@stage-labs/metro 0.1.0-beta.308 → 0.1.0-beta.309

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.308",
+  "version": "0.1.0-beta.309",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -4,6 +4,7 @@ import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { agentsDir } from '../agents/files.js';
 import { MCP_TOKEN_FILE } from '../mcp-server/token.js';
+import { effectiveSetup, modelViewText } from '../gateway/effective.js';
 import { removeHome, writeHomeText } from './home-fs.js';
 import { closeMetroHome } from './metro-home.js';
 import { agentUser, agentViewDir, type AgentUser } from './user.js';
@@ -39,17 +40,10 @@ function agentFile(dir: string): string | null {
   return json({ version: 1, id: file.id, key: file.key });
 }
 
-function modelFile(dir: string): string | null {
-  const cfg = readRecord(join(dir, 'model.json'));
-  if (cfg === null || !Array.isArray(cfg.connections)) return null;
-  const connections = cfg.connections.filter(isRecord).map((c) => ({ id: c.id, provider: c.provider, model: c.model }));
-  return json({ version: 2, route: cfg.route, connections });
-}
-
-export function viewFiles(dir = agentsDir()): Map<string, string | null> {
+export function viewFiles(dir = agentsDir(), model: () => string | null = () => modelViewText(effectiveSetup(dir))): Map<string, string | null> {
   const files = new Map<string, string | null>([
     ['agent.json', agentFile(dir)],
-    ['model.json', modelFile(dir)],
+    ['model.json', model()],
   ]);
   for (const name of COPIED) files.set(name, existsSync(join(dir, name)) ? readText(join(dir, name)) : null);
   for (const name of NEVER_COPIED) files.set(name, null);

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -60,6 +60,11 @@ import { startUploadReaper } from '../files/upload-store.js';
 import { startAttachReaper } from '../files/attach-reaper.js';
 import { startCloudWatchPublisher } from '../server/cloudwatch.js';
 import { watchFallbackUsage } from '../gateway/usage-refresh.js';
+import { startOrgModels, stopOrgModels } from '../gateway/org-models.js';
+import { effectiveSetup, watchModelChanges } from '../gateway/effective.js';
+import { readClaudeLogins } from '../gateway/claude-store.js';
+import { readAgentKey } from '../connectors/agent-key.js';
+import { METRO_API } from '../connectors/metro-api.js';
 import { isCallEvent, leaveCallsForShutdown, onCallEvent, sweepLeftoverCalls } from '../voice/calls.js';
 
 installCrashGuard();
@@ -114,7 +119,7 @@ async function syncStations(station: StationName): Promise<void> {
   }
 }
 
-function sessionApis(setLiveEvents: (on: boolean) => void, switchModel: (model: string | null) => boolean): SessionApis {
+function sessionApis(setLiveEvents: (on: boolean) => void): SessionApis {
   return localSessionApis({
       syncStations,
       reloadAgents: async () => {
@@ -133,7 +138,6 @@ function sessionApis(setLiveEvents: (on: boolean) => void, switchModel: (model:
       toolGroups: stationToolGroups,
       prepareAccount,
       liveEvents: setLiveEvents,
-      switchModel,
     });
 }
 
@@ -150,10 +154,12 @@ installBearerSessions(agentsDir(), localOwner);
   syncGmailHost();
   supervisor.start();
   sweepLeftoverCalls();
+  const models = startOrgModels({ owner: localOwner, key: () => readAgentKey(), api: METRO_API, dir: agentsDir });
   const metroMcp = await createMetroMcp({ liveEvents: liveEvents() });
+  watchModelChanges(models, metroMcp.switchModel);
   webhookServer = await startWebhookServer(
     emit,
-    sessionApis(metroMcp.setLiveEvents, metroMcp.switchModel),
+    sessionApis(metroMcp.setLiveEvents),
     metroMcp.httpHandler,
     true,
   );
@@ -174,7 +180,7 @@ installBearerSessions(agentsDir(), localOwner);
   });
   watchConnectorTools();
   startCloudWatchPublisher();
-  watchFallbackUsage();
+  watchFallbackUsage(() => effectiveSetup(), () => readClaudeLogins());
   announceLocalEndpoint();
   tunnel?.start();
   log.info(
@@ -221,6 +227,7 @@ async function shutdown(): Promise<void> {
     log.warn({ err: errMsg(err) }, 'mcp-server: could not stop the approval relay');
   });
   const leaving = leaveCallsForShutdown();
+  stopOrgModels();
   unwatchSession();
   tunnel?.stop();
   if (webhookServer) {

