@velum-labs/routekit-daemon 0.17.2 → 0.17.4

package/dist/index.js

@@ -8,10 +8,10 @@
  */
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { AccountActivityCoordinator, accountStoreEntries, CLIPROXY_API_KEY_ENV, CLIPROXY_BASE_URL_ENV, cliproxyAccountEntries, cliproxyAccountMatchesKind, cliproxyApiKey, cliproxyAuthDirectory, cliproxyBaseUrl, cliproxyCredentialValid, defaultSubscriptionAccountDirectory, RateLimitTracker, removeCliproxyAccount, removeSubscriptionAccount, renameSubscriptionAccount, sanitizeSubscriptionLabel, subscriptionAccountIdentity } from "@velum-labs/routekit-accounts";
+import { AccountActivityCoordinator, AccountAuthCoordinator, accountStoreEntries, CLIPROXY_API_KEY_ENV, CLIPROXY_BASE_URL_ENV, cliproxyAccountEntries, cliproxyAccountMatchesKind, cliproxyApiKey, cliproxyAuthDirectory, cliproxyBaseUrl, cliproxyCredentialValid, defaultSubscriptionAccountDirectory, RateLimitTracker, removeCliproxyAccount, removeSubscriptionAccount, renameSubscriptionAccount, sanitizeSubscriptionLabel, subscriptionAccountIdentity, subscriptionCredentialFingerprint } from "@velum-labs/routekit-accounts";
 import { configuredProviderIds, globalRouterConfigPath, parseRouterConfigDocument, routekitHome, writeRouterConfig } from "@velum-labs/routekit-config";
 import { createRouteKitControlHandler, ROUTEKIT_CONTROL_CAPABILITY } from "@velum-labs/routekit-control";
-import { resolveLeaderboardConfig, startSwitchingGatewayProxy } from "@velum-labs/routekit-gateway";
+import { resolveCodexStartupModel, resolveLeaderboardConfig, startSwitchingGatewayProxy } from "@velum-labs/routekit-gateway";
 import { accountKindForCliproxyAuthType, PROVIDERS, resolveAccountConnector } from "@velum-labs/routekit-registry";
 import { startRouter } from "@velum-labs/routekit-router";
 import { acquireLifecycleLock, CONTROL_PROTOCOL_VERSION, ControlClient, ControlError, createPortlessSession, createServiceRecordStore, createTokenStore, encodeJoinCredential, extendCleanupGrace, generateControlToken, nextServiceGeneration, processIdentity, registerCleanup, SERVICE_HOME_MODE, startControlServer, supervisorFromEnv, writeFileAtomic } from "@velum-labs/routekit-runtime";
@@ -276,6 +276,7 @@ export async function startRouteKitDaemon(options) {
     let sidecarRef;
     let activeRouter;
     let accountActivity;
+    let accountAuth;
     let daemonTelemetry;
     let gatewayTelemetry;
     let record;
@@ -352,6 +353,18 @@ export async function startRouteKitDaemon(options) {
         accountActivity = new AccountActivityCoordinator({
             statePath: join(home, "usage", "account-activity.v1.json")
         });
+        mkdirSync(join(home, "subscriptions"), { recursive: true, mode: 0o700 });
+        accountAuth = new AccountAuthCoordinator({
+            statePath: join(home, "subscriptions", "account-auth.v1.json")
+        });
+        const activeCredentialFingerprints = () => new Map(accountStoreEntries(env).flatMap((entry) => entry.connector === "native"
+            ? [
+                [
+                    subscriptionAccountIdentity(entry.subscriptionKind, entry.label),
+                    subscriptionCredentialFingerprint(entry.path)
+                ]
+            ]
+            : []));
         const applyLeaderboardConfig = (config) => {
             leaderboardConfig = resolveLeaderboardConfig(config);
             callAttributions.configureBudget({
@@ -395,10 +408,12 @@ export async function startRouteKitDaemon(options) {
             env: routerEnv(),
             provenance,
             activity: accountActivity,
+            authHealth: accountAuth,
             drainGraceMs
         });
         await sidecar.reconcile(wantsCliproxySidecar(currentConfig));
         activeRouter = await startGeneration(currentConfig);
+        accountAuth.reconcileActiveCredentials(activeCredentialFingerprints());
         proxy = await startSwitchingGatewayProxy({
             target: activeRouter.url,
             host: options.host ?? "127.0.0.1",
@@ -471,6 +486,7 @@ export async function startRouteKitDaemon(options) {
             currentDocument = input.write ? readFileSync(configPath, "utf8") : nextDocument;
             revisions = nextRevisions;
             applyLeaderboardConfig(currentConfig);
+            accountAuth?.reconcileActiveCredentials(activeCredentialFingerprints());
             if (previousRouter !== undefined) {
                 try {
                     if (previousTarget !== undefined) {
@@ -625,7 +641,10 @@ export async function startRouteKitDaemon(options) {
                     models,
                     ...(currentConfig.defaultModel !== undefined
                         ? { defaultModel: currentConfig.defaultModel }
-                        : {}),
+                        : typeof body.default_model === "string" &&
+                            models.some((model) => model.id === body.default_model)
+                            ? { defaultModel: body.default_model }
+                            : {}),
                     revision: revisions.config
                 };
                 writeSnapshot(home, "catalog", "models", {
