Merge remote-tracking branch 'origin/main' into agent-network/gateway-protocol-conformance

Two changes to routeClaimsModel, both about dated Anthropic ids.

Normalising the configured candidate as well as the requested model made
every dated build of a family interchangeable: a route registered against
claude-sonnet-4-5-20250101 also claimed ...-20250202, so an operator who
pinned a build deliberately would have served a different one, and with
several such routes declaration or path order decided which. Only an undated
registration now absorbs a dated request.

The per-model lookup also stamps the model its path names, so the guardrail's
allowlist — a separate and possibly narrower list than the route's — still
decides GET /v1/models/{id} rather than seeing no model at all.

AGENTS.md

@@ -1,6 +1,6 @@
 # NetBird Agent Guidelines
 
-**NetBird** is an open source connectivity platform: a WireGuard®-based overlay
+**NetBird** is an open-source connectivity platform: a WireGuard®-based overlay
 network with a control plane. The **agent** (`client/`) runs on user machines as
 a privileged daemon and manages the WireGuard interface, routing, firewall, and
 DNS. **Management** (`management/`) is the control plane and REST/gRPC API,

CONTRIBUTING.md

@@ -479,7 +479,7 @@ go test -race ./client/internal/dns/...
 
 ## Checklist before submitting a PR
 
-As a critical network service and open source project, we must enforce a few
+As a critical network service and open-source project, we must enforce a few
 things before submitting a pull request. The
 [pull request template](/.github/pull_request_template.md) mirrors this list —
 fill it in rather than deleting it.

README.md

@@ -130,7 +130,7 @@ In November 2022, NetBird joined the [StartUpSecure program](https://www.forschu
 ![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
 
 ### Acknowledgements
-We build on open source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
+We build on open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
 
 ### Legal
 This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/.

SECURITY.md

@@ -14,7 +14,7 @@ Report security issues one of these two ways:
   on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
 - **Email** — `security@netbird.io`.
 
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open source code, email us rather than
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
 filing a repository report.
 
 ### What to include

agent-network/README.md

@@ -40,6 +40,35 @@ You can then use this private endpoint to configure your AI agents, whether that
 Full step-by-step setup:
 **https://docs.netbird.io/agent-network/quickstart**
 
+## Client settings that don't follow the endpoint
+
+Most of an agent's traffic follows the base URL you hand it, but a few
+client-side checks call their vendor directly and never reach the proxy. On a
+network that blocks direct egress they fail even though inference works, so
+they are worth setting once when you roll the endpoint out.
+
+For Claude Code:
+
+- **Fast mode** checks availability against `api.anthropic.com` rather than the
+  configured base URL. Set `CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1` when the
+  agent authenticates with `ANTHROPIC_AUTH_TOKEN` alone (the usual shape when
+  the proxy injects the real provider key) or when a TLS-inspecting proxy
+  answers the check itself. Set
+  `CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1` when the network refuses the
+  connection outright. Fast mode is an Anthropic-API feature, so it is
+  unavailable on a Bedrock- or Vertex-backed endpoint whatever you set.
+- **Model discovery** is off by default. Set
+  `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` for the picker to list the
+  models your policies authorise; the proxy filters the response to that set.
+  The client gives discovery a three-second budget and treats any redirect as
+  a failure, so the endpoint must serve `/v1/models` directly.
+- **The WebFetch domain safety check** also calls `api.anthropic.com` directly
+  and is unaffected by the variables above.
+
+Allowing direct egress to `api.anthropic.com` covers the network cases but not
+the credential one, where the check reaches Anthropic and is rejected because
+the agent presents a proxy-issued key.
+
 ## Architecture 
 
 Agent Network is built on two existing NetBird capabilities:
@@ -67,30 +96,6 @@ components:
   — the management-side control plane: providers, policies, guardrails, limits, routing,
   and usage/access logs.
 
-## Access roles
-
-Agent Network permissions build on the account permission matrix
-([`management/server/permissions/`](../management/server/permissions)). The
-`agent_network` area is split into dotted submodules (`agent_network.providers`,
-`.policies`, `.guardrails`, `.budgets`, `.usage`, `.logs`, `.settings`); a role may
-grant a single submodule or the parent, which cascades to all of them.
-
-Two roles delegate Agent Network access without account-admin rights:
-
-- **`agent_network_admin`** — full control over the whole `agent_network` area plus
-  read-only users, groups, peers, and account info (needed to build policies).
-  Nothing else in the account.
-- **`usage_viewer`** — the regular User baseline plus read on
-  `agent_network.usage` (the aggregated usage and cost overview). No provider
-  configuration, no policies, no request-level access logs.
-
-Every authenticated user, regardless of role, can read the caller-scoped
-self-service endpoints: `GET /api/agent-network/me/setup` (the endpoint, providers,
-and models the caller's own policies allow — what a local AI tool needs and nothing
-more) and `GET /api/agent-network/me/consumption` (the caller's own token and cost
-counters). Role definitions live in
-[`management/server/permissions/roles/`](../management/server/permissions/roles).
-
 ## Documentation
 
 Full documentation, architecture, and quickstart:

docs/agent-networks/01-end-to-end-flows.md

@@ -115,7 +115,7 @@ sequenceDiagram
         Resp->>Resp: parse usage tokens, completion
         Note over Resp: capture_completion gates raw<br/>completion capture
         Resp->>Cost: tokens
-        Cost->>Cost: lookup rates from config-delivered<br/>pricing table + compute cost
+        Cost->>Cost: lookup pricing.yaml + compute cost
         Cost->>Rec: tokens + cost
         Rec->>MgmtGrpc: RecordLLMUsage(provider, model, prompt_t, completion_t, cost, groups, user)
         Rec-->>Log: emit access-log entry<br/>(if EnableLogCollection)

docs/agent-networks/modules/21-management-agentnetwork.md

@@ -15,10 +15,6 @@ Inside the package: `manager.go` is the CRUD + permissions-gated facade; `synthe
 | ---- | ---- |
 | `agentnetwork/manager.go` | Manager interface + CRUD + permission gates + bootstrap-settings + reconcile trigger |
 | `agentnetwork/synthesizer.go` | Settings/policy → wire-format synthesis; sole writer of the proxy middleware chain |
-| `agentnetwork/synthesizer_pricing.go` | `buildCostMeterConfigJSON` — default table + per-provider prices → `cost_meter` config |
-| `agentnetwork/pricing/defaults.go` | Default pricing table derived from the catalog + supplementals; `DefaultTable`, `LookupDefault`, wire `Entry` |
-| `agentnetwork/pricing/override.go` | `LoadFile`/`StartReloader` for `AgentNetwork.PricingDefaultsFile` (mtime poll, merge over compiled-in base) |
-| `agentnetwork/pricing/{exampleyaml,gen}.go` | Generates `defaults_llm_pricing.example.yaml` from the compiled-in table (golden-tested) |
 | `agentnetwork/policyselect.go` | Per-request policy attribution + account-budget ceiling (min-wins) |
 | `agentnetwork/reconcile.go` | Per-account synth diff vs in-memory cache → Create/Update/Delete |
 | `agentnetwork/catalog/catalog.go` | Static provider catalogue (auth headers, identity-injection shapes) |
@@ -52,8 +48,6 @@ flowchart TD
     I --> J[indexProviderGroups: providerID -> sorted source groups]
     J --> K[buildRouterConfigJSON drops orphan providers]
     J --> L[buildIdentityInjectConfigJSON per catalog entry]
-    J --> K2[buildCostMeterConfigJSON: default table + per-provider prices]
-    K2 --> P
     H --> M[mergeGuardrails: union allowlist, OR redact]
     M --> N[applyAccountCollectionControls account toggle = SOLE capture control]
     N --> O[marshalGuardrailConfig]
@@ -66,84 +60,6 @@ flowchart TD
     R --> T[accountManager.UpdateAccountPeers — fans synth ACLs into network map]
 ```
 
-### LLM pricing (management is the sole authority)
-
-**The proxy carries no price list.** Management synthesizes the entire pricing
-table and ships it inside `cost_meter`'s `ConfigJSON`, so a price change reaches
-the proxies as an ordinary mapping push — the chain rebuild installs a fresh
-table and there is nothing to reload on the proxy side.
-
-```mermaid
-flowchart TD
-    A[catalog.All — PricingSurfaces x Models] --> B[buildDefaultTable + supplementalDefaults]
-    B --> C{AgentNetwork.PricingDefaultsFile}
-    C -- absent --> D[compiled-in table serves]
-    C -- loaded --> E[LoadFile: merge file entries WHOLE over compiled base]
-    E --> F[mergedTable atomic.Pointer]
-    D --> G[DefaultTable]
-    F --> G
-    G --> H[buildCostMeterConfigJSON — pricing.defaults]
-    I[types.Provider.Models operator prices] --> J[normalizePricingModelID<br/>bedrock ARN/region/version, vertex @version]
-    J --> K[materializeEntry: default entry as base,<br/>operator input/output verbatim,<br/>cache pointers only when non-nil]
-    K --> L[pricing.providers keyed by provider record ID]
-    H --> M[cost_meter ConfigJSON]
-    L --> M
-    G --> N[GET /catalog — applyDefaultPricing prefills dashboard rows]
-    O[StartReloader: mtime poll every ReloadInterval 1m] --> E
-```
-
-**Two tiers, resolved per request on the proxy** (`synthesizer_pricing.go:22-35`):
-
-- `pricing.defaults` — surface (`openai`/`anthropic`/`bedrock`) → normalized model
-  id → rates. The **full** default table ships to every account: it is small
-  (~10 KB) and it is what keeps gateway-style providers (which enumerate no
-  models, so they claim every model) priced.
-- `pricing.providers` — provider **record** id → normalized model id → rates,
-  matched against the `llm.resolved_provider_id` the router stamps. Entries are
-  **fully materialized here**, at synth time: `materializeEntry` starts from the
-  default entry for that model so cache rates the operator didn't state are
-  inherited, overlays operator `input`/`output` verbatim (**including an explicit
-  0**, which prices a self-hosted or internal endpoint as free rather than
-  silently reverting to list price), and overlays cache-rate **pointers only when
-  non-nil** — `nil` means "inherit the default", an explicit `0` means "no
-  discount, bill this bucket at the input rate". The proxy therefore does two map
-  lookups and no merging.
-
-Same orphan rule as the router: a provider no enabled policy authorises is
-unreachable, so its prices aren't shipped. Model ids are normalized with the
-**same** functions the request parser uses (`NormalizeBedrockModel` /
-`NormalizeVertexModel`), which is what makes the per-record lookup key compare
-equal to the `llm.model` the proxy meters. Post-normalization duplicates resolve
-first-occurrence-wins, matching the routing dedup order.
-
-**`AgentNetwork.PricingDefaultsFile`** (`config.go:190-207`) lets an operator
-replace default rates without a rebuild. Schema is `surface → model → rates`
-(`input_per_1k`, `output_per_1k`, and optional `cached_input_per_1k` /
-`cache_read_per_1k` / `cache_creation_per_1k`). Semantics:
-
-- A **relative** path resolves against `<Datadir>`, so a bare filename lands
-  alongside the store. Empty config probes `<Datadir>/defaults_llm_pricing.yaml`.
-- An **explicitly configured** path is *required to load*: a typo or malformed
-  file fails startup, because the operator believes those rates are live. The
-  conventional probe is optional — an absent file just serves compiled-in
-  defaults, and the path stays watched in case it appears later.
-- File entries **replace** the compiled-in entry for the same (surface, model)
-  **whole** — they are not field-merged, so an entry must repeat the cache rates
-  it wants to keep. Everything the file doesn't mention keeps built-in rates.
-- Unknown YAML fields are rejected (`KnownFields(true)`) and every rate must be
-  finite and non-negative — the same constraints the HTTP API enforces on
-  operator per-provider prices.
-- Reload is an mtime poll (`ReloadInterval`, 1 min) and is **lenient at runtime**:
-  a parse error keeps the previous table, a deleted file reverts to compiled-in
-  defaults. A mid-edit save can never take pricing down.
-
-The live table feeds **both** consumers, which is what keeps them consistent: the
-synthesizer (what proxies actually bill with) and `GET /api/agent-network/catalog`
-via `applyDefaultPricing` (what the dashboard's model-row prices prefill with).
-`defaults_llm_pricing.example.yaml` is generated from the compiled-in table
-(`go generate ./management/internals/modules/agentnetwork/pricing`) and
-golden-tested, so operators start from a file matching the built-in rates exactly.
-
 ### Budget rule resolution (min-wins, group+user bound)
 
 ```mermaid
@@ -208,7 +124,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
   | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
   | on_request | 4 | `llm_guardrail` | `{"provider_allowlists"?: {providerID: []model}, "prompt_capture":{enabled,redact_pii}}` | – |
   | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
-  | on_response | 6 | `cost_meter` | `{"pricing":{"defaults":{surface:{model:rates}},"providers"?:{providerRecordID:{model:rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}` | – |
+  | on_response | 6 | `cost_meter` | `{}` | – |
   | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
 - **Synthesized service shape** (`synthesizer.go:739`): `Mode=HTTP`, `Private=true`, `Domain=<subdomain>.<cluster>`, `AccessGroups=unionSourceGroups(enabledPolicies)`, one `TargetTypeCluster` target with `Host=noop.invalid:443` (router rewrites per request), `Options.{DirectUpstream,AgentNetwork}=true`, `DisableAccessLog=!settings.EnableLogCollection`, `CaptureMax{Req,Resp}Bytes=1<<20`, `CaptureContentTypes=["application/json","text/event-stream"]`.
 
@@ -223,12 +139,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Orphan providers (no enabled policy authorises them) NEVER reach the router** (`synthesizer.go:351-357`); skipped from `identity_inject` for symmetry.
 - **Provider creation refuses empty `api_key`** (`manager.go:175`); **deletion refuses while any policy still references it** (`manager.go:265-273`).
 - **Session keypair stability across provider edits** (`manager.go:226-228`) — server-managed, copied through every `UpdateProvider`, never API-surfaced.
-- **Management is the sole pricing authority.** The proxy has no embedded price list, so an account whose `cost_meter` config carries no `pricing` block bills **nothing** (`cost.skipped=unknown_model`, $0) rather than falling back to stale built-ins. The top-level `pricing` wrapper is also the feature-detection signal in both directions: an old proxy ignores it as an unknown field, and a new proxy reads its absence as "old management".
-- **Per-provider prices are materialized at synth time, not merged on the proxy** (`synthesizer_pricing.go:114-131`). A per-record entry is always complete, so the proxy's lookup is per-record-then-defaults with no field-level fallback between tiers.
-- **An explicit operator price of `0` prices the model as free** — it must not be treated as "unset" and reverted to list price (`synthesizer_pricing.go:49-54`). Only *cache*-rate fields distinguish unset from zero, via `*float64`.
-- **Pricing model ids are normalized with the same functions the request parser uses** (`normalizePricingModelID`). If the two ever diverge, per-record prices silently stop matching and every request falls through to surface defaults.
-- **The default table's coverage is structural, not curated.** It is derived from the catalog via each provider's `PricingSurfaces`; `TestDefaultTable_CoversEveryCatalogModel` fails on an unpriced catalog model and `TestDefaultTable_NoConflictingContributions` fails if two providers contribute the same (surface, model) at different rates.
-- **A pricing-defaults file failure is fatal only at startup, and only for an explicitly configured path.** Runtime reload failures keep the previous table; a deleted file reverts to compiled-in defaults (`pricing/override.go:62-81, 113-148`).
 
 ## Things to scrutinize
 
@@ -266,12 +176,10 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Capture-pointer semantics (restated):** non-agent-network callers see no field → legacy nil-default emit, identical to pre-PR. Agent-network targets always carry an explicit `capture_*` value.
 - **`TestSynthesizeServices_HappyPath` was updated:** request-parser config moved from `{}` to `{"capture_prompt":false}` (`synthesizer_test.go:174`). External snapshot tests against synth output need updating.
 - **`MergedGuardrails` retains zeroed `TokenLimits`/`Budget`/`Retention`** even though `Policy.Limits` carries the real values now; `llm_limit_check` is the authoritative enforcement. Comment at `synthesizer.go:940-948` calls this out.
-- **`cost_meter`'s `pricing` block is version-skew-safe in both directions.** A proxy predating config-delivered pricing ignores the field as unknown JSON (it previously priced from its own embedded table, so it keeps billing — at its own rates, which is the skew to be aware of during a rolling upgrade). A current proxy paired with old management sees no `pricing` block, logs one warning at chain-build time, and records `cost.skipped=unknown_model` — token counting and cap enforcement are unaffected, only the USD annotation goes to $0.
 
 ### Performance
 
 - **`SynthesizeServices` runs on every controller tick / mutation reconcile.** Cost: 4 store reads + optional per-provider keypair backfill. Sort + index + merge are O(N log N) / O(P × G); dominant cost is JSON marshalling. No nested loops escape these dimensions.
-- **The full default pricing table is marshalled into every account's `cost_meter` config on every synth** (~10 KB serialized). This is a deliberate trade: it keeps gateway-style providers priced for every catalog model, and it is the largest single contributor to the synth JSON. `DefaultTable()` itself is a pointer load (or a `sync.Once`-built map) — the cost is the marshal, not the build.
 - **`reconcile.diffMappings` is O(N + M)** with N=M=1 per account today — effectively constant.
 - **`SynthesizeServicesForCluster`** (`synthesizer.go:71`) walks every account on a cluster; per-account failures are **swallowed** (`synthesizer.go:91-93`) so a single misconfigured account doesn't drop the cluster. Runs per proxy reconnect.
 
@@ -280,7 +188,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Activity codes:** `AgentNetwork{Provider,Policy,Guardrail,BudgetRule}{Created,Updated,Deleted}`; `AgentNetworkSettingsUpdated` with `log_collection/prompt_collection/redact_pii` payload (`manager.go:567-571`). **No activity code for `SelectPolicyForRequest` denies** — surfaced via proxy access log only (likely intentional given volume).
 - **Deny codes** namespaced: `llm_policy.{token,budget}_cap_exceeded`, `llm_account.{token,budget}_cap_exceeded` (`policyselect.go:18-26`).
 - **Reconcile failures are logged at warn and swallowed** (`reconcile.go:42-44`). Persistent synth failures (e.g. unknown catalog id) silently keep the proxy out of sync — consider a manager-level synth-health surface if this becomes a support burden.
-- **Pricing-file lifecycle logs at info** (load, reload, revert-to-built-ins) and **at warn** for a runtime reload failure; the mtime check itself is `Debugf`. There is no metric on reload failures, so an operator who breaks the file mid-flight keeps billing at the previous table with only a log line to show it (`pricing/override.go:113-148`).
 
 ## Test coverage
 
@@ -291,9 +198,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 | `synthesizer_guardrail_realstore_test.go` | `PromptCaptureAccountIsSoleControl`; `PromptCaptureFlowsWhenAccountOptsIn`; `AccountRedactWithoutGuardrailRedact`; `NoGuardrail_CaptureOff`. |
 | `synthesizer_log_collection_realstore_test.go` | `LogCollection{Off_SuppressesAccessLog,On_PermitsAccessLog}` — verifies `DisableAccessLog` propagation through `ToProtoMapping`. |
 | `synthesizer_parser_redact_realstore_test.go` | **Capture-pointer regression suite:** `ParserConfigsCarryRedactPii`; `ParserConfigsSuppressCaptureWhenLogCollectionOnly` (log=on/prompt=off ⇒ both capture flags false); `ParserConfigsOmitRedactPiiWhenOff`. |
-| `synthesizer_pricing_test.go` | `BuildCostMeterConfig_{BedrockModelNormalization,CacheRateNilVsZero,OrphanAndGatewayProviders}` — the per-record tier's three load-bearing rules: keys normalized like the parser's, `nil` cache pointer inherits vs explicit `0` bills at input rate, and orphan / gateway (empty `Models`) providers ship no per-record entry. |
-| `pricing/defaults_test.go` | `DefaultTable_{CoversEveryCatalogModel,NoConflictingContributions,AllRatesFiniteNonNegative,PinnedRates}`; `LookupDefault_SurfaceOrder`. Catalog-derived coverage + rate sanity are structural, not curated. |
-| `pricing/override_test.go` | `LoadFile_{MergesOverCompiledDefaults,MissingPath,RejectsInvalid}`; `Reload_LifeCycle` (mtime detect, parse error keeps previous, delete reverts to built-ins); `ExampleYAML_InSyncWithBuiltins` golden. |
 | `policyselect_test.go` | Mock-store: `NoApplicablePolicies`; `AllowWithLowestGroupAttribution`; `LargerPoolWinsAcrossUsageLevels`; `StaysOnLargerPoolAfterPartialDrain`; `FallsThroughToSmallerPoolWhenLargerExhausted`; `TiebreakBy{LargerGroupPool,CreatedAt}`; `DeniesWhenAllExhausted`; `UncappedPolicyAlwaysWinsAgainstCapped`; `DisabledPolicyIgnored`; `StoreErrorPropagates`; `RejectsEmptyAccount`; `SharesGroupCounterAcrossPolicies`; `AntiFallThroughOnLowestGroup`; `BudgetOnlyExhaustionDenies`; `BudgetTighterThanTokenWins`. |
 | `policyselect_realstore_test.go` | Real-sqlite regression guard: `NoApplicablePolicies`; `AllowAndLowestGroupAttribution`; `LargerPoolWins_FallsThroughWhenExhausted`; `BudgetCapDenies`; `GroupCounterSharedAcrossPolicies`; `DisabledPolicyIgnored`. |
 | `policyselect_account_realstore_test.go` | Account budget rules: `AccountCeilingBindsEvenWithUncappedPolicy` (min-wins); `AccountGroupCeiling`; `AccountTargetUsersBindsOnlyThatUser`; `AccountRuleRecordsToOwnWindow`. |

docs/agent-networks/modules/31-proxy-middleware-builtin.md

@@ -5,7 +5,7 @@ LLM request. The two highest-blast-radius areas are the **capture-pointer
 semantics** and the **limit_check ⇒ limit_record** record-once invariant.
 
 Sibling module: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — the SDK
-adapters + pricing table and cost formula this chain delegates to.
+adapters + pricing catalog this chain delegates to.
 
