llm-switcher 1.1.11 → 1.2.0

package/ensure-ca-bundle.mjs

@@ -0,0 +1,28 @@
+// ============================================================
+// ensure-ca-bundle.mjs — the shim's one call into Node (R2, R4)
+//
+// The shim must point NODE_EXTRA_CA_CERTS at a bundle holding BOTH the user's own CA and the
+// switcher's ca.pem, so trusting the interceptor never costs the user a certificate they
+// already had. Building that bundle means reading files, comparing content byte for byte and
+// renaming atomically — none of which belongs in a shell script, and none at all in cmd.exe.
+//
+// It is a FILE rather than `node -e "..."` on purpose: cmd.exe re-parses quotes and reads %2
+// inside a percent-encoded URL, so a space anywhere in the checkout path would corrupt the
+// program or its arguments.
+//
+// argv: <inherited NODE_EXTRA_CA_CERTS> <switcher ca.pem> <state dir>
+// stdout: the bundle path, and nothing else — the shim compares it against -f before exporting.
+// exit 1 on any failure: the reason is already on stderr, and the shim then keeps the inherited
+// value and exports no path to a file that does not exist.
+// ============================================================
+
+import { ensureClaudeCaBundle } from './state.mjs';
+
+const [, , inheritedCa, switcherCaPath, stateDir] = process.argv;
+const result = ensureClaudeCaBundle(inheritedCa, switcherCaPath, stateDir);
+
+if (result && result.ok && result.path) {
+  process.stdout.write(result.path);
+  process.exit(0);
+}
+process.exit(1);

package/formats.mjs

@@ -23,7 +23,6 @@
 // }
 // ============================================================
 
-export const IN_FORMATS = ['anthropic', 'openai-chat', 'responses', 'vertex'];
 export const OUT_FORMATS = ['openai-chat', 'anthropic', 'vertex'];
 
 // ---------------- stop reasons ----------------
@@ -272,7 +271,10 @@ function sanitizeSchemaNode(schema) {
     }
     clean[k] = sanitizeSchemaNode(v);
   }
-  if (!clean.type && clean.properties) {
+  // An empty schema carries no shape, and Vertex reads that as a missing `type`.
+  // Heal it the way a missing schema is healed — but only when nothing else is here,
+  // so an `anyOf`/`$ref` shape is never handed a type it did not ask for.
+  if (!clean.type && (clean.properties || Object.keys(clean).length === 0)) {
     clean.type = 'object';
   }
   if (clean.type === 'object' && !clean.properties) {
@@ -455,73 +457,6 @@ function applyAllowedTools(ir, mode, list, nameOf) {
   ir.toolChoice = ir.tools.length ? (mode === 'required' ? 'required' : 'auto') : null;
 }
 
