@stage-labs/metro 0.1.0-beta.310 → 0.1.0-beta.311

package/dist/claude-env.js

@@ -89,7 +89,7 @@ function gatewayLaunchEnv(key, port, claude, say) {
         say('MCP tool search is on, so connector tools load when Claude needs them instead of all at start');
     const env = credentialEnv(routed, key, claudeSignedIn(claude));
     if (env !== routed)
-        say("Claude Code has no login of its own here, so metro's key stands in as its credential; the Model page must route to Bedrock, OpenRouter or Codex");
+        say("Claude Code has no login of its own here, so metro's key stands in as its credential; the organization's Models page decides where requests go");
     return env;
 }
 export async function headlessEnv(claude, command) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.310",
+  "version": "0.1.0-beta.311",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/core/package.json

@@ -18,6 +18,7 @@
     "./train-error": "./src/train-error.ts",
     "./trains/protocol": "./src/protocol.ts",
     "./ids": "./src/ids.ts",
+    "./claude-token": "./src/claude-token.ts",
     "./tickets": "./src/tickets.ts",
     "./station-names": "./src/station-names.ts",
     "./str": "./src/str.ts",

package/runtime/node_modules/@metro-labs/core/src/claude-token.ts

@@ -0,0 +1,3 @@
+const TOKEN_RE = /^sk-ant-oat01-[A-Za-z0-9_-]{32,512}$/;
+
+export const isClaudeToken = (value: string): boolean => TOKEN_RE.test(value);

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -40,7 +40,7 @@ function agentFile(dir: string): string | null {
   return json({ version: 1, id: file.id, key: file.key });
 }
 
-export function viewFiles(dir = agentsDir(), model: () => string | null = () => modelViewText(effectiveSetup(dir))): Map<string, string | null> {
+export function viewFiles(dir = agentsDir(), model: () => string | null = () => modelViewText(effectiveSetup())): Map<string, string | null> {
   const files = new Map<string, string | null>([
     ['agent.json', agentFile(dir)],
     ['model.json', model()],

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -62,7 +62,6 @@ import { startCloudWatchPublisher } from '../server/cloudwatch.js';
 import { watchFallbackUsage } from '../gateway/usage-refresh.js';
 import { startOrgModels, stopOrgModels } from '../gateway/org-models.js';
 import { effectiveSetup, watchModelChanges } from '../gateway/effective.js';
-import { readClaudeLogins, retireV2ModelFile } from '../gateway/claude-store.js';
 import { removeModelLeftovers } from '../gateway/model-leftovers.js';
 import { readAgentKey } from '../connectors/agent-key.js';
 import { METRO_API } from '../connectors/metro-api.js';
@@ -146,7 +145,6 @@ function sessionApis(setLiveEvents: (on: boolean) => void): SessionApis {
 async function main(): Promise<void> {
   removeConnectorLeftovers();
   removeModelLeftovers();
-  retireV2ModelFile();
   applyLocalOwner();
 installBearerSessions(agentsDir(), localOwner);
   watchPolicySnapshot();
@@ -183,7 +181,7 @@ installBearerSessions(agentsDir(), localOwner);
   });
   watchConnectorTools();
   startCloudWatchPublisher();
-  watchFallbackUsage(() => effectiveSetup(), () => readClaudeLogins());
+  watchFallbackUsage(() => effectiveSetup());
   announceLocalEndpoint();
   tunnel?.start();
   log.info(

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -13,17 +13,6 @@ import {
   readClaudeSkill,
   writeClaudeSkill,
 } from './skills.js';
-import {
-  answerClaudeLogin,
-  claudeAccount,
-  claudeInstalled,
-  claudeLoginView,
-  endClaudeLogin,
-  startClaudeLogin,
-  type LoginDeps,
-  type LoginTarget,
-} from './login.js';
-import { claudeLoginTarget, type ClaudeLoginDeps } from '../gateway/claude-logins.js';
 import { setupAnswer, type SetupApiDeps } from './setup-api.js';
 import {
   autostartEnabled,
@@ -58,8 +47,6 @@ const PAGE_MAX = 500;
 
 export interface ClaudeApiDeps extends SetupApiDeps {
   dir?: () => string;
-  login?: LoginDeps;
-  claudeLogins?: ClaudeLoginDeps;
   skillSource?: GitHubSkills;
 }
 
