@stage-labs/metro 0.1.0-beta.310 → 0.1.0-beta.312

package/dist/claude-env.js

@@ -89,7 +89,7 @@ function gatewayLaunchEnv(key, port, claude, say) {
         say('MCP tool search is on, so connector tools load when Claude needs them instead of all at start');
     const env = credentialEnv(routed, key, claudeSignedIn(claude));
     if (env !== routed)
-        say("Claude Code has no login of its own here, so metro's key stands in as its credential; the Model page must route to Bedrock, OpenRouter or Codex");
+        say("Claude Code has no login of its own here, so metro's key stands in as its credential; the organization's Models page decides where requests go");
     return env;
 }
 export async function headlessEnv(claude, command) {

package/dist/route.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { agentsDir } from './local.js';
-const PROVIDERS = new Set(['bedrock', 'openrouter', 'codex', 'gemini']);
+const PROVIDERS = new Set(['bedrock', 'openrouter', 'codex', 'gemini', 'routeway']);
 const ANTHROPIC = 'anthropic';
 const text = (value) => (typeof value === 'string' ? value : '');
 function routedIn(cfg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.310",
+  "version": "0.1.0-beta.312",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/core/package.json

@@ -18,6 +18,7 @@
     "./train-error": "./src/train-error.ts",
     "./trains/protocol": "./src/protocol.ts",
     "./ids": "./src/ids.ts",
+    "./claude-token": "./src/claude-token.ts",
     "./tickets": "./src/tickets.ts",
     "./station-names": "./src/station-names.ts",
     "./str": "./src/str.ts",

package/runtime/node_modules/@metro-labs/core/src/claude-token.ts

@@ -0,0 +1,3 @@
+const TOKEN_RE = /^sk-ant-oat01-[A-Za-z0-9_-]{32,512}$/;
+
+export const isClaudeToken = (value: string): boolean => TOKEN_RE.test(value);

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -40,7 +40,7 @@ function agentFile(dir: string): string | null {
   return json({ version: 1, id: file.id, key: file.key });
 }
 
-export function viewFiles(dir = agentsDir(), model: () => string | null = () => modelViewText(effectiveSetup(dir))): Map<string, string | null> {
+export function viewFiles(dir = agentsDir(), model: () => string | null = () => modelViewText(effectiveSetup())): Map<string, string | null> {
   const files = new Map<string, string | null>([
     ['agent.json', agentFile(dir)],
     ['model.json', model()],

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -62,7 +62,6 @@ import { startCloudWatchPublisher } from '../server/cloudwatch.js';
 import { watchFallbackUsage } from '../gateway/usage-refresh.js';
 import { startOrgModels, stopOrgModels } from '../gateway/org-models.js';
 import { effectiveSetup, watchModelChanges } from '../gateway/effective.js';
-import { readClaudeLogins, retireV2ModelFile } from '../gateway/claude-store.js';
 import { removeModelLeftovers } from '../gateway/model-leftovers.js';
 import { readAgentKey } from '../connectors/agent-key.js';
 import { METRO_API } from '../connectors/metro-api.js';
@@ -146,7 +145,6 @@ function sessionApis(setLiveEvents: (on: boolean) => void): SessionApis {
 async function main(): Promise<void> {
   removeConnectorLeftovers();
   removeModelLeftovers();
-  retireV2ModelFile();
   applyLocalOwner();
 installBearerSessions(agentsDir(), localOwner);
   watchPolicySnapshot();
@@ -183,7 +181,7 @@ installBearerSessions(agentsDir(), localOwner);
   });
   watchConnectorTools();
   startCloudWatchPublisher();
-  watchFallbackUsage(() => effectiveSetup(), () => readClaudeLogins());
+  watchFallbackUsage(() => effectiveSetup());
   announceLocalEndpoint();
   tunnel?.start();
   log.info(

