@stage-labs/metro 0.1.0-beta.251 → 0.1.0-beta.253

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.251",
+  "version": "0.1.0-beta.253",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {
@@ -30,7 +30,7 @@
     "test": "tsc --noEmit && node scripts/stage-runtime.mjs && bun test test/"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.251",
+  "version": "0.1.0-beta.253",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/core/package.json

@@ -42,7 +42,7 @@
     "pino-pretty": "^13.1.3"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",

package/runtime/node_modules/@metro-labs/daemon/package.json

@@ -41,7 +41,7 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
+    "@stage-labs/config": "0.1.0-beta.3",
     "@types/ws": "^8.18.0",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -54,6 +54,7 @@ import type { StationName } from '@metro-labs/core/station-names';
 import { startUploadReaper } from '../files/upload-store.js';
 import { startAttachReaper } from '../files/attach-reaper.js';
 import { startCloudWatchPublisher } from '../server/cloudwatch.js';
+import { watchFallbackUsage } from '../gateway/usage-refresh.js';
 import { isCallEvent, leaveCallsForShutdown, onCallEvent, sweepLeftoverCalls } from '../voice/calls.js';
 
 installCrashGuard();
@@ -153,6 +154,7 @@ installBearerSessions(agentsDir(), localOwner);
   startUploadReaper();
   startAttachReaper();
   startCloudWatchPublisher();
+  watchFallbackUsage();
   announceLocalEndpoint();
   tunnel?.start();
   log.info(

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -19,7 +19,9 @@ import {
   endClaudeLogin,
   startClaudeLogin,
   type LoginDeps,
+  type LoginTarget,
 } from './login.js';
+import { claudeLoginTarget, type ClaudeLoginDeps } from '../gateway/claude-logins.js';
 import {
   claudeSetupStatus,
   ensureClaudeSetup,
@@ -71,6 +73,7 @@ const PAGE_MAX = 500;
 export interface ClaudeApiDeps {
   dir?: () => string;
   login?: LoginDeps;
+  claudeLogins?: ClaudeLoginDeps;
   session?: SessionDeps;
   setup?: SetupDeps;
   version?: VersionDeps;
@@ -265,10 +268,15 @@ async function sessionAnswer(req: IncomingMessage, deps: ClaudeApiDeps): Promise
   return sessionCommand(body, session);
 }
 
+function loginTarget(req: IncomingMessage, deps: ClaudeApiDeps): LoginTarget | null {
+  const asked = new URL(req.url ?? '', 'http://metro').searchParams.get('connection');
+  return asked === null ? null : claudeLoginTarget(asked, deps.claudeLogins);
+}
+
 async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
   const method = req.method ?? 'GET';
   if (id === '') {
-    if (method === 'POST') return startClaudeLogin(deps.login);
+    if (method === 'POST') return startClaudeLogin(deps.login, Date.now(), loginTarget(req, deps));
     if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
     throw new ApiError('method not allowed', 405);
   }

package/runtime/node_modules/@metro-labs/daemon/src/claude/login.ts

@@ -26,12 +26,19 @@ export interface LoginView {
   error: string | null;
 }
 
+export interface LoginTarget {
+  key: string;
+  env: Record<string, string>;
+  settle: (ok: boolean) => Promise<string | null>;
+}
+
 interface Live {
   id: string;
   startedAt: number;
   state: LoginState;
   output: string;
   error: string | null;
+  target: LoginTarget | null;
   write: (text: string) => void;
   kill: () => void;
 }
@@ -102,27 +109,32 @@ export function claudeInstalled(): boolean {
   });
 }
 
-interface ClaudeAccount {
+export interface ClaudeAccount {
   signedIn: boolean;
   account: string | null;
+  plan: string | null;
 }
 
