openzoo 0.49.7 → 0.49.9

package/lib/podagent.mjs

@@ -28,6 +28,14 @@ import {
   isRaceCountable, raceLastShip, shouldRetryRaceArrival, raceFailKind,
   summarizeRaceFailures,
 } from './livestatus.js';
+import { messageReasoning, wrapThink, stripThinkTags, reasoningPresent, splitThink } from './think.js';
+import { guardFindCwd } from './runguard.js';
+
+function emitReply(onDelta, raw) {
+  const parts = splitThink(raw);
+  if (parts.thinking) onDelta(parts.thinking, { think: true });
+  if (parts.visible) onDelta(parts.visible);
+}
 import {
   probeGatewayRace, capRaceByCredit, inferRaceTier, RACE_NO_CREDIT,
   recutRaceByHud, sessionDollarX,
@@ -42,7 +50,7 @@ export const PROXY = process.env.OZ_PROXY || 'http://127.0.0.1:8402/v1';
 function completionsProxy() {
   return process.env.OZ_PROXY || PROXY;
 }
-export const MODEL = process.env.OZ_BRAIN_MODEL || 'deepseek/deepseek-v4-pro-0813';
+export const MODEL = process.env.OZ_BRAIN_MODEL || 'openzoo/auto';
 const MAX_STEPS = Number(process.env.OZ_MAX_STEPS || 10);
 
 // Matches the Grok Bot chat surface itself (dark canvas, right-aligned grey
@@ -188,7 +196,7 @@ function execFrame(command, cwd = '/tmp') {
     approvalId: randomUUID(),
     // agent.v1.ExecServerMessage as protobuf-es JSON (camelCase). The daemon
     // assigns `id`; we only supply the shell variant.
-    serverMessage: { shellArgs: { command, workingDirectory: cwd, timeout: 120 } },
+    serverMessage: { shellArgs: { command: guardFindCwd(command, cwd), workingDirectory: cwd, timeout: 120 } },
   };
 }
 
@@ -247,7 +255,7 @@ async function httpErrorNote(status) {
         // funded === false is the genuinely-empty case; funded === true after
         // the retries above means the rail/quote failed, not the balance
         if (w.funded === false) {
-          return `(payment failed — HTTP 402, the wallet is empty. ${w.funding}. EVM (Base/Robinhood): ${w.evm}.)`;
+          return `(payment required — HTTP 402, the wallet is empty. ${w.funding}. EVM (Base/Robinhood): ${w.evm}.)`;
         }
         return `(payment failed — HTTP 402 after ${PAYMENT_RETRIES} retries, though the wallet holds ${w.balances || 'a balance'}. Send it again; if it keeps failing the quoted asset may not be convertible right now. Fund with: ${w.funding})`;
       }
@@ -276,7 +284,13 @@ function sanitizeProxiedError(msg) {
 // this attempt, but the NEXT attempt usually settles (measured: same wallet,
 // same rail, second call pays fine). Surfacing that as a chat message makes
 // the user do the retry by hand — so do it here instead.
+// Empty/underfunded is NOT that handshake: retrying just re-walks wrap.
 const PAYMENT_RETRIES = 3;
+
+export function isUnderfunded402Body(body) {
+  const msg = String(body?.error?.message || body?.error || body?.message || '');
+  return /\b(?:underfunded|wallet is empty|empty wallet)\b/i.test(msg);
+}
 /**
  * ADAPTIVE top_k. We have learned this one the expensive way already.
  *
@@ -329,6 +343,10 @@ async function postChat(body, contextId, topK, onStatus, signal) {
       ...(signal ? { signal } : {}),
     });
     if (r.status !== 402 || attempt === PAYMENT_RETRIES) return r;
+    // Handshake 402 (funded, settle flake) → retry. Empty-wallet 402 → stop.
+    // Opening Pay / parking happens on the empty body, not on every 402.