package/runtime/node_modules/@metro-labs/daemon/src/claude/session.ts

@@ -11,7 +11,8 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { readJson, writeJson } from '@metro-labs/core/secure-fs';
 import { METRO_VERSION } from '@metro-labs/core/version';
 import { agentsDir, listAgentFiles } from '../agents/files.js';
-import { notReady, readModelConfig, routedConnection } from '../gateway/model-config.js';
+import { notReady, primaryRoute, type ModelSetup } from '../gateway/model-config.js';
+import { effectiveSetup } from '../gateway/effective.js';
 import { claudeAccount, claudeInstalled, forgetClaudeChecks } from './login.js';
 import { inSessionScope } from './memory.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
@@ -38,6 +39,7 @@ export interface SessionDeps {
   home?: string;
   agents?: string;
   signedIn?: () => boolean;
+  model?: () => ModelSetup;
   now?: () => number;
   version?: string;
 }
@@ -138,13 +140,12 @@ function credentialReady(deps: SessionDeps): string | null {
   const signedIn = deps.signedIn ?? loginNotRuledOut;
   if (signedIn()) return null;
   try {
-    const cfg = readModelConfig(deps.agents ?? agentsDir());
-    const conn = routedConnection(cfg);
-    if (conn !== null && notReady(cfg) === null && (conn.provider !== 'anthropic' || conn.apiKey !== '')) return null;
+    const primary = primaryRoute((deps.model ?? (() => effectiveSetup(deps.agents ?? agentsDir())))());
+    if (primary !== null && notReady(primary) === null && (primary.connection.provider !== 'anthropic' || primary.connection.apiKey !== '')) return null;
   } catch (err) {
-    return `the Model page is not readable (${errMsg(err)})`;
+    return `the model setup is not readable (${errMsg(err)})`;
   }
-  return 'Claude Code is not signed in and the Model page routes nowhere yet';
+  return 'Claude Code is not signed in and the organization routes this agent to no model yet';
 }
 
 const agentUserMissing = (deps: SessionDeps): boolean =>

package/runtime/node_modules/@metro-labs/daemon/src/gateway/bedrock.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
 import { EventStreamDecoder, type EventStreamMessage } from './eventstream.js';
-import { errorFrame, GatewayError, providerStatus, relayFrames, sendError, upstreamMessage, type Watch } from './forward.js';
+import { errorFrame, providerStatus, relayFrames, sendError, upstreamMessage, type Watch } from './forward.js';
 import type { Connection } from './model-config.js';
 import { estimateTokens } from './subscription.js';
 import { UsageScanner } from './usage.js';
@@ -226,8 +226,3 @@ export async function bedrockCount(
   res.writeHead(200, { 'content-type': 'application/json' });
   res.end(JSON.stringify({ input_tokens: counted ?? estimateTokens(rewritten.body) }));
 }
-
-export function assertBedrockReady(settings: Connection): void {
-  if (settings.apiKey === '' || settings.region === '')
-    throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key and a region: add them on the Model page.');
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/claude-logins.ts

