@stage-labs/metro 0.1.0-beta.220 → 0.1.0-beta.222

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.220",
+  "version": "0.1.0-beta.222",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.220",
+  "version": "0.1.0-beta.222",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -0,0 +1,127 @@
+import { spawn } from 'node:child_process';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentCommand, agentUser, agentUserExpected, claudeBin } from '../agent-user/user.js';
+import { runningAsRoot } from '../metro-user/privilege.js';
+import { PRIVACY_ENV } from './setup.js';
+
+const REQUEST_ID = 'metro-usage';
+const REQUEST = `${JSON.stringify({ type: 'control_request', request_id: REQUEST_ID, request: { subtype: 'get_usage', skip_behaviors: true } })}\n`;
+const ARGS = [
+  '-p',
+  '--setting-sources',
+  'project',
+  '--strict-mcp-config',
+  '--mcp-config',
+  '{"mcpServers":{}}',
+  '--no-session-persistence',
+  '--input-format',
+  'stream-json',
+  '--output-format',
+  'stream-json',
+  '--verbose',
+];
+const BLOCKS_USAGE = 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC';
+const PROBE_ENV: Record<string, string> = {
+  ...Object.fromEntries(Object.entries(PRIVACY_ENV).filter(([name]) => name !== BLOCKS_USAGE)),
+  DISABLE_AUTOUPDATER: '1',
+  DISABLE_BUG_COMMAND: '1',
+  ENABLE_CLAUDEAI_MCP_SERVERS: 'false',
+};
+const TIMEOUT_MS = 20_000;
+const KILL_GRACE_MS = 2_000;
+const LINE_MAX = 1024 * 1024;
+
+export interface UsageProbeDeps {
+  command?: string[];
+  timeoutMs?: number;
+}
+
+export function usageProbeCommand(): string[] | null {
+  if (runningAsRoot() || (agentUserExpected() && agentUser() === null)) return null;
+  return agentCommand([claudeBin(), ...ARGS], PROBE_ENV);
+}
+
+function answerOf(line: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(line);
+    if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response)) return null;
+    return parsed.response.request_id === REQUEST_ID ? parsed.response : null;
+  } catch {
+    return null;
+  }
+}
+
+function limitsOf(answer: Record<string, unknown>): unknown {
+  if (answer.subtype !== 'success') throw new Error(`Claude Code refused the usage request: ${typeof answer.error === 'string' ? answer.error : 'no reason given'}`);
+  return isRecord(answer.response) ? (answer.response.rate_limits ?? null) : null;
+}
+
+export function usageIn(output: string): unknown {
+  const answer = output
+    .split('\n')
+    .map(answerOf)
+    .find((found) => found !== null);
+  if (answer === undefined || answer === null) throw new Error('Claude Code gave no usage answer');
+  return limitsOf(answer);
+}
+
+export function readClaudeUsage(deps: UsageProbeDeps = {}): Promise<unknown> {
+  const command = deps.command ?? usageProbeCommand();
+  if (command === null) return Promise.reject(new Error('Claude Code runs only as the agent user, and this box has none'));
+  const [file = '', ...args] = command;
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV } });
+    let carry = '';
+    let settled = false;
+    let hardKill: ReturnType<typeof setTimeout> | undefined;
+    const settle = (run: () => void): void => {
+      if (settled) return;
+      settled = true;
+      run();
+    };
+    const overdue = setTimeout(() => {
+      settle(() => {
+        reject(new Error('Claude Code did not report the usage in time'));
+      });
+      child.stdout.destroy();
+      child.kill('SIGTERM');
+      hardKill = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS);
+    }, deps.timeoutMs ?? TIMEOUT_MS);
+    const take = (line: string): void => {
+      const answer = answerOf(line);
+      if (answer === null) return;
+      settle(() => {
+        try {
+          resolve(limitsOf(answer));
+        } catch (err) {
+          reject(err instanceof Error ? err : new Error(errMsg(err)));
+        }
+      });
+    };
+    child.stdout.on('data', (chunk: Buffer) => {
+      const lines = (carry + chunk.toString('utf8')).split('\n');
+      carry = lines.pop() ?? '';
+      if (carry.length > LINE_MAX) carry = '';
+      lines.forEach(take);
+    });
+    child.stdin.on('error', (err) => {
+      log.debug({ err: errMsg(err) }, 'claude-usage: Claude Code closed its input early');
+    });
+    child.on('error', (err) => {
+      clearTimeout(overdue);
+      settle(() => {
+        reject(err);
+      });
+    });
+    child.on('close', () => {
+      clearTimeout(overdue);
+      clearTimeout(hardKill);
+      take(carry);
+      settle(() => {
+        reject(new Error('Claude Code gave no usage answer'));
+      });
+    });
+    child.stdin.end(REQUEST);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -10,6 +10,7 @@ export const CODEX_ISSUER = 'https://auth.openai.com';
 export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
 const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
 const AUTH_CLAIM = 'https://api.openai.com/auth';
+const PROFILE_CLAIM = 'https://api.openai.com/profile';
 const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
 
 export interface CodexTokens {
@@ -76,7 +77,12 @@ function decodeJwtPayload(jwt: string): Record<string, unknown> {
 export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
   const payload = decodeJwtPayload(idToken);
   const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
-  return { accountId: nonEmpty(auth.chatgpt_account_id), email: nonEmpty(payload.email), plan: nonEmpty(auth.chatgpt_plan_type) };
+  const profile = isRecord(payload[PROFILE_CLAIM]) ? payload[PROFILE_CLAIM] : {};
+  return {
+    accountId: nonEmpty(auth.chatgpt_account_id),
+    email: nonEmpty(payload.email) ?? nonEmpty(profile.email),
+    plan: nonEmpty(auth.chatgpt_plan_type),
+  };
 }
 
 interface TokenResponse {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -8,11 +8,13 @@ import { ToolNames, toResponsesRequest } from './codex-translate.js';
 import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
 import { parseEvent, SseParser, type SseEvent } from './frames.js';
 import type { Connection } from './model-config.js';
+import { listCache } from './model-lists.js';
 import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
-import { noteUsageHeaders } from './usage.js';
+import { codexUsageBody, noteUsageHeaders, type Reported } from './usage.js';
 
 const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
 const INVALID = [400, 404, 422];
+const USAGE_TIMEOUT_MS = 10_000;
 
 export interface CodexDeps {
   base?: string;
@@ -25,6 +27,8 @@ export type CodexState = TokenState<CodexTokens>;
 
 export const sharedCodexState: CodexState = new Map();
 