+    const peek = await r.clone().json().catch(() => null);
+    if (isUnderfunded402Body(peek)) return r;
     // A 402 retry used to be silent — grokui sat on mute "…" for the whole
     // settle. Tell the watcher this attempt is paying, not wedged.
     onStatus?.(formatPayStatus(attempt));
@@ -370,15 +388,17 @@ export async function brain(messages, contextId, modelOverride, topK, signal) {
     contextId, topK, undefined, signal,
   );
   const j = await r.json().catch(() => ({}));
-  const content = j?.choices?.[0]?.message?.content;
+  const msg = j?.choices?.[0]?.message;
+  const content = msg?.content;
+  const thinking = messageReasoning(msg);
   // Same truncation catch as the streaming path (see brainStream): a reply that
   // stops because the budget ran out is not a finished reply, and this path is
   // what non-streaming callers — including every SPAWNed subagent — go through.
   if (content && j?.choices?.[0]?.finish_reason === 'length') {
     const rest = await brainContinue(messages, content, contextId, modelOverride, 0);
-    return content + rest;
+    return wrapThink(thinking, content + rest);
   }
-  return content || (r.ok ? '' : await httpErrorNote(r.status));
+  return wrapThink(thinking, content || (r.ok ? '' : await httpErrorNote(r.status)));
 }
 
 /** Resume a reply that hit the output cap, non-streaming. Bounded by
@@ -420,20 +440,31 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
   if (!r.ok || !r.body) {
     // fall back to the non-streaming path rather than fail outright
     const j = await r.json().catch(() => ({}));
-    const content = j?.choices?.[0]?.message?.content;
+    const msg = j?.choices?.[0]?.message;
+    const content = msg?.content;
+    const thinking = messageReasoning(msg);
     const proxied = sanitizeProxiedError(j?.error?.message);
     const text = content || (r.ok ? '' : (proxied ? `(request failed — HTTP ${r.status}: ${proxied})` : await httpErrorNote(r.status)));
+    if (thinking) onDelta(thinking, { think: true });
     if (text) onDelta(text);
-    return text;
+    return wrapThink(thinking, text);
   }
   const reader = r.body.getReader();
   const decoder = new TextDecoder();
-  let buf = '', full = '', reasonedChars = 0, finish = '';
+  let buf = '', full = '', reasonedChars = 0, reasonedText = '', finish = '';
   let stopWait = startModelWait(onStatus);
   const noteThinking = () => {
     stopWait();
     onStatus?.('thinking…');
   };
+  const takeReasoning = (delta, message) => {
+    const chunk = messageReasoning(message, delta);
+    if (!chunk) return;
+    reasonedChars += chunk.length;
+    reasonedText += chunk;
+    onDelta(chunk, { think: true });
+    if (!full) noteThinking();
+  };
   try {
     for (;;) {
       let chunk;
@@ -449,11 +480,11 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
         if (full) {
           const note = '\n\n(stream stalled — showing what arrived before the timeout)';
           onDelta(note);
-          return full + note;
+          return wrapThink(reasonedText, full + note);
         }
         onStatus?.('waiting on model…');
         const fallback = await brain(messages, contextId, modelOverride, topK, signal);
-        if (fallback) onDelta(fallback);
+        if (fallback) emitReply(onDelta, fallback);
         return fallback || '(stream timed out — no tokens arrived)';
       }
       const { value, done } = chunk;
@@ -478,13 +509,18 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
             full += d.content;
             onDelta(d.content);
           }
-          // Reasoning models emit their chain of thought on a SEPARATE field and
-          // only then start producing content. Count it — not to show it, but to
-          // tell "the model said nothing" apart from "the model spent its whole
-          // budget thinking and got cut off". Surface "thinking…" so the wait
-          // is not mute dots.
