myapikey 0.12.0 → 0.14.0

package/README.md

@@ -158,6 +158,22 @@ Quick smoke test without any tool:
 myapikey call gpt-4o-mini "Say hello in one sentence."
 ```
 
+**Why two base URLs?** The gateway exposes two separate agent surfaces — `/openai/v1` and `/anthropic/v1` — each with its own `GET /models` (an OpenAI client discovers only openai-enabled models, an Anthropic client only anthropic-enabled ones). Each ecosystem's SDK appends its own paths, so the OpenAI SDK points at `…/openai/v1` (it appends `/chat/completions`, `/responses`, `/models`) and the Anthropic SDK / Claude Code points at `…/anthropic` (it appends `/v1/messages`, `/v1/models`).
+
+**Raw HTTP** (no SDK) — hit either surface directly with the gateway API key as a `Bearer` token:
+
+```bash
+# OpenAI family
+curl http://localhost:7800/openai/v1/chat/completions \
+  -H "Authorization: Bearer <gateway api key>" -H "Content-Type: application/json" \
+  -d '{"model":"<model>","messages":[{"role":"user","content":"hi"}]}'
+
+# Anthropic family
+curl http://localhost:7800/anthropic/v1/messages \
+  -H "Authorization: Bearer <gateway api key>" -H "Content-Type: application/json" \
+  -d '{"model":"<model>","max_tokens":16,"messages":[{"role":"user","content":"hi"}]}'
+```
+
 Whichever endpoint you point a tool at, the gateway forwards in that format and never translates — so make sure each model you call is backed by at least one source on the matching slot ([see below](#how-routing-works)).
 
 ---
@@ -239,9 +255,9 @@ It's the same admin API the CLI uses — configure either way.
 
 - `POST /openai/v1/chat/completions` — OpenAI-format proxy
 - `POST /openai/v1/responses` — OpenAI Responses API (only sources marked `supportsResponses`)
-- `GET /openai/v1/models` — models enabled on the **openai** slot, OpenAI list shape
+- `GET /openai/v1/models` — models enabled on the **openai** slot, OpenAI list shape (public — no key needed)
 - `POST /anthropic/v1/messages` — Anthropic-format proxy
-- `GET /anthropic/v1/models` — models enabled on the **anthropic** slot, OpenAI list shape
+- `GET /anthropic/v1/models` — models enabled on the **anthropic** slot, Anthropic list shape (public — no key needed)
 - `GET /health` — public liveness check
 
 **Admin (`/admin`, account password — HTTP Basic):**

package/README.zh-CN.md

@@ -158,6 +158,22 @@ export ANTHROPIC_API_KEY=<网关 API Key>
 myapikey call gpt-4o-mini "用一句话打个招呼。"
 ```
 
+**为什么有两个 Base URL?** 网关暴露了两个互相独立的 agent 面——`/openai/v1` 和 `/anthropic/v1`,各自带自己的 `GET /models`(OpenAI 客户端只发现 openai 槽位启用的模型,Anthropic 客户端只发现 anthropic 槽位启用的模型)。两套生态的 SDK 各自拼接自己的路径:OpenAI SDK 指向 `…/openai/v1`(它自己补 `/chat/completions`、`/responses`、`/models`),Anthropic SDK / Claude Code 指向 `…/anthropic`(它自己补 `/v1/messages`、`/v1/models`)。
+
+**直接用 HTTP**(不走 SDK)——带上网关 API Key(`Bearer`)直接打这两个面之一:
+
+```bash
+# OpenAI 系
+curl http://localhost:7800/openai/v1/chat/completions \
+  -H "Authorization: Bearer <网关 API Key>" -H "Content-Type: application/json" \
+  -d '{"model":"<模型名>","messages":[{"role":"user","content":"hi"}]}'
+
+# Anthropic 系
+curl http://localhost:7800/anthropic/v1/messages \
+  -H "Authorization: Bearer <网关 API Key>" -H "Content-Type: application/json" \
+  -d '{"model":"<模型名>","max_tokens":16,"messages":[{"role":"user","content":"hi"}]}'
+```
+
 不管你把工具指向哪个端点,网关都按那个格式转发、绝不翻译——所以确保你调用的每个模型,在对应的槽位上至少有一个来源在服务它([见下文](#路由是怎么工作的))。
 
