@stage-labs/metro 0.1.0-beta.31 → 0.1.0-beta.310

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-stream.ts

@@ -0,0 +1,179 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { encodeSignature } from './codex-translate.js';
+import { errorFrame } from './forward.js';
+import { frame, messageEnd, messageStart, type Usage } from './frames.js';
+import { stringOf } from '@metro-labs/http/api-http';
+
+type Item = Record<string, unknown>;
+
+interface Block {
+  index: number;
+  kind: 'text' | 'thinking' | 'tool_use';
+  deltas: number;
+}
+
+const responseOf = (data: Item): Item => (isRecord(data.response) ? data.response : {});
+const itemOf = (data: Item): Item => (isRecord(data.item) ? data.item : {});
+
+const PLAN_LIMIT = 'subscription_sharing_usage_limit_exceeded';
+const USAGE_URL = 'https://chatgpt.com/settings/usage';
+
+export const withUsageLink = (code: string, message: string): string => (code === PLAN_LIMIT ? `${message} Manage usage: ${USAGE_URL}` : message);
+
+function errorKind(code: string): string {
+  if (code === 'rate_limit_exceeded' || code === 'usage_limit_reached' || code === PLAN_LIMIT) return 'rate_limit_error';
+  if (code === 'context_length_exceeded' || code === 'invalid_prompt') return 'invalid_request_error';
+  if (code === 'insufficient_quota') return 'permission_error';
+  return 'api_error';
+}
+
+function usageOf(response: Item): Usage {
+  const usage = isRecord(response.usage) ? response.usage : {};
+  const details = isRecord(usage.input_tokens_details) ? usage.input_tokens_details : {};
+  const cached = typeof details.cached_tokens === 'number' ? details.cached_tokens : 0;
+  const input = typeof usage.input_tokens === 'number' ? usage.input_tokens : 0;
+  return {
+    input_tokens: Math.max(0, input - cached),
+    output_tokens: typeof usage.output_tokens === 'number' ? usage.output_tokens : 0,
+    cache_read_input_tokens: cached,
+  };
+}
+
+const startBlock = (kind: Block['kind'], id: string, name: string): Item =>
+  kind === 'text' ? { type: 'text', text: '' } : kind === 'thinking' ? { type: 'thinking', thinking: '' } : { type: 'tool_use', id, name, input: {} };
+
+const messageText = (item: Item): string =>
+  Array.isArray(item.content) ? item.content.filter(isRecord).map((part) => stringOf(part.text)).join('') : '';
+
+export class CodexEventTranslator {
+  private readonly blocks = new Map<string, Block>();
+  private next = 0;
+  private started = false;
+  private toolCalls = 0;
+  private done = false;
+  private readonly model: string;
+  private readonly restore: (name: string) => string;
+  private readonly handlers: Record<string, (data: Item) => string> = {
+    'response.created': (d) => this.start(responseOf(d)),
+    'response.output_item.added': (d) => this.start({}) + this.itemAdded(itemOf(d)),
+    'response.output_text.delta': (d) => this.delta(stringOf(d.item_id), 'text', stringOf(d.delta)),
+    'response.reasoning_summary_text.delta': (d) => this.delta(stringOf(d.item_id), 'thinking', stringOf(d.delta)),
+    'response.reasoning_summary_part.added': (d) => this.partAdded(stringOf(d.item_id)),
+    'response.function_call_arguments.delta': (d) => this.delta(stringOf(d.item_id), 'tool_use', stringOf(d.delta)),
+    'response.output_item.done': (d) => this.itemDone(itemOf(d)),
+    'response.completed': (d) => this.start(responseOf(d)) + this.completed(responseOf(d)),
+    'response.failed': (d) => this.failed(responseOf(d), 'Codex failed the response'),
+    'response.incomplete': (d) => this.incomplete(responseOf(d)),
+    error: (d) => this.failed({ error: d }, 'Codex stream error'),
+  };
+
+  constructor(model: string, restore: (name: string) => string = (name) => name) {
+    this.model = model;
+    this.restore = restore;
+  }
+
+  get finished(): boolean {
+    return this.done;
+  }
+
+  private open(key: string, kind: Block['kind'], id = '', name = ''): string {
+    const block: Block = { index: this.next, kind, deltas: 0 };
+    this.next += 1;
+    this.blocks.set(key, block);
+    return frame('content_block_start', { type: 'content_block_start', index: block.index, content_block: startBlock(kind, id, name) });
+  }
+
+  private start(response: Item): string {
