llm-switcher 1.2.11 → 1.3.0

package/proxy.mjs

@@ -1,9 +1,11 @@
 import http from 'node:http';
+import https from 'node:https';
 import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
 import { promisify } from 'node:util';
+import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { createFrameReader } from './blindfold/wsframe.mjs';
 import {
@@ -11,7 +13,8 @@ import {
   createThinkTagSplitter, splitThinkTags, healAnthropicPayload, estimateTokens, THINKING_MODES,
   toGeminiSchema, isAntigravityModel,
   createAnthropicStream, createChatStream, createResponsesStream, createVertexStream,
-  buildAnthropicMessage, buildChatMessage, buildResponsesMessage, buildVertexMessage
+  buildAnthropicMessage, buildChatMessage, buildResponsesMessage, buildVertexMessage,
+  createCodeAssistStream, buildCodeAssistMessage
 } from './formats.mjs';
 import {
   TOOLS, configPath, loadConfig, getConfigLoadError, saveConfig, resolvePort, hasProfile, isValidProfileKey,
@@ -21,10 +24,11 @@ import {
   modelForSlot, primaryModel, codexPublicModel, isSafeModelName, parsePort, CODEX_MODEL_SLOTS,
   ensureAdminToken, identityProof, reconcileBlindfold, checkBlindfoldTarget,
   codexModelEntry, smallestWindows, publicModelWindows, model1MForSlot,
-  contractLabSettings, STATE_DIR
+  contractLabSettings, STATE_DIR, stopRecordedBlindfold
 } from './state.mjs';
 import { classifyCodexRole, classifyClaudeTier, syncLocalCatalog, refreshCatalog, checkVersionAndRefresh } from './catalog.mjs';
 import { checkForUpdate } from './version.mjs';
+import { applyUpdate } from './update.mjs';
 import { createContractLab, createHalfTap, tapClientWrites, capText, capJson, toolVersionFromUA, finishHalf, PROBE_HEADER, TRACE_ID_RE } from './contract.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -46,6 +50,7 @@ if (missingNoProxy.length > 0) {
 // Fixed port for the process lifetime: changing "port" in config.json at runtime has no effect
 // env.cmd / flags would point at a port the server is not listening on.
 const PORT = resolvePort();
+let updateInProgress = false;
 
 // In-memory Request / Response Inspector Ring Buffer (up to 40 most recent requests)
 const requestLogs = [];
@@ -201,8 +206,8 @@ async function readJsonBody(req, limit = MAX_API_BODY_SIZE) {
 // ----------------------------------------------------
 // Profile & model resolution
 // ----------------------------------------------------
-// R5: the only two input protocols, each owned by one tool.
-const CLIENT_FORMAT_TOOL = { anthropic: 'claude', responses: 'codex' };
+// R5: one input protocol per tool. codeassist is the Antigravity CLI (agy).
+const CLIENT_FORMAT_TOOL = { anthropic: 'claude', responses: 'codex', codeassist: 'agy' };
 
 function getActiveProfile(clientFormat, req) {
   const cfg = loadConfig();
@@ -246,6 +251,15 @@ function getFirstActiveProfile(preferred, req) {
 // clientFormat is the protocol the request arrived in. An `auto` profile serves every protocol,
 // so the profile's inFormat cannot tell a Codex request from a Claude one.
 function mapModel(requestedModel, profile, clientFormat) {
+  if (clientFormat === 'codeassist') {
+    // agy picks a model per call (gemini-3.8-flash-high). The main slot names the upstream model;
+    // '*' in it stands for that pick, so antigravity/* keeps agy's choice on an intact pool.
+    const slot = modelForSlot(profile, 'main');
+    if (!slot) return requestedModel || '';
+    if (!slot.includes('*')) return slot;
+    // A function replacer: a model name with $& or $1 in it must not expand.
+    return requestedModel ? slot.replace('*', () => requestedModel) : '';
+  }
   if (!requestedModel) return primaryModel(profile);
   const clean = requestedModel.replace(/\[1m\]/gi, '').trim();
   // If the client specified a model with a provider prefix (e.g. ag/..., gh/..., cf/...), keep it as-is
@@ -344,7 +358,7 @@ function sendClientError(res, clientFormat, status, message, headers = {}) {
   let body;
   if (clientFormat === 'anthropic') {
     body = { type: 'error', error: { type: anthropicErrorType(status), message } };
-  } else if (clientFormat === 'vertex') {
+  } else if (clientFormat === 'vertex' || clientFormat === 'codeassist') {
     body = { error: { code: status, message, status: vertexStatus(status) } };
   } else {
     body = { error: { message, type: status >= 500 ? 'server_error' : 'invalid_request_error', code: String(status) } };
@@ -475,6 +489,7 @@ function clientRenderer(clientFormat, res, model, opts = {}) {
   if (clientFormat === 'anthropic') return createAnthropicStream((e, d) => sendSSE(res, e, d), model);
   if (clientFormat === 'responses') return createResponsesStream((e, d) => sendSSE(res, e, d), model, opts);
   if (clientFormat === 'vertex') return createVertexStream((e, d) => sendSSE(res, null, d), model);
+  if (clientFormat === 'codeassist') return createCodeAssistStream((e, d) => sendSSE(res, null, d), model);
   return createChatStream((e, d) => sendSSE(res, null, d), model);
 }
 