 ---
@@ -239,9 +255,9 @@ myapikey call gpt-4o-mini "用一句话打个招呼。"
 
 - `POST /openai/v1/chat/completions` — OpenAI 格式代理
 - `POST /openai/v1/responses` — OpenAI Responses API(仅限标记了 `supportsResponses` 的来源)
-- `GET /openai/v1/models` — 启用在 **openai** 槽位的模型,OpenAI 列表格式
+- `GET /openai/v1/models` — 启用在 **openai** 槽位的模型,OpenAI 列表格式(公开——无需 Key)
 - `POST /anthropic/v1/messages` — Anthropic 格式代理
-- `GET /anthropic/v1/models` — 启用在 **anthropic** 槽位的模型,OpenAI 列表格式
+- `GET /anthropic/v1/models` — 启用在 **anthropic** 槽位的模型,Anthropic 列表格式(公开——无需 Key)
 - `GET /health` — 公开存活检查
 
 **管理(`/admin`,账号密码 —— HTTP Basic):**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "myapikey",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "type": "module",
   "description": "Personal LLM API gateway & proxy — one address + one API key for all your models. Forwards OpenAI & Anthropic calls to your backends with failover and a circuit breaker. Pure passthrough, no format translation. Self-hosted (CLI + web UI).",
   "keywords": [

package/packages/core/src/cli/index.ts

@@ -54,7 +54,9 @@ program
       console.log(`  proxy:   ${url}/openai/v1/chat/completions   (OpenAI)`);
       console.log(`           ${url}/openai/v1/responses           (OpenAI Responses)`);
       console.log(`           ${url}/anthropic/v1/messages         (Anthropic)`);
-      console.log(`  data:    ${dataDir}  (override with --data-dir or MYAPIKEY_DATA_DIR)\n`);
+      console.log(`  data:    ${dataDir}  (override with --data-dir or MYAPIKEY_DATA_DIR)`);
+      console.log(`  log:     ${store.getPaths().serverLogFile}  (errors + failover/cooldown events; level via MYAPIKEY_LOG_LEVEL)\n`);
+      store.getLogger().info(`gateway started on port ${info.port}, data=${dataDir}`);
 
       if (firstRun) {
         const { account, apiKey } = store.get();

package/packages/core/src/server/app.ts

@@ -1,4 +1,4 @@
-import { Hono } from "hono";
+import { Hono, type Context } from "hono";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -17,13 +17,21 @@ export function createApp(store: Store, opts: AppOptions = {}): Hono {
 
   app.get("/health", (c) => c.json({ ok: true, version: "0.1.0" }));
 
+  // Runtime log (console + server.log): auth failures, unhandled errors.
+  const logger = store.getLogger();
+  app.onError((err, c) => {
+    logger.error(`unhandled error on ${c.req.method} ${c.req.path}: ${err.stack ?? String(err)}`);
+    return c.json({ error: { message: "internal error", type: "server_error" } }, 500);
+  });
+
   // Two independent secrets: the account password admins /admin (Basic), the
   // API key gates /v1 (Bearer / x-api-key). Neither works on the other's surface.
   const accountAuth = authMiddleware(
     () => store.get().account.username,
     () => store.get().account.password,
+    logger,
   );
-  const apiKeyAuth = apiKeyMiddleware(() => store.get().apiKey);
+  const apiKeyAuth = apiKeyMiddleware(() => store.get().apiKey, logger);
 
   // Both sub-apps require auth, applied inside each sub-app (before routes).
   // Two agent surfaces, each with its own /models: /openai/v1 (openai family)
@@ -35,6 +43,20 @@ export function createApp(store: Store, opts: AppOptions = {}): Hono {
   app.route("/anthropic/v1", anthropic);
   app.route("/admin", admin);
 