@@ -745,6 +764,9 @@ export async function startRouteKitDaemon(options) {
                             label: entry.label,
                             connector: entry.connector,
                             credentialValid: member?.credentialValid ?? false,
+                            ...(member?.upstreamAuthState !== undefined
+                                ? { upstreamAuthState: member.upstreamAuthState }
+                                : {}),
                             configured: currentConfig.providers[entry.subscriptionKind] !== undefined,
                             relayOpen: member?.relayReady === true &&
                                 currentConfig.providers[entry.subscriptionKind] !== undefined,
@@ -936,8 +958,16 @@ export async function startRouteKitDaemon(options) {
                     const transaction = prepareAccountTransaction({
                         home,
                         configPath,
-                        accountPaths: prepared.map((entry) => entry.path),
-                        accountRoots: prepared.map((entry) => entry.directory),
+                        accountPaths: [
+                            ...prepared.map((entry) => entry.path),
+                            ...(connector === "native"
+                                ? [join(home, "subscriptions", "account-auth.v1.json")]
+                                : [])
+                        ],
+                        accountRoots: [
+                            ...prepared.map((entry) => entry.directory),
+                            ...(connector === "native" ? [join(home, "subscriptions")] : [])
+                        ],
                         kind,
                         provider,
                         labels: prepared.map((entry) => entry.label)
@@ -957,6 +987,11 @@ export async function startRouteKitDaemon(options) {
                             configRevision: true,
                             accountRevision: true,
                             beforeSwap: async () => {
+                                if (connector === "native") {
+                                    for (const entry of prepared) {
+                                        accountAuth.activateFingerprint(subscriptionAccountIdentity(kind, entry.label), subscriptionCredentialFingerprint(entry.path));
+                                    }
+                                }
                                 markAccountTransactionCommitted(transaction);
                                 if (connector === "cliproxy")
                                     await sidecar.refresh();
@@ -976,6 +1011,7 @@ export async function startRouteKitDaemon(options) {
                         const rollbackFailures = [];
                         try {
                             rollbackAccountTransaction(transaction, home);
+                            accountAuth?.reload();
                         }
                         catch (rollbackError) {
                             rollbackFailures.push(rollbackError);
@@ -1067,11 +1103,12 @@ export async function startRouteKitDaemon(options) {
                         const nextDocument = disableProvider ? stringifyYaml(raw) : currentDocument;
                         const nextConfig = disableProvider ? parseConfigDocument(nextDocument) : currentConfig;
                         const activityPath = join(home, "usage", "account-activity.v1.json");
+                        const authPath = join(home, "subscriptions", "account-auth.v1.json");
                         const transaction = prepareAccountTransaction({
                             home,
                             configPath,
-                            accountPaths: [nativePath, activityPath],
-                            accountRoots: [activeNativeDirectory, home],
+                            accountPaths: [nativePath, activityPath, authPath],
+                            accountRoots: [activeNativeDirectory, home, join(home, "subscriptions")],
                             kind: nativeKind,
                             provider: nativeKind,
                             labels: [params.label]
@@ -1091,6 +1128,7 @@ export async function startRouteKitDaemon(options) {
                                 accountRevision: true,
                                 beforeSwap: () => {
                                     accountActivity.remove(subscriptionAccountIdentity(nativeKind, params.label));
+                                    accountAuth.remove(subscriptionAccountIdentity(nativeKind, params.label));
                                     markAccountTransactionCommitted(transaction);
                                 }
                             });
@@ -1106,6 +1144,7 @@ export async function startRouteKitDaemon(options) {
                             try {
                                 rollbackAccountTransaction(transaction, home);
                                 accountActivity?.reload();
+                                accountAuth?.reload();
                             }
                             catch (rollbackError) {
