@flame0510/project-aether 1.2.0 → 1.4.0

package/app/api/models/route.ts

@@ -1,22 +1,12 @@
 import { type NextRequest } from "next/server";
 import { NextResponse } from 'next/server';
-import { MODELS_CONFIG_FILE } from '@/lib/rev4a-paths';
-import * as fs from 'fs';
-import * as path from 'path';
 import { readProviderKeys } from '@/app/api/gateway/provider/keys';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { loadOfferedModels } from '@/lib/model-catalogue';
+import { getPricing } from '@/lib/model-pricing';
 
 export const dynamic = 'force-dynamic';
 
-interface ModelsConfigEntry {
-  id: string;
-  name: string;
-  provider: string;
-  enabled: boolean;
-}
-
-const CONFIG_PATH = MODELS_CONFIG_FILE;
-
 const PROVIDER_EMOJI: Record<string, string> = {
   deepseek: '🧠',
   openrouter: '🌐',
@@ -37,32 +27,27 @@ const PROVIDER_LABEL: Record<string, string> = {
   rev4a: 'Rev4a',
 };
 
-function loadModelsConfig(): ModelsConfigEntry[] {
-  try {
-    const raw = fs.readFileSync(CONFIG_PATH, 'utf-8');
-    const parsed = JSON.parse(raw);
-    if (Array.isArray(parsed.models)) return parsed.models as ModelsConfigEntry[];
-  } catch {}
-  return [];
-}
-
+/**
+ * Model picker source. Uses the shared catalogue loader so the list offered here
+ * matches what the sync actually writes into agent containers — this route used
+ * to read models.config.json directly and ignore model-overrides.json, so models
+ * switched off on the Gateway page still showed up as selectable.
+ */
 export async function GET(_req: NextRequest): Promise<NextResponse> {
   const request = _req;
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
-  const allModels = loadModelsConfig();
-  const providerKeys = readProviderKeys();
-  const configured = new Set(Object.keys(providerKeys));
-
-  const eligible = allModels.filter((m) => {
-    if (!m.enabled) return false;
-    if (configured.has(m.provider)) return true;
-    // rev4a/* aliases resolve to deepseek upstream
-    if (m.provider === 'rev4a' && configured.has('deepseek')) return true;
-    return false;
-  });
+  const eligible = loadOfferedModels();
 
-  const grouped = new Map<string, { provider: string; emoji: string; models: { id: string; label: string }[] }>();
+  const grouped = new Map<string, {
+    provider: string;
+    emoji: string;
+    models: {
+      id: string; label: string;
+      input: number | null; output: number | null;
+      deprecated: boolean;
+    }[];
+  }>();
 
   for (const model of eligible) {
     if (!grouped.has(model.provider)) {
@@ -72,7 +57,16 @@ export async function GET(_req: NextRequest): Promise<NextResponse> {
         models: [],
       });
     }
-    grouped.get(model.provider)!.models.push({ id: model.id, label: model.name });
+    // Price travels with the option so the picker can show cost at the point of
+    // choice, instead of sending the operator to another page to look it up.
+    const price = getPricing(model.id);
+    grouped.get(model.provider)!.models.push({
+      id: model.id,
+      label: model.name,
+      input: price?.input ?? null,
+      output: price?.output ?? null,
+      deprecated: model.deprecated ?? false,
+    });
   }
 
   return NextResponse.json(Array.from(grouped.values()));