@@ -5,13 +5,14 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg, log } from '@metro-labs/core/log';
 import { ApiError } from '@metro-labs/http/api-error';
 import { readFileSync } from '../agent-user/agent-fs.js';
-import { removeHome } from '../agent-user/home-fs.js';
+import { moveHome, removeHome } from '../agent-user/home-fs.js';
 import { claudeHome } from '../agent-user/user.js';
 import { claudeAccountIn, type ClaudeAccount, type LoginTarget } from '../claude/login.js';
 import { readClaudeUsage } from '../claude/usage-probe.js';
 import { currentOf, reach, refreshed, type TokenSource, type TokenState } from './subscription.js';
-import { forgetReported } from './usage.js';
-import { addConnection, connectionOf, readModelConfig, setClaudeLogin, writeModelConfig, type ModelConfig } from './model-config.js';
+import { forgetOne, forgetReported } from './usage.js';
+import { readClaudeLogins, writeClaudeLogins, type ClaudeLogin } from './claude-store.js';
+import { loginRef } from './model-config.js';
 
 const CREDENTIALS = '.credentials.json';
 const RENEW_MARGIN_MS = 60_000;
@@ -22,8 +23,7 @@ export interface ClaudeLoginDeps {
   root?: string;
   probe?: (env: Record<string, string>) => Promise<unknown>;
   account?: (env: Record<string, string>) => ClaudeAccount;
-  read?: () => ModelConfig;
-  write?: (cfg: ModelConfig) => void;
+  dir?: string;
 }
 
 interface ClaudeTokens {
@@ -110,56 +110,80 @@ export function withClaudeLogin(login: string, deps: ClaudeLoginDeps, send: (tok
   );
 }
 
-function dropClaudeLogin(login: string, deps: ClaudeLoginDeps): void {
+const folderOf = (login: string, deps: ClaudeLoginDeps): string => claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '';
+
+function forgetTokens(login: string): void {
   seen.delete(login);
   state.delete(login);
+}
+
+function dropFolder(login: string, deps: ClaudeLoginDeps): void {
+  forgetTokens(login);
   try {
-    removeHome(claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '', true);
+    removeHome(folderOf(login, deps), true);
   } catch (err) {
-    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove a Claude login that is no longer used');
+    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove the folder of a Claude login that is no longer used');
   }
 }
 
-export function dropUnusedClaudeLogins(before: ModelConfig, after: ModelConfig, deps: ClaudeLoginDeps = {}): void {
-  const kept = new Set(after.connections.flatMap((c) => (c.claude === null ? [] : [c.claude.id])));
-  for (const c of before.connections) if (c.claude !== null && !kept.has(c.claude.id)) dropClaudeLogin(c.claude.id, deps);
+export function removeClaudeLogin(login: string, deps: ClaudeLoginDeps = {}): void {
+  const logins = readClaudeLogins(deps.dir);
+  if (!logins.some((l) => l.id === login)) throw new ApiError('no such Claude login on this box', 404);
+  writeClaudeLogins(logins.filter((l) => l.id !== login), deps.dir);
+  dropFolder(login, deps);
+  forgetOne(loginRef(login));
+  log.info({ login }, 'claude-logins: a Claude login was removed from this box');
+}
+
+function takeOver(fresh: string, replaced: string, deps: ClaudeLoginDeps): void {
+  const aside = `${folderOf(replaced, deps)}.old-${newId()}`;
+  moveHome(folderOf(replaced, deps), aside);
+  try {
+    moveHome(folderOf(fresh, deps), folderOf(replaced, deps));
+  } catch (err) {
+    moveHome(aside, folderOf(replaced, deps));
+    throw err;
+  }
+  forgetTokens(replaced);
+  try {
+    removeHome(aside, true);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove the folder of the login that was signed in again');
+  }
 }
 