@@ -482,6 +497,7 @@ function clientMessage(clientFormat, args) {
   if (clientFormat === 'anthropic') return buildAnthropicMessage(args);
   if (clientFormat === 'responses') return buildResponsesMessage(args);
   if (clientFormat === 'vertex') return buildVertexMessage(args);
+  if (clientFormat === 'codeassist') return buildCodeAssistMessage(args);
   return buildChatMessage(args);
 }
 
@@ -503,6 +519,11 @@ const HOP_BY_HOP = new Set(['content-length', 'content-encoding', 'transfer-enco
 // Bifrost: intact names, per model, the User-Agent prefix of the provider's own client (bifrost_ua).
 // When the caller is that client, the request crosses as it is: only the key changes.
 const bifrostUACache = new Map();
+// A failed lookup holds the convert route only this long, so a short intact outage does not pin it.
+const BIFROST_RETRY_MS = (() => {
+  const v = Number(process.env.LLM_SWITCHER_BIFROST_RETRY_MS);
+  return Number.isFinite(v) && v >= 0 ? v : 30000;
+})();
 async function bifrostUAFor(profile, model) {
   const base = String(profile.baseURL || '').replace(/\/+$/, '');
   if (!base || !model) return '';
@@ -510,16 +531,20 @@ async function bifrostUAFor(profile, model) {
   const hit = bifrostUACache.get(key);
   if (hit && hit.until > Date.now()) return hit.ua;
   let ua = '';
-  let ttl = 10 * 60 * 1000;
+  let failure = '';
   try {
     const r = await fetch(`${base}/models/${model.split('/').map(encodeURIComponent).join('/')}`, {
       headers: { authorization: `Bearer ${profile.apiKey || ''}` }, signal: AbortSignal.timeout(3000)
     });
+    // Only a 2xx is an answer. A 404 can be an intact older than 0.1.14 or a wrong baseURL.
     if (r.ok) ua = String((await r.json())?.bifrost_ua || '');
-  } catch {
-    ttl = 30 * 1000; // an unreachable list must not pin the decision for long
+    else failure = `HTTP ${r.status}`;
+  } catch (err) {
+    failure = err.message;
   }
-  bifrostUACache.set(key, { ua, until: Date.now() + ttl });
+  // One line per failure streak, not one per retry.
+  if (failure && !hit?.failed) console.warn(`[llm-switcher] Bifrost lookup of "${model}" at ${base} failed (${failure}); the convert route serves it, retry in ${BIFROST_RETRY_MS} ms`);
+  bifrostUACache.set(key, { ua, failed: Boolean(failure), until: Date.now() + (failure ? BIFROST_RETRY_MS : 10 * 60 * 1000) });
   return ua;
 }
 
@@ -542,6 +567,15 @@ function bifrostHeaders(req, profile) {
   return headers;
 }
 