package/app/api/provider/auth.ts

@@ -0,0 +1,65 @@
+/**
+ * Who may call the Rev4a Provider Gateway.
+ *
+ * One credential opens this door: the `rev4a` entry of `provider-keys.json`.
+ * That is the value `buildRev4aProviderConfig()` writes into every agent
+ * container, and `syncAllAgents()` refuses to run without it, so it is the only
+ * token any legitimate client holds. `REV4A_API_KEY` is accepted alongside it
+ * for callers configured before the key moved into the file.
+ *
+ * **Why this is its own module.** The two v1 routes each carried their own copy
+ * of the check and the copies had drifted — one guarded the empty token, the
+ * other did not. Worse, both compared the incoming token against *every* value
+ * in `provider-keys.json`:
+ *
+ *     Object.values(providerKeys).some((key) => token === key)
+ *
+ * `provider-keys.json` holds two different kinds of secret in one map. The
+ * `rev4a` entry is the password to this door. Every other entry is a credential
+ * Rev4a presents to an upstream provider. Iterating the map conflated them, so a
+ * DeepSeek API key authenticated here exactly like the gateway key — verified
+ * against a running instance, which answered `400 invalid_request_error` to a
+ * malformed body rather than `401`.
+ *
+ * With one upstream provider configured that granted nothing: the holder of a
+ * DeepSeek key can already spend at DeepSeek. It mattered as a latent fault. Add
+ * an OpenAI key and the old DeepSeek key silently becomes a way to spend at
+ * OpenAI, with nothing in the code or the UI to say so.
+ */
+import { timingSafeEqual } from 'crypto';
+import { readProviderKeys } from '@/app/api/gateway/provider/keys';
+
+/** Compare without leaking length or position through timing. */
+function secretEquals(a: string, b: string): boolean {
+  const ab = Buffer.from(a, 'utf8');
+  const bb = Buffer.from(b, 'utf8');
+  // timingSafeEqual throws on length mismatch, which is itself an early exit.
+  // Comparing digests of equal length would hide it; for a bearer token the
+  // length is not the secret, so a plain guard is enough.
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+
+/**
+ * True when the request carries the gateway credential.
+ *
+ * Never true for an absent or empty token, whatever the key file contains: an
+ * entry saved as `""` would otherwise match a request with no Authorization
+ * header at all.
+ */
+export function isGatewayClient(request: Request): boolean {
+  const token = (request.headers.get('Authorization') || '')
+    .replace(/^Bearer\s+/i, '')
+    .trim();
+  if (!token) return false;
+
+  // provider-keys.json is hand-editable: a non-string value must deny, not throw.
+  // Buffer.from on a number raises, and the models route has no catch.
+  const gatewayKey: unknown = readProviderKeys()['rev4a'];
+  if (typeof gatewayKey === 'string' && gatewayKey && secretEquals(token, gatewayKey)) return true;
+
+  const masterKey = process.env.REV4A_API_KEY;
+  if (masterKey && secretEquals(token, masterKey)) return true;
+
+  return false;
+}

package/app/api/provider/upstream.ts

@@ -57,7 +57,7 @@ export const PROVIDER_ENVS: Record<string, ProviderEnvConfig> = {
 
 /** Map rev4a/ model aliases to upstream provider/model pairs. */
 export const MODEL_ALIASES: Record<string, { provider: string; model: string }> = {
-  'rev4a/deepseek-v4-flash': { provider: 'deepseek', model: 'deepseek-v4-flash' },
+  'rev4a/deepseek-flash': { provider: 'deepseek', model: 'deepseek-flash' },
   'rev4a/deepseek-v4-pro': { provider: 'deepseek', model: 'deepseek-v4-pro' },
 };
 
@@ -76,7 +76,7 @@ export function extractProviderAndModel(request: UpstreamRequest): { provider: s
   if (request.provider) {
     return { provider: request.provider, model: modelStr };
   }
-  // Check aliases first (rev4a/deepseek-v4-flash -> deepseek/deepseek-v4-flash)
+  // Check aliases first (rev4a/deepseek-flash -> deepseek/deepseek-flash)
   if (modelStr && MODEL_ALIASES[modelStr]) {
     return { ...MODEL_ALIASES[modelStr] };
   }
@@ -114,6 +114,13 @@ export async function callUpstream(
 
   const upstreamBody: Record<string, unknown> = { ...body, model: model || undefined };
   delete upstreamBody.provider;
+  // `model` has been checked against the catalogue; these fields let the upstream
+  // pick a different one. OpenRouter serves a fallback from `models` when the
+  // primary fails, and `route`/`preset` can redirect the request, so forwarding them
+  // would let a client get a model the catalogue does not offer.
+  delete upstreamBody.models;
+  delete upstreamBody.route;
+  delete upstreamBody.preset;
 
   const headers: Record<string, string> = { 'Content-Type': 'application/json' };
 

