llm-switcher 1.2.2 → 1.2.4

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog — LLM Switcher
 
+## Release 1.2.4
+
+- **Codex blindfold starts on a new machine:** A switch to a Codex profile stopped with "ca.pem is missing" on every new data directory. The certificates came only from `make-certs.sh`, which needs bash and OpenSSL. Now the switcher builds the same set with Node's crypto before it does any other check. It builds a new leaf when the leaf is missing, does not cover the three hosts, or does not match its key. It keeps a CA that still works, because Codex already trusts it.
+- **1M context follows the real window:** The model list in the dashboard now reads the token limits that the gateway gives (`context_length`, `max_input_tokens`, `max_output_tokens`). When a model has a known window of less than 1M, the **1M context** box of its slot is cleared and locked. The reason shows under the field. When the gateway gives no window, the box stays free and shows a warning when it is ticked.
+- **Tests:** A suite run no longer leaves an interceptor process running. Two tests that failed only on a loaded machine now pass: one waited for a lock that was already gone, and one lost its port to a test file that ran at the same time.
+
+## Release 1.2.3
+
+- **Update notice:** The dashboard sidebar shows the running version. When npm has a newer release, a notice shows the update command with a copy button. The new command `switch version` prints the same information. The switcher asks the npm registry at most once in 12 hours. Without an answer, no notice shows.
+- **Codex daemon follows the route:** The interactive Codex TUI talks to a shared `codex app-server` daemon, and that daemon keeps the environment that it started with. As a result, the TUI bypassed the gateway after a switch. Now each change of the Codex route restarts the running daemon with the new variables. When no daemon runs, nothing starts.
+- **API keys stay with their host:** A catalog refresh sent the key of the active profile to the official Anthropic and OpenAI model lists. Now a key goes only to the host of its own profile.
+- **Real model catalog:** The catalog reads the model list that Codex and Claude Code keep on disk for the signed-in account. A failed refresh no longer marks the tool version as done, so the next request tries again.
+- **Dashboard saves:** Every write action reported a failure after it succeeded, because the page read `ok` and the server sends `success`. Enter in a field no longer saves a half-edited profile. A text selection that ends outside the dialog no longer closes it.
+- **Model slots:** Each slot is a searchable list of the provider models. The list loads when you open the Model Slots tab and sends the saved key. A profile without `outFormat` keeps it empty after a save.
+- **Other fixes:** `make-certs.sh` works when the path contains a dot. `switch doctor` warns again about a Codex profile without `publicModels`. Three dashboard controls have an accessible name.
+- **Tests:** The tests use the 1.2 configuration schema, never read the certificates of the checkout, and never reach the real Codex daemon, npm registry, or `claude` binary.
+
 ## Release 1.2.2
 
 - **Structured output reaches every upstream:** A request that asks for JSON that matches a schema now keeps that schema. Before this release, the gateway did not read `output_config.format` (Claude Code) or `text.format` (Codex), so the provider got a free-text request. The schema now goes to the provider as `response_format` (OpenAI Chat), `output_config.format` (Anthropic), or `responseMimeType` with `responseSchema` (Gemini and Vertex). A request for JSON without a schema reaches Anthropic as plain text, because Anthropic has no JSON mode without a schema.

package/README.md

@@ -120,7 +120,7 @@ LLM Switcher acts as a transparent man-in-the-middle without ever touching clien
 
 > #### 🔒 CA Security & Origin: Where does the CA come from and how safe is it?
 >
-> - **100% Locally Minted:** The CA certificate (`ca.pem`) and private key (`ca.key`) are generated entirely on your own machine using your local OpenSSL (`blindfold/make-certs.sh`). No keys are downloaded from the internet, and the private key is stored locally with strict `0600` permissions.
+> - **100% Locally Minted:** The CA certificate (`ca.pem`) and private key (`ca.key`) are generated entirely on your own machine. The switcher builds them itself with Node's crypto the first time a tool is switched on, and again when the leaf is missing or out of date. It keeps a CA that still works, because Codex already trusts it. `blindfold/make-certs.sh` builds the same set with OpenSSL. No keys are downloaded from the internet, and the private key is stored locally with strict `0600` permissions.
 > - **Zero OS Trust Store Tampering:** Unlike tools like Charles or Fiddler, LLM Switcher **NEVER installs anything into your system or OS root certificate store** (no Windows Certificate Store, no macOS Keychain, no Linux `/etc/ssl/certs`). It requires **zero Administrator or sudo privileges**.
 > - **Process-Scoped Trust Only:** The certificate is loaded ephemerally into the memory of `claude` (via `NODE_EXTRA_CA_CERTS`) and `codex` (via `CODEX_CA_CERTIFICATE`). Your browsers, banking apps, git, and other terminal sessions never trust this CA.
 > - **Cryptographic Name Constraints:** The CA is minted with explicit X.509 `nameConstraints` strictly permitting only three domains: `api.anthropic.com`, `api.openai.com`, and `chatgpt.com`. Even if the local private key were compromised, standard TLS verifiers will reject it for any other domain (Google, GitHub, your bank).
@@ -279,9 +279,8 @@ base URL is overridden to http://127.0.0.1:3456/v1. Selecting models may not be
 Blindfold mode removes that line. Codex keeps its official endpoint, and the switcher intercepts the network hop instead. It needs no administrator rights, no certificate in a system trust store, and no change to `~/.codex/config.toml`.
 
 ```bash
-bash "$(npm root -g)/llm-switcher/blindfold/make-certs.sh"   # once; a checkout runs blindfold/make-certs.sh
 # the port is already top-level in config.json: "blindfold": { "port": 3457 }
-switch codex <profile>                     # the gateway starts the interceptor
+switch codex <profile>   # builds the certificates when they are missing, then the gateway starts the interceptor
 ```
 