@@ -133,8 +120,7 @@ async function created(req: IncomingMessage, path: string, dir: string): Promise
   return createClaudeSkill(body.name, typeof body.text === 'string' ? body.text : undefined, dir);
 }
 
-const ADMIN_ONLY = /^\/api\/claude\/(login|session|setup|skill-source)(\/|$)/;
-const LOGIN = 'login';
+const ADMIN_ONLY = /^\/api\/claude\/(session|setup|skill-source)(\/|$)/;
 const SESSION = 'session';
 const SETUP = 'setup';
 
@@ -166,26 +152,6 @@ async function sessionAnswer(req: IncomingMessage, deps: ClaudeApiDeps): Promise
   return sessionCommand(body, session);
 }
 
-function loginTarget(req: IncomingMessage, deps: ClaudeApiDeps): LoginTarget | null {
-  const asked = new URL(req.url ?? '', 'http://metro').searchParams.get('connection');
-  return asked === null ? null : claudeLoginTarget(asked, deps.claudeLogins);
-}
-
-async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
-  const method = req.method ?? 'GET';
-  if (id === '') {
-    if (method === 'POST') return startClaudeLogin(deps.login, Date.now(), loginTarget(req, deps));
-    if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
-    throw new ApiError('method not allowed', 405);
-  }
-  if (method === 'GET') return claudeLoginView(id);
-  if (method === 'DELETE') return endClaudeLogin(id);
-  if (method !== 'POST') throw new ApiError('method not allowed', 405);
-  const body = await readJsonBody(req);
-  if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
-  return answerClaudeLogin(id, body.text);
-}
-
 function removed(rest: string[], query: URLSearchParams, dir: string): unknown {
   const [head = '', item = ''] = rest;
   if (rest.length !== 2) throw new ApiError('method not allowed', 405);
@@ -236,7 +202,6 @@ function fileAnswer(req: IncomingMessage, path: string, search: string, dir: str
 function routed(req: IncomingMessage, path: string, search: string, deps: ClaudeApiDeps): unknown {
   const dir = (deps.dir ?? claudeDir)();
   const [head = '', item = ''] = parts(path);
-  if (head === LOGIN) return loginAnswer(req, item, deps);
   if (head === 'skill-source' && parts(path).length === 1) return githubSkillsAnswer(req, deps.skillSource);
   if (head === 'skills') return skillsAnswer(req, path, search, dir, sourceOf(deps));
   const single = item === '' ? SINGLETONS[head] : undefined;

package/runtime/node_modules/@metro-labs/daemon/src/claude/session.ts

@@ -13,7 +13,6 @@ import { METRO_VERSION } from '@metro-labs/core/version';
 import { agentsDir, listAgentFiles } from '../agents/files.js';
 import { notReady, primaryRoute, type ModelSetup } from '../gateway/model-config.js';
 import { effectiveSetup } from '../gateway/effective.js';
-import { claudeAccount, claudeInstalled, forgetClaudeChecks } from './login.js';
 import { inSessionScope } from './memory.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { agentExtraEnv, agentUser, agentUserExpected, agentViewDir, asAgent, claudeHome } from '../agent-user/user.js';
@@ -38,7 +37,6 @@ export interface SessionDeps {
   metro?: string[];
   home?: string;
   agents?: string;
-  signedIn?: () => boolean;
   model?: () => ModelSetup;
   now?: () => number;
   version?: string;
@@ -122,30 +120,23 @@ export function prepareRunnerStore(): Promise<void> {
     child.stderr.on('data', (chunk: Buffer) => {
       said = (said + chunk.toString('utf8')).slice(-2000);
     });
-    child.on('error', (err) => {
-      forgetClaudeChecks();
-      reject(err);
-    });
+    child.on('error', reject);
     child.on('close', (code) => {
-      forgetClaudeChecks();
       if (code === 0) resolve();
       else reject(new Error(`metro agent --prepare failed: ${said.trim() || `exit ${String(code)}`}`));
     });
   });
 }
 