package/app/api/provider/v1/chat/completions/route.ts

@@ -4,11 +4,14 @@
  * OpenAI-compatible chat completions endpoint.
  * POST /api/provider/v1/chat/completions
  *
- * Authentication uses provider keys stored in data/provider-keys.json.
- * The Authorization Bearer token must match a configured provider key.
- * The rev4a master key (REV4A_API_KEY env var) unlocks all providers.
+ * Authentication is the `rev4a` entry of provider-keys.json, or REV4A_API_KEY.
+ * See `app/api/provider/auth.ts` — in particular why the other entries in that
+ * file, which are upstream credentials rather than passwords, must not be
+ * accepted here.
  */
 import { NextRequest } from 'next/server';
+import { isGatewayClient } from '@/app/api/provider/auth';
+import { isModelOffered } from '@/lib/model-catalogue';
 import { readProviderKeys } from '@/app/api/gateway/provider/keys';
 import {
   extractProviderAndModel,
@@ -50,19 +53,7 @@ export async function POST(request: NextRequest) {
   const start = Date.now();
 
   try {
-    // Resolve provider from Authorization token
-    const authHeader = request.headers.get('Authorization') || '';
-    const token = authHeader.replace(/^Bearer\s+/i, '').trim();
-    const providerKeys = readProviderKeys();
-
-    // Check if token matches any stored key
-    const isAuthenticated = Object.values(providerKeys).some((key) => token === key);
-
-    // Also accept the rev4a master API key env var
-    const rev4aMasterKey = process.env.REV4A_API_KEY;
-    const isMasterAuth = !!rev4aMasterKey && token === rev4aMasterKey;
-
-    if (!isAuthenticated && !isMasterAuth) {
+    if (!isGatewayClient(request)) {
       return errorResponse(
         'Invalid API key. Use your Rev4a API key from the Gateway page via Authorization: Bearer <key>.',
         'authentication_error',
@@ -73,6 +64,21 @@ export async function POST(request: NextRequest) {
     const body: ProviderV1Request = await request.json();
     const { provider, model } = extractProviderAndModel(body);
 
+    // The catalogue is policy, and policy has to be enforced where the money is
+    // spent, not only where the pickers are drawn. Without this, unchecking a
+    // model on the Gateway page hid it from every list and still served every
+    // client that already held the id.
+    if (!isModelOffered(provider, model)) {
+      return errorResponse(
+        `Model '${provider}/${model}' is not enabled for this deployment. ` +
+        'Enable it on the Gateway page, or pick one that is.',
+        'invalid_request_error',
+        400,
+      );
+    }
+
+    // Upstream credentials, distinct from the token that opened this door.
+    const providerKeys = readProviderKeys();
     const apiKey = getApiKey(provider, providerKeys);
     if (!apiKey) {
       return errorResponse(

package/app/api/provider/v1/models/route.ts

@@ -3,143 +3,36 @@
  *
  * GET /api/provider/v1/models
  *
- * Returns models available through the Rev4a Gateway
- * in OpenAI-compatible format, filtered by the provider
- * identified from the Authorization token.
+ * Returns the models available through the Rev4a Gateway, in OpenAI-compatible
+ * format. This is the endpoint agent containers call to discover what they can
+ * ask for, so it must agree with what `gateway/sync.ts` writes into their config.
  *
- * The model list is read from models.config.json in the project root.
- * If the file doesn't exist, falls back to provider env config + static defaults.
+ * It did not. This route used to carry its own copy of the catalogue and its own
+ * loader, and the two diverged in ways that mattered:
+ *
+ *  - **User toggles were ignored here.** Disabling a model from the Gateway page
+ *    writes to `model-overrides.json`, which `loadModelsConfig()` applies. This
+ *    route read `models.config.json` raw, so a model switched off in the UI was
+ *    still advertised to agents.
+ *  - **A read failure overwrote the catalogue.** If the file was missing or
+ *    momentarily unparseable, the `catch` wrote a hardcoded 30-model default over
+ *    it — replacing the real catalogue, user overrides included.
+ *
+ * Both are gone: the catalogue now comes from `lib/model-catalogue`, the single
+ * loader shared with the create route, the provider page and the sync.
  */
 import { NextResponse, NextRequest } from 'next/server';
-import { MODELS_CONFIG_FILE } from '@/lib/rev4a-paths';
-import * as fs from 'fs';
-import * as path from 'path';
-import { readProviderKeys } from '@/app/api/gateway/provider/keys';
+import { isGatewayClient } from '@/app/api/provider/auth';
+import { loadOfferedModels } from '@/lib/model-catalogue';
 
