aicodeman 1.43.0 → 1.45.0

package/dist/web/routes/config-backup-routes.js

@@ -0,0 +1,268 @@
+/**
+ * @fileoverview Config backups (src/config-backup.ts).
+ *
+ * GET  /api/config-backups              — settings in effect, the folder, and the snapshots in it.
+ * POST /api/config-backups              — snapshot now (a manual request always makes one).
+ * POST /api/config-backups/:id/restore  — put a snapshot's files back (after a `pre-restore` snapshot).
+ * GET  /api/config-backups/diff?from=&to= — what differs between two snapshots, or a snapshot and the
+ *                                           running config (`current`, the default for `to`).
+ *
+ * The files include credentials (`.env`, `users.json`, endpoint keys), so in multi-user mode all four
+ * are admin only. Responses carry file NAMES and sizes, never file content, except the diff, which shows
+ * changed values but never a credential's (`.env`, `users.json`, `push-keys.json`, `webhook.json`, `intents.json` and any key that looks
+ * like a token/secret/password are reported as "changed" only). Restore replaces files the running server
+ * may have cached: `restartRequired` says which ones only apply after a restart. A restore that could not
+ * write every file answers 500 with the error envelope plus `data` (`restored`, `failed`, `untouched`,
+ * `safetySnapshot`, `restartRequired`): the files it wrote stay restored and are reloaded like a full one.
+ */
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { ApiErrorCode, createErrorResponse, getErrorMessage } from '../../types.js';
+import { getAuthUser, isAdmin, readJsonConfig, SETTINGS_PATH } from '../route-helpers.js';
+import { appendAdminAudit } from '../admin-audit.js';
+import { reloadCliRegistry } from '../../config/cli-registry/registry.js';
+import { isMultiUserMode } from '../../config/multiuser.js';
+import { getDataDir } from '../../config/instance.js';
+import { intentStore } from '../../intent-store.js';
+import { describeUnknownPath, probePathKind } from '../../utils/bounded-path-probe.js';
+import { dirname } from 'node:path';
+import { CONFIG_BACKUP_FILES, CONFIG_DIFF_CURRENT, ConfigBackupCorruptError, ConfigBackupNotFoundError, ConfigBackupPartialRestoreError, defaultConfigBackupDir, diffConfigBackups, listConfigBackups, readConfigBackupSettings, resolveConfigBackupDir, restoreConfigBackup, runConfigBackupPass, withRecordedRetention, readConfigBackupOrigin, } from '../../config-backup.js';
+// Only recorded in each manifest; a missing package.json just leaves it blank.
+const APP_VERSION = (() => {
+    try {
+        return createRequire(import.meta.url)('../../../package.json').version ?? '';
+    }
+    catch {
+        return '';
+    }
+})();
+/** Files whose running-process copy only reloads on restart (the rest are read per request; `users.json`
+ * is re-read within a second, `clis.json` is reloaded below, `intents.json` by `reload()`). */
+const RESTART_REQUIRED = new Set(['.env', 'push-keys.json', 'settings.json']);
+/**
+ * The settings in effect and the folder they name. A custom folder is probed (bounded, #516) BEFORE
+ * the recorded-retention fallback reads it, so this throws `BackupDirUnavailableError` for a folder
+ * that does not answer and never lists it; `present` is false for a custom folder that does not exist yet.
+ */
+export async function readEffectiveBackupSettings() {
+    const raw = await readJsonConfig(SETTINGS_PATH, 'settings.json', {});
+    const base = readConfigBackupSettings(raw);
+    const dir = resolveConfigBackupDir(base, getDataDir());
+    const present = await probeBackupDir(base, dir);
+    // The same fallback the timer pass uses, so the form never shows 20 / 30 while a pass keeps 100 / 0.
+    const settings = present ? withRecordedRetention(base, raw, dir, readConfigBackupOrigin(getDataDir())) : base;
+    return { settings, dir, present };
+}
+/** A user-chosen backup folder that is not safe to touch (bounded probe, as for case paths, #516). */
+export class BackupDirUnavailableError extends Error {
+}
+/**
+ * Probe a custom backup folder without blocking the event loop on a dead mount. The default folder
+ * needs no probe. Returns whether the folder exists; throws when it did not answer, or is not a
+ * folder. A missing custom folder is only creatable when its parent is present.