+    if (this.started) return '';
+    this.started = true;
+    return messageStart(stringOf(response.id) || 'msg_codex', this.model);
+  }
+
+  private openCall(key: string, item: Item): string {
+    this.toolCalls += 1;
+    return this.open(key, 'tool_use', stringOf(item.call_id) || key, this.restore(stringOf(item.name)));
+  }
+
+  private itemAdded(item: Item): string {
+    const key = stringOf(item.id) || String(this.next);
+    if (item.type === 'function_call') return this.openCall(key, item);
+    if (item.type === 'reasoning') return this.open(key, 'thinking');
+    return '';
+  }
+
+  private partAdded(key: string): string {
+    const block = this.blocks.get(key);
+    return block !== undefined && block.deltas > 0 ? this.delta(key, 'thinking', '\n\n') : '';
+  }
+
+  private delta(key: string, kind: Block['kind'], text: string): string {
+    const opened = this.blocks.has(key) ? '' : this.open(key, kind);
+    const block = this.blocks.get(key);
+    if (block === undefined) return opened;
+    block.deltas += 1;
+    const delta =
+      kind === 'tool_use' ? { type: 'input_json_delta', partial_json: text } : kind === 'text' ? { type: 'text_delta', text } : { type: 'thinking_delta', thinking: text };
+    return opened + frame('content_block_delta', { type: 'content_block_delta', index: block.index, delta });
+  }
+
+  private stop(key: string): string {
+    const block = this.blocks.get(key);
+    if (block === undefined) return '';
+    this.blocks.delete(key);
+    return frame('content_block_stop', { type: 'content_block_stop', index: block.index });
+  }
+
+  private reasoningDone(key: string, item: Item): string {
+    const opened = this.blocks.has(key) ? '' : this.open(key, 'thinking');
+    const block = this.blocks.get(key);
+    if (block === undefined || typeof item.encrypted_content !== 'string') return opened + this.stop(key);
+    const signature = encodeSignature({ id: key, encrypted_content: item.encrypted_content });
+    return opened + frame('content_block_delta', { type: 'content_block_delta', index: block.index, delta: { type: 'signature_delta', signature } }) + this.stop(key);
+  }
+
+  private callDone(key: string, item: Item): string {
+    let out = this.blocks.has(key) ? '' : this.openCall(key, item);
+    if (this.blocks.get(key)?.deltas === 0 && stringOf(item.arguments) !== '') out += this.delta(key, 'tool_use', stringOf(item.arguments));
+    return out + this.stop(key);
+  }
+
+  private itemDone(item: Item): string {
+    const key = stringOf(item.id);
+    if (item.type === 'reasoning') return this.reasoningDone(key, item);
+    if (item.type === 'function_call') return this.callDone(key, item);
+    if (item.type === 'message' && !this.blocks.has(key) && messageText(item) !== '') return this.delta(key, 'text', messageText(item)) + this.stop(key);
+    return this.stop(key);
+  }
+
+  private completed(response: Item, forced: string | null = null): string {
+    this.done = true;
+    let out = '';
+    for (const key of [...this.blocks.keys()]) out += this.stop(key);
+    const stop = forced ?? (this.toolCalls > 0 ? 'tool_use' : 'end_turn');
+    return out + messageEnd(stop, usageOf(response));
+  }
+
+  private incomplete(response: Item): string {
+    const details = isRecord(response.incomplete_details) ? response.incomplete_details : {};
+    if (details.reason === 'max_output_tokens') return this.start(response) + this.completed(response, 'max_tokens');
+    return this.failed(response, `Codex left the response incomplete (${stringOf(details.reason) || 'no reason given'})`);
+  }
+
+  private failed(response: Item, fallback: string): string {
+    this.done = true;
+    const error = isRecord(response.error) ? response.error : {};
+    const code = stringOf(error.code);
+    return errorFrame(errorKind(code), withUsageLink(code, stringOf(error.message) || fallback));
+  }
+
+  push(event: string, data: Item): string {
+    const handler = this.handlers[event];
+    return handler === undefined ? '' : handler(data);
+  }
+
+  close(message = 'Codex ended the stream before completing the response'): string {
+    if (this.done) return '';
+    this.done = true;
+    return errorFrame('api_error', message);
