aigetwey 1.1.0 → 1.2.0

package/dist/upstream/client.js

@@ -57,6 +57,15 @@ function buildBody(provider, req, model, stream, thinkingIntent) {
     const adapter = adapterFor(provider.format);
     const upstreamReq = { ...req, model, stream };
     const out = adapter.requestFromCanonical(upstreamReq);
+    // OpenAI-compatible streams omit usage entirely unless you opt in — without this
+    // every streamed call through an openai-format provider logs 0 tokens in/out
+    // (anthropic/gemini report usage inline, so they're unaffected). Ask for the
+    // final usage chunk; the handler taps it for accounting. Preserve a usage opt-in
+    // the client already set.
+    if (stream && provider.format === "openai") {
+        const existing = (out.stream_options ?? {});
+        out.stream_options = { ...existing, include_usage: true };
+    }
     // Normalize thinking into THIS provider's native format, keyed by the upstream
     // model's capabilities. No-op for non-reasoning models. Runs per-attempt so each
     // provider in a fallback chain gets the right shape.

package/dist/upstream/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/upstream/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAuB,MAAM,kCAAkC,CAAC;AAStF;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACzE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC/D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;KAC5B,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,mBAAmB,CAAC,KAAK,YAAY,CAAC;IAChD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,GAAG;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAkB,EAAE,KAAa,EAAE,MAAe;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC5E,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAChB,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,MAAe,EACf,cAAsC;IAEtC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAqB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAA4B,CAAC;IACjF,+EAA+E;IAC/E,iFAAiF;IACjF,qDAAqD;IACrD,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,IAAqG;IAErG,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAE/E,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,0DAA0D;YAC1D,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,oBAAqB,CAAW,CAAC,OAAO,EAAE,CAAkB,CAAC;QAC1G,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,aAAa,GAAG,CAAC,UAAU,EAAE,CAAkB,CAAC;QAC7F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;QAC5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;IACxG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/upstream/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAuB,MAAM,kCAAkC,CAAC;AAStF;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACzE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC/D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;KAC5B,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,mBAAmB,CAAC,KAAK,YAAY,CAAC;IAChD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,GAAG;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAkB,EAAE,KAAa,EAAE,MAAe;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC5E,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAChB,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,MAAe,EACf,cAAsC;IAEtC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAqB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAA4B,CAAC;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,6EAA6E;IAC7E,iFAAiF;IACjF,0BAA0B;IAC1B,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAA4B,CAAC;QACvE,GAAG,CAAC,cAAc,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,+EAA+E;IAC/E,iFAAiF;IACjF,qDAAqD;IACrD,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,IAAqG;IAErG,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAE/E,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,0DAA0D;YAC1D,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,oBAAqB,CAAW,CAAC,OAAO,EAAE,CAAkB,CAAC;QAC1G,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,aAAa,GAAG,CAAC,UAAU,EAAE,CAAkB,CAAC;QAC7F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;QAC5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;IACxG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "aigetwey",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "type": "module",
-  "description": "Personal AI gateway — route, translate and track requests across Anthropic / OpenAI / Gemini-compatible providers, with a built-in dashboard.",
+  "description": "Personal AI gateway — route, translate and track requests across Anthropic and OpenAI-compatible providers, with a built-in dashboard.",
   "keywords": [
     "ai",
     "gateway",
@@ -10,7 +10,6 @@
     "proxy",
     "anthropic",
     "openai",
-    "gemini",
     "router",
     "claude",
     "dashboard"
@@ -29,7 +28,7 @@
     "node": ">=22"
   },
   "bin": {
-    "aigetwey": "./dist/cli.js"
+    "aigetwey": "dist/cli.js"
   },
   "files": [
     "dist",

package/src/cli.ts

@@ -14,7 +14,7 @@
  */
 import { spawn, execSync, type ChildProcess } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { existsSync, copyFileSync } from "node:fs";
+import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline";
@@ -65,24 +65,57 @@ const HELP = `
 const GATEWAY_PORT = opts.port ?? Number(process.env.AIGETWEY_PORT ?? 18080);
 const DASHBOARD_PORT = Number(process.env.DASHBOARD_PORT ?? 3000);
 