 One interceptor serves both tools. It routes by the host of the CONNECT request and by the path,
@@ -312,6 +311,10 @@ Read [📖 `docs/codex-blindfold.md`](docs/codex-blindfold.md) before you turn i
   or an auto-compact limit, and it writes no model name into your environment. Claude Code sizes
   its own session from the window of the model you pick. A backend whose window is smaller than
   that model can overflow in a long session. `model1M` now only decides what `/v1/models` reports.
+  The dashboard reads each model's window from the gateway's model list (`context_length` or
+  `max_input_tokens`, as intact and OpenRouter give them). When the window is known to be under
+  1M, the slot's **1M context** box is cleared and locked. When the list gives no window, the box
+  stays free and shows a warning when it is ticked.
 - **Codex needs certificates once.** Blindfold mode is what keeps Codex on its official endpoint,
   and it needs a private CA plus a leaf naming the three hosts above. Skip it and Codex shows the
   `base URL is overridden` line on its `/model` screen instead.
@@ -401,6 +404,7 @@ Add the server to your MCP configuration (for example `opencode.jsonc`, `claude_
 ```bash
 switch ui                      # Open the Web UI dashboard in your browser
 switch status                  # Display status for all active CLI targets
+switch version                 # Show the version and tell you when npm has a newer one
 switch doctor                  # Audit environment, settings & routing
 switch on [profile]            # Start the gateway and activate a profile
 switch <profile>               # Activate a profile for both tools

package/README.vi.md

@@ -120,7 +120,7 @@ LLM Switcher hoạt động như một lớp trung gian mạng trong suốt (tra
 
 > #### 🔒 Độ An Toàn & Nguồn Gốc Chứng Chỉ CA: CA từ đâu ra và an toàn thế nào?
 >
-> - **Tự sinh 100% tại máy cục bộ:** File chứng chỉ (`ca.pem`) và private key (`ca.key`) được sinh trực tiếp trên chính máy tính của bạn bằng OpenSSL nội bộ (`blindfold/make-certs.sh`). Tuyệt đối không tải bất kỳ chứng chỉ nào từ internet về, private key được lưu với quyền bảo mật nghiêm ngặt `0600`.
+> - **Tự sinh 100% tại máy cục bộ:** File chứng chỉ (`ca.pem`) và private key (`ca.key`) được sinh trực tiếp trên chính máy tính của bạn. Switcher tự tạo chúng bằng crypto của Node ở lần đầu bật một công cụ, và tạo lại khi leaf bị thiếu hoặc đã cũ. CA còn dùng được thì được giữ nguyên, vì Codex đã tin nó. `blindfold/make-certs.sh` tạo đúng bộ đó bằng OpenSSL. Tuyệt đối không tải bất kỳ chứng chỉ nào từ internet về, private key được lưu với quyền bảo mật nghiêm ngặt `0600`.
 > - **Không can thiệp vào System Trust Store của hệ điều hành:** Khác với các công cụ bắt proxy như Charles hay Fiddler, LLM Switcher **tuyệt đối KHÔNG cài đặt chứng chỉ vào OS Root Store** (không đụng vào Windows Certificate Manager, macOS Keychain hay Linux `/etc/ssl/certs`). Bạn **không cần quyền Administrator hay sudo**.
 > - **Chỉ tin cậy trong phạm vi tiến trình (Process-Scoped):** Chứng chỉ CA chỉ được nạp tạm thời vào bộ nhớ của `claude` (qua `NODE_EXTRA_CA_CERTS`) và `codex` (qua `CODEX_CA_CERTIFICATE`). Trình duyệt web (Chrome, Edge), ứng dụng ngân hàng, git và các app khác trên máy hoàn toàn không biết và không tin cậy chứng chỉ này.
 > - **Giới hạn tên miền bằng mật mã học (Name Constraints):** Chứng chỉ CA được cấu hình thuộc tính X.509 `nameConstraints` bắt buộc, chỉ cho phép ký duy nhất cho 3 domain: `api.anthropic.com`, `api.openai.com`, và `chatgpt.com`. Dù có ai đánh cắp được private key, các trình xác thực TLS chuẩn sẽ lập tức từ chối chứng chỉ này đối với mọi trang web khác (Google, GitHub, ngân hàng...).
@@ -281,9 +281,8 @@ base URL is overridden to http://127.0.0.1:3456/v1. Selecting models may not be
 Blindfold xóa dòng đó. Codex giữ nguyên endpoint chính thức, switcher chặn ở tầng mạng. Không cần quyền admin, không cài chứng chỉ vào system trust store, không sửa `~/.codex/config.toml`.
 
