clauderipple 0.2.0 → 0.3.0

package/dist/router/src/admin.js

@@ -7,6 +7,7 @@
 //   POST /api/chatgpt-login  begin ChatGPT browser login without holding the request open
 //   GET  /api/chatgpt-login  ChatGPT browser login state and credential status
 //   GET  /*             static files from packages/ui (the GUI itself)
+import crypto from "node:crypto";
 import fs from "node:fs";
 import net from "node:net";
 import os from "node:os";
@@ -17,12 +18,17 @@ import { fileURLToPath } from "node:url";
 import { homeDir, validate } from "./config.js";
 import { PRESETS } from "./presets.js";
 import { resolveCompatibleCaps } from "./compat.js";
+import { CHATGPT_FALLBACK_MODELS } from "./providers/chatgpt/catalog.js";
+import { measureModel, refusedByPlan } from "./capabilities.js";
 import { ClaudeCodeAuthStore, nativeAnthropicHeaders } from "./providers/anthropic.js";
 import { codexEnabled, codexHome } from "../../cli/src/codex.js";
 import { openBrowser } from "../../cli/src/browser.js";
 import { caTrusted, currentAppProxy } from "../../cli/src/picker.js";
+import { certPaths } from "../../cli/src/certs.js";
+import { syncModelSlots } from "../../cli/src/settings.js";
 import { ClaudeOAuthSession } from "./providers/claude-oauth.js";
 import { readClaudeAuthFile } from "./providers/anthropic-token-file.js";
+import { listClaudeAccounts, removeClaudeAccount, renameClaudeAccount } from "./providers/anthropic-accounts.js";
 const MAX_BODY = 1024 * 1024;
 const here = path.dirname(fileURLToPath(import.meta.url));
 const STARTED_AT = new Date().toISOString();
@@ -40,7 +46,6 @@ const MIME = {
 };
 const ANTHROPIC_EFFORT_LEVELS = ["low", "medium", "high", "max"];
 const CHATGPT_DEFAULT_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
-const CHATGPT_LUNA_EFFORT_LEVELS = [...CHATGPT_DEFAULT_EFFORT_LEVELS, "ultra"];
 let chatgptLogin = { running: false };
 /** The Claude subscription sign-in in progress (or the last one), for GET /api/claude-oauth. */
 let claudeOAuth = null;
@@ -51,15 +56,15 @@ export function effortLevels(cfg) {
     };
     for (const [name, provider] of Object.entries(cfg.providers)) {
         if (provider.type === "chatgpt") {
-            providers[name] = {
-                default: CHATGPT_DEFAULT_EFFORT_LEVELS,
-                models: {
-                    "gpt-5.6-luna": CHATGPT_LUNA_EFFORT_LEVELS,
-                    "gpt-5.6-terra": CHATGPT_DEFAULT_EFFORT_LEVELS,
-                    "gpt-5.6-sol": CHATGPT_DEFAULT_EFFORT_LEVELS,
-                    "gpt-6-astra": CHATGPT_DEFAULT_EFFORT_LEVELS,
-                },
-            };
+            // The backend's catalogue is the truth about which models exist and what each supports, but
+            // it lives behind a login and a network call, so the measured fallback list carries the
+            // per-model ladders (ultra on astra/sol/5.6 terra+sol, not on either Luna) and any config
+            // entries the user has saved override them.
+            const models = Object.fromEntries(CHATGPT_FALLBACK_MODELS.filter((model) => model.effortLevels !== undefined).map((model) => [model.id, [...model.effortLevels]]));
+            for (const model of provider.models ?? [])
+                if (model.effortLevels !== undefined)
+                    models[model.id] = [...model.effortLevels];
+            providers[name] = { default: CHATGPT_DEFAULT_EFFORT_LEVELS, ...(Object.keys(models).length ? { models } : {}) };
             continue;
         }
         const modelLevels = Object.fromEntries((provider.models ?? [])
@@ -78,7 +83,7 @@ export function effortLevels(cfg) {
         }
         const preset = provider.preset ? PRESETS.find((entry) => entry.id === provider.preset) : undefined;
         providers[name] = {
-            default: resolveCompatibleCaps(preset ? { effortLevels: preset.effortLevels, thinking: preset.thinking } : undefined, provider.caps).effortLevels,
+            default: resolveCompatibleCaps(preset ? { effortLevels: preset.effortLevels, thinking: preset.thinking, ...(preset.serverTools ? { serverTools: true } : {}) } : undefined, provider.caps).effortLevels,
             ...(Object.keys(modelLevels).length ? { models: modelLevels } : {}),
         };
     }
@@ -86,6 +91,7 @@ export function effortLevels(cfg) {
 }
 const CLAUDE_MODEL_FALLBACK = [
     { id: "claude-fable-5-1", name: "Fable 5.1" },
+    { id: "claude-opus-5-5", name: "Opus 5.5" },
     { id: "claude-opus-5", name: "Opus 5" },
     { id: "claude-sonnet-5", name: "Sonnet 5" },
     { id: "claude-haiku-4-5", name: "Haiku 4.5" },
@@ -184,10 +190,12 @@ export function chatgptSignedIn(mode) {
     const borrowed = fs.existsSync(path.join(os.homedir(), ".codex", "auth.json"));
     return mode === "own" ? own : mode === "borrow-codex" ? borrowed : own || borrowed;
 }
-async function buildStatus(deps) {
+async function buildStatus(deps, opts = {}) {
     const cfg = deps.config();
     const providers = {};
-    await Promise.all(Object.entries(cfg.providers).map(async ([name, p]) => {
+    // Keyed in the order the config lists them. Assigning inside the Promise.all callbacks ordered
+    // them by whichever TCP check answered first, so the Health list reshuffled on every poll.