-const loginNotRuledOut = (): boolean => claudeAccount().signedIn || !claudeInstalled();
+const NO_MODEL = "the organization routes this agent to no model yet: choose one on the organization's Models page";
 
 function credentialReady(deps: SessionDeps): string | null {
-  const signedIn = deps.signedIn ?? loginNotRuledOut;
-  if (signedIn()) return null;
   try {
-    const primary = primaryRoute((deps.model ?? (() => effectiveSetup(deps.agents ?? agentsDir())))());
-    if (primary !== null && notReady(primary) === null && (primary.connection.provider !== 'anthropic' || primary.connection.apiKey !== '')) return null;
+    const primary = primaryRoute((deps.model ?? (() => effectiveSetup()))());
+    return primary === null ? NO_MODEL : notReady(primary);
   } catch (err) {
     return `the model setup is not readable (${errMsg(err)})`;
   }
-  return 'Claude Code is not signed in and the organization routes this agent to no model yet';
 }
 
 const agentUserMissing = (deps: SessionDeps): boolean =>

package/runtime/node_modules/@metro-labs/daemon/src/gateway/delivered.ts

@@ -1,5 +1,5 @@
 import { isRecord } from '@metro-labs/core/is-record';
-import { isProvider, LOCAL_PREFIX, type Account, type CodexAccess, type Connection, type Fallback, type Provider, type RouteSource } from './model-config.js';
+import { isProvider, type Account, type CodexAccess, type Connection, type Fallback, type Provider, type RouteSource } from './model-config.js';
 
 export interface DeliveredRoute {
   primary: Fallback | null;
@@ -27,7 +27,7 @@ function refOf(raw: unknown): Fallback | null {
 function routeOf(raw: unknown): DeliveredRoute | null {
   if (!isRecord(raw)) return null;
   const fallbacks = Array.isArray(raw.fallbacks) ? raw.fallbacks.flatMap((f: unknown) => refOf(f) ?? []) : [];
-  return { primary: refOf(raw.primary), fallbacks: fallbacks.filter((f) => f.model !== '' || f.connection.startsWith(LOCAL_PREFIX)).slice(0, MAX_FALLBACKS) };
+  return { primary: refOf(raw.primary), fallbacks: fallbacks.filter((f) => f.model !== '').slice(0, MAX_FALLBACKS) };
 }
 
 function accountOf(raw: unknown): Account {
@@ -44,16 +44,23 @@ function codexOf(raw: Record<string, unknown>): CodexAccess | null {
   return { method: raw.method, accessToken, expiresAt: numberOf(raw.expiresAt), accountId: maybe(raw.accountId) };
 }
 
-function credentialOf(provider: Provider, raw: unknown): { apiKey: string; codex: CodexAccess | null } {
-  if (!isRecord(raw)) return { apiKey: '', codex: null };
-  return provider === 'codex' ? { apiKey: '', codex: codexOf(raw) } : { apiKey: text(raw.apiKey), codex: null };
+interface Credential {
+  apiKey: string;
+  claudeToken: string;
+  codex: CodexAccess | null;
+}
+
+function credentialOf(provider: Provider, raw: unknown): Credential {
+  if (!isRecord(raw)) return { apiKey: '', claudeToken: '', codex: null };
+  if (provider === 'codex') return { apiKey: '', claudeToken: '', codex: codexOf(raw) };
+  return { apiKey: text(raw.apiKey), claudeToken: provider === 'anthropic' ? text(raw.claudeToken) : '', codex: null };
 }
 
 export function deliveredConnection(raw: unknown): Connection | null {
   if (!isRecord(raw) || !isProvider(raw.provider)) return null;
   const id = text(raw.id);
-  if (id === '' || id.startsWith(LOCAL_PREFIX)) return null;
-  const { apiKey, codex } = credentialOf(raw.provider, raw.credential);
+  if (id === '') return null;
+  const { apiKey, claudeToken, codex } = credentialOf(raw.provider, raw.credential);
   return {
     id,
     provider: raw.provider,
@@ -64,9 +71,9 @@ export function deliveredConnection(raw: unknown): Connection | null {
     zdr: raw.zdr === true,
     revision: numberOf(raw.revision),
     codex,
-    claude: null,
+    claudeToken,
     account: accountOf(raw.account),
-    signedOut: codex === null && apiKey === '',
+    signedOut: codex === null && apiKey === '' && claudeToken === '',
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effective.ts