-function chatToIR(payload) {
-  const ir = baseIR();
-  ir.model = payload.model || '';
-  ir.stream = payload.stream === true;
-
-  if (Array.isArray(payload.messages)) {
-    for (const m of payload.messages) {
-      const role = m.role;
-      if (role === 'system' || role === 'developer') {
-        const t = typeof m.content === 'string' ? m.content : asText(m.content);
-        if (t) ir.system = ir.system ? `${ir.system}\n\n${t}` : t;
-        continue;
-      }
-      if (role === 'tool' || role === 'function') {
-        ir.messages.push({
-          role: 'tool', toolCallId: m.tool_call_id || m.id,
-          name: m.name, content: typeof m.content === 'string' ? m.content : asText(m.content)
-        });
-        continue;
-      }
-      const out = { role: role === 'assistant' ? 'assistant' : 'user' };
-      if (typeof m.content === 'string' || Array.isArray(m.content)) out.content = m.content;
-      else if (m.content != null) out.content = asText(m.content);
-      if (Array.isArray(m.tool_calls)) {
-        out.toolCalls = m.tool_calls.map((tc, i) => ({
-          id: tc.id || null,
-          name: tc.function?.name || tc.name || '',
-          args: parseArgs(tc.function?.arguments ?? tc.function?.args ?? tc.args)
-        })).filter(t => t.name);
-      }
-      if (out.content !== undefined || out.toolCalls) ir.messages.push(out);
-    }
-  }
-
-  const toolDefs = payload.tools;
-  if (Array.isArray(toolDefs) && toolDefs.length) {
-    ir.tools = toolDefs.map(t => {
-      const fn = t.function || t;
-      return { name: fn.name, description: fn.description || '', parameters: sanitizeJsonSchema(fn.parameters || fn.input_schema || {}) };
-    }).filter(t => t.name);
-  }
-
-  const tc = payload.tool_choice;
-  if (typeof tc === 'string') ir.toolChoice = tc;
-  else if (tc?.type === 'function' && tc.function?.name) ir.toolChoice = { name: tc.function.name };
-  else if (tc?.type === 'allowed_tools') applyAllowedTools(ir, tc.allowed_tools?.mode, tc.allowed_tools?.tools, t => t?.function?.name);
-
-  ir.params.maxTokens = payload.max_tokens ?? payload.max_completion_tokens ?? null;
-  if (typeof payload.temperature === 'number') ir.params.temperature = payload.temperature;
-  if (typeof payload.top_p === 'number') ir.params.topP = payload.top_p;
-  if (typeof payload.presence_penalty === 'number') ir.params.presencePenalty = payload.presence_penalty;
-  if (typeof payload.frequency_penalty === 'number') ir.params.frequencyPenalty = payload.frequency_penalty;
-  if (payload.stop !== undefined && payload.stop !== null) ir.params.stop = stopList(payload.stop);
-  if (payload.parallel_tool_calls === false) ir.params.parallelToolCalls = false;
-
-  if (payload.thinking && typeof payload.thinking === 'object') {
-    ir.thinking = thinkingFromAnthropicParam(payload.thinking, payload.reasoning_effort);
-  } else if (typeof payload.reasoning_effort === 'string') {
-    ir.thinking = isNoReasoningEffort(payload.reasoning_effort)
-      ? { type: 'disabled' }
-      : { type: 'enabled', budget: effortToBudget(payload.reasoning_effort), effort: payload.reasoning_effort };
-  } else if (payload.reasoning && typeof payload.reasoning === 'object') {
-    ir.thinking = thinkingFromReasoningParam(payload.reasoning);
-  }
-  return ir;
-}
-
 // OpenAI/OpenRouter `reasoning` object -> IR thinking.
 function thinkingFromReasoningParam(r) {
   if (!r || typeof r !== 'object') return null;
@@ -712,95 +647,16 @@ function responsesToIR(payload) {
   return ir;
 }
 