+ */
+export async function probeBackupDir(settings, dir) {
+    if (!settings.dir || dir === defaultConfigBackupDir(getDataDir()))
+        return true;
+    const kind = await probePathKind(dir, { pastCap: true });
+    if (kind === 'unknown')
+        throw new BackupDirUnavailableError(describeUnknownPath('Backup folder', dir, { pastCap: true }));
+    if (kind === 'file')
+        throw new BackupDirUnavailableError(`Backup folder is a file, not a folder: ${dir}`);
+    if (kind === 'directory')
+        return true;
+    const parent = await probePathKind(dirname(dir), { pastCap: true });
+    if (parent === 'unknown') {
+        throw new BackupDirUnavailableError(describeUnknownPath('Backup folder', dirname(dir), { pastCap: true }));
+    }
+    if (parent !== 'directory')
+        throw new BackupDirUnavailableError(`Backup folder's parent is missing: ${dirname(dir)}`);
+    return false;
+}
+async function readSettingsForBackup() {
+    try {
+        const parsed = JSON.parse(await readFile(SETTINGS_PATH, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : 'unreadable';
+    }
+    catch (err) {
+        return err.code === 'ENOENT' ? {} : 'unreadable';
+    }
+}
+/** Snapshot (when changed) and apply retention; shared by the timer and the manual route. */
+export async function runConfigBackup(reason, opts = {}) {
+    // Read settings.json directly: readJsonConfig answers {} for ANY failure, so a syntax error or a read
+    // that lands inside PUT /api/settings's non-atomic write used to prune with the defaults (20 / 30
+    // days) and drop the longer history the user asked to keep.
+    const raw = await readSettingsForBackup();
+    const unreadable = raw === 'unreadable';
+    const fromFile = readConfigBackupSettings(unreadable ? {} : raw);
+    if (!fromFile.enabled && !opts.force)
+        return null;
+    const dir = resolveConfigBackupDir(fromFile, getDataDir());
+    await probeBackupDir(fromFile, dir);
+    return runConfigBackupPass({
+        dataDir: getDataDir(),
+        backupDir: dir,
+        reason,
+        appVersion: APP_VERSION,
+        force: opts.force,
+        settings: fromFile,
+        raw: unreadable ? {} : raw,
+        // An unreadable settings.json still gets its snapshot, but no pass deletes anything on its say-so.
+        prune: !unreadable,
+    });
+}
+export function registerConfigBackupRoutes(app) {
+    const deny = (req, reply) => {
+        if (isMultiUserMode() && !isAdmin(req)) {
+            reply.code(403);
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'Admin only in multi-user mode');
+        }
+        return null;
+    };
+    app.get('/api/config-backups', async (req, reply) => {
+        const denied = deny(req, reply);
+        if (denied)
+            return denied;
+        let eff;
+        try {
+            eff = await readEffectiveBackupSettings();
+        }
+        catch (err) {
+            reply.code(503);
+            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getErrorMessage(err));
+        }
+        const { settings, dir, present } = eff;
+        // Read-only: a listing must not create config-backup-id, and without one nothing can be ours.