+const SIGNED_OUT: ClaudeAccount = { signedIn: false, account: null, plan: null };
+
 export function claudeAccount(): ClaudeAccount {
-  return remembered(checks.account, readAccount, (c) => {
+  return remembered(checks.account, () => claudeAccountIn({}), (c) => {
     checks.account = c;
   });
 }
 
-function readAccount(): ClaudeAccount {
-  const run = spawnSync(...asAgent(claudeBin(), STATUS_COMMAND), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
-  if (run.error !== undefined || typeof run.stdout !== 'string') return { signedIn: false, account: null };
+const textOf = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claudeAccountIn(env: Record<string, string>): ClaudeAccount {
+  const run = spawnSync(...asAgent(claudeBin(), STATUS_COMMAND, env), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, ...env } });
+  if (run.error !== undefined || typeof run.stdout !== 'string') return SIGNED_OUT;
   try {
     const parsed: unknown = JSON.parse(run.stdout);
-    if (!isRecord(parsed)) return { signedIn: false, account: null };
-    const account = typeof parsed.email === 'string' ? parsed.email : typeof parsed.organization === 'string' ? parsed.organization : null;
-    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account };
+    if (!isRecord(parsed)) return SIGNED_OUT;
+    const account = textOf(parsed.email) ?? textOf(parsed.organization) ?? textOf(parsed.orgName);
+    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account, plan: textOf(parsed.subscriptionType) };
   } catch {
-    return { signedIn: false, account: null };
+    return SIGNED_OUT;
   }
 }
 
@@ -131,16 +143,37 @@ function note(session: Live, chunk: string): void {
   session.output = next.length > OUTPUT_MAX ? next.slice(next.length - OUTPUT_MAX) : next;
 }
 
-export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginView {
+async function verdict(session: Live, code: number): Promise<string | null> {
+  const problem = code === 0 ? null : `the login ended with status ${String(code)}`;
+  if (session.target === null) return problem;
+  try {
+    return (await session.target.settle(problem === null)) ?? problem;
+  } catch (err) {
+    return errMsg(err);
+  }
+}
+
+function runningFor(target: LoginTarget | null): Live | null {
+  if (live === null || live.state !== 'pending') return null;
+  if (live.target?.key === target?.key) return live;
+  live.kill();
+  live = null;
+  return null;
+}
+
+export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now(), target: LoginTarget | null = null): LoginView {
   sweep(now);
-  if (live !== null && live.state === 'pending') return view(live);
-  const command = deps.command ?? agentCommand([claudeBin(), ...LOGIN_ARGS], { TERM: 'xterm-256color' });
+  const running = runningFor(target);
+  if (running !== null) return view(running);
+  const env = { TERM: 'xterm-256color', ...target?.env };
+  const command = deps.command ?? agentCommand([claudeBin(), ...LOGIN_ARGS], env);
   const session: Live = {
     id: randomBytes(9).toString('base64url'),
     startedAt: now,
     state: 'pending',
     output: '',
     error: null,
+    target,
     write: () => undefined,
     kill: () => undefined,
   };
@@ -151,7 +184,7 @@ export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginV
       note(session, Buffer.from(chunk).toString('utf8'));
     },
   });
-  const proc = Bun.spawn(command, { terminal, env: { ...process.env, TERM: 'xterm-256color' } });
+  const proc = Bun.spawn(command, { terminal, env: { ...process.env, ...env } });
   session.write = (text: string) => {
     terminal.write(Buffer.from(`${text}\r`, 'utf8'));
   };
@@ -160,13 +193,14 @@ export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginV
     terminal.close();
   };
   proc.exited
-    .then((code) => {
-      session.state = code === 0 ? 'done' : 'failed';
-      if (code !== 0) session.error = `the login ended with status ${String(code)}`;
+    .then(async (code) => {
+      session.write = () => undefined;
       terminal.close();
       forgetClaudeChecks();
-      const onboarding = code === 0 ? markOnboardingDone() : 'skipped';
-      log.info({ state: session.state, onboarding }, 'claude-login: the official login finished');
+      session.error = await verdict(session, code);
+      session.state = session.error === null ? 'done' : 'failed';
+      const onboarding = session.error === null ? markOnboardingDone() : 'skipped';
+      log.info({ state: session.state, onboarding, own: session.target !== null }, 'claude-login: the official login finished');
     })
     .catch((err: unknown) => {
       session.state = 'failed';