 ```bash
-bash "$(npm root -g)/llm-switcher/blindfold/make-certs.sh"   # chạy một lần; bản checkout chạy blindfold/make-certs.sh
 # cổng đã nằm sẵn ở cấp cao nhất của config.json: "blindfold": { "port": 3457 }
-switch codex <profile>                     # gateway khởi động interceptor
+switch codex <profile>   # tự tạo chứng chỉ khi còn thiếu, rồi gateway khởi động interceptor
 ```
 
 Một interceptor phục vụ cả hai công cụ. Nó định tuyến theo host của request CONNECT và theo path,
@@ -402,6 +401,7 @@ Thêm server vào cấu hình MCP (ví dụ `opencode.jsonc`, `claude_desktop_co
 ```bash
 switch ui                      # Mở giao diện Web UI trên trình duyệt
 switch status                  # Xem trạng thái kích hoạt của tất cả các CLI
+switch version                 # Xem version đang chạy và báo khi npm có bản mới
 switch doctor                  # Quét & thanh tra toàn bộ môi trường, settings và định tuyến
 switch on [profile]            # Khởi động gateway và kích hoạt một profile
 switch <profile>               # Kích hoạt một profile cho cả hai công cụ

package/blindfold/certs.mjs

@@ -0,0 +1,156 @@
+// Builds the interceptor's private CA and leaf in Node alone, the same certificates as
+// make-certs.sh but with no bash and no openssl, so the gateway can build a missing set itself.
+// Node reads X.509 but cannot write it, so the certificates are encoded here as DER.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const CA_DAYS = 3650;
+const LEAF_DAYS = 825;
+
+// ---- DER
+function len(n) {
+  if (n < 0x80) return Buffer.from([n]);
+  const bytes = [];
+  for (let v = n; v > 0; v >>= 8) bytes.unshift(v & 0xff);
+  return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+const tlv = (tag, ...parts) => { const body = Buffer.concat(parts); return Buffer.concat([Buffer.from([tag]), len(body.length), body]); };
+const seq = (...parts) => tlv(0x30, ...parts);
+const set = (...parts) => tlv(0x31, ...parts);
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0]));
+const octets = (buf) => tlv(0x04, buf);
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+const bits = (buf, unused = 0) => tlv(0x03, Buffer.from([unused]), buf);
+const dnsName = (host) => tlv(0x82, Buffer.from(host, 'ascii'));   // GeneralName [2] IA5String
+function int(buf) {
+  let b = Buffer.from(buf);
+  while (b.length > 1 && b[0] === 0 && !(b[1] & 0x80)) b = b.subarray(1);
+  if (b[0] & 0x80) b = Buffer.concat([Buffer.from([0]), b]);
+  return tlv(0x02, b);
+}
+function oid(dotted) {
+  const [a, b, ...rest] = dotted.split('.').map(Number);
+  const out = [40 * a + b];
+  for (const n of rest) {
+    const chunk = [n & 0x7f];
+    for (let v = n >> 7; v > 0; v >>= 7) chunk.unshift(0x80 | (v & 0x7f));
+    out.push(...chunk);
+  }
+  return tlv(0x06, Buffer.from(out));
+}
+function time(d) {
+  const p = (n) => String(n).padStart(2, '0');
+  const y = d.getUTCFullYear();
+  const s = `${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`;
+  // UTCTime until 2049, GeneralizedTime after, as RFC 5280 requires.
+  return y < 2050 ? tlv(0x17, Buffer.from(String(y).slice(2) + s)) : tlv(0x18, Buffer.from(String(y) + s));
+}
+
+const ECDSA_SHA256 = seq(oid('1.2.840.10045.4.3.2'));
+const name = (cn) => seq(set(seq(oid('2.5.4.3'), utf8(cn))));
+const ext = (id, critical, value) => seq(oid(id), ...(critical ? [bool(true)] : []), octets(value));
+
+function keyId(publicKey) {
+  // The key identifier is the SHA-1 of the subjectPublicKey bits (RFC 5280, method 1).
+  const spki = publicKey.export({ type: 'spki', format: 'der' });
+  return crypto.createHash('sha1').update(spki.subarray(spki.length - 65)).digest();
+}
+
+function certificate({ subject, issuer, publicKey, signingKey, days, extensions }) {
+  const notBefore = new Date(Date.now() - 60 * 60 * 1000);   // an hour back, for a skewed clock
+  const notAfter = new Date(notBefore.getTime() + days * 86400000);