-// Vertex generateContent -> IR.
-function vertexToIR(payload) {
-  const ir = baseIR();
-  ir.model = payload.model || '';
-  ir.stream = false; // proxy overrides per the :streamGenerateContent endpoint
-
-  const sys = payload.systemInstruction?.parts;
-  if (Array.isArray(sys)) {
-    ir.system = sys.map(p => p.text || '').filter(Boolean).join('\n\n');
-  } else if (typeof payload.system_instruction === 'string') {
-    ir.system = payload.system_instruction;
-  }
-
-  // Vertex has no tool call ids: auto-generate ids for functionCalls then match functionResponses by name (FIFO),
-  // so upstream OpenAI/Anthropic gets the correct tool_call <-> tool result pairs instead of "healing" them into text.
-  const pendingByName = new Map();
-  let callSeq = 0;
-
-  if (Array.isArray(payload.contents)) {
-    for (const c of payload.contents) {
-      const parts = Array.isArray(c?.parts) ? c.parts : [];
-      const texts = [];
-      const toolCalls = [];
-      for (const p of parts) {
-        if (!p || typeof p !== 'object') continue;
-        if (typeof p.text === 'string' && p.text && p.thought !== true) texts.push(p.text);
-        if (p.functionCall) {
-          const name = p.functionCall.name || '';
-          const id = p.functionCall.id || `call_vtx_${callSeq++}_${name}`;
-          if (!pendingByName.has(name)) pendingByName.set(name, []);
-          pendingByName.get(name).push(id);
-          const sig = p.thoughtSignature || p.thought_signature || null;
-          rememberToolSignature(id, sig);
-          toolCalls.push({ id, name, args: p.functionCall.args ?? {}, sig });
-        }
-        if (p.functionResponse) {
-          const fr = p.functionResponse;
-          const name = fr.name || '';
-          const queue = pendingByName.get(name);
-          const id = fr.id || (queue && queue.length ? queue.shift() : `call_vtx_orphan_${name}`);
-          ir.messages.push({
-            role: 'tool', toolCallId: id, name: name || null,
-            content: typeof fr.response === 'string' ? fr.response : JSON.stringify(fr.response ?? '')
-          });
-        }
-      }
-      if (c.role === 'model') {
-        const out = { role: 'assistant' };
-        if (texts.length) out.content = texts.join('');
-        if (toolCalls.length) out.toolCalls = toolCalls;
-        if (out.content !== undefined || out.toolCalls) ir.messages.push(out);
-      } else if (c.role === 'function') {
-        // functionResponse already pushed above
-      } else {
-        if (texts.length) ir.messages.push({ role: 'user', content: texts.join('') });
-      }
-    }
-  }
-
-  const fns = payload.tools?.flatMap(t => t.functionDeclarations || t.function_declarations || []);
-  if (Array.isArray(fns) && fns.length) {
-    ir.tools = fns.filter(f => f.name).map(f => ({
-      name: f.name, description: f.description || '',
-      parameters: sanitizeJsonSchema(f.parameters || {})
-    }));
-  }
-
-  const gc = payload.generationConfig || payload.generation_config || {};
-  if (typeof gc.maxOutputTokens === 'number') ir.params.maxTokens = gc.maxOutputTokens;
-  if (typeof gc.temperature === 'number') ir.params.temperature = gc.temperature;
-  if (typeof gc.topP === 'number') ir.params.topP = gc.topP;
-  if (Array.isArray(gc.stopSequences)) ir.params.stop = stopList(gc.stopSequences);
-  const th = gc.thinkingConfig || gc.thinking_config;
-  if (th && typeof th === 'object') {
-    if (th.thinkingBudget === 0) ir.thinking = { type: 'disabled' };
-    else if (th.thinkingBudget > 0) ir.thinking = { type: 'enabled', budget: clampBudget(th.thinkingBudget) };
-    else if (th.thinkingLevel) ir.thinking = { type: 'enabled', budget: effortToBudget(th.thinkingLevel), effort: th.thinkingLevel };
-    else if (th.includeThoughts) ir.thinking = { type: 'enabled', budget: 2048 };
-  }
-  return ir;
-}
-
+// R5: two inputs, one per tool — `anthropic` for Claude Code, `responses` for Codex. The
+// openai-chat and vertex routes were removed with their parsers; a format that reaches here
+// anyway is an error, never a silent fallback to another protocol (a different API key!).
+// The UPSTREAM formats are a different axis and are untouched: emitUpstreamBody still speaks
+// openai-chat, anthropic and vertex to whatever provider the profile points at.
 function parseToIR(clientFormat, payload) {
   switch (clientFormat) {
     case 'anthropic': return anthropicToIR(payload);
-    case 'openai-chat': return chatToIR(payload);
     case 'responses': return responsesToIR(payload);
-    case 'vertex': return vertexToIR(payload);
-    default: throw new Error(`Unknown client format: ${clientFormat}`);
+    default: throw new Error(`Unsupported input format: ${clientFormat}. Only anthropic (Claude Code) and responses (Codex) accept requests.`);
   }
 }
 
@@ -1255,6 +1111,8 @@ function toGeminiSchema(schema, root, seen) {
     return schema === 'object' ? { type: 'object', properties: {} } : { type: schema };
   }
   if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return schema;
+  // The same hole as the string shorthand above: an empty schema has no type Vertex can read.
+  if (Object.keys(schema).length === 0) return { type: 'object', properties: {} };
   root = root || schema;
   seen = seen || new Set();
   if (seen.has(schema)) return {};
@@ -2305,7 +2163,7 @@ export {
   smartReasoning, smartText, smartToolCalls, smartUsage, smartFinish,
   firstChoice, smartDelta, sanitizeJsonSchema, toGeminiSchema, splitParts,
   budgetToEffort, effortToBudget, clampBudget, parseArgs, stringifyArgs,
-  anthropicToIR, chatToIR, responsesToIR, vertexToIR, parseToIR,
+  anthropicToIR, responsesToIR, parseToIR,
   healToolPairs, healAnthropicPayload, rememberToolSignature, lookupToolSignature, estimateTokens, irToChatBody, irToAnthropicBody, irToVertexBody, emitUpstreamBody,
   normalizeUpstream, createUpstreamNormalizer, createCollector,
   createThinkTagSplitter, splitThinkTags,

package/mcp.mjs

@@ -11,7 +11,7 @@
 // ============================================================
 
 import fs from 'node:fs';
-import { claudeSettingsPath, loadConfig as loadSharedConfig, resolvePort, readAdminToken, TARGETS } from './state.mjs';
+import { claudeSettingsPath, loadConfig as loadSharedConfig, resolvePort, readAdminToken, STATE_DIR } from './state.mjs';
 
