@flame0510/project-aether 1.1.9

package/app/api/metrics/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { openDb } from '@/lib/db';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const { searchParams } = new URL(request.url);
+  const limit = Math.min(Number.parseInt(searchParams.get('limit') ?? '60', 10), 1000);
+  try {
+    const db = openDb();
+    const latest = db
+      .prepare(
+        `SELECT cpu_percent as cpu, ram_used_mb, ram_total_mb, disk_used_gb, disk_total_gb,
+         load_avg_1m as load_avg, ts FROM system_metrics ORDER BY ts DESC LIMIT 1`,
+      )
+      .get();
+    const history = db
+      .prepare(
+        'SELECT cpu_percent as cpu, ram_used_mb, ram_total_mb, ts FROM system_metrics ORDER BY ts DESC LIMIT ?',
+      )
+      .all(limit)
+      .reverse();
+    const stats_24h = db
+      .prepare(
+        'SELECT ROUND(AVG(cpu_percent)) as cpu_avg, MAX(cpu_percent) as cpu_max FROM system_metrics WHERE ts > ?',
+      )
+      .get(Math.floor(Date.now() / 1000) - 86400);
+    db.close();
+    return NextResponse.json({ latest, history, stats_24h });
+  } catch (e: unknown) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 500 });
+  }
+}

package/app/api/models/route.ts

@@ -0,0 +1,77 @@
+import { type NextRequest } from "next/server";
+import { NextResponse } from 'next/server';
+import { MODELS_CONFIG_FILE } from '@/lib/rev4a-paths';
+import * as fs from 'fs';
+import * as path from 'path';
+import { readProviderKeys } from '@/app/api/gateway/provider/keys';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+export const dynamic = 'force-dynamic';
+
+interface ModelsConfigEntry {
+  id: string;
+  name: string;
+  provider: string;
+  enabled: boolean;
+}
+
+const CONFIG_PATH = MODELS_CONFIG_FILE;
+
+const PROVIDER_EMOJI: Record<string, string> = {
+  deepseek: '🧠',
+  openrouter: '🌐',
+  groq: '⚡',
+  openai: '🤖',
+  'openai-codex': '🤖',
+  anthropic: '🟣',
+  rev4a: '🔴',
+};
+
+const PROVIDER_LABEL: Record<string, string> = {
+  deepseek: 'DeepSeek',
+  openrouter: 'OpenRouter',
+  groq: 'Groq',
+  openai: 'OpenAI',
+  'openai-codex': 'OpenAI Codex',
+  anthropic: 'Anthropic',
+  rev4a: 'Rev4a',
+};
+
+function loadModelsConfig(): ModelsConfigEntry[] {
+  try {
+    const raw = fs.readFileSync(CONFIG_PATH, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed.models)) return parsed.models as ModelsConfigEntry[];
+  } catch {}
+  return [];
+}
+
+export async function GET(_req: NextRequest): Promise<NextResponse> {
+  const request = _req;
+  const allModels = loadModelsConfig();
+  const providerKeys = readProviderKeys();
+  const configured = new Set(Object.keys(providerKeys));
+
+  const eligible = allModels.filter((m) => {
+    if (!m.enabled) return false;
+    if (configured.has(m.provider)) return true;
+    // rev4a/* aliases resolve to deepseek upstream
+    if (m.provider === 'rev4a' && configured.has('deepseek')) return true;
+    return false;
+  });
+
+  const grouped = new Map<string, { provider: string; emoji: string; models: { id: string; label: string }[] }>();
+
+  for (const model of eligible) {
+    if (!grouped.has(model.provider)) {
+      grouped.set(model.provider, {
+        provider: PROVIDER_LABEL[model.provider] || model.provider,
+        emoji: PROVIDER_EMOJI[model.provider] || '🔌',
+        models: [],
+      });
+    }
+    grouped.get(model.provider)!.models.push({ id: model.id, label: model.name });
+  }
+
+  return NextResponse.json(Array.from(grouped.values()));
+}