+    const checked = await Promise.all(Object.entries(cfg.providers).map(async ([name, p]) => {
         const url = p.type === "anthropic" ? "https://api.anthropic.com" : p.type === "chatgpt" ? (p.url ?? "https://chatgpt.com/backend-api") : p.url;
         let reachable = false;
         try {
@@ -197,22 +205,59 @@ async function buildStatus(deps) {
         catch {
             reachable = false;
         }
-        providers[name] = {
-            url,
-            type: p.type,
-            reachable,
-            // Reaching the host says nothing about being able to use it: a chatgpt provider with no
-            // credentials is not "connected", and calling it that sends the user off believing it works.
-            ...(p.type === "chatgpt" ? { needsLogin: !chatgptSignedIn(p.auth) } : {}),
-            ...(p.type === "anthropic"
-                ? {
-                    authSource: p.auth === "claude-code" ? claudeAuthStore(deps).describeSource() : null,
-                    signedIn: p.auth === "claude-code" ? (readClaudeAuthFile(homeDir())?.source ?? null) : null,
-                }
-                : {}),
-        };
+        return [name, {
+                url,
+                type: p.type,
+                reachable,
+                // Whether the router could run a `WebSearch` side request through this provider, so the
+                // Clients screen can say so beside a model name. Nothing on that screen said which ones
+                // those are, and a `smallFast` slot pointed at one turns every search into a visible failure
+                // (2026-09-21: it was set to OpenCode Go's DeepSeek, which accepts the search request and
+                // answers with a fabricated one).
+                //
+                // It answers "can the router search here", not "can this model search". Those differ:
+                // measured 2026-09-21, OpenCode Go's Responses endpoint runs OpenAI's hosted `web_search`
+                // and cites real pages, but the wire is OpenAI-shaped while its hits come back as Responses
+                // events — a backend the router does not have, so a search still cannot go through it.
+                // Naming the provider's own capability instead would be a promise the router cannot keep.
+                ...(providerCanSearch(name, cfg) ? { webSearch: true } : {}),
+                // Reaching the host says nothing about being able to use it: a chatgpt provider with no
+                // credentials is not "connected", and calling it that sends the user off believing it works.
+                ...(p.type === "chatgpt" ? { needsLogin: !chatgptSignedIn(p.auth) } : {}),
+                ...(p.type === "anthropic"
+                    ? {
+                        authSource: p.auth === "claude-code" ? claudeAuthStore(deps).describeSource() : null,
+                        signedIn: p.auth === "claude-code" ? (listClaudeAccounts(homeDir()).length > 0 ? "oauth" : readClaudeAuthFile(homeDir())?.source ?? null) : null,
+                        accountCount: p.auth === "claude-code" ? listClaudeAccounts(homeDir()).length : 0,
+                    }
+                    : {}),
+            }];
     }));
+    for (const [name, entry] of checked)
+        providers[name] = entry;
     const chatgpt = deps.chatgpt?.() ?? { quota: {}, auth: {} };
+    // A snapshot from response headers ages the moment GPT traffic stops: measured 2026-09-20, the
+    // status route showed 1% from 11 hours earlier while the account was at 40%. Past ten minutes,
+    // ask the backend directly. The lookup shares one in-flight promise per provider, so concurrent
+    // status polls (the GUI does one every 5s) collapse into a single request. A failed lookup keeps
+    // the last good numbers and says why, rather than blanking the read the budget decision uses.
+    const STALE_MS = 10 * 60 * 1000;
+    const staleReasons = {};
+    const refresh = deps.chatgpt?.().refresh;
+    if (refresh) {
+        const now = Date.now();
+        for (const [name, q] of Object.entries(chatgpt.quota)) {
+            const at = q && typeof q.at === "number" ? q.at : 0;
+            if (!opts.refresh && at && now - at < STALE_MS)
+                continue;
+            const fresh = await refresh(name);
+            if (fresh)
+                chatgpt.quota[name] = fresh;
+            else
+                staleReasons[name] = opts.refresh ? "refresh requested but lookup failed" : "lookup failed; showing last known value";
+        }
+    }
+    const stale = Object.keys(staleReasons).length > 0;
     const signedIn = {};
     for (const [name, p] of Object.entries(cfg.providers)) {
         if (p.type !== "chatgpt")
@@ -260,7 +305,10 @@ async function buildStatus(deps) {
             pointsAtRouter: env.HTTPS_PROXY === wantProxy,
         },
         cliVersion: cliVersion(),
-        chatgpt: { ...chatgpt, signedIn },
+        chatgpt: { ...chatgpt, signedIn, ...(stale ? { stale: true, staleReason: staleReasons } : {}) },
+        // Only present for providers that declare a pool; a provider with one credential has nothing
+        // to report and would only add a row that never changes.