+  // Unmatched paths under an API prefix answer JSON 404 — NOT the SPA's
+  // index.html. A misconfigured client (e.g. a doubled /v1 segment) then gets a
+  // parseable error instead of HTML that only blows up later in its JSON parser
+  // as "Unexpected token '<'" (this bit pi's model refresh once).
+  const apiMiss = (c: Context) =>
+    c.json({ error: { message: `no such endpoint: ${c.req.method} ${c.req.path}`, type: "invalid_request_error" } }, 404);
+  app.all("/openai/*", apiMiss);
+  app.all("/anthropic/*", apiMiss);
+  app.all("/admin/*", apiMiss);
+  // Legacy pre-0.12 surface: gone since the split — point the caller at the two
+  // current surfaces instead of a bare 404.
+  app.all("/v1/*", (c) =>
+    c.json({ error: { message: "the /v1 surface was split in v0.12.0 — use /openai/v1 or /anthropic/v1", type: "invalid_request_error" } }, 404));
+
   // Web UI: serve built SPA when available.
   if (opts.webDir && existsSync(opts.webDir)) {
     app.use("/*", serveStatic({ root: opts.webDir }));

package/packages/core/src/server/auth.ts

@@ -1,5 +1,6 @@
 import type { Context, MiddlewareHandler } from "hono";
 import { timingSafeEqual } from "node:crypto";
+import type { Logger } from "./logger";
 
 /** Constant-time string compare. */
 function safeEqual(a: string, b: string): boolean {
@@ -35,7 +36,7 @@ export function extractSecret(c: Context): { password: string; username?: string
 }
 
 /** Hono middleware: require the single account/password. */
-export function authMiddleware(getUser: () => string, getPass: () => string): MiddlewareHandler {
+export function authMiddleware(getUser: () => string, getPass: () => string, logger?: Logger): MiddlewareHandler {
   return async (c, next) => {
     const cred = extractSecret(c);
     const ok =
@@ -43,6 +44,7 @@ export function authMiddleware(getUser: () => string, getPass: () => string): Mi
       (cred.username === undefined || safeEqual(cred.username, getUser())) &&
       safeEqual(cred.password, getPass());
     if (!ok) {
+      logger?.warn(`auth failed: admin ${c.req.method} ${c.req.path} (invalid or missing credentials)`);
       return c.json(
         { error: { message: "invalid or missing credentials", type: "authentication_error" } },
         401,
@@ -58,12 +60,13 @@ export function authMiddleware(getUser: () => string, getPass: () => string): Mi
  * secret. extractSecret sets `username` only for Basic, so rejecting when it's
  * present keeps the account password off /v1.
  */
-export function apiKeyMiddleware(getKey: () => string): MiddlewareHandler {
+export function apiKeyMiddleware(getKey: () => string, logger?: Logger): MiddlewareHandler {
   return async (c, next) => {
     const cred = extractSecret(c);
     const ok =
       !!cred && cred.username === undefined && !!cred.password && safeEqual(cred.password, getKey());
     if (!ok) {
+      logger?.warn(`auth failed: agent ${c.req.method} ${c.req.path} (invalid or missing api key)`);
       return c.json(
         { error: { message: "invalid or missing api key", type: "authentication_error" } },
         401,