-// reuse env secrets if present, otherwise generate (admin) / random (session).
+// reuse env secrets if present, otherwise generate (admin) / persist (session).
 const adminPassword = process.env.AIGETWEY_ADMIN_PASSWORD ?? randomBytes(6).toString("hex");
-const sessionSecret = process.env.SESSION_SECRET ?? randomBytes(24).toString("hex");
 const generatedPw = !process.env.AIGETWEY_ADMIN_PASSWORD;
 
+/**
+ * The dashboard session cookie is signed+encrypted with SESSION_SECRET. A fresh
+ * random secret each boot would invalidate every cookie on restart — the symptom
+ * being "re-enter the password after a relaunch" — so persist a generated one to
+ * the data dir (alongside auth.json) and reuse it. An explicit env var wins.
+ */
+function loadOrCreateSessionSecret(): string {
+  if (process.env.SESSION_SECRET) return process.env.SESSION_SECRET;
+  const dataDir = resolve(process.env.AIGETWEY_DATA_DIR ?? join(root, "data"));
+  const file = join(dataDir, "session-secret");
+  try {
+    const existing = readFileSync(file, "utf8").trim();
+    if (existing) return existing;
+  } catch {
+    // not created yet — fall through and generate.
+  }
+  const secret = randomBytes(24).toString("hex");
+  try {
+    mkdirSync(dataDir, { recursive: true });
+    writeFileSync(file, secret, { mode: 0o600 });
+  } catch {
+    // unwritable data dir — fall back to an ephemeral secret (cookies won't
+    // survive this boot, but the gateway still runs).
+  }
+  return secret;
+}
+const sessionSecret = loadOrCreateSessionSecret();
+
 function openBrowser(url: string): void {
   const cmd =
     process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   spawn(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).unref();
 }
 
-async function waitForGateway(url: string, timeoutMs = 20000): Promise<boolean> {
+async function waitForGateway(
+  url: string,
+  timeoutMs = 20000,
+  ready: (status: number) => boolean = (s) => s > 0,
+): Promise<boolean> {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
       const res = await fetch(url, { method: "GET" });
-      // any HTTP answer (even 401/503) means the port is up
-      if (res.status > 0) return true;
+      // default: any HTTP answer (even 401/503) means the port is up. A caller
+      // can demand more — e.g. a non-5xx, to wait past a proxy's boot-time 502/500
+      // while the upstream it fronts is still coming up.
+      if (ready(res.status)) return true;
     } catch {
       // not up yet
     }
@@ -349,9 +382,12 @@ async function main(): Promise<void> {
   });
 
   // one URL for everything — the gateway reverse-proxies the dashboard. Wait for
-  // the dashboard to answer THROUGH the proxy before opening the browser.
+  // the dashboard to be READY before opening the browser. Probe it directly on
+  // its own port (not through the proxy) and require a non-5xx answer: a proxy
+  // hit during boot returns 500 (ECONNREFUSED upstream), which a bare "port up"
+  // check would mistake for ready and open the browser into a wall of 500s.
   const appUrl = `http://127.0.0.1:${GATEWAY_PORT}`;
-  await waitForGateway(`${appUrl}/login`, 30000);
+  await waitForGateway(`http://127.0.0.1:${DASHBOARD_PORT}/login`, 30000, (s) => s > 0 && s < 500);
   console.log(`\n  aigetwey   ${appUrl}   (dashboard + API, one URL)`);
   if (generatedPw) {
     console.log(`\n  admin password (generated): ${adminPassword}`);

package/src/config.ts

@@ -9,6 +9,9 @@ import {
 import { dirname } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { z } from "zod";
+import { clientKeyFingerprint } from "./middleware/auth.js";
+
+export { clientKeyFingerprint } from "./middleware/auth.js";
 
 // ---- schema (PLAN §8) -------------------------------------------------------
 //
@@ -121,17 +124,28 @@ const ServerSchema = z
   .default({ host: "127.0.0.1", port: 18080, api_keys: [] });
 
