@flame0510/project-aether 1.1.15 → 1.3.0

package/app/api/gateway/sync.ts

@@ -2,16 +2,22 @@
  * Agent Gateway Sync
  *
  * Syncs the models.providers.rev4a config block to all agent containers
- * (or a single container) without touching model references (primary/fallback).
+ * without touching model references (primary/fallback).
  *
  * Import and call:
  *   syncAllAgents()          — sync all containers with AGENT_ID label
- *   syncAgent('container')   — sync a single container
+ *
+ * A single-container `syncAgent()` used to be exported too. Nothing called it —
+ * the create route builds the block with `buildRev4aProviderConfig()` and writes
+ * it with `openclaw config patch` itself — so it was removed.
  */
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
 import { readProviderKeys } from './provider/keys';
-import { loadModelsConfig, type ModelConfigEntry } from '@/lib/model-catalogue';
+import { bundledCatalogueStatus, loadOfferedModels, type ModelConfigEntry } from '@/lib/model-catalogue';
+import { singleFileFromTar } from '@/lib/container-file';
 import { detectProviderGatewayUrl } from '@/lib/docker-utils';
 
 const PROVIDER_GATEWAY_BASE_URL = detectProviderGatewayUrl();
@@ -33,11 +39,8 @@ function modalityToInput(modality: string): string[] {
   return left.split('+').map((s) => s.trim()).filter((s) => ALLOWED_INPUT.has(s));
 }
 
-function getActiveRev4aModels(models: ModelConfigEntry[]): { id: string; name: string; input?: string[] }[] {
-  const providerKeys = readProviderKeys();
-  const configuredProviders = Object.keys(providerKeys);
-  return models
-    .filter((m) => m.enabled && configuredProviders.includes(m.provider))
+function getActiveRev4aModels(): { id: string; name: string; input?: string[] }[] {
+  return loadOfferedModels()
     .map((m) => {
       const entry: { id: string; name: string; input?: string[] } = { id: m.id, name: m.name };
       if (m.modality) entry.input = modalityToInput(m.modality);
@@ -45,54 +48,146 @@ function getActiveRev4aModels(models: ModelConfigEntry[]): { id: string; name: s
     });
 }
 
-function getAgentContainers(): string[] {
+/** A readable cause from a failed child process: its stderr if any, else the message. */
+function firstLine(e: unknown): string {
+  const err = e as { stderr?: string | Buffer; message?: string };
+  const text = (err.stderr ? err.stderr.toString() : '') || err.message || 'unknown error';
+  return text.trim().split('\n')[0];
+}
+
+/** A container carrying an AGENT_ID label, and whether it is running. */
+interface AgentContainer { name: string; running: boolean }
+
+/**
+ * Every container carrying an AGENT_ID label, running or stopped.
+ *
+ * Throws when Docker cannot be asked. It used to catch that and return `[]`,
+ * which made "the Docker daemon is not running" indistinguishable from "there are
+ * no agents": a model toggle made while Docker was stopped synced to nobody and
+ * still reported success. An empty list now means only the second.
+ *
+ * Stopped agents are included on purpose. This used to run `docker ps` without
+ * `-a`, so a catalogue change made while an agent was stopped skipped it, and
+ * starting it later brought back the old catalogue until someone ran Sync All.
+ */
+function getAgentContainers(): AgentContainer[] {
+  let raw: string;
   try {
-    const raw = execSync(
-      `docker ps --filter "label=AGENT_ID" --format '{{.Names}}'`,
-      { timeout: 5000, maxBuffer: 64 * 1024, encoding: 'utf-8' },
+    raw = execSync(
+      `docker ps -a --filter "label=AGENT_ID" --format '{{.Names}}\t{{.State}}'`,
+      { timeout: 5000, maxBuffer: 64 * 1024, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] },
     ).trim();
-    if (!raw) return [];
-    return raw.split('\n');
-  } catch {
-    return [];
+  } catch (e) {
+    throw new Error(firstLine(e));
+  }
+  if (!raw) return [];
+  return raw.split('\n')
+    .map((line) => {
+      const [name, state] = line.split('\t');
+      return { name: (name ?? '').trim(), running: (state ?? '').trim() === 'running' };
+    })
+    .filter((c) => c.name);
+}
+
+/**
+ * Why Docker cannot be asked right now, or undefined when it can.
+ *
+ * For callers that must decide *before* committing a change whether its sync can
+ * happen at all. A model toggle made while Docker was unreachable used to be saved
+ * and then reach no container, leaving the Gateway's checkboxes out of step with
+ * what the agents hold; checking first lets it be refused cleanly instead.
+ */
+export function dockerUnreachableReason(): string | undefined {
+  try {
+    getAgentContainers();
+    return undefined;
+  } catch (e) {
+    return (e as Error).message;
   }
 }
 