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
 
-interface ModelEntry {
-  id: string;
-  object: string;
-  created: number;
-  owned_by: string;
-  permission: string[];
-  root: string;
-}
-
-interface ModelsConfigEntry {
-  id: string;
-  name: string;
-  provider: string;
-  enabled: boolean;
-}
-
-const CONFIG_PATH = MODELS_CONFIG_FILE;
-
-/** Default model catalogue (known models for each provider) */
-const DEFAULT_CATALOGUE: ModelsConfigEntry[] = [
-  // OpenAI
-  { id: 'openai/gpt-5.6-sol', name: 'GPT-5.6 Sol', provider: 'openai', enabled: true },
-  { id: 'openai/gpt-5.6-terra', name: 'GPT-5.6 Terra', provider: 'openai', enabled: true },
-  { id: 'openai/gpt-5.6-luna', name: 'GPT-5.6 Luna', provider: 'openai', enabled: true },
-  { id: 'openai/gpt-5.5', name: 'GPT-5.5', provider: 'openai', enabled: true },
-  { id: 'openai/gpt-5.4', name: 'GPT-5.4', provider: 'openai', enabled: true },
-  { id: 'openai/gpt-5.4-mini', name: 'GPT-5.4 Mini', provider: 'openai', enabled: true },
-  // Anthropic
-  { id: 'anthropic/claude-fable-5', name: 'Claude Fable 5', provider: 'anthropic', enabled: false },
-  { id: 'anthropic/claude-opus-5', name: 'Claude Opus 5', provider: 'anthropic', enabled: false },
-  { id: 'anthropic/claude-sonnet-5', name: 'Claude Sonnet 5', provider: 'anthropic', enabled: false },
-  { id: 'anthropic/claude-haiku-4-5', name: 'Claude Haiku 4.5', provider: 'anthropic', enabled: false },
-  // DeepSeek
-  { id: 'deepseek/deepseek-v4-pro', name: 'DeepSeek V4 Pro', provider: 'deepseek', enabled: true },
-  { id: 'deepseek/deepseek-v4-flash', name: 'DeepSeek V4 Flash', provider: 'deepseek', enabled: true },
-  // OpenRouter
-  { id: 'openrouter/auto', name: 'OpenRouter Auto', provider: 'openrouter', enabled: true },
-  { id: 'openrouter/deepseek/deepseek-v4-flash', name: 'DeepSeek V4 Flash (OR)', provider: 'openrouter', enabled: true },
-  { id: 'openrouter/google/gemini-2.5-flash', name: 'Gemini 2.5 Flash (OR)', provider: 'openrouter', enabled: true },
-  { id: 'openrouter/google/gemini-2.5-pro', name: 'Gemini 2.5 Pro (OR)', provider: 'openrouter', enabled: true },
-  { id: 'openrouter/anthropic/claude-sonnet-4.6', name: 'Claude Sonnet 4.6 (OR)', provider: 'openrouter', enabled: false },
-  { id: 'openrouter/deepseek/deepseek-r1-0528', name: 'DeepSeek R1 0528 (OR)', provider: 'openrouter', enabled: false },
-  // Groq
-  { id: 'groq/llama-3.1-8b-instant', name: 'Llama 3.1 8B (Groq)', provider: 'groq', enabled: false },
-  { id: 'groq/llama-3.3-70b-versatile', name: 'Llama 3.3 70B (Groq)', provider: 'groq', enabled: false },
-  // Kimi
-  { id: 'kimi/kimi-k3', name: 'Kimi K3', provider: 'kimi', enabled: true },
-  { id: 'kimi/kimi-k2.7-code', name: 'Kimi K2.7 Code', provider: 'kimi', enabled: false },
-  { id: 'kimi/kimi-k2.7-code-highspeed', name: 'Kimi K2.7 Code HighSpeed', provider: 'kimi', enabled: false },
-  { id: 'kimi/kimi-k2.6', name: 'Kimi K2.6', provider: 'kimi', enabled: false },
-  // GLM
-  { id: 'glm/glm-5.2', name: 'GLM-5.2', provider: 'glm', enabled: false },
-  { id: 'glm/glm-5.1', name: 'GLM-5.1', provider: 'glm', enabled: false },
-  { id: 'glm/glm-5', name: 'GLM-5', provider: 'glm', enabled: false },
-  { id: 'glm/glm-4.7', name: 'GLM-4.7', provider: 'glm', enabled: false },
-  { id: 'glm/glm-4.7-flash', name: 'GLM-4.7 Flash', provider: 'glm', enabled: false },