                                 rollbackFailures.push(rollbackError);
@@ -1175,6 +1214,7 @@ export async function startRouteKitDaemon(options) {
                     const targetPath = join(directory, `${params.target}.json`);
                     const trackerPath = join(directory, ".state.json");
                     const activityPath = join(home, "usage", "account-activity.v1.json");
+                    const authPath = join(home, "subscriptions", "account-auth.v1.json");
                     if (!existsSync(sourcePath)) {
                         throw new ControlError({
                             code: "not_found",
@@ -1200,8 +1240,8 @@ export async function startRouteKitDaemon(options) {
                     const transaction = prepareAccountTransaction({
                         home,
                         configPath,
-                        accountPaths: [sourcePath, targetPath, trackerPath, activityPath],
-                        accountRoots: [directory, home],
+                        accountPaths: [sourcePath, targetPath, trackerPath, activityPath, authPath],
+                        accountRoots: [directory, home, join(home, "subscriptions")],
                         kind,
                         provider: kind,
                         labels: [params.source, params.target]
@@ -1217,6 +1257,7 @@ export async function startRouteKitDaemon(options) {
                             accountRevision: true,
                             beforeSwap: () => {
                                 accountActivity.rename(subscriptionAccountIdentity(kind, params.source), subscriptionAccountIdentity(kind, params.target));
+                                accountAuth.rename(subscriptionAccountIdentity(kind, params.source), subscriptionAccountIdentity(kind, params.target));
                                 markAccountTransactionCommitted(transaction);
                             }
                         });
@@ -1232,6 +1273,7 @@ export async function startRouteKitDaemon(options) {
                         try {
                             rollbackAccountTransaction(transaction, home);
                             accountActivity?.reload();
+                            accountAuth?.reload();
                         }
                         catch (rollbackError) {
                             rollbackFailures.push(rollbackError);
@@ -1447,10 +1489,59 @@ export async function startRouteKitDaemon(options) {
             },
             "launcher.prepare": async (params, context) => {
                 const listed = await handlers["models.list"]({}, {
-                    signal: new AbortController().signal,
+                    signal: context.signal,
                     requestId: "internal"
                 });
-                const model = params.model ?? listed.defaultModel ?? listed.models[0]?.id;
+                let model = params.model ?? listed.defaultModel ?? listed.models[0]?.id;
+                let codexSelection;
+                if (params.tool === "codex") {
+                    const candidates = listed.models.flatMap((entry) => {
+                        const info = activeRouter.modelInfo(entry.id);
+                        if (info === undefined)
+                            return [];
+                        return [{
+                                id: info.id,
+                                nativeId: info.nativeModel,
+                                provider: info.provider,
+                                billingScope: info.billingMode,
+                                ...(info.createdAt !== undefined ? { createdAt: info.createdAt } : {}),
+                                ...(info.providerPriority !== undefined
+                                    ? { providerPriority: info.providerPriority }
+                                    : {}),
+                                ...(info.metadata?.architecture !== undefined
+                                    ? { architecture: info.metadata.architecture }
+                                    : {}),
+                                ...(info.metadata?.supportedParameters !== undefined
+                                    ? { supportedParameters: info.metadata.supportedParameters }
+                                    : {}),
+                                ...(info.reasoning !== null ? { reasoning: info.reasoning } : {})
+                            }];
+                    });
+                    try {
+                        const selected = await resolveCodexStartupModel({
+                            models: candidates,
+                            ...(listed.defaultModel !== undefined
+                                ? { preferredModel: listed.defaultModel }
+                                : {}),
+                            ...(params.model !== undefined ? { requestedModel: params.model } : {}),
+                            signal: context.signal
+                        });
+                        model = selected.model;
+                        codexSelection = {
+                            compatibleModelIds: [...selected.compatibleModelIds],