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-translate.ts

@@ -0,0 +1,209 @@
+import { createHash } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { inlineImage, partText, resultImages, resultParts, resultText, TOOL_ERROR, type InlineImage } from './text.js';
+import { stringOf } from '@metro-labs/http/api-http';
+
+const SIGNATURE_PREFIX = 'metro-codex:';
+const DEFAULT_EFFORT = 'medium';
+const EFFORTS = new Set(['minimal', 'low', 'medium', 'high', 'xhigh']);
+const EFFORT_ALIAS: Record<string, string> = { max: 'xhigh' };
+const NAME_MAX = 64;
+const NAME_RE = /^[a-zA-Z0-9_-]+$/;
+const HASH_LEN = 8;
+
+type Item = Record<string, unknown>;
+
+export interface TranslateOptions {
+  promptCacheKey: string;
+  names?: ToolNames;
+}
+
+export interface ResponsesRequest {
+  model: string;
+  instructions?: string;
+  input: Item[];
+  tools: Item[];
+  tool_choice: unknown;
+  parallel_tool_calls: boolean;
+  reasoning: { effort: string; summary: string };
+  store: false;
+  stream: true;
+  include: string[];
+  prompt_cache_key: string;
+}
+
+
+export function codexToolName(name: string): string {
+  if (name.length <= NAME_MAX && NAME_RE.test(name)) return name;
+  const clean = name.replace(/[^a-zA-Z0-9_-]/g, '_');
+  const hash = createHash('sha256').update(name).digest('hex').slice(0, HASH_LEN);
+  return `${clean.slice(0, NAME_MAX - HASH_LEN - 1)}_${hash}`;
+}
+
+export class ToolNames {
+  private readonly original = new Map<string, string>();
+
+  alias(name: string): string {
+    const alias = codexToolName(name);
+    if (alias !== name) this.original.set(alias, name);
+    return alias;
+  }
+
+  restore(alias: string): string {
+    return this.original.get(alias) ?? alias;
+  }
+}
+
+function blocksText(content: unknown): string {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  return content
+    .filter(isRecord)
+    .filter((block) => block.type === 'text')
+    .map((block) => stringOf(block.text))
+    .join('\n');
+}
+
+export function systemText(system: unknown): string {
+  return blocksText(system).trim();
+}
+
+export function encodeSignature(item: Item): string {
+  return `${SIGNATURE_PREFIX}${Buffer.from(JSON.stringify(item)).toString('base64url')}`;
+}
+
+export function decodeSignature(signature: unknown): Item | null {
+  if (typeof signature !== 'string' || !signature.startsWith(SIGNATURE_PREFIX)) return null;
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(signature.slice(SIGNATURE_PREFIX.length), 'base64url').toString('utf8'));
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+const imagePart = (image: InlineImage): Item => ({ type: 'input_image', image_url: `data:${image.mediaType};base64,${image.data}` });
+
+function userPart(block: Item): Item | null {
+  if (block.type === 'text') return { type: 'input_text', text: stringOf(block.text) };
+  const image = inlineImage(block);
+  return image === null ? null : imagePart(image);
+}
+
+function outputPart(part: Item): Item | null {
+  const image = inlineImage(part);
+  if (image !== null) return imagePart(image);
+  const text = partText(part);
+  return text === '' ? null : { type: 'input_text', text };
+}
+
+function toolOutput(block: Item): string | Item[] {
+  if (resultImages(block).length === 0) return resultText(block);
+  const parts = resultParts(block).map(outputPart).filter((part): part is Item => part !== null);
+  return block.is_error === true ? [{ type: 'input_text', text: TOOL_ERROR }, ...parts] : parts;
+}
+
+function userItems(content: unknown): Item[] {
+  if (typeof content === 'string') return [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: content }] }];
+  if (!Array.isArray(content)) return [];
+  const out: Item[] = [];
+  let parts: Item[] = [];
+  const flush = (): void => {
+    if (parts.length > 0) out.push({ type: 'message', role: 'user', content: parts });
+    parts = [];
+  };
+  for (const block of content.filter(isRecord)) {
+    if (block.type === 'tool_result') {
+      flush();
+      out.push({ type: 'function_call_output', call_id: stringOf(block.tool_use_id), output: toolOutput(block) });
+      continue;
+    }
+    const part = userPart(block);
+    if (part !== null) parts.push(part);
+  }
+  flush();
+  return out;
