@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.71

package/runtime/node_modules/@metro-labs/mcp/src/gateway/codex.ts

@@ -0,0 +1,211 @@
+import { randomUUID } from 'node:crypto';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { arch, platform, release } from 'node:os';
+import { isRecord } from '../daemon/is-record.js';
+import { errMsg } from '../daemon/log.js';
+import { refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
+import { assembleMessage, CodexEventTranslator, parseEvent, SseParser } from './codex-stream.js';
+import { ToolNames, toResponsesRequest } from './codex-translate.js';
+import { GatewayError, idleMessage, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
+import type { ModelConfig } from './model-config.js';
+
+export const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
+const CODEX_VERSION = '0.104.0';
+const PING_MS = 25_000;
+const STATUS_OF: Record<string, number> = { rate_limit_error: 429, invalid_request_error: 400, permission_error: 403, overloaded_error: 529 };
+
+export interface CodexDeps {
+  base?: string;
+  issuer?: string;
+  fetchImpl?: typeof fetch;
+  save: (tokens: CodexTokens) => void;
+}
+
+export interface CodexState {
+  refreshing: Promise<CodexTokens> | null;
+  latest: CodexTokens | null;
+}
+
+export const freshCodexState = (): CodexState => ({ refreshing: null, latest: null });
+
+const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
+
+export const userAgent = (): string => `codex_cli_rs/${CODEX_VERSION} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
+
+function headersFor(tokens: CodexTokens, sessionId: string): Record<string, string> {
+  return {
+    authorization: `Bearer ${tokens.accessToken}`,
+    'chatgpt-account-id': tokens.accountId,
+    'content-type': 'application/json',
+    accept: 'text/event-stream',
+    originator: 'codex_cli_rs',
+    'user-agent': userAgent(),
+    'openai-beta': 'responses=experimental',
+    'session-id': sessionId,
+  };
+}
+
+const newerThan = (a: CodexTokens, b: CodexTokens): boolean => Date.parse(a.savedAt) > Date.parse(b.savedAt);
+
+function refreshed(tokens: CodexTokens, deps: CodexDeps, state: CodexState): Promise<CodexTokens> {
+  const latest = state.latest;
+  if (latest !== null && newerThan(latest, tokens) && !tokensStale(latest)) return Promise.resolve(latest);
+  if (state.refreshing !== null) return state.refreshing;
+  const run = refreshTokens(tokens, deps.issuer, deps.fetchImpl)
+    .then((fresh) => {
+      deps.save(fresh);
+      state.latest = fresh;
+      return fresh;
+    })
+    .catch((err: unknown) => {
+      throw new GatewayError(403, 'permission_error', `Codex sign-in expired (${errMsg(err)}): connect again on the Model page`);
+    })
+    .finally(() => {
+      state.refreshing = null;
+    });
+  state.refreshing = run;
+  return run;
+}
+
+export function currentTokens(cfg: ModelConfig, deps: CodexDeps, state: CodexState): Promise<CodexTokens> {
+  const tokens = cfg.codex.auth;
+  if (tokens === null) throw new GatewayError(400, 'invalid_request_error', 'Codex is not connected: sign in on the Model page.');
+  return tokensStale(tokens) ? refreshed(tokens, deps, state) : Promise.resolve(tokens);
+}
+
+function errorKind(status: number): string {
+  if (status === 401 || status === 403) return 'permission_error';
+  if (status === 429) return 'rate_limit_error';
+  if (status === 400 || status === 404 || status === 422) return 'invalid_request_error';
+  return 'api_error';
+}
+
+const sessionIdOf = (req: IncomingMessage): string => {
+  const raw = req.headers['x-claude-code-session-id'];
+  const given = (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+  return given === '' ? randomUUID() : given;