-function readContainerJson(container: string, remotePath: string): Record<string, unknown> {
+
+/**
+ * Read and parse a container's JSON config, running or stopped.
+ *
+ * Throws on any failure. It used to return `{}`, and the caller wrote that back
+ * with only the provider block added — so a single timed-out read replaced an
+ * agent's whole config (agents, gateway, channels) with `{ models: { providers:
+ * { rev4a } } }`. An empty object is refused for the same reason. Also returns
+ * the file mode, so a stopped container's file is written back unchanged in that
+ * respect.
+ */
+function readContainerJson(container: AgentContainer, remotePath: string): { config: Record<string, unknown>; mode: number } {
+  let raw: string;
+  let mode = 0o600;
+  if (container.running) {
+    raw = execFileSync('docker', ['exec', container.name, 'cat', remotePath], {
+      timeout: 8000, maxBuffer: 512 * 1024, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } else {
+    const file = singleFileFromTar(execFileSync('docker', ['cp', `${container.name}:${remotePath}`, '-'], {
+      timeout: 8000, maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
+    }));
+    raw = file.body.toString('utf-8');
+    mode = file.mode;
+  }
+  let parsed: unknown;
   try {
-    const raw = execSync(
-      `docker exec ${container} cat ${remotePath}`,
-      { timeout: 8000, maxBuffer: 512 * 1024, encoding: 'utf-8' },
-    );
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch {
-    return {};
+    // Not the parser's message: V8 quotes a slice of the input, this file holds
+    // tokens, and the error ends up in the sync summary shown in the browser.
+    throw new Error(`${remotePath} is not valid JSON; refusing to overwrite it`);
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || Object.keys(parsed).length === 0) {
+    throw new Error(`${remotePath} is empty or not a JSON object; refusing to overwrite it`);
   }
+  return { config: parsed as Record<string, unknown>, mode };
 }
 
-function writeContainerJson(container: string, remotePath: string, data: Record<string, unknown>): void {
+/**
+ * Write a container's JSON config, running or stopped.
+ *
+ * Running: through `docker exec`, truncating the file in place so its mode and
+ * owner stay as they are, and OpenClaw hot-applies the change. Stopped: through
+ * `docker cp`, the only way to reach it; the file is staged on the host with the
+ * original mode, lands on the agent's volume, and is read at next start.
+ */
+function writeContainerJson(container: AgentContainer, remotePath: string, data: Record<string, unknown>, mode: number): void {
   const jsonStr = JSON.stringify(data, null, 2);
-  // Use shell-quoted heredoc to avoid word-splitting on paths with spaces
-  execSync(
-    `docker exec -i ${container} sh -c "cat > '${remotePath}'"`,
-    { timeout: 10000, maxBuffer: 1024 * 1024, input: jsonStr },
-  );
+  if (container.running) {
+    execFileSync('docker', ['exec', '-i', container.name, 'sh', '-c', 'cat > "$1"', 'sh', remotePath], {
+      timeout: 10000, maxBuffer: 1024 * 1024, input: jsonStr, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    return;
+  }
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rev4a-sync-'));
+  const staged = path.join(dir, path.basename(remotePath));
+  try {
+    fs.writeFileSync(staged, jsonStr);
+    fs.chmodSync(staged, mode);
+    execFileSync('docker', ['cp', staged, `${container.name}:${remotePath}`], {
+      timeout: 10000, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
 }
 