+const codexLists = listCache<string>('codex');
+
 const sourceOf = (deps: CodexDeps): TokenSource<CodexTokens> => ({
   label: 'Codex',
   stale: (tokens) => tokensStale(tokens),
@@ -107,10 +111,33 @@ export async function codexMessages(
   answerWhole(res, frames + translator.close(), conn.id);
 }
 
+const jsonHeaders = (tokens: CodexTokens): Record<string, string> => ({ ...headersFor(tokens, randomUUID()), accept: 'application/json' });
+
+export const codexUsageUrl = (base = CODEX_BASE): string => `${base.replace(/\/codex\/?$/, '')}/wham/usage`;
+
+export async function codexUsageNow(conn: Connection, deps: CodexDeps, state: CodexState): Promise<Reported | null> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const res = await reach(
+    () => currentTokens(conn, deps, state),
+    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
+    (tokens) => fetchImpl(codexUsageUrl(deps.base), { headers: jsonHeaders(tokens), redirect: 'manual', signal: AbortSignal.timeout(USAGE_TIMEOUT_MS) }),
+  );
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not report its usage (${String(res.status)})`);
+  }
+  return codexUsageBody(await res.json());
+}
+
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
   const version = await learnCodexVersion();
-  const res = await (deps.fetchImpl ?? fetch)(`${deps.base ?? CODEX_BASE}/models?client_version=${version}`, {
-    headers: { ...headersFor(tokens, randomUUID()), accept: 'application/json' },
+  const base = deps.base ?? CODEX_BASE;
+  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, version, base, deps.fetchImpl ?? fetch));
+}
+
+async function listCodex(tokens: CodexTokens, version: string, base: string, fetchImpl: typeof fetch): Promise<string[]> {
+  const res = await fetchImpl(`${base}/models?client_version=${version}`, {
+    headers: jsonHeaders(tokens),
     redirect: 'manual',
   });
   if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not list models (${String(res.status)})`);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effort.ts

@@ -64,12 +64,28 @@ export function effortToApply(body: Body): string | null {
 export const cappedEffort = (effort: string): string => (ABOVE_HIGH.has(effort) ? 'high' : effort);
 
 const THINKING_ALWAYS_ON = /claude-(fable|mythos)-5|claude-opus-5-5/;
+const REFUSES_THINKING_OFF = '"thinking.type.disabled" is not supported';
+const thinkingAlwaysOn = new Set<string>();
+
+export const thinkingOff = (body: Body): boolean => record(body.thinking).type === 'disabled';
+
+const alwaysThinks = (model: string): boolean => THINKING_ALWAYS_ON.test(model) || thinkingAlwaysOn.has(model);
 
 export function withThinkingFor(body: Body, model: string): Body {
-  if (!THINKING_ALWAYS_ON.test(model) || record(body.thinking).type !== 'disabled') return body;
+  if (!alwaysThinks(model) || !thinkingOff(body)) return body;
   return Object.fromEntries(Object.entries(body).filter(([key]) => key !== 'thinking'));
 }
 
+export function learnAlwaysThinks(model: string, refusal: string): boolean {
+  if (!refusal.includes(REFUSES_THINKING_OFF)) return false;
+  thinkingAlwaysOn.add(model);
+  return true;
+}
+
+export function forgetLearnedThinking(): void {
+  thinkingAlwaysOn.clear();
+}
+
 export function withBlockBinding(body: Body): Body {
   const thinking = body.thinking;
   if (!isRecord(thinking) || thinking.block_binding !== undefined) return body;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -9,9 +9,20 @@ import {
   freshAdaptations,
   type Adaptations,
 } from './bedrock.js';
-import { addBeta, anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
-import { BINDING_BETA, cappedEffort, effortToApply, plannedEffort, withBlockBinding, withEffort, withThinkingFor } from './effort.js';
-import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
+import { addBeta, anthropicHeaders, forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, upstreamMessage, watchUpstream } from './forward.js';
+import {
+  BINDING_BETA,
+  cappedEffort,
+  effortToApply,
+  forgetLearnedThinking,
+  learnAlwaysThinks,
+  plannedEffort,
+  thinkingOff,
+  withBlockBinding,
+  withEffort,
+  withThinkingFor,
+} from './effort.js';
+import { notReady, PASSTHROUGH_ID, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
 import { codexMessages, sharedCodexState } from './codex.js';
 import { geminiMessages, sharedGeminiState } from './gemini.js';
 import { countTokens } from './subscription.js';
@@ -23,10 +34,10 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { forgetServed, noteServed } from './served.js';
 import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
 import { fitToolSearch } from './tool-search.js';
+import { ANTHROPIC_API, refreshLoginModels } from './provider-models.js';
 import type { CodexTokens } from './codex-auth.js';
 
 const GATEWAY_PREFIX = '/gateway';
-const ANTHROPIC_BASE = 'https://api.anthropic.com';
 const MESSAGES = '/v1/messages';
 const COUNT = '/v1/messages/count_tokens';
 const MODELS = '/v1/models';
@@ -49,6 +60,7 @@ export function resetGatewayState(): void {
   forgetUsage();
   learned.fields.clear();
   learned.dropBetas = false;
+  forgetLearnedThinking();
   sharedCodexState.clear();
   sharedGeminiState.clear();
 }
@@ -75,7 +87,7 @@ function modelsBody(cfg: ModelConfig): Record<string, unknown> {
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
-const PASSTHROUGH: Connection = { id: 'passthrough', provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
+const PASSTHROUGH: Connection = { id: PASSTHROUGH_ID, provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
 
 const passthrough = (body: Record<string, unknown>): Route => ({ connection: PASSTHROUGH, model: requestedModel(body) });
 
@@ -97,8 +109,9 @@ interface Payloads {
 }
 
 function anthropicPayloads(raw: Buffer, sent: Record<string, unknown>, shaped: Record<string, unknown>, model: string): Payloads {
-  const rewrite = typeof sent.model === 'string' && sent.model !== model;
-  const asSent = rewrite ? Buffer.from(JSON.stringify({ ...sent, model })) : raw;
+  const runnable = withThinkingFor(sent, model);
+  const rewrite = runnable !== sent || (typeof sent.model === 'string' && sent.model !== model);
+  const asSent = rewrite ? Buffer.from(JSON.stringify({ ...runnable, model })) : raw;
   const bound = withBlockBinding(withThinkingFor(shaped, model));
   if (bound === sent) return { metro: asSent, asSent: null, bound: false };
   return { metro: Buffer.from(JSON.stringify(rewrite ? { ...bound, model } : bound)), asSent, bound: bound !== shaped };
@@ -115,6 +128,20 @@ async function asAnthropicWants(send: Send, base: Record<string, string>, payloa
   return send(asSent, base);
 }
 
