llm-switcher 1.2.3 → 1.2.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — LLM Switcher
 
+## Release 1.2.4
+
+- **Codex blindfold starts on a new machine:** A switch to a Codex profile stopped with "ca.pem is missing" on every new data directory. The certificates came only from `make-certs.sh`, which needs bash and OpenSSL. Now the switcher builds the same set with Node's crypto before it does any other check. It builds a new leaf when the leaf is missing, does not cover the three hosts, or does not match its key. It keeps a CA that still works, because Codex already trusts it.
+- **1M context follows the real window:** The model list in the dashboard now reads the token limits that the gateway gives (`context_length`, `max_input_tokens`, `max_output_tokens`). When a model has a known window of less than 1M, the **1M context** box of its slot is cleared and locked. The reason shows under the field. When the gateway gives no window, the box stays free and shows a warning when it is ticked.
+- **Tests:** A suite run no longer leaves an interceptor process running. Two tests that failed only on a loaded machine now pass: one waited for a lock that was already gone, and one lost its port to a test file that ran at the same time.
+
 ## Release 1.2.3
 
 - **Update notice:** The dashboard sidebar shows the running version. When npm has a newer release, a notice shows the update command with a copy button. The new command `switch version` prints the same information. The switcher asks the npm registry at most once in 12 hours. Without an answer, no notice shows.

package/README.md

@@ -120,7 +120,7 @@ LLM Switcher acts as a transparent man-in-the-middle without ever touching clien
 
 > #### 🔒 CA Security & Origin: Where does the CA come from and how safe is it?
 >
-> - **100% Locally Minted:** The CA certificate (`ca.pem`) and private key (`ca.key`) are generated entirely on your own machine using your local OpenSSL (`blindfold/make-certs.sh`). No keys are downloaded from the internet, and the private key is stored locally with strict `0600` permissions.
+> - **100% Locally Minted:** The CA certificate (`ca.pem`) and private key (`ca.key`) are generated entirely on your own machine. The switcher builds them itself with Node's crypto the first time a tool is switched on, and again when the leaf is missing or out of date. It keeps a CA that still works, because Codex already trusts it. `blindfold/make-certs.sh` builds the same set with OpenSSL. No keys are downloaded from the internet, and the private key is stored locally with strict `0600` permissions.
 > - **Zero OS Trust Store Tampering:** Unlike tools like Charles or Fiddler, LLM Switcher **NEVER installs anything into your system or OS root certificate store** (no Windows Certificate Store, no macOS Keychain, no Linux `/etc/ssl/certs`). It requires **zero Administrator or sudo privileges**.
 > - **Process-Scoped Trust Only:** The certificate is loaded ephemerally into the memory of `claude` (via `NODE_EXTRA_CA_CERTS`) and `codex` (via `CODEX_CA_CERTIFICATE`). Your browsers, banking apps, git, and other terminal sessions never trust this CA.
 > - **Cryptographic Name Constraints:** The CA is minted with explicit X.509 `nameConstraints` strictly permitting only three domains: `api.anthropic.com`, `api.openai.com`, and `chatgpt.com`. Even if the local private key were compromised, standard TLS verifiers will reject it for any other domain (Google, GitHub, your bank).
@@ -279,9 +279,8 @@ base URL is overridden to http://127.0.0.1:3456/v1. Selecting models may not be
 Blindfold mode removes that line. Codex keeps its official endpoint, and the switcher intercepts the network hop instead. It needs no administrator rights, no certificate in a system trust store, and no change to `~/.codex/config.toml`.
 
 ```bash
-bash "$(npm root -g)/llm-switcher/blindfold/make-certs.sh"   # once; a checkout runs blindfold/make-certs.sh
 # the port is already top-level in config.json: "blindfold": { "port": 3457 }
-switch codex <profile>                     # the gateway starts the interceptor
+switch codex <profile>   # builds the certificates when they are missing, then the gateway starts the interceptor
 ```
 
 One interceptor serves both tools. It routes by the host of the CONNECT request and by the path,
@@ -312,6 +311,10 @@ Read [📖 `docs/codex-blindfold.md`](docs/codex-blindfold.md) before you turn i
   or an auto-compact limit, and it writes no model name into your environment. Claude Code sizes
   its own session from the window of the model you pick. A backend whose window is smaller than
   that model can overflow in a long session. `model1M` now only decides what `/v1/models` reports.
+  The dashboard reads each model's window from the gateway's model list (`context_length` or
+  `max_input_tokens`, as intact and OpenRouter give them). When the window is known to be under
+  1M, the slot's **1M context** box is cleared and locked. When the list gives no window, the box
+  stays free and shows a warning when it is ticked.
 - **Codex needs certificates once.** Blindfold mode is what keeps Codex on its official endpoint,
   and it needs a private CA plus a leaf naming the three hosts above. Skip it and Codex shows the
   `base URL is overridden` line on its `/model` screen instead.

package/README.vi.md

@@ -120,7 +120,7 @@ LLM Switcher hoạt động như một lớp trung gian mạng trong suốt (tra
 
 > #### 🔒 Độ An Toàn & Nguồn Gốc Chứng Chỉ CA: CA từ đâu ra và an toàn thế nào?
 >
-> - **Tự sinh 100% tại máy cục bộ:** File chứng chỉ (`ca.pem`) và private key (`ca.key`) được sinh trực tiếp trên chính máy tính của bạn bằng OpenSSL nội bộ (`blindfold/make-certs.sh`). Tuyệt đối không tải bất kỳ chứng chỉ nào từ internet về, private key được lưu với quyền bảo mật nghiêm ngặt `0600`.
+> - **Tự sinh 100% tại máy cục bộ:** File chứng chỉ (`ca.pem`) và private key (`ca.key`) được sinh trực tiếp trên chính máy tính của bạn. Switcher tự tạo chúng bằng crypto của Node ở lần đầu bật một công cụ, và tạo lại khi leaf bị thiếu hoặc đã cũ. CA còn dùng được thì được giữ nguyên, vì Codex đã tin nó. `blindfold/make-certs.sh` tạo đúng bộ đó bằng OpenSSL. Tuyệt đối không tải bất kỳ chứng chỉ nào từ internet về, private key được lưu với quyền bảo mật nghiêm ngặt `0600`.