 ---
 
@@ -34,7 +34,7 @@ rewrites.
 | `llm_identity_inject` | OnRequest | `llm.{resolved_provider_id,authorising_groups}`, `Input.{UserEmail,UserID,UserGroups,UserGroupNames}` | none | header strip/inject + optional body rewrite |
 | `llm_guardrail` | OnRequest | `llm.{model,request_prompt_raw}` | `llm_policy.{decision,reason}`, `llm.request_prompt` | none (model allowlist deny) |
 | `llm_response_parser` | OnResponse | `llm.provider`, `Input.{RespHeaders,RespBody,Status}` | `llm.{input,output,total,cached_input,cache_creation}_tokens`, `llm.response_completion` | none |
-| `cost_meter` | OnResponse | `llm.{provider,model,resolved_provider_id}`, token buckets | `cost.usd_{input,cached_input,cache_creation,output,total,cache}` or `cost.skipped` | none (in-memory pricing lookup) |
+| `cost_meter` | OnResponse | `llm.{provider,model}`, token buckets | `cost.usd_total` or `cost.skipped` | pricing lookup |
 | `llm_limit_record` | OnResponse | `llm.{attribution_group_id,attribution_window_seconds,input_tokens,output_tokens}`, `cost.usd_total` | none | gRPC `RecordLLMUsage` |
 
 [all_test.go:26–40](../../../proxy/internal/middleware/builtin/all_test.go)
@@ -44,7 +44,7 @@ locks the ID set; adding or removing one is a conscious extension.
 
 | File | LOC | Notes |
 |---|---:|---|
-| `builtin.go` | 90 | Registry + `FactoryContext` (ctx, meter, logger, mgmt client) |
+| `builtin.go` | 86 | Registry + `FactoryContext` (ctx, data dir, meter, logger, mgmt client) |
 | `all_test.go` | 41 | Locks the 8-ID registry surface |
 | `agentnetwork_chain_integration_test.go` | 319 | Live sqlite + real gRPC bufconn; gate→recorder wire path |
 | `llm_request_parser/*` | 162 / 66 / 356 | Provider detection, body parse, prompt extraction with capture-pointer gating |
@@ -53,7 +53,7 @@ locks the ID set; adding or removing one is a conscious extension.
 | `llm_identity_inject/*` | 440 / 108 / 666 | HeaderPair (LiteLLM) + JSONMetadata (Portkey) + ExtraHeaders |
 | `llm_guardrail/*` | 176 / 82 / 75 / 219 / 217 | Model allowlist + optional prompt capture with PII redaction |
 | `llm_response_parser/*` | 258 / 222 / 43 / 433 / 169 / 111 | Buffered + SSE accumulation; AWS event-stream accumulator (`streaming_bedrock.go`) for Bedrock; capture-pointer gates completion emit |
-| `cost_meter/*` | 236 / 98 / 586 | Token → USD via `proxy/internal/llm/pricing`; both pricing tiers arrive in the middleware config |
+| `cost_meter/*` | 181 / 84 / 439 | Token → USD via `proxy/internal/llm/pricing` |
 | `llm_limit_record/*` | 144 / 35 / 191 | Post-flight `RecordLLMUsage` (5s, debug-on-error) |
 
 ## Per-middleware
@@ -168,46 +168,12 @@ token schema.
 
 ### cost_meter
 
-Reads `llm.provider` + `llm.model` + token buckets, looks up the per-1k rates,
-and emits the full `cost.usd_*` breakdown (four per-bucket values plus the
-`_total` and `_cache` aggregates) or a closed-set `cost.skipped` reason
-(`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
-`unknown_model`).
-
-**Management owns pricing.** The proxy carries no embedded price list: the whole
-table arrives in this middleware's `ConfigJSON` as
-`{pricing: {defaults, providers}}`, synthesized by management from the catalog
-plus the operator's stored per-provider prices
-([factory.go:13–34](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
-Both tiers are validated by `pricing.NewTable` / `pricing.NewEntries` at
-construction, so a non-finite or negative rate fails the chain build. A price
-change is an ordinary mapping push — the chain rebuild yields a fresh instance
-over a fresh immutable table, so there is no data dir, no pricing file, no
-reload goroutine, and nothing to invalidate.
-
-**Two-tier lookup**
-([middleware.go:165–183](../../../proxy/internal/middleware/builtin/cost_meter/middleware.go)):
-
-1. **Per-provider-record** — the operator's stored price for the route that
-   actually served the request, keyed by the `llm.resolved_provider_id` that
-   `llm_router` stamped on the allow path, then by normalized model id. Entries
-   arrive fully materialized (management folds default cache rates in at synth
-   time), so there is no merging here. Absent metadata — no router in the chain
-   — skips this tier.
-2. **Surface defaults** — the catalog-derived table keyed by `llm.provider`
-   (`openai`/`anthropic`/`bedrock`). This is also what prices gateway-style
-   providers, which enumerate no models and therefore get no per-record entry.
-
-**Backward compatibility:** a config with no `pricing` block means management
-predates config-delivered pricing. The factory logs one warning at build time
-and the instance records `cost.skipped=unknown_model` ($0) for every request
-rather than falling back to a stale built-in price list
-([factory.go:55–60](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
-
-**Key invariant:** the provider-shape switch lives in `pricing.EntryCosts`
-(sibling doc) and is selected by the **surface**, not by which tier the entry
-came from — `cost_meter` stays provider-agnostic, and a per-record override on
-an Anthropic route still bills its cache buckets additively.
+Reads `llm.provider` + `llm.model` + token buckets, looks up per-1k rate via
+`pricing.Loader`, emits `cost.usd_total` or a closed-set `cost.skipped`
+reason (`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
+`unknown_model`). Loader's hot-reload goroutine is bound to proxy-lifetime
+context via `startReloader`. **Key invariant:** provider-shape switch lives
+in `pricing.Table.Cost` (sibling doc) — `cost_meter` stays provider-agnostic.
 
 ### llm_limit_record
 
@@ -280,14 +246,12 @@ no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
 | `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
 | `llm_guardrail` | `{provider_allowlists: {providerID: []string}, prompt_capture: {enabled, redact_pii}}` — allowlist keyed by resolved provider id; a provider absent from the map is unrestricted (fail-closed backstop; authoritative per-policy/group check is management's `CheckLLMPolicyLimits`) |
 | `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
-| `cost_meter` | `{pricing: {defaults: {surface: {model: rates}}, providers: {providerRecordID: {model: rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}`. A missing `pricing` key means "management predates config-delivered pricing": every request records `cost.skipped=unknown_model` |
+| `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
 | `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
 
 All factories accept empty / null / `{}` / whitespace as zero-value config;
 only structurally invalid JSON is rejected so misconfig surfaces at chain
-build time. `cost_meter` adds a semantic check on top of that: a `pricing`
-block carrying a negative or non-finite rate fails the build too, rather than
-mispricing live traffic.
+build time.
 
 ## Invariants
 
@@ -356,11 +320,10 @@ non-object `metadata` field
 — header path still attributes, but body-level tag-budget enforcement
 doesn't run for that request.
 
-**Concurrency.** `cost_meter`'s two pricing tables are built once from the
-middleware config and never mutated, so the lookup path needs no lock or atomic
-swap — a price change replaces the whole instance. Every middleware is
-otherwise a stateless value receiver. Integration test uses real bufconn gRPC —
-race detector is the meaningful bar.
+**Concurrency.** `cost_meter` shares a `pricing.Loader` via
+`atomic.Pointer[Table]`; readers always see a consistent table. Every
+middleware is a stateless value receiver. Integration test uses real bufconn
+gRPC — race detector is the meaningful bar.
 
 **Perf.** Hot path is `lookupKV` linear scan over <10 KVs; `cost_meter.Cost`
 is O(1); SSE accumulation is single-pass. No map allocation per call.
@@ -386,13 +349,13 @@ counter accuracy.
 | `llm_guardrail/redact_test.go` | 15 | Email, SSN, phone (E.164 + NA), bearer, IPv4; fixture-driven |
 | `llm_response_parser/middleware_test.go` | 18 | Buffered OAI+Anthro, capture-pointer, redact, truncation |
 | `llm_response_parser/streaming_test.go` | 7 | OAI usage frame, Anthro message_delta, truncated body best-effort |
-| `cost_meter/middleware_test.go` | 22 | Each skip reason, provider-shape formulas, config-delivered defaults, per-record-beats-defaults + miss-falls-back, per-record uses surface formula, nil-pricing skips everything, invalid-rate rejection |
+| `cost_meter/middleware_test.go` | 17 | Each skip reason, provider-shape, pricing loader integration |
 | `llm_limit_record/middleware_test.go` | 7 | Skip-on-no-signal, skip-on-missing-attribution, RPC failure swallowed |
 
 ## Cross-references
 
 - Sibling: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — SDK adapters
-  + SSE framer + pricing table and cost formula.
+  + SSE framer + pricing loader.
 - Path-routed providers (Vertex AI + Bedrock), `keyfile::` credential, GCP
   token minting, `/bedrock` prefix:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/32-proxy-llm-parsers.md

@@ -9,7 +9,7 @@ pricing table's per-provider cost formula is the highest-leverage place a
 small bug would silently mis-bill operators.
 
 Sibling module: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
-— the 8 middlewares that consume this package's parsers + pricing table.
+— the 8 middlewares that consume this package's parsers + pricing loader.
 
 ---
 
@@ -24,9 +24,8 @@ proxy-framework dependencies:
 - `openai.go` / `anthropic.go` / `bedrock.go` — per-provider `Parser` impls.
 - `sse.go` — SSE scanner (`Scanner`, `Event`, `NewScanner`).
 - `errors.go` — sentinels callers branch on with `errors.Is`.
-- `pricing/` — immutable pricing table + the per-surface cost formula. The
-  rates themselves come from management inside `cost_meter`'s middleware
-  config; this package holds no price list and reads no files.
+- `pricing/` — embedded-default + hot-reload override table with
+  symlink-safe Unix loader (build-tagged stub elsewhere).
 - `fixtures/` — captured request/response/stream bodies the tests replay.
 
 The package carries zero proxy-framework dependencies so the same parsers can
@@ -48,9 +47,12 @@ be reused later by a WASM adapter
 | `sse_test.go` | 175 | 12 tests; fixture replay + multiline + size limits |
 | `parser_test.go` | 53 | `Parsers()`, `DetectParser`, provider enum values |
 | `errors.go` | 31 | 6 sentinels: `Err{Unknown,Unsupported}Provider/Model`, `Err{NotLLM,Malformed}Response`, `ErrStreamingUnsupported`, `ErrMalformedRequest` |
-| `pricing/pricing.go` | 234 | `Table`, `Entry`, `EntryJSON`, `Costs`; `NewTable`/`NewEntries` validation + `EntryCosts` formula. No I/O, no reload, no embedded rates |
-| `pricing/pricing_test.go` | 177 | 10 tests — provider-shape formulas, cached clamp, rate fallback, nil-safety, rate validation |
-| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream |
+| `pricing/pricing.go` | 421 | `Loader`, `Table`, `Entry`; embedded defaults + atomic swap + mtime reload |
+| `pricing/pricing_unix.go` | 69 | `O_NOFOLLOW` + fstat-from-FD + 1 MiB cap |
+| `pricing/pricing_other.go` | 21 | Stub returning "not supported on this platform" |
+| `pricing/pricing_test.go` | 432 | 21 tests — symlink rejection, reload race, path traversal, oversize |
+| `pricing/defaults_pricing.yaml` | 85 | go:embed source of truth |
+| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream + pricing starter |
 
 ## Request body → parser dispatch
 
@@ -186,11 +188,9 @@ response leg, covering both Bedrock body shapes:
   `totalTokens`). `firstNonZero` folds the two naming conventions into one
   `Usage`; when Converse omits `totalTokens` the parser sums the buckets.
 
-`ProviderName()` returns `"bedrock"` — its own pricing surface in the table
-management ships, keyed by the **normalised** model id (region prefix + version
-suffix stripped by the request parser; management normalises its keys the same
-way at synth time so the two compare equal). `ParseResponse` returns
-`ErrStreamingUnsupported` for an
+`ProviderName()` returns `"bedrock"` — its own `defaults_pricing.yaml` block,
+keyed by the **normalised** model id (region prefix + version suffix stripped by
+the request parser). `ParseResponse` returns `ErrStreamingUnsupported` for an
 AWS binary event-stream content-type (`application/vnd.amazon.eventstream`,
 `isAWSEventStream`) so the caller routes to the streaming accumulator instead.
 
@@ -205,34 +205,11 @@ response body. Streaming accumulators live in the middleware package
 ([llm_response_parser/streaming.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
 but use `llm.NewScanner` so the framing contract stays here.
 
-### Pricing table
+### Pricing catalog
 
-**Management is the sole pricing authority.** The proxy carries no embedded
-price list and reads no pricing file: the whole table arrives inside
-`cost_meter`'s `ConfigJSON` on the ordinary mapping push, and a price change
-is just another push — the chain rebuild constructs a fresh `Table`, so there
-is nothing to reload
-([pricing.go:1–7](../../../proxy/internal/llm/pricing/pricing.go)). The
-management side of the contract (catalog defaults, the operator's stored
-per-provider prices, and `AgentNetwork.PricingDefaultsFile`) is covered in the
-management-side module guide; `cost_meter`'s wire shape is in
-[31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md).
-
-`EntryJSON`
-([pricing.go:36–45](../../../proxy/internal/llm/pricing/pricing.go)) is the
-management→proxy contract — five USD-per-1k rates under `input_per_1k`,
-`output_per_1k`, `cached_input_per_1k`, `cache_read_per_1k`,
-`cache_creation_per_1k`. Management's `pricing.Entry` marshals the identical
-names, and `EntryJSON`/`Entry` are field-identical so `NewEntries` converts by
-direct struct conversion rather than field-by-field copying (a new rate can't
-be silently dropped in transit).
-
-`EntryCosts`
-([pricing.go:183–234](../../../proxy/internal/llm/pricing/pricing.go))
-is the cost formula — most security-relevant math in this module. The
-**surface** (the `llm.provider` value the request parser stamped) selects the
-formula, never the tier the entry came from: a per-provider-record override on
-an Anthropic route still bills its cache buckets additively.
+`Table.Cost`
+([pricing.go:129–174](../../../proxy/internal/llm/pricing/pricing.go))
+is the cost formula — most security-relevant math in this module:
 
 | Provider | Formula |
 |---|---|
@@ -241,7 +218,7 @@ an Anthropic route still bills its cache buckets additively.
 | default | `inTokens × InputPer1K + outTokens × OutputPer1K` |
 
 `bedrock` shares the Anthropic additive-cache formula
-([pricing.go:214–229](../../../proxy/internal/llm/pricing/pricing.go)):
+([pricing.go:172-174](../../../proxy/internal/llm/pricing/pricing.go)):
 Anthropic-on-Bedrock reports the same additive cache buckets, while non-Anthropic
 Bedrock models (Nova, Llama) simply report zero in those buckets so cost reduces
 to `input + output`.
@@ -249,12 +226,15 @@ to `input + output`.
 Each per-bucket rate falls back to `InputPer1K` when zero — operators opt in
 to discounts by setting the field.
 
-`Costs`
-([pricing.go:143–163](../../../proxy/internal/llm/pricing/pricing.go)) is the
-per-request split. The four per-bucket fields are the base; `TotalUSD` and
-`CacheUSD` are **derived** in `newCosts` so the aggregates can never drift from
-the breakdown. `InputUSD` is always the non-cached input bucket on both
-provider shapes, so input and cached-input never double-count.
+`Loader`
+([pricing.go:212–268](../../../proxy/internal/llm/pricing/pricing.go))
+overlays an optional `pricing.yaml` from data-dir on top of the go:embed
+defaults. Atomic pointer swap means readers never observe a partial update.
+The mtime-poll reloader (30s default cadence) keeps the previous table on
+parse failure so cost annotation never goes blank during a botched edit.
+
+`defaults_pricing.yaml` is the source of truth for built-in pricing.
+Operator overrides only carry the entries they want to change.
 
 ## Public contracts
 
@@ -284,38 +264,29 @@ Order matters: `DetectFromURL` ties resolve by registration order.
 `ProviderBedrock = 3`. Numeric values are persisted in nothing today but treat
 them as wire-stable — new providers must take fresh numbers.
 
-**`Pricing` construction + lookup**
-([pricing.go:60–130](../../../proxy/internal/llm/pricing/pricing.go)):
+**`Pricing` lookup**
+([pricing.go:129](../../../proxy/internal/llm/pricing/pricing.go)):
 
 ```go
-func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error)
-func NewTable(raw map[string]map[string]EntryJSON) (*Table, error)
-
-func (t *Table) Lookup(provider, model string) (Entry, bool)
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool)
-func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool)
-func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs
 ```
 
-`NewTable` is the surface-keyed defaults table; `NewEntries` returns the raw
-two-level map `cost_meter` uses for the per-provider-record tier (it looks up an
-`Entry` directly and calls `EntryCosts`, so it needs no `Table` wrapper). Both
-reject any non-finite or negative rate, so a corrupt config fails the chain
-build rather than mispricing silently. Nil input yields an empty,
-never-matching table.
-
-Nil-safe: `t.Cost`/`t.Lookup` on a nil receiver returns `ok=false`
-([pricing.go:96–99](../../../proxy/internal/llm/pricing/pricing.go)).
-`ok=false` means the surface or model is absent from the table management sent;
-the caller emits `cost.skipped=unknown_model`.
+Nil-safe: `t.Cost` on a nil receiver returns `(0, false)`
+([pricing.go:130–132](../../../proxy/internal/llm/pricing/pricing.go)).
+`ok=false` means provider or model is absent from the loaded table; the caller
+emits `cost.skipped=unknown_model`.
 
 ## Invariants
 
-1. **The pricing package is pure and platform-independent.** No file I/O, no
-   `//go:embed`, no goroutines, no build tags — the rates arrive as config, so
-   there is nothing platform-specific left to port. Anything reintroducing a
-   read-from-disk path here re-splits pricing authority between management and
-   the proxy, which is exactly what this design removed.
+1. **Cross-platform pricing build.** `pricing_unix.go` carries the only
+   functional `loadPricing` (uses `syscall.O_NOFOLLOW` and `f.Stat()` on an
+   open descriptor — both Unix-only). `pricing_other.go` is a build-tag
+   fallback that returns `"not supported on this platform"`
+   ([pricing_other.go:14–16](../../../proxy/internal/llm/pricing/pricing_other.go)).
+   The proxy is Linux-only in production today; a Windows port needs an
+   equivalent path-as-handle implementation. Reviewers building on Windows
+   should expect this surface to return an error at startup if an override
+   file is configured.
 
 2. **SSE scanner handles partial chunks.** A buffered prefix that doesn't end
    in `\n\n` still yields its accumulated event before `io.EOF`
@@ -327,45 +298,38 @@ the caller emits `cost.skipped=unknown_model`.
    usage rather than aborting
    ([streaming.go:68–73, 144–150](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go)).
 
-3. **Management is the only source of rates.** `Table` has no constructor that
-   invents prices: the only way in is `NewTable`/`NewEntries` over the wire map
-   management sent. A missing or empty `pricing` block therefore means *no
-   prices at all* (`cost_meter` records `cost.skipped=unknown_model`, $0) —
-   never a stale built-in fallback that would silently bill list price.
+3. **`defaults_pricing.yaml` is the source of truth.** Compiled into the
+   binary via `//go:embed`
+   ([pricing.go:29–30](../../../proxy/internal/llm/pricing/pricing.go)).
+   `DefaultTable()` parses once and panics on parse failure
+   ([pricing.go:42–49](../../../proxy/internal/llm/pricing/pricing.go))
+   — by design: a broken embedded YAML must not ship to production.
 
-4. **Tables are immutable once built.** `Table.entries` is written only in
-   `NewEntries` and never mutated afterwards, and `cost_meter`'s `perRecord`
-   map is likewise build-time-only
-   ([pricing.go:47–52](../../../proxy/internal/llm/pricing/pricing.go)). This
-   is what makes the no-reload design safe: a price change arrives as a mapping
-   push that builds a new middleware instance over a new table, so concurrent
-   readers can't observe a half-updated price list and no atomic swap or lock
-   is needed on the hot path.
+4. **Loader path validation.** `resolveMiddlewareDataPath`
+   ([pricing.go:370–394](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects absolute paths, traversal segments, and basenames that fail
+   `basenameRegex = ^[a-zA-Z0-9._-]+$`. The resolved path must remain
+   inside `baseDir` even after `filepath.Clean`. Tests:
+   `TestNewLoader_PathValidation`, `TestNewLoader_PathValidation_Extended`,
+   `TestNewLoader_SymlinkOutsideBaseDirRejected`, `TestNewLoader_SymlinkRejected`.
 
-5. **Rate validation happens at chain-build time, not per request.**
-   `NewEntries` rejects negative, NaN, and ±Inf rates field by field
-   ([pricing.go:60–83](../../../proxy/internal/llm/pricing/pricing.go)), naming
-   the offending surface/model/field in the error. Management enforces the same
-   constraints at its API boundary and in its YAML parser, so this is
-   defense-in-depth — but it means a corrupt push fails loudly at build instead
-   of producing negative costs on live traffic. Test:
-   `TestNewTable_ValidatesRates`.
+5. **Unix loader symlink safety.** `O_NOFOLLOW` on open, `f.Stat()` on the
+   open descriptor (never re-stat by path), `info.Mode().IsRegular()` check,
+   `io.LimitReader(f, maxPricingBytes+1)` with a final size assertion
+   ([pricing_unix.go:25–57](../../../proxy/internal/llm/pricing/pricing_unix.go)).
+   A mid-read symlink swap is detected because the fstat is on the original
+   fd. Test: `TestNewLoader_RejectsOversizedFile_FixesM4`.
 
-6. **New rates must be added to `Entry`, `EntryJSON`, *and* management's
-   `pricing.Entry` together.** `NewEntries` converts by direct struct
-   conversion `Entry(e)`
-   ([pricing.go:76–78](../../../proxy/internal/llm/pricing/pricing.go)), which
-   only compiles while the two structs stay field-identical — so the proxy half
-   is compiler-enforced. The management half is not: a rate added there but not
-   here unmarshals into nothing and prices that bucket at `InputPer1K`.
+6. **`yaml.NewDecoder(...).KnownFields(true)`**
+   ([pricing.go:397–398](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects YAML files that carry fields not in the schema. A typo in an
+   operator override file fails loud instead of silently zeroing rates.
 
 ## Things to scrutinise
 
-**Correctness.** Verify the OpenAI cached-prompt clamp at
-[pricing.go:203–206](../../../proxy/internal/llm/pricing/pricing.go)
-short-circuits before subtraction. Negative token counts are clamped to zero up
-front ([pricing.go:186–197](../../../proxy/internal/llm/pricing/pricing.go)) so
-no formula can yield a negative cost. `Anthropic.TotalTokens` sums all four
+**Correctness.** Verify OpenAI cached-prompt clamp at
+[pricing.go:147–149](../../../proxy/internal/llm/pricing/pricing.go)
+short-circuits before subtraction. `Anthropic.TotalTokens` sums all four
 buckets (in + out + cache_read + cache_creation) — downstream dashboards
 need to know this differs from `input + output`.
 `OpenAIParser.ExtractPrompt` falls through `messages → input → prompt`; a
@@ -374,27 +338,22 @@ noting).
 
 **Security.** `Scanner.maxLine = 1 MiB`; a 2 MiB single-line `data:` event
 errors from `Scanner.Next` and both accumulators stop with partial usage.
-Pricing is no longer file-backed, so the loader's path-traversal / symlink /
-oversize surface is gone entirely — the config channel (an authenticated
-mapping push from management) is now the only way rates enter the proxy, and
-`NewEntries` is the validation boundary on it. A new rate added to management's
-`pricing.Entry` but not to `EntryJSON` here is the remaining silent-mispricing
-path (see invariant 6).
+Pricing file 1 MiB cap is orders of magnitude larger than realistic. Confirm
+new schema additions are mirrored in both `pricingFile` and `Entry`;
+`KnownFields(true)` will reject silently-typo'd operator overrides
+otherwise.
 