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -35,11 +35,12 @@ const LINE_MAX = 1024 * 1024;
 export interface UsageProbeDeps {
   command?: string[];
   timeoutMs?: number;
+  env?: Record<string, string>;
 }
 
-export function usageProbeCommand(): string[] | null {
+export function usageProbeCommand(env: Record<string, string> = {}): string[] | null {
   if (runningAsRoot() || (agentUserExpected() && agentUser() === null)) return null;
-  return agentCommand([claudeBin(), ...ARGS], PROBE_ENV);
+  return agentCommand([claudeBin(), ...ARGS], { ...PROBE_ENV, ...env });
 }
 
 function answerOf(line: string): Record<string, unknown> | null {
@@ -67,11 +68,11 @@ export function usageIn(output: string): unknown {
 }
 
 export function readClaudeUsage(deps: UsageProbeDeps = {}): Promise<unknown> {
-  const command = deps.command ?? usageProbeCommand();
+  const command = deps.command ?? usageProbeCommand(deps.env);
   if (command === null) return Promise.reject(new Error('Claude Code runs only as the agent user, and this box has none'));
   const [file = '', ...args] = command;
   return new Promise((resolve, reject) => {
-    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV } });
+    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV, ...deps.env } });
     let carry = '';
     let settled = false;
     let hardKill: ReturnType<typeof setTimeout> | undefined;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/claude-logins.ts