package/runtime/node_modules/@metro-labs/daemon/src/claude/api.ts

@@ -13,17 +13,6 @@ import {
   readClaudeSkill,
   writeClaudeSkill,
 } from './skills.js';
-import {
-  answerClaudeLogin,
-  claudeAccount,
-  claudeInstalled,
-  claudeLoginView,
-  endClaudeLogin,
-  startClaudeLogin,
-  type LoginDeps,
-  type LoginTarget,
-} from './login.js';
-import { claudeLoginTarget, type ClaudeLoginDeps } from '../gateway/claude-logins.js';
 import { setupAnswer, type SetupApiDeps } from './setup-api.js';
 import {
   autostartEnabled,
@@ -58,8 +47,6 @@ const PAGE_MAX = 500;
 
 export interface ClaudeApiDeps extends SetupApiDeps {
   dir?: () => string;
-  login?: LoginDeps;
-  claudeLogins?: ClaudeLoginDeps;
   skillSource?: GitHubSkills;
 }
 
@@ -133,8 +120,7 @@ async function created(req: IncomingMessage, path: string, dir: string): Promise
   return createClaudeSkill(body.name, typeof body.text === 'string' ? body.text : undefined, dir);
 }
 
-const ADMIN_ONLY = /^\/api\/claude\/(login|session|setup|skill-source)(\/|$)/;
-const LOGIN = 'login';
+const ADMIN_ONLY = /^\/api\/claude\/(session|setup|skill-source)(\/|$)/;
 const SESSION = 'session';
 const SETUP = 'setup';
 
@@ -166,26 +152,6 @@ async function sessionAnswer(req: IncomingMessage, deps: ClaudeApiDeps): Promise
   return sessionCommand(body, session);
 }
 
-function loginTarget(req: IncomingMessage, deps: ClaudeApiDeps): LoginTarget | null {
-  const asked = new URL(req.url ?? '', 'http://metro').searchParams.get('connection');
-  return asked === null ? null : claudeLoginTarget(asked, deps.claudeLogins);
-}
-
-async function loginAnswer(req: IncomingMessage, id: string, deps: ClaudeApiDeps): Promise<unknown> {
-  const method = req.method ?? 'GET';
-  if (id === '') {
-    if (method === 'POST') return startClaudeLogin(deps.login, Date.now(), loginTarget(req, deps));
-    if (method === 'GET') return { available: claudeInstalled(), ...claudeAccount() };
-    throw new ApiError('method not allowed', 405);
-  }
-  if (method === 'GET') return claudeLoginView(id);
-  if (method === 'DELETE') return endClaudeLogin(id);
-  if (method !== 'POST') throw new ApiError('method not allowed', 405);
-  const body = await readJsonBody(req);
-  if (!isRecord(body) || typeof body.text !== 'string') throw new ApiError('text is required', 400);
-  return answerClaudeLogin(id, body.text);
-}
-
 function removed(rest: string[], query: URLSearchParams, dir: string): unknown {
   const [head = '', item = ''] = rest;
   if (rest.length !== 2) throw new ApiError('method not allowed', 405);
@@ -236,7 +202,6 @@ function fileAnswer(req: IncomingMessage, path: string, search: string, dir: str
 function routed(req: IncomingMessage, path: string, search: string, deps: ClaudeApiDeps): unknown {
   const dir = (deps.dir ?? claudeDir)();
   const [head = '', item = ''] = parts(path);
-  if (head === LOGIN) return loginAnswer(req, item, deps);
   if (head === 'skill-source' && parts(path).length === 1) return githubSkillsAnswer(req, deps.skillSource);
   if (head === 'skills') return skillsAnswer(req, path, search, dir, sourceOf(deps));
   const single = item === '' ? SINGLETONS[head] : undefined;