 const VERSION = (() => {
   try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version; } catch { return '0.0.0'; }
@@ -80,7 +80,7 @@ async function postSwitch(port, target, profile) {
 const TOOLS = [
   {
     name: 'switcher_status',
-    description: 'Get live status of LLM Switcher gateway: port, active multi-CLI targets (Claude Code, Codex, OpenAI, Vertex), and 1M context flags.',
+    description: 'Get live status of LLM Switcher gateway: port, the two tool targets (Claude Code, Codex), and the active profile of each.',
     inputSchema: {
       type: 'object',
       properties: {}
@@ -98,14 +98,14 @@ const TOOLS = [
   },
   {
     name: 'switcher_switch_profile',
-    description: 'Programmatically change the active profile for a specific CLI target (e.g. Claude Code, Codex, OpenAI, Vertex) or globally.',
+    description: 'Programmatically change the active profile for one tool: Claude Code (claude) or Codex (codex).',
     inputSchema: {
       type: 'object',
       properties: {
         target: {
           type: 'string',
-          description: 'CLI target to switch: "anthropic" (Claude Code), "responses" (Codex), "openai-chat", or "vertex"',
-          enum: TARGETS
+          description: 'Tool to switch: "claude" (Claude Code) or "codex" (Codex)',
+          enum: ['claude', 'codex']
         },
         profile: {
           type: 'string',
@@ -124,6 +124,17 @@ const TOOLS = [
         limit: { type: 'number', description: 'Maximum number of recent logs to return (default: 5)' }
       }
     }
+  },
+  {
+    name: 'switcher_models',
+    description: 'Get the latest model catalog for Claude Code and Codex, including discovered upstream models and slot assignments.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tool: { type: 'string', enum: ['claude', 'codex'], description: 'Optional: filter by tool ("claude" or "codex")' },
+        refresh: { type: 'boolean', description: 'Query official upstream endpoints for new models before returning' }
+      }
+    }
   }
 ];
 
@@ -131,17 +142,29 @@ async function handleToolCall(name, args) {
   const cfg = loadConfig();
   const port = getMcpPort();
 