+// The client formats a provider's own CLI speaks, and where Bifrost sends each one on intact.
+const BIFROST_FORMATS = new Set(['anthropic', 'responses', 'codeassist']);
+function bifrostURL(profile, clientFormat, req, opts = {}) {
+  const base = String(profile.baseURL || '').replace(/\/+$/, '');
+  if (clientFormat === 'responses') return withClientQuery(`${base}/responses`, req);
+  if (clientFormat === 'codeassist') return withClientQuery(`${base}/v1internal:${opts.codeAssistAction}`, req);
+  return withClientQuery(upstreamEndpoint(profile, 'anthropic', '', false, req).url, req);
+}
+
 function withClientQuery(url, req) {
   const q = String(req.url || '').indexOf('?');
   return q < 0 ? url : url + (url.includes('?') ? '&' : '?') + req.url.slice(q + 1);
@@ -602,7 +636,9 @@ async function forwardAnthropicDirect(res, payload, bodyBuffer, url, headers, ma
       streamError = `stream interrupted: ${streamErr.cause?.message || streamErr.message}`;
     }
   } finally {
-    res.end();
+    // A cut stream must not reach the client as a whole answer.
+    if (streamError && !signal.aborted) res.destroy();
+    else res.end();
   }
   const error = streamError || (upstreamRes.ok ? null : errorPreview.slice(0, 300));
   return { status, error, healed: healed.notes, tokens: usage.tokens() };
@@ -619,13 +655,16 @@ function createUsageTap(limit = 4 * 1024 * 1024) {
     if (!u || typeof u !== 'object') return;
     if (typeof u.input_tokens === 'number') tokens.prompt = u.input_tokens + (u.cache_read_input_tokens || 0) + (u.cache_creation_input_tokens || 0);
     if (typeof u.output_tokens === 'number') tokens.completion = u.output_tokens;
+    // Gemini (Code Assist): thought tokens are billed as output.
+    if (typeof u.promptTokenCount === 'number') tokens.prompt = u.promptTokenCount;
+    if (typeof u.candidatesTokenCount === 'number') tokens.completion = u.candidatesTokenCount + (u.thoughtsTokenCount || 0);
   };
   const line = (l) => {
     const t = l.startsWith('data:') ? l.slice(5).trim() : '';
-    if (!t.includes('"usage"')) return;
+    if (!t.includes('"usage"') && !t.includes('"usageMetadata"')) return;
     try {
       const d = JSON.parse(t);
-      take(d.message?.usage || d.usage);
+      take(d.message?.usage || d.usage || d.response?.usage || d.response?.usageMetadata || d.usageMetadata);
     } catch {}
   };
   return {
@@ -640,7 +679,10 @@ function createUsageTap(limit = 4 * 1024 * 1024) {
     tokens() {
       text += decoder.decode();
       if (text.trim().startsWith('{')) {
-        try { take(JSON.parse(text).usage); } catch {}
+        try {
+          const j = JSON.parse(text);
+          take(j.usage || j.response?.usageMetadata || j.usageMetadata);
+        } catch {}
       } else if (text) line(text);
       return tokens;
     }
@@ -770,12 +812,18 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
     ir.stream = Boolean(opts.vertexStream);
     if (!ir.model && opts.vertexModel) ir.model = opts.vertexModel;
   }
+  // Code Assist names streaming in the path (:streamGenerateContent), not in the body.
+  if (clientFormat === 'codeassist') ir.stream = Boolean(opts.codeAssistStream);
 
   const reqStartTime = Date.now();
   const requestPreview = previewOf(ir);
   const requestedModel = ir.model || payload.model || '';
   const mappedModel = mapModel(requestedModel, profile, clientFormat);
-  const bifrost = clientFormat === 'anthropic' && await crossesBifrost(req, profile, mappedModel);
+  if (clientFormat === 'codeassist' && !mappedModel) {
+    sendClientError(res, clientFormat, 400, 'The request names no model, and the main slot of the agy profile needs one (*).');
+    return;
+  }
+  const bifrost = BIFROST_FORMATS.has(clientFormat) && await crossesBifrost(req, profile, mappedModel);
   const outFormat = resolveOutFormat(profile, mappedModel);
   const route = bifrost ? 'bifrost' : outFormat;
   console.log(`[llm-switcher] ${clientFormat} -> ${route} "${requestedModel}" -> "${mappedModel}" [${profile.name || profileKey}]`);
@@ -785,7 +833,9 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
 
   // Contract lab: a sampled request carries a trace id to intact, and the bytes this gateway
   // writes back are copied for the upload that follows the answer.
-  const traceId = probeTraceId(req) || contractLab.traceFor(mappedModel);
+  // The contract lab compares converters of the Claude Code and Codex shapes; it has no reducer for
+  // the Code Assist shape, so an agy exchange is never sampled.
+  const traceId = clientFormat === 'codeassist' ? null : (probeTraceId(req) || contractLab.traceFor(mappedModel));
   const halfTap = traceId ? createHalfTap() : null;
   if (halfTap) tapClientWrites(res, halfTap);
 
@@ -804,11 +854,11 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
     // Bifrost: the provider's own client reaching its own account through intact. Bytes and headers
     // go as sent, only the key changes: no healer, no thinkingMode, no conversion.
     if (bifrost) {
-      const { url } = upstreamEndpoint(profile, 'anthropic', mappedModel, ir.stream, req);
+      // bifrostHeaders drops the client's own Authorization: agy's Google token never reaches intact.
       const headers = bifrostHeaders(req, profile);
       if (traceId) headers['x-intact-trace'] = traceId;
       try {
-        const r = await forwardAnthropicDirect(res, payload, bodyBuffer, withClientQuery(url, req), headers, mappedModel, ac.signal, profile, true);
+        const r = await forwardAnthropicDirect(res, payload, bodyBuffer, bifrostURL(profile, clientFormat, req, opts), headers, mappedModel, ac.signal, profile, true);
         answered = !r.error && r.status >= 200 && r.status < 300;
         log({ status: r.status, tokens: r.tokens, responsePreview: '(bifrost)', error: r.error || undefined });
       } catch (err) {
@@ -938,7 +988,7 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
         toolResponse: halfTap?.text() || '',
         toolVersion: toolVersionFromUA(req.headers['user-agent']),
         inFormat: clientFormat,
-        outFormat: bifrost ? 'anthropic' : outFormat, // Bifrost converts nothing
+        outFormat: bifrost ? clientFormat : outFormat, // Bifrost converts nothing
         openerKey: profile.apiKey || ''
       });
     }
@@ -1055,7 +1105,7 @@ function validateProfileInput(p) {
     if (typeof p[k] === 'string' && CONTROL_CHARS.test(p[k])) return `${k} must not contain control characters`;
   }
   // R6 / R7(c): a profile declares exactly one tool. An old-format field must never be written back.
-  if (p.inFormat !== undefined) return 'inFormat is not supported; use "tool": "claude" or "tool": "codex"';
+  if (p.inFormat !== undefined) return 'inFormat is not supported; use "tool": "claude", "codex" or "agy"';
   if (p.blindfold !== undefined) return 'blindfold per-profile setting is deprecated';
   if (p.blindfoldPort !== undefined) return 'blindfoldPort per-profile setting is deprecated';
   if (p.blindfoldHost !== undefined) return 'blindfoldHost per-profile setting is deprecated';
@@ -1312,6 +1362,9 @@ async function route(req, res) {
     return handleCountTokens(req, res, buf);
   }
 