-          else if (d?.reasoning || d?.reasoning_content) {
-            reasonedChars += (d.reasoning || d.reasoning_content).length;
+          // Reasoning models emit their chain of thought on a SEPARATE field
+          // (reasoning_content / reasoning / thinking / thought, or a provider
+          // object with a plaintext summary). Forward the plaintext as
+          // onDelta(text, { think: true }) so the canvas can fold it — never
+          // as visible content. Encrypted blobs stay counted for the empty-
+          // after-think retry, but are not forwarded.
+          const before = reasonedChars;
+          takeReasoning(d, c?.message);
+          if (reasonedChars === before && reasoningPresent(d, c?.message)) {
+            // Encrypted-only: nothing to fold, but the model DID think —
+            // count it so an empty completion retries instead of "(no response)".
+            reasonedChars += 1;
             if (!full) noteThinking();
           }
         } catch { /* keep-alive line or partial JSON — ignore */ }
@@ -523,9 +559,9 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
       onDelta, contextId, modelOverride,
       Math.min(budget * 2, MAX_CONTINUE_TOKENS), round + 1, topK, onStatus,
     );
-    return full + (more || '');
+    return wrapThink(reasonedText, full + (more || ''));
   }
-  return full;
+  return wrapThink(reasonedText, full);
 }
 
 // How many times a single answer may be resumed after hitting the cap. Three
@@ -618,6 +654,7 @@ export const TIER_ALIASES = {
 };
 export function normalizeTier(s) {
   const raw = String(s || '').trim().toLowerCase();
+  if (raw === 'auto') return 'auto';
   if (TIER_NAMES.includes(raw)) return raw;
   if (TIER_ALIASES[raw]) return TIER_ALIASES[raw];
   const compact = raw.replace(/[\s_]/g, '');
@@ -776,15 +813,16 @@ async function brainGatewayRace(messages, onDelta, contextId, models, need, maxT
       const r = await postChat(body, contextId, 0, onStatus, hooks.signal);
       if (!r.ok || !r.body) {
         const j = await r.json().catch(() => ({}));
-        const content = j?.choices?.[0]?.message?.content;
+        const msg = j?.choices?.[0]?.message;
+        const content = msg?.content;
         const proxied = sanitizeProxiedError(j?.error?.message);
-        const text = content || (r.ok ? '' : (proxied ? `(request failed — HTTP ${r.status}: ${proxied})` : await httpErrorNote(r.status)));
+        const text = wrapThink(messageReasoning(msg), content || (r.ok ? '' : (proxied ? `(request failed — HTTP ${r.status}: ${proxied})` : await httpErrorNote(r.status))));
         lastFail = { model: 'gateway', text: text || '', error: r.ok ? undefined : `HTTP ${r.status}` };
         if (isRaceCountable(lastFail)) {
           arrivals.push(lastFail);
           done.push(lastFail);
           feed.onBack(lastFail.model);
-          if (text) onDelta(text);
+          if (text) emitReply(onDelta, text);
           break;
         }
         if (!shouldRetryRaceArrival(lastFail) || attempt === 1) break;
@@ -836,6 +874,7 @@ async function readGatewayRaceStream(r, feed, signal) {
   const decoder = new TextDecoder();
   let buf = '';
   const texts = new Map();
+  const thinks = new Map();
   const finished = new Map();
   const live = { id: null };
   const stopWait = startModelWait(() => {});
@@ -847,11 +886,21 @@ async function readGatewayRaceStream(r, feed, signal) {
     texts.set(key, (texts.get(key) || '') + chunk);
     feed.onToken(key, chunk);
   };
+  const pushThink = (id, chunk) => {
+    if (chunk == null || chunk === '') return;
+    const key = id || live.id || 'gateway';
+    live.id = key;
+    thinks.set(key, (thinks.get(key) || '') + chunk);
+  };
   const finishOne = (id, extra = {}) => {
     const key = id || live.id || 'gateway';
     if (finished.has(key)) return;
     const text = extra.text != null ? String(extra.text) : (texts.get(key) || '');
-    const row = { model: extra.model || key, text, error: extra.error };
+    const row = {
+      model: extra.model || key,
+      text: wrapThink(thinks.get(key) || '', text),
+      error: extra.error,
+    };
     finished.set(key, row);
   };
 
@@ -899,7 +948,11 @@ async function readGatewayRaceStream(r, feed, signal) {
           const d = c?.delta;
           const id = raceRacerId(obj, live.id || 'gateway');
           if (d?.content) pushText(id, d.content);
-          else if (d?.reasoning || d?.reasoning_content) { /* thinking — not content */ }
+          // Reasoning is not a racer preview. Fold it onto the arrival so
+          // the winner's canvas row can show a thinking chip — never dump
+          // CoT into the spectator grid.