+        const origin = readConfigBackupOrigin(getDataDir());
+        return {
+            success: true,
+            data: {
+                settings,
+                dir,
+                defaultDir: defaultConfigBackupDir(getDataDir()),
+                tracked: CONFIG_BACKUP_FILES,
+                backups: present && origin ? listConfigBackups(dir, origin) : [],
+            },
+        };
+    });
+    app.post('/api/config-backups', async (req, reply) => {
+        const denied = deny(req, reply);
+        if (denied)
+            return denied;
+        try {
+            const out = await runConfigBackup('manual', { force: true });
+            return { success: true, data: { ...out.result, removed: out.removed } };
+        }
+        catch (err) {
+            reply.code(err instanceof BackupDirUnavailableError ? 503 : 500);
+            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Backup failed: ${getErrorMessage(err)}`);
+        }
+    });
+    app.get('/api/config-backups/diff', async (req, reply) => {
+        const denied = deny(req, reply);
+        if (denied)
+            return denied;
+        const q = req.query;
+        if (typeof q.from !== 'string' || !q.from) {
+            reply.code(400);
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, '`from` is required (a backup id or "current")');
+        }
+        try {
+            const { dir } = await readEffectiveBackupSettings();
+            const data = diffConfigBackups({
+                dataDir: getDataDir(),
+                backupDir: dir,
+                from: q.from,
+                to: typeof q.to === 'string' && q.to ? q.to : CONFIG_DIFF_CURRENT,
+            });
+            return { success: true, data };
+        }
+        catch (err) {
+            if (err instanceof ConfigBackupNotFoundError) {
+                reply.code(404);
+                return createErrorResponse(ApiErrorCode.NOT_FOUND, err.message);
+            }
+            if (err instanceof ConfigBackupCorruptError) {
+                reply.code(409);
+                return createErrorResponse(ApiErrorCode.CONFLICT, err.message);
+            }
+            reply.code(err instanceof BackupDirUnavailableError ? 503 : 500);
+            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Diff failed: ${getErrorMessage(err)}`);
+        }
+    });
+    /**
+     * What a restore that wrote files must do, whether or not every file made it: reload what the running
+     * server caches, audit it, and name the files that only apply after a restart.
+     */
+    const afterRestore = (req, id, restored, failed = []) => {
+        // IntentStore caches the file and rewrites it whole on the next prompt, which would undo the restore.
+        if (restored.includes('intents.json'))
+            intentStore.reload();
+        // restoreConfigBackup writes clis.json directly (the one writer besides mutateRegistryFile).
+        if (restored.includes('clis.json'))
+            reloadCliRegistry();
+        // A restore of users.json replaces accounts, password hashes, roles and bypass grants.
+        if (isMultiUserMode()) {
+            void appendAdminAudit({
+                admin: getAuthUser(req).username,
+                action: 'config_backup_restore',
+                target: id,
+                ip: req.ip,
+                detail: { restored, ...(failed.length > 0 && { failed }) },
+            });
+        }
+        return restored.filter((n) => RESTART_REQUIRED.has(n));
+    };
+    app.post('/api/config-backups/:id/restore', async (req, reply) => {
+        const denied = deny(req, reply);
+        if (denied)
+            return denied;
+        const { id } = req.params;
+        try {
+            const { dir } = await readEffectiveBackupSettings();
+            const out = restoreConfigBackup({ dataDir: getDataDir(), backupDir: dir, id, appVersion: APP_VERSION });
+            return {
+                success: true,
+                data: {
+                    restored: out.restored,
+                    untouched: out.untouched,
+                    safetySnapshot: out.safetySnapshot,
+                    restartRequired: afterRestore(req, id, out.restored),
+                },
+            };
+        }
+        catch (err) {
+            if (err instanceof ConfigBackupNotFoundError) {
+                reply.code(404);
+                return createErrorResponse(ApiErrorCode.NOT_FOUND, err.message);
+            }
+            if (err instanceof ConfigBackupCorruptError) {
+                reply.code(409);
+                return createErrorResponse(ApiErrorCode.CONFLICT, `${err.message}. Nothing was changed.`);
+            }
+            if (err instanceof ConfigBackupPartialRestoreError) {
+                // Some files are the backup's now: the client must learn which (Settings re-reads a restored
+                // settings.json, or its next Save writes the old values back) and where the undo copy is.