+                            models: [...selected.models]
+                        };
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        throw new ControlError({
+                            code: params.model !== undefined && message.startsWith("unknown model")
+                                ? "not_found"
+                                : "unavailable",
+                            message
+                        });
+                    }
+                }
                 if (model === undefined || !listed.models.some((entry) => entry.id === model)) {
                     throw new ControlError({
                         code: "not_found",
@@ -1464,7 +1555,8 @@ export async function startRouteKitDaemon(options) {
                     model,
                     gatewayUrl: dataUrl,
                     authToken: dataTokenForPrincipal(tokens, dataTokenCache, dataAuth.token, context.principal),
-                    env: {}
+                    env: {},
+                    ...(codexSelection !== undefined ? { codexSelection } : {})
                 };
             },
             "tokens.issue": async (params, context) => {
@@ -1652,6 +1744,7 @@ export async function startRouteKitDaemon(options) {
                 await proxy?.drain(drainGraceMs);
                 await activeRouter?.close();
                 accountActivity?.close();
+                accountAuth?.close();
                 await sidecar.close();
                 await control?.close();
                 if (portless?.enabled)
@@ -1691,6 +1784,7 @@ export async function startRouteKitDaemon(options) {
         await proxy?.close();
         await activeRouter?.close();
         accountActivity?.close();
+        accountAuth?.close();
         await sidecarRef?.close();
         await control?.close();
         if (portless?.enabled)

package/dist/test/daemon.test.js

@@ -10,19 +10,19 @@ import { ControlClient, ControlError, createServiceRecordStore } from "@velum-la
 import { parse as parseYaml } from "yaml";
 import { prepareAccountTransaction } from "../account-transaction.js";
 import { startRouteKitDaemon } from "../index.js";
-async function mockProvider() {
+async function mockProvider(models = [
+    {
+        id: "mock-model",
+        object: "model",
+        capabilities: { streaming: "supported", tools: "degraded" },
+        supported_reasoning_levels: ["high"]
+    }
+]) {
     const server = createServer((req, res) => {
         if (req.url === "/v1/models") {
             res.setHeader("content-type", "application/json");
             res.end(JSON.stringify({
-                data: [
-                    {
-                        id: "mock-model",
-                        object: "model",
-                        capabilities: { streaming: "supported", tools: "degraded" },
-                        supported_reasoning_levels: ["high"]
-                    }
-                ]
+                data: models
             }));
             return;
         }
@@ -339,6 +339,94 @@ test("singleton daemon exposes authenticated control and a stable reloadable dat
         rmSync(root, { recursive: true, force: true });
     }
 });
+test("local Codex preparation ranks an incompatible OpenAI default by native recency", async () => {
+    const root = mkdtempSync(join(tmpdir(), "routekit-daemon-codex-ranking-"));
+    const stateHome = join(root, "state");
+    const configPath = join(root, "router.yaml");
+    writeFileSync(configPath, "providers:\n  openai: {}\ndefaultModel: openai/text-embedding-test\n");
+    const upstream = await mockProvider([
+        { id: "text-embedding-test", object: "model", created: 50 },
+        { id: "older-generation", object: "model", created: 100 },
+        { id: "newer-generation", object: "model", created: 200 }
+    ]);
+    const originalFetch = globalThis.fetch;
+    let openRouterFetches = 0;
+    globalThis.fetch = async (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : input.toString());
+        if (url.hostname === "openrouter.ai") {
+            openRouterFetches += 1;
+            if (url.pathname === "/api/v1/models") {
+                return Response.json({
+                    data: [
+                        {
+                            id: "openai/older-generation",
+                            created: 900,
+                            architecture: {
+                                input_modalities: ["text"],
+                                output_modalities: ["text"]
+                            },
+                            supported_parameters: ["tools"]
+                        },
+                        {
+                            id: "openai/newer-generation",
+                            created: 800,
+                            architecture: {
+                                input_modalities: ["text"],
+                                output_modalities: ["text"]
+                            },
+                            supported_parameters: ["tools"]
+                        }
+                    ]
+                });