+};
+
+interface Call {
+  body: Record<string, unknown>;
+  model: string;
+  sessionId: string;
+  watch: Watch;
+  deps: CodexDeps;
+  names: ToolNames;
+}
+
+function send(call: Call, tokens: CodexTokens): Promise<Response> {
+  const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
+  return (call.deps.fetchImpl ?? fetch)(`${call.deps.base ?? CODEX_BASE}/responses`, {
+    method: 'POST',
+    headers: headersFor(tokens, call.sessionId),
+    body: JSON.stringify(request),
+    signal: call.watch.signal,
+    redirect: 'manual',
+  });
+}
+
+async function reach(call: Call, cfg: ModelConfig, state: CodexState): Promise<Response> {
+  let tokens = await currentTokens(cfg, call.deps, state);
+  let upstream = await send(call, tokens);
+  if (upstream.status === 401) {
+    await upstream.body?.cancel();
+    tokens = await refreshed(tokens, call.deps, state);
+    upstream = await send(call, tokens);
+  }
+  return upstream;
+}
+
+async function relayStream(upstream: Response, res: ServerResponse, model: string, names: ToolNames, watch: Watch): Promise<void> {
+  res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' });
+  const translator = new CodexEventTranslator(model, (name) => names.restore(name));
+  const body = upstream.body;
+  if (body === null) {
+    res.end(translator.close());
+    return;
+  }
+  const ping = setInterval(() => res.write('event: ping\ndata: {"type":"ping"}\n\n'), PING_MS);
+  try {
+    const parser = new SseParser();
+    const decoder = new TextDecoder();
+    const reader = body.getReader();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      watch.touch();
+      for (const raw of parser.push(decoder.decode(value, { stream: true }))) {
+        const parsed = parseEvent(raw);
+        if (parsed !== null) res.write(translator.push(parsed.event, parsed.data));
+      }
+    }
+    res.write(translator.close());
+  } catch (err) {
+    if (!watch.idle()) throw err;
+    res.write(translator.finished ? '' : translator.close(idleMessage(watch.ms)));
+  } finally {
+    clearInterval(ping);
+    watch.stop();
+    res.end();
+  }
+}
+
+async function relayWhole(upstream: Response, res: ServerResponse, model: string, names: ToolNames): Promise<void> {
+  const translator = new CodexEventTranslator(model, (name) => names.restore(name));
+  let frames = '';
+  const parser = new SseParser();
+  for (const raw of parser.push(await upstream.text())) {
+    const parsed = parseEvent(raw);
+    if (parsed !== null) frames += translator.push(parsed.event, parsed.data);
+  }
+  frames += translator.close();
+  const message = assembleMessage(frames);
+  const kind = isRecord(message.error) ? String(message.error.type) : '';
+  res.writeHead(message.type === 'error' ? (STATUS_OF[kind] ?? 502) : 200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(message));
+}
+
+export async function codexMessages(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  model: string,
+  cfg: ModelConfig,
+  deps: CodexDeps,
+  state: CodexState,
+  watch: Watch,
+): Promise<void> {
+  const call: Call = { body, model, sessionId: sessionIdOf(req), watch, deps, names: new ToolNames() };
+  const upstream = await reach(call, cfg, state);
+  if (!upstream.ok) {
+    const text = await upstream.text();
+    sendError(res, providerStatus(upstream.status), errorKind(upstream.status), upstreamMessage(text, `Codex answered ${String(upstream.status)}`));
+    return;
+  }
+  if (body.stream === true) await relayStream(upstream, res, model, call.names, watch);
+  else await relayWhole(upstream, res, model, call.names);
+}
+