@@ -0,0 +1,168 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ID_RE, newId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readFileSync } from '../agent-user/agent-fs.js';
+import { removeHome } from '../agent-user/home-fs.js';
+import { claudeHome } from '../agent-user/user.js';
+import { claudeAccountIn, type ClaudeAccount, type LoginTarget } from '../claude/login.js';
+import { readClaudeUsage } from '../claude/usage-probe.js';
+import { currentOf, reach, refreshed, type TokenSource, type TokenState } from './subscription.js';
+import { forgetReported } from './usage.js';
+import { addConnection, connectionOf, readModelConfig, setClaudeLogin, writeModelConfig, type ModelConfig } from './model-config.js';
+
+const CREDENTIALS = '.credentials.json';
+const RENEW_MARGIN_MS = 60_000;
+const NEW = 'new';
+const MISSING = 'this Claude login is no longer on the box: sign in again on the Model page';
+
+export interface ClaudeLoginDeps {
+  root?: string;
+  probe?: (env: Record<string, string>) => Promise<unknown>;
+  account?: (env: Record<string, string>) => ClaudeAccount;
+  read?: () => ModelConfig;
+  write?: (cfg: ModelConfig) => void;
+}
+
+interface ClaudeTokens {
+  accessToken: string;
+  expiresAt: number | null;
+  savedAt: string;
+}
+
+const state: TokenState<ClaudeTokens> = new Map();
+const seen = new Map<string, ClaudeTokens>();
+
+const claudeLoginsRoot = (): string => join(claudeHome() ?? homedir(), '.metro', 'claude-logins');
+
+const rootOf = (deps: ClaudeLoginDeps): string => deps.root ?? claudeLoginsRoot();
+
+function claudeLoginEnv(login: string, deps: ClaudeLoginDeps = {}): Record<string, string> {
+  if (!ID_RE.test(login)) throw new Error('not a Claude login id');
+  return { CLAUDE_CONFIG_DIR: join(rootOf(deps), login) };
+}
+
+export const probeClaudeLogin = (login: string, deps: ClaudeLoginDeps = {}): Promise<unknown> =>
+  (deps.probe ?? ((env) => readClaudeUsage({ env })))(claudeLoginEnv(login, deps));
+
+const stale = (tokens: ClaudeTokens, margin = RENEW_MARGIN_MS): boolean => tokens.expiresAt !== null && tokens.expiresAt - margin <= Date.now();
+
+function onDisk(login: string, deps: ClaudeLoginDeps): ClaudeTokens | null {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(join(claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '', CREDENTIALS), 'utf8'));
+  } catch {
+    return null;
+  }
+  const oauth = isRecord(raw) && isRecord(raw.claudeAiOauth) ? raw.claudeAiOauth : {};
+  const accessToken = typeof oauth.accessToken === 'string' ? oauth.accessToken : '';
+  const expiresAt = typeof oauth.expiresAt === 'number' && Number.isFinite(oauth.expiresAt) ? oauth.expiresAt : null;
+  return accessToken === '' ? null : { accessToken, expiresAt, savedAt: new Date(expiresAt ?? 0).toISOString() };
+}
+
+function remembered(login: string, tokens: ClaudeTokens | null): ClaudeTokens | null {
+  if (tokens === null) seen.delete(login);
+  else seen.set(login, tokens);
+  return tokens;
+}
+
+function known(login: string, deps: ClaudeLoginDeps): ClaudeTokens | null {
+  const kept = seen.get(login);
+  if (kept !== undefined && !stale(kept)) return kept;
+  const read = onDisk(login, deps);
+  return read === null && kept !== undefined ? kept : remembered(login, read);
+}
+
+function sourceFor(login: string, deps: ClaudeLoginDeps): TokenSource<ClaudeTokens> {
+  return {
+    label: 'Claude',
+    stale: (tokens) => stale(tokens),
+    refresh: async () => {
+      try {
+        await probeClaudeLogin(login, deps);
+      } catch (err) {
+        log.warn({ err: errMsg(err) }, 'claude-logins: Claude Code stumbled while renewing a login, so its folder is read as it is');
+      }
+      const fresh = onDisk(login, deps);