+            }
+            if (url.pathname === "/api/v1/embeddings/models") {
+                return Response.json({ data: [{ id: "openai/text-embedding-test" }] });
+            }
+            return Response.json({ data: [] });
+        }
+        return await originalFetch(input, init);
+    };
+    let daemon;
+    try {
+        daemon = await startRouteKitDaemon({
+            packageVersion: "1.2.3",
+            stateHome,
+            configPath,
+            port: 0,
+            portless: false,
+            env: {
+                ...process.env,
+                HOME: root,
+                ROUTEKIT_HOME: stateHome,
+                OPENAI_API_KEY: "test-key",
+                OPENAI_BASE_URL: upstream.url,
+                ROUTEKIT_PORTLESS: "0"
+            }
+        });
+        const client = new RouteKitControlClient({
+            url: daemon.record.url,
+            token: daemon.record.controlToken
+        });
+        const explicit = await client.call("launcher.prepare", {
+            tool: "codex",
+            model: "openai/older-generation"
+        });
+        assert.equal(explicit.model, "openai/older-generation");
+        assert.equal(openRouterFetches, 0);
+        const implicit = await client.call("launcher.prepare", { tool: "codex" });
+        assert.equal(implicit.model, "openai/newer-generation");
+        assert.equal(openRouterFetches, 4);
+        assert.equal(implicit.codexSelection?.models.find((model) => model.id === "openai/older-generation")?.createdAt, 100, "native OpenAI creation time wins over OpenRouter");
+        assert.equal(implicit.codexSelection?.models.find((model) => model.id === "openai/newer-generation")?.createdAt, 200);
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+        if (daemon !== undefined)
+            await daemon.close();
+        await upstream.close();
+        rmSync(root, { recursive: true, force: true });
+    }
+});
 test("daemon account activity persists last selection independently of leaderboard rollups", async () => {
     const root = mkdtempSync(join(tmpdir(), "routekit-daemon-activity-"));
     const stateHome = join(root, "state");
@@ -518,6 +606,12 @@ test("cleared persisted cooldown remains absent and eligible after daemon reload
                     url: daemon.record.url,
                     token: daemon.record.controlToken
                 });
+                const prepared = await client.call("launcher.prepare", { tool: "codex" });
+                assert.equal(prepared.model, "codex/gpt-test-model");
+                assert.deepEqual(prepared.codexSelection?.compatibleModelIds, [
+                    "codex/gpt-test-model"
+                ]);
+                assert.deepEqual(prepared.codexSelection?.models[0]?.architecture?.outputModalities, ["text"]);
                 const before = await client.call("accounts.status", {});
                 assert.equal(before.accounts[0]?.relayOpen, false);
                 assert.deepEqual(before.accounts[0]?.readinessReasons, [
@@ -779,8 +873,8 @@ for (const kind of ["claude-code", "codex"]) {
                     });
                     assert.equal(doctor.checks.find((check) => check.name === "account/provider consistency")?.ok, true);
                     await assert.rejects(client.call("launcher.prepare", { tool: "codex" }), (error) => error instanceof ControlError &&
-                        error.code === "not_found" &&
-                        /no model is available/.test(error.message));
+                        error.code === "unavailable" &&
+                        /no advertised model with text output and tool support/.test(error.message));
                     assert.equal((await fetch(`${daemon.dataUrl}/health`)).status, 200);
                     const dataToken = readFileSync(daemon.record.authTokenFile, "utf8").trim();
                     const gatewayModels = await fetch(`${daemon.dataUrl}/v1/models`, {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@velum-labs/routekit-daemon",
   "private": false,
-  "version": "0.17.2",
+  "version": "0.17.4",
   "description": "Singleton RouteKit control daemon and stable model gateway.",
   "repository": {
     "type": "git",
@@ -35,14 +35,14 @@
   "dependencies": {
     "posthog-node": "5.46.1",
     "yaml": "2.9.0",
-    "@velum-labs/routekit-accounts": "0.17.2",
-    "@velum-labs/routekit-config": "0.17.2",
-    "@velum-labs/routekit-control": "0.17.2",
-    "@velum-labs/routekit-gateway": "0.17.2",
-    "@velum-labs/routekit-registry": "0.17.2",
-    "@velum-labs/routekit-router": "0.17.2",
-    "@velum-labs/routekit-runtime": "0.17.2",
-    "@velum-labs/routekit-telemetry-core": "0.17.2"
+    "@velum-labs/routekit-accounts": "0.17.4",
+    "@velum-labs/routekit-config": "0.17.4",
+    "@velum-labs/routekit-control": "0.17.4",
+    "@velum-labs/routekit-gateway": "0.17.4",
+    "@velum-labs/routekit-registry": "0.17.4",
+    "@velum-labs/routekit-router": "0.17.4",
+    "@velum-labs/routekit-runtime": "0.17.4",
+    "@velum-labs/routekit-telemetry-core": "0.17.4"
   },
   "scripts": {
     "build": "tsc -b",