+  // The Antigravity CLI (agy): CLOUD_CODE_URL points every Code Assist call at this gateway.
+  if (pathname.startsWith('/v1internal:')) return routeCodeAssist(req, res, method, pathname);
+
   let clientFormat = null;
 
   // Codex CLI sends GET /v1/responses (and /v1/responses/{id}) to fetch model
@@ -1352,6 +1405,93 @@ async function route(req, res) {
   return sendJson(res, 404, { error: { message: `Not found: ${method} ${pathname}` } });
 }
 
+// ----------------------------------------------------
+// Antigravity CLI (agy)
+// ----------------------------------------------------
+// Only the agent turns of agy go through its profile. Every other Code Assist call (sign-in state,
+// model list, quota, experiments, analytics) and the checkpoint summaries stay on the person's own
+// Google account, exactly as without the switcher.
+const CODE_ASSIST_URL = (process.env.LLM_SWITCHER_CODE_ASSIST_URL || 'https://daily-cloudcode-pa.googleapis.com').replace(/\/+$/, '');
+const CODE_ASSIST_MODEL_CALLS = new Set(['streamGenerateContent', 'generateContent']);
+// Idle time on a passthrough, not its total time: a checkpoint stream may think for a while. Node
+// runs a delay outside 1..2147483647 ms as 1 ms, so a value outside 1 s..max falls back to 5 min.
+const CODE_ASSIST_IDLE_MS = (() => {
+  const v = Number(process.env.LLM_SWITCHER_CODE_ASSIST_TIMEOUT_MS);
+  return Number.isFinite(v) && v >= 1000 && v <= 2147483647 ? v : 300000;
+})();
+
+async function routeCodeAssist(req, res, method, pathname) {
+  const action = pathname.slice('/v1internal:'.length);
+  if (method !== 'POST' || !CODE_ASSIST_MODEL_CALLS.has(action)) return passthroughCodeAssist(req, res, null);
+  let buf;
+  try {
+    buf = await readBody(req, MAX_BODY_SIZE);
+  } catch (err) {
+    return sendClientError(res, 'codeassist', err.status || 400, err.message);
+  }
+  // Without a config the gateway cannot tell whether agy is routed, so it must not guess Google.
+  if (!loadConfig()) return sendClientError(res, 'codeassist', 503, `The gateway has no readable config (${configPath}).`);
+  const { profile, error } = getActiveProfile('codeassist', req);
+  if (error) return sendClientError(res, 'codeassist', 400, error);
+  if (!profile) return passthroughCodeAssist(req, res, buf);
+  let envelope;
+  try {
+    envelope = JSON.parse(buf.toString('utf8'));
+  } catch (err) {
+    return sendClientError(res, 'codeassist', 400, `Cannot parse the Code Assist request: ${err.message}`);
+  }
+  if (envelope?.requestType !== 'agent') return passthroughCodeAssist(req, res, buf);
+  return handleConvert('codeassist', req, res, buf, { codeAssistAction: action, codeAssistStream: action === 'streamGenerateContent' });
+}
+
+// Headers that belong to this gateway or to a proxy in front of it. Everything else agy sends,
+// x-goog-* included, is meant for Google.
+const GATEWAY_ONLY_HEADERS = new Set([
+  'x-profile', 'x-llm-profile', 'x-llm-switcher-token', PROBE_HEADER, 'x-intact-trace', 'proxy-authorization', 'x-real-ip'
+]);
+const isGatewayOnlyHeader = (lk) => GATEWAY_ONLY_HEADERS.has(lk) || lk.startsWith('x-forwarded-');
+
+// The one place where a client credential leaves this gateway on purpose: agy's own Google token
+// goes back to Google, the host it was issued for. It never reaches the Bifrost or convert paths,
+// which build their own headers. The bytes stream both ways unread (an analytics call is 100 KB+).
+function passthroughCodeAssist(req, res, body) {
+  const target = new URL(`${CODE_ASSIST_URL}${req.url}`);
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    const lk = k.toLowerCase();
+    if (lk === 'host' || lk === 'connection' || lk === 'keep-alive' || lk === 'proxy-connection' || isGatewayOnlyHeader(lk)) continue;
+    headers[lk] = v;
+  }
+  if (body) {
+    delete headers['transfer-encoding'];
+    headers['content-length'] = String(body.length);
+  }
+  const transport = target.protocol === 'http:' ? http : https;
+  // One outcome per call: the first of a timeout, an upstream error or a broken answer decides it.
+  // Before the headers agy gets a Code Assist error; after them a half answer must not look whole,
+  // so the connection is cut.
+  let settled = false;
+  const fail = (status, message) => {
+    if (settled) return;
+    settled = true;
+    if (!res.headersSent) sendClientError(res, 'codeassist', status, message);
+    else res.destroy();
+    up.destroy();
+  };
+  const up = transport.request(target, { method: req.method, headers }, (ur) => {
+    res.writeHead(ur.statusCode || 502, ur.headers);
+    ur.on('aborted', () => fail(502, 'Code Assist closed the answer early'));
+    ur.on('error', (err) => fail(502, `Code Assist answer failed: ${err.message}`));
+    ur.on('end', () => { settled = true; });
+    ur.pipe(res);
+  });
+  up.setTimeout(CODE_ASSIST_IDLE_MS, () => fail(504, `Code Assist did not answer within ${CODE_ASSIST_IDLE_MS} ms`));
+  up.on('error', (err) => fail(502, `Cannot reach Code Assist: ${err.message}`));
+  res.on('close', () => { if (!res.writableEnded) up.destroy(); });
+  if (body) up.end(body);
+  else req.pipe(up);
+}
+
 // The names /v1/models serves, and the window of each. Official names when the profile publishes
 // them, otherwise the mapped upstream IDs; each window follows model1M of its slot.
 function servedModels(req) {
@@ -1416,6 +1556,28 @@ async function routeApi(req, res, method, pathname) {
     return sendJson(res, 200, { success: true, catalog: updated });
   }
 