 /**
- * Gateway-wide spend budget. unit picks what `limit` means — USD cost or total
- * tokens across every provider. Soft-alert at alert_at (default 0.8), hard-stop
- * at 100%. Window math reuses the quota calendar engine. Opt-in: omit to disable.
+ * A spend budget scoped to the whole gateway, one provider, or one upstream
+ * model. unit picks what `limit` means — USD cost or total tokens. Soft-alert at
+ * alert_at (default 0.8), hard-stop at 100%. Window math reuses the quota
+ * calendar engine. Opt-in: omit / empty list to disable.
  */
+const BudgetScopeSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("global") }),
+  z.object({ type: z.literal("provider"), id: z.string().min(1) }),
+  z.object({ type: z.literal("model"), id: z.string().min(1) }),
+  z.object({ type: z.literal("key"), id: z.string().min(1) }),
+]);
+
 const BudgetSchema = z.object({
+  scope: BudgetScopeSchema,
   unit: z.enum(["usd", "tokens"]),
   limit: z.number().positive(),
   window: z.enum(["5h", "daily", "weekly", "monthly"]),
   reset_at: z.string().optional(),
   timezone: z.string().default("UTC"),
   alert_at: z.number().gt(0).lte(1).optional(),
+  // optional free-text label so an operator remembers what a budget is for.
+  note: z.string().max(200).optional(),
 });
 
 const ConfigSchema = z.object({
@@ -140,7 +154,7 @@ const ConfigSchema = z.object({
   providers: z.array(ProviderSchema).default([]),
   // the routing layer. Each entry is a "combo": an alias + a provider chain.
   models: z.array(ModelRouteSchema).default([]),
-  budget: BudgetSchema.optional(),
+  budgets: z.array(BudgetSchema).default([]),
 });
 
 export type Quota = z.infer<typeof QuotaSchema>;
@@ -148,6 +162,7 @@ export type ProviderModel = z.infer<typeof ProviderModelSchema>;
 export type Provider = z.infer<typeof ProviderSchema>;
 export type ModelRoute = z.infer<typeof ModelRouteSchema>;
 export type EndpointSettings = z.infer<typeof EndpointSchema>;
+export type BudgetScope = z.infer<typeof BudgetScopeSchema>;
 export type Budget = z.infer<typeof BudgetSchema>;
 export type Config = z.infer<typeof ConfigSchema>;
 
@@ -277,6 +292,16 @@ export class GatewayConfig {
 
 /** Validate an already-parsed config object. Throws with readable issues. */
 export function validateConfig(parsed: unknown): GatewayConfig {
+  // migrate the legacy single `budget` (pre-scoped) into a global-scoped entry
+  // before zod runs — zod would otherwise strip the unknown `budget` key.
+  if (parsed && typeof parsed === "object") {
+    const raw = parsed as Record<string, unknown>;
+    if (raw.budget && !raw.budgets) {
+      const legacy = raw.budget as Record<string, unknown>;
+      raw.budgets = [{ scope: { type: "global" }, ...legacy }];
+    }
+    delete raw.budget;
+  }
   const result = ConfigSchema.safeParse(parsed ?? {});
   if (!result.success) {
     const issues = result.error.issues
@@ -757,19 +782,41 @@ export function setHeadroom(
   return next;
 }
 
-// ---- global budget ---------------------------------------------------------
+// ---- scoped budgets --------------------------------------------------------
+
+/** Stable identity key for a budget's scope. */
+export function budgetKey(scope: BudgetScope): string {
+  return scope.type === "global" ? "global" : `${scope.type}:${scope.id}`;
+}
 
-/** Set (or replace) the gateway-wide spend budget. */
+/** Add a budget, or replace the existing one with the same scope key. */
 export function setBudget(config: Config, budget: Budget): Config {
+  if (budget.scope.type === "provider") {
+    const { id } = budget.scope;
+    if (!config.providers.some((p) => p.id === id)) {
+      throw new Error(`unknown provider "${id}" for budget scope`);
+    }
+  }
+  if (budget.scope.type === "key") {
+    const { id } = budget.scope;
+    if (!config.server.api_keys.some((k) => clientKeyFingerprint(k) === id)) {
+      throw new Error(`unknown API key fingerprint "${id}" for budget scope`);
+    }
+  }
   const next = cloneConfig(config);
-  next.budget = budget;
+  const key = budgetKey(budget.scope);
+  const idx = next.budgets.findIndex((b) => budgetKey(b.scope) === key);
+  if (idx === -1) next.budgets.push(budget);
+  else next.budgets[idx] = budget;
   return next;
 }
 