+
 /* ------------------------------------------------------------------ */
 /*  Sync functions                                                     */
 /* ------------------------------------------------------------------ */
 
 /**
  * Build the models.providers.rev4a config object from local state.
- * Shared between the create wizard and syncAgent — single source of truth
+ * Shared between the create route and syncAllAgents — single source of truth
  * for the provider block injected into every agent container.
  */
 export function buildRev4aProviderConfig(): { baseUrl: string; apiKey: string; api: string; models: { id: string; name: string; input?: string[] }[] } {
   const providerKeys = readProviderKeys();
   const rev4aApiKey = providerKeys['rev4a'] || '';
-  const allModels = loadModelsConfig();
-  const activeModels = getActiveRev4aModels(allModels);
+  const activeModels = getActiveRev4aModels();
   return {
     baseUrl: PROVIDER_GATEWAY_BASE_URL,
     apiKey: rev4aApiKey,
@@ -102,65 +197,146 @@ export function buildRev4aProviderConfig(): { baseUrl: string; apiKey: string; a
 }
 
 /**
- * Sync models.providers.rev4a to all agent containers.
- * Does NOT touch agents.defaults.model or agents.list[].model.
+ * Write `models.providers.rev4a` into one running container.
+ *
+ * Throws instead of writing when the catalogue could not be read: an unreadable
+ * catalogue is not an empty one, and patching it in would strip every model from
+ * the agent. `syncAllAgents()` refuses for the same reason.
+ *
+ * No gateway restart: `config patch` reports "Change will apply without restarting
+ * the gateway" for a models-only patch, and the Gateway watches openclaw.json with
+ * gateway.reload defaulting to hybrid.
+ */
+export function patchRev4aProvider(container: string): void {
+  if (bundledCatalogueStatus() === 'unavailable') {
+    throw new Error('models.config.json could not be read; models.providers.rev4a left unchanged');
+  }
+  const input = JSON.stringify({ models: { providers: { rev4a: buildRev4aProviderConfig() } } });
+  execFileSync('docker', ['exec', '-i', container, 'sh', '-c', 'openclaw config patch --stdin'], {
+    timeout: 15000,
+    stdio: 'pipe',
+    input,
+  });
+}
+
+/** What a sync did, container by container. */
+export interface SyncOutcome {
+  /**
+   * True only when every agent container received the catalogue. Zero agents is
+   * ok — there is nothing to sync, which is the normal state on first run.
+   */
+  ok: boolean;
+  /** Models written into each container. */
+  activeModels: number;
+  /** Agent containers found. */
+  total: number;
+  synced: string[];
+  /** Of `synced`, the ones not running (stopped, paused, created): written with `docker cp`. Applied when started, or resumed. */
+  stopped: string[];
+  failed: { container: string; error: string }[];
+  /** Docker could not list containers at all, so nothing was attempted. */
+  dockerError?: string;
+  /** The catalogue block could not be built, so nothing was attempted. */
+  configError?: string;
+  /** One line for a person. Built here so every caller says the same thing. */
+  summary: string;
+}
+
+/** ", 2 of them not running" — those apply the change later, which is worth saying. */
+function stoppedNote(outcome: SyncOutcome): string {
+  return outcome.stopped.length ? `, ${outcome.stopped.length} of them not running` : '';
+}
+
+/**
+ * Push the offered catalogue into every agent container, and say exactly what
+ * happened.
+ *
+ * Returns an outcome instead of throwing: callers run this *after* committing a
+ * change — a key saved, a model toggled — and a failed propagation must not be
+ * reported as a failed save, because the save stands. The old signature returned
+ * loose strings that no caller inspected, so a sync that reached no container
+ * surfaced as success.
  */
-export function syncAllAgents(): string[] {
+export function syncAllAgents(): SyncOutcome {
   const rev4aProviderConfig = buildRev4aProviderConfig();
+  const outcome: SyncOutcome = {
+    ok: false,
+    activeModels: rev4aProviderConfig.models.length,
+    total: 0,
+    synced: [],
+    stopped: [],
+    failed: [],
+    summary: '',
+  };
+
   if (!rev4aProviderConfig.apiKey) {
-    return ['ERROR: REV4A_API_KEY not found in provider-keys.json (add "rev4a" key)'];
+    outcome.configError = 'REV4A_API_KEY not found in provider-keys.json (add "rev4a" key)';
+    outcome.summary = `Not applied to any agent: ${outcome.configError}.`;
+    return outcome;
   }
 