package/app/api/plugins/route.js

@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'child_process';
+import { requireAuthJWT } from '@/lib/rev4a-auth';
+
+const SAFE_PLUGIN_ID = /^[a-zA-Z0-9._:@/-]+$/;
+
+export async function GET(request) {
+  const denied = await requireAuthJWT(request); if (denied) return denied;
+  try {
+    const raw = execSync('openclaw plugins list --json 2>/dev/null', {
+      encoding: 'utf8',
+      timeout: 10000,
+    });
+    const data = JSON.parse(raw);
+    return NextResponse.json(data);
+  } catch (err) {
+    return NextResponse.json({ error: err.message, plugins: [] }, { status: 500 });
+  }
+}
+
+export async function POST(request) {
+  const denied = await requireAuthJWT(request); if (denied) return denied;
+  try {
+    const { action, pluginId } = await request.json();
+    if (!pluginId || !['enable', 'disable'].includes(action)) {
+      return NextResponse.json({ error: 'Invalid action or pluginId' }, { status: 400 });
+    }
+    if (typeof pluginId !== 'string' || !SAFE_PLUGIN_ID.test(pluginId)) {
+      return NextResponse.json({ error: 'Invalid pluginId' }, { status: 400 });
+    }
+    const cmd = `openclaw plugins ${action} ${JSON.stringify(pluginId)} 2>&1`;
+    const output = execSync(cmd, { encoding: 'utf8', timeout: 15000 });
+    return NextResponse.json({ ok: true, output });
+  } catch (err) {
+    return NextResponse.json({ error: err.message }, { status: 500 });
+  }
+}

package/app/api/provider/upstream.ts

@@ -0,0 +1,142 @@
+/**
+ * Rev4a Provider Gateway — upstream logic
+ *
+ * Shared logic for calling upstream AI providers.
+ * Used by both /api/provider/v1/chat/completions and /api/assistant
+ * to avoid HTTP loopback (calling localhost from inside Next.js).
+ */
+import { detectPublicHost } from '@/lib/docker-utils';
+
+export const dynamic = 'force-dynamic';
+
+export interface ProviderEnvConfig {
+  baseUrl: string;
+  authHeader: string;
+  /** Path prefix for chat completions (defaults to "/v1" if omitted). */
+  basePath?: string;
+}
+
+export const PROVIDER_ENVS: Record<string, ProviderEnvConfig> = {
+  google: {
+    baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai',
+    authHeader: 'x-goog-api-key',
+  },
+  openai: {
+    baseUrl: 'https://api.openai.com',
+    authHeader: 'Authorization',
+  },
+  anthropic: {
+    baseUrl: 'https://api.anthropic.com',
+    authHeader: 'x-api-key',
+  },
+  deepseek: {
+    baseUrl: 'https://api.deepseek.com',
+    authHeader: 'Authorization',
+  },
+  openrouter: {
+    baseUrl: 'https://openrouter.ai/api',
+    authHeader: 'Authorization',
+  },
+  groq: {
+    baseUrl: 'https://api.groq.com/openai',
+    authHeader: 'Authorization',
+  },
+  kimi: {
+    baseUrl: 'https://api.moonshot.cn',
+    authHeader: 'Authorization',
+  },
+  glm: {
+    baseUrl: 'https://api.z.ai',
+    basePath: '/api/paas/v4',
+    authHeader: 'Authorization',
+  },
+  qwen: {
+    baseUrl: 'https://dashscope.aliyuncs.com',