-**Concurrency.** Nothing in this package is shared mutable state: tables are
-built once and never written again, so `cost_meter`'s hot path is lock-free by
-construction rather than by atomic swap. Per-call `Scanner` instances mean no
-shared state across concurrent response-parser calls.
+**Concurrency.** `Loader.table` is `atomic.Pointer[Table]`; readers never
+block or see a torn table. `Loader.Reload` is one goroutine, cancelled via
+context (`TestLoader_ReloadBackgroundLoopCancellation`). `DefaultTable()`
+uses `sync.Once`. Per-call `Scanner` instances mean no shared state across
+concurrent response-parser calls.
 
-**Perf.** `Table.Cost` is two map lookups + multiplications, O(1); the
-per-provider-record tier adds at most one more lookup. `Scanner.Next` is one
-`ReadString('\n')` per line. No background goroutines and no per-request
-allocation of pricing state.
+**Perf.** `Table.Cost` is two map lookups + multiplications, O(1).
+`Scanner.Next` is one `ReadString('\n')` per line. Pricing reload poll 30s.
 
-**Observability.** A config carrying no `pricing` block logs one warning at
-chain-build time (`cost_meter` factory) and then records
-`cost.skipped=unknown_model` per request, so an old-management deployment is
-visible in both logs and the access log rather than quietly reporting $0.
+**Observability.** Reload failures count via `metric.Int64Counter` keyed
+`plugin`; warning log rate-limited at 5 min so a broken file doesn't flood.
 Parser errors return sentinels — middleware uses `errors.Is` to map to the
 right `cost.skipped` reason.
 
@@ -406,7 +365,7 @@ right `cost.skipped` reason.
 | `openai_test.go` | 11 | Chat Completions + Responses API + legacy `prompt`; cached-tokens subset for both naming conventions; fixture replays |
 | `anthropic_test.go` | 7 | Messages + legacy `/v1/complete`; streaming REJECTED on `ParseResponse` (must use scanner); fixture replays |
 | `sse_test.go` | 12 | Fixture replay both providers; multiline `data:`; CRLF; comment skip; trailing-event-without-blank-line; oversize rejection |
-| `pricing/pricing_test.go` | 10 | Provider-shape switch (surface selects the formula); cached-rate + cache-read/creation fallback to `InputPer1K`; cached-clamp; negative-token clamp; nil-receiver safety; rate validation (negative / NaN / Inf rejected); nil + empty table |
+| `pricing/pricing_test.go` | 21 | Provider-shape switch; cached-rate fallback; cached-clamp; symlink rejection (target outside basedir + symlink to file); path validation matrix; oversize rejection; reload-keeps-previous-on-parse-error; mtime change detection; goroutine cancellation |
 
 **Fixtures** ([proxy/internal/llm/fixtures/](../../../proxy/internal/llm/fixtures/)):
 `openai_chat_completion.json` (chat.completions with usage),
@@ -414,15 +373,14 @@ right `cost.skipped` reason.
 `openai_stream.txt` (3 deltas + usage + `[DONE]`),
 `anthropic_messages.json` (Messages API non-streaming),
 `anthropic_stream.txt` (full 7-event sequence: message_start →
-content_block_{start,delta×2,stop} → message_delta (usage) → message_stop).
-No pricing fixture: the table is config-delivered, so pricing tests construct
-it in-process from a wire-shape map.
+content_block_{start,delta×2,stop} → message_delta (usage) → message_stop),
+`pricing.yaml` (realistic-pricing starter for operator overrides).
 
 ## Cross-references
 
 - Sibling: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
   — the chain that calls `llm.Parsers()`, `llm.ParserByName`,
-  `llm.NewScanner`, `pricing.NewTable` / `pricing.NewEntries`.
+  `llm.NewScanner`, `pricing.NewLoader`.
 - Path-routed providers (Vertex AI + Bedrock), credential syntax, and the
   Bedrock AWS event-stream accumulator:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/33-proxy-runtime.md

@@ -1,7 +1,7 @@
 # proxy/runtime — translate + serve + log
 
 > **Risk level:** High — every config push from management is translated here, and the chain runs on every HTTP request to a synth target.
-> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path. Middleware config is entirely wire-delivered — no proxy-side data dir is involved, including for LLM pricing, which management ships inside `cost_meter`'s config.
+> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareDataDir`, `MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path.
 
 ## Module boundary
 
@@ -114,7 +114,8 @@ At **request time** the access-log middleware stamps `CapturedData`; the auth ch
 
 ## Public contracts touched
 
-- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:249-253). There is no `MiddlewareDataDir`: no built-in middleware reads config from disk, so `builtin.FactoryContext` carries only the proxy-lifetime context, meter, logger, and management client.
+- `proxy.Server.MiddlewareDataDir` (string) — base dir for file-backed middleware config (server.go:238-241).
+- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:248-250).
 - `proxy/internal/proxy.WithMiddlewareManager(*middleware.Manager) Option` — new option on `NewReverseProxy`; nil keeps the fast path (reverseproxy.go:48-56).
 - `proxy/internal/proxy.PathTarget` adds `Middlewares`, `CaptureConfig`, `AgentNetwork`, `DisableAccessLog` (servicemapping.go:27-51), all zero-default.
 - `proxy/internal/proxy.CapturedData` adds `agentNetwork`, `suppressAccessLog`, `userGroupNames` behind `sync.RWMutex`; slices deep-copied (context.go:47-66, 183-258).

docs/agent-networks/modules/50-path-routed-providers.md

@@ -87,9 +87,9 @@ strips the `@version` suffix from the model, and maps the publisher to a parser
 surface via `vertexPublisherVendor`:
 
 - `anthropic` → `llm.provider="anthropic"` → metered through the Anthropic
-  parser, priced under the **`anthropic`** surface of the pricing table
-  management ships (the parser emits the standard Anthropic provider label, so
-  Vertex Claude reuses first-party Anthropic prices).
+  parser, priced under the **`anthropic`** block in `defaults_pricing.yaml`
+  (the parser emits the standard Anthropic provider label, so Vertex Claude
+  reuses first-party Anthropic prices).
 - `openai` → `llm.provider="openai"` (reserved; not in the catalog lineup
   today).
 - anything else (notably `google` / Gemini) → empty vendor → **no parser**.
@@ -104,9 +104,8 @@ is omitted from the catalog.
 
 > Caveat: cross-region inference profiles in `eu` / `apac` carry a ~10% price
 > premium that the base per-token rates do **not** model — cost annotations for
-> those regions read low. Operators who need exact regional billing set the
-> affected models' prices on the provider record, or replace the default entries
-> via management's `AgentNetwork.PricingDefaultsFile`.
+> those regions read low. Operators who need exact regional billing override
+> the affected entries in `pricing.yaml`.
 
 ## AWS Bedrock (`bedrock_api`)
 
@@ -212,19 +211,15 @@ so a model-listing call can't be rewritten onto an upstream that would 404 it.
 ## Catalog ↔ pricing cross-check
 
 Catalog prices and context windows are cross-checked against LiteLLM's
-`model_prices_and_context_window.json`. The **catalog is the source of default
-prices**: management's `pricing.DefaultTable` folds every catalog provider's
-models into the surfaces that provider declares (`PricingSurfaces`), so coverage
-is structural rather than maintained in a parallel file
-([pricing/defaults.go](../../../management/internals/modules/agentnetwork/pricing/defaults.go)).
-`TestDefaultTable_CoversEveryCatalogModel` fails if a catalog model ends up
-unpriced, and `TestDefaultTable_NoConflictingContributions` fails if two
-providers contribute the same (surface, model) at different rates. Bedrock
-entries are keyed by the **normalised** id the request parser emits (region
-prefix + version suffix stripped) — management applies the same normalisation to
-per-provider prices at synth time, so the two keys compare equal. Vertex Claude
-carries no Bedrock-style prefix, so it prices straight off the `anthropic`
-surface.
+`model_prices_and_context_window.json`. The proxy's embedded
+`defaults_pricing.yaml` covers **every metered first-party model** the catalog
+enumerates — guarded by
+`TestDefaultTable_FirstPartyModelCoverage`
+([pricing/defaults_coverage_test.go](../../../proxy/internal/llm/pricing/defaults_coverage_test.go)),
+which fails if a catalog model has no embedded price. Bedrock entries are keyed
+by the **normalised** id the request parser emits (region prefix + version
+suffix stripped). Vertex Claude carries no Bedrock-style prefix, so it prices
+straight off the `anthropic` block.
 
 ## Things to scrutinise
 
@@ -237,17 +232,16 @@ operator-misconfigured Vertex provider and unmetered Gemini traffic; verify
 publishers).
 
 **Correctness.** `normalizeBedrockModel` is the join between the wire id and the
-pricing key — a model that normalises to something absent from the shipped
-pricing table meters at `cost.skipped=unknown_model` rather than failing the
-request. The
+pricing key — a model that normalises to something not in `defaults_pricing.yaml`
+meters at `cost.skipped=unknown_model` rather than failing the request. The
 `/bedrock` prefix strip must run on both the parser side (so the model is
 extracted) and the router side (so the upstream path is native); a regression in
 either silently breaks the other.
 
 **Metering caveats.** eu/apac cross-region Bedrock + Vertex profiles carry a
-~10% premium not modelled by base pricing — flagged in the catalog comment.
-Operators needing exact regional billing set per-provider prices on the model
-rows (or replace the default entries via `AgentNetwork.PricingDefaultsFile`).
+~10% premium not modelled by base pricing — flagged in both the catalog comment
+and `defaults_pricing.yaml`. Operators needing exact regional billing override
+the relevant entries.
 
 ## Cross-references
 

e2e/agentnetwork/custom_pricing_test.go

@@ -23,9 +23,10 @@ import (
 // model the client asks for. The proxy prices off the REQUEST model, not the
 // upstream response model, so a made-up model id billed at operator rates lets
 // these tests assert exact costs without a real vendor key.
+// Sourced from the harness so the counts can't drift from the mock's config.
 const (
-	vllmPromptTokens     = 11
-	vllmCompletionTokens = 2
+	vllmPromptTokens     = harness.VLLMChatInputTokens
+	vllmCompletionTokens = harness.VLLMChatOutputTokens
 )
 
 // pricedEnv is a connected single-provider agent-network deployment pointed at

e2e/agentnetwork/gateway_protocol_test.go

@@ -0,0 +1,455 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// Models each catalog surface is registered with in the matrix below. They
+// differ per provider so the router's choice is unambiguous: a request that
+// lands on the wrong provider record fails the surface assertion instead of
+// passing by coincidence.
+const (
+	matrixAnthropicModel = "claude-sonnet-5"
+	matrixBedrockModel   = "anthropic.claude-sonnet-5"
+	// matrixBedrockPathModel is what a Bedrock SDK client puts in the URL: a
+	// cross-region inference profile with a release date and version suffix.
+	// The proxy must normalise it back to matrixBedrockModel to route and price.
+	matrixBedrockPathModel = "us.anthropic.claude-sonnet-5-20250101-v1:0"
+	// matrixVertexModel differs from the Anthropic record's model on purpose:
+	// a shared id would leave two routes claiming it and make which one serves
+	// /v1/messages depend on declaration order.
+	matrixVertexModel   = "claude-haiku-4-5"
+	matrixVertexProject = "e2e-project"
+	matrixVertexRegion  = "us-east5"
+)
+
+// gatewayEnv is a connected client plus a set of provider records, all pointed
+// at one mock upstream, so several wire shapes can be driven over a single
+// tunnel.
+type gatewayEnv struct {
+	endpoint string
+	proxyIP  string
+	client   *harness.Client
+	proxy    *harness.Proxy
+	vllm     *harness.VLLM
+	// providerIDs maps the catalog id to the created provider record id.
+	providerIDs map[string]string
+}
+
+// provisionGatewayMatrix brings up one mock upstream and one provider record
+// per catalog surface, all authorised for the same group by a single policy.
+// Sharing one proxy and client keeps the wire-shape cases to one tunnel setup;
+// each case still creates its own session id so its access-log row is findable.
+func provisionGatewayMatrix(t *testing.T, ctx context.Context) gatewayEnv {
+	t.Helper()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-matrix"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gw-matrix-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// The mock ignores auth, so a dummy credential satisfies each catalog
+	// entry's auth template. Vertex is the exception: its api_key is a GCP
+	// service-account keyfile the proxy mints an OAuth token from, and a dummy
+	// one cannot mint. That is deliberate — the Vertex case below asserts on
+	// routing, which happens before the token mint.
+	dummyKey := "sk-gw-e2e"
+	dummyKeyfile := "keyfile::" + "e2e-not-a-real-service-account-key"
+
+	specs := []struct {
+		name      string
+		catalogID string
+		apiKey    string
+		models    []api.AgentNetworkProviderModel
+	}{
+		{
+			name: "openai", catalogID: "openai_api", apiKey: dummyKey,
+			models: []api.AgentNetworkProviderModel{{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002}},
+		},
+		{
+			name: "anthropic", catalogID: "anthropic_api", apiKey: dummyKey,
+			models: []api.AgentNetworkProviderModel{{Id: matrixAnthropicModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
+		},
+		{
+			name: "bedrock", catalogID: "bedrock_api", apiKey: dummyKey,
+			models: []api.AgentNetworkProviderModel{{Id: matrixBedrockModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
+		},
+		{
+			name: "vertex", catalogID: "vertex_ai_api", apiKey: dummyKeyfile,
+			models: []api.AgentNetworkProviderModel{{Id: matrixVertexModel, InputPer1k: 0.001, OutputPer1k: 0.005}},
+		},
+	}
+
+	providerIDs := make(map[string]string, len(specs))
+	ids := make([]string, 0, len(specs))
+	for _, spec := range specs {
+		key := spec.apiKey
+		models := spec.models
+		prov, perr := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+			Name:        "e2e-gw-" + spec.name,
+			ProviderId:  spec.catalogID,
+			UpstreamUrl: vllm.URL,
+			ApiKey:      &key,
+			Enabled:     ptr(true),
+			Models:      &models,
+		})
+		require.NoError(t, perr, "create %s provider", spec.name)
+		id := prov.Id
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
+		providerIDs[spec.catalogID] = id
+		ids = append(ids, id)
+	}
+
+	// Uncapped token limit: never blocks the handful of tokens driven here, but
+	// switches on usage metering so consumption and cost land in the row.
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gw-matrix",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: ids,
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-matrix", sk.Key)
+	return gatewayEnv{
+		endpoint:    endpoint,
+		proxyIP:     proxyIP,
+		client:      cl,
+		proxy:       px,
+		vllm:        vllm,
+		providerIDs: providerIDs,
+	}
+}
+
+// connectClient starts a proxy and a tunnel client for the shared account and
+// waits until the client can reach the proxy peer, returning the endpoint and
+// the proxy's tunnel IP to pin requests to.
+func connectClient(t *testing.T, ctx context.Context, name, setupKey string) (string, string, *harness.Client, *harness.Proxy) {
+	t.Helper()
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-"+name+"-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, setupKey)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// The probe resolves the endpoint and its first packet wakes the lazy proxy
+	// peer, so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+	return settings.Endpoint, proxyIP, cl, px
+}
+
+// callUntil retries an HTTP call through the tunnel until it returns one of the
+// wanted statuses or the deadline passes, absorbing the DNS and tunnel jitter
+// the first call through a fresh tunnel can hit. The last status and body are
+// returned either way so the caller can assert with real detail.
+func callUntil(t *testing.T, call func() (int, string, error), want ...int) (int, string) {
+	t.Helper()
+	wanted := make(map[int]struct{}, len(want))
+	for _, w := range want {
+		wanted[w] = struct{}{}
+	}
+
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		c, b, err := call()
+		if err == nil {
+			code, body = c, b
+			if _, ok := wanted[code]; ok {
+				return code, body
+			}
+		}
+		time.Sleep(5 * time.Second)
+	}
+	return code, body
+}
+
+// TestGatewayProtocolProviderMatrix drives one request per wire shape over a
+// single tunnel, with a provider record per catalog surface behind it. It is
+// the regression net for the routing and parser-selection changes: each case
+// asserts the surface the request was metered under and the token counts that
+// surface's own usage block carries, so a request parsed by the wrong provider's
+// parser meters zero and fails rather than passing on a coincidence.
+func TestGatewayProtocolProviderMatrix(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	env := provisionGatewayMatrix(t, ctx)
+	diag := func() string {
+		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
+			env.vllm.Logs(context.Background()), env.proxy.Logs(context.Background()))
+	}
+
+	t.Run("openai chat completions", func(t *testing.T) {
+		session := "e2e-gw-openai"
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, harness.VLLMModel, "ping", session)
+		}, 200)
+		require.Equal(t, 200, code, "openai chat must succeed; body: %s%s", body, diag())
+		require.Contains(t, body, "chat.completion", "body must be an OpenAI completion; got: %s", body)
+
+		row := findAccessLogBySession(t, ctx, session)
+		require.NotNil(t, row.Provider)
+		assert.Equal(t, "openai", *row.Provider, "the OpenAI chat path must meter under the openai surface")
+		assert.Equal(t, int64(harness.VLLMChatInputTokens), row.InputTokens, "OpenAI usage block must be read")
+		assert.Equal(t, int64(harness.VLLMChatOutputTokens), row.OutputTokens)
+	})
+
+	t.Run("anthropic messages", func(t *testing.T) {
+		session := "e2e-gw-anthropic"
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, matrixAnthropicModel, "ping", session)
+		}, 200)
+		require.Equal(t, 200, code, "anthropic messages must succeed; body: %s%s", body, diag())
+
+		row := findAccessLogBySession(t, ctx, session)
+		require.NotNil(t, row.Provider)
+		assert.Equal(t, "anthropic", *row.Provider, "the /v1/messages path must meter under the anthropic surface")
+		// These counts only appear if the Anthropic parser read the response:
+		// its usage fields are named differently from the OpenAI block.
+		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens,
+			"Anthropic input_tokens must be read; zero here means the wrong parser ran")
+		assert.Equal(t, int64(harness.VLLMMessagesOutputTokens), row.OutputTokens)
+		assert.Positive(t, row.CachedInputTokens, "the Anthropic cache-read bucket must be recorded")
+		assert.Positive(t, row.CostUsd, "a metered request must carry a cost")
+		require.NotNil(t, row.ResolvedProviderId)
+		assert.Equal(t, env.providerIDs["anthropic_api"], *row.ResolvedProviderId,
+			"a vendor-tagged request must not cross to another provider's record")
+	})
+
+	t.Run("bedrock invoke normalises the path model", func(t *testing.T) {
+		session := "e2e-gw-bedrock"
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Bedrock(ctx, env.endpoint, env.proxyIP, matrixBedrockPathModel, "ping", session)
+		}, 200)
+		require.Equal(t, 200, code, "bedrock invoke must succeed; body: %s%s", body, diag())
+
+		row := findAccessLogBySession(t, ctx, session)
+		require.NotNil(t, row.Provider)
+		assert.Equal(t, "bedrock", *row.Provider, "a native Bedrock path must meter under the bedrock surface")
+		require.NotNil(t, row.Model)
+		assert.Equal(t, matrixBedrockModel, *row.Model,
+			"the inference-profile prefix, release date and version suffix must be normalised away")
+		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens)
+	})
+
+	t.Run("anthropic token counting", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, "/v1/messages/count_tokens",
+				fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"ping"}]}`, matrixAnthropicModel),
+				[]string{"anthropic-version: 2023-06-01"})
+		}, 200)
+		assert.Equal(t, 200, code, "token counting must route rather than deny; body: %s%s", body, diag())
+	})
+
+	t.Run("bedrock token counting", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP,
+				"/model/"+matrixBedrockPathModel+"/count-tokens",
+				`{"input":{"converse":{"messages":[{"role":"user","content":[{"text":"ping"}]}]}}}`, nil)
+		}, 200)
+		assert.Equal(t, 200, code,
+			"the Bedrock count-tokens action must route; denying it pushes counting onto the billable inference path; body: %s%s",
+			body, diag())
+	})
+
+	t.Run("vertex token counting reaches its provider", func(t *testing.T) {
+		// The dummy service-account key cannot mint an OAuth token, so the
+		// request stops at the upstream credential. Both outcomes render as
+		// 403, so the deny code is what distinguishes them: upstream_auth_failed
+		// means the path resolved to the Vertex route and only the credential
+		// failed, while model_not_routable would mean the method segment was
+		// swallowed into the model id and no route ever claimed it.
+		path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s/count-tokens:rawPredict",
+			matrixVertexProject, matrixVertexRegion, matrixVertexModel)
+		_, body := callUntil(t, func() (int, string, error) {
+			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, path,
+				`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"ping"}]}`, nil)
+		}, 403)
+		assert.NotContains(t, body, "model_not_routable",
+			"the count-tokens method segment must not be parsed as part of the model id; body: %s%s", body, diag())
+		assert.Contains(t, body, "llm_policy.upstream_auth_failed",
+			"the request must reach the Vertex route and fail only at the credential; body: %s%s", body, diag())
+	})
+
+	t.Run("connection warming probe", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Get(ctx, env.endpoint, env.proxyIP, "/api/hello", nil)
+		}, 200)
+		assert.NotEqual(t, 403, code,
+			"the warm-up probe carries no model and must not be refused as unroutable; body: %s%s", body, diag())
+	})
+
+	t.Run("unknown model denies in the caller's error shape", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages,
+				"claude-not-a-real-model-9", "ping", "e2e-gw-unknown")
+		}, 403)
+		require.Equal(t, 403, code, "a model no provider claims must still be refused; body: %s%s", body, diag())
+
+		// The NetBird fields stay where they were for existing consumers.
+		assert.Contains(t, body, "llm_policy.model_not_routable", "the deny code must be preserved")
+		// And the vendor's own envelope rides alongside, so the client can show
+		// the reason instead of an unexplained API error.
+		assert.Contains(t, body, `"type":"error"`, "an Anthropic caller must get the Anthropic error envelope")
+		assert.Contains(t, body, "permission_error", "403 must map to the vendor's permission error type")
+	})
+}
+
+// TestModelDiscoveryWithModelAllowlist covers gateway model discovery on an
+// account that restricts models, which is the configuration that broke: the
+// listing carries no model, and the per-model allowlist fails closed on an
+// undetermined one, so discovery denied for exactly the accounts using the
+// feature. It also asserts the allowlist still refuses a model outside it, so
+// the exemption cannot be read as a way around the gate.
+func TestModelDiscoveryWithModelAllowlist(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-discovery"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gw-discovery-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// One provider enumerating a single model, while the upstream's own listing
+	// advertises two. The proxy must serve the shorter list.
+	dummyKey := "sk-discovery-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-gw-discovery",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &dummyKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
+		},
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// The model allowlist is what makes this a regression test: without a
+	// guardrail enabled, discovery was never gated in the first place.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-gw-discovery-allowlist"
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{harness.VLLMModel}
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gw-discovery",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-discovery", sk.Key)
+	diag := func() string {
+		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
+			vllm.Logs(context.Background()), px.Logs(context.Background()))
+	}
+
+	t.Run("listing is served and bounded by policy", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Get(ctx, endpoint, proxyIP, "/v1/models?limit=1000", nil)
+		}, 200)
+		require.Equal(t, 200, code,
+			"discovery must not be refused because the request carries no model; body: %s%s", body, diag())
+
+		assert.Contains(t, body, harness.VLLMModel, "the authorised model must reach the picker")
+		assert.NotContains(t, body, harness.VLLMUnlistedModel,
+			"a model the policy does not authorise must not be offered; body: %s", body)
+	})
+
+	t.Run("allowlist still refuses a model outside it", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
+				harness.VLLMUnlistedModel, "ping", "e2e-gw-discovery-blocked")
+		}, 403)
+		require.Equal(t, 403, code,
+			"exempting model-less endpoints must not exempt inference; body: %s%s", body, diag())
+		assert.True(t,
+			strings.Contains(body, "llm_policy.model_blocked") || strings.Contains(body, "llm_policy.model_not_routable"),
+			"the refusal must name a model policy code; body: %s", body)
+	})
+
+	t.Run("allowlisted model still routes", func(t *testing.T) {
+		code, body := callUntil(t, func() (int, string, error) {
+			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
+				harness.VLLMModel, "ping", "e2e-gw-discovery-allowed")
+		}, 200)
+		require.Equal(t, 200, code, "the allowlisted model must still be served; body: %s%s", body, diag())
+	})
+}

e2e/harness/client.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -322,10 +323,29 @@ func withSessionID(headers []string, sessionID string) []string {
 	return append(headers, "x-session-id: "+sessionID)
 }
 