+  if (name === 'switcher_models') {
+    const { loadCatalogCache, refreshCatalog } = await import('./catalog.mjs');
+    if (args?.refresh) {
+      await refreshCatalog(STATE_DIR);
+    }
+    const cache = loadCatalogCache(STATE_DIR);
+    const t = args?.tool?.toLowerCase();
+    const res = {};
+    if (!t || t === 'claude') res.claude = cache.claude;
+    if (!t || t === 'codex') res.codex = cache.codex;
+    res.updatedAt = cache.updatedAt;
+    return { content: [{ type: 'text', text: JSON.stringify(res, null, 2) }] };
+  }
+
   if (name === 'switcher_status') {
     const live = await fetchStatus(port);
     const activeMap = live?.activeProfiles || cfg.activeProfiles || {};
     const text = [
       '=== LLM Switcher Gateway Status ===',
       `Service Running: ${live ? `YES (http://127.0.0.1:${port})` : 'NO / UNREACHABLE'}`,
-      `Active Profiles by CLI:`,
-      `  - Claude Code (/v1/messages)       : [${activeMap.anthropic || 'OFF'}] ${live?.claude1MTiers?.length ? `• 1M Context ACTIVE (${live.claude1MTiers.join(', ')})` : ''}`,
-      `  - Codex CLI   (/v1/responses)      : [${activeMap.responses || 'OFF'}] ${live?.isCodex1MActive ? '• 1M Context ACTIVE' : ''}`,
-      `  - OpenAI Chat (/v1/chat/completions): [${activeMap['openai-chat'] || 'OFF'}]`,
-      `  - Vertex      (/v1beta/models/*)   : [${activeMap.vertex || 'OFF'}]`,
+      `Active Profiles by tool:`,
+      `  - Claude Code (/v1/messages)  : [${activeMap.claude || 'OFF'}]`,
+      `  - Codex CLI   (/v1/responses) : [${activeMap.codex || 'OFF'}]`,
       '',
       `Available Profiles in config: ${Object.keys(cfg.profiles || {}).join(', ')}`,
       `Dashboard Web UI: http://127.0.0.1:${port}/ui`
@@ -220,7 +243,12 @@ async function handleToolCall(name, args) {
       if (res.success) {
         return { content: [{ type: 'text', text: `Successfully set ${target || 'global'} active profile to "${profile || 'OFF'}".` }] };
       }
-      return { content: [{ type: 'text', text: `Switch failed: ${res.error || 'Unknown error'}` }], isError: true };
+      // A 409 answer carries the clashing keys. Without them the agent cannot tell which two
+      // pointers of config.json disagree, and the only advice left is "go read the file".
+      const detail = Array.isArray(res.clashingKeys) && res.clashingKeys.length
+        ? ` Clashing keys: ${res.clashingKeys.join(', ')}.`
+        : '';
+      return { content: [{ type: 'text', text: `Switch failed: ${res.error || 'Unknown error'}.${detail}` }], isError: true };
     } catch (err) {
       return { content: [{ type: 'text', text: `Gateway connection failed: ${err.message}` }], isError: true };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.1.11",
+  "version": "1.2.0",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -7,21 +7,23 @@ import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import { createFrameReader } from './blindfold/wsframe.mjs';
 import {
-  OUT_FORMATS, IN_FORMATS, parseToIR, emitUpstreamBody, createUpstreamNormalizer, createCollector,
+  OUT_FORMATS, parseToIR, emitUpstreamBody, createUpstreamNormalizer, createCollector,
   createThinkTagSplitter, splitThinkTags, healAnthropicPayload, estimateTokens, THINKING_MODES,
   toGeminiSchema, isAntigravityModel,
   createAnthropicStream, createChatStream, createResponsesStream, createVertexStream,
   buildAnthropicMessage, buildChatMessage, buildResponsesMessage, buildVertexMessage
 } from './formats.mjs';
 import {
-  TARGETS, configPath, loadConfig, getConfigLoadError, saveConfig, resolvePort, hasProfile, isValidProfileKey,
+  TOOLS, configPath, loadConfig, getConfigLoadError, saveConfig, resolvePort, hasProfile, isValidProfileKey,
+  getMigrationError, getMigrationCollision,
   getActiveMap, setTargetProfile, activateProfile, deactivateProfile, deactivateAll, deleteProfile,
   isProfileActive, profileAcceptsTarget, applyLaunchState, readLaunchFlags, redactConfig, MASKED_KEY,
   modelForSlot, primaryModel, codexPublicModel, isSafeModelName, parsePort, CODEX_MODEL_SLOTS,
   ensureAdminToken, identityProof, reconcileBlindfold, checkBlindfoldTarget,
-  codexModelEntry, smallestWindows, publicModelWindows, model1MForSlot, computeLaunchState,
-  contractLabSettings
+  codexModelEntry, smallestWindows, publicModelWindows, model1MForSlot,
+  contractLabSettings, STATE_DIR
 } from './state.mjs';
+import { classifyCodexRole, classifyClaudeTier, loadCatalogCache, refreshCatalog, checkVersionAndRefresh } from './catalog.mjs';
 import { createContractLab, createHalfTap, tapClientWrites, capText, capJson, toolVersionFromUA, finishHalf, PROBE_HEADER, TRACE_ID_RE } from './contract.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -198,6 +200,9 @@ async function readJsonBody(req, limit = MAX_API_BODY_SIZE) {
 // ----------------------------------------------------
 // Profile & model resolution
 // ----------------------------------------------------
+// R5: the only two input protocols, each owned by one tool.
+const CLIENT_FORMAT_TOOL = { anthropic: 'claude', responses: 'codex' };
+
 function getActiveProfile(clientFormat, req) {
   const cfg = loadConfig();
   if (!cfg) return { cfg: null, profileKey: null, profile: null };
@@ -214,9 +219,12 @@ function getActiveProfile(clientFormat, req) {
     return { cfg, profileKey: reqProfile, profile: null, error: `Profile "${reqProfile}" requested via x-llm-profile/?profile= does not exist` };
   }
 