 > - **Không can thiệp vào System Trust Store của hệ điều hành:** Khác với các công cụ bắt proxy như Charles hay Fiddler, LLM Switcher **tuyệt đối KHÔNG cài đặt chứng chỉ vào OS Root Store** (không đụng vào Windows Certificate Manager, macOS Keychain hay Linux `/etc/ssl/certs`). Bạn **không cần quyền Administrator hay sudo**.
 > - **Chỉ tin cậy trong phạm vi tiến trình (Process-Scoped):** Chứng chỉ CA chỉ được nạp tạm thời vào bộ nhớ của `claude` (qua `NODE_EXTRA_CA_CERTS`) và `codex` (qua `CODEX_CA_CERTIFICATE`). Trình duyệt web (Chrome, Edge), ứng dụng ngân hàng, git và các app khác trên máy hoàn toàn không biết và không tin cậy chứng chỉ này.
 > - **Giới hạn tên miền bằng mật mã học (Name Constraints):** Chứng chỉ CA được cấu hình thuộc tính X.509 `nameConstraints` bắt buộc, chỉ cho phép ký duy nhất cho 3 domain: `api.anthropic.com`, `api.openai.com`, và `chatgpt.com`. Dù có ai đánh cắp được private key, các trình xác thực TLS chuẩn sẽ lập tức từ chối chứng chỉ này đối với mọi trang web khác (Google, GitHub, ngân hàng...).
@@ -281,9 +281,8 @@ base URL is overridden to http://127.0.0.1:3456/v1. Selecting models may not be
 Blindfold xóa dòng đó. Codex giữ nguyên endpoint chính thức, switcher chặn ở tầng mạng. Không cần quyền admin, không cài chứng chỉ vào system trust store, không sửa `~/.codex/config.toml`.
 
 ```bash
-bash "$(npm root -g)/llm-switcher/blindfold/make-certs.sh"   # chạy một lần; bản checkout chạy blindfold/make-certs.sh
 # cổng đã nằm sẵn ở cấp cao nhất của config.json: "blindfold": { "port": 3457 }
-switch codex <profile>                     # gateway khởi động interceptor
+switch codex <profile>   # tự tạo chứng chỉ khi còn thiếu, rồi gateway khởi động interceptor
 ```
 
 Một interceptor phục vụ cả hai công cụ. Nó định tuyến theo host của request CONNECT và theo path,
@@ -402,6 +401,7 @@ Thêm server vào cấu hình MCP (ví dụ `opencode.jsonc`, `claude_desktop_co
 ```bash
 switch ui                      # Mở giao diện Web UI trên trình duyệt
 switch status                  # Xem trạng thái kích hoạt của tất cả các CLI
+switch version                 # Xem version đang chạy và báo khi npm có bản mới
 switch doctor                  # Quét & thanh tra toàn bộ môi trường, settings và định tuyến
 switch on [profile]            # Khởi động gateway và kích hoạt một profile
 switch <profile>               # Kích hoạt một profile cho cả hai công cụ

package/blindfold/certs.mjs

@@ -0,0 +1,156 @@
+// Builds the interceptor's private CA and leaf in Node alone, the same certificates as
+// make-certs.sh but with no bash and no openssl, so the gateway can build a missing set itself.
+// Node reads X.509 but cannot write it, so the certificates are encoded here as DER.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const CA_DAYS = 3650;
+const LEAF_DAYS = 825;
+
+// ---- DER
+function len(n) {
+  if (n < 0x80) return Buffer.from([n]);
+  const bytes = [];
+  for (let v = n; v > 0; v >>= 8) bytes.unshift(v & 0xff);
+  return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+const tlv = (tag, ...parts) => { const body = Buffer.concat(parts); return Buffer.concat([Buffer.from([tag]), len(body.length), body]); };
+const seq = (...parts) => tlv(0x30, ...parts);
+const set = (...parts) => tlv(0x31, ...parts);
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0]));
+const octets = (buf) => tlv(0x04, buf);
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+const bits = (buf, unused = 0) => tlv(0x03, Buffer.from([unused]), buf);
+const dnsName = (host) => tlv(0x82, Buffer.from(host, 'ascii'));   // GeneralName [2] IA5String
+function int(buf) {
+  let b = Buffer.from(buf);
+  while (b.length > 1 && b[0] === 0 && !(b[1] & 0x80)) b = b.subarray(1);
+  if (b[0] & 0x80) b = Buffer.concat([Buffer.from([0]), b]);
+  return tlv(0x02, b);
+}
+function oid(dotted) {
+  const [a, b, ...rest] = dotted.split('.').map(Number);
+  const out = [40 * a + b];
+  for (const n of rest) {
+    const chunk = [n & 0x7f];
+    for (let v = n >> 7; v > 0; v >>= 7) chunk.unshift(0x80 | (v & 0x7f));
+    out.push(...chunk);
+  }
+  return tlv(0x06, Buffer.from(out));
+}
+function time(d) {
+  const p = (n) => String(n).padStart(2, '0');
+  const y = d.getUTCFullYear();
+  const s = `${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`;
+  // UTCTime until 2049, GeneralizedTime after, as RFC 5280 requires.
+  return y < 2050 ? tlv(0x17, Buffer.from(String(y).slice(2) + s)) : tlv(0x18, Buffer.from(String(y) + s));
+}
+
+const ECDSA_SHA256 = seq(oid('1.2.840.10045.4.3.2'));
+const name = (cn) => seq(set(seq(oid('2.5.4.3'), utf8(cn))));
+const ext = (id, critical, value) => seq(oid(id), ...(critical ? [bool(true)] : []), octets(value));
+
+function keyId(publicKey) {
+  // The key identifier is the SHA-1 of the subjectPublicKey bits (RFC 5280, method 1).