+          const think = messageReasoning(c?.message, d);
+          if (think) pushThink(id, think);
           if (c?.finish_reason) finishOne(id, { model: obj.model });
           if (ev?.ev === 'back' || ev?.ev === 'done') finishOne(ev.id, { text: ev.text, model: ev.id });
           if (ev?.ev === 'fail' || ev?.error) finishOne(ev.id, { text: ev.text || '', error: ev.error || 'empty body' });
@@ -1066,7 +1119,10 @@ export async function brainRace(messages, onDelta, contextId, models, need = 1,
     for (let attempt = 0; attempt < 2; attempt++) {
       if (raceAbort.signal.aborted && attempt > 0) break;
       try {
-        const text = await stream(messages, (chunk) => feed.onToken(m, chunk), contextId, m, maxTokens, 0, 0, undefined, raceAbort.signal);
+        const text = await stream(messages, (chunk, meta) => {
+          if (meta?.think) return;
+          feed.onToken(m, chunk);
+        }, contextId, m, maxTokens, 0, 0, undefined, raceAbort.signal);
         last = { model: m, text: text == null ? '' : String(text) };
         if (isRaceCountable(last)) {
           arrivals.push(last);
@@ -1136,7 +1192,7 @@ function raceQuestion(messages) {
 async function classifyRaceAnswer(messages, cand) {
   const prompt = 'Score this answer to one question from 0 to 10.\n\n'
     + 'QUESTION:\n' + String(raceQuestion(messages)).slice(0, 4000) + '\n\n'
-    + 'ANSWER:\n' + String(cand?.text || '').slice(0, 6000) + '\n\n'
+    + 'ANSWER:\n' + stripThinkTags(String(cand?.text || '')).slice(0, 6000) + '\n\n'
     + 'Judge on: correctness first, then completeness, then whether it actually did what was asked '
     + '(a directive like RUN: or DONE: on one line is the correct format here, not a flaw). '
     + 'Ignore length and confidence of tone.\n'
@@ -1155,7 +1211,7 @@ async function pairwiseTied(messages, tied) {
   const letters = tied.map((_, i) => String.fromCharCode(65 + i));
   const prompt = 'You are judging answers to one question. Pick the single best one.\n\n'
     + 'QUESTION:\n' + String(raceQuestion(messages)).slice(0, 4000) + '\n\n'
-    + tied.map((c, i) => 'ANSWER ' + letters[i] + ':\n' + String(c.text || '').slice(0, 6000)).join('\n\n')
+    + tied.map((c, i) => 'ANSWER ' + letters[i] + ':\n' + stripThinkTags(String(c.text || '')).slice(0, 6000)).join('\n\n')
     + '\n\nJudge on: correctness first, then completeness, then whether it actually did what was asked '
     + '(a directive like RUN: or DONE: on one line is the correct format here, not a flaw). '
     + 'Ignore length and confidence of tone.\n'

package/lib/proxy.js

@@ -20,7 +20,11 @@ import {
   corpusRecall,
   decideChatSpill, isOneShotCorpusAsk,
 } from './spill.js';
-import { rewritablePath, augmentModelList, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
+import { rewritablePath, modelsListForRequest, isHarnessAliasId, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS, raiseReasoningMaxTokens, isAutoModel } from './models.js';
+import {
+  route as routeTask, routeChatBody, fallbackChain, isRetryableStatus,
+  outcomeFromResponse, recordRouteOutcome, autoModelListEntry,
+} from './modelroute.js';
 import { forgetContext } from './contexts.js';
 import { injectBrief } from './brief.js';
 import { withNamespace } from './namespace.js';
@@ -30,8 +34,10 @@ import { loadSessionSpend, saveSessionSpend } from './session.js';
 import { creditBalance, quotedPrices } from './info.js';