+    basePath: '/compatible-mode/v1',
+    authHeader: 'Authorization',
+  },
+};
+
+/** Map rev4a/ model aliases to upstream provider/model pairs. */
+export const MODEL_ALIASES: Record<string, { provider: string; model: string }> = {
+  'rev4a/deepseek-v4-flash': { provider: 'deepseek', model: 'deepseek-v4-flash' },
+  'rev4a/deepseek-v4-pro': { provider: 'deepseek', model: 'deepseek-v4-pro' },
+};
+
+export interface UpstreamRequest {
+  model?: string;
+  provider?: string;
+  messages?: { role: string; content: string }[];
+  stream?: boolean;
+  max_tokens?: number;
+  temperature?: number;
+  [key: string]: unknown;
+}
+
+export function extractProviderAndModel(request: UpstreamRequest): { provider: string; model: string } {
+  const modelStr = request.model || '';
+  if (request.provider) {
+    return { provider: request.provider, model: modelStr };
+  }
+  // Check aliases first (rev4a/deepseek-v4-flash -> deepseek/deepseek-v4-flash)
+  if (modelStr && MODEL_ALIASES[modelStr]) {
+    return { ...MODEL_ALIASES[modelStr] };
+  }
+  const parts = modelStr.split('/');
+  if (parts.length >= 2 && PROVIDER_ENVS[parts[0]]) {
+    return { provider: parts[0], model: parts.slice(1).join('/') };
+  }
+  // Default fallback: assume the model is a raw upstream model ID
+  if (parts.length >= 3 && PROVIDER_ENVS[parts[1]]) {
+    return { provider: parts[1], model: parts.slice(2).join('/') };
+  }
+  return { provider: 'deepseek', model: modelStr || 'deepseek-chat' };
+}
+
+export function getApiKey(provider: string, storedKeys: Record<string, string>): string | null {
+  return storedKeys[provider] || null;
+}
+
+export async function callUpstream(
+  provider: string,
+  model: string,
+  body: UpstreamRequest,
+  apiKey: string,
+): Promise<Response> {
+  const envConfig = PROVIDER_ENVS[provider];
+  if (!envConfig) {
+    return new Response(
+      JSON.stringify({ error: { message: `Unknown provider: ${provider}`, type: 'invalid_request_error' } }),
+      { status: 400, headers: { 'Content-Type': 'application/json' } },
+    );
+  }
+
+  const basePath = envConfig.basePath || '/v1';
+  const targetUrl = `${envConfig.baseUrl}${basePath}/chat/completions`;
+
+  const upstreamBody: Record<string, unknown> = { ...body, model: model || undefined };
+  delete upstreamBody.provider;
+
+  const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+
+  if (envConfig.authHeader === 'x-api-key') {
+    headers['x-api-key'] = apiKey;
+    headers['anthropic-version'] = '2023-06-01';
+  } else {
+    headers['Authorization'] = `Bearer ${apiKey}`;
+  }
+
+  if (provider === 'openrouter') {
+    headers['HTTP-Referer'] = `http://${detectPublicHost()}:3740`;
+    headers['X-Title'] = 'Rev4a Gateway';
+  }
+
+  // Force identity encoding to avoid gzip-related HTTP/2 truncation issues via Traefik
+  headers['Accept-Encoding'] = 'identity';
+
+  return fetch(targetUrl, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify(upstreamBody),
+  });
+}