-  // Look up the active profile by CLI target (clientFormat: anthropic | responses | openai-chat | vertex).
-  // Deleted profile / disabled target counts as OFF, never silently fall through to another profile (different API key!).
-  const key = clientFormat ? getActiveMap(cfg)[clientFormat] : (cfg.activeProfile || null);
+  // R4: resolve by TOOL, not by the protocol the request arrived in. Only two client formats
+  // exist anymore — anthropic is Claude Code's, responses is Codex's — and each has exactly one
+  // pointer, activeProfiles.claude and activeProfiles.codex. A deleted profile or a disabled tool
+  // counts as OFF and never falls through to the other tool's profile (different API key!).
+  const key = clientFormat ? getActiveMap(cfg)[CLIENT_FORMAT_TOOL[clientFormat]] ?? null
+    : (cfg.activeProfile || null);
   if (!key || !hasProfile(cfg, key)) return { cfg, profileKey: key || null, profile: null };
   return { cfg, profileKey: key, profile: cfg.profiles[key] };
 }
@@ -266,12 +274,12 @@ function mapModel(requestedModel, profile, clientFormat) {
     // retired gpt-5.3-codex) have no credentials behind 9Router -> fail closed to the main slot
     // instead of passing through to an upstream 404. Provider-prefixed names (ag/..., cf/...)
     // are preserved by the early return above.
-    if (/^(gpt|o\d|codex)([-/]|$)/i.test(clean)) return modelForSlot(profile, 'main') || clean;
+    if (/^(gpt|o\d|codex)([-/]|$)/i.test(clean)) {
+      const autoRole = classifyCodexRole(clean);
+      return (autoRole !== 'main' ? modelForSlot(profile, autoRole) : null) || modelForSlot(profile, 'main') || clean;
+    }
     return clean || requestedModel;
   }
-  if (clientFormat === 'openai-chat' || clientFormat === 'vertex') {
-    if (m === 'default' || m === 'main' || !clean) return modelForSlot(profile, 'default') || clean;
-  }
   if (m.includes('fable')) return modelForSlot(profile, 'fable') || clean;
   if (m.includes('opus')) return modelForSlot(profile, 'opus') || clean;
   if (m.includes('haiku')) return modelForSlot(profile, 'haiku') || clean;
@@ -974,7 +982,15 @@ function validateProfileInput(p) {
   for (const k of ['name', 'baseURL', 'optimizerURL']) {
     if (typeof p[k] === 'string' && CONTROL_CHARS.test(p[k])) return `${k} must not contain control characters`;
   }
-  if (p.inFormat && p.inFormat !== 'auto' && !IN_FORMATS.includes(p.inFormat)) return `Invalid inFormat "${p.inFormat}"`;
+  // R6 / R7(c): a profile declares exactly one tool. An old-format field must never be written back.
+  if (p.inFormat !== undefined) return 'inFormat is not supported; use "tool": "claude" or "tool": "codex"';
+  if (p.blindfold !== undefined) return 'blindfold per-profile setting is deprecated';
+  if (p.blindfoldPort !== undefined) return 'blindfoldPort per-profile setting is deprecated';
+  if (p.blindfoldHost !== undefined) return 'blindfoldHost per-profile setting is deprecated';
+  if (p.blindfoldPrefix !== undefined) return 'blindfoldPrefix per-profile setting is deprecated';
+  if (p.tool !== undefined && p.tool !== null && !TOOLS.includes(p.tool)) {
+    return `Invalid tool "${p.tool}". Valid: ${TOOLS.join(', ')}`;
+  }
   if (p.outFormat && !OUT_FORMATS.includes(p.outFormat)) return `Invalid outFormat "${p.outFormat}"`;
   if (p.mode && !VALID_MODES.includes(p.mode)) return `Invalid mode "${p.mode}"`;
   if (p.thinkingMode && !THINKING_MODES.includes(p.thinkingMode)) return `Invalid thinkingMode "${p.thinkingMode}"`;
@@ -1080,7 +1096,9 @@ async function fetchModels(body, cfg) {
 
 // Vertex/Gemini: /v1beta/models/{m}:{action} (Gemini API) and
 // /v1/projects/{p}/locations/{l}/publishers/{pub}/models/{m}:{action} (Vertex AI SDK).
-const VERTEX_ROUTE = /^\/(?:v1|v1beta|v1beta1)\/(?:projects\/[^/]+\/locations\/[^/]+\/publishers\/[^/]+\/)?models\/([^/:]+):(generateContent|streamGenerateContent)$/;
+// R4/Codex: model mapping for the responses input only. Claude Code's mapping is the tier
+// substring chain at the bottom of mapModel. No alias (`main`, `opus[1m]`) ever leaves this
+// function: the `[1m]` suffix is stripped before anything is looked up.
 
 // ----------------------------------------------------
 // Router
@@ -1123,7 +1141,7 @@ async function route(req, res) {
 
   // Health check
   if (method === 'GET' && pathname === '/health') {
-    const { profileKey, profile } = getFirstActiveProfile(TARGETS, req);
+    const { profileKey, profile } = getFirstActiveProfile(['responses', 'anthropic'], req);
     // ?challenge=<nonce> lets the CLI tell this gateway from a process that replays a /health body.
     const challenge = parsedUrl.searchParams.get('challenge');
     return sendJson(res, 200, {
@@ -1151,6 +1169,7 @@ async function route(req, res) {
   // advertised: Codex sends them in-request and mapModel resolves them server-side.
   // Without publicModels, fall back to the deduplicated mapped upstream IDs.
   if (method === 'GET' && (pathname === '/v1/models' || pathname === '/models')) {
+    checkVersionAndRefresh(req.headers['anthropic-version'] ? 'claude' : 'codex', req.headers, STATE_DIR);
     const { ids, windows } = servedModels(req);
     const created = Math.floor(Date.now() / 1000);
     return sendJson(res, 200, {
@@ -1183,9 +1202,7 @@ async function route(req, res) {
     return handleCountTokens(req, res, buf);
   }
 