 import { subscriptionPublicView } from './subscription.js';
 import { priceHoldings } from './livestatus.js';
-import { receiptUsedCogs, receiptDirectUsd } from './racesettle.js';
+import { receiptUsedCogs, receiptDirectUsd, pairActualBilled } from './racesettle.js';
 import { rewriteWrapClientError } from './wrap.js';
+import { fetchHeaders } from './fetch.js';
+import { relay } from './relay.js';
 
 const HOP_BY_HOP = new Set([
   'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade',
@@ -81,46 +87,6 @@ async function readBody(req) {
   return Buffer.concat(chunks);
 }
 
-/** Pipe an upstream fetch Response to the client, unbuffered (SSE-safe).
- *
- *  `onReceipt` is called with the gateway's x402 block when it arrives. On a
- *  STREAMED call there is no JSON body to carry that block, so the gateway
- *  emits it as an SSE COMMENT (`: x402 {...}`) after the last frame — comments
- *  are discarded by every compliant client, so nothing downstream sees it, but
- *  without reading it here every spend and savings figure on the status line
- *  would silently read zero the moment real streaming was switched on.
- *
- *  Sniffing NEVER delays a byte: each chunk is written to the client first and
- *  only then scanned. */
-function relay(res, upstream, onReceipt) {
-  const headers = {};
-  upstream.headers.forEach((v, k) => {
-    if (!['transfer-encoding', 'connection', 'content-encoding', 'content-length'].includes(k)) headers[k] = v;
-  });
-  res.writeHead(upstream.status, headers);
-  if (!upstream.body) { res.end(); return Promise.resolve(); }
-  const sse = (upstream.headers.get('content-type') || '').includes('text/event-stream');
-  return new Promise((resolve) => {
-    const body = Readable.fromWeb(upstream.body);
-    body.on('error', () => res.destroy());
-    res.on('close', () => body.destroy());
-    body.on('end', resolve);
-    if (!sse || typeof onReceipt !== 'function') { body.pipe(res); return; }
-    let pending = '';
-    body.on('data', (c) => {
-      res.write(c);
-      pending += c.toString('utf8');
-      const lines = pending.split('\n');
-      pending = lines.pop() ?? '';   // a comment can straddle two chunks
-      for (const line of lines) {
-        if (!line.startsWith(': x402 ')) continue;
-        try { onReceipt(JSON.parse(line.slice(7))); } catch { /* not our frame */ }
-      }
-    });
-    body.on('end', () => res.end());
-  });
-}
-
 function jsonErr(res, status, message, extraFields = {}) {
   res.writeHead(status, { 'content-type': 'application/json' });
   res.end(JSON.stringify({ error: { message }, ...extraFields }));
@@ -813,6 +779,9 @@ async function maybeCacheCorpus(req, bodyBuf, log, stats, extra = {}) {
  * default, so localhost behaviour is unchanged.
  */
 export async function startProxy({ silent = false, requireToken = null, sessionMaxUsd = null, autoTunnel = false } = {}) {
+  // grokui's packed sidecar spawn sets OPENZOO_SILENT=1 so 400s land in
+  // ~/.openzoo/proxy.log instead of Electron's inherited /dev/null.
+  if (process.env.OPENZOO_SILENT === '1') silent = true;
   const client = new PayClient();
   const log = silent ? () => {} : (...a) => console.log(...a);
   // ALWAYS-ON. `silent: true` is used by the editor path to keep startup tidy,
@@ -1196,6 +1165,35 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       return;
     }
 
+    // Local decision � no upstream, no payment. Same keys as Python route().