-/** Remove the gateway-wide budget (turns the feature off). */
-export function clearBudget(config: Config): Config {
+/** Remove a budget by its scope key (global | provider:<id> | model:<id> | key:<fp>). */
+export function clearBudget(config: Config, key: string): Config {
   const next = cloneConfig(config);
-  delete next.budget;
+  const idx = next.budgets.findIndex((b) => budgetKey(b.scope) === key);
+  if (idx === -1) throw new Error(`no budget with scope "${key}"`);
+  next.budgets.splice(idx, 1);
   return next;
 }
 

package/src/core/budget.ts

@@ -1,71 +1,124 @@
 /**
- * Gateway-wide spend budget, derived from the usage table (the single source of
- * truth) rather than a parallel counter. status() sums cost/tokens over the
- * current window and reports spent / pct / alert / exhausted, plus an estimate
- * in the OTHER unit from the window's blended rate. The result is cached for a
- * few seconds so the per-request hard-stop check stays one DB query per window.
+ * Scoped spend budgets, derived from the usage table (the single source of
+ * truth) rather than a parallel counter. Each budget targets the whole gateway,
+ * one provider, or one upstream model. statuses() computes every budget's spend
+ * over its window; the result list is cached a few seconds so the per-request
+ * hard-stop check stays cheap. blocks() answers "is a route to this
+ * provider/model barred by an exhausted budget?".
  */
-import type { Budget } from "../config.js";
+import type { Budget, BudgetScope } from "../config.js";
+import { budgetKey } from "../config.js";
 import { currentWindowStart, nextResetAt } from "./quota.js";
 
 export interface BudgetStatus {
+  scope: BudgetScope;
+  key: string;
+  label: string;
+  note?: string;
   unit: "usd" | "tokens";
   limit: number;
   spent: number;
   pct: number;
   alert: boolean;
+  alert_at: number;
   exhausted: boolean;
-  /** estimate in the converse unit (tokens if unit=usd, usd if unit=tokens); null when no usage yet */
   est_converse: number | null;
   reset_in_ms: number;
   window: Budget["window"];
 }
 
-interface SummaryReader {
-  summary(since: number): { total: { tokens_in: number; tokens_out: number; cost: number } };
+interface TotalsReader {
+  totals(sinceMs: number, filter?: { provider?: string; model?: string; client_key?: string }): {
+    tokens_in: number;
+    tokens_out: number;
+    cost: number;
+  };
+}
+
+function scopeLabel(scope: BudgetScope, keyName: (fp: string) => string): string {
+  if (scope.type === "global") return "Global";
+  if (scope.type === "key") return keyName(scope.id);
+  return scope.id;
+}
+
+function scopeFilter(scope: BudgetScope): { provider?: string; model?: string; client_key?: string } | undefined {
+  if (scope.type === "provider") return { provider: scope.id };
+  if (scope.type === "model") return { model: scope.id };
+  if (scope.type === "key") return { client_key: scope.id };
+  return undefined;
 }
 
 export class BudgetTracker {
-  private cached?: { at: number; status: BudgetStatus | null };
+  private cached?: { at: number; list: BudgetStatus[] };
 
   constructor(
-    private readonly getSpec: () => Budget | undefined,
-    private readonly db: SummaryReader,
+    private readonly getBudgets: () => Budget[],
+    private readonly db: TotalsReader,
     private readonly now: () => number = Date.now,
     private readonly cacheMs = 5000,
+    private readonly keyName: (fp: string) => string = (fp) => `key …${fp}`,
   ) {}
 
-  /** Flush the cached status — call after a config reload that may have changed the budget spec. */
   clearCache(): void {
     this.cached = undefined;
   }
 