+  // POST /api/update: progress as SSE; after a successful update the gateway hands over to the new code.
+  if (pathname === '/api/update') {
+    if (updateInProgress) return sendJson(res, 409, { error: 'An update is already in progress' });
+    updateInProgress = true;
+    res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'X-Accel-Buffering': 'no' });
+    let result = null;
+    try {
+      result = await applyUpdate({ logger: (text) => sendSSE(res, 'log', { text }) });
+      sendSSE(res, 'result', result);
+    } catch (err) {
+      sendSSE(res, 'error', { message: err.message });
+    }
+    res.end();
+    if (result?.updated) {
+      console.log(`[llm-switcher:update] v${result.from} -> v${result.to}. Handing over to the new code.`);
+      handOver();
+    } else {
+      updateInProgress = false;
+    }
+    return;
+  }
+
   // POST /api/logs/clear
   if (pathname === '/api/logs/clear') {
     requestLogs.length = 0;
@@ -1969,7 +2131,36 @@ if (getMigrationCollision()) {
   console.error(`[llm-switcher:ERROR] Configuration migration collision: ${JSON.stringify(getMigrationCollision().clashingKeys)}. Fix config.json; it is not being rewritten.`);
 }
 
-server.listen(PORT, '127.0.0.1', () => {
+// The new code starts as a child that binds the port as soon as this listener closes. This process
+// finishes its open streams and then waits as the parent, so a service manager keeps the pid it
+// started, and `switch off` still stops the gateway by the pid that listens.
+async function handOver() {
+  server.close();
+  server.closeIdleConnections?.();
+  // The new gateway starts its own interceptor, so new interceptor code runs too.
+  await stopRecordedBlindfold().catch(() => {});
+  const args = process.argv.slice(2).filter(a => a !== '--autoupdate');
+  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), ...args], { stdio: 'inherit', windowsHide: true });
+  child.on('exit', (code) => process.exit(code ?? 1));
+  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { child.kill(sig); process.exit(0); });
+}
+
+// --autoupdate is on the service command line: each logon starts the newest release.
+let handedOver = false;
+if (process.argv.includes('--autoupdate')) {
+  try {
+    const r = await applyUpdate({ logger: (msg) => console.log(`[llm-switcher:autoupdate] ${msg}`) });
+    console.log(`[llm-switcher:autoupdate] ${r.reason}`);
+    if (r.updated) {
+      handedOver = true;
+      await handOver();
+    }
+  } catch (err) {
+    console.warn(`[llm-switcher:autoupdate] ${err.message} Starting the installed version.`);
+  }
+}
+
+if (!handedOver) server.listen(PORT, '127.0.0.1', () => {
   // A service start or a restart on a new port finds env-codex.* already pointing at the interceptor.
   const cfg = loadConfig();
   if (getMigrationCollision()) {

package/service.mjs

@@ -14,13 +14,14 @@ export function serviceEnv(env = process.env) {
 const xmlEscape = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 const systemdQuote = (s) => `"${String(s).replace(/(["\\])/g, '\\$1')}"`;
 