+    {
+      const routePath = (req.url || '').split('?')[0];
+      if (req.method === 'POST' && (routePath === '/route' || routePath === '/v1/route')) {
+        let payload;
+        try { payload = JSON.parse(bodyBuf.toString('utf8') || '{}'); } catch {
+          jsonErr(res, 400, 'invalid /route body');
+          return;
+        }
+        try {
+          const r = routeTask(payload.text ?? '', {
+            allow_free: payload.allow_free ?? false,
+            bindable: payload.bindable ?? true,
+            context: payload.context,
+            input_tokens: payload.input_tokens,
+            has_image: payload.has_image,
+            needs_tools: payload.needs_tools,
+            needs_json: payload.needs_json,
+            ...(payload.constraints && typeof payload.constraints === 'object' ? payload.constraints : {}),
+          });
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify(r));
+        } catch (err) {
+          jsonErr(res, 500, `openzoo /route: ${err.message}`);
+        }
+        return;
+      }
+    }
+
     // ANTHROPIC MESSAGES SHAPE. A harness pointed here via ANTHROPIC_BASE_URL
     // (Claude Code, the Anthropic SDKs) speaks POST /v1/messages, not chat
     // completions — this is how such a harness routes its inference through
@@ -1298,6 +1296,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // carries a model field, not just chat/completions, so /completions,
     // /responses and future shapes all work. Never silent.
     let wantsStream = false;
+    let autoRoute = null;
       if ((req.url || '').includes('/chat/completions') && req.method === 'POST') {
         servedRequests += 1;
         say(`\n<- request #${servedRequests} from ${(req.headers['user-agent'] || 'unknown').slice(0, 40)}`);
@@ -1331,6 +1330,26 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         try { ids = await zooModelIds(); } catch { /* catalog miss: still skip the floor on a tiny classify */ }
         const policy = rewriteChatModel(parsed, ids, { bodyLen: bodyBuf.length });
         parsed = policy.parsed;
+        if (!policy.tiny && (policy.auto || isAutoModel(parsed?.model))) {
+          autoRoute = routeChatBody(parsed, {
+            allow_free: false,
+            bindable: true,
+            // Live quoteable ids only � Auto must never emit :batch / $0 /
+            // missing-price rows that 500 `bad openrouter price` on Fly.
+            ...(ids.length ? { allow_ids: ids } : {}),
+          });
+          if (!autoRoute.model) {
+            jsonErr(res, 422, autoRoute.reason || 'openzoo/auto: no feasible model', { route: autoRoute });
+            return;
+          }
+          parsed = { ...parsed, model: autoRoute.model };
+          const bump = raiseReasoningMaxTokens(parsed);
+          parsed = bump.parsed;
+          say(`openzoo/auto -> ${autoRoute.model} p=${autoRoute.p_success} cleared=${autoRoute.cleared_bar} ${autoRoute.task_class}${autoRoute.bind_first ? ' bind_first' : ''}`);
+          if (!autoRoute.cleared_bar) {
+            say(`openzoo/auto cleared_bar=false � strongest fallback, not a normal pick`);
+          }
+        }
         if (policy.tiny) {
           // `openzoo claude` starts us silent � `log` is a no-op then. say()
           // is the proxy.log channel and never the Claude Code TTY.