package/app/api/provider/v1/chat/completions/route.ts

@@ -0,0 +1,146 @@
+/**
+ * Rev4a Provider Gateway — v1
+ *
+ * OpenAI-compatible chat completions endpoint.
+ * POST /api/provider/v1/chat/completions
+ *
+ * Authentication uses provider keys stored in data/provider-keys.json.
+ * The Authorization Bearer token must match a configured provider key.
+ * The rev4a master key (REV4A_API_KEY env var) unlocks all providers.
+ */
+import { NextRequest } from 'next/server';
+import { readProviderKeys } from '@/app/api/gateway/provider/keys';
+import {
+  extractProviderAndModel,
+  getApiKey,
+  callUpstream,
+} from '@/app/api/provider/upstream';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+interface ProviderV1Request {
+  model?: string;
+  provider?: string;
+  messages?: { role: string; content: string }[];
+  stream?: boolean;
+  max_tokens?: number;
+  temperature?: number;
+  [key: string]: unknown;
+}
+
+/** Serialize to JSON and return a Response with explicit Content-Length to avoid Traefik HTTP/2 issues. */
+function jsonResponse(data: unknown, status = 200, extraHeaders?: Record<string, string>): Response {
+  const body = JSON.stringify(data);
+  const byteLen = Buffer.byteLength(body, 'utf-8');
+  const headers = new Headers({
+    'Content-Type': 'application/json',
+    'Content-Length': String(byteLen),
+    'Cache-Control': 'no-store, max-age=0, must-revalidate',
+    ...extraHeaders,
+  });
+  return new Response(body, { status, headers });
+}
+
+function errorResponse(message: string, type: string, status: number): Response {
+  return jsonResponse({ error: { message, type } }, status);
+}
+
+export async function POST(request: NextRequest) {
+  const start = Date.now();
+
+  try {
+    // Resolve provider from Authorization token
+    const authHeader = request.headers.get('Authorization') || '';
+    const token = authHeader.replace(/^Bearer\s+/i, '').trim();
+    const providerKeys = readProviderKeys();
+
+    // Check if token matches any stored key
+    const isAuthenticated = Object.values(providerKeys).some((key) => token === key);
+
+    // Also accept the rev4a master API key env var
+    const rev4aMasterKey = process.env.REV4A_API_KEY;
+    const isMasterAuth = !!rev4aMasterKey && token === rev4aMasterKey;
+
+    if (!isAuthenticated && !isMasterAuth) {
+      return errorResponse(
+        'Invalid API key. Use your Rev4a API key from the Gateway page via Authorization: Bearer <key>.',
+        'authentication_error',
+        401,
+      );
+    }
+
+    const body: ProviderV1Request = await request.json();
+    const { provider, model } = extractProviderAndModel(body);
+
+    const apiKey = getApiKey(provider, providerKeys);
+    if (!apiKey) {
+      return errorResponse(
+        `API key not configured for provider '${provider}'. Add it from the Gateway page.`,
+        'configuration_error',
+        401,
+      );
+    }
+
+    const upstreamResp = await callUpstream(provider, model, body, apiKey);
+    const latency = Date.now() - start;
+
+    // Streaming passthrough
+    if (upstreamResp.headers.get('content-type')?.includes('text/event-stream') || body.stream) {
+      const responseHeaders = new Headers();
+      upstreamResp.headers.forEach((value, key) => {
+        const forbidden = ['transfer-encoding', 'connection', 'keep-alive', 'content-length'];
+        if (!forbidden.includes(key.toLowerCase())) {
+          responseHeaders.set(key, value);
+        }
+      });
+      responseHeaders.set('x-rev4a-gateway', 'true');
+      responseHeaders.set('x-rev4a-provider', provider);
+      responseHeaders.set('x-rev4a-latency-ms', String(latency));
+      return new Response(upstreamResp.body, {
+        status: upstreamResp.status,
+        statusText: upstreamResp.statusText,
+        headers: responseHeaders,
+      });
+    }
+
+    // Non-streaming: parse upstream JSON
+    const responseText = await upstreamResp.text();
+    let responseJson: Record<string, unknown> = {};
+    try {
+      responseJson = JSON.parse(responseText);
+    } catch {
+      responseJson = { raw: responseText };
+    }
+
+    // Build with explicit Content-Length (in bytes, not chars)
+    const finalBodyStr = JSON.stringify(
+      { ...responseJson, _gateway: { provider, latencyMs: latency, timestamp: Date.now() } },
+    );
+    const byteLen = Buffer.byteLength(finalBodyStr, 'utf-8');
+
+    const responseHeaders = new Headers({
+      'Content-Type': 'application/json',
+      'Content-Length': String(byteLen),
+      'Cache-Control': 'no-store, max-age=0, must-revalidate',
+    });
+    upstreamResp.headers.forEach((value, key) => {
+      const forbidden = ['transfer-encoding', 'connection', 'keep-alive', 'content-length'];
+      if (!forbidden.includes(key.toLowerCase())) {
+        responseHeaders.set(key, value);
+      }
+    });
+    responseHeaders.set('x-rev4a-gateway', 'true');
+    responseHeaders.set('x-rev4a-provider', provider);
+    responseHeaders.set('x-rev4a-latency-ms', String(latency));
+
+    return new Response(finalBodyStr, {
+      status: upstreamResp.status,
+      headers: responseHeaders,
+    });
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error('[provider/v1] Error:', message);
+    return errorResponse(`Gateway error: ${message}`, 'gateway_error', 502);
+  }
+}