-export function systemdUnit({ nodeBin, script, port, env = [] }) {
+export function systemdUnit({ nodeBin, script, port, env = [], autoupdate = false }) {
+  const args = autoupdate ? `${systemdQuote(script)} --port ${port} --autoupdate` : `${systemdQuote(script)} --port ${port}`;
   return `[Unit]
 Description=LLM Switcher Local Gateway
 After=network.target
 
 [Service]
-ExecStart=${systemdQuote(nodeBin)} ${systemdQuote(script)} --port ${port}
+ExecStart=${systemdQuote(nodeBin)} ${args}
 ${env.map(([k, v]) => `Environment=${systemdQuote(`${k}=${v}`)}\n`).join('')}Restart=always
 
 [Install]
@@ -28,7 +29,7 @@ WantedBy=default.target
 `;
 }
 
-export function launchdPlist({ nodeBin, script, port, logPath, env = [] }) {
+export function launchdPlist({ nodeBin, script, port, logPath, env = [], autoupdate = false }) {
   const envBlock = env.length
     ? `  <key>EnvironmentVariables</key>
   <dict>
@@ -48,7 +49,7 @@ ${env.map(([k, v]) => `    <key>${xmlEscape(k)}</key>\n    <string>${xmlEscape(v
     <string>${xmlEscape(script)}</string>
     <string>--port</string>
     <string>${port}</string>
-  </array>
+${autoupdate ? '    <string>--autoupdate</string>\n' : ''}  </array>
 ${envBlock}  <key>StandardOutPath</key>
   <string>${xmlEscape(logPath)}</string>
   <key>StandardErrorPath</key>
@@ -65,7 +66,8 @@ ${envBlock}  <key>StandardOutPath</key>
 // Task Scheduler reads the command and its arguments from two elements, so no path goes through
 // the quoting rules of a /TR command line. A task made with /TR also stops after 72 hours by
 // default; PT0S removes that limit.
-export function scheduledTaskXml({ nodeBin, script, port, userId }) {
+export function scheduledTaskXml({ nodeBin, script, port, userId, autoupdate = false }) {
+  const args = autoupdate ? `"${script}" --port ${port} --autoupdate` : `"${script}" --port ${port}`;
   return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
@@ -94,7 +96,7 @@ export function scheduledTaskXml({ nodeBin, script, port, userId }) {
   <Actions Context="Author">
     <Exec>
       <Command>${xmlEscape(nodeBin)}</Command>
-      <Arguments>${xmlEscape(`"${script}" --port ${port}`)}</Arguments>
+      <Arguments>${xmlEscape(args)}</Arguments>
     </Exec>
   </Actions>
 </Task>
@@ -115,6 +117,10 @@ export function portFromServiceText(text) {
   return Number.isInteger(n) && n > 0 && n <= 65535 ? n : null;
 }
 
+export function autoupdateFromServiceText(text) {
+  return /--autoupdate\b/.test(String(text));
+}
+
 /** Writes a service definition. Returns the backup path when it replaced different content. */
 export function writeServiceFile(file, content) {
   fs.mkdirSync(path.dirname(file), { recursive: true });

package/shim.mjs

@@ -37,18 +37,24 @@ export const SHIM_DIR = path.join(os.homedir(), '.llm-switcher', 'bin');
 // space in the checkout into %20, which cmd.exe then reads as the (undefined) argument %2.
 const STATE_HELPER = path.join(path.dirname(fileURLToPath(import.meta.url)), 'ensure-ca-bundle.mjs');
 const ROUTE_NOTIFIER = path.join(path.dirname(fileURLToPath(import.meta.url)), 'notify-route.ps1');
+// agy sends its Google token in clear text to CLOUD_CODE_URL. Its shim asks this helper for the
+// gateway's identity proof first, so a process that took the port never receives the token.
+const GATEWAY_CHECK = path.join(path.dirname(fileURLToPath(import.meta.url)), 'verify-gateway.mjs');
 
-// CLIs to wrap. `claude` is the most important case (--resume), codex included for completeness.
-export const SHIMMED = ['claude', 'codex'];
+// CLIs to wrap. `claude` is the most important case (--resume); codex and agy have their own files.
+export const SHIMMED = ['claude', 'codex', 'agy'];
 