+export function codexCount(res: ServerResponse, body: Record<string, unknown>): void {
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ input_tokens: Math.ceil(JSON.stringify(body).length / 4) }));
+}
+
+export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
+  const res = await (deps.fetchImpl ?? fetch)(`${deps.base ?? CODEX_BASE}/models?client_version=${CODEX_VERSION}`, {
+    headers: { ...headersFor(tokens, randomUUID()), accept: 'application/json' },
+    redirect: 'manual',
+  });
+  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status), `Codex would not list models (${String(res.status)})`);
+  const slugs = new Set<string>();
+  const walk = (value: unknown): void => {
+    if (Array.isArray(value)) value.forEach(walk);
+    else if (typeof value === 'object' && value !== null) {
+      const record = value as Record<string, unknown>;
+      if (typeof record.slug === 'string' && record.slug !== '') slugs.add(record.slug);
+      Object.values(record).forEach(walk);
+    }
+  };
+  walk(await res.json());
+  return [...slugs];
+}

package/runtime/node_modules/@metro-labs/mcp/src/gateway/eventstream.ts

@@ -0,0 +1,123 @@
+export interface EventStreamMessage {
+  headers: Record<string, string>;
+  payload: Buffer;
+}
+
+const PRELUDE_BYTES = 12;
+const CRC_BYTES = 4;
+
+const HEADER_TRUE = 0;
+const HEADER_FALSE = 1;
+const HEADER_BYTE = 2;
+const HEADER_SHORT = 3;
+const HEADER_INT = 4;
+const HEADER_LONG = 5;
+const HEADER_BYTES = 6;
+const HEADER_STRING = 7;
+const HEADER_TIMESTAMP = 8;
+const HEADER_UUID = 9;
+
+const FIXED_WIDTH: Record<number, number> = {
+  [HEADER_TRUE]: 0,
+  [HEADER_FALSE]: 0,
+  [HEADER_BYTE]: 1,
+  [HEADER_SHORT]: 2,
+  [HEADER_INT]: 4,
+  [HEADER_LONG]: 8,
+  [HEADER_TIMESTAMP]: 8,
+  [HEADER_UUID]: 16,
+};
+
+function readHeaderValue(buf: Buffer, at: number, type: number): { value: string; next: number } {
+  if (type === HEADER_BYTES || type === HEADER_STRING) {
+    const len = buf.readUInt16BE(at);
+    const raw = buf.subarray(at + 2, at + 2 + len);
+    const value = type === HEADER_STRING ? raw.toString('utf8') : raw.toString('base64');
+    return { value, next: at + 2 + len };
+  }
+  const width = FIXED_WIDTH[type];
+  if (width === undefined) throw new Error(`eventstream: unknown header type ${String(type)}`);
+  if (type === HEADER_TRUE) return { value: 'true', next: at };
+  if (type === HEADER_FALSE) return { value: 'false', next: at };
+  return { value: buf.subarray(at, at + width).toString('hex'), next: at + width };
+}
+
+function readHeaders(buf: Buffer): Record<string, string> {
+  const out: Record<string, string> = {};
+  let at = 0;
+  while (at < buf.length) {
+    const nameLen = buf.readUInt8(at);
+    const name = buf.subarray(at + 1, at + 1 + nameLen).toString('utf8');
+    const type = buf.readUInt8(at + 1 + nameLen);
+    const parsed = readHeaderValue(buf, at + 2 + nameLen, type);
+    out[name] = parsed.value;
+    at = parsed.next;
+  }
+  return out;
+}
+
+export function decodeFrame(buf: Buffer, offset: number): { message: EventStreamMessage; end: number } | null {
+  if (buf.length - offset < PRELUDE_BYTES) return null;
+  const total = buf.readUInt32BE(offset);
+  const headersLen = buf.readUInt32BE(offset + 4);
+  if (total < PRELUDE_BYTES + CRC_BYTES || headersLen > total) throw new Error('eventstream: malformed frame prelude');
+  if (buf.length - offset < total) return null;
+  const headersStart = offset + PRELUDE_BYTES;
+  const payloadStart = headersStart + headersLen;
+  const payloadEnd = offset + total - CRC_BYTES;
+  return {
+    message: {
+      headers: readHeaders(buf.subarray(headersStart, payloadStart)),
+      payload: Buffer.from(buf.subarray(payloadStart, payloadEnd)),