@@ -1380,7 +1399,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
             log(`reasoning model ${parsed.model}: max_tokens ${policy.raisedFrom} -> ${policy.raisedTo} (thinking shares the budget; OPENZOO_REASONING_MAX_TOKENS_X=1 disables)`);
           }
         }
-        if (policy.tiny || policy.raised || (policy.to && policy.to !== policy.from)) {
+        if (policy.tiny || policy.raised || autoRoute || (policy.to && policy.to !== policy.from)) {
           bodyBuf = Buffer.from(JSON.stringify(parsed));
         }
         // Tell the agent what it is actually connected to — in band, where it
@@ -1501,16 +1520,32 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // rewrite never gets its chance.
     const path = (req.url || '').split('?')[0];
     if (req.method === 'GET' && path === '/v1/models') {
+      // Catalog is chrome, not a paid call. Paying the list would wrap-walk
+      // an empty burner (~4.5s/row) and stall first paint / harness probe.
       try {
-        const { response } = await client.fetch(url, init);
-        const payload = await response.json();
-        res.writeHead(response.status, { 'content-type': 'application/json' });
-        res.end(JSON.stringify(response.ok ? augmentModelList(payload) : payload));
-        return;
-      } catch { /* fall through to the plain relay below */ }
+        const response = await fetchHeaders(url, init);
+        if (response.ok) {
+          const payload = await response.json();
+          // Quoteable catalog only. Raw OpenRouter dump includes :batch,
+          // $0 / missing prices, and we used to mint openzoo-* twins of each
+          // � Claude Code /model then showed 63 clones and Auto 500'd.
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify(modelsListForRequest(payload, req.headers)));
+          return;
+        }
+        await response.text().catch(() => {});
+      } catch { /* gateway 402/down � serve aliases so chrome still paints */ }
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(modelsListForRequest({ object: 'list', data: [] }, req.headers)));
+      return;
     }
     const probe = req.method === 'GET' && /^\/v1\/models\/(.+)$/.exec(path);
-    if (probe && ALIAS_IDS.includes(decodeURIComponent(probe[1]))) {
+    if (probe && isAutoModel(decodeURIComponent(probe[1]))) {
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(autoModelListEntry()));
+      return;
+    }
+    if (probe && isHarnessAliasId(decodeURIComponent(probe[1]))) {
       res.writeHead(200, { 'content-type': 'application/json' });
       res.end(JSON.stringify({ id: decodeURIComponent(probe[1]), object: 'model', owned_by: 'openzoo-alias' }));
       return;
@@ -1580,6 +1615,32 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       } else {
         result = await client.fetch(url, init);
       }
+      // Walk the auto shortlist on 429/5xx � cheapest-first among models that
+      // cleared the bar. Finite: one pass over fallbackChain(), never a loop.
+      if (autoRoute?.cleared_bar && isRetryableStatus(result.response.status)) {
+        const chain = fallbackChain(autoRoute);
+        for (const next of chain) {
+          const failed = result.response.status;
+          try { await result.response.arrayBuffer(); } catch { /* drain */ }
+          say(`openzoo/auto fallback HTTP ${failed} -> ${next}`);
+          const rewriteModel = (buf) => {
+            try {
+              const b = JSON.parse(buf.toString('utf8'));
+              b.model = next;
+              return Buffer.from(JSON.stringify(b));
+            } catch { return buf; }
+          };
+          bodyBuf = rewriteModel(bodyBuf);
+          init.body = bodyBuf;
+          if (cached) {
+            cached = { ...cached, body: rewriteModel(cached.body) };
+            result = await send(cached.body, cached.contextId, cached.topK, corpusCharsForSend(boundChars, cached.contextId, cached.corpus?.length));
+          } else {
+            result = await client.fetch(url, { ...init, body: bodyBuf });
+          }
+          if (!isRetryableStatus(result.response.status)) break;
+        }
+      }
       const { response, paid, receipt } = result;
       if (paid && receipt) {
         if (receipt.ok && typeof receipt.billedUsd === 'number') {
@@ -1624,6 +1685,13 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       // that contract ourselves. An upstream that someday truly streams (SSE
       // content-type) passes straight through the relay below, untouched.
       const upCt = response.headers.get('content-type') || '';
+      const noteAutoOutcome = (status, data, streamed = false) => {
+        if (!autoRoute) return;
+        let ok = outcomeFromResponse(status, data);
+        if (ok == null) return;
+        if (streamed && status >= 200 && status < 300) ok = true;
+        recordRouteOutcome(autoRoute, ok);
+      };
       if (isChat && response.ok && upCt.includes('application/json')) {
         let data = null;
         try { data = await response.clone().json(); } catch { /* not JSON after all */ }
@@ -1631,18 +1699,26 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         // completion already — no extra call, and unlike the account-level
         // /api/v1/credits total it is attributable to THIS proxy even though the
         // same OpenRouter key also pays for ttfx and everything else.