+                const failedNames = err.failed.map((f) => f.name);
+                const restartRequired = afterRestore(req, id, err.restored, failedNames);
+                reply.code(500);
+                return {
+                    ...createErrorResponse(ApiErrorCode.OPERATION_FAILED, err.message),
+                    data: {
+                        restored: err.restored,
+                        failed: err.failed,
+                        untouched: err.untouched,
+                        safetySnapshot: err.safetySnapshot,
+                        restartRequired,
+                    },
+                };
+            }
+            reply.code(err instanceof BackupDirUnavailableError ? 503 : 500);
+            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Restore failed: ${getErrorMessage(err)}`);
+        }
+    });
+}
+//# sourceMappingURL=config-backup-routes.js.map

package/dist/web/routes/config-backup-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-backup-routes.js","sourceRoot":"","sources":["../../../src/web/routes/config-backup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAoB,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,GAKvB,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,WAAW,GAAW,CAAC,GAAG,EAAE;IAChC,IAAI,CAAC;QACH,OAAQ,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAA0B,CAAC,OAAO,IAAI,EAAE,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL;+FAC+F;AAC/F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAUtF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAK/C,MAAM,GAAG,GAAG,MAAM,cAAc,CAA0B,aAAa,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,qGAAqG;IACrG,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,sGAAsG;AACtG,MAAM,OAAO,yBAA0B,SAAQ,KAAK;CAAG;AAEvD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA8B,EAAE,GAAW;IAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,KAAK,sBAAsB,CAAC,UAAU,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpG,IAAI,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC1G,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,yBAAyB,CAAC,sCAAsC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,YAAY,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,OAA4B,EAAE;IAE9B,sGAAsG;IACtG,kGAAkG;IAClG,4DAA4D;IAC5D,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,KAAK,YAAY,CAAC;IACxC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,mBAAmB,CAAC;QACzB,OAAO,EAAE,UAAU,EAAE;QACrB,SAAS,EAAE,GAAG;QACd,MAAM;QACN,UAAU,EAAE,WAAW;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,QAAQ;QAClB,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;QAC1B,mGAAmG;QACnG,KAAK,EAAE,CAAC,UAAU;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAoB;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAmB,EAAE,KAAmB,EAA6B,EAAE;QACnF,IAAI,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAA4C,EAAE;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,GAA4D,CAAC;QACjE,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,2BAA2B,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QACvC,8FAA8F;QAC9F,MAAM,MAAM,GAAG,sBAAsB,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,QAAQ;gBACR,GAAG;gBACH,UAAU,EAAE,sBAAsB,CAAC,UAAU,EAAE,CAAC;gBAChD,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACjE;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,GAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,EAAE,kBAAkB,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAoC,EAAE;QACzF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAuC,CAAC;QACtD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,2BAA2B,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,EAAE,UAAU,EAAE;gBACrB,SAAS,EAAE,GAAG;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;aAClE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAE,EAAU,EAAE,QAAkB,EAAE,SAAmB,EAAE,EAAY,EAAE;QAC5G,sGAAsG;QACtG,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5D,6FAA6F;QAC7F,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,iBAAiB,EAAE,CAAC;QACxD,uFAAuF;QACvF,IAAI,eAAe,EAAE,EAAE,CAAC;YACtB,KAAK,gBAAgB,CAAC;gBACpB,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ;gBAChC,MAAM,EAAE,uBAAuB;gBAC/B,MAAM,EAAE,EAAE;gBACV,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAwB,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,2BAA2B,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;YACxG,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,eAAe,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC;iBACrD;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,mBAAmB,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,GAAG,YAAY,+BAA+B,EAAE,CAAC;gBACnD,6FAA6F;gBAC7F,0FAA0F;gBAC1F,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO;oBACL,GAAG,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC;oBAClE,IAAI,EAAE;wBACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,cAAc,EAAE,GAAG,CAAC,cAAc;wBAClC,eAAe;qBAChB;iBACF,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,EAAE,mBAAmB,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/custom-model-routes.d.ts

@@ -40,14 +40,30 @@ export declare const CLAUDE_MIN_SAFE_CONTEXT_TOKENS = 40000;
  * with a small enough baseline of its own to never trip this would have no reason to
  * declare the field in the first place, so the check simply never applies to it.
  */
-export declare function exceedsSafeContextFloor(entry: Pick<CliEntry, 'capabilities'>, contextLength: number | undefined): boolean;
+export declare function exceedsSafeContextFloor(entry: Pick<CliEntry, 'capabilities'>, contextLength: number | undefined, slotCount?: number): boolean;
+/**
+ * The context one request can rely on when the server runs `slotCount` parallel slots.