package/packages/core/src/server/logger.ts

@@ -0,0 +1,72 @@
+import { appendFileSync, existsSync, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+
+/** Runtime-log levels, ascending severity. `silent` emits nothing. */
+export type LogLevel = "info" | "warn" | "error" | "silent";
+
+const ORDER: Record<LogLevel, number> = { info: 0, warn: 1, error: 2, silent: 3 };
+
+export interface Logger {
+  info(msg: string): void;
+  warn(msg: string): void;
+  error(msg: string): void;
+}
+
+export interface LoggerOptions {
+  /** Log file to append to (parent dirs created). Omit = console only. */
+  file?: string;
+  /** Minimum emitted level. Defaults to the MYAPIKEY_LOG_LEVEL env, else "info". */
+  level?: LogLevel;
+  /** Mirror to stdout (info/warn) / stderr (error). Default true. */
+  console?: boolean;
+  /** Size cap before the file rotates to `<file>.1`. Default 5 MiB. */
+  rotateBytes?: number;
+}
+
+/** Parse MYAPIKEY_LOG_LEVEL; anything unrecognized falls back to "info". */
+export function levelFromEnv(v: string | undefined): LogLevel {
+  return v === "info" || v === "warn" || v === "error" || v === "silent" ? v : "info";
+}
+
+const DEFAULT_ROTATE_BYTES = 5 * 1024 * 1024;
+
+/** Process-level runtime log — the ops-facing line the gateway was missing:
+ *  one plain text line per error or notable event (failover, circuit cooldown,
+ *  auth failure, unhandled exception), mirrored to the console and appended to
+ *  `<dataDir>/server.log`. Deliberately distinct from the per-call history in
+ *  logs.jsonl (that's the web Logs/Stats surface; this is "what happened to
+ *  the process"). Successful requests are NOT logged here — keep it quiet.
+ *  File I/O is best-effort: logging must never throw into a request path. */
+export function createLogger(opts: LoggerOptions = {}): Logger {
+  const level = opts.level ?? levelFromEnv(process.env.MYAPIKEY_LOG_LEVEL);
+  const useConsole = opts.console ?? true;
+  const cap = opts.rotateBytes ?? DEFAULT_ROTATE_BYTES;
+
+  const write = (lvl: "info" | "warn" | "error", msg: string) => {
+    if (ORDER[lvl] < ORDER[level]) return;
+    const line = `${new Date().toISOString()} ${lvl.toUpperCase().padEnd(5)} ${msg}`;
+    if (useConsole) {
+      // error → stderr so a log collector splits real failures from chatter
+      (lvl === "error" ? process.stderr : process.stdout).write(line + "\n");
+    }
+    if (opts.file) {
+      try {
+        mkdirSync(dirname(opts.file), { recursive: true });
+        // Keep-one rotation: past the cap, the current file becomes `.1`
+        // (overwriting any older backup) and a fresh file starts.
+        if (existsSync(opts.file) && statSync(opts.file).size > cap) {
+          renameSync(opts.file, `${opts.file}.1`);
+        }
+        appendFileSync(opts.file, line + "\n");
+      } catch {
+        // Disk full / permissions — swallow; never fail a request over logging.
+      }
+    }
+  };
+
+  return {
+    info: (m) => write("info", m),
+    warn: (m) => write("warn", m),
+    error: (m) => write("error", m),
+  };
+}

package/packages/core/src/server/proxy.ts

@@ -293,21 +293,27 @@ function observedBody(
   });
 }
 
-/** OpenAI-style model list of the models enabled on ONE routing family's slot.
- *  Each agent surface gets its own `/models` so a client listing models never
- *  picks an id that 404s on that surface's call endpoint: `/openai/v1/models`
- *  advertises the openai slot, `/anthropic/v1/models` the anthropic slot. */
+/** Model list of the models enabled on ONE routing family's slot. Each agent
+ *  surface gets its own `/models` so a client listing models never picks an id
+ *  that 404s on that surface's call endpoint — and each answers in its own
+ *  ecosystem's list shape: openai `{object:"list", data:[{id, owned_by}]}` vs
+ *  anthropic `{data:[{id, display_name}], first_id, last_id, has_more}`. We
+ *  can't know real created_at / capabilities, so the anthropic shape carries
+ *  only the honest minimal fields rather than fabricating them. */
 function modelsList(c: Context, store: Store, fmt: "openai" | "anthropic") {
   const d = store.get();
   const byId = new Map(d.providers.map((p) => [p.id, p]));
-  const data = Object.entries(d.models)
-    .filter(([, e]) => e[fmt].enabled)
-    .map(([id, e]) => ({
-      id,
-      object: "model",
-      created: 0,
-      owned_by: byId.get(e[fmt].providers[0]?.id ?? "")?.name || "MyAPIKey",
-    }));
+  const enabled = Object.entries(d.models).filter(([, e]) => e[fmt].enabled);
+  if (fmt === "anthropic") {
+    const data = enabled.map(([id]) => ({ id, display_name: id, created_at: "1970-01-01T00:00:00Z", type: "model" }));
+    return c.json({ data, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null, has_more: false });
+  }
+  const data = enabled.map(([id, e]) => ({
+    id,
+    object: "model",
+    created: 0,
+    owned_by: byId.get(e.openai.providers[0]?.id ?? "")?.name || "MyAPIKey",
+  }));
   return c.json({ object: "list", data });
 }
 