package/runtime/node_modules/@metro-labs/daemon/src/claude/session.ts

@@ -13,7 +13,6 @@ import { METRO_VERSION } from '@metro-labs/core/version';
 import { agentsDir, listAgentFiles } from '../agents/files.js';
 import { notReady, primaryRoute, type ModelSetup } from '../gateway/model-config.js';
 import { effectiveSetup } from '../gateway/effective.js';
-import { claudeAccount, claudeInstalled, forgetClaudeChecks } from './login.js';
 import { inSessionScope } from './memory.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { agentExtraEnv, agentUser, agentUserExpected, agentViewDir, asAgent, claudeHome } from '../agent-user/user.js';
@@ -38,7 +37,6 @@ export interface SessionDeps {
   metro?: string[];
   home?: string;
   agents?: string;
-  signedIn?: () => boolean;
   model?: () => ModelSetup;
   now?: () => number;
   version?: string;
@@ -122,30 +120,23 @@ export function prepareRunnerStore(): Promise<void> {
     child.stderr.on('data', (chunk: Buffer) => {
       said = (said + chunk.toString('utf8')).slice(-2000);
     });
-    child.on('error', (err) => {
-      forgetClaudeChecks();
-      reject(err);
-    });
+    child.on('error', reject);
     child.on('close', (code) => {
-      forgetClaudeChecks();
       if (code === 0) resolve();
       else reject(new Error(`metro agent --prepare failed: ${said.trim() || `exit ${String(code)}`}`));
     });
   });
 }
 
-const loginNotRuledOut = (): boolean => claudeAccount().signedIn || !claudeInstalled();
+const NO_MODEL = "the organization routes this agent to no model yet: choose one on the organization's Models page";
 
 function credentialReady(deps: SessionDeps): string | null {
-  const signedIn = deps.signedIn ?? loginNotRuledOut;
-  if (signedIn()) return null;
   try {
-    const primary = primaryRoute((deps.model ?? (() => effectiveSetup(deps.agents ?? agentsDir())))());
-    if (primary !== null && notReady(primary) === null && (primary.connection.provider !== 'anthropic' || primary.connection.apiKey !== '')) return null;
+    const primary = primaryRoute((deps.model ?? (() => effectiveSetup()))());
+    return primary === null ? NO_MODEL : notReady(primary);
   } catch (err) {
     return `the model setup is not readable (${errMsg(err)})`;
   }
-  return 'Claude Code is not signed in and the organization routes this agent to no model yet';
 }
 
 const agentUserMissing = (deps: SessionDeps): boolean =>

package/runtime/node_modules/@metro-labs/daemon/src/gateway/delivered.ts

@@ -1,5 +1,5 @@
 import { isRecord } from '@metro-labs/core/is-record';
-import { isProvider, LOCAL_PREFIX, type Account, type CodexAccess, type Connection, type Fallback, type Provider, type RouteSource } from './model-config.js';
+import { isProvider, type Account, type CodexAccess, type Connection, type Fallback, type Provider, type RouteSource } from './model-config.js';
 
 export interface DeliveredRoute {
   primary: Fallback | null;
@@ -27,7 +27,7 @@ function refOf(raw: unknown): Fallback | null {
 function routeOf(raw: unknown): DeliveredRoute | null {
   if (!isRecord(raw)) return null;
   const fallbacks = Array.isArray(raw.fallbacks) ? raw.fallbacks.flatMap((f: unknown) => refOf(f) ?? []) : [];
-  return { primary: refOf(raw.primary), fallbacks: fallbacks.filter((f) => f.model !== '' || f.connection.startsWith(LOCAL_PREFIX)).slice(0, MAX_FALLBACKS) };
+  return { primary: refOf(raw.primary), fallbacks: fallbacks.filter((f) => f.model !== '').slice(0, MAX_FALLBACKS) };
 }
 
 function accountOf(raw: unknown): Account {
@@ -44,16 +44,23 @@ function codexOf(raw: Record<string, unknown>): CodexAccess | null {
   return { method: raw.method, accessToken, expiresAt: numberOf(raw.expiresAt), accountId: maybe(raw.accountId) };
 }
 