+async function refusedThinkingOff(upstream: Response, shaped: Record<string, unknown>, model: string): Promise<boolean> {
+  if (upstream.status !== 400 || !thinkingOff(shaped)) return false;
+  if (!learnAlwaysThinks(model, upstreamMessage(await upstream.clone().text(), ''))) return false;
+  await upstream.body?.cancel();
+  log.info({ model }, 'gateway: this model cannot run with thinking off, so metro leaves that setting out for it from now on');
+  return true;
+}
+
+function listLoginModels(req: IncomingMessage, anthropicBase: string): void {
+  refreshLoginModels(req.headers, anthropicBase).catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'gateway: could not list the models of the Claude Code login');
+  });
+}
+
 async function toAnthropic(
   req: IncomingMessage,
   res: ServerResponse,
@@ -125,7 +152,8 @@ async function toAnthropic(
   deps: GatewayDeps,
 ): Promise<void> {
   const conn = route.connection;
-  const url = `${deps.anthropicBase ?? ANTHROPIC_BASE}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
+  const anthropicBase = deps.anthropicBase ?? ANTHROPIC_API;
+  const url = `${anthropicBase}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
   const key = conn.apiKey;
   if (key === '' && standsInFor(req))
     throw new GatewayError(
@@ -134,10 +162,13 @@ async function toAnthropic(
       'Claude Code on this machine has no Anthropic login of its own; choose Bedrock, OpenRouter, Codex or Gemini on the Model page, or sign in on the Claude tab',
     );
   const watch = watchUpstream(res);
+  if (key === '') listLoginModels(req, anthropicBase);
   const base = key === '' ? forwardedHeaders(req) : anthropicHeaders(req, key);
   const send = (payload: Buffer, headers: Record<string, string>): Promise<Response> =>
     fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
-  const upstream = await asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
+  const attempt = (): Promise<Response> => asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
+  const first = await attempt();
+  const upstream = (await refusedThinkingOff(first, shaped, route.model)) ? await attempt() : first;
   noteRefusal(conn.label, route.model, upstream);
   noteUsageHeaders('anthropic', conn.id, upstream.headers);
   const scanner = new UsageScanner(conn.id);
@@ -177,8 +208,6 @@ async function toOpenRouter(
   await pipeResponse(upstream, res, watch, { keepalive: true, ownCredential: true, scanner: new UsageScanner(conn.id) });
 }
 
-const thinkingOff = (body: Record<string, unknown>): boolean => isRecord(body.thinking) && body.thinking.type === 'disabled';
-
 function openrouterBody(body: Record<string, unknown>, model: string, zdr: boolean): Record<string, unknown> {
   const sent: Record<string, unknown> = { ...body, model };
   if (thinkingOff(body)) delete sent.thinking;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -7,9 +7,10 @@ import { openrouterModels, openrouterZdrModels } from './openrouter.js';
 import { anthropicModels, bedrockModels } from './provider-models.js';
 import { routeOf, syncAvailableModelsQuietly } from '../claude/setup.js';
 import { sessionRunning, stopSession } from '../claude/session.js';
-import { forgetOne } from './usage.js';
+import { forgetOne, forgetReported } from './usage.js';
 import {
   addConnection,
+  connectionOf,
   parseModelConfig,
   readModelConfig,
   removeConnection,
@@ -19,7 +20,8 @@ import {
   type ModelConfig,
 } from './model-config.js';
 import { asApiError, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES, refreshUsage } from './model-signin.js';
+import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES } from './model-signin.js';
+import { refreshUsage } from './usage-refresh.js';
 
 const PATH = '/api/model';
 const CONNECTIONS = '/api/model/connections';
@@ -73,7 +75,9 @@ async function create(req: IncomingMessage, deps: ModelApiDeps, store: Store): P
 }
 
 async function change(req: IncomingMessage, deps: ModelApiDeps, store: Store, id: string): Promise<unknown> {
+  const before = connectionOf(store.read(), id)?.apiKey;
   const next = await withBody(req, (body) => updateConnection(store.read(), id, body));
+  if (connectionOf(next, id)?.apiKey !== before) forgetReported(id);
   return kept(store, next, deps, 'model-api: connection changed', { connection: id });
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,7 +3,7 @@ import { newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
-import type { CodexTokens } from './codex-auth.js';
+import { claimsOf, type CodexTokens } from './codex-auth.js';
 import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
@@ -189,6 +189,14 @@ export function resolveRoute(requested: string, cfg: ModelConfig): Route | null
 export const routeLabel = (route: Route): string =>
   route.connection.provider === 'anthropic' ? route.model : `${route.connection.provider}:${route.model}`;
 
+export const PASSTHROUGH_ID = 'passthrough';
+
+function signedInAs(c: Connection): { account: string | null; plan: string | null } {
+  if (c.codex === null) return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
+  const claims = claimsOf(c.codex.idToken);
+  return { account: c.codex.email ?? claims.email, plan: c.codex.plan ?? claims.plan };
+}
+
 function publicConnection(c: Connection): Record<string, unknown> {
   return {
     id: c.id,
@@ -199,8 +207,7 @@ function publicConnection(c: Connection): Record<string, unknown> {
     region: c.region,
     zdr: c.zdr,
     signedIn: c.codex !== null || c.gemini !== null,
-    account: c.codex?.email ?? c.gemini?.email ?? null,
-    plan: c.codex?.plan ?? c.gemini?.tier ?? null,
+    ...signedInAs(c),
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-lists.ts