+    },
+    end: offset + total,
+  };
+}
+
+export class EventStreamDecoder {
+  private pending: Buffer = Buffer.alloc(0);
+
+  push(chunk: Buffer): EventStreamMessage[] {
+    this.pending = this.pending.length === 0 ? chunk : Buffer.concat([this.pending, chunk]);
+    const out: EventStreamMessage[] = [];
+    let offset = 0;
+    for (;;) {
+      const frame = decodeFrame(this.pending, offset);
+      if (frame === null) break;
+      out.push(frame.message);
+      offset = frame.end;
+    }
+    this.pending = this.pending.subarray(offset);
+    return out;
+  }
+}
+
+function encodeHeader(name: string, value: string): Buffer {
+  const nameBuf = Buffer.from(name, 'utf8');
+  const valueBuf = Buffer.from(value, 'utf8');
+  const out = Buffer.alloc(1 + nameBuf.length + 1 + 2 + valueBuf.length);
+  let at = 0;
+  out.writeUInt8(nameBuf.length, at);
+  at += 1;
+  nameBuf.copy(out, at);
+  at += nameBuf.length;
+  out.writeUInt8(HEADER_STRING, at);
+  at += 1;
+  out.writeUInt16BE(valueBuf.length, at);
+  at += 2;
+  valueBuf.copy(out, at);
+  return out;
+}
+
+export function encodeFrame(headers: Record<string, string>, payload: Buffer): Buffer {
+  const headerBuf = Buffer.concat(Object.entries(headers).map(([name, value]) => encodeHeader(name, value)));
+  const total = PRELUDE_BYTES + headerBuf.length + payload.length + CRC_BYTES;
+  const out = Buffer.alloc(total);
+  out.writeUInt32BE(total, 0);
+  out.writeUInt32BE(headerBuf.length, 4);
+  out.writeUInt32BE(0, 8);
+  headerBuf.copy(out, PRELUDE_BYTES);
+  payload.copy(out, PRELUDE_BYTES + headerBuf.length);
+  out.writeUInt32BE(0, total - CRC_BYTES);
+  return out;
+}

package/runtime/node_modules/@metro-labs/mcp/src/gateway/forward.ts

@@ -0,0 +1,169 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+export class GatewayError extends Error {
+  constructor(
+    readonly status: number,
+    readonly kind: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export const BODY_MAX = 64 * 1024 * 1024;
+const DRAIN_FACTOR = 2;
+const PING_MS = 25_000;
+const IDLE_MS = 300_000;
+const HOP_BY_HOP = new Set([
+  'host',
+  'connection',
+  'content-length',
+  'transfer-encoding',
+  'keep-alive',
+  'proxy-authorization',
+  'te',
+  'trailer',
+  'upgrade',
+  'accept-encoding',
+  'x-metro-key',
+]);
+const RESPONSE_DROP = new Set(['content-length', 'content-encoding', 'transfer-encoding', 'connection', 'keep-alive']);
+
+export function sendError(res: ServerResponse, status: number, kind: string, message: string): void {
+  res.writeHead(status, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ type: 'error', error: { type: kind, message } }));
+}
+
+export const errorFrame = (kind: string, message: string): string => `event: error\ndata: ${JSON.stringify({ type: 'error', error: { type: kind, message } })}\n\n`;
+
+export const providerStatus = (status: number): number => (status === 401 ? 403 : status);
+
+export const idleMs = (): number => Number(process.env.METRO_GATEWAY_IDLE_MS) || IDLE_MS;
+
+export const idleMessage = (ms: number): string => `metro gateway: the provider sent nothing for ${String(Math.round(ms / 1000))}s; giving up on this request`;
+
+export interface Watch {
+  signal: AbortSignal;
+  ms: number;
+  touch: () => void;
+  idle: () => boolean;
+  stop: () => void;
+}
+
+export function watchUpstream(res: ServerResponse, ms = idleMs()): Watch {
+  const control = new AbortController();
+  let expired = false;
+  let timer: NodeJS.Timeout | null = null;
+  const stop = (): void => {
+    if (timer !== null) clearTimeout(timer);
+    timer = null;
+  };
+  const arm = (): void => {
+    stop();
+    timer = setTimeout(() => {