@@ -1,26 +1,15 @@
 import { log } from '@metro-labs/core/log';
-import { agentsDir } from '../agents/files.js';
-import { readClaudeLogins, type ClaudeLogin } from './claude-store.js';
 import type { Delivered } from './delivered.js';
-import { emptySetup, LOCAL_PREFIX, loginConnection, primaryRoute, runnerModel, SESSION_LOGIN, sessionConnection, type Connection, type ModelSetup } from './model-config.js';
+import { emptySetup, primaryRoute, runnerModel, type ModelSetup } from './model-config.js';
 import { deliveredSetup, type OrgModels } from './org-models.js';
 
-function localOf(id: string, logins: ClaudeLogin[]): Connection | null {
-  if (id === SESSION_LOGIN) return sessionConnection();
-  if (!id.startsWith(LOCAL_PREFIX)) return null;
-  const login = id.slice(LOCAL_PREFIX.length);
-  return loginConnection(login, logins.find((l) => l.id === login));
-}
-
-export function setupOf(delivered: Delivered | null, logins: ClaudeLogin[]): ModelSetup {
+export function setupOf(delivered: Delivered | null): ModelSetup {
   const route = delivered?.route ?? null;
   if (delivered === null || route === null) return { ...emptySetup(), source: delivered?.source ?? null };
-  const named = [...(route.primary === null ? [] : [route.primary]), ...route.fallbacks].map((r) => r.connection);
-  const locals = [...new Set(named)].flatMap((id) => localOf(id, logins) ?? []);
-  return { primary: route.primary, fallbacks: route.fallbacks, connections: [...delivered.connections, ...locals], source: delivered.source };
+  return { primary: route.primary, fallbacks: route.fallbacks, connections: delivered.connections, source: delivered.source };
 }
 
-export const effectiveSetup = (dir = agentsDir(), delivered: Delivered | null = deliveredSetup()): ModelSetup => setupOf(delivered, readClaudeLogins(dir));
+export const effectiveSetup = (delivered: Delivered | null = deliveredSetup()): ModelSetup => setupOf(delivered);
 
 export function modelViewText(setup: ModelSetup): string | null {
   const primary = primaryRoute(setup);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/fallback.ts

@@ -55,7 +55,7 @@ export function holdOf(route: Route, now = Date.now()): Hold | null {
 
 function fallbackModel(requested: string, conn: Connection, model: string): string {
   const bare = bareModel(requested);
-  return model === '' || (conn.provider === 'anthropic' && isSmallModel(bare)) ? bare : model;
+  return conn.provider === 'anthropic' && isSmallModel(bare) ? bare : model;
 }
 
 function fallbackRoute(setup: ModelSetup, fallback: Fallback, requested: string): Route | null {
@@ -90,9 +90,10 @@ function coolUntil(headers: Headers, now: number): number {
 }
 
 export function noteRefused(route: Route, status: number, headers: Headers, next: Route | undefined, now = Date.now()): void {
-  const reason = `answered ${String(status)}`;
-  cooling.set(keyOf(route), { until: coolUntil(headers, now), reason });
-  log.warn({ from: routeLabel(route), to: next === undefined ? null : routeLabel(next), status }, 'gateway: the model hit its limit, so the request goes to the next fallback model');
+  const signedOut = status === 401;
+  cooling.set(keyOf(route), { until: coolUntil(headers, now), reason: signedOut ? 'token refused, sign in again' : `answered ${String(status)}` });
+  const why = signedOut ? 'gateway: Anthropic refused the Claude subscription, so the request goes to the next fallback model' : 'gateway: the model hit its limit, so the request goes to the next fallback model';
+  log.warn({ from: routeLabel(route), to: next === undefined ? null : routeLabel(next), status }, why);
 }
 
 export function noteChoice(primary: Route, chosen: Route, now = Date.now()): void {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/forward.ts