+        credentials: deps.credentials?.() ?? {},
         picker,
         agentTitle: agentTitleHookEnabled(),
         pickerModels: cfg.cli.extraModels.map((m) => m.name || m.model),
@@ -307,6 +355,57 @@ function runCli(args, timeout = 180_000) {
         });
     });
 }
+/**
+ * Whether this provider can actually run a web search — measured capability, not an assumption from
+ * the vendor name. The rule is the router's own (`Proxy.canRunServerTools`, mirrored here because
+ * that one is private to a live request): Anthropic runs its own server tools; an
+ * `anthropic-compatible` provider only when its preset says it was measured doing so; a `chatgpt`
+ * provider through its hosted search; an `openai-compatible` provider never — its web plugin is a
+ * vendor extension, and OpenCode Go's silently ignores it, leaving the model to answer with invented
+ * results. A configured `webSearch` backend is deliberately not counted here: it serves the search
+ * for the session, but a model still cannot search by itself, which is what a slot points at.
+ */
+function providerCanSearch(name, cfg) {
+    const p = cfg.providers[name];
+    if (!p)
+        return false;
+    if (p.type === "chatgpt")
+        return true;
+    if (p.type === "anthropic")
+        return p.accountPool === true && p.auth === "claude-code";
+    if (p.type !== "anthropic-compatible")
+        return false;
+    const preset = p.preset ? PRESETS.find((entry) => entry.id === p.preset) : undefined;
+    return resolveCompatibleCaps(preset ? { ...(preset.serverTools ? { serverTools: true } : {}) } : undefined, p.caps).serverTools;
+}
+/**
+ * Write `cli.models` into `~/.claude/settings.json` right after a GUI save, so a slot chosen on the
+ * Clients screen takes effect in the next session instead of waiting for an `install`.
+ *
+ * Returns a human-readable warning when the write could not happen, or null. A slot that silently
+ * does nothing is the exact bug this closes, so a failure has to come back to the screen rather
+ * than being swallowed into the router log.
+ */
+function syncModelSlotsForGui(cfg) {
+    try {
+        const home = homeDir();
+        syncModelSlots({
+            proxyUrl: `http://127.0.0.1:${cfg.listen.port}`,
+            caPath: certPaths(home).caPem,
+            force: false,
+            // Always an object, never omitted: `cli.models` absent means every slot should be back on
+            // Claude, and `syncModelSlots` reads an absent `models` as "do not touch these".
+            models: cfg.cli.models ?? {},
+        });
+        return null;
+    }
+    catch (e) {
+        const message = e.message;
+        if (/not ours/.test(message))
+            return "settings.json has another proxy's HTTPS_PROXY; the model slots were not written. Run `clauderipple install --force` to take it over.";
+        return `model slots were not written to settings.json: ${message}`;
+    }
+}
 function readBody(req) {
     return new Promise((resolveP, reject) => {
         const chunks = [];
@@ -329,6 +428,14 @@ function sendJson(res, status, body) {
     res.writeHead(status, { "content-type": "application/json; charset=utf-8", "content-length": String(Buffer.byteLength(out)) });
     res.end(out);
 }
+/** Write the config file atomically. The one save path: the GUI's PUT and the capability
+ * measurement both go through it, so the router never picks up a half-written file either way. */
+function writeConfigFile(configFile, config) {
+    const tmp = `${configFile}.tmp-${process.pid}-${Date.now()}`;
+    fs.mkdirSync(path.dirname(configFile), { recursive: true });
+    fs.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
+    fs.renameSync(tmp, configFile);
+}
 function headerValue(headers) {
     if (!headers)
         return null;
@@ -391,9 +498,12 @@ async function probeAnthropicApiKey(apiKey, probeFetch = fetchWithTimeout) {
 }
 function probeClaudeCodeAuth(deps) {
     const source = claudeAuthStore(deps).describeSource();
-    // Our own sign-in is reported separately: a Claude Desktop session outranks it, and without this
-    // the screen would answer a finished sign-in with the source it was already showing.
-    return { ok: source !== null, auth: source ? "ok" : "missing", source, signedIn: readClaudeAuthFile(homeDir())?.source ?? null, models: CLAUDE_MODEL_FALLBACK };
+    // Our own accounts are reported separately: a Claude Desktop session can outrank them, and without
+    // this the screen would answer a finished sign-in with the source it was already showing.