+  const serial = crypto.randomBytes(16);
+  serial[0] &= 0x7f;
+  const tbs = seq(
+    tlv(0xa0, int([2])),                       // v3
+    int(serial),
+    ECDSA_SHA256,
+    name(issuer),
+    seq(time(notBefore), time(notAfter)),
+    name(subject),
+    publicKey.export({ type: 'spki', format: 'der' }),
+    tlv(0xa3, seq(...extensions))
+  );
+  const sig = crypto.sign('sha256', tbs, signingKey);
+  const der = seq(tbs, ECDSA_SHA256, bits(sig));
+  return `-----BEGIN CERTIFICATE-----\n${der.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
+}
+
+const newKey = () => crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+const pemKey = (k) => k.export({ type: 'sec1', format: 'pem' });
+
+/** A leaf for `hosts`, signed by the CA in `dir`. Returns the PEM strings; writes nothing. */
+export function signLeaf(dir, hosts) {
+  const caKey = crypto.createPrivateKey(fs.readFileSync(path.join(dir, 'ca.key')));
+  const caCert = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'ca.pem')));
+  const { publicKey, privateKey } = newKey();
+  const cert = certificate({
+    subject: 'llm-switcher',
+    issuer: 'LLM Switcher Local CA',
+    publicKey,
+    signingKey: caKey,
+    days: LEAF_DAYS,
+    extensions: [
+      ext('2.5.29.19', true, seq()),                                  // basicConstraints CA:FALSE
+      ext('2.5.29.15', true, bits(Buffer.from([0xa0]), 5)),           // digitalSignature, keyEncipherment
+      ext('2.5.29.37', false, seq(oid('1.3.6.1.5.5.7.3.1'))),         // extendedKeyUsage serverAuth
+      ext('2.5.29.17', false, seq(...hosts.map(dnsName))),            // subjectAltName
+      ext('2.5.29.14', false, octets(keyId(publicKey))),
+      ext('2.5.29.35', false, seq(tlv(0x80, keyId(caCert.publicKey))))
+    ]
+  });
+  return { cert, key: pemKey(privateKey) };
+}
+
+function writePrivate(dir, files) {
+  // Write each file beside its target and rename it into place: a failed run keeps the last set,
+  // and a rename replaces a planted symlink instead of writing through it.
+  const staged = [];
+  for (const [f, body] of Object.entries(files)) {
+    const tmpFile = path.join(dir, `.${f}.${process.pid}.tmp`);
+    fs.writeFileSync(tmpFile, body, { mode: 0o600, flag: 'wx' });
+    staged.push([tmpFile, path.join(dir, f)]);
+  }
+  for (const [from, to] of staged) fs.renameSync(from, to);
+}
+
+function privateDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') {
+    const st = fs.lstatSync(dir);
+    if (!st.isDirectory() || st.uid !== process.getuid()) {
+      throw new Error(`${dir} is not a directory you own; the CA key cannot go there`);
+    }
+    fs.chmodSync(dir, 0o700);
+  }
+}
+
+/** A new CA and leaf in `dir`, the set make-certs.sh builds. */
+export function buildCerts(dir, hosts) {
+  privateDir(dir);
+  const { publicKey, privateKey } = newKey();
+  const caPem = certificate({
+    subject: 'LLM Switcher Local CA',
+    issuer: 'LLM Switcher Local CA',
+    publicKey,
+    signingKey: privateKey,
+    days: CA_DAYS,
+    extensions: [
+      ext('2.5.29.19', true, seq(bool(true), int([0]))),              // CA:TRUE, pathlen:0
+      ext('2.5.29.15', true, bits(Buffer.from([0x06]), 1)),           // keyCertSign, cRLSign
+      ext('2.5.29.14', false, octets(keyId(publicKey))),
+      // A leaked ca.key can then sign only for the host table.
+      ext('2.5.29.30', true, seq(tlv(0xa0, ...hosts.map(h => seq(dnsName(h))))))
+    ]
+  });
+  writePrivate(dir, { 'ca.key': pemKey(privateKey), 'ca.pem': caPem });
+  writeLeaf(dir, hosts);
+}
+
+/** A new leaf in `dir` on the CA already there. */
+export function writeLeaf(dir, hosts) {
+  privateDir(dir);
+  const { cert, key } = signLeaf(dir, hosts);
+  writePrivate(dir, { 'leaf.key': key, 'leaf.pem': cert });
+}

package/blindfold/make-certs.sh

@@ -103,8 +103,10 @@ openssl req -x509 -new -key "$WORK/ca.key" -sha256 -days "$CA_DAYS" \
 