@@ -31,6 +31,12 @@ const HOP_BY_HOP = new Set([
 ]);
 const RESPONSE_DROP = new Set(['content-length', 'content-encoding', 'transfer-encoding', 'connection', 'keep-alive']);
 
+export class SubscriptionRefused extends GatewayError {
+  constructor(label: string) {
+    super(403, 'permission_error', `Anthropic refused the Claude subscription ${label}: sign in again on the Models page`);
+  }
+}
+
 export function sendError(res: ServerResponse, status: number, kind: string, message: string): void {
   res.writeHead(status, { 'content-type': 'application/json' });
   res.end(JSON.stringify({ type: 'error', error: { type: kind, message } }));

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -1,4 +1,4 @@
-import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
 import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
@@ -12,9 +12,9 @@ import {
 import {
   addBeta,
   anthropicHeaders,
-  forwardedHeaders,
   GatewayError,
   holdLimitRefusal,
+  SubscriptionRefused,
   loginHeaders,
   parseJson,
   pipeResponse,
@@ -22,6 +22,9 @@ import {
   sendError,
   upstreamMessage,
   watchUpstream,
+  type Held,
+  type Watch,
+  type Refusal,
 } from './forward.js';
 import { chainOf, forgetFallbackState, noteChoice, noteRefused, routesToTry } from './fallback.js';
 import {
@@ -36,7 +39,7 @@ import {
   withEffort,
   withThinkingFor,
 } from './effort.js';
-import { notReady, resolveRoute, routeLabel, sessionConnection, type Connection, type ModelSetup, type Route } from './model-config.js';
+import { notReady, resolveRoute, routeLabel, type Connection, type ModelSetup, type Route } from './model-config.js';
 import { codexMessages, type CodexDeps } from './codex.js';
 import { countTokens } from './subscription.js';
 import { OPENROUTER_BASE } from './openrouter.js';
@@ -44,8 +47,6 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { forgetServed, noteServed } from './served.js';
 import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
 import { fitToolSearch } from './tool-search.js';
-import { ANTHROPIC_API, refreshLoginModels } from './provider-models.js';
-import { forgetClaudeTokens, withClaudeLogin, type ClaudeLoginDeps } from './claude-logins.js';
 import { orgModels } from './org-models.js';
 
 const GATEWAY_PREFIX = '/gateway';
@@ -53,6 +54,8 @@ const MESSAGES = '/v1/messages';
 const COUNT = '/v1/messages/count_tokens';
 const MODELS = '/v1/models';
 const HELLO = '/api/hello';
+const ANTHROPIC_API = 'https://api.anthropic.com';
+const NO_ROUTE = "metro gateway: no model is set up for this agent yet: enroll it with its organization and choose a model on the organization's Models page";
 
 export interface GatewayDeps {
   setup: () => ModelSetup;
@@ -61,7 +64,6 @@ export interface GatewayDeps {
   bedrockBase?: string;
   openrouterBase?: string;
   codex?: Partial<CodexDeps>;
-  claudeLogins?: ClaudeLoginDeps;
 }
 
 const learned: Adaptations = freshAdaptations();
@@ -73,7 +75,6 @@ export function resetGatewayState(): void {
   learned.fields.clear();
   learned.dropBetas = false;
   forgetLearnedThinking();
-  forgetClaudeTokens();
 }
 
 const refreshCodex = (conn: Connection): Promise<Connection | null> => orgModels()?.refresh(conn) ?? Promise.resolve(null);
@@ -101,7 +102,9 @@ function modelsBody(setup: ModelSetup): Record<string, unknown> {
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
-const passthrough = (body: Record<string, unknown>): Route => ({ connection: sessionConnection(), model: requestedModel(body) });
+const noRoute = (): never => {
+  throw new GatewayError(503, 'api_error', NO_ROUTE);
+};
 
 function requestedModel(body: Record<string, unknown>): string {
   const model = body.model;
@@ -109,11 +112,6 @@ function requestedModel(body: Record<string, unknown>): string {
   return model;
 }
 
