy {
             }
         }
         log(`Using pinned peer ${selectedPeer.peerId.slice(0, 12)}...`);
-        const result = await this._dispatchToPeer(res, serializedReq, selectedPeer, routingPlans, requestProtocol, requestedService, explicitProvider, router, RETRYABLE_STATUS_CODES, clientAbortController.signal);
+        const result = await this._dispatchToPeer(res, pinnedRequest, selectedPeer, routingPlans, requestProtocol, requestedService, explicitProvider, router, RETRYABLE_STATUS_CODES, clientAbortController.signal);
+        if (result.done && trackedConversationId && pinnedServiceId) {
+            this._conversations.recordRoutedModel(trackedConversationId, `${selectedPeer.peerId}@${pinnedServiceId}`);
+        }
         if (!result.done) {
             // Pinned peer returned a retryable error. We never retry against another
-            // peer — auto-selection is disabled — so surface the error to the client.
+            // peer for an explicit pin, so surface the error to the client.
             res.writeHead(result.statusCode, result.responseHeaders);
             res.end(result.responseBody);
         }
@@ -2001,7 +2348,7 @@ export class BuyerProxy {
                     + `did not announce for this service: ${unannounced.join(', ')} — the upstream may ignore or reject them`);
             }
         }
-        const { 'x-antseed-pin-peer': _pinPeer, 'x-antseed-prefer-peer': _preferPeer, ...headersForPeer } = serializedReq.headers;
+        const { 'x-antseed-pin-peer': _pinPeer, 'x-antseed-prefer-peer': _preferPeer, 'x-antstation-session-id': _antstationSession, ...headersForPeer } = serializedReq.headers;
         let requestForPeer = {
             ...serializedReq,
             headers: {
@@ -2009,6 +2356,9 @@ export class BuyerProxy {
                 'x-antseed-provider': selectedRoutePlan.provider,
             },
         };
+        if (selectedRoutePlan.serviceId) {
+            requestForPeer = withRoutedModel(requestForPeer, selectedRoutePlan.serviceId);
+        }
         const clientWantsStreaming = requestWantsStreaming(serializedReq.headers, serializedReq.body);
         let adaptResponse = null;
         let streamResponseAdapter = null;