@@ -0,0 +1,57 @@
+import { createHash } from 'node:crypto';
+import { errMsg, log } from '@metro-labs/core/log';
+
+export const LIST_TTL_MS = 60 * 60_000;
+export const RETRY_MS = 5 * 60_000;
+
+export interface ListCache<T> {
+  get: (key: string, load: () => Promise<T[]>) => Promise<T[]>;
+  peek: (key: string) => T[] | null;
+  refresh: (key: string, load: () => Promise<T[]>) => Promise<void>;
+}
+
+const clears = new Set<() => void>();
+
+export function listCache<T>(name: string, now: () => number = Date.now): ListCache<T> {
+  const kept = new Map<string, { at: number; list: T[] }>();
+  const tried = new Map<string, number>();
+  clears.add(() => {
+    kept.clear();
+    tried.clear();
+  });
+  const fresh = (key: string): boolean => {
+    const hit = kept.get(key);
+    return hit !== undefined && now() - hit.at < LIST_TTL_MS;
+  };
+  return {
+    async get(key, load) {
+      const hit = kept.get(key);
+      if (hit !== undefined && fresh(key)) return hit.list;
+      try {
+        const list = await load();
+        kept.set(key, { at: now(), list });
+        return list;
+      } catch (err) {
+        if (hit === undefined) throw err;
+        log.warn({ list: name, err: errMsg(err) }, 'model-lists: the provider would not list its models, so the last list it gave stands');
+        return hit.list;
+      }
+    },
+    peek: (key) => kept.get(key)?.list ?? null,
+    async refresh(key, load) {
+      if (fresh(key) || now() - (tried.get(key) ?? Number.NEGATIVE_INFINITY) < RETRY_MS) return;
+      tried.set(key, now());
+      try {
+        kept.set(key, { at: now(), list: await load() });
+      } catch (err) {
+        log.warn({ list: name, err: errMsg(err) }, 'model-lists: the provider would not list its models, so the last list it gave stands');
+      }
+    },
+  };
+}
+
+export function forgetModelLists(): void {
+  for (const clear of clears) clear();
+}
+
+export const fingerprint = (...parts: string[]): string => createHash('sha256').update(parts.join('\n')).digest('hex').slice(0, 16);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -2,16 +2,15 @@ import type { IncomingMessage } from 'node:http';
 import { ApiError } from '@metro-labs/http/api-error';
 import { readJsonBody } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
+import { log } from '@metro-labs/core/log';
 import { beginLogin, finishLogin, readCodexCliAuth, type CodexTokens } from './codex-auth.js';
 import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
 import { codexModels, currentTokens, sharedCodexState } from './codex.js';
 import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
 import { onboard, parseGeminiProject } from './gemini-setup.js';
 import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
-import { openrouterCredits } from './openrouter.js';
-import { lastServed } from './served.js';
-import { geminiUsage, noteUsage, openrouterUsage, usageOf } from './usage.js';
+import { listCache } from './model-lists.js';
+import { forgetReported } from './usage.js';
 import {
   addConnection,
   connectionOf,
@@ -21,8 +20,7 @@ import {
   type ModelConfig,
   type Provider,
 } from './model-config.js';
-import { asApiError, askedConnection, BODY_MAX, connectionFor, CREDITS_TTL_MS, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-
+import { asApiError, askedConnection, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
 
 function connectionToFill(store: Store, req: IncomingMessage, provider: Provider): { cfg: ModelConfig; id: string } {
   const asked = askedConnection(req);
@@ -35,8 +33,9 @@ function connectionToFill(store: Store, req: IncomingMessage, provider: Provider
   return { cfg, id: cfg.connections.at(-1)?.id ?? '' };
 }
 
-const saved = (store: Store, cfg: ModelConfig, note: string, fields: Record<string, unknown>): unknown => {
+const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connection: string } & Record<string, unknown>): unknown => {
   store.write(cfg);
+  forgetReported(fields.connection);
   log.info(fields, note);
   return settingsBody(cfg);
 };
@@ -53,7 +52,7 @@ async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps,
   return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected by device code') };
 }
 
-const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
+export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
   issuer: deps.issuer,
   fetchImpl: deps.fetchImpl,
   base: deps.codexBase,
@@ -113,7 +112,7 @@ const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
   },
 });
 
-async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
+export async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
   if (conn.gemini === null) throw new ApiError('this connection is not signed in yet', 400);
   const tokens = await currentGeminiTokens(conn, geminiDeps(deps, store), sharedGeminiState);
   return listGeminiModels(tokens, geminiDeps(deps, store));
@@ -140,54 +139,23 @@ async function connectGemini(req: IncomingMessage, deps: ModelApiDeps, store: St
   return saved(store, setGeminiAuth(cfg, id, full), 'model-api: Gemini connected', { connection: id, tier: onboarded.tier });
 }
 
+const geminiLists = listCache<string>('gemini');
+
+async function geminiIds(req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<string[]> {
+  const conn = connectionFor(store.read(), req, 'gemini');
+  const key = `${deps.geminiBase ?? ''}:${conn.id}:${conn.gemini?.email ?? ''}:${conn.gemini?.project ?? ''}`;
+  return geminiLists.get(key, async () => (await geminiModelsOf(conn, deps, store)).map((m) => m.id));
+}
+
 export const GEMINI_ROUTES: Record<string, Route> = {
   login: { method: 'POST', run: (_req, deps) => Promise.resolve(beginGeminiLogin(deps.geminiAuthBase)) },
   code: { method: 'POST', run: connectGemini },
   models: {
     method: 'GET',
-    run: async (req, deps, store) => ({ models: (await geminiModelsOf(connectionFor(store.read(), req, 'gemini'), deps, store).catch(asApiError)).map((m) => m.id) }),
+    run: async (req, deps, store) => ({ models: await geminiIds(req, deps, store).catch(asApiError) }),
   },
 };
 
 export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
   return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
 }
-
-async function refreshOne(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
-  if (conn.apiKey === '') return;
-  const seen = usageOf(conn.id);
-  if (seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
-  try {
-    const credits = await openrouterCredits(conn.apiKey, deps.openrouterBase, deps.fetchImpl);
-    noteUsage(conn.id, openrouterUsage(credits.total, credits.spent, new Date(now)));
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'model-api: could not read the OpenRouter credits');
-  }
-}
-
-const modelsInUse = (conn: Connection): Set<string> => {
-  const served = lastServed();
-  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
-};
-
-async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
-  if (conn.gemini === null) return;
-  const inUse = modelsInUse(conn);
-  const seen = usageOf(conn.id);
-  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
-  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
-  try {
-    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
-    const usage = geminiUsage(rows, new Date(now));
-    if (usage !== null) noteUsage(conn.id, usage);
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'model-api: could not read the Gemini quota');
-  }
-}
-
-export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
-  for (const conn of store.read().connections) {
-    if (conn.provider === 'openrouter') await refreshOne(conn, deps, now);
-    if (conn.provider === 'gemini') await refreshQuota(conn, deps, store, now);
-  }
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -24,6 +24,8 @@ export interface ModelApiDeps {
   bedrockControlBase?: string;
   setup?: SetupDeps;
   restartSession?: () => boolean;
+  claudeUsage?: () => Promise<unknown>;
+  usageWaitMs?: number;
 }
 
 export interface Store {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -1,9 +1,12 @@
 import { isRecord } from '@metro-labs/core/is-record';
 import { GatewayError } from './forward.js';
+import { listCache } from './model-lists.js';
 import { stringOf } from '@metro-labs/http/api-http';
+import type { KeySpend } from './usage.js';
 
 export const OPENROUTER_BASE = 'https://openrouter.ai/api';
 const MODELS_MAX = 2000;
+const KEY_TIMEOUT_MS = 10_000;
 
 export interface OpenRouterModel {
   id: string;
@@ -13,6 +16,8 @@ export interface OpenRouterModel {
   created: number | null;
 }
 