+    const accounts = listClaudeAccounts(homeDir());
+    const hasUsableAccount = accounts.some((account) => !account.needsReauth && account.expiresAt > Date.now());
+    const signedIn = accounts.length > 0 ? "oauth" : readClaudeAuthFile(homeDir())?.source ?? null;
+    return { ok: source !== null || hasUsableAccount, auth: source !== null || hasUsableAccount ? "ok" : "missing", source, signedIn, accountCount: accounts.length, models: CLAUDE_MODEL_FALLBACK };
 }
 function chatCompletionsUrl(base) {
     return `${base.replace(/\/+$/, "")}/chat/completions`;
@@ -412,30 +522,82 @@ function parsedModels(value) {
         const supported = Array.isArray(r.supported_parameters) && r.supported_parameters.every((value) => typeof value === "string")
             ? r.supported_parameters
             : undefined;
+        // OpenRouter and several other OpenAI-compatible vendors report each model's real context
+        // window here. Taking it means a routed model gets its own window without anyone typing it.
+        const contextWindow = typeof r.context_length === "number" && Number.isFinite(r.context_length) && r.context_length > 0
+            ? Math.floor(r.context_length)
+            : undefined;
         return [{
                 id: r.id,
                 ...(typeof r.name === "string" ? { name: r.name } : {}),
                 ...(supported ? { effortLevels: supported.includes("reasoning_effort") ? ["low", "medium", "high"] : [] } : {}),
+                ...(contextWindow ? { contextWindow } : {}),
             }];
     });
 }
 function snippet(text) {
     return text.replace(/\s+/g, " ").trim().slice(0, 200);
 }
+/**
+ * Fill each discovered model with the wire, endpoint and auth convention its preset declares for it.
+ *
+ * `/models` reports ids alone, and one plan can serve several wires on one catalog (OpenCode Go's
+ * Responses, Chat and Anthropic groups). A discovered model left bare would be routed on the
+ * provider's default wire — the wrong shape on the wrong path for two of the three groups. The
+ * preset's fallback list is the only place that mapping is written down, so it is read here; an id
+ * not on it stays bare and gets the provider's own wire.
+ */
+function withPresetOverrides(models, presetId) {
+    if (!presetId)
+        return models;
+    const preset = PRESETS.find((entry) => entry.id === presetId);
+    if (!preset)
+        return models;
+    return models.map((model) => {
+        const known = preset.fallbackModels.find((fallback) => fallback.id === model.id);
+        if (!known)
+            return model;
+        return {
+            ...model,
+            ...(known.wire !== undefined ? { wire: known.wire } : {}),
+            ...(known.url !== undefined ? { url: known.url } : {}),
+            ...(known.authHeader !== undefined ? { authHeader: known.authHeader } : {}),
+        };
+    });
+}
 async function fetchWithTimeout(url, init) {
     return fetch(url, { ...init, signal: AbortSignal.timeout(8_000) });
 }
-async function probeProvider(body) {
+/**
+ * The model a connection test should use, when the preset names one that speaks the wire the test
+ * speaks (Chat Completions).
+ *
+ * The catalogue's first entry is whatever the vendor happened to list first, and OpenCode lists its
+ * free tier there. Measured 2026-09-22: `big-pickle`, the head of Zen's catalogue, answers 403
+ * FreeTierError — "OpenCode's free tier can only be used from within OpenCode" — while
+ * `claude-fable-5` on the same key answers 402. Testing with the head therefore reported a paying
+ * account as refused, and pointed the operator at a key that was never the problem.
+ *
+ * The preset's own list is picked from deliberately, and only its Chat entries: the test posts to
+ * Chat Completions, so a Responses-only model like Muse Spark would answer 503 and look broken.
+ */
+function presetProbeModel(presetId) {
+    const preset = presetId ? PRESETS.find((entry) => entry.id === presetId) : undefined;
+    if (!preset)
+        return undefined;
+    return preset.fallbackModels.find((model) => (model.wire ?? preset.wire ?? "chat") === "chat")?.id;
+}
+async function probeProvider(body, probeFetch = fetchWithTimeout) {
     const source = headerValue(body.headers);
     let models = [];
     let modelsError;
     if (body.modelsUrl) {
         try {
-            const response = await fetchWithTimeout(body.modelsUrl, { headers: authHeaders(source, body.modelsAuthHeader) });
+            const response = await probeFetch(body.modelsUrl, { headers: authHeaders(source, body.modelsAuthHeader) });
             if (response.status === 401 || response.status === 403)
                 return { ok: false, auth: "bad-key", models: [], error: `models endpoint returned ${response.status}` };
             if (response.ok)
-                models = parsedModels(await response.json());
+                models = withPresetOverrides(parsedModels(await response.json()), body.preset);
             else
                 modelsError = `models endpoint returned ${response.status}`;
         }
@@ -445,18 +607,26 @@ async function probeProvider(body) {
     }
     const openai = body.type === "openai-compatible";
     const checkUrl = openai ? chatCompletionsUrl(body.url) : messagesUrl(body.url);
+    const checkModel = presetProbeModel(body.preset) ?? models[0]?.id ?? body.probeModel ?? "test";