+}
+
+function assistantItems(content: unknown, names: ToolNames): Item[] {
+  if (typeof content === 'string') return [{ type: 'message', role: 'assistant', content: [{ type: 'output_text', text: content }] }];
+  if (!Array.isArray(content)) return [];
+  const out: Item[] = [];
+  for (const block of content.filter(isRecord)) {
+    if (block.type === 'text') out.push({ type: 'message', role: 'assistant', content: [{ type: 'output_text', text: stringOf(block.text) }] });
+    else if (block.type === 'tool_use')
+      out.push({ type: 'function_call', call_id: stringOf(block.id), name: names.alias(stringOf(block.name)), arguments: JSON.stringify(block.input ?? {}) });
+    else if (block.type === 'thinking') {
+      const reasoning = decodeSignature(block.signature);
+      if (reasoning !== null) out.push({ type: 'reasoning', ...reasoning, summary: [] });
+    }
+  }
+  return out;
+}
+
+export function inputItems(messages: unknown, names = new ToolNames()): Item[] {
+  const out: Item[] = [];
+  if (!Array.isArray(messages)) return out;
+  for (const message of messages.filter(isRecord)) {
+    if (message.role === 'assistant') out.push(...assistantItems(message.content, names));
+    else out.push(...userItems(message.content));
+  }
+  return out;
+}
+
+export function toolItems(tools: unknown, names = new ToolNames()): Item[] {
+  if (!Array.isArray(tools)) return [];
+  return tools
+    .filter(isRecord)
+    .filter((tool) => typeof tool.name === 'string' && isRecord(tool.input_schema))
+    .map((tool) => ({
+      type: 'function',
+      name: names.alias(stringOf(tool.name)),
+      description: stringOf(tool.description),
+      parameters: tool.input_schema,
+      strict: false,
+    }));
+}
+
+export function toolChoiceOf(choice: unknown, names = new ToolNames()): unknown {
+  if (!isRecord(choice)) return 'auto';
+  if (choice.type === 'any') return 'required';
+  if (choice.type === 'none') return 'none';
+  if (choice.type === 'tool' && typeof choice.name === 'string') return { type: 'function', name: names.alias(choice.name) };
+  return 'auto';
+}
+
+function configuredEffort(body: Item): string | null {
+  const config = isRecord(body.output_config) ? body.output_config : {};
+  const effort = typeof config.effort === 'string' ? (EFFORT_ALIAS[config.effort] ?? config.effort) : '';
+  return EFFORTS.has(effort) ? effort : null;
+}
+
+export function effortOf(body: Item): string {
+  const configured = configuredEffort(body);
+  if (configured !== null) return configured;
+  const thinking = isRecord(body.thinking) ? body.thinking : {};
+  if (thinking.type === 'disabled') return 'low';
+  const budget = typeof thinking.budget_tokens === 'number' ? thinking.budget_tokens : 0;
+  if (budget > 0 && budget <= 4_000) return 'low';
+  if (budget > 16_000) return 'high';
+  return DEFAULT_EFFORT;
+}
+
+export function toResponsesRequest(body: Item, model: string, opts: TranslateOptions): ResponsesRequest {
+  const system = systemText(body.system);
+  const names = opts.names ?? new ToolNames();
+  return {
+    model,
+    ...(system === '' ? {} : { instructions: system }),
+    input: inputItems(body.messages, names),
+    tools: toolItems(body.tools, names),
+    tool_choice: toolChoiceOf(body.tool_choice, names),
+    parallel_tool_calls: true,
+    reasoning: { effort: effortOf(body), summary: 'auto' },
+    store: false,
+    stream: true,
+    include: ['reasoning.encrypted_content'],
+    prompt_cache_key: opts.promptCacheKey,
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-version.ts

@@ -0,0 +1,44 @@
+import { errMsg, log } from '@metro-labs/core/log';
+
+const BUILT_IN = '0.157.1';
+const REGISTRY = 'https://registry.npmjs.org/@openai/codex/latest';
+const OVERRIDE_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
+const STABLE_RE = /^\d+\.\d+\.\d+$/;
+const FRESH_MS = 6 * 3_600_000;
+const FETCH_MS = 5_000;
+
+let learned: { version: string; at: number } | null = null;
+
+const parts = (version: string): number[] => version.split('.').map(Number);
+
+function newer(a: string, b: string): boolean {
+  const [x, y] = [parts(a), parts(b)];
+  for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) > (y[i] ?? 0);
+  return false;