+  const spki = publicKey.export({ type: 'spki', format: 'der' });
+  return crypto.createHash('sha1').update(spki.subarray(spki.length - 65)).digest();
+}
+
+function certificate({ subject, issuer, publicKey, signingKey, days, extensions }) {
+  const notBefore = new Date(Date.now() - 60 * 60 * 1000);   // an hour back, for a skewed clock
+  const notAfter = new Date(notBefore.getTime() + days * 86400000);
+  const serial = crypto.randomBytes(16);
+  serial[0] &= 0x7f;
+  const tbs = seq(
+    tlv(0xa0, int([2])),                       // v3
+    int(serial),
+    ECDSA_SHA256,
+    name(issuer),
+    seq(time(notBefore), time(notAfter)),
+    name(subject),
+    publicKey.export({ type: 'spki', format: 'der' }),
+    tlv(0xa3, seq(...extensions))
+  );
+  const sig = crypto.sign('sha256', tbs, signingKey);
+  const der = seq(tbs, ECDSA_SHA256, bits(sig));
+  return `-----BEGIN CERTIFICATE-----\n${der.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
+}
+
+const newKey = () => crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+const pemKey = (k) => k.export({ type: 'sec1', format: 'pem' });
+
+/** A leaf for `hosts`, signed by the CA in `dir`. Returns the PEM strings; writes nothing. */
+export function signLeaf(dir, hosts) {
+  const caKey = crypto.createPrivateKey(fs.readFileSync(path.join(dir, 'ca.key')));
+  const caCert = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'ca.pem')));
+  const { publicKey, privateKey } = newKey();
+  const cert = certificate({
+    subject: 'llm-switcher',
+    issuer: 'LLM Switcher Local CA',
+    publicKey,
+    signingKey: caKey,
+    days: LEAF_DAYS,
+    extensions: [
+      ext('2.5.29.19', true, seq()),                                  // basicConstraints CA:FALSE
+      ext('2.5.29.15', true, bits(Buffer.from([0xa0]), 5)),           // digitalSignature, keyEncipherment
+      ext('2.5.29.37', false, seq(oid('1.3.6.1.5.5.7.3.1'))),         // extendedKeyUsage serverAuth
+      ext('2.5.29.17', false, seq(...hosts.map(dnsName))),            // subjectAltName
+      ext('2.5.29.14', false, octets(keyId(publicKey))),
+      ext('2.5.29.35', false, seq(tlv(0x80, keyId(caCert.publicKey))))
+    ]
+  });
+  return { cert, key: pemKey(privateKey) };
+}
+
+function writePrivate(dir, files) {
+  // Write each file beside its target and rename it into place: a failed run keeps the last set,
+  // and a rename replaces a planted symlink instead of writing through it.
+  const staged = [];
+  for (const [f, body] of Object.entries(files)) {
+    const tmpFile = path.join(dir, `.${f}.${process.pid}.tmp`);
+    fs.writeFileSync(tmpFile, body, { mode: 0o600, flag: 'wx' });
+    staged.push([tmpFile, path.join(dir, f)]);
+  }
+  for (const [from, to] of staged) fs.renameSync(from, to);
+}
+
+function privateDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') {
+    const st = fs.lstatSync(dir);
+    if (!st.isDirectory() || st.uid !== process.getuid()) {
+      throw new Error(`${dir} is not a directory you own; the CA key cannot go there`);
+    }
+    fs.chmodSync(dir, 0o700);
+  }
+}
+
+/** A new CA and leaf in `dir`, the set make-certs.sh builds. */
+export function buildCerts(dir, hosts) {
+  privateDir(dir);
+  const { publicKey, privateKey } = newKey();
+  const caPem = certificate({
+    subject: 'LLM Switcher Local CA',
+    issuer: 'LLM Switcher Local CA',
+    publicKey,
+    signingKey: privateKey,
+    days: CA_DAYS,
+    extensions: [
+      ext('2.5.29.19', true, seq(bool(true), int([0]))),              // CA:TRUE, pathlen:0
+      ext('2.5.29.15', true, bits(Buffer.from([0x06]), 1)),           // keyCertSign, cRLSign
+      ext('2.5.29.14', false, octets(keyId(publicKey))),
+      // A leaked ca.key can then sign only for the host table.
+      ext('2.5.29.30', true, seq(tlv(0xa0, ...hosts.map(h => seq(dnsName(h))))))
+    ]
+  });
+  writePrivate(dir, { 'ca.key': pemKey(privateKey), 'ca.pem': caPem });
+  writeLeaf(dir, hosts);
+}
+
+/** A new leaf in `dir` on the CA already there. */
+export function writeLeaf(dir, hosts) {
+  privateDir(dir);
+  const { cert, key } = signLeaf(dir, hosts);
+  writePrivate(dir, { 'leaf.key': key, 'leaf.pem': cert });
+}

package/docs/codex-blindfold.md

@@ -72,12 +72,14 @@ You need:
 
 ## Procedure
 
-### 1. Build the certificates
+### 1. The certificates
 
-Run this command in the repository root:
+You do not have to build them. When a tool is switched on and the certificates are missing, the switcher builds them with Node's crypto. It builds a new leaf when the leaf is missing, does not cover the three hosts, or does not match its key. It keeps a CA that still works, because Codex already trusts that CA. The set is the one that `make-certs.sh` builds: an EC P-256 CA with name constraints, and a leaf with `serverAuth` for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`.
+
+To build the set yourself with OpenSSL, run this command in the repository root:
 
 ```bash
-bash blindfold/make-certs.sh chatgpt.com
+bash blindfold/make-certs.sh
 ```
 
 The script writes `blindfold/certs/ca.pem` and `blindfold/certs/leaf.pem`. It prints the extended key usage and the subject alternative name of the leaf. Make sure that the output contains `TLS Web Server Authentication`.
@@ -212,7 +214,7 @@ The switcher writes `LLM_SWITCHER_CODEX_BASE_URL` again, the gateway stops the i
 
 Read this section before you turn blindfold mode on.
 
-**The CA is trusted for every host that Codex contacts.** `CODEX_CA_CERTIFICATE` adds this authority to the trust store that Codex uses for all of its HTTPS calls. A CA that `make-certs.sh` builds now carries name constraints: it can sign only for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`. A client that obeys name constraints refuses any other certificate from this CA. OpenSSL, rustls and the macOS and Windows verifiers obey them. A CA that an older version built has no constraint. Anybody who can read its `ca.key` can forge a certificate for any host. Run `make-certs.sh` again to replace it, and keep `blindfold/certs/` private in both cases.