+const modelLists = listCache<OpenRouterModel>('openrouter');
+const zdrLists = listCache<string>('openrouter-zdr');
 
 function price(raw: unknown): number | null {
   const value = typeof raw === 'string' ? Number(raw) : typeof raw === 'number' ? raw : Number.NaN;
@@ -23,8 +28,16 @@ function released(raw: unknown): number | null {
   return typeof raw === 'number' && Number.isFinite(raw) && raw > 0 ? raw : null;
 }
 
+const strings = (value: unknown): string[] | null => (Array.isArray(value) ? value.filter((v): v is string => typeof v === 'string') : null);
+
+function chatCapable(entry: Record<string, unknown>): boolean {
+  const output = strings(isRecord(entry.architecture) ? entry.architecture.output_modalities : undefined);
+  const params = strings(entry.supported_parameters);
+  return (output === null || output.includes('text')) && (params === null || params.includes('tools'));
+}
+
 function modelOf(entry: unknown): OpenRouterModel | null {
-  if (!isRecord(entry)) return null;
+  if (!isRecord(entry) || !chatCapable(entry)) return null;
   const id = stringOf(entry.id);
   if (id === '') return null;
   const pricing = isRecord(entry.pricing) ? entry.pricing : {};
@@ -42,7 +55,7 @@ function newestFirst(a: OpenRouterModel, b: OpenRouterModel): number {
   return when !== 0 ? when : a.id.localeCompare(b.id);
 }
 
-export async function openrouterModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> {
+async function listModels(base: string, fetchImpl: typeof fetch): Promise<OpenRouterModel[]> {
   const res = await fetchImpl(`${base}/v1/models`, { headers: { accept: 'application/json' }, redirect: 'manual' });
   if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its models (${String(res.status)})`);
   const body: unknown = await res.json();
@@ -55,30 +68,29 @@ export async function openrouterModels(base = OPENROUTER_BASE, fetchImpl: typeof
     .slice(0, MODELS_MAX);
 }
 
-export interface OpenRouterCredits {
-  total: number;
-  spent: number;
-}
+export const openrouterModels = (base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> =>
+  modelLists.get(base, () => listModels(base, fetchImpl));
+
+const nullableAmount = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
 
-export async function openrouterCredits(
-  apiKey: string,
-  base = OPENROUTER_BASE,
-  fetchImpl: typeof fetch = fetch,
-): Promise<OpenRouterCredits> {
-  const res = await fetchImpl(`${base}/v1/credits`, {
+export async function openrouterKey(apiKey: string, base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<KeySpend> {
+  const res = await fetchImpl(`${base}/v1/key`, {
     headers: { accept: 'application/json', authorization: `Bearer ${apiKey}` },
     redirect: 'manual',
+    signal: AbortSignal.timeout(KEY_TIMEOUT_MS),
   });
-  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not report the credits (${String(res.status)})`);
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, 'api_error', `OpenRouter would not describe the stored key (${String(res.status)})`);
+  }
   const body: unknown = await res.json();
   const data = isRecord(body) && isRecord(body.data) ? body.data : {};
-  const total = Number(data.total_credits);
-  const spent = Number(data.total_usage);
-  if (!Number.isFinite(total) || !Number.isFinite(spent)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no credit figures');
-  return { total, spent };
+  const spent = nullableAmount(data.usage);
+  if (spent === null) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no spend for the key');
+  return { limit: nullableAmount(data.limit), remaining: nullableAmount(data.limit_remaining), spent };
 }
 
-export async function openrouterZdrModels(base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<string[]> {
+async function listZdr(base: string, fetchImpl: typeof fetch): Promise<string[]> {
   const res = await fetchImpl(`${base}/v1/endpoints/zdr`, { headers: { accept: 'application/json' }, redirect: 'manual' });
   if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not list its zero data retention endpoints (${String(res.status)})`);
   const body: unknown = await res.json();
@@ -88,3 +100,5 @@ export async function openrouterZdrModels(base = OPENROUTER_BASE, fetchImpl: typ
   for (const entry of data) if (isRecord(entry) && stringOf(entry.model_id) !== '') ids.add(stringOf(entry.model_id));
   return [...ids].sort();
 }
+
+export const openrouterZdrModels = (base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<string[]> => zdrLists.get(base, () => listZdr(base, fetchImpl));

package/runtime/node_modules/@metro-labs/daemon/src/gateway/provider-models.ts

@@ -1,49 +1,102 @@
+import type { IncomingHttpHeaders } from 'node:http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { GatewayError } from './forward.js';
 import type { Connection } from './model-config.js';
+import { fingerprint, listCache } from './model-lists.js';
 import { stringOf } from '@metro-labs/http/api-http';
 
-const ANTHROPIC_API = 'https://api.anthropic.com';
+export const ANTHROPIC_API = 'https://api.anthropic.com';
 const ANTHROPIC_VERSION = '2023-06-01';
 const LIST_MAX = 1000;
+const LIST_TIMEOUT_MS = 10_000;
+const OAUTH_BETA = 'oauth-2025-04-20';
+const BEARER = 'Bearer ';
 
 export interface ProviderModel {
   id: string;
   name: string;
 }
 
+interface Dated extends ProviderModel {
+  created: string;
+}
+
 const KNOWN_CLAUDE: ProviderModel[] = [
-  { id: 'claude-fable-5-1', name: 'Claude Fable 5.1' },
+  { id: 'claude-sonnet-5-5', name: 'Claude Sonnet 5.5' },
   { id: 'claude-opus-5-5', name: 'Claude Opus 5.5' },
+  { id: 'claude-fable-5-1', name: 'Claude Fable 5.1' },
   { id: 'claude-opus-5', name: 'Claude Opus 5' },
   { id: 'claude-sonnet-5', name: 'Claude Sonnet 5' },
   { id: 'claude-haiku-4-5', name: 'Claude Haiku 4.5' },
 ];
 