+}
+
+export function codexVersion(): string {
+  const wanted = process.env.METRO_CODEX_VERSION?.trim() ?? '';
+  if (wanted !== '' && OVERRIDE_RE.test(wanted)) return wanted;
+  if (wanted !== '') log.warn({ value: wanted }, 'gateway: METRO_CODEX_VERSION is not a version like 0.157.1; using the known one');
+  return learned !== null && newer(learned.version, BUILT_IN) ? learned.version : BUILT_IN;
+}
+
+async function latestOnNpm(): Promise<string> {
+  const res = await fetch(process.env.METRO_CODEX_REGISTRY ?? REGISTRY, { signal: AbortSignal.timeout(FETCH_MS) });
+  const body: unknown = await res.json();
+  const version = typeof body === 'object' && body !== null ? (body as { version?: unknown }).version : undefined;
+  if (!res.ok || typeof version !== 'string' || !STABLE_RE.test(version)) throw new Error(`npm answered ${String(res.status)} without a stable version`);
+  return version;
+}
+
+export async function learnCodexVersion(now = Date.now()): Promise<string> {
+  if (learned !== null && now - learned.at < FRESH_MS) return codexVersion();
+  try {
+    learned = { version: await latestOnNpm(), at: now };
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'gateway: the latest Codex version could not be read from npm; using the known one');
+    learned = { version: learned?.version ?? BUILT_IN, at: now };
+  }
+  return codexVersion();
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -0,0 +1,121 @@
+import { randomUUID } from 'node:crypto';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { arch, platform, release } from 'node:os';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { stringOf } from '@metro-labs/http/api-http';
+import { codexVersion, learnCodexVersion } from './codex-version.js';
+import { CodexEventTranslator, withUsageLink } from './codex-stream.js';
+import { ToolNames, toResponsesRequest } from './codex-translate.js';
+import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
+import { parseEvent, SseParser, type SseEvent } from './frames.js';
+import { CODEX_SIGN_IN, type CodexAccess, type Connection } from './model-config.js';
+import { answerWhole, errorKind, relayTranslated, sessionHeader } from './subscription.js';
+import { noteUsageHeaders } from './usage.js';
+
+const CODEX_BACKEND = 'https://chatgpt.com/backend-api/codex';
+const OPENAI_API = 'https://api.openai.com/v1';
+const INVALID = [400, 404, 422];
+const RENEW_FAILED = "Codex refused its sign-in and api.metro.box could not renew it: sign in again on the organization's Models page.";
+
+export interface CodexDeps {
+  base?: string;
+  fetchImpl?: typeof fetch;
+  refresh: (conn: Connection) => Promise<Connection | null>;
+}
+
+const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
+
+export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
+
+const baseFor = (access: CodexAccess, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (access.method === 'code' ? CODEX_BACKEND : OPENAI_API);
+
+function headersFor(access: CodexAccess, sessionId: string): Record<string, string> {
+  const plain = { authorization: `Bearer ${access.accessToken}`, 'content-type': 'application/json', accept: 'text/event-stream' };
+  if (access.method === 'chatgpt') return plain;
+  return {
+    ...plain,
+    'chatgpt-account-id': access.accountId ?? '',
+    originator: 'codex_cli_rs',
+    'user-agent': userAgent(),
+    'openai-beta': 'responses=experimental',
+    'session-id': sessionId,
+  };
+}
+
+interface Call {
+  body: Record<string, unknown>;
+  model: string;
+  sessionId: string;
+  watch: Watch;
+  deps: CodexDeps;
+  names: ToolNames;
+}
+
+function send(call: Call, access: CodexAccess): Promise<Response> {
+  const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
+  return (call.deps.fetchImpl ?? fetch)(`${baseFor(access, call.deps)}/responses`, {
+    method: 'POST',
+    headers: headersFor(access, call.sessionId),
+    body: JSON.stringify(request),
+    signal: call.watch.signal,
+    redirect: 'manual',
+  });
+}
+
+function refusalOf(text: string, status: number): string {
+  let code = '';
+  try {
+    const parsed: unknown = JSON.parse(text);
+    code = isRecord(parsed) && isRecord(parsed.error) ? stringOf(parsed.error.code) : '';