+**The CA is trusted for every host that Codex contacts.** `CODEX_CA_CERTIFICATE` adds this authority to the trust store that Codex uses for all of its HTTPS calls. A CA that the switcher or `make-certs.sh` builds carries name constraints: it can sign only for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`. A client that obeys name constraints refuses any other certificate from this CA. OpenSSL, rustls and the macOS and Windows verifiers obey them. A CA that an older version built has no constraint. Anybody who can read its `ca.key` can forge a certificate for any host. Run `make-certs.sh` again to replace it, and keep `blindfold/certs/` private in both cases.
 
 **All traffic to the intercepted host is decrypted by this process.** That includes sign-in and token refresh, because the CONNECT for the whole host is terminated locally. Requests outside the Codex API path are re-originated to the real host over a new TLS session; they are forwarded, not tunneled. The `--verbose` flag prints the method and path of every such request.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -1078,12 +1078,30 @@ async function fetchModels(body, cfg) {
   const r = await fetch(`${baseURL}/models`, { headers, signal: upstreamTimeout(15000) });
   if (!r.ok) return { status: 200, json: { ok: false, status: r.status, error: (await r.text()).slice(0, 2000) } };
   const data = await r.json();
-  let list = [];
-  if (Array.isArray(data.data)) list = data.data.map(m => (typeof m === 'string' ? m : m.id));
-  else if (Array.isArray(data)) list = data.map(m => (typeof m === 'string' ? m : m.id));
-  else if (Array.isArray(data.models)) list = data.models.map(m => (typeof m === 'string' ? m : (m.id || m.name)));
-  list = [...new Set(list.filter(Boolean).map(id => String(id).replace(/^models\//, '')))].sort();
-  return { status: 200, json: { ok: true, models: list } };
+  const entries = Array.isArray(data.data) ? data.data : Array.isArray(data) ? data : Array.isArray(data.models) ? data.models : [];
+  const idOf = m => String(typeof m === 'string' ? m : (m?.id || m?.name || '')).replace(/^models\//, '');
+  const list = [...new Set(entries.map(idOf).filter(Boolean))].sort();
+  const limits = {};
+  for (const m of entries) {
+    const l = modelLimits(m);
+    if (l) limits[idOf(m)] = l;
+  }
+  return { status: 200, json: { ok: true, models: list, limits } };
+}
+
+// A listed model's token limits, as intact and OpenRouter write them. Null when the list gives none.
+function modelLimits(m) {
+  if (!m || typeof m !== 'object') return null;
+  const n = v => (Number.isFinite(v) && v > 0 ? v : 0);
+  const top = m.top_provider && typeof m.top_provider === 'object' ? m.top_provider : {};
+  const out = {};
+  const context = n(m.context_length) || n(top.context_length) || n(m.context_window);
+  const input = n(m.max_input_tokens);
+  const output = n(m.max_output_tokens) || n(top.max_completion_tokens);
+  if (context) out.context = context;
+  if (input) out.input = input;
+  if (output) out.output = output;
+  return Object.keys(out).length ? out : null;
 }
 
 // Vertex/Gemini: /v1beta/models/{m}:{action} (Gemini API) and

package/state.mjs

@@ -12,6 +12,7 @@ import crypto from 'node:crypto';
 import http from 'node:http';
 import { spawn, execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { buildCerts, writeLeaf } from './blindfold/certs.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -1743,6 +1744,32 @@ export async function stopRecordedBlindfold() {
   return { ok: stopped, ...(stopped ? {} : { error: `the interceptor on port ${prev.port} did not stop` }) };
 }
 
+// A CA that still works is kept when the leaf is rebuilt: Codex already trusts it.
+function caUsable(dir) {
+  try {
+    const ca = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'ca.pem')));
+    return ca.ca && Date.parse(ca.validTo) > Date.now() + 86400000
+      && ca.checkPrivateKey(crypto.createPrivateKey(fs.readFileSync(path.join(dir, 'ca.key'))));
+  } catch {
+    return false;
+  }
+}
+
+/** Builds the certificates when they are missing or unusable, then returns what the preflight
+ * says of them: null when the interceptor can start. */
+export function ensureBlindfoldCerts(desired) {
+  const problem = blindfoldPreflight(desired);
+  if (!problem) return null;
+  const dir = path.dirname(desired.ca);
+  try {
+    if (caUsable(dir)) writeLeaf(dir, INTERCEPT_HOSTS);
+    else buildCerts(dir, INTERCEPT_HOSTS);
+  } catch (err) {
+    return `${problem} Building them failed: ${err.message}`;
+  }
+  return blindfoldPreflight(desired);
+}
+
 /** null when the interceptor can start, otherwise the reason and the command that fixes it. */
 export function blindfoldPreflight(desired) {
   const certDir = path.dirname(desired.ca);
@@ -1810,11 +1837,12 @@ function spawnBlindfold(desired, gatewayPort) {
   return child.pid;
 }
 
-/** null when the interceptor that cfg asks for can run, otherwise the reason. No side effects. */
+/** null when the interceptor that cfg asks for can run, otherwise the reason. Builds missing or
+ * outdated certificates on the way; changes nothing else. */
 export async function checkBlindfoldTarget(cfg, gatewayPort) {
   const desired = computeLaunchState(cfg, gatewayPort).blindfold;
   if (!desired) return null;
-  const problem = blindfoldPreflight(desired);
+  const problem = ensureBlindfoldCerts(desired);
   if (problem) return problem;
   const held = (await probeBlindfold(desired.port)).state;
   if (held === 'foreign') return `Port ${desired.port} is held by another process, not by this switcher's interceptor.`;

package/switch.mjs

@@ -8,7 +8,7 @@ import {
   resolvePort, parsePort, findProfileKey, getActiveMap, setTargetProfile, activateProfile, deactivateAll,
   applyLaunchState, clearLaunchState, computeLaunchState,
   modelSlotsForProfile, modelForSlot, model1MForSlot, readAdminToken, adminTokenPath, openLog,
-  probeGateway, probeBlindfold, blindfoldPreflight, stopRecordedBlindfold, writeDashboardLauncher,
+  probeGateway, probeBlindfold, ensureBlindfoldCerts, stopRecordedBlindfold, writeDashboardLauncher,
   contractLabSettings, codexPublicModelsWarning,
   getMigrationError, getMigrationCollision, getLastLoadError,
   casClearToolPointers, emptyToolEnvFiles, syncInterceptorTools
@@ -362,10 +362,11 @@ function planSwitch(base, key, cliTarget) {
 
 function refuseBlindfoldProblem(planned, port) {
   const bf = computeLaunchState(planned, port).blindfold;
-  const problem = bf && blindfoldPreflight(bf);
+  // A missing or outdated certificate is built here; only a set that cannot be built stops the switch.