+      expired = true;
+      control.abort();
+    }, ms);
+    timer.unref();
+  };
+  res.on('close', () => {
+    stop();
+    if (!res.writableEnded) control.abort();
+  });
+  arm();
+  return { signal: control.signal, ms, touch: arm, idle: () => expired, stop };
+}
+
+export async function readBody(req: IncomingMessage): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  let total = 0;
+  let over = false;
+  for await (const chunk of req) {
+    const buf = chunk as Buffer;
+    total += buf.length;
+    if (total > BODY_MAX) {
+      over = true;
+      if (total > BODY_MAX * DRAIN_FACTOR) break;
+      continue;
+    }
+    chunks.push(buf);
+  }
+  if (over) throw new GatewayError(413, 'invalid_request_error', 'request too large');
+  return Buffer.concat(chunks);
+}
+
+export function parseJson(raw: Buffer): Record<string, unknown> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw.toString('utf8'));
+  } catch {
+    throw new GatewayError(400, 'invalid_request_error', 'body must be JSON');
+  }
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+    throw new GatewayError(400, 'invalid_request_error', 'body must be a JSON object');
+  return parsed as Record<string, unknown>;
+}
+
+export function forwardedHeaders(req: IncomingMessage): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (HOP_BY_HOP.has(name) || value === undefined) continue;
+    out[name] = Array.isArray(value) ? value.join(', ') : value;
+  }
+  return out;
+}
+
+export interface PipeOptions {
+  keepalive?: boolean;
+  ownCredential?: boolean;
+}
+
+function openResponse(upstream: Response, res: ServerResponse, opts: PipeOptions): boolean {
+  const headers: Record<string, string> = {};
+  upstream.headers.forEach((value, name) => {
+    if (!RESPONSE_DROP.has(name)) headers[name] = value;
+  });
+  res.writeHead(opts.ownCredential === true ? providerStatus(upstream.status) : upstream.status, headers);
+  return (upstream.headers.get('content-type') ?? '').startsWith('text/event-stream');
+}
+
+async function pump(body: ReadableStream<Uint8Array>, res: ServerResponse, watch: Watch): Promise<void> {
+  const reader = body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) return;
+    watch.touch();
+    res.write(value);
+  }
+}
+
+export async function pipeResponse(upstream: Response, res: ServerResponse, watch: Watch, opts: PipeOptions = {}): Promise<void> {
+  const streaming = openResponse(upstream, res, opts);
+  const body = upstream.body;
+  if (body === null) {
+    res.end();
+    return;
+  }
+  const ping = opts.keepalive === true && streaming ? setInterval(() => res.write('event: ping\ndata: {"type":"ping"}\n\n'), PING_MS) : null;
+  try {
+    await pump(body, res, watch);
+  } catch (err) {
+    if (!watch.idle()) throw err;
+    if (streaming) res.write(errorFrame('api_error', idleMessage(watch.ms)));
+  } finally {
+    if (ping !== null) clearInterval(ping);
+    watch.stop();
+    res.end();
+  }
+}
+
+export function upstreamMessage(text: string, fallback: string): string {
+  if (text === '') return fallback;
+  try {
+    const parsed = JSON.parse(text) as { message?: unknown; Message?: unknown; error?: { message?: unknown } };
+    const message = parsed.message ?? parsed.Message ?? parsed.error?.message;
+    return typeof message === 'string' && message !== '' ? message : text;
+  } catch {
+    return text;
+  }
+}

package/runtime/node_modules/@metro-labs/mcp/src/gateway/gateway.ts

@@ -0,0 +1,193 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '../daemon/log.js';
+import { agentIdForKey } from '../db/key-map.js';
+import {
+  assertBedrockReady,
+  bedrockBase,
+  bedrockCount,
+  bedrockMessages,