-// post runs curl in a throwaway container sharing the client's network
-// namespace so the request traverses the WireGuard tunnel, pinning the endpoint
-// to the proxy IP. It returns the HTTP status and response body.
+// Get issues a GET to the agent-network endpoint over the client's tunnel.
+// Model discovery and the connection-warming probe are read-only endpoints
+// that carry no body, so they can't go through the chat helpers.
+func (cl *Client) Get(ctx context.Context, endpoint, proxyIP, path string, extraHeaders []string) (int, string, error) {
+	return cl.do(ctx, http.MethodGet, endpoint, proxyIP, path, "", extraHeaders)
+}
+
+// PostJSON issues an arbitrary JSON POST over the client's tunnel, for wire
+// shapes the typed helpers don't cover (token counting, say).
+func (cl *Client) PostJSON(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
+}
+
+// post issues a JSON POST. Retained as the shorthand the chat helpers use.
 func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
+}
+
+// do runs curl in a throwaway container sharing the client's network
+// namespace so the request traverses the WireGuard tunnel, pinning the endpoint
+// to the proxy IP. It returns the HTTP status and response body. An empty body
+// sends no payload, which is what a GET needs.
+func (cl *Client) do(ctx context.Context, method, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
 	url := "https://" + endpoint + path
 	args := []string{
 		"run", "--rm",
@@ -334,13 +354,15 @@ func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string
 		"-sk", "--connect-timeout", "5", "--max-time", "90",
 		"--resolve", endpoint + ":443:" + proxyIP,
 		"-o", "/dev/stderr", "-w", "%{http_code}",
-		"-X", "POST", url,
+		"-X", method, url,
 		"-H", "Content-Type: application/json",
 	}
 	for _, h := range extraHeaders {
 		args = append(args, "-H", h)
 	}
-	args = append(args, "--data", body)
+	if body != "" {
+		args = append(args, "--data", body)
+	}
 	cmd := exec.CommandContext(ctx, "docker", args...)
 	// -w writes the status code to stdout; -o /dev/stderr writes the body to
 	// stderr so we can capture both separately.

e2e/harness/vllm.go

@@ -22,14 +22,42 @@ const (
 	// matches a real small model commonly served by vLLM so the provider's
 	// enumerated model and the client's request line up.
 	VLLMModel = "Qwen/Qwen2.5-0.5B-Instruct"
+	// VLLMUnlistedModel is a second id the mock's model listing advertises but
+	// no test provider enumerates, so a filtered listing is observably shorter
+	// than the upstream's own.
+	VLLMUnlistedModel = "Qwen/Qwen2.5-7B-Instruct"
+)
+
+// Token counts the mock reports per wire shape. Tests assert on these rather
+// than on "> 0" so a response parsed with the wrong provider's parser (which
+// would read a different field, or none) fails loudly instead of passing on
+// a coincidental non-zero.
+const (
+	// VLLMChatInputTokens / VLLMChatOutputTokens ride the OpenAI usage block.
+	VLLMChatInputTokens  = 11
+	VLLMChatOutputTokens = 2
+	// VLLMMessagesInputTokens / VLLMMessagesOutputTokens ride the Anthropic
+	// usage block, whose field names the OpenAI parser cannot read.
+	VLLMMessagesInputTokens  = 17
+	VLLMMessagesOutputTokens = 3
 )
 
 // vllmNginxConf emulates a vLLM OpenAI-compatible server over plain HTTP (vLLM's
-// default: no TLS, port 8000). It answers /v1/models with a one-model list and
-// any chat/completions path with a canned OpenAI-shaped chat completion carrying
-// a non-zero usage block, so the proxy's OpenAI parser records real token
-// consumption. Running actual vLLM in CI is infeasible (GPU + multi-GB model
+// default: no TLS, port 8000), and additionally answers the wire shapes the
+// other catalog surfaces speak so one mock can stand in for every provider the
+// proxy routes to. Running actual vLLM in CI is infeasible (GPU + multi-GB model
 // download), so this stands in for the wire contract the proxy depends on.
+//
+// Each shape answers with its own vendor's usage block, so a response parsed
+// under the wrong surface meters zero rather than passing by accident:
+//
+//   - /v1/chat/completions (and any unmatched path): OpenAI chat completion.
+//   - /v1/messages: Anthropic Messages, snake_case usage plus a cache bucket.
+//   - /model/{id}/invoke: Bedrock InvokeModel, which carries the Anthropic body.
+//   - the token-counting endpoints: a count, with no usage block at all.
+//
+// The model listing advertises two models so a policy that authorises one
+// produces an observably shorter list than the upstream's own.
 const vllmNginxConf = `pid /tmp/nginx.pid;
 events {}
 http {
@@ -37,7 +65,26 @@ http {
     listen 8000;
     location = /v1/models {
       default_type application/json;
-      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"}]}';
+      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"},{"id":"Qwen/Qwen2.5-7B-Instruct","object":"model","owned_by":"vllm"}]}';
+    }
+    location = /v1/messages {
+      default_type application/json;
+      return 200 '{"id":"msg_e2e","type":"message","role":"assistant","model":"claude-sonnet-5","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
+    }
+    location = /v1/messages/count_tokens {
+      default_type application/json;
+      return 200 '{"input_tokens":7}';
+    }
+    location ~ ^/model/.+/invoke$ {
+      default_type application/json;
+      return 200 '{"id":"msg_e2e_bedrock","type":"message","role":"assistant","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
+    }
+    location ~ ^/model/.+/count-tokens$ {
+      default_type application/json;
+      return 200 '{"inputTokens":9}';
+    }
+    location = /api/hello {
+      return 200;
     }
     location / {
       default_type application/json;

funding.json

@@ -6,7 +6,7 @@
     "name": "NetBird GmbH",
     "email": "hello@netbird.io",
     "phone": "",
-    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
+    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open-source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open-source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
     "webpageUrl": {
       "url": "https://github.com/netbirdio"
     }
@@ -15,7 +15,7 @@
     {
       "guid": "netbird",
       "name": "NetBird",
-      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
+      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open-source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
       "webpageUrl": {
         "url": "https://github.com/netbirdio/netbird"
       },
@@ -59,7 +59,7 @@
         "guid": "support-yearly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Yearly",
-        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "yearly",
@@ -72,7 +72,7 @@
         "guid": "support-one-time-year",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Year",
-        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "one-time",
@@ -85,7 +85,7 @@
         "guid": "support-one-time-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Monthly",
-        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",
@@ -98,7 +98,7 @@
         "guid": "support-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Month",
-        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -296,6 +296,8 @@ var providers = []Provider{
 		// account to be on >= 30-day data retention or all requests
 		// 400.
 		Models: []Model{
+			{ID: "claude-opus-5", Label: "Claude Opus 5", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
 			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
@@ -355,6 +357,8 @@ var providers = []Provider{
 		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
 		// per-region Llama 3 entries; standalone 3.3 not yet listed.
 		Models: []Model{
+			{ID: "anthropic.claude-opus-5", Label: "Claude Opus 5 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "anthropic.claude-sonnet-5", Label: "Claude Sonnet 5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
@@ -406,6 +410,8 @@ var providers = []Provider{
 		// exists — the router denies unmeterable publishers rather than forward
 		// them uncounted.
 		Models: []Model{
+			{ID: "claude-opus-5", Label: "Claude Opus 5 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
+			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
 			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},

management/internals/modules/agentnetwork/catalog/catalog_test.go

@@ -0,0 +1,36 @@
+package catalog
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestClaudeLineupSelectable pins the models Claude Code resolves to by
+// default. A model absent from the lineup can't be ticked on a provider
+// record, so llm_router denies it as not-routable and the operator has no
+// way to authorise the client's own default.
+func TestClaudeLineupSelectable(t *testing.T) {
+	for providerID, wanted := range map[string][]string{
+		"anthropic_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
+		"bedrock_api":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5", "anthropic.claude-haiku-4-5"},
+		"vertex_ai_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
+	} {
+		provider, ok := Lookup(providerID)
+		require.True(t, ok, "catalog must define %s", providerID)
+
+		selectable := make(map[string]Model, len(provider.Models))
+		for _, m := range provider.Models {
+			selectable[m.ID] = m
+		}
+		for _, id := range wanted {
+			model, found := selectable[id]
+			require.True(t, found, "%s must offer %s", providerID, id)
+			assert.NotEmpty(t, model.Label, "%s/%s needs a label for the picker", providerID, id)
+			assert.Positive(t, model.InputPer1k, "%s/%s needs an input rate", providerID, id)
+			assert.Positive(t, model.OutputPer1k, "%s/%s needs an output rate", providerID, id)
+			assert.Positive(t, model.ContextWindow, "%s/%s needs a context window", providerID, id)
+		}
+	}
+}

management/internals/modules/agentnetwork/handlers/me_handler.go

@@ -1,75 +0,0 @@
-package handlers
-
-import (
-	"net/http"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-// addMeEndpoints registers the self-service "My Agent Network" routes.
-// Both are available to every authenticated user regardless of role: the
-// responses are scoped strictly to the caller, which is tighter than any
-// role gate could be.
-func (h *handler) addMeEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/me/setup", h.getMySetup).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/me/consumption", h.listMyConsumption).Methods("GET", "OPTIONS")
-}
-
-func (h *handler) getMySetup(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	setup, err := h.manager.GetSetupForUser(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, setupToAPI(setup))
-}
-
-func (h *handler) listMyConsumption(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rows, err := h.manager.ListConsumptionForUser(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]api.AgentNetworkConsumption, 0, len(rows))
-	for _, row := range rows {
-		out = append(out, consumptionToAPI(row))
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func setupToAPI(setup *types.EffectiveSetup) api.AgentNetworkMeSetup {
-	providers := make([]api.AgentNetworkMeProvider, 0, len(setup.Providers))
-	for _, p := range setup.Providers {
-		providers = append(providers, api.AgentNetworkMeProvider{
-			Name:             p.Name,
-			CatalogId:        p.CatalogID,
-			ApiFlavor:        p.APIFlavor,
-			AllModelsAllowed: p.AllModelsAllowed,
-			Models:           p.Models,
-		})
-	}
-	return api.AgentNetworkMeSetup{
-		Configured: setup.Configured,
-		Endpoint:   setup.Endpoint,
-		Providers:  providers,
-	}
-}

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -43,7 +43,6 @@ func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
 	h.addConsumptionEndpoints(router)
 	h.addAccessLogEndpoints(router)
 	h.addBudgetRuleEndpoints(router)
-	h.addMeEndpoints(router)
 }
 
 func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {

management/internals/modules/agentnetwork/manager.go

@@ -83,12 +83,6 @@ type Manager interface {
 	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
 	RecordUsage(ctx context.Context, in RecordUsageInput) error
 	SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error)
-
-	// GetSetupForUser and ListConsumptionForUser back the self-service
-	// "My Agent Network" endpoints. Both are caller-scoped and skip the
-	// role permission gate; see the implementations.
-	GetSetupForUser(ctx context.Context, accountID, userID string) (*types.EffectiveSetup, error)
-	ListConsumptionForUser(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
 }
 
 // PolicySelectionInput is the per-request selection envelope. The

management/internals/modules/agentnetwork/pricing/defaults.go

@@ -47,17 +47,11 @@ var supplementalDefaults = map[string]map[string]Entry{
 		"gpt-5-nano": {InputPer1k: 0.00005, OutputPer1k: 0.0004, CachedInputPer1k: 0.000005},
 	},
 	"anthropic": {
-		// claude-opus-5 is not yet in the catalog lineup but gateway /
-		// grandfathered traffic uses it; priced so it isn't skipped.
-		"claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
 		// "kimi-k3[1m]" is the 1M-context alias some Claude Code guides
 		// configure against Moonshot's Anthropic-compatible endpoint;
 		// priced identically to kimi-k3 so those requests aren't skipped.
 		"kimi-k3[1m]": {InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003},
 	},
-	"bedrock": {
-		"anthropic.claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
-	},
 }
 
 var (

management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml

@@ -82,6 +82,11 @@ anthropic:
     output_per_1k: 0.015
     cache_read_per_1k: 0.0003
     cache_creation_per_1k: 0.00375
+  claude-sonnet-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
   kimi-k3:
     input_per_1k: 0.003
     output_per_1k: 0.015
@@ -145,6 +150,11 @@ bedrock:
     output_per_1k: 0.015
     cache_read_per_1k: 0.0003
     cache_creation_per_1k: 0.00375
+  anthropic.claude-sonnet-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
   meta.llama3-3-70b-instruct:
     input_per_1k: 0.00072
     output_per_1k: 0.00072

management/internals/modules/agentnetwork/pricing/defaults_test.go

@@ -116,11 +116,13 @@ func TestDefaultTable_PinnedRates(t *testing.T) {
 	assert.InDelta(t, 0.010, fable.InputPer1k, 1e-9, "claude-fable-5 input")
 	assert.InDelta(t, 0.0125, fable.CacheCreationPer1k, 1e-9, "claude-fable-5 cache creation")
 
-	// Supplementals present on their surfaces.
+	// Every id below must stay priced whichever source provides it: the
+	// catalog lineup for the current Claude 5 family, supplementalDefaults
+	// for the ids the dashboard deliberately doesn't offer.
 	for surface, ids := range map[string][]string{
 		"openai":    {"gpt-5", "gpt-5-mini", "gpt-5-nano"},
-		"anthropic": {"claude-opus-5", "kimi-k3[1m]", "kimi-k3"},
-		"bedrock":   {"anthropic.claude-opus-5"},
+		"anthropic": {"claude-opus-5", "claude-sonnet-5", "kimi-k3[1m]", "kimi-k3"},
+		"bedrock":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5"},
 	} {
 		for _, id := range ids {
 			_, ok := table[surface][id]

management/internals/modules/agentnetwork/setup.go

@@ -1,261 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"sort"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-)
-
-// GetSetupForUser returns the Agent Network setup the calling user's
-// groups authorize. It deliberately performs no role permission check:
-// the result is scoped to the caller's own groups, which is strictly
-// tighter than any role gate, so every authenticated user (any role) may
-// read it. Peers and users carry the same groups, so the answer matches
-// what the proxy enforces for the caller's machines at request time.
-func (m *managerImpl) GetSetupForUser(ctx context.Context, accountID, userID string) (*types.EffectiveSetup, error) {
-	user, err := m.store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-	if err != nil {
-		return nil, fmt.Errorf("get user: %w", err)
-	}
-	return m.effectiveSetupForGroups(ctx, accountID, user.AutoGroups)
-}
-
-// ListConsumptionForUser returns the caller's own consumption counters:
-// the user-dimension rows recorded for userID. Caller-scoped by design —
-// no role permission check, mirroring GetSetupForUser.
-func (m *managerImpl) ListConsumptionForUser(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
-	rows, err := m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, err
-	}
-	own := make([]*types.Consumption, 0)
-	for _, row := range rows {
-		if row.DimensionKind == types.DimensionUser && row.DimensionID == userID {
-			own = append(own, row)
-		}
-	}
-	return own, nil
-}
-
-// effectiveSetupForGroups computes the effective Agent Network setup for
-// a set of caller groups: the account endpoint plus, per authorized
-// provider, the effective model set. It mirrors what the proxy enforces
-// at request time — the policy filter matches filterApplicablePolicies,
-// the model logic matches policyPermitsModel, and orphan providers
-// (enabled but referenced by no applicable policy) are omitted just like
-// the router synthesizer omits them — so the answer never advertises
-// anything the proxy would refuse.
-//
-// Every "nothing available" shape returns Configured=false rather than
-// an error, and "account not set up" is indistinguishable from "caller
-// has no access" by design: the response must not leak what exists for
-// others.
-func (m *managerImpl) effectiveSetupForGroups(ctx context.Context, accountID string, groupIDs []string) (*types.EffectiveSetup, error) {
-	notConfigured := &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}
-
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-	case isNotFound(err):
-		return notConfigured, nil
-	default:
-		return nil, fmt.Errorf("get agent network settings: %w", err)
-	}
-	if settings.Endpoint() == "" {
-		return notConfigured, nil
-	}
-
-	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account policies: %w", err)
-	}
-	applicable := filterPoliciesByGroups(policies, groupIDs)
-	if len(applicable) == 0 {
-		return notConfigured, nil
-	}
-
-	providers, err := m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account providers: %w", err)
-	}
-
-	var guardrailsByID map[string]*types.Guardrail
-	if anyPolicyHasGuardrails(applicable) {
-		guardrailsByID, err = m.loadGuardrailsByID(ctx, accountID)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	authorized := make([]*types.Provider, 0, len(providers))
-	for _, p := range providers {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if len(policiesForProvider(applicable, p.ID)) == 0 {
-			continue
-		}
-		authorized = append(authorized, p)
-	}
-	if len(authorized) == 0 {
-		return notConfigured, nil
-	}
-	// created_at order, ID tiebreak — same deterministic order the router
-	// synthesizer presents.
-	sort.SliceStable(authorized, func(i, j int) bool {
-		if !authorized[i].CreatedAt.Equal(authorized[j].CreatedAt) {
-			return authorized[i].CreatedAt.Before(authorized[j].CreatedAt)
-		}
-		return authorized[i].ID < authorized[j].ID
-	})
-
-	out := &types.EffectiveSetup{
-		Configured: true,
-		Endpoint:   "https://" + settings.Endpoint(),
-		Providers:  make([]types.EffectiveProvider, 0, len(authorized)),
-	}
-	for _, p := range authorized {
-		allAllowed, models := effectiveModelsForProvider(p, policiesForProvider(applicable, p.ID), guardrailsByID)
-		flavor := ""
-		if entry, ok := catalog.Lookup(p.ProviderID); ok {
-			flavor = entry.ParserID
-		}
-		out.Providers = append(out.Providers, types.EffectiveProvider{
-			Name:             p.Name,
-			CatalogID:        p.ProviderID,
-			APIFlavor:        flavor,
-			AllModelsAllowed: allAllowed,
-			Models:           models,
-		})
-	}
-	return out, nil
-}
-
-// filterPoliciesByGroups returns the enabled policies whose SourceGroups
-// intersect the caller's groups. Same group matching as
-// filterApplicablePolicies, without the per-provider filter — the setup
-// answer spans every provider the caller can reach.
-func filterPoliciesByGroups(policies []*types.Policy, groupIDs []string) []*types.Policy {
-	groupSet := make(map[string]struct{}, len(groupIDs))
-	for _, g := range groupIDs {
-		if g != "" {
-			groupSet[g] = struct{}{}
-		}
-	}
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if !anyGroupMatches(p.SourceGroups, groupSet) {
-			continue
-		}
-		out = append(out, p)
-	}
-	return out
-}
-
-// policiesForProvider returns the subset of policies targeting the
-// provider, order preserved.
-func policiesForProvider(policies []*types.Policy, providerID string) []*types.Policy {
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if sliceContains(p.DestinationProviderIDs, providerID) {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// effectiveModelsForProvider derives the caller's effective model set for
-// one provider from the applicable policies that target it, mirroring
-// policyPermitsModel: a policy with no allowlist-enabled guardrail is
-// unrestricted, and one unrestricted policy makes the whole provider
-// unrestricted (the proxy would admit any model through it). Otherwise
-// the union of the policies' allowlists applies, intersected with the
-// provider's declared models when the operator declared any — the router
-// only claims declared models, so an allowlisted-but-undeclared model is
-// unreachable and must not be advertised. With no declared models the
-// router claims every model, so the allowlist union stands alone.
-func effectiveModelsForProvider(provider *types.Provider, policies []*types.Policy, guardrailsByID map[string]*types.Guardrail) (bool, []string) {
-	restricted := true
-	union := make([]string, 0)
-	seen := make(map[string]struct{})
-	for _, p := range policies {
-		policyRestricted := false
-		for _, gID := range p.GuardrailIDs {
-			g, ok := guardrailsByID[gID]
-			if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
-				continue
-			}
-			policyRestricted = true
-			for _, model := range g.Checks.ModelAllowlist.Models {
-				key := normaliseModelID(model)
-				if key == "" {
-					continue
-				}
-				if _, dup := seen[key]; dup {
-					continue
-				}
-				seen[key] = struct{}{}
-				union = append(union, key)
-			}
-		}
-		if !policyRestricted {
-			restricted = false
-		}
-	}
-
-	declared := declaredModelIDs(provider)
-	if !restricted {
-		return true, declared
-	}
-	if len(provider.Models) == 0 {
-		// No operator declaration: the router claims every model, so the
-		// allowlist union is the effective set as-is.
-		return false, union
-	}
-	out := make([]string, 0, len(declared))
-	for _, id := range declared {
-		if _, ok := seen[normaliseModelID(id)]; ok {
-			out = append(out, id)
-		}
-	}
-	return false, out
-}
-
-// declaredModelIDs returns the models a provider exposes: the operator's
-// curated list when present, otherwise the catalog entry's models (an
-// empty operator list means "all catalog models"). Gateway/custom catalog
-// entries declare no models, so the result may be empty.
-func declaredModelIDs(provider *types.Provider) []string {
-	if ids := providerModelIDs(provider); len(ids) > 0 {
-		return ids
-	}
-	entry, ok := catalog.Lookup(provider.ProviderID)
-	if !ok {
-		return []string{}
-	}
-	out := make([]string, 0, len(entry.Models))
-	for _, m := range entry.Models {
-		if m.ID != "" {
-			out = append(out, m.ID)
-		}
-	}
-	return out
-}
-
-// GetSetupForUser on the mock manager reports "not configured" so tests
-// that don't care about setup still compile.
-func (*mockManager) GetSetupForUser(_ context.Context, _, _ string) (*types.EffectiveSetup, error) {
-	return &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}, nil
-}
-
-// ListConsumptionForUser on the mock manager returns no rows.
-func (*mockManager) ListConsumptionForUser(_ context.Context, _, _ string) ([]*types.Consumption, error) {
-	return nil, nil
-}