-function credentialOf(provider: Provider, raw: unknown): { apiKey: string; codex: CodexAccess | null } {
-  if (!isRecord(raw)) return { apiKey: '', codex: null };
-  return provider === 'codex' ? { apiKey: '', codex: codexOf(raw) } : { apiKey: text(raw.apiKey), codex: null };
+interface Credential {
+  apiKey: string;
+  claudeToken: string;
+  codex: CodexAccess | null;
+}
+
+function credentialOf(provider: Provider, raw: unknown): Credential {
+  if (!isRecord(raw)) return { apiKey: '', claudeToken: '', codex: null };
+  if (provider === 'codex') return { apiKey: '', claudeToken: '', codex: codexOf(raw) };
+  return { apiKey: text(raw.apiKey), claudeToken: provider === 'anthropic' ? text(raw.claudeToken) : '', codex: null };
 }
 
 export function deliveredConnection(raw: unknown): Connection | null {
   if (!isRecord(raw) || !isProvider(raw.provider)) return null;
   const id = text(raw.id);
-  if (id === '' || id.startsWith(LOCAL_PREFIX)) return null;
-  const { apiKey, codex } = credentialOf(raw.provider, raw.credential);
+  if (id === '') return null;
+  const { apiKey, claudeToken, codex } = credentialOf(raw.provider, raw.credential);
   return {
     id,
     provider: raw.provider,
@@ -64,9 +71,9 @@ export function deliveredConnection(raw: unknown): Connection | null {
     zdr: raw.zdr === true,
     revision: numberOf(raw.revision),
     codex,
-    claude: null,
+    claudeToken,
     account: accountOf(raw.account),
-    signedOut: codex === null && apiKey === '',
+    signedOut: codex === null && apiKey === '' && claudeToken === '',
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effective.ts

@@ -1,26 +1,15 @@
 import { log } from '@metro-labs/core/log';
-import { agentsDir } from '../agents/files.js';
-import { readClaudeLogins, type ClaudeLogin } from './claude-store.js';
 import type { Delivered } from './delivered.js';
-import { emptySetup, LOCAL_PREFIX, loginConnection, primaryRoute, runnerModel, SESSION_LOGIN, sessionConnection, type Connection, type ModelSetup } from './model-config.js';
+import { emptySetup, primaryRoute, runnerModel, type ModelSetup } from './model-config.js';
 import { deliveredSetup, type OrgModels } from './org-models.js';
 
-function localOf(id: string, logins: ClaudeLogin[]): Connection | null {
-  if (id === SESSION_LOGIN) return sessionConnection();
-  if (!id.startsWith(LOCAL_PREFIX)) return null;
-  const login = id.slice(LOCAL_PREFIX.length);
-  return loginConnection(login, logins.find((l) => l.id === login));
-}
-
-export function setupOf(delivered: Delivered | null, logins: ClaudeLogin[]): ModelSetup {
+export function setupOf(delivered: Delivered | null): ModelSetup {
   const route = delivered?.route ?? null;
   if (delivered === null || route === null) return { ...emptySetup(), source: delivered?.source ?? null };
-  const named = [...(route.primary === null ? [] : [route.primary]), ...route.fallbacks].map((r) => r.connection);
-  const locals = [...new Set(named)].flatMap((id) => localOf(id, logins) ?? []);
-  return { primary: route.primary, fallbacks: route.fallbacks, connections: [...delivered.connections, ...locals], source: delivered.source };
+  return { primary: route.primary, fallbacks: route.fallbacks, connections: delivered.connections, source: delivered.source };
 }
 
-export const effectiveSetup = (dir = agentsDir(), delivered: Delivered | null = deliveredSetup()): ModelSetup => setupOf(delivered, readClaudeLogins(dir));
+export const effectiveSetup = (delivered: Delivered | null = deliveredSetup()): ModelSetup => setupOf(delivered);
 
 export function modelViewText(setup: ModelSetup): string | null {
   const primary = primaryRoute(setup);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/fallback.ts