+  freshAdaptations,
+  type Adaptations,
+} from './bedrock.js';
+import { forwardedHeaders, GatewayError, parseJson, pipeResponse, readBody, sendError, watchUpstream } from './forward.js';
+import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, writeModelConfig, type ModelConfig, type Route } from './model-config.js';
+import { codexCount, codexMessages, freshCodexState, type CodexDeps } from './codex.js';
+import type { CodexTokens } from './codex-auth.js';
+
+export const GATEWAY_PREFIX = '/gateway';
+export const ANTHROPIC_BASE = 'https://api.anthropic.com';
+export const OPENROUTER_BASE = 'https://openrouter.ai/api';
+const MESSAGES = '/v1/messages';
+const COUNT = '/v1/messages/count_tokens';
+const MODELS = '/v1/models';
+const HELLO = '/api/hello';
+
+export interface GatewayDeps {
+  config: () => ModelConfig;
+  identify?: (key: string) => boolean;
+  anthropicBase?: string;
+  bedrockBase?: string;
+  openrouterBase?: string;
+  codex?: Partial<CodexDeps>;
+}
+
+const learned: Adaptations = freshAdaptations();
+const codexState = freshCodexState();
+
+export function resetGatewayState(): void {
+  learned.fields.clear();
+  learned.dropBetas = false;
+  Object.assign(codexState, freshCodexState());
+}
+
+const saveCodexTokens = (tokens: CodexTokens): void => {
+  writeModelConfig(setCodexAuth(readModelConfig(), tokens));
+};
+
+const keyOf = (req: IncomingMessage): string => {
+  const raw = req.headers['x-metro-key'];
+  return (Array.isArray(raw) ? raw[0] : raw)?.trim() ?? '';
+};
+
+const defaultIdentify = (key: string): boolean => key !== '' && agentIdForKey(key) !== undefined;
+
+function modelsBody(cfg: ModelConfig): Record<string, unknown> {
+  const data: Record<string, string>[] = [];
+  if (cfg.bedrock.model !== '')
+    data.push({ id: `bedrock:${cfg.bedrock.model}`, display_name: `Bedrock · ${cfg.bedrock.model}`, description: 'Through metro, billed to Amazon Bedrock' });
+  if (cfg.openrouter.model !== '')
+    data.push({ id: `openrouter:${cfg.openrouter.model}`, display_name: `OpenRouter · ${cfg.openrouter.model}`, description: 'Through metro, billed to OpenRouter' });
+  if (cfg.codex.model !== '')
+    data.push({ id: `codex:${cfg.codex.model}`, display_name: `Codex · ${cfg.codex.model}`, description: 'Through metro, on your ChatGPT subscription' });
+  return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
+}
+
+function requestedModel(body: Record<string, unknown>): string {
+  const model = body.model;
+  if (typeof model !== 'string' || model === '') throw new GatewayError(400, 'invalid_request_error', 'model is required');
+  return model;
+}
+
+async function toAnthropic(
+  req: IncomingMessage,
+  res: ServerResponse,
+  raw: Buffer,
+  body: Record<string, unknown>,
+  route: Route,
+  deps: GatewayDeps,
+): Promise<void> {
+  const explicit = typeof body.model === 'string' && body.model !== route.model;
+  const payload = explicit ? Buffer.from(JSON.stringify({ ...body, model: route.model })) : raw;
+  const url = `${deps.anthropicBase ?? ANTHROPIC_BASE}${(req.url ?? '').slice(GATEWAY_PREFIX.length)}`;
+  const watch = watchUpstream(res);
+  const upstream = await fetch(url, {
+    method: 'POST',
+    headers: forwardedHeaders(req),
+    body: new Uint8Array(payload),
+    signal: watch.signal,
+    redirect: 'manual',
+  });
+  await pipeResponse(upstream, res, watch);
+}
+
+async function toOpenRouter(
+  req: IncomingMessage,
+  res: ServerResponse,
+  body: Record<string, unknown>,
+  route: Route,
+  cfg: ModelConfig,
+  deps: GatewayDeps,
+): Promise<void> {
+  const reason = notReady(cfg, 'openrouter');
+  if (reason !== null) throw new GatewayError(400, 'invalid_request_error', reason);