package/app/api/provider/v1/models/route.ts

@@ -0,0 +1,167 @@
+/**
+ * Rev4a Provider Gateway — v1 Models List
+ *
+ * GET /api/provider/v1/models
+ *
+ * Returns models available through the Rev4a Gateway
+ * in OpenAI-compatible format, filtered by the provider
+ * identified from the Authorization token.
+ *
+ * The model list is read from models.config.json in the project root.
+ * If the file doesn't exist, falls back to provider env config + static defaults.
+ */
+import { NextResponse, NextRequest } from 'next/server';
+import { MODELS_CONFIG_FILE } from '@/lib/rev4a-paths';
+import * as fs from 'fs';
+import * as path from 'path';
+import { readProviderKeys } from '@/app/api/gateway/provider/keys';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+interface ModelEntry {
+  id: string;
+  object: string;
+  created: number;
+  owned_by: string;
+  permission: string[];
+  root: string;
+}
+
+interface ModelsConfigEntry {
+  id: string;
+  name: string;
+  provider: string;
+  enabled: boolean;
+}
+
+const CONFIG_PATH = MODELS_CONFIG_FILE;
+
+/** Default model catalogue (known models for each provider) */
+const DEFAULT_CATALOGUE: ModelsConfigEntry[] = [
+  // OpenAI
+  { id: 'openai/gpt-5.6-sol', name: 'GPT-5.6 Sol', provider: 'openai', enabled: true },
+  { id: 'openai/gpt-5.6-terra', name: 'GPT-5.6 Terra', provider: 'openai', enabled: true },
+  { id: 'openai/gpt-5.6-luna', name: 'GPT-5.6 Luna', provider: 'openai', enabled: true },
+  { id: 'openai/gpt-5.5', name: 'GPT-5.5', provider: 'openai', enabled: true },
+  { id: 'openai/gpt-5.4', name: 'GPT-5.4', provider: 'openai', enabled: true },
+  { id: 'openai/gpt-5.4-mini', name: 'GPT-5.4 Mini', provider: 'openai', enabled: true },
+  // Anthropic
+  { id: 'anthropic/claude-fable-5', name: 'Claude Fable 5', provider: 'anthropic', enabled: false },
+  { id: 'anthropic/claude-opus-5', name: 'Claude Opus 5', provider: 'anthropic', enabled: false },
+  { id: 'anthropic/claude-sonnet-5', name: 'Claude Sonnet 5', provider: 'anthropic', enabled: false },
+  { id: 'anthropic/claude-haiku-4-5', name: 'Claude Haiku 4.5', provider: 'anthropic', enabled: false },
+  // DeepSeek
+  { id: 'deepseek/deepseek-v4-pro', name: 'DeepSeek V4 Pro', provider: 'deepseek', enabled: true },
+  { id: 'deepseek/deepseek-v4-flash', name: 'DeepSeek V4 Flash', provider: 'deepseek', enabled: true },
+  // OpenRouter
+  { id: 'openrouter/auto', name: 'OpenRouter Auto', provider: 'openrouter', enabled: true },
+  { id: 'openrouter/deepseek/deepseek-v4-flash', name: 'DeepSeek V4 Flash (OR)', provider: 'openrouter', enabled: true },
+  { id: 'openrouter/google/gemini-2.5-flash', name: 'Gemini 2.5 Flash (OR)', provider: 'openrouter', enabled: true },
+  { id: 'openrouter/google/gemini-2.5-pro', name: 'Gemini 2.5 Pro (OR)', provider: 'openrouter', enabled: true },
+  { id: 'openrouter/anthropic/claude-sonnet-4.6', name: 'Claude Sonnet 4.6 (OR)', provider: 'openrouter', enabled: false },
+  { id: 'openrouter/deepseek/deepseek-r1-0528', name: 'DeepSeek R1 0528 (OR)', provider: 'openrouter', enabled: false },
+  // Groq
+  { id: 'groq/llama-3.1-8b-instant', name: 'Llama 3.1 8B (Groq)', provider: 'groq', enabled: false },
+  { id: 'groq/llama-3.3-70b-versatile', name: 'Llama 3.3 70B (Groq)', provider: 'groq', enabled: false },
+  // Kimi
+  { id: 'kimi/kimi-k3', name: 'Kimi K3', provider: 'kimi', enabled: true },
+  { id: 'kimi/kimi-k2.7-code', name: 'Kimi K2.7 Code', provider: 'kimi', enabled: false },
+  { id: 'kimi/kimi-k2.7-code-highspeed', name: 'Kimi K2.7 Code HighSpeed', provider: 'kimi', enabled: false },
+  { id: 'kimi/kimi-k2.6', name: 'Kimi K2.6', provider: 'kimi', enabled: false },
+  // GLM
+  { id: 'glm/glm-5.2', name: 'GLM-5.2', provider: 'glm', enabled: false },