management/internals/modules/agentnetwork/setup_realstore_test.go

@@ -1,295 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-// These tests drive the effective-setup computation through the real
-// sqlite store, mirroring the policyselect realstore suite: assert on
-// observable answers (configured / providers / models), not on which
-// store methods get called. The computation must agree with what the
-// proxy enforces — policy filtering matches filterApplicablePolicies,
-// model logic matches policyPermitsModel, and orphan providers are
-// omitted like the router synthesizer omits them.
-
-func newSetupTestMgr(t *testing.T) (*managerImpl, store.Store) {
-	t.Helper()
-	ctx := context.Background()
-	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
-	require.NoError(t, err, "real sqlite test store must come up")
-	t.Cleanup(cleanup)
-	return &managerImpl{store: s}, s
-}
-
-// newSetupTestGuardrail returns an allowlist-enabled guardrail.
-func newSetupTestGuardrail(id string, models ...string) *types.Guardrail {
-	return &types.Guardrail{
-		ID:        id,
-		AccountID: testAccountID,
-		Name:      "allowlist " + id,
-		Checks: types.GuardrailChecks{
-			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
-		},
-	}
-}
-
-func TestEffectiveSetup_RealStore_NoSettingsRow(t *testing.T) {
-	mgr, _ := newSetupTestMgr(t)
-
-	setup, err := mgr.effectiveSetupForGroups(context.Background(), testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "account without settings must read as not configured")
-	assert.Empty(t, setup.Endpoint)
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_NoApplicablePolicy(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-other"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "caller outside every policy's source groups must read as not configured")
-	assert.Empty(t, setup.Endpoint, "no-access answer must not leak the endpoint")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyListsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.True(t, setup.Configured)
-	assert.Equal(t, "https://"+testEndpoint, setup.Endpoint)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.Equal(t, "OpenAI", p.Name)
-	assert.Equal(t, "openai_api", p.CatalogID)
-	assert.Equal(t, "openai", p.APIFlavor)
-	assert.True(t, p.AllModelsAllowed, "policy without allowlist guardrail is unrestricted")
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "declared models listed as a courtesy")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistIntersectsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	// Allowlist admits gpt-5.4 (declared, odd casing/spacing) and gpt-4.1
-	// (NOT declared — the router would never route it, so it must not be
-	// advertised).
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", " GPT-5.4 ", "gpt-4.1")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "allowlist ∩ declared, in declared order and casing")
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyWinsOverRestricted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	restricted := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, restricted))
-	open := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	open.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, open))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	assert.True(t, setup.Providers[0].AllModelsAllowed,
-		"one applicable policy without an allowlist makes the provider unrestricted — the proxy would admit any model through it")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistUnionAcrossPolicies(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}, {ID: "o4-mini"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-2", "gpt-4o")))
-	p1 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p1))
-	p2 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-2")
-	p2.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p2))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.ElementsMatch(t, []string{"gpt-5.4", "gpt-4o"}, p.Models, "union of allowlists across applicable policies")
-}
-
-func TestEffectiveSetup_RealStore_OrphanAndDisabledProvidersOmitted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Orphan: enabled but referenced by no policy.
-	orphan := newSynthTestProvider()
-	orphan.ID = "prov-orphan"
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, orphan))
-	// Disabled but referenced by an applicable policy.
-	disabled := newSynthTestProvider()
-	disabled.ID = "prov-disabled"
-	disabled.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, disabled))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(disabled.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "neither an orphan nor a disabled provider is reachable, so nothing is configured for the caller")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_DisabledPolicyIgnored(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	policy.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured)
-}
-
-func TestEffectiveSetup_RealStore_UndeclaredModelsUseAllowlistAsIs(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Gateway-style provider: no declared models — the router claims every
-	// model, so the allowlist union is the effective set on its own.
-	provider := newSynthTestProvider()
-	provider.ProviderID = "litellm_proxy"
-	provider.Name = "LiteLLM"
-	provider.Models = nil
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "claude-sonnet-4-5")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"claude-sonnet-4-5"}, p.Models)
-}
-
-func TestEffectiveSetup_RealStore_ProvidersInCreatedAtOrder(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	newer := newSynthTestProvider()
-	newer.ID = "prov-newer"
-	newer.Name = "Newer"
-	newer.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, newer))
-	older := newSynthTestProvider()
-	older.ID = "prov-older"
-	older.Name = "Older"
-	older.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, older))
-
-	policy := newSynthTestPolicy(newer.ID, "grp-eng", "")
-	policy.DestinationProviderIDs = []string{newer.ID, older.ID}
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 2)
-	assert.Equal(t, "Older", setup.Providers[0].Name)
-	assert.Equal(t, "Newer", setup.Providers[1].Name)
-}
-
-// TestGetSetupForUser_RealStore pins the self-service entry point: the
-// user's group memberships (AutoGroups — the same groups the user's peers
-// carry) scope the answer, and users outside every policy get the
-// indistinguishable not-configured shape.
-func TestGetSetupForUser_RealStore(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-in", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-eng"},
-	}))
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-out", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-other"},
-	}))
-
-	setupIn, err := mgr.GetSetupForUser(ctx, testAccountID, "user-in")
-	require.NoError(t, err)
-	assert.True(t, setupIn.Configured)
-	require.Len(t, setupIn.Providers, 1)
-
-	setupOut, err := mgr.GetSetupForUser(ctx, testAccountID, "user-out")
-	require.NoError(t, err)
-	assert.False(t, setupOut.Configured, "user outside the policy's source groups gets the not-configured answer")
-}
-
-// TestListConsumptionForUser_RealStore pins the own-consumption scope: only
-// the caller's user-dimension rows come back, never another user's rows or
-// group rows.
-func TestListConsumptionForUser_RealStore(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	now := time.Now().UTC().Truncate(time.Hour)
-	require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, testAccountID, types.DimensionUser, "user-a", 3600, now, 100, 50, 0.5))
-	require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, testAccountID, types.DimensionUser, "user-b", 3600, now, 999, 999, 9.9))
-	require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, testAccountID, types.DimensionGroup, "grp-eng", 3600, now, 1, 1, 0.1))
-
-	rows, err := mgr.ListConsumptionForUser(ctx, testAccountID, "user-a")
-	require.NoError(t, err)
-	require.Len(t, rows, 1, "only the caller's own user-dimension rows are visible")
-	assert.Equal(t, "user-a", rows[0].DimensionID)
-	assert.Equal(t, int64(100), rows[0].TokensInput)
-}

management/internals/modules/agentnetwork/types/setup.go

@@ -1,40 +0,0 @@
-package types
-
-// EffectiveSetup is the caller-scoped answer to "what may this caller
-// use on the Agent Network?" — the account's proxy endpoint plus the
-// providers and models the caller's groups authorize. It intentionally
-// carries display metadata only: no keys, no upstream URLs, no policy or
-// guardrail structure, and no hint of providers the caller cannot reach.
-type EffectiveSetup struct {
-	// Configured is false when the account has no Agent Network set up or
-	// when nothing is authorized for the caller's groups — the two cases
-	// are deliberately indistinguishable so the response leaks nothing
-	// about what exists for others.
-	Configured bool
-	// Endpoint is the account's proxy base URL
-	// ("https://<subdomain>.<cluster>"), reachable over the NetBird tunnel
-	// only. Empty when Configured is false.
-	Endpoint string
-	// Providers lists the providers at least one applicable policy
-	// authorizes for the caller, in the account's created_at order.
-	Providers []EffectiveProvider
-}
-
-// EffectiveProvider is one authorized provider in an EffectiveSetup.
-type EffectiveProvider struct {
-	// Name is the operator-assigned label, e.g. "Bedrock prod".
-	Name string
-	// CatalogID names the catalog entry, e.g. "anthropic_api".
-	CatalogID string
-	// APIFlavor is the request-body shape the provider speaks — the
-	// catalog entry's parser id ("anthropic", "openai"); empty when the
-	// proxy dispatches the provider by URL path instead.
-	APIFlavor string
-	// AllModelsAllowed is true when no model allowlist restricts this
-	// provider for the caller. Models then lists the declared/catalog
-	// models as a courtesy (possibly none for gateway-style providers).
-	AllModelsAllowed bool
-	// Models is the effective model allowlist for the caller, or the
-	// declared/catalog models when AllModelsAllowed is true.
-	Models []string
-}

management/server/permissions/agent_network_roles_test.go

@@ -1,130 +0,0 @@
-package permissions
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/permissions/roles"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-var allOps = []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
-
-// TestAgentNetworkAdminRole pins the delegated-admin contract: full control
-// over the whole agent_network area (parent grant cascades to every
-// submodule), read-only on the account objects needed to build policies,
-// and nothing else in the account.
-func TestAgentNetworkAdminRole(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleAgentNetworkAdmin]
-	require.True(t, ok, "agent_network_admin must exist in RolesMap")
-
-	agentNetworkModules := []modules.Module{
-		modules.AgentNetwork,
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkUsage,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-	}
-	for _, m := range agentNetworkModules {
-		for _, op := range allOps {
-			assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must have %s on %s", op, m)
-		}
-	}
-
-	for _, m := range []modules.Module{modules.Users, modules.Groups, modules.Peers, modules.Accounts} {
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
-			"agent_network_admin must read %s to build policies", m)
-		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must not have %s on %s", op, m)
-		}
-	}
-
-	for _, m := range []modules.Module{modules.Networks, modules.Dns, modules.SetupKeys, modules.Routes, modules.Settings} {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestUsageViewerRole pins the least-privilege cost role: read on the
-// aggregated usage overview and nothing else — no providers, no policies,
-// no request-level logs (which can contain captured prompts), nothing in
-// the rest of the account.
-func TestUsageViewerRole(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleUsageViewer]
-	require.True(t, ok, "usage_viewer must exist in RolesMap")
-
-	assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
-		"usage_viewer must read the usage overview")
-	for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, op),
-			"usage_viewer must not have %s on usage", op)
-	}
-
-	denied := []modules.Module{
-		modules.AgentNetwork,
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-		modules.Networks,
-		modules.Users,
-		modules.SetupKeys,
-	}
-	for _, m := range denied {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"usage_viewer must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestBillingAdminRoleResolves pins that billing_admin has a proper entry
-// in the permission map. Its plan/seat/invoice permissions are enforced
-// outside this map; management-side it carries the regular User baseline
-// instead of failing role resolution.
-func TestBillingAdminRoleResolves(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleBillingAdmin]
-	require.True(t, ok, "billing_admin must exist in RolesMap")
-
-	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleBillingAdmin)
-	require.NoError(t, err, "billing_admin role must resolve")
-	require.NotEmpty(t, permissions)
-
-	for _, m := range []modules.Module{modules.AgentNetwork, modules.Networks, modules.Users, modules.Peers} {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"billing_admin must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestNewRolesParse pins the API role strings, which are permanent once
-// released.
-func TestNewRolesParse(t *testing.T) {
-	assert.Equal(t, types.UserRoleAgentNetworkAdmin, types.StrRoleToUserRole("agent_network_admin"))
-	assert.Equal(t, types.UserRoleUsageViewer, types.StrRoleToUserRole("usage_viewer"))
-	assert.Equal(t, types.UserRoleBillingAdmin, types.StrRoleToUserRole("billing_admin"))
-}

management/server/permissions/roles/agent_network_admin.go

@@ -1,54 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// AgentNetworkAdmin is the delegated administrator for the Agent Network
-// area: full control over providers, policies, guardrails, budgets, usage,
-// logs, and its settings, plus read-only visibility into the account
-// objects needed to build policies (users, groups, peers). Nothing else in
-// the account is visible.
-var AgentNetworkAdmin = RolePermissions{
-	Role: types.UserRoleAgentNetworkAdmin,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-	Permissions: Permissions{
-		modules.AgentNetwork: {
-			operations.Read:   true,
-			operations.Create: true,
-			operations.Update: true,
-			operations.Delete: true,
-		},
-		modules.Users: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Groups: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Peers: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Accounts: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-	},
-}

management/server/permissions/roles/billing_admin.go

@@ -1,20 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// BillingAdmin manages plans, seats, and invoices, which are enforced
-// outside this permission map (NetBird Cloud). Management-side it carries
-// the regular User baseline; the explicit entry keeps role resolution from
-// failing with a role-not-found error.
-var BillingAdmin = RolePermissions{
-	Role: types.UserRoleBillingAdmin,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-}

management/server/permissions/roles/role_permissions.go

@@ -15,12 +15,9 @@ type RolePermissions struct {
 type Permissions map[modules.Module]map[operations.Operation]bool
 
 var RolesMap = map[types.UserRole]RolePermissions{
-	types.UserRoleOwner:             Owner,
-	types.UserRoleAdmin:             Admin,
-	types.UserRoleUser:              User,
-	types.UserRoleAuditor:           Auditor,
-	types.UserRoleNetworkAdmin:      NetworkAdmin,
-	types.UserRoleAgentNetworkAdmin: AgentNetworkAdmin,
-	types.UserRoleUsageViewer:       UsageViewer,
-	types.UserRoleBillingAdmin:      BillingAdmin,
+	types.UserRoleOwner:        Owner,
+	types.UserRoleAdmin:        Admin,
+	types.UserRoleUser:         User,
+	types.UserRoleAuditor:      Auditor,
+	types.UserRoleNetworkAdmin: NetworkAdmin,
 }

management/server/permissions/roles/usage_viewer.go

@@ -1,30 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// UsageViewer is the regular User baseline plus read access to the
-// aggregated Agent Network usage and cost overview. It sees no provider
-// configuration, no policies, and no request-level access logs (which can
-// contain captured prompts): usage rows carry user and group display names
-// in the response itself, so no team-wide read access is needed.
-var UsageViewer = RolePermissions{
-	Role: types.UserRoleUsageViewer,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-	Permissions: Permissions{
-		modules.AgentNetworkUsage: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-	},
-}

management/server/types/user.go

@@ -11,15 +11,13 @@ import (
 )
 
 const (
-	UserRoleOwner             UserRole = "owner"
-	UserRoleAdmin             UserRole = "admin"
-	UserRoleUser              UserRole = "user"
-	UserRoleUnknown           UserRole = "unknown"
-	UserRoleBillingAdmin      UserRole = "billing_admin"
-	UserRoleAuditor           UserRole = "auditor"
-	UserRoleNetworkAdmin      UserRole = "network_admin"
-	UserRoleAgentNetworkAdmin UserRole = "agent_network_admin"
-	UserRoleUsageViewer       UserRole = "usage_viewer"
+	UserRoleOwner        UserRole = "owner"
+	UserRoleAdmin        UserRole = "admin"
+	UserRoleUser         UserRole = "user"
+	UserRoleUnknown      UserRole = "unknown"
+	UserRoleBillingAdmin UserRole = "billing_admin"
+	UserRoleAuditor      UserRole = "auditor"
+	UserRoleNetworkAdmin UserRole = "network_admin"
 
 	UserStatusActive   UserStatus = "active"
 	UserStatusDisabled UserStatus = "disabled"
@@ -44,10 +42,6 @@ func StrRoleToUserRole(strRole string) UserRole {
 		return UserRoleAuditor
 	case "network_admin":
 		return UserRoleNetworkAdmin
-	case "agent_network_admin":
-		return UserRoleAgentNetworkAdmin
-	case "usage_viewer":
-		return UserRoleUsageViewer
 	default:
 		return UserRoleUnknown
 	}
@@ -146,7 +140,7 @@ func (u *User) IsRegularUser() bool {
 
 // IsRestrictable checks whether a user is in a restrictable role.
 func (u *User) IsRestrictable() bool {
-	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin || u.Role == UserRoleUsageViewer
+	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin
 }
 
 // ToUserInfo converts a User object to a UserInfo object.

proxy/internal/llm/model.go

@@ -13,6 +13,14 @@ func NormalizeBedrockModel(modelID string) string {
 	return sharedllm.NormalizeBedrockModel(modelID)
 }
 
+// NormalizeAnthropicModel strips the trailing "-YYYYMMDD" release-date suffix
+// from an Anthropic model id so a dated id a client pins matches the undated
+// one the operator registered. Thin delegate to shared/llm for the same
+// contract reason as the two below.
+func NormalizeAnthropicModel(modelID string) string {
+	return sharedllm.NormalizeAnthropicModel(modelID)
+}
+
 // NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
 // so it matches the catalog/pricing key. Thin delegate to shared/llm, kept
 // beside NormalizeBedrockModel for the same contract reason.

proxy/internal/llm/pricing/pricing.go

@@ -10,6 +10,8 @@ package pricing
 import (
 	"fmt"
 	"math"
+
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
 )
 
 // Entry is a single model's input and output pricing, expressed in USD per
@@ -92,7 +94,10 @@ func NewTable(raw map[string]map[string]EntryJSON) (*Table, error) {
 	return &Table{entries: entries}, nil
 }
 
-// Lookup returns the entry for the given provider surface and model.
+// Lookup returns the entry for the given provider surface and model. A
+// dated Anthropic id falls back to its undated form, so a client pinning
+// "claude-sonnet-4-5-20250929" bills at the registered "claude-sonnet-4-5"
+// rate instead of recording no cost at all.
 func (t *Table) Lookup(provider, model string) (Entry, bool) {
 	if t == nil {
 		return Entry{}, false
@@ -101,7 +106,14 @@ func (t *Table) Lookup(provider, model string) (Entry, bool) {
 	if !ok {
 		return Entry{}, false
 	}
-	e, ok := byModel[model]
+	if e, found := byModel[model]; found {
+		return e, true
+	}
+	undated := sharedllm.NormalizeAnthropicModel(model)
+	if undated == model {
+		return Entry{}, false
+	}
+	e, ok := byModel[undated]
 	return e, ok
 }
 

proxy/internal/llm/pricing/pricing_test.go

@@ -175,3 +175,22 @@ func TestNewTable_NilAndEmpty(t *testing.T) {
 	require.NoError(t, err)
 	assert.Empty(t, entries, "nil in, empty (never-matching) map out for the per-record map")
 }
+
+// TestLookup_DatedAnthropicIDFallsBackToUndated covers a client pinning a
+// release date on a model priced under its undated id. Without the
+// fallback the request records no cost at all.
+func TestLookup_DatedAnthropicIDFallsBackToUndated(t *testing.T) {
+	table, err := NewTable(map[string]map[string]EntryJSON{
+		"anthropic": {
+			"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015},
+		},
+	})
+	require.NoError(t, err, "table must build from a valid defaults map")
+
+	entry, ok := table.Lookup("anthropic", "claude-sonnet-4-5-20250929")
+	require.True(t, ok, "a dated id must resolve to the undated entry")
+	assert.InDelta(t, 0.003, entry.InputPer1K, 1e-9, "dated id must bill at the registered rate")
+
+	_, ok = table.Lookup("anthropic", "claude-sonnet-9-9-20250929")
+	assert.False(t, ok, "an unknown family must stay unpriced")
+}

proxy/internal/middleware/builtin/cost_meter/middleware.go

@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"strconv"
 
+	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
@@ -175,13 +176,28 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 // Anthropic route still bills its cache buckets additively.
 func (m *Middleware) lookupCosts(md []middleware.KV, surface, model string, inTokens, outTokens, cachedTokens, cacheCreationTokens int64) (pricing.Costs, bool) {
 	if recordID := lookupKV(md, middleware.KeyLLMResolvedProviderID); recordID != "" {
-		if entry, ok := m.perRecord[recordID][model]; ok {
+		if entry, ok := perRecordEntry(m.perRecord[recordID], model); ok {
 			return pricing.EntryCosts(entry, surface, inTokens, outTokens, cachedTokens, cacheCreationTokens), true
 		}
 	}
 	return m.defaults.Costs(surface, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 }
 
+// perRecordEntry resolves the operator's stored price for a model on one
+// provider record, falling back to the undated form of a dated Anthropic id
+// so a client that pins a release date still bills at the registered rate.
+func perRecordEntry(byModel map[string]pricing.Entry, model string) (pricing.Entry, bool) {
+	if entry, ok := byModel[model]; ok {
+		return entry, true
+	}
+	undated := llm.NormalizeAnthropicModel(model)
+	if undated == model {
+		return pricing.Entry{}, false
+	}
+	entry, ok := byModel[undated]
+	return entry, ok
+}
+
 // usd renders a cost as the fixed-precision string every cost.usd_* key
 // carries, so the per-bucket values and the aggregates round identically.
 //

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -84,8 +84,10 @@ func (m *Middleware) MutationsSupported() bool { return false }
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	model, modelPresent := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 	providerID, _ := lookupMetadata(in.Metadata, middleware.KeyLLMResolvedProviderID)
+	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	nonInference, _ := lookupMetadata(in.Metadata, middleware.KeyLLMNonInference)
 
-	if denial := m.evaluateAllowlist(providerID, model, modelPresent); denial != nil {
+	if denial := m.evaluateAllowlist(providerID, surface, model, modelPresent, nonInference == "true"); denial != nil {
 		return denial, nil
 	}
 
@@ -114,7 +116,7 @@ func (m *Middleware) Close() error { return nil }
 // evaluateAllowlist denies when the resolved provider's allowlist rejects the
 // model; nil means proceed. Scoped to the provider llm_router resolved, so an
 // unrestricted provider (absent from config) is never caught by another's list.
-func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bool) *middleware.Output {
+func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelPresent, nonInference bool) *middleware.Output {
 	if len(m.cfg.ProviderAllowlists) == 0 {
 		return nil
 	}
@@ -122,7 +124,7 @@ func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bo
 	// if this request targets a restricted provider — fail closed. llm_router
 	// normally stamps the provider first, so this is a defensive guard.
 	if providerID == "" {
-		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	allowlist, restricted := m.cfg.ProviderAllowlists[providerID]
 	if !restricted {
@@ -133,18 +135,29 @@ func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bo
 	// Fail closed: with an allowlist in effect for this provider, a request whose
 	// model the parser couldn't extract (absent/empty) is denied. This enforces
 	// the allowlist for path-routed providers (Bedrock, Vertex) with no body model.
+	//
+	// The exception is a non-inference endpoint the router already authorised.
+	// The model listing and the connection-warming probe name no model
+	// anywhere — not in a body, not in the path — so failing closed here
+	// rejected model discovery for exactly the accounts that configured an
+	// allowlist, which is the outage this endpoint is meant to avoid. The
+	// per-model lookup does name one (the router stamps it from the path), so
+	// it still falls through to the allowlist check below.
 	if !modelPresent || normaliseModel(model) == "" {
-		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+		if nonInference {
+			return nil
+		}
+		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	if modelInAllowlist(allowlist, model) {
 		return nil
 	}
-	return denyModel(model, denyCodeModel, denyMessageModel, denyReasonModel)
+	return denyModel(surface, model, denyCodeModel, denyMessageModel, denyReasonModel)
 }
 