+      if (fresh === null || stale(fresh, 0)) throw new Error('Claude Code could not renew this login');
+      return fresh;
+    },
+    save: (id, tokens) => {
+      remembered(id, tokens);
+    },
+  };
+}
+
+function again(login: string, failed: ClaudeTokens, deps: ClaudeLoginDeps, source: TokenSource<ClaudeTokens>): Promise<ClaudeTokens> {
+  const disk = onDisk(login, deps);
+  if (disk !== null && disk.accessToken !== failed.accessToken && !stale(disk)) return Promise.resolve(remembered(login, disk) ?? disk);
+  return refreshed(state, login, failed, source);
+}
+
+export function withClaudeLogin(login: string, deps: ClaudeLoginDeps, send: (token: string) => Promise<Response>): Promise<Response> {
+  const source = sourceFor(login, deps);
+  return reach(
+    () => currentOf(state, login, known(login, deps), source, MISSING),
+    (failed) => again(login, failed, deps, source),
+    (tokens) => send(tokens.accessToken),
+  );
+}
+
+function dropClaudeLogin(login: string, deps: ClaudeLoginDeps): void {
+  seen.delete(login);
+  state.delete(login);
+  try {
+    removeHome(claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '', true);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove a Claude login that is no longer used');
+  }
+}
+
+export function dropUnusedClaudeLogins(before: ModelConfig, after: ModelConfig, deps: ClaudeLoginDeps = {}): void {
+  const kept = new Set(after.connections.flatMap((c) => (c.claude === null ? [] : [c.claude.id])));
+  for (const c of before.connections) if (c.claude !== null && !kept.has(c.claude.id)) dropClaudeLogin(c.claude.id, deps);
+}
+
+function keep(login: string, connection: string | null, account: ClaudeAccount, deps: ClaudeLoginDeps): string | null {
+  const before = (deps.read ?? readModelConfig)();
+  const cfg = connection === null ? addConnection(before, { provider: 'anthropic' }) : before;
+  const id = connection ?? cfg.connections.at(-1)?.id ?? '';
+  if (connectionOf(cfg, id)?.provider !== 'anthropic') return 'that connection was removed during the sign-in';
+  const next = setClaudeLogin(cfg, id, { id: login, email: account.account, plan: account.plan, savedAt: new Date().toISOString() });
+  (deps.write ?? writeModelConfig)(next);
+  dropUnusedClaudeLogins(before, next, deps);
+  forgetReported(id);
+  log.info({ connection: id, plan: account.plan, added: connection === null }, 'claude-logins: the Claude login was kept for its own connection');
+  return null;
+}
+
+function settle(ok: boolean, login: string, connection: string | null, deps: ClaudeLoginDeps): Promise<string | null> {
+  if (!ok) {
+    dropClaudeLogin(login, deps);
+    return Promise.resolve(null);
+  }
+  let problem: string | null;
+  try {
+    const account = (deps.account ?? claudeAccountIn)(claudeLoginEnv(login, deps));
+    problem = account.signedIn ? keep(login, connection, account, deps) : 'the sign-in finished but Claude Code holds no login; try again';
+  } catch (err) {
+    problem = errMsg(err);
+  }
+  if (problem !== null) dropClaudeLogin(login, deps);
+  return Promise.resolve(problem);
+}
+
+export function claudeLoginTarget(asked: string, deps: ClaudeLoginDeps = {}): LoginTarget {
+  const connection = asked === NEW ? null : asked;
+  if (connection !== null && connectionOf((deps.read ?? readModelConfig)(), connection)?.provider !== 'anthropic')
+    throw new ApiError('no such Anthropic connection', 404);
+  const login = newId();
+  return { key: asked, env: claudeLoginEnv(login, deps), settle: (ok) => settle(ok, login, connection, deps) };
+}
+
+export function forgetClaudeTokens(): void {
+  seen.clear();
+  state.clear();
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/fallback.ts