+  const headers: Record<string, string> = {
+    'content-type': 'application/json',
+    accept: req.headers.accept ?? 'application/json',
+    authorization: `Bearer ${cfg.openrouter.apiKey}`,
+    'anthropic-version': typeof req.headers['anthropic-version'] === 'string' ? req.headers['anthropic-version'] : '2023-06-01',
+    'http-referer': 'https://metro.box',
+    'x-title': 'metro',
+  };
+  const beta = req.headers['anthropic-beta'];
+  if (typeof beta === 'string' && beta !== '') headers['anthropic-beta'] = beta;
+  const watch = watchUpstream(res);
+  const upstream = await fetch(`${deps.openrouterBase ?? OPENROUTER_BASE}${MESSAGES}`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({ ...body, model: route.model }),
+    signal: watch.signal,
+    redirect: 'manual',
+  });
+  await pipeResponse(upstream, res, watch, { keepalive: true, ownCredential: true });
+}
+
+async function dispatch(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): Promise<void> {
+  const cfg = deps.config();
+  const raw = await readBody(req);
+  const body = parseJson(raw);
+  const route = resolveRoute(requestedModel(body), cfg);
+  log.info({ route: routeLabel(route), path }, 'gateway: routing');
+  if (route.provider === 'bedrock') {
+    assertBedrockReady(cfg.bedrock);
+    const up = { settings: cfg.bedrock, base: deps.bedrockBase ?? bedrockBase(cfg.bedrock.region), learned, watch: watchUpstream(res) };
+    if (path === COUNT) await bedrockCount(req, res, body, route.model, up);
+    else await bedrockMessages(req, res, body, route.model, up);
+    return;
+  }
+  if (route.provider === 'openrouter') {
+    if (path === COUNT) throw new GatewayError(404, 'not_found_error', 'OpenRouter does not count tokens');
+    await toOpenRouter(req, res, body, route, cfg, deps);
+    return;
+  }
+  if (route.provider === 'codex') {
+    if (path === COUNT) {
+      codexCount(res, body);
+      return;
+    }
+    const codexDeps: CodexDeps = { save: saveCodexTokens, ...deps.codex };
+    await codexMessages(req, res, body, route.model, cfg, codexDeps, codexState, watchUpstream(res));
+    return;
+  }
+  await toAnthropic(req, res, raw, body, route, deps);
+}
+
+function failed(res: ServerResponse, err: unknown): void {
+  if (res.headersSent) {
+    res.end();
+    return;
+  }
+  if (err instanceof GatewayError) {
+    sendError(res, err.status, err.kind, err.message);
+    return;
+  }
+  log.warn({ err: errMsg(err) }, 'gateway: request failed');
+  sendError(res, 502, 'api_error', `metro gateway: ${errMsg(err)}`);
+}
+
+function answer(req: IncomingMessage, res: ServerResponse, path: string, deps: GatewayDeps): void {
+  if (req.method === 'GET' && path === MODELS) {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(modelsBody(deps.config())));
+    return;
+  }
+  if (req.method === 'POST' && (path === MESSAGES || path === COUNT)) {
+    dispatch(req, res, path, deps).catch((err: unknown) => {
+      failed(res, err);
+    });
+    return;
+  }
+  sendError(res, 404, 'not_found_error', 'not found');
+}
+
+export function handleGatewayRequest(req: IncomingMessage, res: ServerResponse, deps: GatewayDeps): boolean {
+  const full = req.url ?? '';
+  if (full !== GATEWAY_PREFIX && !full.startsWith(`${GATEWAY_PREFIX}/`)) return false;
+  const path = (full.split('?')[0] ?? '').slice(GATEWAY_PREFIX.length);
+  if (req.method === 'HEAD' && path === HELLO) {
+    res.writeHead(200).end();
+    return true;
+  }
+  if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
+  else sendError(res, 401, 'authentication_error', 'metro gateway: no agent key (x-metro-key); start Claude Code with metro claude');
+  return true;
+}