+ * llama-server divides its context across `--parallel` slots (by default they share ONE
+ * unified KV pool), and Claude Code sends concurrent requests: the main session plus every
+ * parallel subagent, each carrying the full `CLAUDE_MIN_SAFE_CONTEXT_TOKENS` of its own
+ * system prompt and tools. With N busy slots each request therefore gets roughly
+ * `contextLength / N`, and once the pool is spent llama.cpp answers HTTP 500 "Context size
+ * has been exceeded" (measured: 4 slots, ~131k pool, four simultaneous 40k-token requests
+ * all failed; the same requests against one slot all succeeded). An unknown or single slot
+ * count leaves the context whole.
+ */
+export declare function perSlotContext(contextLength: number, slotCount: number | undefined): number;
 export interface DiscoveryResult {
     models: string[];
     /** See `CustomModelHost.modelContextLengths` — only ever populated for models already loaded. */
     contextLengths: Record<string, number>;
+    /** See `CustomModelHost.modelSlotCounts`; populated on the same loaded-models-only basis as `contextLengths`. */
+    slotCounts: Record<string, number>;
     /** See `CustomModelHost.modelSizesGB` — populated for every model whose own listing states one. */
     sizesGB: Record<string, number>;
 }
+/** Forget what was probed (tests only: a changed launch command already probes again). */
+export declare function clearPropsProbeCache(): void;
 export interface LlamaSwapRunningModel {
     model: string;
     state: string;

package/dist/web/routes/custom-model-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-model-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/custom-model-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAQ/D,OAAO,EAA+C,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAChH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAMnE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8BAA8B,QAAQ,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAIT;AAsED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iGAAiG;IACjG,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAyJD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd;2FACuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GAC9D,OAAO,CAAC,eAAe,CAAC,CAuB1B;AAgID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GACrE,MAAM,GAAG,SAAS,CASpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,SAAa,GAAG,IAAI,CAOjE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,EAC/D,OAAO,EAAE,MAAM,GACd,IAAI,CAcN;AA4BD;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxE;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAoBhE;AAED,iGAAiG;AACjG,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qGAAqG;AACrG,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kCAAkC,CACtD,QAAQ,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC1C,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC9B,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAgDxC;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAsHpE"}
+{"version":3,"file":"custom-model-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/custom-model-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAQ/D,OAAO,EAA+C,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAChH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAMnE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8BAA8B,QAAQ,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAMT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI3F;AA2ED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iGAAiG;IACjG,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,iHAAiH;IACjH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AA8GD,0FAA0F;AAC1F,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AA4HD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd;2FACuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GAC9D,OAAO,CAAC,eAAe,CAAC,CAuB1B;AAgID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GACrE,MAAM,GAAG,SAAS,CASpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,SAAa,GAAG,IAAI,CAOjE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,EAC/D,OAAO,EAAE,MAAM,GACd,IAAI,CAcN;AAiCD;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxE;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAoBhE;AAED,iGAAiG;AACjG,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qGAAqG;AACrG,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kCAAkC,CACtD,QAAQ,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC1C,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC9B,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAgDxC;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAsHpE"}

package/dist/web/routes/custom-model-routes.js

@@ -48,11 +48,30 @@ export const CLAUDE_MIN_SAFE_CONTEXT_TOKENS = 40000;
  * with a small enough baseline of its own to never trip this would have no reason to
  * declare the field in the first place, so the check simply never applies to it.
  */
-export function exceedsSafeContextFloor(entry, contextLength) {
+export function exceedsSafeContextFloor(entry, contextLength, slotCount) {
     const cap = entry.capabilities.customModelInjection;
     if (cap.kind !== 'env' || !cap.contextLengthVar)
         return false;
-    return typeof contextLength === 'number' && contextLength < CLAUDE_MIN_SAFE_CONTEXT_TOKENS;
+    if (typeof contextLength !== 'number')
+        return false;
+    if (contextLength < CLAUDE_MIN_SAFE_CONTEXT_TOKENS)
+        return true;
+    return perSlotContext(contextLength, slotCount) < CLAUDE_MIN_SAFE_CONTEXT_TOKENS;
+}
+/**
+ * The context one request can rely on when the server runs `slotCount` parallel slots.