-function keep(login: string, connection: string | null, account: ClaudeAccount, deps: ClaudeLoginDeps): string | null {
-  const before = (deps.read ?? readModelConfig)();
-  const cfg = connection === null ? addConnection(before, { provider: 'anthropic' }) : before;
-  const id = connection ?? cfg.connections.at(-1)?.id ?? '';
-  if (connectionOf(cfg, id)?.provider !== 'anthropic') return 'that connection was removed during the sign-in';
-  const next = setClaudeLogin(cfg, id, { id: login, email: account.account, plan: account.plan, savedAt: new Date().toISOString() });
-  (deps.write ?? writeModelConfig)(next);
-  dropUnusedClaudeLogins(before, next, deps);
-  forgetReported(id);
-  log.info({ connection: id, plan: account.plan, added: connection === null }, 'claude-logins: the Claude login was kept for its own connection');
+function keep(login: string, replacing: string | null, account: ClaudeAccount, deps: ClaudeLoginDeps): string | null {
+  const logins = readClaudeLogins(deps.dir);
+  if (replacing !== null && !logins.some((l) => l.id === replacing)) return 'that Claude login was removed during the sign-in';
+  if (replacing !== null) takeOver(login, replacing, deps);
+  const entry: ClaudeLogin = { id: replacing ?? login, email: account.account, plan: account.plan, savedAt: new Date().toISOString() };
+  writeClaudeLogins(replacing === null ? [...logins, entry] : logins.map((l) => (l.id === replacing ? entry : l)), deps.dir);
+  forgetReported(loginRef(entry.id));
+  log.info({ login: entry.id, plan: account.plan, added: replacing === null }, 'claude-logins: the Claude login was kept on this box');
   return null;
 }
 
-function settle(ok: boolean, login: string, connection: string | null, deps: ClaudeLoginDeps): Promise<string | null> {
+function settle(ok: boolean, login: string, replacing: string | null, deps: ClaudeLoginDeps): Promise<string | null> {
   if (!ok) {
-    dropClaudeLogin(login, deps);
+    dropFolder(login, deps);
     return Promise.resolve(null);
   }
   let problem: string | null;
   try {
     const account = (deps.account ?? claudeAccountIn)(claudeLoginEnv(login, deps));
-    problem = account.signedIn ? keep(login, connection, account, deps) : 'the sign-in finished but Claude Code holds no login; try again';
+    problem = account.signedIn ? keep(login, replacing, account, deps) : 'the sign-in finished but Claude Code holds no login; try again';
   } catch (err) {
     problem = errMsg(err);
   }
-  if (problem !== null) dropClaudeLogin(login, deps);
+  if (problem !== null) dropFolder(login, deps);
   return Promise.resolve(problem);
 }
 
 export function claudeLoginTarget(asked: string, deps: ClaudeLoginDeps = {}): LoginTarget {
-  const connection = asked === NEW ? null : asked;
-  if (connection !== null && connectionOf((deps.read ?? readModelConfig)(), connection)?.provider !== 'anthropic')
-    throw new ApiError('no such Anthropic connection', 404);
+  const replacing = asked === NEW ? null : asked;
+  if (replacing !== null && !readClaudeLogins(deps.dir).some((l) => l.id === replacing)) throw new ApiError('no such Claude login on this box', 404);
   const login = newId();
-  return { key: asked, env: claudeLoginEnv(login, deps), settle: (ok) => settle(ok, login, connection, deps) };
+  return { key: asked, env: claudeLoginEnv(login, deps), settle: (ok) => settle(ok, login, replacing, deps) };
 }
 
 export function forgetClaudeTokens(): void {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/claude-store.ts