-const standsInFor = (req: IncomingMessage): boolean => {
-  const metroKey = req.headers['x-metro-key'];
-  return typeof metroKey === 'string' && metroKey !== '' && req.headers.authorization === `Bearer ${metroKey}`;
-};
-
 interface Payloads {
   metro: Buffer;
   asSent: Buffer | null;
@@ -148,25 +146,11 @@ async function refusedThinkingOff(upstream: Response, shaped: Record<string, unk
   return true;
 }
 
-function listLoginModels(headers: IncomingHttpHeaders, anthropicBase: string): void {
-  refreshLoginModels(headers, anthropicBase).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'gateway: could not list the models of the Claude Code login');
-  });
-}
-
-function sendAnthropic(req: IncomingMessage, conn: Connection, anthropicBase: string, attempt: (base: Record<string, string>) => Promise<Response>, deps: GatewayDeps): Promise<Response> {
-  if (conn.apiKey !== '') return attempt(anthropicHeaders(req, conn.apiKey));
-  if (conn.claude === null) return attempt(forwardedHeaders(req));
-  return withClaudeLogin(conn.claude, deps.claudeLogins ?? {}, (token) => {
-    listLoginModels({ authorization: `Bearer ${token}` }, anthropicBase);
-    return attempt(loginHeaders(req, token));
-  });
-}
-
-async function refusedLogin(conn: Connection, upstream: Response): Promise<void> {
-  if (conn.apiKey !== '' || conn.claude === null || upstream.status !== 401) return;
+async function refusedSubscription(conn: Connection, upstream: Response, watch: Watch): Promise<void> {
+  if (conn.apiKey !== '' || upstream.status !== 401) return;
   await upstream.body?.cancel();
-  throw new GatewayError(403, 'permission_error', `Anthropic refused the Claude login ${conn.label}: sign in again on the Model page`);
+  watch.stop();
+  throw new SubscriptionRefused(conn.label);
 }
 
 async function toAnthropic(
@@ -179,17 +163,8 @@ async function toAnthropic(
   deps: GatewayDeps,
 ): Promise<void> {
   const conn = route.connection;
-  const anthropicBase = deps.anthropicBase ?? ANTHROPIC_API;
-  const url = `${anthropicBase}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
-  const passthrough = conn.apiKey === '' && conn.claude === null;
-  if (passthrough && standsInFor(req))
-    throw new GatewayError(
-      403,
-      'permission_error',
-      "Claude Code on this machine has no Anthropic login of its own; route this agent to a model on the organization's Models page, or sign in a Claude login on the Model page",
-    );
+  const url = `${deps.anthropicBase ?? ANTHROPIC_API}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
   const watch = watchUpstream(res);
-  if (passthrough) listLoginModels(req.headers, anthropicBase);
   const send = (payload: Buffer, headers: Record<string, string>): Promise<Response> =>
     fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
   const attempt = async (base: Record<string, string>): Promise<Response> => {
@@ -197,12 +172,11 @@ async function toAnthropic(
     const first = await shape();
     return (await refusedThinkingOff(first, shaped, route.model)) ? shape() : first;
   };
-  const upstream = await sendAnthropic(req, conn, anthropicBase, attempt, deps);
-  await refusedLogin(conn, upstream);
+  const upstream = await attempt(conn.apiKey !== '' ? anthropicHeaders(req, conn.apiKey) : loginHeaders(req, conn.claudeToken));
+  await refusedSubscription(conn, upstream, watch);
   noteRefusal(conn.label, route.model, upstream);
   noteUsageHeaders('anthropic', conn.id, upstream.headers);
-  const scanner = new UsageScanner(conn.id);
-  await pipeResponse(upstream, res, watch, passthrough ? { scanner } : { ownCredential: true, scanner });
+  await pipeResponse(upstream, res, watch, { ownCredential: true, scanner: new UsageScanner(conn.id) });
 }
 
 async function toOpenRouter(req: IncomingMessage, res: ServerResponse, body: Record<string, unknown>, route: Route, deps: GatewayDeps): Promise<void> {
@@ -289,13 +263,23 @@ async function attempt(req: IncomingMessage, res: ServerResponse, ask: Request,
   await toAnthropic(req, res, bytesOf(ask.raw, ask.parsed, ask.sent), ask.sent, body, route, deps);
 }
 