+ * llama-server divides its context across `--parallel` slots (by default they share ONE
+ * unified KV pool), and Claude Code sends concurrent requests: the main session plus every
+ * parallel subagent, each carrying the full `CLAUDE_MIN_SAFE_CONTEXT_TOKENS` of its own
+ * system prompt and tools. With N busy slots each request therefore gets roughly
+ * `contextLength / N`, and once the pool is spent llama.cpp answers HTTP 500 "Context size
+ * has been exceeded" (measured: 4 slots, ~131k pool, four simultaneous 40k-token requests
+ * all failed; the same requests against one slot all succeeded). An unknown or single slot
+ * count leaves the context whole.
+ */
+export function perSlotContext(contextLength, slotCount) {
+    const slots = typeof slotCount === 'number' && Number.isFinite(slotCount) && slotCount > 1 ? Math.floor(slotCount) : 1;
+    return Math.floor(contextLength / slots);
 }
 function adminOnly(req, reply) {
     if (!isMultiUserMode() || isAdmin(req))
@@ -96,7 +115,7 @@ function applyStoredApiKey(incoming, existing) {
     return incoming.apiKey ? incoming : { ...incoming, apiKey: existing.apiKey };
 }
 /**
- * `modelContextLengths`/`modelSizesGB` are server-populated by discovery, never
+ * `modelContextLengths`/`modelSlotCounts`/`modelSizesGB` are server-populated by discovery, never
  * user-entered, and PUT replaces the whole record — so merge them back in from the
  * stored host rather than trust whatever the editor's body carried (or omitted).
  * The editor only ever sends `models`/`lastDiscoveredAt` verbatim from its cached
@@ -104,7 +123,12 @@ function applyStoredApiKey(incoming, existing) {
  * future caller forgets, same class of bug `applyStoredApiKey` exists to prevent.
  */
 function applyDiscoveredFields(incoming, existing) {
-    return { ...incoming, modelContextLengths: existing.modelContextLengths, modelSizesGB: existing.modelSizesGB };
+    return {
+        ...incoming,
+        modelContextLengths: existing.modelContextLengths,
+        modelSlotCounts: existing.modelSlotCounts,
+        modelSizesGB: existing.modelSizesGB,
+    };
 }
 function authHeaders(host) {
     const headers = {};
@@ -137,7 +161,7 @@ function parseSizeGB(description) {
 }
 /**
  * Best-effort: fetches `GET /props?model=<id>` (llama.cpp-native, llama-swap-proxied) for
- * ONE already-loaded model and pulls its real `n_ctx` out. Never called for a model that
+ * ONE already-loaded model and pulls its `n_ctx` and `total_slots` out. Never called for a model that
  * isn't already loaded — see the caller and `CustomModelHost.modelContextLengths` for why
  * that's a hard safety requirement, not just a nicety: llama-swap treats this endpoint's
  * `?model=` as a routing hint, and asking it about an unloaded model risks triggering an
@@ -153,17 +177,31 @@ function parseSizeGB(description) {
  * (below), which reads the actual launch flag `/running` reports, is the primary source;
  * this is only used when that parse comes up empty (no recognized flag in `cmd`, or `cmd`
  * itself unavailable).
+ *
+ * ⚠️ `/props` only ever RAISES the slot warning, never skips it: its `n_ctx` is the context
+ * fallback when `cmd` states no context flag at all, and `total_slots` is the slot count when
+ * `cmd` has no `--parallel`. It never widens the pool the slot check divides. And it is not
+ * free: llama-swap routes it through the model's process handler, which refreshes the model's
+ * last-use time, so probing a model with a `ttl` on every 5-minute sweep would keep it loaded
+ * forever. `discoverModels` therefore probes once per launch command (`propsByCmd`).
+ *
+ * Returns `undefined` when the request itself failed (network error, timeout, unreadable body),
+ * which is retried next sweep; a non-2xx status, or a 2xx without the fields, gives an object with
+ * them unset, which `propsForLaunch` remembers.