@@ -320,6 +326,13 @@ export function proxyApi(
 ): { openai: Hono; anthropic: Hono } {
   const openai = new Hono();
   const anthropic = new Hono();
+  // GET /models is a PUBLIC discovery read — no api key required. It returns only
+  // the enabled model names (like /health), so an agent or a quick curl can see
+  // what each surface offers before wiring up auth. Registered BEFORE the auth
+  // middleware so it isn't gated: Hono only runs middleware on routes registered
+  // after it.
+  openai.get("/models", (c) => modelsList(c, store, "openai"));
+  anthropic.get("/models", (c) => modelsList(c, store, "anthropic"));
   openai.use("*", auth);
   anthropic.use("*", auth);
 
@@ -373,6 +386,16 @@ export function proxyApi(
     const start = Date.now();
     let lastStatus = 502;
     let lastErr = "";
+    // Runtime log (console + server.log). Errors and notable events only — the
+    // per-call history these lines summarize goes to pushLog/logs.jsonl anyway.
+    // UI-triggered probes are excluded: their outcome is shown inline already.
+    const rt = store.getLogger();
+    const sayFailover = (p: Provider, why: string) => {
+      if (!isProbe) rt.warn(`proxy model=${model}: provider '${p.name}' ${why} → trying next`);
+    };
+    const sayCooldown = (p: Provider, r: { entered: boolean; fails: number; cooldownMs: number }) => {
+      if (r.entered && !isProbe) rt.warn(`proxy circuit open: provider '${p.name}' cooldown=${r.cooldownMs}ms fails=${r.fails}`);
+    };
 
     // Skip providers that are either in circuit-breaker cooldown OR over their
     // RPM pacing cap. Both are heuristics: if every candidate is skipped, fall
@@ -414,9 +437,11 @@ export function proxyApi(
         lastStatus = 502;
         lastErr = "network error";
         if (pinIndex != null) break; // per-source probe: fail fast, no circuit impact.
+        sayFailover(provider, "network error");
         const r = store.recordCircuitFailure(provider.id, lastStatus, lastErr);
         if (r.entered) {
           store.pushLog({ ts: Date.now(), model, upstreamModel, provider: provider.name, providerId: provider.id, format: wire, status: lastStatus, ms: Date.now() - start, stream, kind: "cooldown", cooldownMs: r.cooldownMs, fails: r.fails, error: lastErr });
+          sayCooldown(provider, r);
         }
         continue;
       }
@@ -446,6 +471,7 @@ export function proxyApi(
               // A pinned per-source probe takes no circuit side-effects (a manual
               // test must not trip the breaker) — mirrors the retryable branch.
               if (pinIndex == null) store.recordCircuitFailure(provider.id, info.status, info.error || "stream failed");
+              if (!isProbe) rt.warn(`proxy stream failed: provider '${provider.name}' status=${info.status} (${info.error || "stream failed"})`);
               store.pushLog({ ts: Date.now(), model, upstreamModel, provider: provider.name, providerId: provider.id, format: wire, status: info.status, ms: ttfb, stream, error: info.error });
             }
           },
@@ -459,6 +485,7 @@ export function proxyApi(
         const txt = await upstream.text().catch(() => "");
         lastErr = shortError(txt) || `HTTP ${upstream.status}`;
         if (pinIndex != null) break; // per-source probe: fail fast, no circuit impact.
+        sayFailover(provider, `HTTP ${lastStatus} (${lastErr})`);
         // A 429/overloaded upstream usually carries Retry-After; honoring it
         // cools for exactly as long as asked (clamped) instead of the escalating
         // guess. Absent (5xx often, OR a quota error that buried the reset time
@@ -469,6 +496,7 @@ export function proxyApi(
         const r = store.recordCircuitFailure(provider.id, lastStatus, lastErr, retryAfterMs ?? resetInMs, !!resetInMs);
         if (r.entered) {
           store.pushLog({ ts: Date.now(), model, upstreamModel, provider: provider.name, providerId: provider.id, format: wire, status: lastStatus, ms: Date.now() - start, stream, kind: "cooldown", cooldownMs: r.cooldownMs, fails: r.fails, error: lastErr });
+          sayCooldown(provider, r);
         }
         continue;
       }
@@ -481,6 +509,7 @@ export function proxyApi(
 
     const last = order[order.length - 1];
     const lastUpstreamModel = last.model && last.model !== model ? last.model : undefined;
+    if (!isProbe) rt.error(`proxy all providers failed model=${model} (last status ${lastStatus})`);
     store.pushLog({ ts: Date.now(), model, upstreamModel: lastUpstreamModel, provider: last.provider.name, providerId: last.provider.id, format: wire, status: lastStatus, ms: Date.now() - start, stream, error: lastErr || `all providers failed (last status ${lastStatus})` });
     // A pinned (per-source) probe failed: surface the REAL upstream status the
     // one slot returned (429/500/…), not a collapsed 502, and tag it with
@@ -499,18 +528,14 @@ export function proxyApi(
     );
   };
 