+async function heldAttempt(req: IncomingMessage, held: Held, ask: Request, route: Route, deps: GatewayDeps): Promise<Refusal | null> {
+  try {
+    await attempt(req, held.res, ask, route, deps);
+  } catch (err) {
+    if (!(err instanceof SubscriptionRefused)) throw err;
+    return { status: 401, headers: new Headers() };
+  }
+  return held.refusal();
+}
+
 async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
   const setup = deps.setup();
   const raw = await readBody(req);
   const parsed = parseJson(raw);
   const sent = fitToolSearch(req, parsed);
   const requested = requestedModel(sent);
-  const primary = resolveRoute(requested, setup) ?? passthrough(sent);
+  const primary = resolveRoute(requested, setup) ?? noRoute();
   const ask: Request = { path, raw, parsed, sent, body: shapedFor(req, sent), setup };
   const routes = routesToTry(chainOf(primary, setup, requested));
   for (const [at, route] of routes.entries()) {
@@ -305,9 +289,7 @@ async function dispatch(req: IncomingMessage, res: ServerResponse, path: string,
       await attempt(req, res, ask, route, deps);
       return;
     }
-    const held = holdLimitRefusal(res);
-    await attempt(req, held.res, ask, route, deps);
-    const refusal = held.refusal();
+    const refusal = await heldAttempt(req, holdLimitRefusal(res), ask, route, deps);
     if (refusal === null) return;
     noteRefused(route, refusal.status, refusal.headers, next);
   }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -1,14 +1,10 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from '@metro-labs/http/api-error';
-import { apiFailure, apiSession, cors, requireAdmin, sendJson, type ApiSession } from '@metro-labs/http/api-http';
-import { agentsDir } from '../agents/files.js';
-import { removeClaudeLogin } from './claude-logins.js';
-import { readClaudeLogins, type ClaudeLogin } from './claude-store.js';
+import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
 import { effectiveSetup } from './effective.js';
 import { chainStatus } from './fallback.js';
 import { notReady, primaryRoute, type Connection, type ModelSetup } from './model-config.js';
 import { orgModels, type SyncStatus } from './org-models.js';
-import { claudeModels } from './provider-models.js';
 import { lastServed } from './served.js';
 import { refreshUsage, type UsageDeps } from './usage-refresh.js';
 import { usageSeen } from './usage.js';
@@ -16,19 +12,15 @@ import { usageSeen } from './usage.js';
 const PATH = '/api/model';
 const SNAPSHOT = '/api/model/snapshot';
 const SYNC = '/api/model/sync';
-const CLAUDE_MODELS = '/api/model/claude-models';
-const CLAUDE_LOGIN = '/api/model/claude/';
-const LOGIN_RE = /^[A-Za-z0-9_-]{11}$/;
 
 export interface ModelApiDeps extends UsageDeps {
-  dir?: () => string;
   setup?: () => ModelSetup;
   sync?: () => Promise<void>;
   syncStatus?: () => SyncStatus;
-  anthropicBase?: string;
 }
 
 const NO_SYNC: SyncStatus = { enrolled: false, at: null, error: null };
+const NO_MODEL = "No model is set up for this agent yet: choose one on the organization's Models page.";
 
 function publicConnection(c: Connection): Record<string, unknown> {
   return {
@@ -37,9 +29,9 @@ function publicConnection(c: Connection): Record<string, unknown> {
     label: c.label,
     model: c.model,
     hasKey: c.apiKey !== '',
+    subscription: c.claudeToken !== '',
     region: c.region,
     zdr: c.zdr,
-    signedIn: c.codex !== null || (c.claude !== null && !c.signedOut),
     signedOut: c.signedOut,
     account: c.account.email,
     plan: c.account.plan,
@@ -47,13 +39,12 @@ function publicConnection(c: Connection): Record<string, unknown> {
   };
 }
 