-  { id: 'glm/glm-4.7-flashx', name: 'GLM-4.7 FlashX', provider: 'glm', enabled: false },
-  { id: 'glm/glm-5v-turbo', name: 'GLM-5V Turbo', provider: 'glm', enabled: false },
-  { id: 'glm/glm-4.6v-flash', name: 'GLM-4.6V Flash', provider: 'glm', enabled: false },
-  // Qwen
-  { id: 'qwen/qwen3.7-max', name: 'Qwen 3.7 Max', provider: 'qwen', enabled: false },
-  { id: 'qwen/qwen3.7-plus', name: 'Qwen 3.7 Plus', provider: 'qwen', enabled: true },
-  { id: 'qwen/qwen3.7-flash', name: 'Qwen 3.7 Flash', provider: 'qwen', enabled: false },
-  { id: 'qwen/qwen3-coder-plus', name: 'Qwen 3 Coder Plus', provider: 'qwen', enabled: false },
-  { id: 'qwen/qwen-long', name: 'Qwen Long', provider: 'qwen', enabled: false },
-  // Rev4a aliases (convenience models for the Rev4a proxy)
-  { id: 'rev4a/deepseek-v4-flash', name: 'DeepSeek V4 Flash (Rev4a)', provider: 'rev4a', enabled: true },
-  { id: 'rev4a/deepseek-v4-pro', name: 'DeepSeek V4 Pro (Rev4a)', provider: 'rev4a', enabled: true },
-  { id: 'rev4a/fast', name: 'Rev4a Fast', provider: 'rev4a', enabled: false },
-  { id: 'rev4a/code', name: 'Rev4a Code', provider: 'rev4a', enabled: false },
-  { id: 'rev4a/reason', name: 'Rev4a Reason', provider: 'rev4a', enabled: false },
-  { id: 'rev4a/fallback-general', name: 'Rev4a Fallback General', provider: 'rev4a', enabled: false },
-];
-
-/** Load the models config from file, or create from defaults */
-function loadConfig(): ModelsConfigEntry[] {
-  try {
-    const raw = fs.readFileSync(CONFIG_PATH, 'utf-8');
-    const parsed = JSON.parse(raw);
-    if (Array.isArray(parsed.models)) {
-      return parsed.models as ModelsConfigEntry[];
-    }
-    return DEFAULT_CATALOGUE;
-  } catch {
-    // File doesn't exist or invalid — write defaults
-    try {
-      fs.writeFileSync(CONFIG_PATH, JSON.stringify({ models: DEFAULT_CATALOGUE }, null, 2), 'utf-8');
-    } catch {
-      // Can't write, fall back to defaults in memory
-    }
-    return DEFAULT_CATALOGUE;
-  }
-}
-
-/** Resolve the provider from the Authorization token by matching against provider-keys.json */
-function resolveProviderFromToken(authHeader: string): string | null {
-  const token = authHeader.replace(/^Bearer\s+/i, '').trim();
-  if (!token) return null;
-
-  const providerKeys = readProviderKeys();
-
-  // Match the token value against stored provider keys
-  for (const [, key] of Object.entries(providerKeys)) {
-    if (token === key) return 'authenticated';
-  }
-
-  // Also try matching the rev4a API key env var (legacy compat)
-  if (token === process.env.REV4A_API_KEY) return 'all';
-
-  return null;
-}
-
 export async function GET(request: NextRequest) {
-  const allModels = loadConfig();
-
-  // Determine provider from Authorization token
-  const authHeader = request.headers.get('Authorization') || '';
-  const provider = resolveProviderFromToken(authHeader);
-
-  if (!provider) {
-    // No valid token — return empty list to avoid leaking model info
+  if (!isGatewayClient(request)) {
+    // An empty list rather than a 401: this endpoint should not confirm the
+    // catalogue to a caller that cannot use it. The cost is that a container
+    // configured with the wrong key sees "no models" instead of an auth error.
     return NextResponse.json({
       object: 'list',
       total: 0,
@@ -147,10 +40,10 @@ export async function GET(request: NextRequest) {
     });
   }
 