@@ -0,0 +1,55 @@
+import { join } from 'node:path';
+import { ID_RE, newId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { agentsDir } from '../agents/files.js';
+
+export interface ClaudeLogin {
+  id: string;
+  email: string | null;
+  plan: string | null;
+  savedAt: string;
+}
+
+const MODEL_FILE = 'model.json';
+
+const text = (value: unknown): string => (typeof value === 'string' ? value.trim() : '');
+const maybe = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claudeLoginOf(raw: unknown): ClaudeLogin | null {
+  if (!isRecord(raw) || !ID_RE.test(text(raw.id))) return null;
+  return { id: text(raw.id), email: maybe(raw.email), plan: maybe(raw.plan), savedAt: text(raw.savedAt) };
+}
+
+export const modelPath = (dir: string): string => join(dir, MODEL_FILE);
+
+export const readModelFile = (dir = agentsDir()): unknown =>
+  readJson<unknown>(modelPath(dir), null, { warn: 'model.json is unreadable, so the Claude logins of this box are not seen until it is fixed' });
+
+export const isV2 = (raw: unknown): raw is Record<string, unknown> & { connections: unknown[] } =>
+  isRecord(raw) && raw.version !== 3 && Array.isArray(raw.connections);
+
+const unique = (logins: ClaudeLogin[]): ClaudeLogin[] => logins.filter((l, at) => logins.findIndex((o) => o.id === l.id) === at);
+
+export function claudeLoginsIn(raw: unknown): ClaudeLogin[] {
+  if (isV2(raw)) return unique(raw.connections.flatMap((c: unknown) => (isRecord(c) && c.provider === 'anthropic' ? (claudeLoginOf(c.claude) ?? []) : [])));
+  if (!isRecord(raw) || !Array.isArray(raw.claude)) return [];
+  return unique(raw.claude.flatMap((c: unknown) => claudeLoginOf(c) ?? []));
+}
+
+export const readClaudeLogins = (dir = agentsDir()): ClaudeLogin[] => claudeLoginsIn(readModelFile(dir));
+
+export const v3Text = (logins: ClaudeLogin[]): string => JSON.stringify({ version: 3, claude: logins }, null, 2);
+
+function v2With(raw: Record<string, unknown> & { connections: unknown[] }, logins: ClaudeLogin[]): Record<string, unknown> {
+  const holds = (c: unknown): c is Record<string, unknown> => isRecord(c) && c.provider === 'anthropic' && claudeLoginOf(c.claude) !== null;
+  const held = new Map(raw.connections.filter(holds).map((c) => [claudeLoginOf(c.claude)?.id ?? '', c]));
+  const others = raw.connections.filter((c) => !holds(c));
+  const logged = logins.map((login) => ({ ...(held.get(login.id) ?? { id: newId(), provider: 'anthropic', label: 'Anthropic', model: '' }), claude: login }));
+  return { ...raw, connections: [...others, ...logged] };
+}
+
+export function writeClaudeLogins(logins: ClaudeLogin[], dir = agentsDir()): void {
+  const raw = readModelFile(dir);
+  writeSecure(modelPath(dir), isV2(raw) ? JSON.stringify(v2With(raw, logins), null, 2) : v3Text(logins));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -2,54 +2,40 @@ import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { arch, platform, release } from 'node:os';
 import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
 import { stringOf } from '@metro-labs/http/api-http';
-import { OPENAI_API, CODEX_SIGN_IN, refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
-import { refreshCodeTokens } from './codex-device.js';
 import { codexVersion, learnCodexVersion } from './codex-version.js';
 import { CodexEventTranslator, withUsageLink } from './codex-stream.js';
 import { ToolNames, toResponsesRequest } from './codex-translate.js';
 import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
 import { parseEvent, SseParser, type SseEvent } from './frames.js';
-import type { Connection } from './model-config.js';
-import { listCache } from './model-lists.js';
-import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
+import { CODEX_SIGN_IN, type CodexAccess, type Connection } from './model-config.js';
+import { answerWhole, errorKind, relayTranslated, sessionHeader } from './subscription.js';
 import { noteUsageHeaders } from './usage.js';
 
 const CODEX_BACKEND = 'https://chatgpt.com/backend-api/codex';
+const OPENAI_API = 'https://api.openai.com/v1';
 const INVALID = [400, 404, 422];
+const RENEW_FAILED = "Codex refused its sign-in and api.metro.box could not renew it: sign in again on the organization's Models page.";
 
 export interface CodexDeps {
   base?: string;
-  issuer?: string;
   fetchImpl?: typeof fetch;
-  save: (id: string, tokens: CodexTokens) => void;
+  refresh: (conn: Connection) => Promise<Connection | null>;
 }
 
-export type CodexState = TokenState<CodexTokens>;
-
-export const sharedCodexState: CodexState = new Map();
-
-const codexLists = listCache<string>('codex');
-
-const sourceOf = (deps: CodexDeps): TokenSource<CodexTokens> => ({
-  label: 'Codex',
-  stale: (tokens) => tokensStale(tokens),
-  refresh: (tokens) => (tokens.method === 'code' ? refreshCodeTokens(tokens, deps.issuer, deps.fetchImpl) : refreshTokens(tokens, deps.issuer, deps.fetchImpl)),
-  save: deps.save,
-});
-
 const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
 
 export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
 
-const baseFor = (tokens: CodexTokens, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (tokens.method === 'code' ? CODEX_BACKEND : OPENAI_API);
+const baseFor = (access: CodexAccess, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (access.method === 'code' ? CODEX_BACKEND : OPENAI_API);
 