-  // Client endpoints, one per input protocol (auto-detected by path).
   let clientFormat = null;
-  const vmatch = method === 'POST' ? pathname.match(VERTEX_ROUTE) : null;
 
   // Codex CLI sends GET /v1/responses (and /v1/responses/{id}) to fetch model
   // metadata and retrieve previous responses.  The gateway is stateless, so
@@ -1206,18 +1223,18 @@ async function route(req, res) {
 
   if (method === 'POST') {
     if (pathname === '/v1/messages' || pathname === '/messages') clientFormat = 'anthropic';
-    else if (pathname === '/v1/chat/completions' || pathname === '/chat/completions') clientFormat = 'openai-chat';
     else if (pathname === '/v1/responses' || pathname === '/responses') clientFormat = 'responses';
-    else if (vmatch) clientFormat = 'vertex';
   }
   if (clientFormat) {
+    if (clientFormat === 'anthropic') checkVersionAndRefresh('claude', req.headers, STATE_DIR);
+    else if (clientFormat === 'responses') checkVersionAndRefresh('codex', req.headers, STATE_DIR);
     let buf;
     try {
       buf = await readBody(req, MAX_BODY_SIZE);
     } catch (err) {
       return sendClientError(res, clientFormat, err.status || 400, err.message);
     }
-    const opts = vmatch ? { vertexModel: decodeURIComponent(vmatch[1]), vertexStream: vmatch[2] === 'streamGenerateContent' } : {};
+    const opts = {};
     return handleConvert(clientFormat, req, res, buf, opts);
   }
 
@@ -1228,7 +1245,7 @@ async function route(req, res) {
 // The names /v1/models serves, and the window of each. Official names when the profile publishes
 // them, otherwise the mapped upstream IDs; each window follows model1M of its slot.
 function servedModels(req) {
-  const { profile } = getFirstActiveProfile(['responses', 'openai-chat', 'anthropic', 'vertex'], req);
+  const { profile } = getFirstActiveProfile(['responses', 'anthropic'], req);
   if (Array.isArray(profile?.publicModels) && profile.publicModels.length) {
     return { ids: [...new Set(profile.publicModels.filter(Boolean))], windows: publicModelWindows(profile) };
   }
@@ -1247,9 +1264,8 @@ async function routeApi(req, res, method, pathname) {
       activeProfile: cfg.activeProfile || null,
       activeProfiles,
       revision: configRevision(cfg),
-      claude1MTiers: computeLaunchState(cfg, PORT).claude1MTiers,
       ...readLaunchFlags(),
-      claudeBaseURL: activeProfiles.anthropic ? `http://127.0.0.1:${PORT} (injected via launcher)` : '(none / official)',
+      claudeBaseURL: activeProfiles.claude ? `http://127.0.0.1:${PORT} (injected via launcher)` : '(none / official)',
       config: redactConfig(cfg)
     });
   }
@@ -1271,6 +1287,24 @@ async function routeApi(req, res, method, pathname) {
     return sendJson(res, err.status || 400, { error: err.message });
   }
 
+  // GET /api/catalog
+  if (method === 'GET' && pathname === '/api/catalog') {
+    return sendJson(res, 200, loadCatalogCache(STATE_DIR));
+  }
+
+  // POST /api/catalog/refresh
+  if (method === 'POST' && pathname === '/api/catalog/refresh') {
+    const active = getActiveMap(requireConfig(res) || {});
+    const cfg = requireConfig(res) || {};
+    const claudeProfile = active.claude ? cfg.profiles?.[active.claude] : null;
+    const codexProfile = active.codex ? cfg.profiles?.[active.codex] : null;
+    const updated = await refreshCatalog(STATE_DIR, {
+      claudeKey: claudeProfile?.apiKey,
+      codexKey: codexProfile?.apiKey
+    });
+    return sendJson(res, 200, { success: true, catalog: updated });
+  }
+
   // POST /api/logs/clear
   if (pathname === '/api/logs/clear') {
     requestLogs.length = 0;
@@ -1292,6 +1326,12 @@ async function routeConfigApi(res, method, pathname, body) {
   }
 