@@ -0,0 +1,147 @@
+import { log } from '@metro-labs/core/log';
+import { lastServed } from './served.js';
+import { PER_MINUTE, usageOf, type UsageWindow } from './usage.js';
+import { bareModel, connectionOf, isSmallModel, notReady, routedConnection, routeLabel, type Connection, type Fallback, type ModelConfig, type Route } from './model-config.js';
+
+export const USAGE_LIMIT = 0.95;
+const COOLDOWN_MS = 60_000;
+const SCOPED = 'Weekly, ';
+const MS_PER_SECOND = 1000;
+
+export interface Hold {
+  reason: string;
+  until: string | null;
+}
+
+interface Cooling {
+  until: number;
+  reason: string;
+}
+
+const cooling = new Map<string, Cooling>();
+let lastChoice = '';
+
+const keyOf = (route: Route): string => `${route.connection.id}\n${route.model}`;
+
+export function forgetFallbackState(): void {
+  cooling.clear();
+  lastChoice = '';
+}
+
+function scopeOf(label: string): string | null {
+  if (!label.startsWith(SCOPED)) return null;
+  return (label.slice(SCOPED.length).trim().split(/\s+/)[0] ?? '').toLowerCase();
+}
+
+function applies(window: UsageWindow, route: Route, now: number): boolean {
+  if (window.used === null || window.label === PER_MINUTE) return false;
+  if (window.resetAt !== null && Date.parse(window.resetAt) <= now) return false;
+  if (route.connection.provider === 'gemini') return window.label === route.model;
+  const scope = scopeOf(window.label);
+  return scope === null || route.model.toLowerCase().split(/[^a-z0-9]+/).includes(scope);
+}
+
+export function windowsFor(route: Route, now = Date.now()): UsageWindow[] {
+  return (usageOf(route.connection.id)?.windows ?? []).filter((w) => applies(w, route, now));
+}
+
+const percent = (used: number): string => `${String(Math.round(used * 100))}%`;
+
+export function holdOf(route: Route, now = Date.now()): Hold | null {
+  const cool = cooling.get(keyOf(route));
+  if (cool !== undefined && cool.until > now) return { reason: cool.reason, until: new Date(cool.until).toISOString() };
+  const over = windowsFor(route, now).find((w) => (w.used ?? 0) > USAGE_LIMIT);
+  return over === undefined ? null : { reason: `${over.label} ${percent(over.used ?? 0)}`, until: over.resetAt };
+}
+
+function fallbackModel(requested: string, conn: Connection, model: string): string {
+  const bare = bareModel(requested);
+  return conn.provider === 'anthropic' && isSmallModel(bare) ? bare : model;
+}
+
+function fallbackRoute(cfg: ModelConfig, fallback: Fallback, requested: string): Route | null {
+  const conn = connectionOf(cfg, fallback.connection);
+  if (conn === null || notReady(cfg, conn) !== null) return null;
+  return { connection: conn, model: fallbackModel(requested, conn, fallback.model) };
+}
+
+const unique = (routes: Route[]): Route[] => routes.filter((route, at) => routes.findIndex((other) => keyOf(other) === keyOf(route)) === at);
+
+export const chainOf = (primary: Route, cfg: ModelConfig, requested: string): Route[] =>
+  unique([primary, ...(cfg.fallbacks ?? []).flatMap((f) => fallbackRoute(cfg, f, requested) ?? [])]);
+
+export function routesToTry(chain: Route[], now = Date.now()): Route[] {
+  const open = chain.filter((route) => holdOf(route, now) === null);
+  return open.length > 0 ? open : chain.slice(0, 1);
+}
+
+function secondsHeader(headers: Headers, name: string): number | null {
+  const raw = headers.get(name);
+  if (raw === null || raw.trim() === '') return null;
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? value : null;
+}
+
+function coolUntil(headers: Headers, now: number): number {
+  const after = secondsHeader(headers, 'retry-after');
+  if (after !== null) return now + after * MS_PER_SECOND;
+  const reset = secondsHeader(headers, 'anthropic-ratelimit-unified-reset');
+  if (reset !== null && reset * MS_PER_SECOND > now) return reset * MS_PER_SECOND;
+  return now + COOLDOWN_MS;
+}
+
+export function noteRefused(route: Route, status: number, headers: Headers, next: Route | undefined, now = Date.now()): void {
+  const reason = `answered ${String(status)}`;
+  cooling.set(keyOf(route), { until: coolUntil(headers, now), reason });
+  log.warn({ from: routeLabel(route), to: next === undefined ? null : routeLabel(next), status }, 'gateway: the model hit its limit, so the request goes to the next fallback model');
+}
+
+export function noteChoice(primary: Route, chosen: Route, now = Date.now()): void {
+  const key = keyOf(chosen);
+  if (key === lastChoice) return;
+  const first = lastChoice === '';
+  lastChoice = key;
+  if (key === keyOf(primary)) {
+    if (!first) log.info({ model: routeLabel(chosen), connection: chosen.connection.label }, 'gateway: back on the first model of the fallback list');
+    return;
+  }
+  const hold = holdOf(primary, now);
+  log.info(
+    { from: routeLabel(primary), to: routeLabel(chosen), connection: chosen.connection.label, reason: hold?.reason ?? null, until: hold?.until ?? null },
+    'gateway: the first model is over its limit, so requests go to a fallback model',
+  );
+}
+
+export interface ChainRow {
+  connection: string;
+  model: string;
+  used: number | null;
+  hold: Hold | null;
+  active: boolean;
+}
+
+function primaryOf(cfg: ModelConfig): Route | null {
+  const conn = routedConnection(cfg);
+  if (conn === null) return null;
+  const served = lastServed();
+  const model = conn.model !== '' ? conn.model : served?.connection === conn.id ? served.model : '';
+  return { connection: conn, model };
+}
+
+function rowOf(cfg: ModelConfig, route: Route, now: number): Omit<ChainRow, 'active'> {
+  const reason = notReady(cfg, route.connection);
+  const used = windowsFor(route, now).reduce<number | null>((most, w) => Math.max(most ?? 0, w.used ?? 0), null);
+  return { connection: route.connection.id, model: route.model, used, hold: reason === null ? holdOf(route, now) : { reason, until: null } };
+}
+
+export function chainStatus(cfg: ModelConfig, now = Date.now()): ChainRow[] {
+  const primary = primaryOf(cfg);
+  if (primary === null) return [];
+  const listed = (cfg.fallbacks ?? []).flatMap((f) => {
+    const conn = connectionOf(cfg, f.connection);
+    return conn === null ? [] : [{ connection: conn, model: f.model }];
+  });
+  const rows = unique([primary, ...listed]).map((route) => rowOf(cfg, route, now));
+  const active = Math.max(0, rows.findIndex((row) => row.hold === null));
+  return rows.map((row, at) => ({ ...row, active: at === active }));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/forward.ts