+  } catch {
+    code = '';
+  }
+  return withUsageLink(code, upstreamMessage(text, `OpenAI answered ${String(status)}`));
+}
+
+let learning: Promise<unknown> | null = null;
+
+function learnVersion(access: CodexAccess): void {
+  if (access.method !== 'code' || learning !== null) return;
+  learning = learnCodexVersion()
+    .catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'gateway: the latest Codex version could not be learned');
+    })
+    .finally(() => {
+      learning = null;
+    });
+}
+
+async function reach(call: Call, conn: Connection): Promise<Response> {
+  if (conn.codex === null) throw new GatewayError(400, 'invalid_request_error', CODEX_SIGN_IN);
+  learnVersion(conn.codex);
+  const upstream = await send(call, conn.codex);
+  if (upstream.status !== 401) return upstream;
+  await upstream.body?.cancel();
+  const fresh = await call.deps.refresh(conn);
+  if (fresh?.codex === null || fresh?.codex === undefined) throw new GatewayError(403, 'permission_error', RENEW_FAILED);
+  return send(call, fresh.codex);
+}
+
+export async function codexMessages(req: IncomingMessage, res: ServerResponse, body: Record<string, unknown>, model: string, conn: Connection, deps: CodexDeps, watch: Watch): Promise<void> {
+  const call: Call = { body, model, sessionId: sessionHeader(req) || randomUUID(), watch, deps, names: new ToolNames() };
+  const upstream = await reach(call, conn);
+  noteUsageHeaders('codex', conn.id, upstream.headers);
+  if (!upstream.ok) {
+    const text = await upstream.text();
+    sendError(res, providerStatus(upstream.status), errorKind(upstream.status, INVALID), refusalOf(text, upstream.status));
+    return;
+  }
+  const translator = new CodexEventTranslator(model, (name) => call.names.restore(name));
+  const onEvent = (raw: SseEvent): string => {
+    const parsed = parseEvent(raw);
+    return parsed === null ? '' : translator.push(parsed.event, parsed.data);
+  };
+  if (body.stream === true) {
+    await relayTranslated(upstream, res, watch, conn.id, translator, onEvent);
+    return;
+  }
+  const frames = new SseParser().push(await upstream.text()).map(onEvent).join('');
+  answerWhole(res, frames + translator.close(), conn.id);
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/delivered.ts

@@ -0,0 +1,82 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { isProvider, LOCAL_PREFIX, type Account, type CodexAccess, type Connection, type Fallback, type Provider, type RouteSource } from './model-config.js';
+
+export interface DeliveredRoute {
+  primary: Fallback | null;
+  fallbacks: Fallback[];
+}
+
+export interface Delivered {
+  route: DeliveredRoute | null;
+  source: RouteSource | null;
+  connections: Connection[];
+}
+
+const MAX_FALLBACKS = 8;
+const MAX_CONNECTIONS = 20;
+
+const text = (value: unknown): string => (typeof value === 'string' ? value.trim() : '');
+const maybe = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+function refOf(raw: unknown): Fallback | null {
+  if (!isRecord(raw)) return null;
+  const ref = { connection: text(raw.connection), model: text(raw.model) };
+  return ref.connection === '' ? null : ref;
+}
+
+function routeOf(raw: unknown): DeliveredRoute | null {
+  if (!isRecord(raw)) return null;
+  const fallbacks = Array.isArray(raw.fallbacks) ? raw.fallbacks.flatMap((f: unknown) => refOf(f) ?? []) : [];
+  return { primary: refOf(raw.primary), fallbacks: fallbacks.filter((f) => f.model !== '' || f.connection.startsWith(LOCAL_PREFIX)).slice(0, MAX_FALLBACKS) };
+}
+
+function accountOf(raw: unknown): Account {
+  const account = isRecord(raw) ? raw : {};
+  const method = account.method === 'chatgpt' || account.method === 'code' ? account.method : null;
+  return { email: maybe(account.email), plan: maybe(account.plan), method };
+}
+
+const numberOf = (value: unknown): number => (typeof value === 'number' && Number.isFinite(value) ? value : 0);
+
+function codexOf(raw: Record<string, unknown>): CodexAccess | null {
+  const accessToken = text(raw.accessToken);
+  if (accessToken === '' || (raw.method !== 'chatgpt' && raw.method !== 'code')) return null;
+  return { method: raw.method, accessToken, expiresAt: numberOf(raw.expiresAt), accountId: maybe(raw.accountId) };
+}