-function headersFor(tokens: CodexTokens, accept: string, sessionId: string): Record<string, string> {
-  const plain = { authorization: `Bearer ${tokens.accessToken}`, 'content-type': 'application/json', accept };
-  if (tokens.method === 'chatgpt') return plain;
+function headersFor(access: CodexAccess, sessionId: string): Record<string, string> {
+  const plain = { authorization: `Bearer ${access.accessToken}`, 'content-type': 'application/json', accept: 'text/event-stream' };
+  if (access.method === 'chatgpt') return plain;
   return {
     ...plain,
-    'chatgpt-account-id': tokens.accountId,
+    'chatgpt-account-id': access.accountId ?? '',
     originator: 'codex_cli_rs',
     'user-agent': userAgent(),
     'openai-beta': 'responses=experimental',
@@ -57,9 +43,6 @@ function headersFor(tokens: CodexTokens, accept: string, sessionId: string): Rec
   };
 }
 
-export const currentTokens = (conn: Connection, deps: CodexDeps, state: CodexState): Promise<CodexTokens> =>
-  currentOf(state, conn.id, conn.codex, sourceOf(deps), CODEX_SIGN_IN);
-
 interface Call {
   body: Record<string, unknown>;
   model: string;
@@ -69,11 +52,11 @@ interface Call {
   names: ToolNames;
 }
 
-function send(call: Call, tokens: CodexTokens): Promise<Response> {
+function send(call: Call, access: CodexAccess): Promise<Response> {
   const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
-  return (call.deps.fetchImpl ?? fetch)(`${baseFor(tokens, call.deps)}/responses`, {
+  return (call.deps.fetchImpl ?? fetch)(`${baseFor(access, call.deps)}/responses`, {
     method: 'POST',
-    headers: headersFor(tokens, 'text/event-stream', call.sessionId),
+    headers: headersFor(access, call.sessionId),
     body: JSON.stringify(request),
     signal: call.watch.signal,
     redirect: 'manual',
@@ -91,22 +74,33 @@ function refusalOf(text: string, status: number): string {
   return withUsageLink(code, upstreamMessage(text, `OpenAI answered ${String(status)}`));
 }
 
-export async function codexMessages(
-  req: IncomingMessage,
-  res: ServerResponse,
-  body: Record<string, unknown>,
-  model: string,
-  conn: Connection,
-  deps: CodexDeps,
-  state: CodexState,
-  watch: Watch,
-): Promise<void> {
+let learning: Promise<unknown> | null = null;
+
+function learnVersion(access: CodexAccess): void {
+  if (access.method !== 'code' || learning !== null) return;
+  learning = learnCodexVersion()
+    .catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'gateway: the latest Codex version could not be learned');
+    })
+    .finally(() => {
+      learning = null;
+    });
+}
+
+async function reach(call: Call, conn: Connection): Promise<Response> {
+  if (conn.codex === null) throw new GatewayError(400, 'invalid_request_error', CODEX_SIGN_IN);
+  learnVersion(conn.codex);
+  const upstream = await send(call, conn.codex);
+  if (upstream.status !== 401) return upstream;
+  await upstream.body?.cancel();
+  const fresh = await call.deps.refresh(conn);
+  if (fresh?.codex === null || fresh?.codex === undefined) throw new GatewayError(403, 'permission_error', RENEW_FAILED);
+  return send(call, fresh.codex);
+}
+
+export async function codexMessages(req: IncomingMessage, res: ServerResponse, body: Record<string, unknown>, model: string, conn: Connection, deps: CodexDeps, watch: Watch): Promise<void> {
   const call: Call = { body, model, sessionId: sessionHeader(req) || randomUUID(), watch, deps, names: new ToolNames() };
-  const upstream = await reach(
-    () => currentTokens(conn, deps, state),
-    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
-    (tokens) => send(call, tokens),
-  );
+  const upstream = await reach(call, conn);
   noteUsageHeaders('codex', conn.id, upstream.headers);
   if (!upstream.ok) {
     const text = await upstream.text();
@@ -125,19 +119,3 @@ export async function codexMessages(
   const frames = new SseParser().push(await upstream.text()).map(onEvent).join('');
   answerWhole(res, frames + translator.close(), conn.id);
 }
-
-export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
-  const base = baseFor(tokens, deps);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  if (tokens.method === 'chatgpt') return codexLists.get(`${base}:${tokens.clientId}`, () => listCodex(tokens, `${base}/models`, fetchImpl));
-  const version = await learnCodexVersion();
-  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, `${base}/models?client_version=${version}`, fetchImpl));
-}
-
-async function listCodex(tokens: CodexTokens, url: string, fetchImpl: typeof fetch): Promise<string[]> {
-  const res = await fetchImpl(url, { headers: headersFor(tokens, 'application/json', randomUUID()), redirect: 'manual' });
-  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `OpenAI would not list the models of this ChatGPT plan (${String(res.status)})`);
-  const body: unknown = await res.json();
-  const models: unknown[] = isRecord(body) && Array.isArray(body.models) ? body.models : [];
-  return models.filter(isRecord).flatMap((m) => ((m.visibility ?? 'list') === 'list' && stringOf(m.slug) !== '' ? [stringOf(m.slug)] : []));
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/delivered.ts