     const checkBody = openai
-        ? { model: models[0]?.id ?? body.probeModel ?? "test", max_tokens: 1, stream: false, messages: [{ role: "user", content: "hi" }] }
-        : { model: models[0]?.id ?? body.probeModel ?? "test", max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
+        ? { model: checkModel, max_tokens: 1, stream: false, messages: [{ role: "user", content: "hi" }] }
+        : { model: checkModel, max_tokens: 1, messages: [{ role: "user", content: "hi" }] };
     const label = openai ? "chat completions endpoint" : "messages endpoint";
     try {
-        const response = await fetchWithTimeout(checkUrl, {
+        const response = await probeFetch(checkUrl, {
             method: "POST",
-            headers: { "content-type": "application/json", ...authHeaders(source) },
+            headers: {
+                "content-type": "application/json",
+                ...(body.sessionHeader ? { [body.sessionHeader]: `probe-${crypto.randomBytes(8).toString("hex")}` } : {}),
+                ...authHeaders(source),
+            },
             body: JSON.stringify(checkBody),
         });
-        if (response.status === 401 || response.status === 403)
-            return { ok: false, auth: "bad-key", models, error: `${label} returned ${response.status}: ${snippet(await response.text())}` };
+        if (response.status === 401 || response.status === 403) {
+            const refusal = snippet(await response.text());
+            const auth = response.status === 403 && refusedByPlan(refusal) ? "not-entitled" : "bad-key";
+            return { ok: false, auth, models, error: `${label} returned ${response.status}: ${refusal}` };
+        }
         if (response.ok)
             return { ok: true, auth: "ok", models, ...(modelsError ? { error: modelsError } : {}) };
         const detail = snippet(await response.text());
@@ -475,6 +645,162 @@ async function probeProvider(body) {
         return { ok: false, auth: "unreachable", models, error: modelsError ? `${modelsError}; ${message}` : message };
     }
 }
+const MEASURE_JOBS = new Map();
+/** Measured capability does not change minute to minute, so a finished job is served for a while
+ * and then dropped: a test or a GUI that polls late should re-measure rather than hold the result
+ * (and its error strings) in memory for the life of the process. */
+const MEASURE_JOB_TTL_MS = 10 * 60 * 1000;
+const MEASURE_TIMEOUT_MS = 20_000;
+async function measureFetchWithTimeout(url, init) {
+    return fetch(url, { ...init, signal: AbortSignal.timeout(MEASURE_TIMEOUT_MS) });
+}
+/** Drop finished jobs past their TTL. Run on each measure request, so no timer keeps the process up. */
+function sweepMeasureJobs() {
+    const cutoff = Date.now() - MEASURE_JOB_TTL_MS;
+    for (const [id, job] of MEASURE_JOBS)
+        if (job.state !== "running" && job.finishedAt !== undefined && job.finishedAt < cutoff)
+            MEASURE_JOBS.delete(id);
+}
+/**
+ * The wires a model of this provider might speak, in the order they are worth trying.
+ *
+ * The preset's own entry for this exact model goes first when there is one. Order decides the
+ * answer, because the first wire to reply wins — and a plan can serve one model on two of them:
+ * measured 2026-09-22, `minimax-m3` answers on both Chat Completions and Anthropic Messages, so
+ * trying the list in catalogue order made it measure as `chat` and quietly overrule the `anthropic`
+ * the preset recorded for it. A recorded wire is still only a starting point: it has to answer like
+ * any other candidate, and the rest of the list is tried when it does not.
+ */
+function measureCandidates(p, modelId) {
+    const defaultWire = p.type === "anthropic-compatible" ? "anthropic"
+        : p.type === "openai-compatible" ? (p.wire ?? "chat")
+            : "chat";
+    const ownUrl = "url" in p ? p.url : "";
+    const ownHeader = "authHeader" in p ? p.authHeader : undefined;
+    const own = { wire: defaultWire, url: ownUrl, ...(ownHeader ? { authHeader: ownHeader } : {}) };
+    const candidates = [];
+    const seen = new Set();
+    const add = (c) => {
+        const key = `${c.wire}|${c.url}|${c.authHeader ?? ""}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        candidates.push(c);
+    };
+    const known = "preset" in p && p.preset
+        ? PRESETS.find((entry) => entry.id === p.preset)?.fallbackModels?.find((m) => m.id === modelId)
+        : undefined;
+    if (known?.wire)
+        add({ wire: known.wire, url: known.url ?? ownUrl, ...(known.authHeader ? { authHeader: known.authHeader } : {}) });
+    add(own);
+    if (p.type === "openai-compatible" && p.preset) {
+        // One plan can serve several wires on one catalog. The preset's fallback list is the only place
+        // any of that mapping is written down, so it is what the remaining candidates are read from.
+        const preset = PRESETS.find((entry) => entry.id === p.preset);
+        for (const model of preset?.fallbackModels ?? [])
+            add({ wire: model.wire ?? defaultWire, url: model.url ?? p.url, ...(model.authHeader ? { authHeader: model.authHeader } : {}) });
+    }
+    else if (p.type === "openai-compatible") {
+        // No table to read: the two OpenAI wires this kind of provider could be serving.