  */
-async function fetchContextLength(host, modelId, headers) {
+async function fetchServerProps(host, modelId, headers) {
     try {
         const url = new URL(`${host.baseUrl.replace(/\/+$/, '')}/props`);
         url.searchParams.set('model', modelId);
         const res = await webviewFetch(url, { headers, signal: AbortSignal.timeout(PROPS_TIMEOUT_MS) });
+        // A non-2xx answer (an upstream that does not serve /props) is a real answer: empty, so it is
+        // remembered per launch command instead of being re-probed every sweep.
         if (!res.ok)
-            return undefined;
+            return {};
         const body = (await res.json());
         const nCtx = body.n_ctx ?? body.default_generation_settings?.n_ctx;
-        return typeof nCtx === 'number' && Number.isFinite(nCtx) && nCtx > 0 ? nCtx : undefined;
+        const positive = (v) => typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : undefined;
+        return { nCtx: positive(nCtx), totalSlots: positive(body.total_slots) };
     }
     catch {
         return undefined;
@@ -173,7 +211,7 @@ async function fetchContextLength(host, modelId, headers) {
  * Parses the REAL configured context size out of llama-swap's own launch command for a
  * model (`/running`'s `cmd` field, e.g. `"llama-server -m ... --fit-ctx 16384 ..."`) —
  * the primary source for `modelContextLengths`, preferred over `/props`'s `n_ctx` (see
- * `fetchContextLength`'s own doc comment for why that field is unreliable here). Checks
+ * `fetchServerProps`'s own doc comment for why that field is unreliable here). Checks
  * `--fit-ctx` first (llama-swap's own auto-fit flag), then the plain llama.cpp
  * `-c`/`--ctx-size`/`--ctx_size` flags a hand-written launch command might use instead.
  * Returns `undefined` when `cmd` has none of these — not every launch command needs to
@@ -189,6 +227,46 @@ function parseCtxFromCmd(cmd) {
     const value = Number(match[1]);
     return Number.isFinite(value) && value > 0 ? value : undefined;
 }
+/**
+ * Parses an explicit `--parallel N` / `-np N` (or `--parallel=N`) out of a launch command.
+ * Returns `undefined` when the command states none, including `-np -1` (llama.cpp's "pick
+ * automatically"), because a llama-server started without it chooses the slot count itself
+ * (4 on the build this was measured on) and only `/props`'s `total_slots` can say what it chose.
+ */
+function parseSlotsFromCmd(cmd) {
+    if (typeof cmd !== 'string')
+        return undefined;
+    const match = /(?:^|\s)(?:-np|--parallel)(?:\s+|=)(\d+)(?=\s|$)/.exec(cmd);
+    if (!match)
+        return undefined;
+    const value = Number(match[1]);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+/** The `/props` answer for the launch command a model was last probed under, by host and model id. */
+const propsByCmd = new Map();
+/** Forget what was probed (tests only: a changed launch command already probes again). */
+export function clearPropsProbeCache() {
+    propsByCmd.clear();
+}
+/**
+ * `/props` for one loaded model, but only once per launch command: the probe refreshes the model's
+ * last-use time in llama-swap, so repeating it on every rediscovery sweep would stop a model with a
+ * `ttl` from ever unloading. A changed `cmd` (a reloaded or reconfigured model) probes again; a
+ * `cmd` that is not a string cannot be told apart, so it is probed each time; a probe that did not
+ * answer (network error, timeout) is not remembered; a non-2xx status is. Held in memory only, so a restart probes once more.
+ */
+async function propsForLaunch(host, modelId, cmd, headers) {
+    const key = `${host.baseUrl}\0${modelId}`;
+    if (typeof cmd === 'string') {
+        const cached = propsByCmd.get(key);
+        if (cached?.cmd === cmd)
+            return cached.props;
+    }
+    const props = await fetchServerProps(host, modelId, headers);
+    if (props && typeof cmd === 'string')
+        propsByCmd.set(key, { cmd, props });
+    return props;
+}
 async function discoverModels(host) {
     const headers = authHeaders(host);
     const res = await webviewFetch(new URL(`${host.baseUrl.replace(/\/+$/, '')}/v1/models`), {
@@ -214,6 +292,7 @@ async function discoverModels(host) {
     // fetchContextLength must only ever run against a model this server itself calls loaded.