@@ -0,0 +1,82 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { isProvider, LOCAL_PREFIX, type Account, type CodexAccess, type Connection, type Fallback, type Provider, type RouteSource } from './model-config.js';
+
+export interface DeliveredRoute {
+  primary: Fallback | null;
+  fallbacks: Fallback[];
+}
+
+export interface Delivered {
+  route: DeliveredRoute | null;
+  source: RouteSource | null;
+  connections: Connection[];
+}
+
+const MAX_FALLBACKS = 8;
+const MAX_CONNECTIONS = 20;
+
+const text = (value: unknown): string => (typeof value === 'string' ? value.trim() : '');
+const maybe = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+function refOf(raw: unknown): Fallback | null {
+  if (!isRecord(raw)) return null;
+  const ref = { connection: text(raw.connection), model: text(raw.model) };
+  return ref.connection === '' ? null : ref;
+}
+
+function routeOf(raw: unknown): DeliveredRoute | null {
+  if (!isRecord(raw)) return null;
+  const fallbacks = Array.isArray(raw.fallbacks) ? raw.fallbacks.flatMap((f: unknown) => refOf(f) ?? []) : [];
+  return { primary: refOf(raw.primary), fallbacks: fallbacks.filter((f) => f.model !== '').slice(0, MAX_FALLBACKS) };
+}
+
+function accountOf(raw: unknown): Account {
+  const account = isRecord(raw) ? raw : {};
+  const method = account.method === 'chatgpt' || account.method === 'code' ? account.method : null;
+  return { email: maybe(account.email), plan: maybe(account.plan), method };
+}
+
+const numberOf = (value: unknown): number => (typeof value === 'number' && Number.isFinite(value) ? value : 0);
+
+function codexOf(raw: Record<string, unknown>): CodexAccess | null {
+  const accessToken = text(raw.accessToken);
+  if (accessToken === '' || (raw.method !== 'chatgpt' && raw.method !== 'code')) return null;
+  return { method: raw.method, accessToken, expiresAt: numberOf(raw.expiresAt), accountId: maybe(raw.accountId) };
+}
+
+function credentialOf(provider: Provider, raw: unknown): { apiKey: string; codex: CodexAccess | null } {
+  if (!isRecord(raw)) return { apiKey: '', codex: null };
+  return provider === 'codex' ? { apiKey: '', codex: codexOf(raw) } : { apiKey: text(raw.apiKey), codex: null };
+}
+
+export function deliveredConnection(raw: unknown): Connection | null {
+  if (!isRecord(raw) || !isProvider(raw.provider)) return null;
+  const id = text(raw.id);
+  if (id === '' || id.startsWith(LOCAL_PREFIX)) return null;
+  const { apiKey, codex } = credentialOf(raw.provider, raw.credential);
+  return {
+    id,
+    provider: raw.provider,
+    label: text(raw.label) === '' ? raw.provider : text(raw.label),
+    model: text(raw.model),
+    apiKey,
+    region: text(raw.region),
+    zdr: raw.zdr === true,
+    revision: numberOf(raw.revision),
+    codex,
+    claude: null,
+    account: accountOf(raw.account),
+    signedOut: codex === null && apiKey === '',
+  };
+}
+
+export function deliveredOf(raw: Record<string, unknown>): Delivered | null {
+  if (!Array.isArray(raw.connections) || (raw.route !== null && !isRecord(raw.route))) return null;
+  const source = raw.source === 'agent' || raw.source === 'organization' ? raw.source : null;
+  const connections = raw.connections.flatMap((c: unknown) => deliveredConnection(c) ?? []).slice(0, MAX_CONNECTIONS);
+  return { route: routeOf(raw.route), source, connections };
+}
+
+export function refreshedConnection(raw: Record<string, unknown>): Connection | null {
+  return deliveredConnection(isRecord(raw.connection) ? raw.connection : raw);
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effective.ts