-  // OpenAI surface: chat/completions + responses, plus its own (openai-slot)
-  // model list.
+  // OpenAI surface: chat/completions + responses (/models is registered above,
+  // before the auth middleware, so it stays public).
   openai.post("/chat/completions", (c) => dispatch(c, "openai"));
   // OpenAI Responses API — its own routing slot (sources must be supportsResponses).
   openai.post("/responses", (c) => dispatch(c, "responses"));
-  openai.get("/models", (c) => modelsList(c, store, "openai"));
 
-  // Anthropic surface: messages, plus its own (anthropic-slot) model list — so
-  // an Anthropic client can discover models enabled only on the anthropic slot,
-  // which the shared-/v1 design couldn't surface.
+  // Anthropic surface: messages (/models likewise registered above, public).
   anthropic.post("/messages", (c) => dispatch(c, "anthropic"));
-  anthropic.get("/models", (c) => modelsList(c, store, "anthropic"));
 
   return { openai, anthropic };
 }

package/packages/core/src/server/store.ts

@@ -2,6 +2,7 @@ import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSyn
 import { join } from "node:path";
 import { defaultConfig, newApiKey, CONFIG_VERSION } from "../shared/config";
 import type { GateConfig, LogEntry, Provider } from "../shared/types";
+import { createLogger, type Logger } from "./logger";
 
 /** Call-log retention: the log is bounded two ways — never older than this, and
  *  never more than LOG_MAX_LINES entries. Whichever binds first. 90 days covers
@@ -165,6 +166,10 @@ export class Store {
   private readonly dataPath: string;
   private readonly logsPath: string;
   private readonly credentialsPath: string;
+  private readonly serverLogPath: string;
+  /** Process-level runtime log (server.log — errors + notable events). Owned
+   *  by the Store like every other dataDir file; injectable for quiet tests. */
+  private readonly logger: Logger;
   private chain: Promise<unknown> = Promise.resolve();
   /** Line count of the on-disk log (drives periodic trimming). The entries
    *  themselves are persisted to logs.jsonl, never held in memory. */
@@ -179,11 +184,13 @@ export class Store {
    *  NOT persisted (resets on restart). Pruned as `rpmUsed` reads. */
   private rpm = new Map<string, number[]>();
 
-  constructor(dataDir: string) {
+  constructor(dataDir: string, opts: { logger?: Logger } = {}) {
     this.dataDir = dataDir;
     this.dataPath = join(dataDir, "data.json");
     this.logsPath = join(dataDir, "logs.jsonl");
     this.credentialsPath = join(dataDir, "credentials.txt");
+    this.serverLogPath = join(dataDir, "server.log");
+    this.logger = opts.logger ?? createLogger({ file: this.serverLogPath });
     this.data = this.load();
     this.logCount = this.countLogs();
     // Don't trim on the very first post-startup call: let normal hysteresis do
@@ -193,15 +200,22 @@ export class Store {
   }
 
   /** Resolved on-disk locations (for read-only display in Settings). */
-  getPaths(): { dataDir: string; dataFile: string; logsFile: string; credentialsFile: string } {
+  getPaths(): { dataDir: string; dataFile: string; logsFile: string; credentialsFile: string; serverLogFile: string } {
     return {
       dataDir: this.dataDir,
       dataFile: this.dataPath,
       logsFile: this.logsPath,
       credentialsFile: this.credentialsPath,
+      serverLogFile: this.serverLogPath,
     };
   }
 
+  /** Runtime log (console + server.log). Errors and notable events only —
+   *  per-call history is pushLog/logs.jsonl, a separate surface. */
+  getLogger(): Logger {
+    return this.logger;
+  }
+
   /**
    * Write a human-readable credentials.txt (web login + /v1 api key), current
    * as of this boot. So a brand-new user — or anyone who closed the startup