+const claudeLists = listCache<ProviderModel>('anthropic');
+const bedrockLists = listCache<ProviderModel>('bedrock');
 
-export async function anthropicModels(settings: Connection, base = ANTHROPIC_API, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
-  if (settings.apiKey === '') return KNOWN_CLAUDE;
+const newestFirst = (list: Dated[]): ProviderModel[] =>
+  list.sort((a, b) => b.created.localeCompare(a.created) || a.id.localeCompare(b.id)).map(({ id, name }) => ({ id, name }));
+
+function claudeEntry(entry: unknown): Dated[] {
+  if (!isRecord(entry) || stringOf(entry.id) === '') return [];
+  const type = stringOf(entry.type);
+  if (type !== '' && type !== 'model') return [];
+  const id = stringOf(entry.id);
+  return [{ id, name: stringOf(entry.display_name) || id, created: stringOf(entry.created_at) }];
+}
+
+async function listClaude(auth: Record<string, string>, what: string, base: string, fetchImpl: typeof fetch): Promise<ProviderModel[]> {
   const res = await fetchImpl(`${base}/v1/models?limit=${String(LIST_MAX)}`, {
-    headers: { 'x-api-key': settings.apiKey, 'anthropic-version': ANTHROPIC_VERSION, accept: 'application/json' },
+    headers: { ...auth, 'anthropic-version': ANTHROPIC_VERSION, accept: 'application/json' },
     redirect: 'manual',
+    signal: AbortSignal.timeout(LIST_TIMEOUT_MS),
   });
-  if (!res.ok) throw new GatewayError(res.status, 'api_error', `Anthropic would not list its models with the stored key (${String(res.status)})`);
+  if (!res.ok) throw new GatewayError(res.status, 'api_error', `Anthropic would not list its models with ${what} (${String(res.status)})`);
   const body: unknown = await res.json();
   const data = isRecord(body) && Array.isArray(body.data) ? body.data : null;
   if (data === null) throw new GatewayError(502, 'api_error', 'Anthropic answered with no model list');
-  return data
-    .flatMap((entry) => (isRecord(entry) && stringOf(entry.id) !== '' ? [{ id: stringOf(entry.id), name: stringOf(entry.display_name) || stringOf(entry.id) }] : []))
-    .sort((a, b) => a.id.localeCompare(b.id));
+  return newestFirst(data.flatMap(claudeEntry));
+}
+
+const loginKey = (base: string): string => `login:${base}`;
+
+const first = (value: string | string[] | undefined): string => (Array.isArray(value) ? value[0] : value)?.trim() ?? '';
+
+function loginAuth(headers: IncomingHttpHeaders): Record<string, string> | null {
+  const bearer = first(headers.authorization);
+  if (bearer.startsWith(BEARER) && bearer.length > BEARER.length) return { authorization: bearer, 'anthropic-beta': OAUTH_BETA };
+  const key = first(headers['x-api-key']);
+  return key === '' ? null : { 'x-api-key': key };
+}
+
+export function refreshLoginModels(headers: IncomingHttpHeaders, base = ANTHROPIC_API, fetchImpl: typeof fetch = fetch): Promise<void> {
+  const auth = loginAuth(headers);
+  if (auth === null) return Promise.resolve();
+  return claudeLists.refresh(loginKey(base), () => listClaude(auth, 'the Claude Code login', base, fetchImpl));
+}
+
+export async function anthropicModels(settings: Connection, base = ANTHROPIC_API, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
+  if (settings.apiKey === '') {
+    const live = claudeLists.peek(loginKey(base)) ?? [];
+    return live.length > 0 ? live : KNOWN_CLAUDE;
+  }
+  return claudeLists.get(`key:${base}:${fingerprint(settings.apiKey)}`, () => listClaude({ 'x-api-key': settings.apiKey }, 'the stored key', base, fetchImpl));
 }
 
 export const bedrockControlBase = (region: string): string => `https://bedrock.${region}.amazonaws.com`;
 
-export async function bedrockModels(settings: Connection, base?: string, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
-  if (settings.region === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs a region before its models can be listed');
-  if (settings.apiKey === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key before its models can be listed');
-  const res = await fetchImpl(`${base ?? bedrockControlBase(settings.region)}/inference-profiles?maxResults=${String(LIST_MAX)}`, {
+function bedrockEntry(entry: unknown): Dated[] {
+  if (!isRecord(entry)) return [];
+  const id = stringOf(entry.inferenceProfileId);
+  const status = stringOf(entry.status);
+  if (id === '' || !id.includes('anthropic') || (status !== '' && status !== 'ACTIVE')) return [];
+  return [{ id, name: stringOf(entry.inferenceProfileName) || id, created: stringOf(entry.createdAt) }];
+}
+
+async function listBedrock(settings: Connection, base: string, fetchImpl: typeof fetch): Promise<ProviderModel[]> {
+  const res = await fetchImpl(`${base}/inference-profiles?maxResults=${String(LIST_MAX)}`, {
     headers: { authorization: `Bearer ${settings.apiKey}`, accept: 'application/json' },
     redirect: 'manual',
+    signal: AbortSignal.timeout(LIST_TIMEOUT_MS),
   });
   if (!res.ok)
     throw new GatewayError(
@@ -54,13 +107,12 @@ export async function bedrockModels(settings: Connection, base?: string, fetchIm
   const body: unknown = await res.json();
   const list = isRecord(body) && Array.isArray(body.inferenceProfileSummaries) ? body.inferenceProfileSummaries : null;
   if (list === null) throw new GatewayError(502, 'api_error', 'Bedrock answered with no inference profile list');
-  return list
-    .flatMap((entry) => {
-      if (!isRecord(entry)) return [];
-      const id = stringOf(entry.inferenceProfileId);
-      const status = stringOf(entry.status);
-      if (id === '' || !id.includes('anthropic') || (status !== '' && status !== 'ACTIVE')) return [];
-      return [{ id, name: stringOf(entry.inferenceProfileName) || id }];
-    })
-    .sort((a, b) => a.id.localeCompare(b.id));
+  return newestFirst(list.flatMap(bedrockEntry));
+}
+
+export async function bedrockModels(settings: Connection, base?: string, fetchImpl: typeof fetch = fetch): Promise<ProviderModel[]> {
+  if (settings.region === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs a region before its models can be listed');
+  if (settings.apiKey === '') throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key before its models can be listed');
+  const from = base ?? bedrockControlBase(settings.region);
+  return bedrockLists.get(`${from}:${fingerprint(settings.apiKey)}`, () => listBedrock(settings, from, fetchImpl));
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage-refresh.ts