@@ -55,7 +55,7 @@ export function holdOf(route: Route, now = Date.now()): Hold | null {
 
 function fallbackModel(requested: string, conn: Connection, model: string): string {
   const bare = bareModel(requested);
-  return model === '' || (conn.provider === 'anthropic' && isSmallModel(bare)) ? bare : model;
+  return conn.provider === 'anthropic' && isSmallModel(bare) ? bare : model;
 }
 
 function fallbackRoute(setup: ModelSetup, fallback: Fallback, requested: string): Route | null {
@@ -90,9 +90,10 @@ function coolUntil(headers: Headers, now: number): number {
 }
 
 export function noteRefused(route: Route, status: number, headers: Headers, next: Route | undefined, now = Date.now()): void {
-  const reason = `answered ${String(status)}`;
-  cooling.set(keyOf(route), { until: coolUntil(headers, now), reason });
-  log.warn({ from: routeLabel(route), to: next === undefined ? null : routeLabel(next), status }, 'gateway: the model hit its limit, so the request goes to the next fallback model');
+  const signedOut = status === 401;
+  cooling.set(keyOf(route), { until: coolUntil(headers, now), reason: signedOut ? 'token refused, sign in again' : `answered ${String(status)}` });
+  const why = signedOut ? 'gateway: Anthropic refused the Claude subscription, so the request goes to the next fallback model' : 'gateway: the model hit its limit, so the request goes to the next fallback model';
+  log.warn({ from: routeLabel(route), to: next === undefined ? null : routeLabel(next), status }, why);
 }
 
 export function noteChoice(primary: Route, chosen: Route, now = Date.now()): void {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/forward.ts

@@ -31,6 +31,12 @@ const HOP_BY_HOP = new Set([
 ]);
 const RESPONSE_DROP = new Set(['content-length', 'content-encoding', 'transfer-encoding', 'connection', 'keep-alive']);
 
+export class SubscriptionRefused extends GatewayError {
+  constructor(label: string) {
+    super(403, 'permission_error', `Anthropic refused the Claude subscription ${label}: sign in again on the Models page`);
+  }
+}
+
 export function sendError(res: ServerResponse, status: number, kind: string, message: string): void {
   res.writeHead(status, { 'content-type': 'application/json' });
   res.end(JSON.stringify({ type: 'error', error: { type: kind, message } }));

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -1,4 +1,4 @@
-import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
 import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
@@ -12,9 +12,9 @@ import {
 import {
   addBeta,
   anthropicHeaders,
-  forwardedHeaders,
   GatewayError,
   holdLimitRefusal,
+  SubscriptionRefused,
   loginHeaders,
   parseJson,
   pipeResponse,
@@ -22,6 +22,9 @@ import {
   sendError,
   upstreamMessage,
   watchUpstream,
+  type Held,
+  type Watch,
+  type Refusal,
 } from './forward.js';
 import { chainOf, forgetFallbackState, noteChoice, noteRefused, routesToTry } from './fallback.js';
 import {
@@ -36,16 +39,15 @@ import {
   withEffort,
   withThinkingFor,
 } from './effort.js';
-import { notReady, resolveRoute, routeLabel, sessionConnection, type Connection, type ModelSetup, type Route } from './model-config.js';
+import { notReady, resolveRoute, routeLabel, type Connection, type ModelSetup, type Route } from './model-config.js';
 import { codexMessages, type CodexDeps } from './codex.js';
 import { countTokens } from './subscription.js';
 import { OPENROUTER_BASE } from './openrouter.js';
+import { refusedWithPage, ROUTEWAY_BASE, routewayHeaders } from './routeway.js';
 import { isRecord } from '@metro-labs/core/is-record';
 import { forgetServed, noteServed } from './served.js';
 import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
 import { fitToolSearch } from './tool-search.js';
-import { ANTHROPIC_API, refreshLoginModels } from './provider-models.js';
-import { forgetClaudeTokens, withClaudeLogin, type ClaudeLoginDeps } from './claude-logins.js';
 import { orgModels } from './org-models.js';
 