-  status(): BudgetStatus | null {
+  statuses(): BudgetStatus[] {
     const t = this.now();
-    if (this.cached && t - this.cached.at < this.cacheMs) return this.cached.status;
-    const status = this.compute(t);
-    this.cached = { at: t, status };
-    return status;
+    if (this.cached && t - this.cached.at < this.cacheMs) return this.cached.list;
+    const list = this.getBudgets().map((b) => this.compute(b, t));
+    this.cached = { at: t, list };
+    return list;
+  }
+
+  globalStatus(): BudgetStatus | null {
+    return this.statuses().find((s) => s.scope.type === "global") ?? null;
+  }
+
+  /** First exhausted provider/model budget matching a route, or null. */
+  blocks(providerId: string, model: string): { exhausted: true; reset_in_ms: number } | null {
+    for (const s of this.statuses()) {
+      if (!s.exhausted) continue;
+      if (s.scope.type === "provider" && s.scope.id === providerId)
+        return { exhausted: true, reset_in_ms: s.reset_in_ms };
+      if (s.scope.type === "model" && s.scope.id === model)
+        return { exhausted: true, reset_in_ms: s.reset_in_ms };
+    }
+    return null;
+  }
+
+  /** The exhausted key-scoped budget for this fingerprint, or null. */
+  blocksKey(fp: string): { exhausted: true; reset_in_ms: number } | null {
+    for (const s of this.statuses()) {
+      if (s.exhausted && s.scope.type === "key" && s.scope.id === fp) {
+        return { exhausted: true, reset_in_ms: s.reset_in_ms };
+      }
+    }
+    return null;
   }
 
-  private compute(t: number): BudgetStatus | null {
-    const spec = this.getSpec();
-    if (!spec) return null;
+  private compute(spec: Budget, t: number): BudgetStatus {
     const windowStart = currentWindowStart(spec, t);
-    const total = this.db.summary(windowStart).total;
+    const total = this.db.totals(windowStart, scopeFilter(spec.scope));
     const tokens = total.tokens_in + total.tokens_out;
     const cost = total.cost;
-    const rate = tokens > 0 ? cost / tokens : undefined; // $/token, blended over the window
+    const rate = tokens > 0 ? cost / tokens : undefined;
     const spent = spec.unit === "usd" ? cost : tokens;
     const limit = spec.limit;
     const pct = limit > 0 ? Math.min(1, spent / limit) : 0;
+    const alertAt = spec.alert_at ?? 0.8;
     const est_converse = rate === undefined ? null : spec.unit === "usd" ? limit / rate : limit * rate;
     return {
+      scope: spec.scope,
+      key: budgetKey(spec.scope),
+      label: scopeLabel(spec.scope, this.keyName),
+      note: spec.note,
       unit: spec.unit,
       limit,
       spent,
       pct,
-      alert: pct >= (spec.alert_at ?? 0.8),
+      alert: pct >= alertAt,
+      alert_at: alertAt,
       exhausted: spent >= limit,
       est_converse,
       reset_in_ms: Math.max(0, nextResetAt(spec, windowStart, t) - t),

package/src/core/handler.ts

@@ -51,7 +51,12 @@ export interface HandleDeps {
   pool: KeyPool;
   db?: UsageDB;
   quota?: QuotaTracker;
-  budget?: { status(): { exhausted: boolean; reset_in_ms: number } | null };
+  budget?: {
+    globalStatus(): { exhausted: boolean; reset_in_ms: number } | null;
+    blocks(providerId: string, model: string): { exhausted: true; reset_in_ms: number } | null;
+    blocksKey(fp: string): { exhausted: true; reset_in_ms: number } | null;
+  };
+  clientKeyFp?: string;
   log?: (msg: string) => void;
   now?: () => number;
 }
@@ -85,6 +90,7 @@ function recordUsage(
     status,
     latency_ms: latencyMs,
     stream: stream ? 1 : 0,
+    client_key: deps.clientKeyFp ?? "",
   });
 }
 
@@ -115,16 +121,27 @@ export async function handle(
   const thinkingIntent: ThinkingConfig | null =
     override ?? captureThinking(canonical as Record<string, unknown>);
 
-  const routes = config.resolve(canonical.model);
+  let routes = config.resolve(canonical.model);
   if (routes.length === 0) {
     throw new GatewayError(404, { error: `unknown model "${canonical.model}"` });
   }
 