 // denyModel builds a 403 deny Output for a model-allowlist rejection. model is
 // included in the details only when non-empty.
-func denyModel(model, code, message, reason string) *middleware.Output {
+func denyModel(surface, model, code, message, reason string) *middleware.Output {
 	details := map[string]string{}
 	if model != "" {
 		details["model"] = model
@@ -156,6 +169,7 @@ func denyModel(model, code, message, reason string) *middleware.Output {
 			Code:    code,
 			Message: message,
 			Details: details,
+			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -343,3 +343,52 @@ func TestFactoryNormalisesAllowlist(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out2.Decision, "trimmed entry must still match")
 }
+
+// TestAllowlistSkipsNonInferenceWithoutModel covers the reported regression:
+// GET /v1/models carries no model anywhere, so the fail-closed rule above
+// denied model discovery for exactly the accounts that configured a provider
+// allowlist — the clients that read a 403 here render an empty model picker.
+// The router authorises those endpoints by path before the guardrail sees
+// them, so an absent model there is expected rather than undeterminable.
+func TestAllowlistSkipsNonInferenceWithoutModel(t *testing.T) {
+	mw := New(providerCfg("gpt-4o"))
+	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"model discovery must not be refused because it names no model")
+}
+
+// TestAllowlistStillAppliesToNonInferenceWithModel pins that the exemption is
+// scoped to requests that genuinely name nothing. The per-model lookup
+// (GET /v1/models/{id}) is non-inference too, but the router stamps the model
+// from its path, so the allowlist must still decide it — otherwise the
+// exemption becomes a way to confirm a model the policy blocks.
+func TestAllowlistStillAppliesToNonInferenceWithModel(t *testing.T) {
+	mw := New(providerCfg("gpt-4o"))
+
+	t.Run("model in the allowlist", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
+			middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"an allowlisted model must stay reachable")
+	})
+
+	t.Run("model outside the allowlist", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
+			middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-5"},
+		))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"non-inference must not become a way past the allowlist")
+		require.NotNil(t, out.DenyReason)
+		assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code,
+			"a named but blocked model is blocked, not unknown")
+	})
+}

proxy/internal/middleware/builtin/llm_identity_inject/middleware.go

@@ -217,6 +217,32 @@ func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mut
 	return mutations
 }
 
+// bodyInjectableSurfaces are the request-body dialects that accept the
+// OpenAI-standard identity fields this middleware writes. A surface
+// outside this set gets header-only stamping: "user" and "metadata.tags"
+// are not part of the Anthropic Messages schema, which rejects unknown
+// top-level fields and permits only "user_id" under metadata, so writing
+// them into an Anthropic-shaped body turns a working request into a 400.
+// Claude Code speaks that shape through gateway records pinned to the
+// OpenAI parser, so the check keys on the detected surface rather than
+// on the provider record.
+var bodyInjectableSurfaces = map[string]struct{}{
+	"openai": {},
+	// An empty surface means no parser claimed the path (a custom gateway
+	// base). Those upstreams are OpenAI-compatible by convention, so keep
+	// the long-standing behaviour rather than silently dropping identity.
+	"": {},
+}
+
+// bodyAcceptsOpenAIIdentity reports whether the request body may carry the
+// OpenAI-standard identity fields, read from the surface llm_request_parser
+// resolved from the request path.
+func bodyAcceptsOpenAIIdentity(in *middleware.Input) bool {
+	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	_, ok := bodyInjectableSurfaces[surface]
+	return ok
+}
+
 // injectIntoBody parses the request body and writes the supplied
 // identity dimensions into it. Tags land at metadata.tags (creating
 // the metadata object when absent); the user identity lands at the
@@ -225,6 +251,8 @@ func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mut
 // was written. Returns ok=false (no mutation) when:
 //
 //   - both inputs are empty (nothing to write);
+//   - the body speaks a dialect without these fields (see
+//     bodyInjectableSurfaces);
 //   - the body is empty or truncated (we don't have the full document
 //     to safely round-trip);
 //   - the body isn't a JSON object (skip silently — this middleware
@@ -245,6 +273,9 @@ func injectIntoBody(in *middleware.Input, tags []string, userID string) ([]byte,
 	if in == nil || len(in.Body) == 0 || in.BodyTruncated {
 		return nil, false
 	}
+	if !bodyAcceptsOpenAIIdentity(in) {
+		return nil, false
+	}
 	var doc map[string]any
 	if err := json.Unmarshal(in.Body, &doc); err != nil {
 		return nil, false

proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go

@@ -704,3 +704,57 @@ func TestInject_ExtraHeaders_EmptyValueSkipped(t *testing.T) {
 			"empty extra value must not be stamped")
 	}
 }
+
+// TestInject_AnthropicBodyIsNotRewritten pins the shape gate. Claude Code
+// reaches a LiteLLM record on /v1/messages, where "user" is not a
+// permitted top-level field and metadata accepts only "user_id", so
+// writing the OpenAI-standard fields would turn a working request into a
+// 400 naming a field the client never sent. Header stamping still runs, so
+// spend tracking and per-end-user budgets keep working.
+func TestInject_AnthropicBodyIsNotRewritten(t *testing.T) {
+	rule := liteLLMRuleWithBody()
+	rule.HeaderPair.EndUserIDInBody = true
+	mw := New(Config{Providers: []ProviderInjection{rule}})
+
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = "alice@example.com"
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+	in.Body = []byte(`{"model":"claude-sonnet-5","messages":[]}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	assert.Empty(t, out.Mutations.BodyReplace,
+		"an Anthropic-shaped body must reach the upstream unmodified")
+
+	var endUser string
+	for _, kv := range out.Mutations.HeadersAdd {
+		if kv.Key == "x-litellm-end-user-id" {
+			endUser = kv.Value
+		}
+	}
+	assert.Equal(t, "alice@example.com", endUser,
+		"header stamping must still carry identity when body inject is skipped")
+}
+
+// TestInject_OpenAIBodyStillRewritten guards the gate against
+// over-reaching: the OpenAI surface must keep its body-level identity,
+// which is the only path LiteLLM's tag-budget check reads.
+func TestInject_OpenAIBodyStillRewritten(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "openai"})
+	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.NotEmpty(t, out.Mutations.BodyReplace, "the OpenAI surface still gets body tags")
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	meta, ok := doc["metadata"].(map[string]any)
+	require.True(t, ok, "metadata must be an object")
+	assert.NotEmpty(t, meta["tags"], "metadata.tags must still be written")
+}

proxy/internal/middleware/builtin/llm_limit_check/middleware.go

@@ -84,6 +84,15 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 		return allowNoAttribution(), nil
 	}
 
+	// Model-listing and other non-inference endpoints carry no model, and
+	// management's per-model allowlist fails closed on an empty one. The
+	// router has already authorised the route against the caller's groups
+	// and the request consumes no tokens, so gating it on a model that
+	// cannot exist would only break gateway model discovery.
+	if lookupKV(in.Metadata, middleware.KeyLLMNonInference) == "true" {
+		return allowNoAttribution(), nil
+	}
+
 	providerID := lookupKV(in.Metadata, middleware.KeyLLMResolvedProviderID)
 	if providerID == "" {
 		// llm_router didn't emit a resolved provider id — usually
@@ -117,7 +126,7 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 	}
 
 	if resp.GetDecision() == "deny" {
-		return denyFromManagement(resp), nil
+		return denyFromManagement(resp, lookupKV(in.Metadata, middleware.KeyLLMProvider)), nil
 	}
 	return allowFromManagement(resp), nil
 }
@@ -161,7 +170,7 @@ func allowFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.O
 // envelope. The deny code surfaces verbatim through the framework's
 // fixed JSON template; arbitrary middleware bytes can't reach the
 // wire.
-func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Output {
+func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse, surface string) *middleware.Output {
 	code := resp.GetDenyCode()
 	if code == "" {
 		code = "llm_policy.cap_exceeded"
@@ -176,6 +185,7 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Ou
 		DenyReason: &middleware.DenyReason{
 			Code:    code,
 			Message: denyMessageForCode(code),
+			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},

proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go

@@ -224,3 +224,35 @@ func TestMetadataKeys_Allowlist(t *testing.T) {
 	}
 	assert.ElementsMatch(t, want, keys)
 }
+
+// TestInvoke_NonInferenceSkipsPreflight covers gateway model discovery:
+// GET /v1/models carries no model, and management's per-model allowlist
+// fails closed on an empty one, so a pre-flight would deny discovery for
+// exactly the accounts that use the model allowlist. The router marks the
+// request non-inference after authorising the route, and the gate must
+// then allow without calling management at all.
+func TestInvoke_NonInferenceSkipsPreflight(t *testing.T) {
+	mgmt := &fakeMgmt{
+		checkResp: &proto.CheckLLMPolicyLimitsResponse{
+			Decision: "deny",
+			DenyCode: "llm_policy.model_blocked",
+		},
+	}
+	m := New(mgmt, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserID:     "user-bob",
+		UserGroups: []string{"grp-engineers"},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
+			{Key: middleware.KeyLLMNonInference, Value: "true"},
+		},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model-less endpoints must not be gated on a model")
+	assert.Nil(t, mgmt.checkReq, "no pre-flight may be sent for a non-inference request")
+
+	assert.Empty(t, lookupKV(out.Metadata, middleware.KeyLLMSelectedPolicyID),
+		"no policy is attributed when nothing was metered")
+}

proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go

@@ -1,9 +1,13 @@
 package llm_request_parser
 
 import (
+	"context"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
 func TestParseBedrockPath(t *testing.T) {
@@ -36,3 +40,25 @@ func TestParseBedrockPath(t *testing.T) {
 		}
 	}
 }
+
+// TestInvoke_BedrockCountTokens covers the dedicated token-counting
+// endpoint. Denying it does not break the client, it just pushes context
+// counting back onto the inference endpoint, which is billable.
+func TestInvoke_BedrockCountTokens(t *testing.T) {
+	mw := newMiddleware(t)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/model/us.anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens",
+		Body: []byte(`{"input":{"converse":{"messages":[]}}}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	require.True(t, ok, "count-tokens carries a model in the path and must emit it")
+	assert.Equal(t, "anthropic.claude-sonnet-4-5", model, "model must be normalized like any other action")
+
+	stream, _ := metaValue(t, out.Metadata, middleware.KeyLLMStream)
+	assert.Equal(t, "false", stream, "count-tokens never streams")
+}

proxy/internal/middleware/builtin/llm_request_parser/middleware.go

@@ -61,6 +61,8 @@ func (middlewareImpl) MetadataKeys() []string {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
+		middleware.KeyLLMAgentID,
+		middleware.KeyLLMParentAgentID,
 	}
 }
 
@@ -72,9 +74,9 @@ func (middlewareImpl) Close() error { return nil }
 
 // Invoke detects the LLM provider, parses request facts, and emits
 // metadata. Always returns DecisionAllow; never errors. Provider
-// selection prefers the configured providerID (synthesiser-stamped on
-// agent-network targets) so requests routed to a custom upstream URL
-// still resolve. Falls back to URL sniffing when no providerID is set.
+// selection prefers the request path, falling back to the configured
+// providerID (synthesiser-stamped on agent-network targets) so requests
+// routed to a custom upstream URL still resolve.
 func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	out := &middleware.Output{Decision: middleware.DecisionAllow}
 	if in == nil {
@@ -92,9 +94,14 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 		return m.invokeBedrock(in, br), nil
 	}
 
-	parser, ok := llm.ParserByName(m.providerID)
+	// A path that names an API surface wins over the configured providerID:
+	// a gateway record pinned to "openai" still serves Claude Code on
+	// /v1/messages, and reading that body with the OpenAI parser loses the
+	// Anthropic usage block and prices the request on the wrong surface.
+	// providerID stays the fallback for upstreams whose path says nothing.
+	parser, ok := llm.DetectParser(extractPath(in.URL))
 	if !ok {
-		parser, ok = llm.DetectParser(extractPath(in.URL))
+		parser, ok = llm.ParserByName(m.providerID)
 	}
 	if !ok {
 		return out, nil
@@ -116,9 +123,9 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	}
 	appendSessionID := func(md []middleware.KV) []middleware.KV {
 		if sessionID != "" {
-			return append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+			md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 		}
-		return md
+		return appendAgentIDs(md, in.Headers)
 	}
 
 	facts, err := parser.ParseRequest(in.Body)
@@ -160,6 +167,41 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	return out, nil
 }
 
+// agentIDHeader and parentAgentIDHeader carry sub-agent attribution: a
+// coding agent that spawns helpers stamps the spawned agent's id, plus the
+// spawning agent's when that helper is itself nested. Both are opaque
+// identifiers rather than content, so they're emitted regardless of the
+// prompt-collection toggle, the same way the session id is.
+const (
+	agentIDHeader       = "x-claude-code-agent-id"
+	parentAgentIDHeader = "x-claude-code-parent-agent-id"
+)
+
+// appendAgentIDs stamps the sub-agent attribution headers onto the metadata
+// bag, skipping either one the request doesn't carry.
+func appendAgentIDs(md []middleware.KV, headers []middleware.KV) []middleware.KV {
+	for _, pair := range []struct{ key, header string }{
+		{middleware.KeyLLMAgentID, agentIDHeader},
+		{middleware.KeyLLMParentAgentID, parentAgentIDHeader},
+	} {
+		if v := headerValue(headers, pair.header); v != "" {
+			md = append(md, middleware.KV{Key: pair.key, Value: v})
+		}
+	}
+	return md
+}
+
+// headerValue returns the first non-empty value for the named header.
+// Headers arrive in canonical form, so the match is case-insensitive.
+func headerValue(headers []middleware.KV, want string) string {
+	for _, kv := range headers {
+		if strings.EqualFold(kv.Key, want) && kv.Value != "" {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
 // sessionIDHeaders are request header names that may carry a client
 // session identifier, checked in order, case-insensitively. Matching is
 // against Go's canonical header form, so use the hyphenated names the
@@ -173,10 +215,8 @@ var sessionIDHeaders = []string{"x-claude-code-session-id", "session-id", "x-ses
 // canonical form, so the match is case-insensitive.
 func sessionIDFromHeaders(headers []middleware.KV) string {
 	for _, want := range sessionIDHeaders {
-		for _, kv := range headers {
-			if strings.EqualFold(kv.Key, want) && kv.Value != "" {
-				return kv.Value
-			}
+		if v := headerValue(headers, want); v != "" {
+			return v
 		}
 	}
 	return ""
@@ -252,6 +292,12 @@ func parseVertexPath(reqPath string) (vertexRequest, bool) {
 	if c := strings.LastIndex(rest, ":"); c >= 0 {
 		model, action = rest[:c], rest[c+1:]
 	}
+	// Token counting hangs off the model as its own path segment
+	// (".../models/{model}/count-tokens:rawPredict"), so anything past the
+	// first "/" belongs to the method rather than the model id.
+	if slash := strings.Index(model, "/"); slash >= 0 {
+		model = model[:slash]
+	}
 	model = llm.NormalizeVertexModel(model)
 	if model == "" {
 		return vertexRequest{}, false
@@ -298,6 +344,7 @@ func (m middlewareImpl) invokeVertex(in *middleware.Input, vx vertexRequest) *mi
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
+	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {
@@ -345,7 +392,9 @@ func trimBedrockNamespace(reqPath string) string {
 //
 //	/model/{modelId}/{action}
 //
-// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream}.
+// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream,
+// count-tokens}. Token counting carries a model and no usage, so it routes
+// like any other action and meters to zero.
 // The modelId may be URL-encoded and may carry a cross-region inference-profile
 // prefix and a version suffix; normalizeBedrockModel strips both so the model
 // matches catalog pricing.
@@ -369,7 +418,7 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 		return bedrockRequest{}, false
 	}
 	switch action {
-	case "invoke", "converse":
+	case "invoke", "converse", "count-tokens":
 		return bedrockRequest{model: model}, true
 	case "invoke-with-response-stream", "converse-stream":
 		return bedrockRequest{model: model, stream: true}, true
@@ -397,6 +446,7 @@ func (m middlewareImpl) invokeBedrock(in *middleware.Input, br bedrockRequest) *
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
+	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {

proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go

@@ -45,6 +45,8 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
+		middleware.KeyLLMAgentID,
+		middleware.KeyLLMParentAgentID,
 	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
@@ -230,6 +232,31 @@ func TestInvoke_ProviderIDConfigBypassesURLSniff(t *testing.T) {
 	assert.Equal(t, "gpt-4o-mini", model)
 }
 
+func TestInvoke_PathSurfaceBeatsProviderIDConfig(t *testing.T) {
+	// Gateway records (LiteLLM, Portkey, OpenRouter) pin provider_id
+	// "openai", but the same record serves Claude Code on /v1/messages.
+	// Parsing that body as OpenAI reads no usage off the Anthropic
+	// response and prices the request on a surface where no claude-*
+	// model exists, so the path has to win.
+	mw, err := Factory{}.New([]byte(`{"provider_id":"openai"}`))
+	require.NoError(t, err, "factory must accept provider_id config")
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/messages",
+		Body: []byte(`{"model":"claude-sonnet-5","stream":true,"messages":[{"role":"user","content":"Hi"}]}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "provider must be emitted")
+	assert.Equal(t, "anthropic", provider, "the /v1/messages path selects the Anthropic surface")
+
+	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	require.True(t, ok, "model must be extracted")
+	assert.Equal(t, "claude-sonnet-5", model)
+}
+
 func TestInvoke_UnknownProviderIDFallsBackToURL(t *testing.T) {
 	mw, err := Factory{}.New([]byte(`{"provider_id":"not-a-real-parser"}`))
 	require.NoError(t, err, "factory must accept any provider_id string")
@@ -416,3 +443,81 @@ func TestInvoke_NilInputAllows(t *testing.T) {
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "nil input still allows")
 	assert.Empty(t, out.Metadata, "nil input emits no metadata")
 }
+
+// TestParseVertexPath_CountTokensKeepsModel covers Vertex token counting,
+// where the method hangs off the model as its own path segment. Splitting
+// only on the final colon swallowed "/count-tokens" into the model id, so
+// the router saw a model no route could claim.
+func TestParseVertexPath_CountTokensKeepsModel(t *testing.T) {
+	cases := map[string]struct {
+		model  string
+		stream bool
+	}{
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:rawPredict":                       {model: "claude-sonnet-5"},
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:streamRawPredict":                 {model: "claude-sonnet-5", stream: true},
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5/count-tokens:rawPredict":          {model: "claude-sonnet-5"},
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5@20250929/count-tokens:rawPredict": {model: "claude-sonnet-5"},
+	}
+	for path, want := range cases {
+		vx, ok := parseVertexPath(path)
+		require.True(t, ok, "must parse %q", path)
+		assert.Equal(t, want.model, vx.model, "model for %q", path)
+		assert.Equal(t, want.stream, vx.stream, "stream flag for %q", path)
+		assert.Equal(t, "anthropic", vx.publisher, "publisher for %q", path)
+	}
+}
+
+// TestInvoke_EmitsAgentIDs covers sub-agent attribution: several agents run
+// in parallel inside one session, and without their ids every request in
+// the session attributes to the session alone.
+func TestInvoke_EmitsAgentIDs(t *testing.T) {
+	mw := newMiddleware(t)
+
+	t.Run("spawned agent", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:  "/v1/messages",
+			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
+			Headers: []middleware.KV{
+				{Key: "X-Claude-Code-Session-Id", Value: "sess-1"},
+				{Key: "X-Claude-Code-Agent-Id", Value: "agent-7"},
+			},
+		})
+		require.NoError(t, err)
+
+		agent, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
+		require.True(t, ok, "the spawned agent's id must be emitted")
+		assert.Equal(t, "agent-7", agent)
+
+		_, ok = metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
+		assert.False(t, ok, "a top-level agent has no parent to emit")
+	})
+
+	t.Run("nested agent", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:  "/v1/messages",
+			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
+			Headers: []middleware.KV{
+				{Key: "X-Claude-Code-Agent-Id", Value: "agent-9"},
+				{Key: "X-Claude-Code-Parent-Agent-Id", Value: "agent-7"},
+			},
+		})
+		require.NoError(t, err)
+
+		agent, _ := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
+		assert.Equal(t, "agent-9", agent)
+		parent, ok := metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
+		require.True(t, ok, "a nested agent must carry the spawning agent's id")
+		assert.Equal(t, "agent-7", parent)
+	})
+
+	t.Run("absent on a plain request", func(t *testing.T) {
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:  "/v1/messages",
+			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
+		})
+		require.NoError(t, err)
+
+		_, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
+		assert.False(t, ok, "no key is emitted when the client sends no agent id")
+	})
+}

proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go

@@ -1,9 +1,13 @@
 package llm_router
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
 // TestRouteClaimsModel_BedrockNormalizesCandidate guards the fix for the native
@@ -28,3 +32,86 @@ func TestRouteClaimsModel_BedrockNormalizesCandidate(t *testing.T) {
 	assert.False(t, routeClaimsModel(openai, "us.gpt-4o"),
 		"non-Bedrock routes must not strip a us. prefix")
 }
+
+// TestRouter_BedrockCountTokensRoutes pins that the token-counting action
+// reaches the Bedrock route instead of denying as not-routable.
+func TestRouter_BedrockCountTokensRoutes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "bedrock-prod",
+		Bedrock:         true,
+		Models:          []string{"anthropic.claude-sonnet-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+	}}})
+
+	in := newInputWithModelAndURL("anthropic.claude-sonnet-4-5",
+		"/model/anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens")
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "bedrock"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "count-tokens must route, not deny")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestRouter_BedrockInferenceProfilesRoutes covers the startup lookups a
+// client makes to resolve a configured inference profile. They carry no
+// model, so before they were recognised they denied and wrote a policy
+// rejection into the access log on every session start.
+func TestRouter_BedrockInferenceProfilesRoutes(t *testing.T) {
+	bedrock := ProviderRoute{
+		ID:              "bedrock-prod",
+		Bedrock:         true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+	}
+	openai := ProviderRoute{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{openai, bedrock}})
+
+	for _, path := range []string{
+		"/inference-profiles?type=SYSTEM_DEFINED",
+		"/inference-profiles/us.anthropic.claude-sonnet-5",
+	} {
+		out, err := mw.Invoke(context.Background(), newModellessInput(path))
+		require.NoError(t, err)
+		require.NotNil(t, out)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision, "%s must route", path)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host,
+			"%s must reach the Bedrock provider, not the first authorised one", path)
+
+		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+		assert.Equal(t, "true", nonInference, "%s carries no model to gate on", path)
+	}
+}
+
+// TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix pins that the
+// optional gateway namespace is removed before the request goes upstream.
+func TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "bedrock-prod",
+		Bedrock:         true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newModellessInput("/bedrock/inference-profiles"))
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "/bedrock", out.Mutations.RewriteUpstream.StripPathPrefix,
+		"the namespace prefix must not reach the real Bedrock endpoint")
+}

proxy/internal/middleware/builtin/llm_router/middleware.go

@@ -109,6 +109,10 @@ func (m *Middleware) MetadataKeys() []string {
 		middleware.KeyLLMAuthorisingGroups,
 		middleware.KeyLLMPolicyDecision,
 		middleware.KeyLLMPolicyReason,
+		middleware.KeyLLMNonInference,
+		// Emitted only for the per-model lookup, whose model lives in the path
+		// rather than a body the parser could read.
+		middleware.KeyLLMModel,
 	}
 }
 