-  let activeModels: ModelsConfigEntry[];
-
-  // Token authenticated — return all enabled models
-  activeModels = allModels.filter((m) => m.enabled);
+  // Same set as gateway/sync.ts writes into the containers, so what an agent can
+  // discover matches what it was actually given. This route used to skip the
+  // provider-key half of that test and advertise models nobody could be billed for.
+  const activeModels = loadOfferedModels();
 
   return NextResponse.json({
     object: 'list',

package/app/api/setup/agent-image/route.ts

@@ -1,60 +1,36 @@
 /**
  * GET /api/setup/agent-image
  *
- * Checks if openclaw-agent-base:latest exists locally or needs downloading.
- * Returns status and a hint for the UI.
+ * Whether a supported OpenClaw version of the agent base image is downloaded.
+ * Returns `{ exists, version }`, the version being the newest one present.
  *
  * POST /api/setup/agent-image
  *
- * Downloads openclaw-agent-base:latest from ghcr.io (public registry).
- * Streams progress via SSE so the setup wizard can show a live progress bar.
+ * Downloads the newest supported version the registry publishes, and streams
+ * progress via SSE so the setup wizard can show a live progress bar. Nothing is
+ * downloaded when that version is already here.
  *
  * Only one download at a time — returns 409 if already running.
- * Cleans up the docker process if the client disconnects.
  */
 import { NextResponse, type NextRequest } from 'next/server';
 import { downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
-import { execSync } from 'child_process';
 import { requireAuthIfConfigured } from '@/lib/rev4a-auth';
+import { dockerAvailable } from '@/lib/docker-socket';
+import { listLocalAgentImages, newestLocalSupportedVersion } from '@/lib/agent-images';
 
 export const dynamic = 'force-dynamic';
 
-function dockerOk(): boolean {
-  try {
-    execSync('docker version --format "{{.Client.Version}}" 2>/dev/null', {
-      encoding: 'utf-8',
-      timeout: 2000,
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthIfConfigured(request);
   if (denied) return denied;
-  if (!dockerOk()) {
-    return NextResponse.json({ exists: false });
+  if (!dockerAvailable()) {
+    return NextResponse.json({ exists: false, version: null });
   }
   try {
-    const { exec } = await import('child_process');
-    const result = await new Promise<string>((resolve, reject) => {
-      exec(
-        'docker image inspect openclaw-agent-base:latest --format "{{.ID}}" 2>/dev/null',
-        { timeout: 5000 },
-        (err, stdout) => {
-          if (err) return reject(err);
-          resolve(stdout.trim());
-        },
-      );
-    });
-    if (result) {
-      return NextResponse.json({ exists: true, imageId: result });
-    }
-    return NextResponse.json({ exists: false });
+    const version = newestLocalSupportedVersion(await listLocalAgentImages());
+    return NextResponse.json({ exists: version !== null, version });
   } catch {
-    return NextResponse.json({ exists: false });
+    return NextResponse.json({ exists: false, version: null });
   }
 }
 