-  // Global budget hard-stop: refuse before doing any upstream work when the
-  // gateway-wide budget for this window is spent. Cached in the tracker (~5s).
-  const budgetStatus = deps.budget?.status();
-  if (budgetStatus?.exhausted) {
-    throw new GatewayError(402, { error: "budget exceeded", reset_in_ms: budgetStatus.reset_in_ms });
+  // Budget hard-stop. Global overrun fails fast. Provider/model budgets bar the
+  // matching routes (like the token-quota skip); if every candidate is barred,
+  // there's nothing to serve → 402.
+  if (deps.budget) {
+    const g = deps.budget.globalStatus();
+    if (g?.exhausted) throw new GatewayError(402, { error: "budget exceeded", reset_in_ms: g.reset_in_ms });
+    if (deps.clientKeyFp) {
+      const kb = deps.budget.blocksKey(deps.clientKeyFp);
+      if (kb?.exhausted) throw new GatewayError(402, { error: "budget exceeded", reset_in_ms: kb.reset_in_ms });
+    }
+    const eligible = routes.filter((r) => !deps.budget!.blocks(r.provider.id, r.model));
+    if (eligible.length === 0) {
+      const b = deps.budget.blocks(routes[0]!.provider.id, routes[0]!.model);
+      throw new GatewayError(402, { error: "budget exceeded", reset_in_ms: b?.reset_in_ms ?? 0 });
+    }
+    routes = eligible;
   }
 
   // Pipeline order matters: RTK compresses tool_result in the INPUT first, then

package/src/core/state.ts

@@ -17,11 +17,20 @@ import {
   validateConfig,
   unmaskSecrets,
   writeConfigFile,
+  maskKey,
 } from "../config.js";
+import { clientKeyFingerprint } from "../middleware/auth.js";
 import { KeyPool } from "./keypool.js";
 import { QuotaTracker } from "./quota.js";
 import { BudgetTracker } from "./budget.js";
 
+function serverKeyLabel(server: { api_keys: string[]; key_names?: Record<string, string> }, fp: string): string {
+  for (const k of server.api_keys) {
+    if (clientKeyFingerprint(k) === fp) return server.key_names?.[k] ?? maskKey(k);
+  }
+  return `key …${fp}`;
+}
+
 export class GatewayState {
   private _config: GatewayConfig;
   private _pool: KeyPool;
@@ -32,12 +41,18 @@ export class GatewayState {
     private readonly configPath: string,
     initial: GatewayConfig,
     quota?: QuotaTracker,
-    budgetDb?: { summary(since: number): { total: { tokens_in: number; tokens_out: number; cost: number } } },
+    budgetDb?: { totals(since: number, filter?: { provider?: string; model?: string; client_key?: string }): { tokens_in: number; tokens_out: number; cost: number } },
   ) {
     this._config = initial;
     this._pool = new KeyPool();
     this._quota = quota ?? new QuotaTracker();
-    this._budget = new BudgetTracker(() => this._config.raw.budget, budgetDb ?? { summary: () => ({ total: { tokens_in: 0, tokens_out: 0, cost: 0 } }) });
+    this._budget = new BudgetTracker(
+      () => this._config.raw.budgets,
+      budgetDb ?? { totals: () => ({ tokens_in: 0, tokens_out: 0, cost: 0 }) },
+      undefined,
+      undefined,
+      (fp) => serverKeyLabel(this._config.raw.server, fp),
+    );
   }
 
   get config(): GatewayConfig {

package/src/db.ts

@@ -27,6 +27,7 @@ export interface UsageRow {
   status: number;
   latency_ms: number;
   stream: number; // 0/1
+  client_key: string;
 }
 
 export interface LogRow {
@@ -38,6 +39,12 @@ export interface LogRow {
   response_summary: string;
 }
 