@@ -0,0 +1,102 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { readClaudeUsage } from '../claude/usage-probe.js';
+import { codexUsageNow, sharedCodexState } from './codex.js';
+import { openrouterKey } from './openrouter.js';
+import { lastServed } from './served.js';
+import { claudeLoginUsage, geminiUsage, keepProbeAnswer, mayProbe, noteUsage, openrouterUsage, probeAnswer, usageOf, type Reported } from './usage.js';
+import { PASSTHROUGH_ID, routedConnection, type Connection, type ModelConfig } from './model-config.js';
+import { codexDepsFor, geminiModelsOf } from './model-signin.js';
+import { CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
+
+const WAIT_MS = 4_000;
+const LOGIN_PROBE = 'claude-login';
+
+const fresh = (id: string, now: number): boolean => {
+  const seen = usageOf(id);
+  return seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS;
+};
+
+const due = (id: string, now: number): boolean => !fresh(id, now) && mayProbe(id, now, CREDITS_TTL_MS);
+
+async function probe(what: string, run: () => Promise<void>): Promise<void> {
+  try {
+    await run();
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, `model-api: could not read the ${what}`);
+  }
+}
+
+async function refreshKey(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
+  if (conn.apiKey === '' || !due(conn.id, now)) return;
+  await probe('OpenRouter key spend', async () => {
+    noteUsage(conn.id, openrouterUsage(await openrouterKey(conn.apiKey, deps.openrouterBase, deps.fetchImpl), new Date(now)));
+  });
+}
+
+async function refreshCodex(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.codex === null || !due(conn.id, now)) return;
+  await probe('Codex usage', async () => {
+    const usage = await codexUsageNow(conn, codexDepsFor(deps, store, conn.id), sharedCodexState);
+    if (usage !== null) noteUsage(conn.id, usage);
+  });
+}
+
+const modelsInUse = (conn: Connection): Set<string> => {
+  const served = lastServed();
+  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
+};
+
+async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.gemini === null) return;
+  const inUse = modelsInUse(conn);
+  const seen = usageOf(conn.id);
+  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
+  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
+  await probe('Gemini quota', async () => {
+    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
+    const usage = geminiUsage(rows, new Date(now));
+    if (usage !== null) noteUsage(conn.id, usage);
+  });
+}
+
+const loginIds = (cfg: ModelConfig): string[] => [
+  ...(routedConnection(cfg) === null ? [PASSTHROUGH_ID] : []),
+  ...cfg.connections.filter((c) => c.provider === 'anthropic' && c.apiKey === '').map((c) => c.id),
+];
+
+const olderThan = (seen: Reported | undefined, usage: Reported): boolean => seen === undefined || Date.parse(seen.at) < Date.parse(usage.at);
+
+async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number): Promise<void> {
+  const stale = loginIds(cfg).filter((id) => !fresh(id, now));
+  if (stale.length === 0) return;
+  if (mayProbe(LOGIN_PROBE, now, CREDITS_TTL_MS))
+    await probe('usage of the Claude Code login', async () => {
+      const usage = claudeLoginUsage(await (deps.claudeUsage ?? readClaudeUsage)(), new Date(now));
+      if (usage !== null) keepProbeAnswer(LOGIN_PROBE, usage);
+    });
+  const usage = probeAnswer(LOGIN_PROBE);
+  if (usage === undefined || now - Date.parse(usage.at) >= CREDITS_TTL_MS) return;
+  for (const id of stale) if (olderThan(usageOf(id), usage)) noteUsage(id, usage);
+}
+
+function refreshOne(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.provider === 'openrouter') return refreshKey(conn, deps, now);
+  if (conn.provider === 'codex') return refreshCodex(conn, deps, store, now);
+  if (conn.provider === 'gemini') return refreshQuota(conn, deps, store, now);
+  return Promise.resolve();
+}
+
+async function within(ms: number, work: Promise<unknown>): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const waited = new Promise<void>((resolve) => {
+    timer = setTimeout(resolve, ms);
+  });
+  await Promise.race([work, waited]);
+  clearTimeout(timer);
+}
+
+export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
+  const cfg = store.read();
+  const work = Promise.all([...cfg.connections.map((conn) => refreshOne(conn, deps, store, now)), refreshLogin(cfg, deps, now)]);
+  await within(deps.usageWaitMs ?? WAIT_MS, work);
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -1,3 +1,6 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
+
 type Key = string;
 
 interface UsageWindow {
@@ -22,10 +25,12 @@ export interface ProviderUsage {
   tally: Tally | null;
 }
 
-type Reported = Omit<ProviderUsage, 'tally'>;
+export type Reported = Omit<ProviderUsage, 'tally'>;
 
 const latest = new Map<Key, Reported>();
 const tallies = new Map<Key, Tally>();
+const probed = new Map<Key, number>();
+const answers = new Map<Key, Reported>();
 
 export const noteUsage = (key: Key, usage: Reported): void => {
   latest.set(key, usage);
@@ -46,11 +51,31 @@ export const usageOf = (key: Key): Reported | undefined => latest.get(key);
 export const forgetOne = (key: Key): void => {
   latest.delete(key);
   tallies.delete(key);
+  probed.delete(key);
+};
+
+export const forgetReported = (key: Key): void => {
+  latest.delete(key);
+  probed.delete(key);
 };
 
 export const forgetUsage = (): void => {
   latest.clear();
   tallies.clear();
+  probed.clear();
+  answers.clear();
+};
+
+export function mayProbe(key: Key, now: number, every: number): boolean {
+  if (now - (probed.get(key) ?? Number.NEGATIVE_INFINITY) < every) return false;
+  probed.set(key, now);
+  return true;
+}
+
+export const probeAnswer = (key: Key): Reported | undefined => answers.get(key);
+
+export const keepProbeAnswer = (key: Key, usage: Reported): void => {
+  answers.set(key, usage);
 };
 
 export interface Counted {
@@ -198,13 +223,16 @@ function codexWindow(headers: Headers, kind: 'primary' | 'secondary', now: Date)
   return { label: windowLabel(Number.isFinite(minutes) ? minutes : null), used, resetAt, detail: null };
 }
 
-function codexCredits(headers: Headers): UsageWindow | null {
-  if (headers.get('x-codex-credits-has-credits') !== 'true') return null;
-  const balance = Number(headers.get('x-codex-credits-balance') ?? 'none');
+function creditsLeft(hasCredits: boolean, raw: string | null): UsageWindow | null {
+  if (!hasCredits) return null;
+  const balance = Number(raw ?? 'none');
   if (!Number.isFinite(balance)) return null;
   return { label: 'Credits', used: null, resetAt: null, detail: `${balance.toLocaleString('en-US')} left` };
 }
 