 const GATEWAY_PREFIX = '/gateway';
@@ -53,6 +55,8 @@ const MESSAGES = '/v1/messages';
 const COUNT = '/v1/messages/count_tokens';
 const MODELS = '/v1/models';
 const HELLO = '/api/hello';
+const ANTHROPIC_API = 'https://api.anthropic.com';
+const NO_ROUTE = "metro gateway: no model is set up for this agent yet: enroll it with its organization and choose a model on the organization's Models page";
 
 export interface GatewayDeps {
   setup: () => ModelSetup;
@@ -60,8 +64,8 @@ export interface GatewayDeps {
   anthropicBase?: string;
   bedrockBase?: string;
   openrouterBase?: string;
+  routewayBase?: string;
   codex?: Partial<CodexDeps>;
-  claudeLogins?: ClaudeLoginDeps;
 }
 
 const learned: Adaptations = freshAdaptations();
@@ -73,7 +77,6 @@ export function resetGatewayState(): void {
   learned.fields.clear();
   learned.dropBetas = false;
   forgetLearnedThinking();
-  forgetClaudeTokens();
 }
 
 const refreshCodex = (conn: Connection): Promise<Connection | null> => orgModels()?.refresh(conn) ?? Promise.resolve(null);
@@ -101,7 +104,9 @@ function modelsBody(setup: ModelSetup): Record<string, unknown> {
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
-const passthrough = (body: Record<string, unknown>): Route => ({ connection: sessionConnection(), model: requestedModel(body) });
+const noRoute = (): never => {
+  throw new GatewayError(503, 'api_error', NO_ROUTE);
+};
 
 function requestedModel(body: Record<string, unknown>): string {
   const model = body.model;
@@ -109,24 +114,27 @@ function requestedModel(body: Record<string, unknown>): string {
   return model;
 }
 
-const standsInFor = (req: IncomingMessage): boolean => {
-  const metroKey = req.headers['x-metro-key'];
-  return typeof metroKey === 'string' && metroKey !== '' && req.headers.authorization === `Bearer ${metroKey}`;
-};
-
 interface Payloads {
   metro: Buffer;
   asSent: Buffer | null;
   bound: boolean;
 }
 
-function anthropicPayloads(raw: Buffer, sent: Record<string, unknown>, shaped: Record<string, unknown>, model: string): Payloads {
+interface Shaped {
+  raw: Buffer;
+  sent: Record<string, unknown>;
+  shaped: Record<string, unknown>;
+  bind: boolean;
+}
+
+function anthropicPayloads({ raw, sent, shaped, bind }: Shaped, model: string): Payloads {
   const runnable = withThinkingFor(sent, model);
   const rewrite = runnable !== sent || (typeof sent.model === 'string' && sent.model !== model);
   const asSent = rewrite ? Buffer.from(JSON.stringify({ ...runnable, model })) : raw;
-  const bound = withBlockBinding(withThinkingFor(shaped, model));
+  const fitted = withThinkingFor(shaped, model);
+  const bound = bind ? withBlockBinding(fitted) : fitted;
   if (bound === sent) return { metro: asSent, asSent: null, bound: false };
-  return { metro: Buffer.from(JSON.stringify(rewrite ? { ...bound, model } : bound)), asSent, bound: bound !== shaped };
+  return { metro: Buffer.from(JSON.stringify(rewrite ? { ...bound, model } : bound)), asSent, bound: bind && bound !== shaped };
 }
 
 type Send = (payload: Buffer, headers: Record<string, string>) => Promise<Response>;
@@ -148,61 +156,43 @@ async function refusedThinkingOff(upstream: Response, shaped: Record<string, unk
   return true;
 }
 