 openssl ecparam -name prime256v1 -genkey -noout -out "$WORK/leaf.key"
 openssl req -new -key "$WORK/leaf.key" -config "$WORK/leaf.cnf" -out "$WORK/leaf.csr"
+# An explicit -CAserial: LibreSSL derives the default name by cutting the CA path at its first dot,
+# so a home directory such as /Users/first.last sent the serial file to /Users/first.srl.
 openssl x509 -req -in "$WORK/leaf.csr" \
-  -CA "$WORK/ca.pem" -CAkey "$WORK/ca.key" -CAcreateserial \
+  -CA "$WORK/ca.pem" -CAkey "$WORK/ca.key" -CAcreateserial -CAserial "$WORK/ca.srl" \
   -days "$LEAF_DAYS" -sha256 -extfile "$WORK/leaf.ext" \
   -out "$WORK/leaf.pem"
 

package/catalog.mjs

@@ -7,6 +7,7 @@
 // ============================================================
 
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 export const OFFICIAL_MODEL_URLS = {
@@ -69,6 +70,70 @@ export function loadCatalogCache(stateDir) {
   };
 }
 
+function defaultSources() {
+  return {
+    codexHome: process.env.CODEX_HOME || path.join(os.homedir(), '.codex'),
+    claudeDir: process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude')
+  };
+}
+
+/**
+ * Reads the model list that the tool itself keeps on disk for the signed-in account, so no key and
+ * no network call is needed. Codex writes models_cache.json; Claude Code writes cache/model-catalog.
+ * Returns null when the tool has no list.
+ */
+export function readLocalToolModels(tool, sources = defaultSources()) {
+  try {
+    if (tool === 'codex') {
+      const d = JSON.parse(fs.readFileSync(path.join(sources.codexHome, 'models_cache.json'), 'utf8'));
+      const models = (Array.isArray(d?.models) ? d.models : [])
+        .filter(m => m && typeof m.slug === 'string' && m.slug)
+        .map(m => ({ id: m.slug, role: classifyCodexRole(m.slug), ...(Number.isInteger(m.context_window) ? { contextWindow: m.context_window } : {}) }));
+      return models.length ? { models, version: String(d.client_version || '') } : null;
+    }
+    if (tool === 'claude') {
+      // One file per account or surface; the newest fetch wins.
+      const dir = path.join(sources.claudeDir, 'cache', 'model-catalog');
+      let newest = null;
+      for (const f of fs.readdirSync(dir)) {
+        if (!f.endsWith('.json')) continue;
+        try {
+          const d = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8'));
+          const list = d?.catalog?.config?.models;
+          if (Array.isArray(list) && list.length && (!newest || (d.fetchedAt || 0) > newest.fetchedAt)) newest = { fetchedAt: d.fetchedAt || 0, list };
+        } catch {}
+      }
+      const models = (newest?.list || [])
+        .filter(m => m && typeof m.id === 'string' && m.id)
+        .map(m => ({ id: m.id, display_name: m.name || m.id, tier: classifyClaudeTier(m.id) }));
+      return models.length ? { models, version: '' } : null;
+    }
+  } catch {}
+  return null;
+}
+
+/**
+ * Copies the tools' own lists into the catalog when they changed. A tool can update and rewrite its
+ * list without any request through the gateway, so readers of the catalog call this first.
+ */
+export function syncLocalCatalog(stateDir, sources = defaultSources()) {
+  const cache = loadCatalogCache(stateDir);
+  let changed = false;
+  for (const tool of ['claude', 'codex']) {
+    const local = readLocalToolModels(tool, sources);
+    if (!local) continue;
+    const ids = (cache[tool]?.models || []).map(m => m.id).join('\n');
+    if (ids === local.models.map(m => m.id).join('\n') && cache[tool]?.source === 'local') continue;
+    cache[tool] = { ...cache[tool], models: local.models, source: 'local' };
+    changed = true;
+  }
+  if (changed) {
+    cache.updatedAt = Date.now();
+    saveCatalogCache(stateDir, cache);
+  }
+  return cache;
+}
+
 /** Atomically writes the model catalog cache to disk */
 export function saveCatalogCache(stateDir, catalog) {
   const p = catalogCachePath(stateDir);
@@ -141,19 +206,33 @@ export async function fetchToolModels(tool, { url, apiKey, timeout = 3000 } = {}
   }
 }
 
+// A profile key is a credential for that profile's baseURL. Send it to the official model list only
+// when the profile itself points at the official host, never to a third party.
+function officialKey(profile, tool) {
+  try {
+    if (profile?.apiKey && new URL(profile.baseURL).host === new URL(OFFICIAL_MODEL_URLS[tool]).host) return profile.apiKey;
+  } catch {}
+  return undefined;
+}
+
 /**
  * Refreshes the local catalog cache with models from both official endpoints
  * and saves to the state directory.
  */
-export async function refreshCatalog(stateDir, { claudeKey, codexKey } = {}) {
+export async function refreshCatalog(stateDir, { claudeProfile, codexProfile, sources = defaultSources() } = {}) {
   const cache = loadCatalogCache(stateDir);
+  const local = { claude: readLocalToolModels('claude', sources), codex: readLocalToolModels('codex', sources) };
 