+
+function credentialOf(provider: Provider, raw: unknown): { apiKey: string; codex: CodexAccess | null } {
+  if (!isRecord(raw)) return { apiKey: '', codex: null };
+  return provider === 'codex' ? { apiKey: '', codex: codexOf(raw) } : { apiKey: text(raw.apiKey), codex: null };
+}
+
+export function deliveredConnection(raw: unknown): Connection | null {
+  if (!isRecord(raw) || !isProvider(raw.provider)) return null;
+  const id = text(raw.id);
+  if (id === '' || id.startsWith(LOCAL_PREFIX)) return null;
+  const { apiKey, codex } = credentialOf(raw.provider, raw.credential);
+  return {
+    id,
+    provider: raw.provider,
+    label: text(raw.label) === '' ? raw.provider : text(raw.label),
+    model: text(raw.model),
+    apiKey,
+    region: text(raw.region),
+    zdr: raw.zdr === true,
+    revision: numberOf(raw.revision),
+    codex,
+    claude: null,
+    account: accountOf(raw.account),
+    signedOut: codex === null && apiKey === '',
+  };
+}
+
+export function deliveredOf(raw: Record<string, unknown>): Delivered | null {
+  if (!Array.isArray(raw.connections) || (raw.route !== null && !isRecord(raw.route))) return null;
+  const source = raw.source === 'agent' || raw.source === 'organization' ? raw.source : null;
+  const connections = raw.connections.flatMap((c: unknown) => deliveredConnection(c) ?? []).slice(0, MAX_CONNECTIONS);
+  return { route: routeOf(raw.route), source, connections };
+}
+
+export function refreshedConnection(raw: Record<string, unknown>): Connection | null {
+  return deliveredConnection(isRecord(raw.connection) ? raw.connection : raw);
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effective.ts

@@ -0,0 +1,43 @@
+import { log } from '@metro-labs/core/log';
+import { agentsDir } from '../agents/files.js';
+import { readClaudeLogins, type ClaudeLogin } from './claude-store.js';
+import type { Delivered } from './delivered.js';
+import { emptySetup, LOCAL_PREFIX, loginConnection, primaryRoute, runnerModel, SESSION_LOGIN, sessionConnection, type Connection, type ModelSetup } from './model-config.js';
+import { deliveredSetup, type OrgModels } from './org-models.js';
+
+function localOf(id: string, logins: ClaudeLogin[]): Connection | null {
+  if (id === SESSION_LOGIN) return sessionConnection();
+  if (!id.startsWith(LOCAL_PREFIX)) return null;
+  const login = id.slice(LOCAL_PREFIX.length);
+  return loginConnection(login, logins.find((l) => l.id === login));
+}
+
+export function setupOf(delivered: Delivered | null, logins: ClaudeLogin[]): ModelSetup {
+  const route = delivered?.route ?? null;
+  if (delivered === null || route === null) return { ...emptySetup(), source: delivered?.source ?? null };
+  const named = [...(route.primary === null ? [] : [route.primary]), ...route.fallbacks].map((r) => r.connection);
+  const locals = [...new Set(named)].flatMap((id) => localOf(id, logins) ?? []);
+  return { primary: route.primary, fallbacks: route.fallbacks, connections: [...delivered.connections, ...locals], source: delivered.source };
+}
+
+export const effectiveSetup = (dir = agentsDir(), delivered: Delivered | null = deliveredSetup()): ModelSetup => setupOf(delivered, readClaudeLogins(dir));
+
+export function modelViewText(setup: ModelSetup): string | null {
+  const primary = primaryRoute(setup);
+  if (primary === null) return null;
+  const connections = [{ id: primary.connection.id, provider: primary.connection.provider, model: primary.model }];
+  return `${JSON.stringify({ version: 2, route: primary.connection.id, connections }, null, 2)}\n`;
+}
+
+export function watchModelChanges(models: Pick<OrgModels, 'onChange'>, switchModel: (model: string | null) => boolean, setup: () => ModelSetup = effectiveSetup): () => void {
+  let last = runnerModel(setup());
+  const changed = (): void => {
+    const now = runnerModel(setup());
+    if (now === last) return;
+    const was = last;
+    last = now;
+    if (switchModel(now)) log.info({ was, now }, 'org-models: the model changed, so the Agent SDK session switches to it live, with no restart');
+    else log.info({ was, now }, 'org-models: the model changed while no Agent SDK session listens; its next start loads it');
+  };
+  return models.onChange(changed);
+}