-function listLoginModels(headers: IncomingHttpHeaders, anthropicBase: string): void {
-  refreshLoginModels(headers, anthropicBase).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'gateway: could not list the models of the Claude Code login');
-  });
+async function refusedSubscription(conn: Connection, upstream: Response, watch: Watch): Promise<void> {
+  if (conn.apiKey !== '' || upstream.status !== 401) return;
+  await upstream.body?.cancel();
+  watch.stop();
+  throw new SubscriptionRefused(conn.label);
 }
 
-function sendAnthropic(req: IncomingMessage, conn: Connection, anthropicBase: string, attempt: (base: Record<string, string>) => Promise<Response>, deps: GatewayDeps): Promise<Response> {
-  if (conn.apiKey !== '') return attempt(anthropicHeaders(req, conn.apiKey));
-  if (conn.claude === null) return attempt(forwardedHeaders(req));
-  return withClaudeLogin(conn.claude, deps.claudeLogins ?? {}, (token) => {
-    listLoginModels({ authorization: `Bearer ${token}` }, anthropicBase);
-    return attempt(loginHeaders(req, token));
-  });
+async function shapedAttempt(send: Send, base: Record<string, string>, body: Shaped, route: Route): Promise<Response> {
+  const shape = (): Promise<Response> => asAnthropicWants(send, base, anthropicPayloads(body, route.model), route.connection.label, route.model);
+  const first = await shape();
+  return (await refusedThinkingOff(first, body.shaped, route.model)) ? shape() : first;
 }
 
-async function refusedLogin(conn: Connection, upstream: Response): Promise<void> {
-  if (conn.apiKey !== '' || conn.claude === null || upstream.status !== 401) return;
-  await upstream.body?.cancel();
-  throw new GatewayError(403, 'permission_error', `Anthropic refused the Claude login ${conn.label}: sign in again on the Model page`);
-}
+const sender = (url: string, watch: Watch): Send => (payload, headers) =>
+  fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
+
+const upstreamPath = (req: IncomingMessage): string => (req.url ?? '').slice(GATEWAY_PREFIX.length);
 
-async function toAnthropic(
-  req: IncomingMessage,
-  res: ServerResponse,
-  raw: Buffer,
-  sent: Record<string, unknown>,
-  shaped: Record<string, unknown>,
-  route: Route,
-  deps: GatewayDeps,
-): Promise<void> {
+async function toAnthropic(req: IncomingMessage, res: ServerResponse, body: Shaped, route: Route, deps: GatewayDeps): Promise<void> {
   const conn = route.connection;
-  const anthropicBase = deps.anthropicBase ?? ANTHROPIC_API;
-  const url = `${anthropicBase}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
-  const passthrough = conn.apiKey === '' && conn.claude === null;
-  if (passthrough && standsInFor(req))
-    throw new GatewayError(
-      403,
-      'permission_error',
-      "Claude Code on this machine has no Anthropic login of its own; route this agent to a model on the organization's Models page, or sign in a Claude login on the Model page",
-    );
   const watch = watchUpstream(res);
-  if (passthrough) listLoginModels(req.headers, anthropicBase);
-  const send = (payload: Buffer, headers: Record<string, string>): Promise<Response> =>
-    fetch(url, { method: 'POST', headers, body: new Uint8Array(payload), signal: watch.signal, redirect: 'manual' });
-  const attempt = async (base: Record<string, string>): Promise<Response> => {
-    const shape = (): Promise<Response> => asAnthropicWants(send, base, anthropicPayloads(raw, sent, shaped, route.model), conn.label, route.model);
-    const first = await shape();
-    return (await refusedThinkingOff(first, shaped, route.model)) ? shape() : first;
-  };
-  const upstream = await sendAnthropic(req, conn, anthropicBase, attempt, deps);
-  await refusedLogin(conn, upstream);
+  const send = sender(`${deps.anthropicBase ?? ANTHROPIC_API}${upstreamPath(req)}`, watch);
+  const upstream = await shapedAttempt(send, conn.apiKey !== '' ? anthropicHeaders(req, conn.apiKey) : loginHeaders(req, conn.claudeToken), body, route);
+  await refusedSubscription(conn, upstream, watch);
   noteRefusal(conn.label, route.model, upstream);
   noteUsageHeaders('anthropic', conn.id, upstream.headers);
-  const scanner = new UsageScanner(conn.id);
-  await pipeResponse(upstream, res, watch, passthrough ? { scanner } : { ownCredential: true, scanner });
+  await pipeResponse(upstream, res, watch, { ownCredential: true, scanner: new UsageScanner(conn.id) });
+}
+
+async function toRouteway(req: IncomingMessage, res: ServerResponse, body: Shaped, route: Route, deps: GatewayDeps): Promise<void> {
+  const conn = route.connection;
+  const watch = watchUpstream(res);
+  const send = sender(`${deps.routewayBase ?? ROUTEWAY_BASE}${upstreamPath(req)}`, watch);
+  const upstream = await shapedAttempt(send, routewayHeaders(req, conn.apiKey), { ...body, bind: false }, route);
+  noteRefusal(conn.label, route.model, upstream);
+  await refusedWithPage(upstream, watch);
+  await pipeResponse(upstream, res, watch, { keepalive: true, ownCredential: true, scanner: new UsageScanner(conn.id) });
 }
 