@@ -1,4 +1,4 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { IncomingMessage, OutgoingHttpHeader, OutgoingHttpHeaders, ServerResponse } from 'node:http';
 import { UsageScanner } from './usage.js';
 
 export class GatewayError extends Error {
@@ -128,6 +128,15 @@ export function anthropicHeaders(req: IncomingMessage, apiKey: string): Record<s
   return headers;
 }
 
+export const OAUTH_BETA = 'oauth-2025-04-20';
+
+export function loginHeaders(req: IncomingMessage, token: string): Record<string, string> {
+  const headers = forwardedHeaders(req);
+  delete headers['x-api-key'];
+  headers.authorization = `Bearer ${token}`;
+  return addBeta(headers, OAUTH_BETA);
+}
+
 export function addBeta(headers: Record<string, string>, beta: string): Record<string, string> {
   const listed = (headers['anthropic-beta'] ?? '')
     .split(',')
@@ -235,3 +244,41 @@ export function upstreamMessage(text: string, fallback: string): string {
     return text;
   }
 }
+
+const LIMIT_STATUSES = new Set([402, 429]);
+
+export interface Refusal {
+  status: number;
+  headers: Headers;
+}
+
+export interface Held {
+  res: ServerResponse;
+  refusal: () => Refusal | null;
+}
+
+function headersOf(raw: OutgoingHttpHeaders | OutgoingHttpHeader[] | undefined): Headers {
+  const out = new Headers();
+  if (raw === undefined || Array.isArray(raw)) return out;
+  for (const [name, value] of Object.entries(raw)) if (value !== undefined) out.set(name, Array.isArray(value) ? value.join(', ') : String(value));
+  return out;
+}
+
+export function holdLimitRefusal(res: ServerResponse): Held {
+  let refusal: Refusal | null = null;
+  const swallow = (): boolean => true;
+  const held: ServerResponse = new Proxy(res, {
+    get(target, prop) {
+      if (prop === 'writeHead')
+        return (status: number, headers?: OutgoingHttpHeaders | OutgoingHttpHeader[]): ServerResponse => {
+          if (!LIMIT_STATUSES.has(status)) return target.writeHead(status, headers);
+          refusal = { status, headers: headersOf(headers) };
+          return held;
+        };
+      if (refusal !== null && (prop === 'write' || prop === 'end')) return swallow;
+      const value: unknown = Reflect.get(target, prop, target);
+      return typeof value === 'function' ? (value as (...args: unknown[]) => unknown).bind(target) : value;
+    },
+  });
+  return { res: held, refusal: () => refusal };
+}