+  { id: 'glm/glm-5.1', name: 'GLM-5.1', provider: 'glm', enabled: false },
+  { id: 'glm/glm-5', name: 'GLM-5', provider: 'glm', enabled: false },
+  { id: 'glm/glm-4.7', name: 'GLM-4.7', provider: 'glm', enabled: false },
+  { id: 'glm/glm-4.7-flash', name: 'GLM-4.7 Flash', provider: 'glm', enabled: false },
+  { id: 'glm/glm-4.7-flashx', name: 'GLM-4.7 FlashX', provider: 'glm', enabled: false },
+  { id: 'glm/glm-5v-turbo', name: 'GLM-5V Turbo', provider: 'glm', enabled: false },
+  { id: 'glm/glm-4.6v-flash', name: 'GLM-4.6V Flash', provider: 'glm', enabled: false },
+  // Qwen
+  { id: 'qwen/qwen3.7-max', name: 'Qwen 3.7 Max', provider: 'qwen', enabled: false },
+  { id: 'qwen/qwen3.7-plus', name: 'Qwen 3.7 Plus', provider: 'qwen', enabled: true },
+  { id: 'qwen/qwen3.7-flash', name: 'Qwen 3.7 Flash', provider: 'qwen', enabled: false },
+  { id: 'qwen/qwen3-coder-plus', name: 'Qwen 3 Coder Plus', provider: 'qwen', enabled: false },
+  { id: 'qwen/qwen-long', name: 'Qwen Long', provider: 'qwen', enabled: false },
+  // Rev4a aliases (convenience models for the Rev4a proxy)
+  { id: 'rev4a/deepseek-v4-flash', name: 'DeepSeek V4 Flash (Rev4a)', provider: 'rev4a', enabled: true },
+  { id: 'rev4a/deepseek-v4-pro', name: 'DeepSeek V4 Pro (Rev4a)', provider: 'rev4a', enabled: true },
+  { id: 'rev4a/fast', name: 'Rev4a Fast', provider: 'rev4a', enabled: false },
+  { id: 'rev4a/code', name: 'Rev4a Code', provider: 'rev4a', enabled: false },
+  { id: 'rev4a/reason', name: 'Rev4a Reason', provider: 'rev4a', enabled: false },
+  { id: 'rev4a/fallback-general', name: 'Rev4a Fallback General', provider: 'rev4a', enabled: false },
+];
+
+/** Load the models config from file, or create from defaults */
+function loadConfig(): ModelsConfigEntry[] {
+  try {
+    const raw = fs.readFileSync(CONFIG_PATH, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed.models)) {
+      return parsed.models as ModelsConfigEntry[];
+    }
+    return DEFAULT_CATALOGUE;
+  } catch {
+    // File doesn't exist or invalid — write defaults
+    try {
+      fs.writeFileSync(CONFIG_PATH, JSON.stringify({ models: DEFAULT_CATALOGUE }, null, 2), 'utf-8');
+    } catch {
+      // Can't write, fall back to defaults in memory
+    }
+    return DEFAULT_CATALOGUE;
+  }
+}
+
+/** Resolve the provider from the Authorization token by matching against provider-keys.json */
+function resolveProviderFromToken(authHeader: string): string | null {
+  const token = authHeader.replace(/^Bearer\s+/i, '').trim();
+  if (!token) return null;
+
+  const providerKeys = readProviderKeys();
+
+  // Match the token value against stored provider keys
+  for (const [, key] of Object.entries(providerKeys)) {
+    if (token === key) return 'authenticated';
+  }
+
+  // Also try matching the rev4a API key env var (legacy compat)
+  if (token === process.env.REV4A_API_KEY) return 'all';
+
+  return null;
+}
+
+export async function GET(request: NextRequest) {
+  const allModels = loadConfig();
+
+  // Determine provider from Authorization token
+  const authHeader = request.headers.get('Authorization') || '';
+  const provider = resolveProviderFromToken(authHeader);
+
+  if (!provider) {
+    // No valid token — return empty list to avoid leaking model info
+    return NextResponse.json({
+      object: 'list',
+      total: 0,
+      data: [],
+    });
+  }
+
+  let activeModels: ModelsConfigEntry[];
+
+  // Token authenticated — return all enabled models
+  activeModels = allModels.filter((m) => m.enabled);
+
+  return NextResponse.json({
+    object: 'list',
+    total: activeModels.length,
+    data: activeModels.map((m) => ({
+      id: m.id,
+      object: 'model',
+      created: 1700000000,
+      owned_by: m.provider,
+      permission: [],
+      root: m.id,
+    })),
+  });
+}