 async function toOpenRouter(req: IncomingMessage, res: ServerResponse, body: Record<string, unknown>, route: Route, deps: GatewayDeps): Promise<void> {
@@ -286,7 +276,18 @@ async function attempt(req: IncomingMessage, res: ServerResponse, ask: Request,
     await toCodex(req, res, path, body, route, deps);
     return;
   }
-  await toAnthropic(req, res, bytesOf(ask.raw, ask.parsed, ask.sent), ask.sent, body, route, deps);
+  const shaped: Shaped = { raw: bytesOf(ask.raw, ask.parsed, ask.sent), sent: ask.sent, shaped: body, bind: true };
+  await (conn.provider === 'routeway' ? toRouteway : toAnthropic)(req, res, shaped, route, deps);
+}
+
+async function heldAttempt(req: IncomingMessage, held: Held, ask: Request, route: Route, deps: GatewayDeps): Promise<Refusal | null> {
+  try {
+    await attempt(req, held.res, ask, route, deps);
+  } catch (err) {
+    if (!(err instanceof SubscriptionRefused)) throw err;
+    return { status: 401, headers: new Headers() };
+  }
+  return held.refusal();
 }
 
 async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
@@ -295,7 +296,7 @@ async function dispatch(req: IncomingMessage, res: ServerResponse, path: string,
   const parsed = parseJson(raw);
   const sent = fitToolSearch(req, parsed);
   const requested = requestedModel(sent);
-  const primary = resolveRoute(requested, setup) ?? passthrough(sent);
+  const primary = resolveRoute(requested, setup) ?? noRoute();
   const ask: Request = { path, raw, parsed, sent, body: shapedFor(req, sent), setup };
   const routes = routesToTry(chainOf(primary, setup, requested));
   for (const [at, route] of routes.entries()) {
@@ -305,9 +306,7 @@ async function dispatch(req: IncomingMessage, res: ServerResponse, path: string,
       await attempt(req, res, ask, route, deps);
       return;
     }
-    const held = holdLimitRefusal(res);
-    await attempt(req, held.res, ask, route, deps);
-    const refusal = held.refusal();
+    const refusal = await heldAttempt(req, holdLimitRefusal(res), ask, route, deps);
     if (refusal === null) return;
     noteRefused(route, refusal.status, refusal.headers, next);
   }