@@ -0,0 +1,47 @@
+import { log } from '@metro-labs/core/log';
+import { agentsDir } from '../agents/files.js';
+import { claudeLoginsIn, isV2, readModelFile, type ClaudeLogin } from './claude-store.js';
+import type { Delivered } from './delivered.js';
+import { emptySetup, LOCAL_PREFIX, loginConnection, primaryRoute, runnerModel, SESSION_LOGIN, sessionConnection, type Connection, type ModelSetup } from './model-config.js';
+import { v2Setup } from './model-v2.js';
+import { deliveredSetup, type OrgModels } from './org-models.js';
+
+function localOf(id: string, logins: ClaudeLogin[]): Connection | null {
+  if (id === SESSION_LOGIN) return sessionConnection();
+  if (!id.startsWith(LOCAL_PREFIX)) return null;
+  const login = id.slice(LOCAL_PREFIX.length);
+  return loginConnection(login, logins.find((l) => l.id === login));
+}
+
+export function setupOf(delivered: Delivered | null, logins: ClaudeLogin[]): ModelSetup {
+  const route = delivered?.route ?? null;
+  if (delivered === null || route === null) return { ...emptySetup(), source: delivered?.source ?? null };
+  const named = [...(route.primary === null ? [] : [route.primary]), ...route.fallbacks].map((r) => r.connection);
+  const locals = [...new Set(named)].flatMap((id) => localOf(id, logins) ?? []);
+  return { primary: route.primary, fallbacks: route.fallbacks, connections: [...delivered.connections, ...locals], source: delivered.source };
+}
+
+export function effectiveSetup(dir = agentsDir(), delivered: Delivered | null = deliveredSetup()): ModelSetup {
+  const raw = readModelFile(dir);
+  return isV2(raw) ? v2Setup(raw) : setupOf(delivered, claudeLoginsIn(raw));
+}
+
+export function modelViewText(setup: ModelSetup): string | null {
+  const primary = primaryRoute(setup);
+  if (primary === null) return null;
+  const connections = [{ id: primary.connection.id, provider: primary.connection.provider, model: primary.model }];
+  return `${JSON.stringify({ version: 2, route: primary.connection.id, connections }, null, 2)}\n`;
+}
+
+export function watchModelChanges(models: Pick<OrgModels, 'onChange'>, switchModel: (model: string | null) => boolean, setup: () => ModelSetup = effectiveSetup): () => void {
+  let last = runnerModel(setup());
+  const changed = (): void => {
+    const now = runnerModel(setup());
+    if (now === last) return;
+    const was = last;
+    last = now;
+    if (switchModel(now)) log.info({ was, now }, 'org-models: the model changed, so the Agent SDK session switches to it live, with no restart');
+    else log.info({ was, now }, 'org-models: the model changed while no Agent SDK session listens; its next start loads it');
+  };
+  return models.onChange(changed);
+}