-  const containers = getAgentContainers();
-  const results: string[] = [`Active models: ${rev4aProviderConfig.models.length} across ${containers.length} agent(s)`];
+  // A catalogue that could not be read is not an empty catalogue: pushing it would
+  // strip every model from every agent.
+  if (bundledCatalogueStatus() === 'unavailable') {
+    outcome.configError = 'models.config.json could not be read, so there is no catalogue to push';
+    outcome.summary = `Not applied to any agent: ${outcome.configError}.`;
+    return outcome;
+  }
 
+  let containers: AgentContainer[];
+  try {
+    containers = getAgentContainers();
+  } catch (e) {
+    outcome.dockerError = (e as Error).message;
+    outcome.summary = `Not applied to any agent: Docker is unreachable (${outcome.dockerError}).`;
+    return outcome;
+  }
+
+  outcome.total = containers.length;
   for (const container of containers) {
     try {
-      const result = syncContainer(container, rev4aProviderConfig);
-      results.push(result);
+      syncContainer(container, rev4aProviderConfig);
+      outcome.synced.push(container.name);
+      if (!container.running) outcome.stopped.push(container.name);
     } catch (e: unknown) {
-      const err = e as { stderr?: string; message?: string };
-      results.push(`${container}: ERROR ${err.stderr || err.message || 'unknown'}`);
+      outcome.failed.push({ container: container.name, error: firstLine(e) });
     }
   }
 
-  if (containers.length === 0) {
-    results.push('No agent containers found');
+  outcome.ok = outcome.failed.length === 0;
+  if (outcome.total === 0) {
+    outcome.summary = 'No agent containers to sync.';
+  } else if (outcome.ok) {
+    outcome.summary = `Synced ${outcome.synced.length} of ${outcome.total} agent(s)${stoppedNote(outcome)}.`;
+  } else {
+    const names = outcome.failed.map((f) => `${f.container} (${f.error})`).join(', ');
+    outcome.summary = `Synced ${outcome.synced.length} of ${outcome.total} agent(s)${stoppedNote(outcome)}. Not applied to: ${names}.`;
   }
-
-  return results;
+  return outcome;
 }
 
 /**
- * Sync models.providers.rev4a to a single agent container.
- * Does NOT touch agents.defaults.model or agents.list[].model.
- */
-export function syncAgent(containerName: string): string {
-  const rev4aProviderConfig = buildRev4aProviderConfig();
-  if (!rev4aProviderConfig.apiKey) {
-    throw new Error('REV4A_API_KEY not found in provider-keys.json (add "rev4a" key)');
-  }
-  return syncContainer(containerName, rev4aProviderConfig);
-}
-
-/**
- * Internal: write models.providers.rev4a to one container and restart its gateway.
+ * Internal: write models.providers.rev4a into one container's openclaw.json.
  */
 function syncContainer(
-  container: string,
+  container: AgentContainer,
   rev4aProviderConfig: { baseUrl: string; apiKey: string; api: string; models: { id: string; name: string }[] },
 ): string {
   const remotePath = '/root/.openclaw/openclaw.json';
-  const config = readContainerJson(container, remotePath) as Record<string, unknown>;
+  // Read first. If this throws, the container is reported as failed and nothing
+  // below runs — in particular nothing is written.
+  const { config, mode } = readContainerJson(container, remotePath);
 