@@ -81,11 +57,7 @@ export async function POST(request: NextRequest): Promise<Response> {
       const ctrl = controller as ReadableStreamDefaultController & { signal?: AbortSignal };
 
       try {
-        await downloadAgentImage({
-          force: false, // setup: skip if already exists
-          onEvent: send,
-          signal: ctrl.signal,
-        });
+        await downloadAgentImage({ onEvent: send, signal: ctrl.signal });
       } catch (e: unknown) {
         send(JSON.stringify({
           type: 'error',
@@ -94,7 +66,7 @@ export async function POST(request: NextRequest): Promise<Response> {
       }
       controller.close();
     },
-    cancel() { /* downloadAgentImage handles cleanup via signal */ },
+    cancel() { /* downloadAgentImage stops the docker process through the signal */ },
   });
 
   return new Response(stream, {

package/app/components/DashboardToolbar.tsx

@@ -32,7 +32,7 @@ export default function DashboardToolbar({ filter, onChange, agents = ['all'] }:
         className={`agent-btn ${filter.showOnlyActive ? 'active' : ''}`}
         onClick={() => onChange({ showOnlyActive: !filter.showOnlyActive })}
       >
-        solo attivi
+        active only
       </button>
 
       <button

package/app/components/PulseChat.tsx

@@ -2,6 +2,7 @@
 
 import { useState, useRef, useEffect, useCallback } from 'react';
 import { usePathname } from 'next/navigation';
+import { useModels } from '../lib/models-context';
 import Link from 'next/link';
 
 const STORAGE_KEY = 'rev4a_pulse_chat';
@@ -79,51 +80,36 @@ export default function PulseChat() {
   const [input, setInput] = useState('');
   const [streaming, setStreaming] = useState(false);
   const [selectedModel, setSelectedModel] = useState<string>('');
-  const [modelGroups, setModelGroups] = useState<ModelGroup[]>([]);
-  const [modelsLoading, setModelsLoading] = useState(true);
+  // The shared catalogue, not a private copy. It refreshes when the Gateway page
+  // changes what is enabled, so this select cannot go stale mid-session.
+  const { providers: modelGroups, loaded: modelsLoaded } = useModels();
+  const modelsLoading = !modelsLoaded;
   const bottomRef = useRef<HTMLDivElement>(null);
   const inputRef = useRef<HTMLTextAreaElement>(null);
   const abortRef = useRef<AbortController | null>(null);
 
-  // Fetch available models from backend on mount
+  // Keep the choice valid against the current catalogue.
+  //
+  // Runs whenever the shared list changes, which includes the moment a model is
+  // unchecked on the Gateway page: a selection that just became unavailable is
+  // replaced rather than left to fail at send time. The saved preference is only
+  // honoured while it is still on offer.
   useEffect(() => {
-    let cancelled = false;
-
-    async function fetchModels() {
-      try {
-        const res = await fetch('/api/models');
-        if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        const data: ModelGroup[] = await res.json();
-        if (cancelled) return;
-
-        setModelGroups(data);
-
-        const allIds = data.flatMap((g) => g.models.map((m) => m.id));
-
-        // Restore saved model if valid, otherwise pick first
-        try {
-          const saved = localStorage.getItem(MODEL_STORAGE_KEY);
-          if (saved && allIds.includes(saved)) {
-            setSelectedModel(saved);
-          } else if (allIds.length > 0) {
-            setSelectedModel(allIds[0]);
-          }
-        } catch {
-          if (allIds.length > 0) setSelectedModel(allIds[0]);
-        }
-      } catch {
-        // API unavailable — leave selectedModel empty, select stays disabled
-      } finally {
-        if (!cancelled) setModelsLoading(false);
-      }
-    }
-
-    fetchModels();
-    return () => { cancelled = true; };
-  }, []);
-
-  // Save model preference on change
+    if (!modelsLoaded) return;
+    const allIds = modelGroups.flatMap((g) => g.models.map((m) => m.id));
+    if (allIds.length === 0) { setSelectedModel(''); return; }
+    if (selectedModel && allIds.includes(selectedModel)) return;
+
+    let saved: string | null = null;
+    try { saved = localStorage.getItem(MODEL_STORAGE_KEY); } catch { /* blocked */ }
+    setSelectedModel(saved && allIds.includes(saved) ? saved : allIds[0]);
+  }, [modelGroups, modelsLoaded, selectedModel]);
+
+  // Save model preference on change. Not while empty: on mount the selection is ''
+  // until the list arrives, and saving that erased the preference before it could
+  // be read back.
   useEffect(() => {
+    if (!selectedModel) return;
     try {
       localStorage.setItem(MODEL_STORAGE_KEY, selectedModel);
     } catch {