+  // A local list is the list of the account itself; the built-in names are guesses and are not added.
   const [claudeRes, codexRes] = await Promise.all([
-    fetchToolModels('claude', { apiKey: claudeKey }),
-    fetchToolModels('codex', { apiKey: codexKey })
+    local.claude || fetchToolModels('claude', { apiKey: officialKey(claudeProfile, 'claude') }),
+    local.codex || fetchToolModels('codex', { apiKey: officialKey(codexProfile, 'codex') })
   ]);
+  for (const tool of ['claude', 'codex']) {
+    if (local[tool]) cache[tool] = { ...cache[tool], models: local[tool].models, source: 'local' };
+  }
 
-  if (claudeRes.ok && claudeRes.models.length > 0) {
+  if (!local.claude && claudeRes.ok && claudeRes.models.length > 0) {
     const existing = new Set(claudeRes.models.map(m => m.id));
     // Keep any baseline models that might be absent from the API
     for (const [tier, ids] of Object.entries(BASELINE_MODELS.claude)) {
@@ -161,17 +240,17 @@ export async function refreshCatalog(stateDir, { claudeKey, codexKey } = {}) {
         if (!existing.has(id)) claudeRes.models.push({ id, tier });
       }
     }
-    cache.claude = { models: claudeRes.models };
+    cache.claude = { ...cache.claude, models: claudeRes.models, source: 'official' };
   }
 
-  if (codexRes.ok && codexRes.models.length > 0) {
+  if (!local.codex && codexRes.ok && codexRes.models.length > 0) {
     const existing = new Set(codexRes.models.map(m => m.id));
     for (const [role, ids] of Object.entries(BASELINE_MODELS.codex)) {
       for (const id of ids) {
         if (!existing.has(id)) codexRes.models.push({ id, role });
       }
     }
-    cache.codex = { models: codexRes.models };
+    cache.codex = { ...cache.codex, models: codexRes.models, source: 'official' };
   }
 
   cache.updatedAt = Date.now();
@@ -199,48 +278,59 @@ const refreshingTools = new Set();
 
 /**
  * Version-triggered auto-poll:
- * When a request arrives with a new tool version not yet seen in cache,
- * immediately records the new version and kicks off an asynchronous background refresh.
- * Subsequent requests with the same version do zero network calls.
+ * When a request arrives with a tool version that has no refreshed catalog yet, the catalog is
+ * refreshed from the tool's own list on disk, or else from the official list in the background.
+ * The version is recorded only after a refresh succeeds, so a failed refresh is tried again.
  */
-export function checkVersionAndRefresh(tool, headers, stateDir, apiKey) {
+const RETRY_AFTER_MS = 10 * 60 * 1000;
+const failedAttempts = new Map();
+
+export function checkVersionAndRefresh(tool, headers, stateDir, apiKey, sources = defaultSources()) {
   const version = detectToolVersion(headers, tool);
   if (!version) return;
 
   const cache = loadCatalogCache(stateDir);
-  const toolEntry = cache[tool] || {};
-  const lastVersion = toolEntry.lastSeenVersion || '';
+  if (version === (cache[tool]?.lastSeenVersion || '')) return;
 
-  if (version !== lastVersion) {
-    toolEntry.lastSeenVersion = version;
-    cache[tool] = toolEntry;
+  const local = readLocalToolModels(tool, sources);
+  if (local) {
+    cache[tool] = { ...cache[tool], lastSeenVersion: version, models: local.models, source: 'local' };
+    cache.updatedAt = Date.now();
     saveCatalogCache(stateDir, cache);
+    console.log(`[llm-switcher:catalog] Detected ${tool} ${version} -> model catalog read from the tool (${local.models.length} models)`);
+    return;
+  }
+
+  // Without a local list every request would call the network again; wait between failed attempts.
+  const failed = failedAttempts.get(tool);
+  if (failed && failed.version === version && Date.now() - failed.at < RETRY_AFTER_MS) return;
+  if (refreshingTools.has(tool)) return;
 