-  // Clean up stale files from old versions
-  try {
-    execSync(
-      `docker exec ${container} sh -c 'rm -f /root/.openclaw/agents/main/agent/models.json /root/.openclaw/agents/main/agent/auth-profiles.json'`,
-      { timeout: 5000 },
-    );
-  } catch {
-    // non-fatal
+  // Clean up stale files from old versions. Needs exec, so running containers
+  // only; a stopped one is cleaned on the first sync after it starts.
+  if (container.running) {
+    try {
+      execFileSync('docker', ['exec', container.name, 'rm', '-f',
+        '/root/.openclaw/agents/main/agent/models.json',
+        '/root/.openclaw/agents/main/agent/auth-profiles.json'], { timeout: 5000, stdio: 'ignore' });
+    } catch {
+      // non-fatal
+    }
   }
 
   // Write/overwrite models.providers.rev4a — do NOT touch agents.*
@@ -169,7 +345,7 @@ function syncContainer(
   (models.providers as Record<string, unknown>)['rev4a'] = rev4aProviderConfig;
   config.models = models;
 
-  writeContainerJson(container, remotePath, config);
+  writeContainerJson(container, remotePath, config, mode);
 
   // No gateway restart: this only writes models.providers.rev4a, and the Gateway
   // watches openclaw.json and hot-applies it. OpenClaw's own config tooling says
@@ -182,5 +358,5 @@ function syncContainer(
   // The restart used to cost ~7.5s per container, serially — roughly 52s of
   // fully blocked event loop on a seven-agent host, every time a provider key or
   // model toggle was saved, to do something the Gateway had already done.
-  return `${container}: synced`;
+  return `${container.name}: synced`;
 }

package/app/api/models/route.ts

@@ -1,22 +1,12 @@
 import { type NextRequest } from "next/server";
 import { NextResponse } from 'next/server';
-import { MODELS_CONFIG_FILE } from '@/lib/rev4a-paths';
-import * as fs from 'fs';
-import * as path from 'path';
 import { readProviderKeys } from '@/app/api/gateway/provider/keys';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { loadOfferedModels } from '@/lib/model-catalogue';
+import { getPricing } from '@/lib/model-pricing';
 
 export const dynamic = 'force-dynamic';
 
-interface ModelsConfigEntry {
-  id: string;
-  name: string;
-  provider: string;
-  enabled: boolean;
-}
-
-const CONFIG_PATH = MODELS_CONFIG_FILE;
-
 const PROVIDER_EMOJI: Record<string, string> = {
   deepseek: '🧠',
   openrouter: '🌐',
@@ -37,32 +27,27 @@ const PROVIDER_LABEL: Record<string, string> = {
   rev4a: 'Rev4a',
 };
 
-function loadModelsConfig(): ModelsConfigEntry[] {
-  try {
-    const raw = fs.readFileSync(CONFIG_PATH, 'utf-8');
-    const parsed = JSON.parse(raw);
-    if (Array.isArray(parsed.models)) return parsed.models as ModelsConfigEntry[];
-  } catch {}
-  return [];
-}
-
+/**
+ * Model picker source. Uses the shared catalogue loader so the list offered here
+ * matches what the sync actually writes into agent containers — this route used
+ * to read models.config.json directly and ignore model-overrides.json, so models
+ * switched off on the Gateway page still showed up as selectable.
+ */
 export async function GET(_req: NextRequest): Promise<NextResponse> {
   const request = _req;
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
-  const allModels = loadModelsConfig();
-  const providerKeys = readProviderKeys();
-  const configured = new Set(Object.keys(providerKeys));
-
-  const eligible = allModels.filter((m) => {
-    if (!m.enabled) return false;
-    if (configured.has(m.provider)) return true;
-    // rev4a/* aliases resolve to deepseek upstream
-    if (m.provider === 'rev4a' && configured.has('deepseek')) return true;
-    return false;
-  });
+  const eligible = loadOfferedModels();
 