 // One tool, one env file. Sourcing the shared one is how one tool used to capture the other.
-const envFileOf = (name) => (name === 'codex' ? 'env-codex.sh' : 'env-claude.sh');
-const routeFileOf = (name) => (name === 'codex' ? 'route-codex.txt' : 'route-claude.txt');
+const envFileOf = (name) => `env-${SHIMMED.includes(name) ? name : 'claude'}.sh`;
+const routeFileOf = (name) => `route-${SHIMMED.includes(name) ? name : 'claude'}.txt`;
+// Only Claude Code trusts the interceptor through NODE_EXTRA_CA_CERTS. Codex takes its CA from its
+// env file, and agy reaches the gateway over plain http.
+const needsCaBlock = (name) => name === 'claude';
 
 const POSIX_TEMPLATE = (name) => {
   const envFile = envFileOf(name);
   const routeFile = routeFileOf(name);
-  const caBlock = name === 'codex' ? '' : `
+  const caBlock = !needsCaBlock(name) ? '' : `
 # R2: one bundle holds the user's own CA and the switcher CA, so trusting the interceptor never
 # costs a certificate the user already had. Decided here, at launch, because only now is it known
 # whether the user brought one — and never while this tool is off.
@@ -87,7 +93,14 @@ if [ -O "$SWITCHER_DIR" ] && [ -O "$SWITCHER_DIR/${envFile}" ] && [ -f "$SWITCHE
 else
   TOOL_ACTIVE=0
 fi
-
+${name !== 'agy' ? '' : `
+# The gateway proves itself before agy's token goes to it; any doubt keeps agy on its official endpoint.
+if [ "$TOOL_ACTIVE" = "1" ] && ! node "${GATEWAY_CHECK}" "\${CLOUD_CODE_URL:-}" >/dev/null 2>&1; then
+  printf '[llm-switcher] the gateway at %s did not prove it is this switcher; agy uses its official endpoint.\\n' "\${CLOUD_CODE_URL:-}" >&2
+  unset CLOUD_CODE_URL
+  TOOL_ACTIVE=0
+fi
+`}
 # Nothing on screen tells the person that the switcher took this tool's traffic, so say it once,
 # here. Only while THIS tool is routed: an empty route file means the tool is off, so the tool
 # reaches its official endpoint and there is nothing to warn about.
@@ -122,6 +135,14 @@ if [ -n "$_u" ]; then
     *" \${_u#http://} "*) unset OPENAI_BASE_URL ;;
   esac
 fi
+# agy's gateway address is the switcher's own value. While agy is off, a value left in this shell
+# from an earlier run must not keep sending agy to the gateway.
+_u="\${CLOUD_CODE_URL:-}"
+if [ "$TOOL_ACTIVE" != "1" ] && [ -n "$_u" ]; then
+  case " $SWITCHER_URLS " in
+    *" \${_u#http://} "*) unset CLOUD_CODE_URL ;;
+  esac
+fi
 
 # The suffix the old switcher forced on every tier. Nothing else matches: the user's own
 # ANTHROPIC_MODEL=opus, or a real model id, is theirs.
@@ -178,7 +199,7 @@ exec "$REAL" "$@"
 const WINDOWS_TEMPLATE = (name) => {
   const envFile = envFileOf(name).replace(/\.sh$/, '.cmd');
   const routeFile = routeFileOf(name);
-  const caBlock = name === 'codex' ? '' : `
+  const caBlock = !needsCaBlock(name) ? '' : `
 REM R2: one bundle holds the user's own CA and the switcher CA, so trusting the interceptor
 REM never costs a certificate the user already had. Decided here, at launch, because only now
 REM is it known whether the user brought one - and never while this tool is off.
@@ -198,7 +219,7 @@ set "NODE_EXTRA_CA_CERTS=%CA_BUNDLE%"
 REM Auto-generated by LLM Switcher - DO NOT EDIT.
 setlocal
 set "SWITCHER_DIR=${STATE_DIR}"
-${name === 'codex' ? '' : `set "STATE_HELPER=${STATE_HELPER}"
+${!needsCaBlock(name) ? '' : `set "STATE_HELPER=${STATE_HELPER}"
 