@@ -137,29 +141,26 @@ const (
 // known to a provider that no policy authorises for the caller deny
 // with no_authorised_provider.
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	reqPath := requestPath(in.URL)
+	// The caller's API dialect, used to mirror a denial in the vendor's own
+	// error shape so the client can explain it to the user.
+	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+
 	// Vertex AI carries the model in the URL path, not the body, and is
 	// selected by path rather than by the model/vendor table. Route it before
 	// the model lookup so a model the parser extracted from the path can't be
 	// claimed by a same-vendor direct provider (e.g. claude-* on api.anthropic.com).
-	reqPath := requestPath(in.URL)
 	if isVertexPath(reqPath) {
-		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		// The request parser emits no llm.provider for a Vertex publisher it
 		// can't parse (e.g. google/gemini). Forwarding such a request would
 		// bypass token/budget metering, so deny it rather than serve it
 		// unmetered.
-		if vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider); vendor == "" {
-			return denyUnmeterable(), nil
+		if surface == "" {
+			return denyUnmeterable(surface), nil
 		}
 		route, outcome := m.matchVertex(reqPath, model, in.UserGroups)
-		switch outcome {
-		case matchOutcomeFound:
-			return m.allowWithRoute(route, in.UserGroups), nil
-		case matchOutcomeUnauthorised:
-			return denyNoAuthorisedRoute(model), nil
-		default:
-			return denyUnknownModel(model), nil
-		}
+		return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
 	}
 
 	// Bedrock likewise carries the model in the URL path (/model/{id}/{action}),
@@ -167,52 +168,120 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	// before the model lookup; when the prefix is present, strip it from the
 	// forwarded path so the real Bedrock endpoint receives its native path.
 	if isBedrockPath(reqPath) {
-		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		native, hadPrefix := splitBedrockNamespace(reqPath)
 		route, outcome := m.matchBedrock(native, model, in.UserGroups)
-		switch outcome {
-		case matchOutcomeFound:
-			out := m.allowWithRoute(route, in.UserGroups)
-			if hadPrefix && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
-				out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
+		return m.decide(route, outcome, surface, model, in.UserGroups, func(out *middleware.Output) {
+			if hadPrefix {
+				stripBedrockNamespace(out)
 			}
-			return out, nil
-		case matchOutcomeUnauthorised:
-			return denyNoAuthorisedRoute(model), nil
-		default:
-			return denyUnknownModel(model), nil
-		}
+		}), nil
 	}
 
-	model, ok := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
-	if !ok || model == "" {
-		// Non-inference endpoints (model listing) carry no model but still
-		// need rewriting from the synth placeholder to a real upstream;
-		// clients such as Codex call GET /v1/models at startup to enumerate
-		// availability and read a 403 as "model unavailable".
-		route, outcome := m.matchModelless(requestPath(in.URL), in.UserGroups)
-		switch outcome {
-		case matchOutcomeFound:
-			return m.allowWithRoute(route, in.UserGroups), nil
-		case matchOutcomeUnauthorised:
-			// A recognised model-less endpoint exists but no provider
-			// authorises the caller — deny as an authorisation failure
-			// rather than masking it as a missing model.
-			return denyNoAuthorisedRoute(model), nil
-		default:
-			return denyMissingModel(), nil
-		}
+	// GET /v1/models/{id} carries no body, so no model reaches the router in
+	// metadata — but the path names one, and answering it confirms a model
+	// exists and is reachable. Authorise it against the model table like any
+	// other per-model request, then mark it non-inference so it still skips
+	// the token pre-flight it would otherwise charge nothing against.
+	if detail, isDetail := modelDetailID(reqPath); isDetail && isNonInferenceMethod(in.Method) {
+		route, outcome := m.matchRoute(detail, surface, reqPath, in.UserGroups)
+		return m.decide(route, outcome, surface, detail, in.UserGroups, func(out *middleware.Output) {
+			markNonInference(out)
+			// The parser reads models from JSON bodies only, and this request
+			// has none, so stamp the one the path names. Without it the
+			// guardrail's own allowlist — a separate, possibly narrower list
+			// than the route's — never sees a model to check.
+			out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMModel, Value: detail})
+		}), nil
 	}
 
-	vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	route, outcome := m.matchRoute(model, vendor, requestPath(in.URL), in.UserGroups)
+	if model == "" {
+		return m.routeModelless(reqPath, surface, in.Method, in.UserGroups), nil
+	}
+
+	route, outcome := m.matchRoute(model, surface, reqPath, in.UserGroups)
+	return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
+}
+
+// decide turns a per-model match result into the middleware's decision. Every
+// surface that routes by model shares the same two denial arms — a model no
+// route claims is not routable, one that some route claims but none authorises
+// for this caller is an authorisation failure — so they live here once.
+// decorate, when non-nil, adjusts the allow with whatever that surface needs.
+func (m *Middleware) decide(
+	route ProviderRoute,
+	outcome matchOutcome,
+	surface, model string,
+	userGroups []string,
+	decorate func(*middleware.Output),
+) *middleware.Output {
 	switch outcome {
 	case matchOutcomeFound:
-		return m.allowWithRoute(route, in.UserGroups), nil
+		out := m.allowWithRoute(route, surface, userGroups)
+		if decorate != nil {
+			decorate(out)
+		}
+		return out
 	case matchOutcomeUnauthorised:
-		return denyNoAuthorisedRoute(model), nil
+		return denyNoAuthorisedRoute(surface, model)
 	default:
-		return denyUnknownModel(model), nil
+		return denyUnknownModel(surface, model)
+	}
+}
+
+// routeModelless serves the endpoints that name no model at all: the model
+// listing, the connection-warming probe, and the Bedrock inference-profile
+// lookup. They still need rewriting from the synth placeholder to a real
+// upstream — clients such as Codex call GET /v1/models at startup to enumerate
+// availability and read a 403 as "model unavailable".
+func (m *Middleware) routeModelless(reqPath, surface, method string, userGroups []string) *middleware.Output {
+	route, outcome := m.matchModelless(reqPath, method, userGroups)
+	switch outcome {
+	case matchOutcomeFound:
+		out := m.allowWithRoute(route, surface, userGroups)
+		markNonInference(out)
+		if _, hadPrefix := splitBedrockNamespace(reqPath); hadPrefix {
+			stripBedrockNamespace(out)
+		}
+		// A route that enumerates its models bounds what the caller may use,
+		// so the picker must not offer the rest: every entry outside the list
+		// is a request the chain will deny.
+		if reqPath == modelListingPath && len(route.Models) > 0 &&
+			out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+			out.Mutations.RewriteUpstream.DiscoveryModels = append([]string(nil), route.Models...)
+		}
+		return out
+	case matchOutcomeUnauthorised:
+		// A recognised model-less endpoint exists but no provider authorises
+		// the caller — deny as an authorisation failure rather than masking it
+		// as a missing model.
+		return denyNoAuthorisedRoute(surface, "")
+	default:
+		return denyMissingModel(surface)
+	}
+}
+
+// isNonInferenceMethod reports whether a request method is one the
+// non-inference endpoints actually use: the listing and the per-model lookup
+// are GET, the connection-warming probe is HEAD or GET. The method is the only
+// thing separating "GET /v1/models/{id}" from a POST to the same path carrying
+// an inference body, and the non-inference mark exempts a request from the
+// token pre-flight — so anything else falls through to normal per-model
+// routing, which denies when the request names no model.
+func isNonInferenceMethod(method string) bool {
+	return method == http.MethodGet || method == http.MethodHead
+}
+
+// markNonInference tags an allow as a request that spends no tokens, so the
+// limit check skips the management pre-flight it would charge nothing against.
+func markNonInference(out *middleware.Output) {
+	out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"})
+}
+
+// stripBedrockNamespace tells the rewrite to drop the optional "/bedrock"
+// gateway namespace so the upstream receives its native Bedrock path.
+func stripBedrockNamespace(out *middleware.Output) {
+	if out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+		out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
 	}
 }
 
@@ -300,12 +369,60 @@ func (m *Middleware) matchRoute(model, vendor, reqPath string, userGroups []stri
 	return best, matchOutcomeFound
 }
 
-// isModelLessPath reports whether reqPath is a known OpenAI-shaped
-// non-inference endpoint that legitimately carries no model in its
-// request (the model-listing endpoints). These must route to an upstream
-// rather than deny, so model enumeration works end to end.
+// connectionWarmPath is the probe Anthropic clients send before their first
+// inference request to open the upstream connection early. Forwarding it
+// warms the connection the request will actually use; denying it only fills
+// the access log with rejections at every session start.
+const connectionWarmPath = "/api/hello"
+
+// modelListingPath is the endpoint clients read at startup to populate
+// their model picker. Its response is a list the proxy can bound; the
+// per-model "/v1/models/{id}" lookup returns a single object and is left
+// alone.
+const modelListingPath = "/v1/models"
+
+// isModelLessPath reports whether reqPath is a known non-inference endpoint
+// that legitimately carries no model at all: the model listing and the
+// connection-warming probe. These must route to an upstream rather than
+// deny, so model enumeration works end to end. The per-model
+// "/v1/models/{id}" lookup is deliberately excluded — it names a model, so
+// it is authorised against the model table instead (see modelDetailID).
 func isModelLessPath(reqPath string) bool {
-	return reqPath == "/v1/models" || strings.HasPrefix(reqPath, "/v1/models/")
+	return reqPath == modelListingPath || reqPath == connectionWarmPath
+}
+
+// modelDetailID returns the model id named by a "/v1/models/{id}" lookup.
+// reqPath comes from url.URL.Path, which is already percent-decoded, so an
+// id carrying a "/" (a self-hosted "Qwen/Qwen2.5-0.5B-Instruct" sent as
+// "Qwen%2FQwen2.5-...") arrives whole and everything after the prefix is the
+// id, separators included.
+func modelDetailID(reqPath string) (string, bool) {
+	if !strings.HasPrefix(reqPath, modelListingPath+"/") {
+		return "", false
+	}
+	id := strings.TrimPrefix(reqPath, modelListingPath+"/")
+	if id == "" {
+		return "", false
+	}
+	return id, true
+}
+
+// isBedrockModelLessPath reports whether reqPath is a Bedrock
+// inference-profile lookup, optionally behind the "/bedrock" gateway
+// namespace. Clients read these at startup to resolve a configured profile
+// to its underlying model. They carry no model of their own, so they route
+// by path to a Bedrock provider rather than through the model table.
+//
+// On native AWS these live on the control plane ("bedrock.<region>") while a
+// provider's upstream is normally the runtime host ("bedrock-runtime.<region>"),
+// so forwarding yields a 404 there. That is deliberate: a client has one base
+// URL, so pointing it straight at the runtime host 404s identically, and
+// forwarding keeps the proxy transparent instead of inventing a policy denial
+// the client would never otherwise see. Operators whose Bedrock upstream is a
+// gateway that does serve the lookup get a working answer.
+func isBedrockModelLessPath(reqPath string) bool {
+	native, _ := splitBedrockNamespace(reqPath)
+	return native == "/inference-profiles" || strings.HasPrefix(native, "/inference-profiles/")
 }
 
 // isVertexPath reports whether reqPath is a Google Vertex AI publisher
@@ -332,20 +449,33 @@ func splitBedrockNamespace(reqPath string) (string, bool) {
 	return reqPath, false
 }
 
+// bedrockActions are the runtime actions that follow the model id in a
+// Bedrock path. count-tokens is here so a client can price its context
+// against the dedicated endpoint; denying it pushes that work back onto
+// the inference endpoint, which bills for it.
+var bedrockActions = []string{
+	"/invoke",
+	"/invoke-with-response-stream",
+	"/converse",
+	"/converse-stream",
+	"/count-tokens",
+}
+
 // isBedrockPath reports whether reqPath is an AWS Bedrock runtime model
-// endpoint: /model/{modelId}/{action} where action is invoke,
-// invoke-with-response-stream, converse, or converse-stream — optionally behind
-// a "/bedrock" gateway-namespace prefix. The model lives in the path, so these
-// requests are routed by path to the Bedrock provider.
+// endpoint: /model/{modelId}/{action} — optionally behind a "/bedrock"
+// gateway-namespace prefix. The model lives in the path, so these requests
+// are routed by path to the Bedrock provider.
 func isBedrockPath(reqPath string) bool {
 	native, _ := splitBedrockNamespace(reqPath)
 	if !strings.HasPrefix(native, "/model/") {
 		return false
 	}
-	return strings.HasSuffix(native, "/invoke") ||
-		strings.HasSuffix(native, "/invoke-with-response-stream") ||
-		strings.HasSuffix(native, "/converse") ||
-		strings.HasSuffix(native, "/converse-stream")
+	for _, action := range bedrockActions {
+		if strings.HasSuffix(native, action) {
+			return true
+		}
+	}
+	return false
 }
 
 // matchVertex selects the Vertex provider authorised for the caller's groups
@@ -425,19 +555,26 @@ func (m *Middleware) matchPathRoute(reqPath, model string, userGroups []string,
 // declaration order), matchOutcomeUnauthorised when no provider authorises
 // the caller, or matchOutcomeUnknownModel when the path isn't a recognised
 // model-less endpoint.
-func (m *Middleware) matchModelless(reqPath string, userGroups []string) (ProviderRoute, matchOutcome) {
-	if !isModelLessPath(reqPath) {
+func (m *Middleware) matchModelless(reqPath, method string, userGroups []string) (ProviderRoute, matchOutcome) {
+	if !isNonInferenceMethod(method) {
 		return ProviderRoute{}, matchOutcomeUnknownModel
 	}
-	var candidates []ProviderRoute
-	for _, route := range m.cfg.Providers {
+	var eligible func(ProviderRoute) bool
+	switch {
+	case isBedrockModelLessPath(reqPath):
+		eligible = func(r ProviderRoute) bool { return r.Bedrock }
+	case isModelLessPath(reqPath):
 		// Vertex/Bedrock are path-routed and don't serve OpenAI-style
 		// model-listing endpoints; including them here could rewrite a
 		// GET /v1/models to an upstream that 404s it.
-		if route.Vertex || route.Bedrock {
-			continue
-		}
-		if routeAuthorisesGroups(route, userGroups) {
+		eligible = func(r ProviderRoute) bool { return !r.Vertex && !r.Bedrock }
+	default:
+		return ProviderRoute{}, matchOutcomeUnknownModel
+	}
+
+	var candidates []ProviderRoute
+	for _, route := range m.cfg.Providers {
+		if eligible(route) && routeAuthorisesGroups(route, userGroups) {
 			candidates = append(candidates, route)
 		}
 	}
@@ -564,6 +701,16 @@ func routeClaimsModel(route ProviderRoute, model string) bool {
 		if route.Bedrock && llm.NormalizeBedrockModel(candidate) == model {
 			return true
 		}
+		// A client may pin a dated Anthropic id ("claude-sonnet-4-5-20250929")
+		// where the operator registered the undated one. Only an undated
+		// registration absorbs a dated request: normalising both sides would
+		// let a route pinned to one dated release claim a different one, so an
+		// operator who deliberately pinned a build would silently serve
+		// another — and with several such routes, ordering would decide which.
+		if candidate == llm.NormalizeAnthropicModel(candidate) &&
+			candidate == llm.NormalizeAnthropicModel(model) {
+			return true
+		}
 	}
 	return false
 }
@@ -612,7 +759,7 @@ func requestPath(raw string) string {
 // provider id so identity-stamping middlewares (llm_identity_inject)
 // tag the request with ONLY the groups that authorised this specific
 // route — not every group the peer happens to be in.
-func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *middleware.Output {
+func (m *Middleware) allowWithRoute(route ProviderRoute, surface string, userGroups []string) *middleware.Output {
 	rewrite := &middleware.UpstreamRewrite{
 		Scheme: route.UpstreamScheme,
 		Host:   route.UpstreamHost,
@@ -634,7 +781,7 @@ func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *m
 		// request time (cached + auto-refreshed) instead of a static value.
 		bearer, err := m.gcpBearer(route.GCPServiceAccountKeyB64)
 		if err != nil {
-			return denyUpstreamAuth()
+			return denyUpstreamAuth(surface)
 		}
 		authValue = bearer
 	}
@@ -704,11 +851,12 @@ func (m *Middleware) gcpTokenSource(saKeyB64 string) (oauth2.TokenSource, error)
 // denyUpstreamAuth is returned when the router cannot obtain the upstream
 // credential (e.g. a malformed service-account key or an unreachable token
 // endpoint). It surfaces as a 502 — an upstream problem, not a policy denial.
-func denyUpstreamAuth() *middleware.Output {
+func denyUpstreamAuth(surface string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 502,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeUpstreamAuth,
 			Message: "could not obtain upstream credential",
 		},
@@ -722,11 +870,12 @@ func denyUpstreamAuth() *middleware.Output {
 // denyUnmeterable returns the deny envelope for a path-routed request whose
 // publisher has no parser surface, so its usage can't be metered. Serving it
 // would bypass token/budget caps, so it is rejected with a 403.
-func denyUnmeterable() *middleware.Output {
+func denyUnmeterable(surface string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeUnmeterable,
 			Message: "request publisher is not supported for metering",
 		},
@@ -739,11 +888,12 @@ func denyUnmeterable() *middleware.Output {
 
 // denyMissingModel returns the deny envelope for a request whose
 // envelope has no llm.model metadata.
-func denyMissingModel() *middleware.Output {
+func denyMissingModel(surface string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: "missing llm.model on request envelope",
 		},
@@ -756,11 +906,12 @@ func denyMissingModel() *middleware.Output {
 
 // denyUnknownModel returns the deny envelope for a model that no
 // configured provider claims.
-func denyUnknownModel(model string) *middleware.Output {
+func denyUnknownModel(surface, model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: fmt.Sprintf("no provider configured for model %s", model),
 			Details: map[string]string{"model": model},
@@ -775,11 +926,12 @@ func denyUnknownModel(model string) *middleware.Output {
 // denyNoAuthorisedRoute returns the deny envelope for a model that one
 // or more providers claim, but where no policy authorises the caller's
 // groups for any of those providers.
-func denyNoAuthorisedRoute(model string) *middleware.Output {
+func denyNoAuthorisedRoute(surface, model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
+			Surface: surface,
 			Code:    denyCodeNoAuthorisedRoute,
 			Message: fmt.Sprintf("no policy authorises model %s for the caller's groups", model),
 			Details: map[string]string{"model": model},

proxy/internal/middleware/builtin/llm_router/middleware_test.go

@@ -2,6 +2,7 @@ package llm_router
 
 import (
 	"context"
+	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -60,6 +61,8 @@ func TestMiddlewareIdentity(t *testing.T) {
 		[]string{
 			middleware.KeyLLMResolvedProviderID,
 			middleware.KeyLLMAuthorisingGroups,
+			middleware.KeyLLMNonInference,
+			middleware.KeyLLMModel,
 			middleware.KeyLLMPolicyDecision,
 			middleware.KeyLLMPolicyReason,
 		},
@@ -171,8 +174,12 @@ func TestRouter_MissingModel(t *testing.T) {
 // from which a model could be parsed). UserGroups matches defaultTestGroup.
 func newModellessInput(reqURL string) *middleware.Input {
 	return &middleware.Input{
-		Slot:       middleware.SlotOnRequest,
-		URL:        reqURL,
+		Slot: middleware.SlotOnRequest,
+		URL:  reqURL,
+		// The non-inference endpoints are read requests; the method is what
+		// separates them from an inference body posted to the same path, so
+		// state it rather than leaning on the zero value.
+		Method:     http.MethodGet,
 		UserGroups: []string{defaultTestGroup},
 	}
 }
@@ -197,6 +204,12 @@ func TestRouter_ModelLessPath_RoutesToAuthorisedProvider(t *testing.T) {
 