+  const problem = bf && ensureBlindfoldCerts(bf);
   if (!problem) return bf;
   console.error(`[Error] ${problem}`);
-  console.error('        Fix the certificate with: bash blindfold/make-certs.sh - it names all three hosts this switcher routes. Nothing was changed.');
+  console.error('        Nothing was changed.');
   process.exit(1);
 }
 
@@ -959,14 +960,14 @@ async function runDoctor() {
   const leafPath = path.join(path.dirname(paths.blindfoldCA), 'leaf.pem');
   if (!fs.existsSync(leafPath)) {
     warn(`[WARN] No interceptor certificate at ${leafPath}: neither tool can be intercepted.`);
-    console.log('        Fix: bash blindfold/make-certs.sh');
+    console.log('        Fix: switch a tool on; the switcher builds the certificate. Or run bash blindfold/make-certs.sh');
   } else {
     try {
       const pem = fs.readFileSync(leafPath, 'utf8');
       const missing = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com'].filter(h => !certCoversHost(pem, h));
       if (missing.length) {
         warn(`[WARN] The interceptor certificate does not cover ${missing.join(', ')}.`);
-        console.log('        Fix: bash blindfold/make-certs.sh   (it names all three hosts this switcher routes)');
+        console.log('        Fix: switch a tool on; the switcher rebuilds the certificate on the same CA. Or run bash blindfold/make-certs.sh');
       } else {
         console.log('[PASS] Interceptor certificate covers api.anthropic.com, api.openai.com and chatgpt.com.');
       }

package/tests/certs.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import tls from 'node:tls';
+import { execFileSync } from 'node:child_process';
+import { buildCerts, signLeaf } from '../blindfold/certs.mjs';
+import { blindfoldPreflight, ensureBlindfoldCerts, INTERCEPT_HOSTS } from '../state.mjs';
+
+const HAS_OPENSSL = (() => { try { execFileSync('openssl', ['version'], { stdio: 'ignore' }); return true; } catch { return false; } })();
+
+function tmp(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-certs-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return path.join(dir, 'certs');
+}
+
+const desiredFor = (dir) => ({ ca: path.join(dir, 'ca.pem') });
+
+test('buildCerts writes a CA and a leaf that the preflight accepts, private to the owner', (t) => {
+  const dir = tmp(t);
+  buildCerts(dir, INTERCEPT_HOSTS);
+  for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) {
+    assert.ok(fs.existsSync(path.join(dir, f)), f);
+    if (process.platform !== 'win32') assert.equal(fs.statSync(path.join(dir, f)).mode & 0o777, 0o600, f);
+  }
+  if (process.platform !== 'win32') assert.equal(fs.statSync(dir).mode & 0o777, 0o700);
+  assert.equal(blindfoldPreflight(desiredFor(dir)), null);
+  const ca = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'ca.pem')));
+  assert.equal(ca.ca, true);
+  const leaf = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'leaf.pem')));
+  assert.equal(leaf.ca, false);
+  for (const h of INTERCEPT_HOSTS) assert.equal(leaf.checkHost(h), h);
+});
+
+test('a TLS client that trusts only the CA completes a handshake for every host', async (t) => {
+  const dir = tmp(t);
+  buildCerts(dir, INTERCEPT_HOSTS);
+  const server = tls.createServer({ key: fs.readFileSync(path.join(dir, 'leaf.key')), cert: fs.readFileSync(path.join(dir, 'leaf.pem')) }, s => s.end('ok'));
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  t.after(() => server.close());
+  for (const host of INTERCEPT_HOSTS) {
+    const got = await new Promise((resolve, reject) => {
+      const s = tls.connect({ port: server.address().port, host: '127.0.0.1', servername: host, ca: fs.readFileSync(path.join(dir, 'ca.pem')) }, () => {
+        s.once('data', d => { resolve(String(d)); s.end(); });
+      });
+      s.on('error', reject);
+    });
+    assert.equal(got, 'ok', host);
+  }
+});
+
+test('openssl verifies the leaf, and the name constraints refuse a leaf for another host', { skip: !HAS_OPENSSL && 'openssl' }, (t) => {
+  const dir = tmp(t);
+  buildCerts(dir, INTERCEPT_HOSTS);
+  const out = execFileSync('openssl', ['verify', '-CAfile', path.join(dir, 'ca.pem'), path.join(dir, 'leaf.pem')], { encoding: 'utf8' });
+  assert.match(out, /OK/);
+  // A leaked ca.key signs for any name; a client that obeys the constraints must refuse it.
+  const evil = path.join(dir, 'evil.pem');
+  fs.writeFileSync(evil, signLeaf(dir, ['evil.example']).cert);
+  assert.throws(() => execFileSync('openssl', ['verify', '-CAfile', path.join(dir, 'ca.pem'), evil], { stdio: 'pipe' }), /permitted subtree violation/);
+});
+
+test('ensureBlindfoldCerts builds a missing set, rebuilds a missing leaf on the same CA, and leaves a good set alone', (t) => {
+  const dir = tmp(t);
+  assert.match(blindfoldPreflight(desiredFor(dir)), /ca\.pem is missing/);
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  const ca = fs.readFileSync(path.join(dir, 'ca.pem'), 'utf8');
+  const leaf = fs.readFileSync(path.join(dir, 'leaf.pem'), 'utf8');
+
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  assert.equal(fs.readFileSync(path.join(dir, 'leaf.pem'), 'utf8'), leaf, 'a good set is not rebuilt');
+
+  fs.rmSync(path.join(dir, 'leaf.pem'));
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  assert.equal(fs.readFileSync(path.join(dir, 'ca.pem'), 'utf8'), ca, 'the CA Codex already trusts is kept');
+  assert.notEqual(fs.readFileSync(path.join(dir, 'leaf.pem'), 'utf8'), leaf);
+
+  // A leaf from an older version covers one host only.