     const hasStatusField = entries.some((m) => m && typeof m === 'object' && 'status' in m);
     const contextLengths = {};
+    const slotCounts = {};
     if (hasStatusField) {
         const loadedIds = entries
             .filter((m) => m.status && typeof m.status === 'object' && m.status.value === 'loaded')
@@ -227,14 +306,35 @@ async function discoverModels(host) {
             const swapStatus = await getLlamaSwapStatus(host);
             const cmdById = new Map(swapStatus.running.map((r) => [r.model, r.cmd]));
             for (const id of loadedIds) {
-                const fromCmd = parseCtxFromCmd(cmdById.get(id));
-                const ctx = fromCmd ?? (await fetchContextLength(host, id, headers));
+                const cmd = cmdById.get(id);
+                let ctx = parseCtxFromCmd(cmd);
+                const cmdSlots = parseSlotsFromCmd(cmd);
+                let slots = cmdSlots;
+                // /props is only needed for whatever the launch command did not answer. The context
+                // still comes from the command whenever it states one (see fetchServerProps's doc
+                // comment for why /props's n_ctx is only a fallback); the slot count usually cannot
+                // come from the command at all, since an unset --parallel is chosen by the server.
+                if (ctx === undefined || slots === undefined) {
+                    const props = await propsForLaunch(host, id, cmd, headers);
+                    const ctxFromProps = ctx === undefined && props?.nCtx !== undefined;
+                    ctx ??= props?.nCtx;
+                    slots ??= props?.totalSlots;
+                    // With an explicit --parallel N, llama.cpp reports /props's n_ctx PER SLOT (the unified
+                    // KV pool is only the default when the count is auto), so it is already the figure one
+                    // request can use, so the count is 1: recording N would divide it a second time, and
+                    // recording nothing would leave an earlier round's count in place (applyDiscoveredModels
+                    // merges onto what was learned before).
+                    if (cmdSlots !== undefined && ctxFromProps)
+                        slots = 1;
+                }
                 if (ctx !== undefined)
                     contextLengths[id] = ctx;
+                if (slots !== undefined)
+                    slotCounts[id] = slots;
             }
         }
     }
-    return { models, contextLengths, sizesGB };
+    return { models, contextLengths, slotCounts, sizesGB };
 }
 /**
  * undici reports every network failure as `TypeError('fetch failed', { cause })`, with the
@@ -506,7 +606,7 @@ export function triggerLlamaSwapLoad(host, modelId) {
     });
 }
 function applyDiscoveredModels(host, result) {
-    const { models, contextLengths, sizesGB } = result;
+    const { models, contextLengths, slotCounts, sizesGB } = result;
     const defaultModelId = host.defaultModelId && models.includes(host.defaultModelId) ? host.defaultModelId : undefined;
     // Merge onto what's already known rather than replacing: a model not probed this round
     // (not currently loaded) keeps whatever context length an earlier round already learned
@@ -514,6 +614,10 @@ function applyDiscoveredModels(host, result) {
     const merged = { ...host.modelContextLengths, ...contextLengths };
     const kept = Object.fromEntries(Object.entries(merged).filter(([id]) => models.includes(id)));
     const modelContextLengths = Object.keys(kept).length > 0 ? kept : undefined;
+    // Slot counts follow the same loaded-only, keep-what-an-earlier-round-learned rule.
+    const mergedSlots = { ...host.modelSlotCounts, ...slotCounts };
+    const keptSlots = Object.fromEntries(Object.entries(mergedSlots).filter(([id]) => models.includes(id)));
+    const modelSlotCounts = Object.keys(keptSlots).length > 0 ? keptSlots : undefined;
     // sizesGB, unlike contextLengths, is populated for every model in the SAME pass (no
     // loaded-only restriction — see parseSizeGB), so this is closer to a plain replace, but
     // still merges onto the previous round rather than dropping a size for a model whose
@@ -526,6 +630,7 @@ function applyDiscoveredModels(host, result) {
         models,
         defaultModelId,
         modelContextLengths,
+        modelSlotCounts,
         modelSizesGB,
         lastDiscoveredAt: new Date().toISOString(),
     };