+        add({ wire: "responses", url: p.url });
+        add({ wire: "chat", url: p.url });
+    }
+    else if (p.type === "anthropic-compatible" && p.preset) {
+        const preset = PRESETS.find((entry) => entry.id === p.preset);
+        for (const model of preset?.fallbackModels ?? [])
+            if (model.wire)
+                add({ wire: model.wire, url: model.url ?? p.url, ...(model.authHeader ? { authHeader: model.authHeader } : {}) });
+    }
+    return candidates;
+}
+/** The effort ladder this provider offers, before any per-model override narrows it. */
+function providerLadder(p) {
+    if (p.type === "openai-compatible")
+        return p.caps?.reasoning === "effort" ? [...(p.caps.effortLevels ?? [])] : [];
+    if (p.type === "anthropic-compatible")
+        return [...(p.caps?.effortLevels ?? [])];
+    return [];
+}
+/**
+ * Fold measurements into the config on disk.
+ *
+ * Read again here rather than reusing what the job started with: the user may have saved from the
+ * GUI while the measurements ran, and writing back a stale copy would silently revert that save.
+ * Only a model that is still present is touched, and only into a blank field — a `wire` or
+ * `effortLevels` already on the model is the user's, and an explicitly empty array is a decision
+ * (it disables the provider fallback), not an empty slot. A model whose measurement errored is
+ * left entirely alone. The result is validated with the same `validate` the GUI's save uses, so a
+ * bad edit is refused rather than written.
+ */
+function applyMeasurements(configFile, results) {
+    let current;
+    try {
+        current = JSON.parse(fs.readFileSync(configFile, "utf8"));
+    }
+    catch (e) {
+        return { error: `could not re-read config: ${errorText(e)}` };
+    }
+    let applied = 0;
+    for (const result of results) {
+        if (result.error || !result.wire)
+            continue;
+        for (const provider of Object.values(current.providers)) {
+            if (!("models" in provider) || !provider.models)
+                continue;
+            const model = provider.models.find((entry) => entry.id === result.id);
+            if (!model)
+                continue;
+            const before = `${model.wire ?? ""}|${model.effortLevels ? model.effortLevels.join(",") : "∅"}`;
+            if (model.wire === undefined)
+                model.wire = result.wire;
+            if (model.effortLevels === undefined && result.effortLevels !== undefined)
+                model.effortLevels = result.effortLevels;
+            if (`${model.wire ?? ""}|${model.effortLevels ? model.effortLevels.join(",") : "∅"}` !== before)
+                applied++;
+        }
+    }
+    const errors = validate(current);
+    if (errors.length > 0)
+        return { error: `measured config did not validate: ${errors[0]}` };
+    writeConfigFile(configFile, current);
+    return { applied };
+}
+/** Run one provider measurement job to completion. Detached: the request that started it has already answered. */
+async function runMeasureJob(jobId, providerName, models, deps) {
+    const job = MEASURE_JOBS.get(jobId);
+    if (!job)
+        return;
+    const provider = deps.config().providers[providerName];
+    if (!provider || (provider.type !== "openai-compatible" && provider.type !== "anthropic-compatible")) {
+        MEASURE_JOBS.set(jobId, { ...job, state: "failed", error: `provider "${providerName}" is not openai-compatible or anthropic-compatible` });
+        return;
+    }
+    const ladder = providerLadder(provider);
+    const fetchImpl = deps.measureFetch ?? measureFetchWithTimeout;
+    const headers = "headers" in provider ? provider.headers : undefined;
+    const sessionHeader = "sessionHeader" in provider ? provider.sessionHeader : undefined;
+    for (const id of models) {
+        // Per model, not once per job: the order depends on what the preset recorded for this id.
+        const candidates = measureCandidates(provider, id);
+        const measured = await measureModel(id, candidates, ladder, { fetch: fetchImpl, ...(sessionHeader ? { sessionHeader } : {}), ...(headers ? { headers } : {}) });
+        job.results.push(measured);
+        job.done++;
+        deps.log.info(`admin: measured ${providerName}/${id} -> ${measured.error ? `error ${measured.error}` : `wire ${measured.wire}${measured.effortLevels ? ` effort ${measured.effortLevels.join(",")}` : ""}`}`);
+    }
+    try {
+        const outcome = applyMeasurements(deps.configFile, job.results);
+        if ("error" in outcome) {
+            MEASURE_JOBS.set(jobId, { ...job, state: "failed", error: outcome.error, finishedAt: Date.now() });
+            deps.log.warn(`admin: measurement for ${providerName} was not applied: ${outcome.error}`);
+            return;
+        }
+        deps.log.info(`admin: measurement for ${providerName} applied to ${outcome.applied} model(s)`);
+        MEASURE_JOBS.set(jobId, { ...job, state: "done", finishedAt: Date.now() });
+    }
+    catch (e) {
+        MEASURE_JOBS.set(jobId, { ...job, state: "failed", error: errorText(e), finishedAt: Date.now() });
+    }
+}
 function pickerModels(deps) {
     const last = deps.picker?.().last;
     if (last && typeof last === "object" && Array.isArray(last.surfaces)) {
@@ -582,10 +908,14 @@ export function startAdmin(deps) {
     }
     async function handle(req, res) {
         const url = req.url ?? "/";
-        const method = req.method ?? "GET";
+        // A HEAD is a GET whose body is discarded, and Node discards it for us: measured 2026-09-22,
+        // the response goes out with its `content-length` and no bytes after the headers. Normalising
+        // it here lets every read-only route answer one, where matching on "GET" alone fell through to
+        // 404 — which reads as a dead router to anything that checks with a HEAD.