-  const grouped = new Map<string, { provider: string; emoji: string; models: { id: string; label: string }[] }>();
+  const grouped = new Map<string, {
+    provider: string;
+    emoji: string;
+    models: {
+      id: string; label: string;
+      input: number | null; output: number | null;
+      deprecated: boolean;
+    }[];
+  }>();
 
   for (const model of eligible) {
     if (!grouped.has(model.provider)) {
@@ -72,7 +57,16 @@ export async function GET(_req: NextRequest): Promise<NextResponse> {
         models: [],
       });
     }
-    grouped.get(model.provider)!.models.push({ id: model.id, label: model.name });
+    // Price travels with the option so the picker can show cost at the point of
+    // choice, instead of sending the operator to another page to look it up.
+    const price = getPricing(model.id);
+    grouped.get(model.provider)!.models.push({
+      id: model.id,
+      label: model.name,
+      input: price?.input ?? null,
+      output: price?.output ?? null,
+      deprecated: model.deprecated ?? false,
+    });
   }
 
   return NextResponse.json(Array.from(grouped.values()));

package/app/api/provider/auth.ts

@@ -0,0 +1,65 @@
+/**
+ * Who may call the Rev4a Provider Gateway.
+ *
+ * One credential opens this door: the `rev4a` entry of `provider-keys.json`.
+ * That is the value `buildRev4aProviderConfig()` writes into every agent
+ * container, and `syncAllAgents()` refuses to run without it, so it is the only
+ * token any legitimate client holds. `REV4A_API_KEY` is accepted alongside it
+ * for callers configured before the key moved into the file.
+ *
+ * **Why this is its own module.** The two v1 routes each carried their own copy
+ * of the check and the copies had drifted — one guarded the empty token, the
+ * other did not. Worse, both compared the incoming token against *every* value
+ * in `provider-keys.json`:
+ *
+ *     Object.values(providerKeys).some((key) => token === key)
+ *
+ * `provider-keys.json` holds two different kinds of secret in one map. The
+ * `rev4a` entry is the password to this door. Every other entry is a credential
+ * Rev4a presents to an upstream provider. Iterating the map conflated them, so a
+ * DeepSeek API key authenticated here exactly like the gateway key — verified
+ * against a running instance, which answered `400 invalid_request_error` to a
+ * malformed body rather than `401`.
+ *
+ * With one upstream provider configured that granted nothing: the holder of a
+ * DeepSeek key can already spend at DeepSeek. It mattered as a latent fault. Add
+ * an OpenAI key and the old DeepSeek key silently becomes a way to spend at
+ * OpenAI, with nothing in the code or the UI to say so.
+ */
+import { timingSafeEqual } from 'crypto';
+import { readProviderKeys } from '@/app/api/gateway/provider/keys';
+
+/** Compare without leaking length or position through timing. */
+function secretEquals(a: string, b: string): boolean {
+  const ab = Buffer.from(a, 'utf8');
+  const bb = Buffer.from(b, 'utf8');
+  // timingSafeEqual throws on length mismatch, which is itself an early exit.
+  // Comparing digests of equal length would hide it; for a bearer token the
+  // length is not the secret, so a plain guard is enough.
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+
+/**
+ * True when the request carries the gateway credential.
+ *
+ * Never true for an absent or empty token, whatever the key file contains: an
+ * entry saved as `""` would otherwise match a request with no Authorization
+ * header at all.
+ */
+export function isGatewayClient(request: Request): boolean {
+  const token = (request.headers.get('Authorization') || '')
+    .replace(/^Bearer\s+/i, '')
+    .trim();
+  if (!token) return false;
+
+  // provider-keys.json is hand-editable: a non-string value must deny, not throw.
+  // Buffer.from on a number raises, and the models route has no catch.
+  const gatewayKey: unknown = readProviderKeys()['rev4a'];
+  if (typeof gatewayKey === 'string' && gatewayKey && secretEquals(token, gatewayKey)) return true;
+
+  const masterKey = process.env.REV4A_API_KEY;
+  if (masterKey && secretEquals(token, masterKey)) return true;
+
+  return false;
+}

package/app/api/provider/upstream.ts

@@ -57,7 +57,7 @@ export const PROVIDER_ENVS: Record<string, ProviderEnvConfig> = {
 
 /** Map rev4a/ model aliases to upstream provider/model pairs. */
 export const MODEL_ALIASES: Record<string, { provider: string; model: string }> = {
-  'rev4a/deepseek-v4-flash': { provider: 'deepseek', model: 'deepseek-v4-flash' },
+  'rev4a/deepseek-flash': { provider: 'deepseek', model: 'deepseek-flash' },
   'rev4a/deepseek-v4-pro': { provider: 'deepseek', model: 'deepseek-v4-pro' },
 };
 