 REM Captured BEFORE the tool's env file runs: the CA decision must see the value this shell
 REM already had, not one this run is about to write.
@@ -212,7 +233,10 @@ if exist "%SWITCHER_DIR%\\active.flag" if exist "%SWITCHER_DIR%\\${envFile}" (
   for %%A in ("%SWITCHER_DIR%\\${envFile}") do if %%~zA GTR 0 set "TOOL_ACTIVE=1"
 )
 if "%TOOL_ACTIVE%"=="1" call "%SWITCHER_DIR%\\${envFile}"
-
+${name !== 'agy' ? '' : `
+REM The gateway proves itself before agy's token goes to it; any doubt keeps agy on its official endpoint.
+if "%TOOL_ACTIVE%"=="1" call :CHECK_GATEWAY
+`}
 REM Nothing on screen tells the person that the switcher took this tool's traffic, and both TUIs
 REM can claim the whole screen, so a printed line would be hidden. A toast is not. It is detached:
 REM the tool never waits for it. Only while THIS tool is routed (%TOOL_ACTIVE%).
@@ -225,6 +249,8 @@ if exist "%SWITCHER_DIR%\\gateway.port" for /f "usebackq delims=" %%P in ("%SWIT
 if not defined _GWPORT set "_GWPORT=3456"
 if defined ANTHROPIC_BASE_URL call :SCRUB_URL ANTHROPIC_BASE_URL "%ANTHROPIC_BASE_URL%"
 if defined OPENAI_BASE_URL call :SCRUB_URL OPENAI_BASE_URL "%OPENAI_BASE_URL%"
+REM agy's gateway address is the switcher's own value: scrubbed only while agy is off.
+if not "%TOOL_ACTIVE%"=="1" if defined CLOUD_CODE_URL call :SCRUB_URL CLOUD_CODE_URL "%CLOUD_CODE_URL%"
 if /i "%ANTHROPIC_MODEL%"=="opus[1m]" set "ANTHROPIC_MODEL="
 if /i "%ANTHROPIC_MODEL%"=="sonnet[1m]" set "ANTHROPIC_MODEL="
 if /i "%ANTHROPIC_MODEL%"=="haiku[1m]" set "ANTHROPIC_MODEL="
@@ -281,7 +307,16 @@ REM another tier (ANTHROPIC_DEFAULT_OPUS_MODEL=sonnet[1m]) is not the switcher's
 :SCRUB_TIER
 if /i "%~2"=="%~3[1m]" set "%~1="
 goto :eof
-`;
+${name !== 'agy' ? '' : `
+REM Exit 0 from the helper means the gateway answered with this install's identity proof.
+:CHECK_GATEWAY
+node "${GATEWAY_CHECK}" "%CLOUD_CODE_URL%" >nul 2>&1
+if not errorlevel 1 goto :eof
+echo [llm-switcher] the gateway at %CLOUD_CODE_URL% did not prove it is this switcher; agy uses its official endpoint. 1>&2
+set "CLOUD_CODE_URL="
+set "TOOL_ACTIVE=0"
+goto :eof
+`}`;
 };
 
 export function renderShim(name, platform = process.platform) {
@@ -347,20 +382,26 @@ export function uninstallShims(names = SHIMMED) {
 }
 
 /** Is SHIM_DIR already ahead of the real binary in PATH? */
-export function shimStatus(names = SHIMMED) {
-  const entries = (process.env.PATH || '').split(path.delimiter).filter(Boolean);
-  const idx = entries.findIndex(p => path.resolve(p) === path.resolve(SHIM_DIR));
-  const out = { dir: SHIM_DIR, onPath: idx !== -1, position: idx, shims: [] };
+export function shimStatus(names = SHIMMED, {
+  pathEnv = process.env.PATH, shimDir = SHIM_DIR, platform = process.platform, pathExt = process.env.PATHEXT
+} = {}) {
+  const delimiter = platform === 'win32' ? ';' : ':';
+  const entries = (pathEnv || '').split(delimiter).filter(Boolean);
+  const idx = entries.findIndex(p => path.resolve(p) === path.resolve(shimDir));
+  const out = { dir: shimDir, onPath: idx !== -1, position: idx, shims: [] };
+  // Windows takes the first directory that holds the name with any PATHEXT extension, in PATHEXT
+  // order, so an agy.exe earlier on PATH runs before the agy.cmd shim.
+  const exts = platform === 'win32'
+    ? (pathExt || '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean).map(e => e.toLowerCase())
+    : [''];
 
   for (const name of names) {
-    const target = shimPath(name);
+    const target = path.join(shimDir, platform === 'win32' ? `${name}.cmd` : name);
     const exists = fs.existsSync(target);
     let effective = null;   // which binary will run when the command name is typed
     for (const p of entries) {
-      const cand = path.join(p, process.platform === 'win32' ? `${name}.cmd` : name);
-      const candExe = path.join(p, name);
-      if (fs.existsSync(cand)) { effective = cand; break; }
-      if (fs.existsSync(candExe)) { effective = candExe; break; }
+      const hit = exts.map(e => path.join(p, `${name}${e}`)).find(c => fs.existsSync(c));
+      if (hit) { effective = hit; break; }
     }
     out.shims.push({
       name,
@@ -421,7 +462,8 @@ export function pathOrderHint(platform = process.platform) {
 // Codex takes the gateway URL as a --config override, or the interceptor as HTTPS_PROXY.
 const ROUTE_EVIDENCE = {
   claude: /(^|\s)ANTHROPIC_BASE_URL=/,
-  codex: /(^|\s)(LLM_SWITCHER_CODEX_BASE_URL=|https?_proxy=http:\/\/(127\.0\.0\.1|localhost)[:/]|openai_base_url=http:\/\/(127\.0\.0\.1|localhost)[:/])/i
+  codex: /(^|\s)(LLM_SWITCHER_CODEX_BASE_URL=|https?_proxy=http:\/\/(127\.0\.0\.1|localhost)[:/]|openai_base_url=http:\/\/(127\.0\.0\.1|localhost)[:/])/i,
+  agy: /(^|\s)CLOUD_CODE_URL=http:\/\/(127\.0\.0\.1|localhost)[:/]/
 };
 
 /** true | false, or null when the dump holds no environment (macOS ps for most processes). */