+  fs.writeFileSync(path.join(dir, 'leaf.pem'), signLeaf(dir, ['api.openai.com']).cert);
+  assert.match(blindfoldPreflight(desiredFor(dir)), /does not cover/);
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  assert.equal(fs.readFileSync(path.join(dir, 'ca.pem'), 'utf8'), ca);
+});

package/tests/gateway.e2e.test.mjs

@@ -265,6 +265,12 @@ after(() => {
   fakeInterceptor?.kill();
   proxy?.kill();
   upstream?.close();
+  // A test that changes the tool set makes the gateway start a real interceptor. It is detached on
+  // purpose, so it outlives the gateway; stop the one the gateway recorded before its state goes.
+  try {
+    const { pid } = JSON.parse(fs.readFileSync(path.join(tmpDir, 'blindfold.json'), 'utf8'));
+    if (Number.isInteger(pid) && pid !== fakeInterceptor?.pid) process.kill(pid);
+  } catch {}
   if (tmpDir) fs.rmSync(tmpDir, { recursive: true, force: true });
 });
 
@@ -659,6 +665,36 @@ test('Security: the admin API refuses a caller without the token and changes not
   }
 });
 
+// The model list carries each model's token limits, as intact and OpenRouter give them, so the
+// 1M context box can be locked for a model known to be smaller.
+test('Browse Models returns the token limits the gateway lists', async () => {
+  const sink = http.createServer((req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ data: [
+      { id: 'big', context_length: 1048576, max_output_tokens: 65536 },
+      { id: 'small', context_length: 200000 },
+      { id: 'or', top_provider: { context_length: 262144, max_completion_tokens: 32768 } },
+      { id: 'in', max_input_tokens: 1000000 },
+      { id: 'bare' }
+    ] }));
+  });
+  await new Promise(r => sink.listen(0, '127.0.0.1', r));
+  try {
+    const r = await post('/api/fetch-models', { baseURL: `http://127.0.0.1:${sink.address().port}` });
+    const data = await r.json();
+    assert.equal(data.ok, true);
+    assert.deepEqual(data.models, ['bare', 'big', 'in', 'or', 'small']);
+    assert.deepEqual(data.limits, {
+      big: { context: 1048576, output: 65536 },
+      small: { context: 200000 },
+      or: { context: 262144, output: 32768 },
+      in: { input: 1000000 }
+    });
+  } finally {
+    sink.close();
+  }
+});
+
 test('Admin API: keys are redacted and invalid switch input is rejected', async () => {
   const status = await (await fetch(url('/api/status'), { headers: withToken('/api/status', {}) })).json();
   assert.ok(!JSON.stringify(status).includes('sk-secret'));

package/tests/lifecycle.test.mjs

@@ -167,40 +167,53 @@ test('switch on refuses a foreign gateway port and changes nothing', { skip: !PO
   }
 });
 
-test('switch codex <blindfold profile> refuses missing certificates, a missing leaf.key and a foreign interceptor port, changing nothing', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
+// A missing or outdated certificate set is built before anything else is checked, so turning a
+// Codex profile on never stops at the certificates. A squatter on the interceptor port keeps the
+// switch refused here, which shows the build ran first and that nothing else changed.
+test('switch codex <blindfold profile> builds missing certificates and a missing leaf.key, and refuses a foreign interceptor port, changing nothing else', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
   const cases = [];
+  const squatter = net.createServer(s => s.end('HTTP/1.1 200 OK\r\n\r\nnot the switcher'));
+  const bfPort = await new Promise(r => squatter.listen(0, '127.0.0.1', () => r(squatter.address().port)));
   try {
     // 1. no certificates at all
     const a = makeWorkspace(); cases.push(a);
-    writeConfig(a, await freePort(), await freePort());
     // 2. leaf.key missing
     const b = makeWorkspace({ certs: true }); cases.push(b);
     fs.rmSync(path.join(b.certDir, 'leaf.key'));
-    writeConfig(b, await freePort(), await freePort());
-    // 3. valid certificates, but another process holds the interceptor port
+    const caBefore = fs.readFileSync(path.join(b.certDir, 'ca.pem'), 'utf8');
+    // 3. valid certificates
     const c = makeWorkspace({ certs: true }); cases.push(c);
-    const squatter = net.createServer(s => s.end('HTTP/1.1 200 OK\r\n\r\nnot the switcher'));
-    const bfPort = await new Promise(r => squatter.listen(0, '127.0.0.1', () => r(squatter.address().port)));
-    writeConfig(c, await freePort(), bfPort);
-    try {
-      for (const [ws, why] of [[a, /missing/], [b, /leaf\.key is missing/], [c, /held by another process/]]) {
-        const before = fs.readFileSync(ws.cfgPath);
-        const launch = snapshotLaunchFiles(ws.dir);
-        const r = await runSwitch(ws, ['codex', 'bf']);
-        assert.notEqual(r.status, 0, r.stdout);
-        assert.match(r.stderr, why);
-        assert.deepEqual(fs.readFileSync(ws.cfgPath), before, 'config.json is byte-identical');
-        assert.ok(!fs.existsSync(path.join(ws.dir, 'blindfold.json')));
-        assert.deepEqual(snapshotLaunchFiles(ws.dir), launch, 'no launcher file changed');
-      }
-    } finally {
-      squatter.close();
+    for (const ws of cases) writeConfig(ws, await freePort(), bfPort);
+    for (const ws of cases) {
+      const before = fs.readFileSync(ws.cfgPath);
+      const launch = snapshotLaunchFiles(ws.dir);
+      const r = await runSwitch(ws, ['codex', 'bf']);
+      assert.notEqual(r.status, 0, r.stdout);
+      assert.match(r.stderr, /held by another process/);
+      assert.doesNotMatch(r.stderr, /missing/);
+      assert.equal(await probe(ws, `s.blindfoldPreflight({ ca: ${JSON.stringify(path.join(ws.certDir, 'ca.pem'))} })`), null, 'the certificates are usable now');
+      assert.deepEqual(fs.readFileSync(ws.cfgPath), before, 'config.json is byte-identical');
+      assert.ok(!fs.existsSync(path.join(ws.dir, 'blindfold.json')));
+      assert.deepEqual(snapshotLaunchFiles(ws.dir), launch, 'no launcher file changed');
     }
+    assert.equal(fs.readFileSync(path.join(b.certDir, 'ca.pem'), 'utf8'), caBefore, 'a working CA is kept: Codex already trusts it');
   } finally {
+    squatter.close();
     for (const ws of cases) fs.rmSync(ws.dir, { recursive: true, force: true });
   }
 });
 
+test('the gateway check builds a missing certificate set instead of refusing the change', { skip: !POSIX && 'posix' }, async () => {
+  const ws = makeWorkspace();
+  try {
+    writeConfig(ws, await freePort(), await freePort(), 'bf');
+    assert.equal(await probe(ws, `s.checkBlindfoldTarget(s.loadConfig(), s.loadConfig().port)`), null);
+    for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(ws.certDir, f)), f);
+  } finally {
+    fs.rmSync(ws.dir, { recursive: true, force: true });
+  }
+});
+
 test('the gateway owns the interceptor: dashboard changes, a lost interceptor and a gateway restart are reconciled', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
   const ws = makeWorkspace({ certs: true });
   const gwPort = await freePort();
@@ -300,12 +313,20 @@ test('concurrent admin changes: a refused change never reaches disk, and no acce
     assert.equal(onDisk.activeProfiles.codex, null, 'the refused switch is not saved by the other request');
     assert.equal(onDisk.profiles.plain.name, 'Renamed');
 
-    // A usable interceptor port, and Codex on, for the second half. Chosen only now: other test files
-    // run at the same time, and a port picked seconds earlier can be taken in between.