@@ -76,7 +76,7 @@ export function extractProviderAndModel(request: UpstreamRequest): { provider: s
   if (request.provider) {
     return { provider: request.provider, model: modelStr };
   }
-  // Check aliases first (rev4a/deepseek-v4-flash -> deepseek/deepseek-v4-flash)
+  // Check aliases first (rev4a/deepseek-flash -> deepseek/deepseek-flash)
   if (modelStr && MODEL_ALIASES[modelStr]) {
     return { ...MODEL_ALIASES[modelStr] };
   }
@@ -114,6 +114,13 @@ export async function callUpstream(
 
   const upstreamBody: Record<string, unknown> = { ...body, model: model || undefined };
   delete upstreamBody.provider;
+  // `model` has been checked against the catalogue; these fields let the upstream
+  // pick a different one. OpenRouter serves a fallback from `models` when the
+  // primary fails, and `route`/`preset` can redirect the request, so forwarding them
+  // would let a client get a model the catalogue does not offer.
+  delete upstreamBody.models;
+  delete upstreamBody.route;
+  delete upstreamBody.preset;
 
   const headers: Record<string, string> = { 'Content-Type': 'application/json' };
 

package/app/api/provider/v1/chat/completions/route.ts

@@ -4,11 +4,14 @@
  * OpenAI-compatible chat completions endpoint.
  * POST /api/provider/v1/chat/completions
  *
- * Authentication uses provider keys stored in data/provider-keys.json.
- * The Authorization Bearer token must match a configured provider key.
- * The rev4a master key (REV4A_API_KEY env var) unlocks all providers.
+ * Authentication is the `rev4a` entry of provider-keys.json, or REV4A_API_KEY.
+ * See `app/api/provider/auth.ts` — in particular why the other entries in that
+ * file, which are upstream credentials rather than passwords, must not be
+ * accepted here.
  */
 import { NextRequest } from 'next/server';
+import { isGatewayClient } from '@/app/api/provider/auth';
+import { isModelOffered } from '@/lib/model-catalogue';
 import { readProviderKeys } from '@/app/api/gateway/provider/keys';
 import {
   extractProviderAndModel,
@@ -50,19 +53,7 @@ export async function POST(request: NextRequest) {
   const start = Date.now();
 
   try {
-    // Resolve provider from Authorization token
-    const authHeader = request.headers.get('Authorization') || '';
-    const token = authHeader.replace(/^Bearer\s+/i, '').trim();
-    const providerKeys = readProviderKeys();
-
-    // Check if token matches any stored key
-    const isAuthenticated = Object.values(providerKeys).some((key) => token === key);
-
-    // Also accept the rev4a master API key env var
-    const rev4aMasterKey = process.env.REV4A_API_KEY;
-    const isMasterAuth = !!rev4aMasterKey && token === rev4aMasterKey;
-
-    if (!isAuthenticated && !isMasterAuth) {
+    if (!isGatewayClient(request)) {
       return errorResponse(
         'Invalid API key. Use your Rev4a API key from the Gateway page via Authorization: Bearer <key>.',
         'authentication_error',
@@ -73,6 +64,21 @@ export async function POST(request: NextRequest) {
     const body: ProviderV1Request = await request.json();
     const { provider, model } = extractProviderAndModel(body);
 
+    // The catalogue is policy, and policy has to be enforced where the money is
+    // spent, not only where the pickers are drawn. Without this, unchecking a
+    // model on the Gateway page hid it from every list and still served every
+    // client that already held the id.
+    if (!isModelOffered(provider, model)) {
+      return errorResponse(
+        `Model '${provider}/${model}' is not enabled for this deployment. ` +
+        'Enable it on the Gateway page, or pick one that is.',
+        'invalid_request_error',
+        400,
+      );
+    }
+
+    // Upstream credentials, distinct from the token that opened this door.
+    const providerKeys = readProviderKeys();
     const apiKey = getApiKey(provider, providerKeys);
     if (!apiKey) {
       return errorResponse(