+        const method = req.method === "HEAD" ? "GET" : (req.method ?? "GET");
         const pathname = url.split("?")[0] ?? "/";
         try {
-            if (method !== "GET" && method !== "HEAD" && crossSitePost(req)) {
+            if (method !== "GET" && crossSitePost(req)) {
                 deps.log.warn(`admin: refused ${method} ${pathname} from origin ${String(req.headers.origin)}`);
                 sendJson(res, 403, { error: "cross-site request refused" });
                 return;
@@ -610,7 +940,8 @@ export function startAdmin(deps) {
                 return;
             }
             if (pathname === "/api/status" && method === "GET") {
-                sendJson(res, 200, await buildStatus(deps));
+                const refresh = new URL(url, "http://127.0.0.1").searchParams.get("refresh") === "1";
+                sendJson(res, 200, await buildStatus(deps, { refresh }));
                 return;
             }
             if (pathname === "/api/presets" && method === "GET") {
@@ -665,16 +996,20 @@ export function startAdmin(deps) {
                 if (probe.type === "chatgpt") {
                     const statuses = Object.values(deps.chatgpt?.().auth ?? {});
                     const signed = chatgptSignedIn(typeof probe.auth === "string" ? probe.auth : undefined);
+                    // Which provider to ask: the form knows the one it is editing, and a provider merely
+                    // configured by hand is the only other candidate. Unknown name → ask nobody, show the
+                    // measured fallback, which is also what an unreachable catalogue yields.
+                    const providers = deps.config().providers;
+                    const named = typeof probe.name === "string" && providers[probe.name]?.type === "chatgpt" ? probe.name : undefined;
+                    const providerName = named ?? Object.entries(providers).find(([, p]) => p.type === "chatgpt")?.[0];
+                    const live = providerName ? await deps.chatgpt?.().models?.(providerName) : undefined;
+                    const models = live?.length ? live : CHATGPT_FALLBACK_MODELS;
                     sendJson(res, 200, {
                         ok: signed,
                         auth: signed ? (statuses[0] ?? "ok") : "missing",
                         ...(signed ? {} : { error: "no ChatGPT credentials: sign in from the tray menu, or install and sign in to the Codex CLI" }),
-                        models: [
-                            { id: "gpt-5.6-terra", name: "GPT-5.6 Terra" },
-                            { id: "gpt-5.6-sol", name: "GPT-5.6 Sol" },
-                            { id: "gpt-5.6-luna", name: "GPT-5.6 Luna" },
-                            { id: "gpt-6-astra", name: "GPT-6 Astra" },
-                        ],
+                        models,
+                        modelsSource: live?.length ? "catalog" : "fallback",
                     });
                     return;
                 }
@@ -692,12 +1027,56 @@ export function startAdmin(deps) {
                     url: probe.url,
                     ...(probe.headers ? { headers: probe.headers } : {}),
                     ...(probe.modelsUrl ? { modelsUrl: probe.modelsUrl } : {}),
+                    ...(typeof probe.sessionHeader === "string" && probe.sessionHeader ? { sessionHeader: probe.sessionHeader } : {}),
                     ...(probe.modelsAuthHeader ? { modelsAuthHeader: probe.modelsAuthHeader } : {}),
+                    ...(typeof probe.preset === "string" && probe.preset ? { preset: probe.preset } : {}),
                     ...(typeof probe.probeModel === "string" ? { probeModel: probe.probeModel } : {}),
-                });
+                }, deps.probeModelFetch ?? fetchWithTimeout);
                 sendJson(res, 200, result);
                 return;
             }
+            // Measure what each model's wire and effort ladder actually is, in the background: a job is
+            // several small upstream requests, and the caller polls /api/providers/measure/<jobId> rather
+            // than holding a request open for all of them.
+            if (pathname === "/api/providers/measure" && method === "POST") {
+                let body;
+                try {
+                    body = JSON.parse((await readBody(req)).toString("utf8"));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON" });
+                    return;
+                }
+                if (typeof body.provider !== "string" || !Array.isArray(body.models) || body.models.some((m) => typeof m !== "string")) {
+                    sendJson(res, 400, { error: "expected {provider: string, models: string[]}" });
+                    return;
+                }
+                const provider = deps.config().providers[body.provider];
+                if (!provider || (provider.type !== "openai-compatible" && provider.type !== "anthropic-compatible")) {
+                    sendJson(res, 400, { error: `provider "${body.provider}" is not openai-compatible or anthropic-compatible` });
+                    return;
+                }
+                sweepMeasureJobs();
+                const jobId = crypto.randomBytes(12).toString("hex");
+                const job = { state: "running", done: 0, total: body.models.length, results: [] };
+                MEASURE_JOBS.set(jobId, job);
+                deps.log.info(`admin: measuring ${body.provider} (${body.models.length} model(s)) -> ${jobId.slice(0, 8)}`);
+                void runMeasureJob(jobId, body.provider, body.models, deps);
+                sendJson(res, 202, { jobId, total: job.total });
+                return;
+            }
+            if (pathname.startsWith("/api/providers/measure/") && method === "GET") {
+                const jobId = pathname.slice("/api/providers/measure/".length).split("/")[0] ?? "";
+                const job = MEASURE_JOBS.get(jobId);
+                if (!job) {
+                    sendJson(res, 404, { error: "unknown or expired measure job" });
+                    return;
+                }
+                // The polled shape, without the sweep's own bookkeeping field.