   // POST /api/switch  { target?, profile? | null, deactivate? }
+  // R7: a migration collision means config.json is in a shape this build refuses to rewrite.
+  // Every route that writes it answers the same way, and the bytes on disk stay as they are.
+  if (getMigrationCollision() && ['/api/switch', '/api/toggle', '/api/save-profile', '/api/delete-profile'].includes(pathname)) {
+    return sendJson(res, 409, { error: 'Migration collision', clashingKeys: getMigrationCollision().clashingKeys });
+  }
+
   if (pathname === '/api/switch') {
     let err = null;
     if (body.deactivate) {
@@ -1313,7 +1353,7 @@ async function routeConfigApi(res, method, pathname, body) {
     const map = getActiveMap(cfg);
     let err = null;
     if (body.target) {
-      if (!TARGETS.includes(body.target)) return sendJson(res, 400, { error: `Unknown target "${body.target}"` });
+      if (!TOOLS.includes(body.target)) return sendJson(res, 400, { error: `Unknown target "${body.target}"` });
       let key = null;
       if (body.enabled) {
         const candidates = [map[body.target], cfg.activeProfile, ...Object.keys(cfg.profiles)];
@@ -1361,7 +1401,7 @@ async function routeConfigApi(res, method, pathname, body) {
     const map = getActiveMap(cfg);
     cfg.activeProfiles = map;
     let unassigned = false;
-    for (const t of TARGETS) {
+    for (const t of TOOLS) {
       if (map[t] === key && !profileAcceptsTarget(merged, t)) {
         map[t] = null;
         unassigned = true;
@@ -1369,7 +1409,16 @@ async function routeConfigApi(res, method, pathname, body) {
     }
 
     // Profile is active (or was just unassigned from a target) -> refresh 1M flags / env files.
-    const applied = isProfileActive(cfg, key) || unassigned ? await commit(cfg, baseRevision) : (saveConfig(cfg), { revision: configRevision(cfg) });
+    let applied;
+    try {
+      applied = isProfileActive(cfg, key) || unassigned ? await commit(cfg, baseRevision) : (saveConfig(cfg), { revision: configRevision(cfg) });
+    } catch (err) {
+      // saveConfig refuses while a migration collision or migration error blocks writes (R7).
+      if (getMigrationError() || getMigrationCollision()) {
+        return sendJson(res, 409, { error: err.message });
+      }
+      throw err;
+    }
     return sendJson(res, applied.status || (applied.success === false ? 502 : 200), { success: true, ...applied });
   }
 
@@ -1677,6 +1726,8 @@ server.on('upgrade', (req, socket) => {
     return;
   }
 
+  checkVersionAndRefresh('codex', req.headers, STATE_DIR);
+
   const key = req.headers['sec-websocket-key'];
   if (!key) {
     socket.destroy();
@@ -1788,12 +1839,26 @@ server.on('error', (err) => {
 if (!loadConfig()) {
   console.warn(`[llm-switcher:WARN] Could not load ${configPath}: ${getConfigLoadError()?.message}. Copy config.example.json to config.json.`);
 }
+// R7: a migration that could not complete blocks every write. Say so at startup instead of
+// failing later, on the first save, with an error nobody connects back to this.
+if (getMigrationError()) {
+  console.error(`[llm-switcher:ERROR] ${getMigrationError().message}`);
+}
+if (getMigrationCollision()) {
+  console.error(`[llm-switcher:ERROR] Configuration migration collision: ${JSON.stringify(getMigrationCollision().clashingKeys)}. Fix config.json; it is not being rewritten.`);
+}
 
 server.listen(PORT, '127.0.0.1', () => {
   // A service start or a restart on a new port finds env-codex.* already pointing at the interceptor.
   const cfg = loadConfig();
-  if (cfg && !getConfigLoadError()) serialized(() => reconcile(cfg));
+  if (getMigrationCollision()) {
+    console.error('[llm-switcher] Skipping reconcile: a configuration migration collision blocks writes.');
+  } else if (cfg && !getConfigLoadError()) {
+    serialized(() => reconcile(cfg));
+  }
   console.log(`[llm-switcher] Server running on http://127.0.0.1:${PORT}`);
   console.log(`[llm-switcher] Web UI available at: http://127.0.0.1:${PORT}/ui`);
-  console.log(`[llm-switcher] Endpoints: /v1/messages (anthropic) | /v1/chat/completions (openai) | /v1/responses (codex) | /v1beta/models/* (vertex)`);
+  console.log(`[llm-switcher] Endpoints: /v1/messages (Claude Code) | /v1/responses (Codex)`);
+  // Asynchronously discover latest tool models in the background without blocking startup
+  refreshCatalog(STATE_DIR).catch(() => {});
 });