-    if (!refreshingTools.has(tool)) {
-      refreshingTools.add(tool);
-      fetchToolModels(tool, { apiKey })
-        .then(res => {
-          if (res.ok && res.models.length > 0) {
-            const fresh = loadCatalogCache(stateDir);
-            const existing = new Set(res.models.map(m => m.id));
-            const baseline = BASELINE_MODELS[tool] || {};
-            for (const [, ids] of Object.entries(baseline)) {
-              for (const id of ids) {
-                if (!existing.has(id)) {
-                  res.models.push({ id, ...(tool === 'claude' ? { tier: classifyClaudeTier(id) } : { role: classifyCodexRole(id) }) });
-                }
-              }
-            }
-            fresh[tool] = { lastSeenVersion: version, models: res.models };
-            fresh.updatedAt = Date.now();
-            saveCatalogCache(stateDir, fresh);
-            console.log(`[llm-switcher:catalog] Detected ${tool} version update to ${version} -> refreshed model catalog (${res.models.length} models)`);
+  refreshingTools.add(tool);
+  fetchToolModels(tool, { apiKey })
+    .then(res => {
+      if (!res.ok || res.models.length === 0) {
+        failedAttempts.set(tool, { version, at: Date.now() });
+        console.log(`[llm-switcher:catalog] ${tool} ${version}: no local model list, official list failed (${res.error || 'empty'})`);
+        return;
+      }
+      const fresh = loadCatalogCache(stateDir);
+      const existing = new Set(res.models.map(m => m.id));
+      const baseline = BASELINE_MODELS[tool] || {};
+      for (const [, ids] of Object.entries(baseline)) {
+        for (const id of ids) {
+          if (!existing.has(id)) {
+            res.models.push({ id, ...(tool === 'claude' ? { tier: classifyClaudeTier(id) } : { role: classifyCodexRole(id) }) });
           }
-        })
-        .catch(() => {})
-        .finally(() => {
-          refreshingTools.delete(tool);
-        });
-    }
-  }
+        }
+      }
+      fresh[tool] = { ...fresh[tool], lastSeenVersion: version, models: res.models, source: 'official' };
+      fresh.updatedAt = Date.now();
+      saveCatalogCache(stateDir, fresh);
+      console.log(`[llm-switcher:catalog] Detected ${tool} version update to ${version} -> refreshed model catalog (${res.models.length} models)`);
+    })
+    .catch(() => {})
+    .finally(() => {
+      refreshingTools.delete(tool);
+    });
 }

package/docs/codex-blindfold.md

@@ -72,12 +72,14 @@ You need:
 
 ## Procedure
 
-### 1. Build the certificates
+### 1. The certificates
 
-Run this command in the repository root:
+You do not have to build them. When a tool is switched on and the certificates are missing, the switcher builds them with Node's crypto. It builds a new leaf when the leaf is missing, does not cover the three hosts, or does not match its key. It keeps a CA that still works, because Codex already trusts that CA. The set is the one that `make-certs.sh` builds: an EC P-256 CA with name constraints, and a leaf with `serverAuth` for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`.
+
+To build the set yourself with OpenSSL, run this command in the repository root:
 
 ```bash
-bash blindfold/make-certs.sh chatgpt.com
+bash blindfold/make-certs.sh
 ```
 
 The script writes `blindfold/certs/ca.pem` and `blindfold/certs/leaf.pem`. It prints the extended key usage and the subject alternative name of the leaf. Make sure that the output contains `TLS Web Server Authentication`.
@@ -212,7 +214,7 @@ The switcher writes `LLM_SWITCHER_CODEX_BASE_URL` again, the gateway stops the i
 
 Read this section before you turn blindfold mode on.
 
-**The CA is trusted for every host that Codex contacts.** `CODEX_CA_CERTIFICATE` adds this authority to the trust store that Codex uses for all of its HTTPS calls. A CA that `make-certs.sh` builds now carries name constraints: it can sign only for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`. A client that obeys name constraints refuses any other certificate from this CA. OpenSSL, rustls and the macOS and Windows verifiers obey them. A CA that an older version built has no constraint. Anybody who can read its `ca.key` can forge a certificate for any host. Run `make-certs.sh` again to replace it, and keep `blindfold/certs/` private in both cases.
+**The CA is trusted for every host that Codex contacts.** `CODEX_CA_CERTIFICATE` adds this authority to the trust store that Codex uses for all of its HTTPS calls. A CA that the switcher or `make-certs.sh` builds carries name constraints: it can sign only for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`. A client that obeys name constraints refuses any other certificate from this CA. OpenSSL, rustls and the macOS and Windows verifiers obey them. A CA that an older version built has no constraint. Anybody who can read its `ca.key` can forge a certificate for any host. Run `make-certs.sh` again to replace it, and keep `blindfold/certs/` private in both cases.
 
 **All traffic to the intercepted host is decrypted by this process.** That includes sign-in and token refresh, because the CONNECT for the whole host is terminated locally. Requests outside the Codex API path are re-originated to the real host over a new TLS session; they are forwarded, not tunneled. The `--verbose` flag prints the method and path of every such request.
 