-    bfPort = await freePort();
-    onDisk.blindfold = { port: bfPort };
-    fs.writeFileSync(ws.cfgPath, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
-    const on = await post('/api/switch', { target: 'codex', profile: 'bf' });
+    // A usable interceptor port, and Codex on, for the second half. Other test files run at the
+    // same time and can bind a port between freePort() and the gateway's check; the gateway then
+    // rightly refuses it, so a refusal for a taken port picks another one.
+    let on;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      bfPort = await freePort();
+      onDisk.blindfold = { port: bfPort };
+      fs.writeFileSync(ws.cfgPath, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
+      on = await post('/api/switch', { target: 'codex', profile: 'bf' });
+      if (on.status === 200) break;
+      const why = await on.clone().text();
+      if (!/held by another process|does not answer/.test(why)) break;
+      onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8'));
+    }
     assert.equal(on.status, 200, await on.text());
     await waitFor(async () => (await probe(ws, `s.probeBlindfold(${bfPort})`)).state === 'ours');
     const postProfile = (body) => post('/api/save-profile', body);

package/tests/state.test.mjs

@@ -653,13 +653,18 @@ test('isSafeModelName refuses TOML date-times with T and Z', () => {
 test('an empty launch lock is held, not taken over', async (t) => {
   const { dir, env } = tmpDirs(t);
   const lock = path.join(dir, '.launch.lock');
+  const started = path.join(dir, 'writer.started');
   fs.writeFileSync(lock, '');
-  setTimeout(() => fs.rmSync(lock, { force: true }), 400);
-  const waited = await new Promise((resolve, reject) => {
+  const done = new Promise((resolve, reject) => {
     execFileCb(process.execPath, ['--input-type=module', '-e',
-      `const s = await import(${JSON.stringify(pathToFileURL(path.join(ROOT_DIR, 'state.mjs')).href)}); const t0 = Date.now(); s.applyLaunchState(s.loadConfig(), 4000); console.log(Date.now() - t0);`],
+      `const s = await import(${JSON.stringify(pathToFileURL(path.join(ROOT_DIR, 'state.mjs')).href)}); (await import('node:fs')).writeFileSync(${JSON.stringify(started)}, ''); const t0 = Date.now(); s.applyLaunchState(s.loadConfig(), 4000); console.log(Date.now() - t0);`],
     { env: { ...process.env, LLM_SWITCHER_PORT: '', ...env }, encoding: 'utf8' }, (err, out) => (err ? reject(err) : resolve(Number(out.trim()))));
   });
+  // The 400 ms count from the writer's start: a slow start under a loaded suite must not find the
+  // lock already gone.
+  for (let i = 0; i < 1000 && !fs.existsSync(started); i++) await new Promise(r => setTimeout(r, 10));
+  setTimeout(() => fs.rmSync(lock, { force: true }), 400);
+  const waited = await done;
   // Taken over at once, the write would take a few ms.
   assert.ok(waited >= 100 && waited < 4000, `the writer waited ${waited} ms`);
   assert.equal(fs.existsSync(lock), false);

package/tests/ui.test.mjs

@@ -88,3 +88,23 @@ test('a profile without outFormat keeps auto routing through a save', () => {
   assert.match(html, /<select id="p-outformat">\s*<option value="">/);
   assert.match(html, /getElementById\('p-outformat'\)\.value = p\.outFormat \|\| '';/);
 });
+
+// The 1M box is locked only when the model's window is known and under 1M. An unknown window
+// only warns: many gateways list no limits at all.