+const codexCredits = (headers: Headers): UsageWindow | null =>
+  creditsLeft(headers.get('x-codex-credits-has-credits') === 'true', headers.get('x-codex-credits-balance'));
+
 export function codexUsage(headers: Headers, now = new Date()): Reported | null {
   const windows = [codexWindow(headers, 'primary', now), codexWindow(headers, 'secondary', now), codexCredits(headers)].filter(
     (w): w is UsageWindow => w !== null,
@@ -214,6 +242,77 @@ export function codexUsage(headers: Headers, now = new Date()): Reported | null
   return { windows, note: reached === null || reached === '' ? null : reached.replaceAll('_', ' '), at: now.toISOString() };
 }
 
+const present = (w: UsageWindow | null): w is UsageWindow => w !== null;
+
+const textOf = (raw: unknown): string | null => (typeof raw === 'number' || typeof raw === 'string' ? String(raw) : null);
+
+const numberOf = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
+
+const SECONDS_PER_MINUTE = 60;
+
+function codexBodyWindow(raw: unknown, now: Date): UsageWindow | null {
+  if (!isRecord(raw)) return null;
+  const percent = numberOf(raw.used_percent);
+  if (percent === null) return null;
+  const seconds = numberOf(raw.limit_window_seconds);
+  const minutes = seconds === null || seconds <= 0 ? null : Math.ceil(seconds / SECONDS_PER_MINUTE);
+  const resetAt = whenFrom(textOf(raw.reset_at), now) ?? whenFrom(textOf(raw.reset_after_seconds), now, true);
+  return { label: windowLabel(minutes), used: clamp(percent / 100), resetAt, detail: null };
+}
+
+function codexWall(limit: Record<string, unknown>, reached: unknown): string | null {
+  if (limit.limit_reached !== true && limit.allowed !== false) return null;
+  const kind = isRecord(reached) ? stringOf(reached.type) : '';
+  return kind === '' ? 'limit reached' : kind.replaceAll('_', ' ');
+}
+
+export function codexUsageBody(body: unknown, now = new Date()): Reported | null {
+  if (!isRecord(body)) return null;
+  const limit = isRecord(body.rate_limit) ? body.rate_limit : {};
+  const credits = isRecord(body.credits) ? body.credits : {};
+  const windows = [
+    codexBodyWindow(limit.primary_window, now),
+    codexBodyWindow(limit.secondary_window, now),
+    creditsLeft(credits.has_credits === true, textOf(credits.balance)),
+  ].filter(present);
+  return windows.length === 0 ? null : { windows, note: codexWall(limit, body.rate_limit_reached_type), at: now.toISOString() };
+}
+
+const CLAUDE_WINDOWS: [string, string][] = [
+  ['five_hour', '5-hour window'],
+  ['seven_day', 'Weekly'],
+  ['seven_day_sonnet', 'Weekly, Sonnet'],
+  ['seven_day_opus', 'Weekly, Opus'],
+];
+
+function percentWindow(label: string, raw: unknown, now: Date): UsageWindow | null {
+  if (!isRecord(raw)) return null;
+  const percent = numberOf(raw.utilization) ?? numberOf(raw.percent);
+  if (percent === null) return null;
+  return { label, used: clamp(percent / 100), resetAt: whenFrom(textOf(raw.resets_at), now), detail: null };
+}
+
+function scopedName(entry: Record<string, unknown>): string {
+  if (stringOf(entry.display_name) !== '') return stringOf(entry.display_name);
+  if (entry.kind !== 'weekly_scoped' || !isRecord(entry.scope) || !isRecord(entry.scope.model)) return '';
+  return stringOf(entry.scope.model.display_name);
+}
+
+function scopedWindows(limits: Record<string, unknown>, now: Date): (UsageWindow | null)[] {
+  const listed = [limits.model_scoped, limits.limits].flatMap((list): unknown[] => (Array.isArray(list) ? (list as unknown[]) : []));
+  return listed.map((entry) => {
+    const name = isRecord(entry) ? scopedName(entry) : '';
+    return name === '' ? null : percentWindow(`Weekly, ${name}`, entry, now);
+  });
+}
+
+export function claudeLoginUsage(limits: unknown, now = new Date()): Reported | null {
+  if (!isRecord(limits)) return null;
+  const all = [...CLAUDE_WINDOWS.map(([key, label]) => percentWindow(label, limits[key], now)), ...scopedWindows(limits, now)].filter(present);
+  const windows = all.filter((w, index) => all.findIndex((other) => other.label === w.label) === index);
+  return windows.length === 0 ? null : { windows, note: null, at: now.toISOString() };
+}
+
 export function noteUsageHeaders(kind: 'anthropic' | 'codex', key: Key, headers: Headers, now = new Date()): void {
   const usage = kind === 'anthropic' ? anthropicUsage(headers, now) : codexUsage(headers, now);
   if (usage !== null) noteUsage(key, usage);
@@ -234,11 +333,16 @@ export function geminiUsage(rows: QuotaRow[], now = new Date()): Reported | null
   return windows.length === 0 ? null : { windows, note: null, at: now.toISOString() };
 }
 
-export function openrouterUsage(total: number, spent: number, now = new Date()): Reported {
-  const used = total > 0 ? clamp(spent / total) : null;
-  return {
-    windows: [{ label: 'Credits', used, resetAt: null, detail: `${dollars(spent)} of ${dollars(total)} used` }],
-    note: null,
-    at: now.toISOString(),
-  };
+export interface KeySpend {
+  limit: number | null;
+  remaining: number | null;
+  spent: number;
+}
+
+function keyWindow(key: KeySpend): UsageWindow {
+  if (key.limit === null || key.limit <= 0) return { label: 'Credits', used: null, resetAt: null, detail: `${dollars(key.spent)} used, no limit on this key` };
+  const spent = key.remaining === null ? key.spent : Math.max(0, key.limit - key.remaining);
+  return { label: 'Credits', used: clamp(spent / key.limit), resetAt: null, detail: `${dollars(spent)} of ${dollars(key.limit)} used` };
 }
+
+export const openrouterUsage = (key: KeySpend, now = new Date()): Reported => ({ windows: [keyWindow(key)], note: null, at: now.toISOString() });

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.220"
+  "version": "0.1.0-beta.222"
 }