+                const { finishedAt: _finishedAt, ...view } = job;
+                sendJson(res, 200, view);
+                return;
+            }
             if (pathname === "/api/config" && method === "GET") {
                 sendJson(res, 200, deps.config());
                 return;
@@ -724,12 +1103,13 @@ export function startAdmin(deps) {
                     sendJson(res, 400, { errors });
                     return;
                 }
-                const tmp = `${deps.configFile}.tmp-${process.pid}-${Date.now()}`;
-                fs.mkdirSync(path.dirname(deps.configFile), { recursive: true });
-                fs.writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n");
-                fs.renameSync(tmp, deps.configFile);
+                writeConfigFile(deps.configFile, parsed);
                 deps.log.info(`admin: config saved via GUI (${Object.keys(parsed.routes).length} routes, ${Object.keys(parsed.providers).length} providers)`);
-                sendJson(res, 200, { ok: true });
+                // `cli.models` cannot take effect through the router at all: Claude Code reads the slots
+                // before a request exists. So a GUI save has to write them to settings.json itself;
+                // otherwise the Clients screen shows a choice that only a later `install` would honour.
+                const slotWarning = syncModelSlotsForGui(parsed);
+                sendJson(res, 200, { ok: true, ...(slotWarning ? { warning: slotWarning } : {}) });
                 return;
             }
             if (pathname === "/api/codex" && method === "GET") {
@@ -776,10 +1156,63 @@ export function startAdmin(deps) {
                 sendJson(res, 200, { started: true });
                 return;
             }
+            // Safe account metadata only. The current Claude Code/Desktop source remains externally owned;
+            // ClaudeRipple accounts can be renamed or removed by their local opaque id.
+            if (pathname === "/api/claude-accounts" && method === "GET") {
+                const source = claudeAuthStore(deps).describeSource();
+                sendJson(res, 200, {
+                    current: source ? { id: "current", label: "Current Claude login", source, external: true } : null,
+                    accounts: listClaudeAccounts(homeDir()),
+                });
+                return;
+            }
+            if (pathname.startsWith("/api/claude-accounts/") && (method === "PATCH" || method === "DELETE")) {
+                let id;
+                try {
+                    id = decodeURIComponent(pathname.slice("/api/claude-accounts/".length));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid account id" });
+                    return;
+                }
+                const validId = id === "legacy" || /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id);
+                if (!validId || id === "current") {
+                    sendJson(res, id === "current" ? 409 : 400, { error: id === "current" ? "the current Claude login is managed by Claude Code or Claude Desktop" : "invalid account id" });
+                    return;
+                }
+                if (method === "DELETE") {
+                    if (!removeClaudeAccount(homeDir(), id)) {
+                        sendJson(res, 404, { error: "Claude account not found" });
+                        return;
+                    }
+                    deps.log.info(`admin: removed Claude account ${id.slice(0, 8)}`);
+                    sendJson(res, 200, { ok: true });
+                    return;
+                }
+                let label;
+                try {
+                    label = JSON.parse((await readBody(req)).toString("utf8")).label;
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON" });
+                    return;
+                }
+                if (typeof label !== "string" || !label.trim()) {
+                    sendJson(res, 400, { error: "expected {label: non-empty string}" });
+                    return;
+                }
+                if (!renameClaudeAccount(homeDir(), id, label)) {
+                    sendJson(res, 404, { error: "Claude account not found" });
+                    return;
+                }
+                deps.log.info(`admin: renamed Claude account ${id.slice(0, 8)}`);
+                sendJson(res, 200, { ok: true });
+                return;
+            }
             // Claude subscription sign-in of our own (browser, PKCE). The GUI starts it, polls the state,
             // and pastes the code when the loopback port could not be used. Tokens never leave the router.
             if (pathname === "/api/claude-oauth" && method === "GET") {
-                const state = { ...(claudeOAuth?.snapshot ?? { running: false, url: null, manual: false, startedAt: null, finishedAt: null, ok: null, error: null }), source: claudeAuthStore(deps).describeSource() };
+                const state = { ...(claudeOAuth?.snapshot ?? { running: false, url: null, manual: false, startedAt: null, finishedAt: null, ok: null, error: null, account: null }), source: claudeAuthStore(deps).describeSource() };
                 sendJson(res, 200, state);
                 return;
             }