+test('contextVerdict locks only a window known to be under 1M', () => {
+  const verdict = new Function(functionBody('contextVerdict') + '\n    }\n    return contextVerdict;')();
+  assert.equal(verdict(undefined).kind, 'unknown');
+  assert.equal(verdict({ output: 32000 }).kind, 'unknown');
+  assert.equal(verdict({ context: 200000 }).kind, 'small');
+  assert.equal(verdict({ context: 200000 }).window, 200000);
+  assert.equal(verdict({ input: 1000000 }).kind, 'ok');
+  assert.equal(verdict({ context: 1048576 }).kind, 'ok');
+});
+
+test('each 1M box names its slot and points at its note', () => {
+  const slots = functionBody('renderModelSlots');
+  assert.match(slots, /aria-label="1M context for \$\{escapeHtml\(s\.name\)\}"/);
+  assert.match(slots, /aria-describedby="p-\$\{s\.id\}-1m-note"/);
+  assert.match(slots, /class="slot-1m-note" id="p-\$\{s\.id\}-1m-note" role="status"/);
+  assert.doesNotMatch(html, /\.slot-1m-note:empty \{ display: none/);
+});

package/ui.html

@@ -530,6 +530,11 @@
 
     /* Model slot combobox: one listbox per slot, provider prefix dimmed, match in the accent. */
     .combo { position: relative; }
+    .slot-1m-note { font-size: 0.72rem; color: var(--faint); }
+    /* Kept in the page when empty: a live region added later is often not read. */
+    .slot-1m-note:empty { margin-top: -0.25rem; }
+    .slot-1m-note.warn { color: var(--warn); }
+    .slot-1m-note.err { color: var(--err); }
     .combo > input { padding-right: 2.25rem; font-family: var(--font-mono); font-size: 0.8rem; }
     .combo-toggle {
       position: absolute; right: 4px; top: 4px; width: 28px; height: 28px;
@@ -1138,6 +1143,7 @@
     let formLoadedKey = null;
     let formDirty = false;
     let loadedModels = [];
+    let loadedLimits = {};   // model id -> { context, input, output }, as the gateway lists them
     let currentProfileBuffer = null;
     let renderedSlotFormat = 'auto';
     let logRefreshTimer = null;
@@ -1436,17 +1442,18 @@
           <div style="display:flex; justify-content:space-between; align-items:center;">
             <label for="p-${s.id}" style="font-size:0.82rem; font-weight:500;">${escapeHtml(s.name)}</label>
             <label style="display:flex; align-items:center; gap:0.35rem; font-size:0.75rem; color:var(--accent); cursor:pointer;">
-              <input type="checkbox" id="p-${s.id}-1m" style="width:13px; height:13px; min-height:0;" onchange="update1mWarnings()" ${checked ? 'checked' : ''}>
+              <input type="checkbox" id="p-${s.id}-1m" aria-label="1M context for ${escapeHtml(s.name)}" aria-describedby="p-${s.id}-1m-note" style="width:13px; height:13px; min-height:0;" onchange="update1mWarnings()" ${checked ? 'checked' : ''}>
               1M context
             </label>
           </div>
           <div class="combo">
-            <input type="text" id="p-${s.id}" role="combobox" aria-autocomplete="list" aria-expanded="false" aria-controls="p-${s.id}-list" autocomplete="off" spellcheck="false" placeholder="${escapeHtml(s.placeholder)}" value="${escapeHtml(val)}">
+            <input type="text" id="p-${s.id}" oninput="update1mWarnings()" role="combobox" aria-autocomplete="list" aria-expanded="false" aria-controls="p-${s.id}-list" autocomplete="off" spellcheck="false" placeholder="${escapeHtml(s.placeholder)}" value="${escapeHtml(val)}">
             <button type="button" class="combo-toggle" tabindex="-1" aria-label="Show models for ${escapeHtml(s.name)}">
               <svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 6l4 4 4-4"/></svg>
             </button>
             <ul class="combo-list" id="p-${s.id}-list" role="listbox" aria-label="${escapeHtml(s.name)} models" hidden></ul>
           </div>
+          <div class="slot-1m-note" id="p-${s.id}-1m-note" role="status" aria-live="polite"></div>
         `;
         container.appendChild(slotRow);
         wireCombo(slotRow.querySelector('.combo'));
@@ -1482,12 +1489,43 @@
       return { defaultModels, model1M };
     }
 
+    // A window known to be under 1M locks the box; an unknown one only warns, since many
+    // gateways list no limits at all.
+    function contextVerdict(l) {
+      const window = (l && (l.context || l.input)) || 0;
+      if (!window) return { kind: 'unknown', window: 0 };
+      return { kind: window >= 1000000 ? 'ok' : 'small', window };
+    }
+
+    // 128000 reads as 128K and 262144 as 256K: a round decimal count keeps base 1000.
+    function fmtTokens(n) {
+      const b = n % 1000 === 0 ? 1000 : 1024;
+      return n >= b * b ? +(n / b / b).toFixed(1) + 'M' : n >= b ? Math.round(n / b) + 'K' : String(n);
+    }
+
     function update1mWarnings() {
       const cfg = getActiveSlotConfig(renderedSlotFormat);
       let any1m = false;
       for (const s of cfg.slots) {
         const chk = document.getElementById('p-' + s.id + '-1m');
-        if (chk && chk.checked) any1m = true;
+        const note = document.getElementById('p-' + s.id + '-1m-note');
+        const model = document.getElementById('p-' + s.id)?.value.trim() || '';
+        if (!chk) continue;
+        const v = contextVerdict(model ? loadedLimits[model] : null);
+        const locked = v.kind === 'small';
+        if (locked) chk.checked = false;
+        chk.disabled = locked;
+        chk.closest('label').style.opacity = locked ? '0.5' : '';
+        chk.closest('label').style.cursor = locked ? 'not-allowed' : 'pointer';
+        if (note) {
+          let text = '', cls = '';
+          if (locked) { text = `Context ${fmtTokens(v.window)} is under 1M, so 1M context is off for this model.`; cls = 'err'; }
+          else if (v.kind === 'ok') text = `Context ${fmtTokens(v.window)}.`;
+          else if (chk.checked && model) { text = 'The gateway does not list this model\'s context. Make sure it takes 1M tokens.'; cls = 'warn'; }
+          note.textContent = text;
+          note.className = 'slot-1m-note' + (cls ? ' ' + cls : '');
+        }
+        if (chk.checked) any1m = true;
       }
       const warnCallout = document.getElementById('warn-1m-callout');
       if (warnCallout) warnCallout.style.display = any1m ? 'inline-flex' : 'none';
@@ -2058,6 +2096,7 @@
         if (request !== modelsRequest) return;   // a newer load started while this one waited
         if (data.ok && Array.isArray(data.models)) {
           loadedModels = data.models;
+          loadedLimits = data.limits || {};
           modelsLoadedFor = source;
           setModelsStatus('ready', loadedModels.length + (loadedModels.length === 1 ? ' model' : ' models'), 'Reload');
         } else {
@@ -2072,6 +2111,7 @@
         setModelsStatus('error', 'Models not loaded: ' + err.message, 'Retry');
       }
       document.querySelectorAll('.combo[data-open]').forEach(renderComboOptions);
+      update1mWarnings();
     }
 
     // Slot combobox (ARIA combobox with a listbox). Typing filters; the arrow opens the full list.
@@ -2188,6 +2228,7 @@
       if (!model) return;
       combo.querySelector('input').value = model;
       closeCombo(combo);
+      update1mWarnings();
     }
 
     function onComboKeydown(e) {