-        if (typeof data?.usage?.cost === 'number' && data.usage.cost >= 0) {
-          sessionActual += data.usage.cost;
-          actualCalls += 1;
+        {
           // PAIR THE NUMERATOR WITH THE DENOMINATOR. sessionSpent is summed on
           // three paths and sessionActual on two, so markupX divided ALL billed
-          // by the SUBSET that reported a real cost — a 402-receipt call added
+          // by the SUBSET that reported a real cost � a 402-receipt call added
           // to billed and nothing to real, and the ratio read 12.55x on a stack
           // running at ~1.0x. Track the billed side of exactly the calls whose
           // cost we actually learned.
           // Both figures ride the SAME response object, so read them together
           // rather than carrying one across sites and hoping the order holds.
-          billedWithActual += Number(data?.x402?.billedUsd) || 0;
+          //
+          // x402.billedUsd is often the QUOTE reserve (max_tokens � catalog),
+          // not the settled charge. MEASURED: $0.9858 reserved vs $0.007962
+          // usage.cost -> markupX lied at 124x on a ~1x call. Pair usage.cost
+          // with post-completion billed, never the reserve.
+          const pair = pairActualBilled(data?.x402, data?.usage);
+          if (pair) {
+            sessionActual += pair.upstreamUsd;
+            actualCalls += 1;
+            billedWithActual += pair.billedUsd;
+          }
         }
         // PREPAID CALLS STILL COST MONEY. The block above only meters calls
         // where THIS proxy answered a 402 and paid. When prepaid credit covers
@@ -1674,6 +1750,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
         }
         if (data?.object === 'chat.completion') {
+          noteAutoOutcome(response.status, data);
           if (rKey) replayPut(rKey, data, response.headers.get('x-payment-response'));
           // Anthropic-shaped caller gets an Anthropic-shaped answer, streamed
           // or not, so Claude Code and the SDKs parse it natively.
@@ -1714,12 +1791,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       // same figures the JSON path reads out of `data.x402`, same counters, so
       // the status line does not care which transport served the answer.
       const meterStreamed = (x) => {
+        // Same pairing rule as the JSON path: actualUsd / usage.cost with the
+        // settled billed twin, even on a wallet-paid stream (do not skip just
+        // because `paid` already recorded the quote-time receipt).
+        const pair = pairActualBilled(x, x?.usage);
+        if (pair) {
+          sessionActual += pair.upstreamUsd;
+          actualCalls += 1;
+          billedWithActual += pair.billedUsd;
+        }
         if (paid || typeof x?.billedUsd !== 'number') return;
         sessionSpent += x.billedUsd;
         sessionCogs += receiptUsedCogs(x);
         noteQuote(x);
         sessionDirect += receiptDirectUsd(x);
-        if (typeof x.actualUsd === 'number' && x.actualUsd >= 0) { sessionActual += x.actualUsd; actualCalls += 1; billedWithActual += x.billedUsd || 0; }
         if (didSpill) {
           log(spillPricedLine(x, { streamed: true }));
           spill.spillSpend += x.billedUsd;
@@ -1764,6 +1849,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         return;
       }
 
+      if (autoRoute) {
+        noteAutoOutcome(response.status, null, (upCt.includes('text/event-stream') && response.ok));
+      }
       await relay(res, response, meterStreamed);
     } catch (err) {
       if (err instanceof QuoteTooHighError) {