-const loginsOf = (deps: ModelApiDeps): ClaudeLogin[] => readClaudeLogins(deps.dir?.() ?? agentsDir());
-const setupOf = (deps: ModelApiDeps): ModelSetup => (deps.setup ?? (() => effectiveSetup(deps.dir?.())))();
+const setupOf = (deps: ModelApiDeps): ModelSetup => (deps.setup ?? (() => effectiveSetup()))();
 
 export function settingsBody(deps: ModelApiDeps): Record<string, unknown> {
   const setup = setupOf(deps);
   const primary = primaryRoute(setup);
-  const reason = primary === null ? null : notReady(primary);
+  const reason = primary === null ? NO_MODEL : notReady(primary);
   return {
     source: setup.source,
     sync: (deps.syncStatus ?? (() => orgModels()?.syncStatus() ?? NO_SYNC))(),
@@ -64,14 +55,13 @@ export function settingsBody(deps: ModelApiDeps): Record<string, unknown> {
     connections: setup.connections.map(publicConnection),
     fallbacks: setup.fallbacks,
     chain: chainStatus(setup),
-    claude: loginsOf(deps),
     lastServed: lastServed(),
     usage: usageSeen(),
   };
 }
 
 async function withUsage(deps: ModelApiDeps): Promise<Record<string, unknown>> {
-  await refreshUsage(setupOf(deps), loginsOf(deps), deps);
+  await refreshUsage(setupOf(deps), deps);
   return settingsBody(deps);
 }
 
@@ -80,23 +70,19 @@ async function synced(deps: ModelApiDeps): Promise<Record<string, unknown>> {
   return settingsBody(deps);
 }
 
-function dropLogin(session: ApiSession, login: string, deps: ModelApiDeps): Record<string, unknown> {
-  requireAdmin(session);
-  removeClaudeLogin(login, { ...deps.claudeLogins, dir: deps.dir?.() ?? deps.claudeLogins?.dir });
-  return settingsBody(deps);
-}
+type Run = () => Promise<unknown>;
 
-type Run = (session: ApiSession) => Promise<unknown>;
+const ROUTES: Record<string, [string, (deps: ModelApiDeps) => Promise<unknown>]> = {
+  [PATH]: ['GET', withUsage],
+  [SNAPSHOT]: ['GET', (deps) => Promise.resolve(settingsBody(deps))],
+  [SYNC]: ['POST', synced],
+};
 
 function routeFor(path: string, method: string | undefined, deps: ModelApiDeps): Run | number {
-  const only = (wanted: string, run: Run): Run | number => (method === wanted ? run : 405);
-  if (path === PATH) return only('GET', () => withUsage(deps));
-  if (path === SNAPSHOT) return only('GET', () => Promise.resolve(settingsBody(deps)));
-  if (path === SYNC) return only('POST', () => synced(deps));
-  if (path === CLAUDE_MODELS) return only('GET', () => Promise.resolve({ models: claudeModels(deps.anthropicBase) }));
-  const login = path.slice(CLAUDE_LOGIN.length);
-  if (!LOGIN_RE.test(login)) return 404;
-  return only('DELETE', (session) => Promise.resolve(dropLogin(session, login, deps)));
+  const known = ROUTES[path];
+  if (known === undefined) return 404;
+  const [wanted, run] = known;
+  return method === wanted ? () => run(deps) : 405;
 }
 
 const mine = (path: string): boolean => path === PATH || path.startsWith(`${PATH}/`);
@@ -108,7 +94,7 @@ export function handleModelRequest(req: IncomingMessage, res: ServerResponse, de
     res.writeHead(204, cors(req)).end();
     return true;
   }
-  const route = path === PATH || path.startsWith(CLAUDE_LOGIN) || [SNAPSHOT, SYNC, CLAUDE_MODELS].includes(path) ? routeFor(path, req.method, deps) : 404;
+  const route = routeFor(path, req.method, deps);
   if (typeof route === 'number') {
     sendJson(req, res, route, { error: route === 404 ? 'not found' : 'method not allowed' });
     return true;
@@ -116,7 +102,7 @@ export function handleModelRequest(req: IncomingMessage, res: ServerResponse, de
   apiSession(req)
     .then(async (session) => {
       if (!session) throw new ApiError('unauthorized', 401);
-      sendJson(req, res, 200, await route(session));
+      sendJson(req, res, 200, await route());
     })
     .catch((err: unknown) => {
       apiFailure(req, res, err, 'model-api');