+export interface UsageTotals {
+  tokens_in: number;
+  tokens_out: number;
+  cost: number;
+}
+
 export interface UsageSummary {
   total: { requests: number; tokens_in: number; tokens_out: number; cost: number };
   by_provider: Array<{ provider: string; requests: number; tokens_in: number; tokens_out: number; cost: number }>;
@@ -79,7 +86,8 @@ export class UsageDB {
         cost REAL NOT NULL DEFAULT 0,
         status INTEGER NOT NULL,
         latency_ms INTEGER NOT NULL DEFAULT 0,
-        stream INTEGER NOT NULL DEFAULT 0
+        stream INTEGER NOT NULL DEFAULT 0,
+        client_key TEXT NOT NULL DEFAULT ''
       );
       CREATE INDEX IF NOT EXISTS idx_usage_ts ON usage(ts);
       CREATE TABLE IF NOT EXISTS logs (
@@ -99,10 +107,15 @@ export class UsageDB {
         last_reset INTEGER NOT NULL DEFAULT 0
       );
     `);
+    // migrate older DBs created before client_key existed.
+    const cols = this.db.prepare(`PRAGMA table_info(usage)`).all() as SqlRow[];
+    if (!cols.some((c) => String(c.name) === "client_key")) {
+      this.db.exec(`ALTER TABLE usage ADD COLUMN client_key TEXT NOT NULL DEFAULT ''`);
+    }
     this.now = now;
     this.insertUsage = this.db.prepare(`
-      INSERT INTO usage (ts, alias, provider, model, tokens_in, tokens_out, cached_tokens, cost, status, latency_ms, stream)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      INSERT INTO usage (ts, alias, provider, model, tokens_in, tokens_out, cached_tokens, cost, status, latency_ms, stream, client_key)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
     this.insertLog = this.db.prepare(`
       INSERT INTO logs (ts, direction, provider, status, request_summary, response_summary)
@@ -117,7 +130,7 @@ export class UsageDB {
     `);
   }
 
-  record(row: Omit<UsageRow, "ts"> & { ts?: number }): void {
+  record(row: Omit<UsageRow, "ts" | "client_key"> & { ts?: number; client_key?: string }): void {
     this.insertUsage.run(
       row.ts ?? this.now(),
       row.alias,
@@ -130,6 +143,7 @@ export class UsageDB {
       row.status,
       row.latency_ms,
       row.stream,
+      row.client_key ?? "",
     );
   }
 
@@ -195,6 +209,36 @@ export class UsageDB {
     };
   }
 
+  /**
+   * Summed token + cost totals over rows with ts >= sinceMs, optionally filtered
+   * to one provider and/or one model. Backs the scoped budget tracker — the usage
+   * table stays the single source of truth (no parallel counter).
+   */
+  totals(sinceMs: number, filter?: { provider?: string; model?: string; client_key?: string }): UsageTotals {
+    const clauses = ["ts >= ?"];
+    const params: Array<number | string> = [sinceMs];
+    if (filter?.provider) {
+      clauses.push("provider = ?");
+      params.push(filter.provider);
+    }
+    if (filter?.model) {
+      clauses.push("model = ?");
+      params.push(filter.model);
+    }
+    if (filter?.client_key) {
+      clauses.push("client_key = ?");
+      params.push(filter.client_key);
+    }
+    const row = this.db
+      .prepare(
+        `SELECT COALESCE(SUM(tokens_in),0) tokens_in, COALESCE(SUM(tokens_out),0) tokens_out,
+                COALESCE(SUM(cost),0) cost
+         FROM usage WHERE ${clauses.join(" AND ")}`,
+      )
+      .get(...params) as SqlRow;
+    return { tokens_in: num(row.tokens_in), tokens_out: num(row.tokens_out), cost: num(row.cost) };
+  }
+
   /**
    * Bucketed time-series for charts: one point per `bucketMs` interval from
    * `sinceMs` to now, aligned to the bucket boundary, with zero-filled gaps.
@@ -233,7 +277,7 @@ export class UsageDB {
     const rows = this.db
       .prepare(
         `SELECT ts, alias, provider, model, tokens_in, tokens_out, cached_tokens,
-                cost, status, latency_ms, stream
+                cost, status, latency_ms, stream, client_key
          FROM usage ORDER BY id DESC LIMIT ?`,
       )
       .all(Math.max(1, Math.min(limit, 1000))) as SqlRow[];
@@ -249,6 +293,7 @@ export class UsageDB {
       status: num(r.status),
       latency_ms: num(r.latency_ms),
       stream: num(r.stream),
+      client_key: String(r.client_key ?? ""),
     }));
   }