package/mcp.mjs

@@ -143,11 +143,11 @@ async function handleToolCall(name, args) {
   const port = getMcpPort();
 
   if (name === 'switcher_models') {
-    const { loadCatalogCache, refreshCatalog } = await import('./catalog.mjs');
+    const { syncLocalCatalog, refreshCatalog } = await import('./catalog.mjs');
     if (args?.refresh) {
       await refreshCatalog(STATE_DIR);
     }
-    const cache = loadCatalogCache(STATE_DIR);
+    const cache = syncLocalCatalog(STATE_DIR);
     const t = args?.tool?.toLowerCase();
     const res = {};
     if (!t || t === 'claude') res.claude = cache.claude;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -23,7 +23,8 @@ import {
   codexModelEntry, smallestWindows, publicModelWindows, model1MForSlot,
   contractLabSettings, STATE_DIR
 } from './state.mjs';
-import { classifyCodexRole, classifyClaudeTier, loadCatalogCache, refreshCatalog, checkVersionAndRefresh } from './catalog.mjs';
+import { classifyCodexRole, classifyClaudeTier, syncLocalCatalog, refreshCatalog, checkVersionAndRefresh } from './catalog.mjs';
+import { checkForUpdate } from './version.mjs';
 import { createContractLab, createHalfTap, tapClientWrites, capText, capJson, toolVersionFromUA, finishHalf, PROBE_HEADER, TRACE_ID_RE } from './contract.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -1077,12 +1078,30 @@ async function fetchModels(body, cfg) {
   const r = await fetch(`${baseURL}/models`, { headers, signal: upstreamTimeout(15000) });
   if (!r.ok) return { status: 200, json: { ok: false, status: r.status, error: (await r.text()).slice(0, 2000) } };
   const data = await r.json();
-  let list = [];
-  if (Array.isArray(data.data)) list = data.data.map(m => (typeof m === 'string' ? m : m.id));
-  else if (Array.isArray(data)) list = data.map(m => (typeof m === 'string' ? m : m.id));
-  else if (Array.isArray(data.models)) list = data.models.map(m => (typeof m === 'string' ? m : (m.id || m.name)));
-  list = [...new Set(list.filter(Boolean).map(id => String(id).replace(/^models\//, '')))].sort();
-  return { status: 200, json: { ok: true, models: list } };
+  const entries = Array.isArray(data.data) ? data.data : Array.isArray(data) ? data : Array.isArray(data.models) ? data.models : [];
+  const idOf = m => String(typeof m === 'string' ? m : (m?.id || m?.name || '')).replace(/^models\//, '');
+  const list = [...new Set(entries.map(idOf).filter(Boolean))].sort();
+  const limits = {};
+  for (const m of entries) {
+    const l = modelLimits(m);
+    if (l) limits[idOf(m)] = l;
+  }
+  return { status: 200, json: { ok: true, models: list, limits } };
+}
+
+// A listed model's token limits, as intact and OpenRouter write them. Null when the list gives none.
+function modelLimits(m) {
+  if (!m || typeof m !== 'object') return null;
+  const n = v => (Number.isFinite(v) && v > 0 ? v : 0);
+  const top = m.top_provider && typeof m.top_provider === 'object' ? m.top_provider : {};
+  const out = {};
+  const context = n(m.context_length) || n(top.context_length) || n(m.context_window);
+  const input = n(m.max_input_tokens);
+  const output = n(m.max_output_tokens) || n(top.max_completion_tokens);
+  if (context) out.context = context;
+  if (input) out.input = input;
+  if (output) out.output = output;
+  return Object.keys(out).length ? out : null;
 }
 
 // Vertex/Gemini: /v1beta/models/{m}:{action} (Gemini API) and
@@ -1287,9 +1306,13 @@ async function routeApi(req, res, method, pathname) {
     return sendJson(res, 200, { logs: requestLogs.slice().reverse() });
   }
 
+  if (method === 'GET' && pathname === '/api/version') {
+    return sendJson(res, 200, await checkForUpdate({ stateDir: STATE_DIR }));
+  }
+
   // GET /api/catalog (Dynamic Model Discovery)
   if (method === 'GET' && pathname === '/api/catalog') {
-    return sendJson(res, 200, loadCatalogCache(STATE_DIR));
+    return sendJson(res, 200, syncLocalCatalog(STATE_DIR));
   }
 
   if (method !== 'POST') {
@@ -1310,10 +1333,7 @@ async function routeApi(req, res, method, pathname) {
     const cfg = requireConfig(res) || {};
     const claudeProfile = active.claude ? cfg.profiles?.[active.claude] : null;
     const codexProfile = active.codex ? cfg.profiles?.[active.codex] : null;
-    const updated = await refreshCatalog(STATE_DIR, {
-      claudeKey: claudeProfile?.apiKey,
-      codexKey: codexProfile?.apiKey
-    });
+    const updated = await refreshCatalog(STATE_DIR, { claudeProfile, codexProfile });
     return sendJson(res, 200, { success: true, catalog: updated });
   }
 

package/scripts/run-tests.mjs

@@ -15,5 +15,7 @@ const files = [];
   }
 })(path.join(root, 'tests'));
 
-const r = spawnSync(process.execPath, ['--test', ...process.argv.slice(2), ...files], { cwd: root, stdio: 'inherit' });
+// A version check must never reach the real npm registry.
+const env = { ...process.env, LLM_SWITCHER_REGISTRY_URL: 'http://127.0.0.1:9/' };
+const r = spawnSync(process.execPath, ['--test', ...process.argv.slice(2), ...files], { cwd: root, stdio: 'inherit', env });
 process.exit(r.status ?? 1);