 	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "openai-prod", provider, "resolved provider must be the authorised route")
+
+	// The limits gate reads this to tell "no model applies here" from
+	// "the model could not be determined", which fails closed.
+	nonInference, ok := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+	require.True(t, ok, "model-less allow must mark the request non-inference")
+	assert.Equal(t, "true", nonInference)
 }
 
 func TestRouter_ModelLessPath_MultiProviderDeclarationOrder(t *testing.T) {
@@ -873,3 +886,262 @@ func TestRouter_EmptyModelsClaimsAnyModel(t *testing.T) {
 	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "litellm", resolved)
 }
+
+// TestRouter_DatedAnthropicModelRoutes covers a client pinning a release
+// date on a model the operator registered undated. Exact matches still win,
+// so an operator who registers both dated releases keeps them distinct.
+func TestRouter_DatedAnthropicModelRoutes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "anthropic-prod",
+		Vendor:          "anthropic",
+		Models:          []string{"claude-sonnet-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}}})
+
+	in := newInputWithModelAndURL("claude-sonnet-4-5-20250929", "/v1/messages")
+	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "a dated id must route to the undated registration")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
+}
+
+// TestRouter_ConnectionWarmProbeRoutes covers the HEAD /api/hello probe an
+// Anthropic client sends before its first request. Forwarding it warms the
+// connection that request will use; denying it only wrote a rejection into
+// the access log at every session start.
+func TestRouter_ConnectionWarmProbeRoutes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "anthropic-prod",
+		Vendor:          "anthropic",
+		Models:          []string{"claude-sonnet-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}}})
+
+	in := newModellessInput("/api/hello")
+	in.Method = http.MethodHead
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "the warm-up probe must reach the upstream")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
+
+	nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+	assert.Equal(t, "true", nonInference, "the probe carries no model to gate on")
+}
+
+// TestRouter_ModelListingCarriesAuthorisedModels pins the list the proxy
+// bounds the discovery response with. A catch-all route enumerates nothing,
+// so it must not bound the upstream's list at all.
+func TestRouter_ModelListingCarriesAuthorisedModels(t *testing.T) {
+	enumerated := ProviderRoute{
+		ID:              "anthropic-prod",
+		Models:          []string{"claude-sonnet-5", "claude-haiku-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+
+	t.Run("enumerated route bounds the listing", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"},
+			out.Mutations.RewriteUpstream.DiscoveryModels,
+			"the picker must be bounded by what the route authorises")
+	})
+
+	t.Run("catch-all route leaves the listing alone", func(t *testing.T) {
+		catchAll := enumerated
+		catchAll.Models = nil
+		mw := New(Config{Providers: []ProviderRoute{catchAll}})
+
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"a route that claims every model cannot bound the upstream's list")
+	})
+
+	t.Run("per-model lookup is not a listing", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
+			"the single-object lookup has no data array to filter")
+	})
+}
+
+// TestRouter_ModelDetailHonoursAllowlist pins that GET /v1/models/{id} is
+// authorised against the model table. It carries no body model, so treating
+// it as a model-less endpoint would let a caller confirm a model the route
+// does not list — the listing itself is bounded to the allowlist, so the
+// detail lookup must be too.
+func TestRouter_ModelDetailHonoursAllowlist(t *testing.T) {
+	enumerated := ProviderRoute{
+		ID:              "anthropic-prod",
+		Models:          []string{"claude-sonnet-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+
+	t.Run("allowlisted model routes and skips metering", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
+
+		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+		assert.Equal(t, "true", nonInference, "a detail lookup spends no tokens")
+	})
+
+	t.Run("model outside the allowlist denies", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-opus-5"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"a model no route lists must not be confirmed by the detail lookup")
+	})
+
+	t.Run("dated id matches its undated registration", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{enumerated}})
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5-20250929"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"a pinned release of an allowlisted family stays reachable")
+	})
+
+	t.Run("catch-all route still answers every lookup", func(t *testing.T) {
+		catchAll := enumerated
+		catchAll.Models = nil
+		mw := New(Config{Providers: []ProviderRoute{catchAll}})
+
+		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/anything-at-all"))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"a gateway that enumerates nothing cannot refuse a lookup")
+	})
+}
+
+// TestRouter_NonInferenceRequiresReadMethod pins that the non-inference mark —
+// which exempts a request from the token pre-flight — is reachable only by the
+// read methods these endpoints actually use. A POST to the same path could
+// carry an inference body, so it must not buy the exemption; it falls through
+// to normal per-model routing instead, which denies when no model is named.
+func TestRouter_NonInferenceRequiresReadMethod(t *testing.T) {
+	route := ProviderRoute{
+		ID:              "gateway",
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.example.com",
+	}
+
+	for _, path := range []string{"/v1/models", "/v1/models/claude-sonnet-5", "/api/hello"} {
+		t.Run("POST "+path, func(t *testing.T) {
+			mw := New(Config{Providers: []ProviderRoute{route}})
+
+			in := newModellessInput(path)
+			in.Method = http.MethodPost
+
+			out, err := mw.Invoke(context.Background(), in)
+			require.NoError(t, err)
+			assert.Equal(t, middleware.DecisionDeny, out.Decision,
+				"a write to a non-inference path must not route unmetered")
+
+			nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+			assert.NotEqual(t, "true", nonInference,
+				"only a read method may skip the token pre-flight")
+		})
+	}
+
+	t.Run("HEAD keeps the warm probe working", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{route}})
+
+		in := newModellessInput(connectionWarmPath)
+		in.Method = http.MethodHead
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision,
+			"the HEAD warm probe must still reach the upstream")
+
+		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
+		assert.Equal(t, "true", nonInference,
+			"the HEAD warm probe carries no model to meter")
+	})
+}
+
+// TestRouter_PinnedDatedModelStaysDistinct pins that a route registered
+// against one dated Anthropic release does not claim another. Normalising
+// both sides of the comparison made every dated build of a family
+// interchangeable, so an operator who deliberately pinned a build would have
+// served a different one — and with several such routes, declaration or path
+// order would have decided which.
+func TestRouter_PinnedDatedModelStaysDistinct(t *testing.T) {
+	pinned := ProviderRoute{
+		ID:              "anthropic-pinned",
+		Vendor:          "anthropic",
+		Models:          []string{"claude-sonnet-4-5-20250101"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "pinned.example.com",
+	}
+
+	t.Run("a different dated release is not claimed", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{pinned}})
+		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
+		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"a route pinned to one dated build must not serve another")
+	})
+
+	t.Run("its own dated release still routes", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{pinned}})
+		in := newInputWithModelAndURL("claude-sonnet-4-5-20250101", "/v1/messages")
+		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision, "the exact match must still route")
+	})
+
+	t.Run("two pinned builds each route to their own provider", func(t *testing.T) {
+		other := pinned
+		other.ID = "anthropic-pinned-newer"
+		other.Models = []string{"claude-sonnet-4-5-20250202"}
+		other.UpstreamHost = "newer.example.com"
+		mw := New(Config{Providers: []ProviderRoute{pinned, other}})
+
+		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
+		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
+
+		out, err := mw.Invoke(context.Background(), in)
+		require.NoError(t, err)
+		require.Equal(t, middleware.DecisionAllow, out.Decision)
+		require.NotNil(t, out.Mutations)
+		require.NotNil(t, out.Mutations.RewriteUpstream)
+		assert.Equal(t, "newer.example.com", out.Mutations.RewriteUpstream.Host,
+			"declaration order must not decide between two deliberately pinned builds")
+	})
+}

proxy/internal/middleware/decision.go

@@ -11,11 +11,78 @@ var codeRegex = regexp.MustCompile(`^[a-z][a-z0-9._-]{0,63}$`)
 // denyResponse is the on-wire shape rendered by RenderDenyResponse.
 // Keeping this as a typed struct ensures we never leak
 // middleware-supplied bytes outside known fields.
+//
+// Type and Error mirror the denial in the vendor's own error shape when
+// the request reached a known LLM surface. LLM clients only parse their
+// provider's envelope, so without the mirror a budget stop reaches the
+// user as an unexplained API error. The NetBird fields stay where they
+// were, so the body is a superset and existing consumers are unaffected.
 type denyResponse struct {
 	Code       string            `json:"code"`
 	Message    string            `json:"message,omitempty"`
 	Details    map[string]string `json:"details,omitempty"`
 	Middleware string            `json:"middleware,omitempty"`
+	Type       string            `json:"type,omitempty"`
+	Error      *providerError    `json:"error,omitempty"`
+}
+
+// providerError is the nested error object both vendor envelopes carry.
+type providerError struct {
+	Type    string `json:"type"`
+	Message string `json:"message,omitempty"`
+	Code    string `json:"code,omitempty"`
+}
+
+// Vendor error types keyed by HTTP status, per each provider's published
+// error reference.
+const (
+	anthropicErrInvalidRequest = "invalid_request_error"
+	anthropicErrPermission     = "permission_error"
+	anthropicErrRateLimit      = "rate_limit_error"
+	anthropicErrAPI            = "api_error"
+	openAIErrInvalidRequest    = "invalid_request_error"
+	openAIErrRateLimit         = "rate_limit_error"
+)
+
+// providerEnvelope returns the vendor-shaped mirror for a denial on the
+// given surface, or nil when the surface has no envelope we can speak.
+// message is the already-redacted public message.
+func providerEnvelope(surface, code, message string, status int) (string, *providerError) {
+	switch surface {
+	case "anthropic":
+		return "error", &providerError{
+			Type:    anthropicErrorType(status),
+			Message: message,
+		}
+	case "openai":
+		return "", &providerError{
+			Type:    openAIErrorType(status),
+			Message: message,
+			Code:    code,
+		}
+	default:
+		return "", nil
+	}
+}
+
+func anthropicErrorType(status int) string {
+	switch status {
+	case http.StatusForbidden:
+		return anthropicErrPermission
+	case http.StatusTooManyRequests:
+		return anthropicErrRateLimit
+	case http.StatusBadRequest:
+		return anthropicErrInvalidRequest
+	default:
+		return anthropicErrAPI
+	}
+}
+
+func openAIErrorType(status int) string {
+	if status == http.StatusTooManyRequests {
+		return openAIErrRateLimit
+	}
+	return openAIErrInvalidRequest
 }
 
 // RenderDenyResponse writes a structured JSON deny body. Status is
@@ -36,6 +103,7 @@ func RenderDenyResponse(w http.ResponseWriter, middlewareID string, reason *Deny
 		Message:    truncate(Scan(reason.Message), 256),
 		Middleware: truncate(Scan(middlewareID), 64),
 	}
+	resp.Type, resp.Error = providerEnvelope(reason.Surface, resp.Code, resp.Message, status)
 	if n := len(reason.Details); n > 0 {
 		resp.Details = make(map[string]string, min(n, 8))
 		for k, v := range reason.Details {

proxy/internal/middleware/decision_test.go

@@ -0,0 +1,92 @@
+package middleware
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// decodeDeny renders a denial and returns the parsed body plus the status.
+func decodeDeny(t *testing.T, reason *DenyReason, status int) (map[string]any, int) {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	RenderDenyResponse(rec, "llm_limit_check", reason, status)
+
+	var body map[string]any
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body), "deny body must be valid JSON")
+	return body, rec.Code
+}
+
+// TestRenderDeny_AnthropicSurfaceMirrorsVendorShape covers a budget stop
+// reaching Claude Code. The client only parses the Anthropic envelope, so
+// without the mirror the user sees an unexplained API error instead of the
+// reason their request was refused.
+func TestRenderDeny_AnthropicSurfaceMirrorsVendorShape(t *testing.T) {
+	body, status := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.budget_cap_exceeded",
+		Message: "LLM policy limit exceeded",
+		Surface: "anthropic",
+	}, http.StatusForbidden)
+
+	assert.Equal(t, http.StatusForbidden, status)
+	assert.Equal(t, "error", body["type"], "Anthropic errors carry type=error at the top level")
+
+	errObj, ok := body["error"].(map[string]any)
+	require.True(t, ok, "error must be an object")
+	assert.Equal(t, "permission_error", errObj["type"], "403 maps to permission_error")
+	assert.Equal(t, "LLM policy limit exceeded", errObj["message"])
+
+	// The NetBird fields stay put so existing consumers keep working.
+	assert.Equal(t, "llm_policy.budget_cap_exceeded", body["code"])
+	assert.Equal(t, "LLM policy limit exceeded", body["message"])
+	assert.Equal(t, "llm_limit_check", body["middleware"])
+}
+
+// TestRenderDeny_OpenAISurfaceMirrorsVendorShape pins the OpenAI envelope,
+// which nests the code and carries no top-level type.
+func TestRenderDeny_OpenAISurfaceMirrorsVendorShape(t *testing.T) {
+	body, _ := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.model_blocked",
+		Message: "model is not in the policy allowlist",
+		Surface: "openai",
+	}, http.StatusForbidden)
+
+	assert.NotContains(t, body, "type", "OpenAI errors have no top-level type")
+
+	errObj, ok := body["error"].(map[string]any)
+	require.True(t, ok, "error must be an object")
+	assert.Equal(t, "invalid_request_error", errObj["type"])
+	assert.Equal(t, "llm_policy.model_blocked", errObj["code"], "the NetBird code rides in the vendor code field")
+	assert.Equal(t, "model is not in the policy allowlist", errObj["message"])
+}
+
+// TestRenderDeny_RateLimitStatusMapsToVendorRateLimit pins the mapping a
+// client's backoff keys on.
+func TestRenderDeny_RateLimitStatusMapsToVendorRateLimit(t *testing.T) {
+	body, status := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.token_cap_exceeded",
+		Message: "LLM policy limit exceeded",
+		Surface: "anthropic",
+	}, http.StatusTooManyRequests)
+
+	assert.Equal(t, http.StatusTooManyRequests, status, "429 must survive the status clamp")
+	errObj := body["error"].(map[string]any)
+	assert.Equal(t, "rate_limit_error", errObj["type"])
+}
+
+// TestRenderDeny_NoSurfaceKeepsLegacyShape guards non-LLM middlewares and
+// denials raised before a surface is known.
+func TestRenderDeny_NoSurfaceKeepsLegacyShape(t *testing.T) {
+	body, _ := decodeDeny(t, &DenyReason{
+		Code:    "llm_policy.model_not_routable",
+		Message: "no provider configured for model x",
+	}, http.StatusForbidden)
+
+	assert.NotContains(t, body, "type", "no surface means no vendor mirror")
+	assert.NotContains(t, body, "error", "no surface means no vendor mirror")
+	assert.Equal(t, "llm_policy.model_not_routable", body["code"])
+}

proxy/internal/middleware/keys.go

@@ -22,6 +22,15 @@ const (
 	// body. Empty for clients that don't send one.
 	KeyLLMSessionID = "llm.session_id"
 
+	// Sub-agent attribution (emitted by llm_request_parser from the
+	// client's request headers). A coding agent that spawns helpers
+	// stamps the spawned agent's id, and the spawning agent's id when
+	// the helper is itself nested, so cost within one session can be
+	// split across the agents that ran in parallel. These identify an
+	// agent, not a person or a device: never treat them as a user id.
+	KeyLLMAgentID       = "llm.agent_id"
+	KeyLLMParentAgentID = "llm.parent_agent_id"
+
 	// LLM response-side metadata (emitted by llm_response_parser).
 	//nolint:gosec // metadata key name, not a credential
 	KeyLLMInputTokens = "llm.input_tokens"
@@ -66,6 +75,14 @@ const (
 	// downstream gateways' spend logs.
 	KeyLLMAuthorisingGroups = "llm.authorising_groups"
 
+	// LLM non-inference marker (emitted by llm_router on the allow path
+	// for endpoints that legitimately carry no model, such as model
+	// listing). The router still authorises these against the caller's
+	// groups; the marker only tells the limits gate that a per-model
+	// allowlist has nothing to evaluate, so an empty model must not be
+	// read as an undetermined one. Never derived from client input.
+	KeyLLMNonInference = "llm.non_inference"
+
 	// LLM policy attribution (emitted by llm_limit_check on the allow
 	// path). Names the policy that paid for this request and the
 	// dimension counters the post-flight llm_limit_record middleware

proxy/internal/middleware/types.go

@@ -179,6 +179,12 @@ type DenyReason struct {
 	Code    string
 	Message string
 	Details map[string]string
+	// Surface names the LLM API dialect the caller speaks (the
+	// llm.provider value), so the rendered body can mirror the denial in
+	// that vendor's error shape alongside the NetBird fields. Empty for
+	// non-LLM middlewares and for denials raised before a surface was
+	// resolved; the body then carries the NetBird fields alone.
+	Surface string
 }
 
 // Output is the value each middleware returns to the dispatcher. The
@@ -247,6 +253,12 @@ type UpstreamRewrite struct {
 	// without verifying its TLS certificate. Set by llm_router from the
 	// provider's skip_tls_verification for self-hosted / internal gateways.
 	SkipTLSVerify bool
+	// DiscoveryModels, when non-empty, is the set of model ids the resolved
+	// route authorises, and the proxy drops everything else from the
+	// model-listing response. Empty leaves the upstream's list untouched,
+	// which is what a route that claims every model wants. Set by
+	// llm_router on a model-listing request only.
+	DiscoveryModels []string
 }
 
 // AuthHeader is a single name/value pair the proxy injects on the

proxy/internal/proxy/discovery_filter.go

@@ -0,0 +1,191 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	sharedllm "github.com/netbirdio/netbird/shared/llm"
+)
+
+// maxDiscoveryBodyBytes bounds the model-listing response the filter will
+// buffer. A listing is a few kilobytes of ids; anything larger is not a
+// listing we recognise, and buffering it to rewrite would cost more than
+// the filtering is worth.
+const maxDiscoveryBodyBytes = 1 << 20
+
+// modelDiscoveryFilter returns a ModifyResponse hook that drops models the
+// caller's policy does not authorise from a model-listing response, then
+// delegates to next (which may be nil).
+//
+// Clients populate their model picker from this endpoint, so an unfiltered
+// list offers models the very next request denies. The filter is
+// best-effort: a response it cannot safely rewrite passes through
+// untouched rather than reaching the client corrupted.
+func modelDiscoveryFilter(allowed []string, next func(*http.Response) error) func(*http.Response) error {
+	permitted := make(map[string]struct{}, len(allowed)*2)
+	for _, id := range allowed {
+		permitted[id] = struct{}{}
+		permitted[sharedllm.NormalizeAnthropicModel(id)] = struct{}{}
+	}
+
+	return func(resp *http.Response) error {
+		if err := filterModelListing(resp, permitted); err != nil {
+			return err
+		}
+		if next == nil {
+			return nil
+		}
+		return next(resp)
+	}
+}
+
+// filterModelListing rewrites the response body in place, keeping only the
+// entries whose id the policy authorises. Responses that are not a plain
+// JSON listing are left alone.
+func filterModelListing(resp *http.Response, permitted map[string]struct{}) error {
+	if !isPlainJSONListing(resp) {
+		return nil
+	}
+
+	// One byte past the cap, so an oversized body is detectable without
+	// buffering all of it.
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxDiscoveryBodyBytes+1))
+	if err != nil {
+		_ = resp.Body.Close()
+		return err
+	}
+	if len(body) > maxDiscoveryBodyBytes {
+		// Too large to filter. Put the bytes already read back in front of the
+		// unread remainder and forward the response exactly as the upstream
+		// sent it, headers included. Buffering what was read and closing here
+		// would truncate the body at the cap and hand the client a short,
+		// invalid listing — worse than not filtering at all.
+		resp.Body = spliceBody(body, resp.Body)
+		return nil
+	}
+	if err := resp.Body.Close(); err != nil {
+		return err
+	}
+
+	filtered, ok := filterListingBody(body, permitted)
+	if !ok {
+		restoreBody(resp, body)
+		return nil
+	}
+	restoreBody(resp, filtered)
+	return nil
+}
+
+// isPlainJSONListing reports whether the response is a JSON body the filter
+// can parse. A content-encoded body is skipped: the transport only
+// transparently decompresses what it negotiated itself, and the client
+// negotiates its own encoding on this request.
+func isPlainJSONListing(resp *http.Response) bool {
+	if resp == nil || resp.Body == nil {
+		return false
+	}
+	if resp.StatusCode != http.StatusOK {
+		return false
+	}
+	if enc := resp.Header.Get("Content-Encoding"); enc != "" && !strings.EqualFold(enc, "identity") {
+		return false
+	}
+	return strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "application/json")
+}
+
+// filterListingBody returns the listing with unauthorised entries removed.
+// ok is false when the body is not a listing shape, in which case the
+// caller must forward the original bytes.
+func filterListingBody(body []byte, permitted map[string]struct{}) ([]byte, bool) {
+	var doc map[string]json.RawMessage
+	if err := json.Unmarshal(body, &doc); err != nil {
+		return nil, false
+	}
+	raw, present := doc["data"]
+	if !present {
+		return nil, false
+	}
+	var entries []map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &entries); err != nil {
+		return nil, false
+	}
+
+	kept := make([]map[string]json.RawMessage, 0, len(entries))
+	for _, entry := range entries {
+		if entryPermitted(entry, permitted) {
+			kept = append(kept, entry)
+		}
+	}
+
+	encoded, err := json.Marshal(kept)
+	if err != nil {
+		return nil, false
+	}
+	doc["data"] = encoded
+	out, err := json.Marshal(doc)
+	if err != nil {
+		return nil, false
+	}
+	return out, true
+}
+
+// entryPermitted reports whether a listing entry names a model the policy
+// authorises, trying every form the same model is written in.
+func entryPermitted(entry map[string]json.RawMessage, permitted map[string]struct{}) bool {
+	raw, ok := entry["id"]
+	if !ok {
+		return false
+	}
+	var id string
+	if err := json.Unmarshal(raw, &id); err != nil {
+		return false
+	}
+	for _, candidate := range modelIDForms(id) {
+		if _, ok := permitted[candidate]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+// modelIDForms returns the forms a single model id may be written in: the id
+// itself, its undated form, and the same two with a gateway's provider
+// prefix removed ("vertex_ai/claude-sonnet-5"). The bare id is tried first,
+// because a self-hosted id can legitimately contain a slash of its own
+// ("Qwen/Qwen2.5-0.5B-Instruct") and must not be cut down to its tail.
+func modelIDForms(id string) []string {
+	if id == "" {
+		return nil
+	}
+	forms := []string{id, sharedllm.NormalizeAnthropicModel(id)}
+	if slash := strings.LastIndex(id, "/"); slash >= 0 {
+		tail := id[slash+1:]
+		forms = append(forms, tail, sharedllm.NormalizeAnthropicModel(tail))
+	}
+	return forms
+}
+
+// restoreBody puts body back on the response and fixes the length headers
+// so the client reads exactly what is there.
+// spliceBody returns a ReadCloser that yields prefix followed by whatever is
+// left in rest, closing rest when closed. It lets the filter put back bytes it
+// consumed while deciding, without owning the rest of the stream.
+func spliceBody(prefix []byte, rest io.ReadCloser) io.ReadCloser {
+	return struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
+		Closer: rest,
+	}
+}
+
+func restoreBody(resp *http.Response, body []byte) {
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+	resp.ContentLength = int64(len(body))
+	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
+}

proxy/internal/proxy/discovery_filter_test.go

@@ -0,0 +1,217 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// jsonListingResponse builds a 200 model-listing response with the given
+// body, as an upstream would return it.
+func jsonListingResponse(body string) *http.Response {
+	resp := &http.Response{
+		StatusCode:    http.StatusOK,
+		Header:        http.Header{},
+		Body:          io.NopCloser(strings.NewReader(body)),
+		ContentLength: int64(len(body)),
+	}
+	resp.Header.Set("Content-Type", "application/json")
+	return resp
+}
+
+// listedIDs runs the filter and returns the ids left in the response.
+func listedIDs(t *testing.T, allowed []string, body string) []string {
+	t.Helper()
+	resp := jsonListingResponse(body)                            //nolint:bodyclose // in-memory body, replaced by the filter
+	require.NoError(t, modelDiscoveryFilter(allowed, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
+
+	raw, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	var doc struct {
+		Data []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &doc), "filtered body must stay valid JSON")
+
+	ids := make([]string, 0, len(doc.Data))
+	for _, entry := range doc.Data {
+		ids = append(ids, entry.ID)
+	}
+	return ids
+}
+
+// TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels covers the picker a
+// developer sees: an unfiltered upstream list offers every model the shared
+// key can reach, and each one the policy excludes is a request the chain
+// denies a moment later.
+func TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels(t *testing.T) {
+	ids := listedIDs(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, `{
+		"data": [
+			{"id": "claude-opus-5", "display_name": "Claude Opus 5"},
+			{"id": "claude-sonnet-5", "display_name": "Claude Sonnet 5"},
+			{"id": "claude-haiku-4-5"}
+		],
+		"has_more": false
+	}`)
+
+	assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, ids,
+		"only the models the route authorises may reach the picker")
+}
+
+// TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs pins the two id forms
+// a gateway returns for a model the operator registered plainly.
+func TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs(t *testing.T) {
+	ids := listedIDs(t, []string{"claude-sonnet-4-5", "anthropic.claude-opus-5"}, `{
+		"data": [
+			{"id": "claude-sonnet-4-5-20250929"},
+			{"id": "bedrock/anthropic.claude-opus-5"},
+			{"id": "gpt-4o"}
+		]
+	}`)
+
+	assert.Equal(t, []string{"claude-sonnet-4-5-20250929", "bedrock/anthropic.claude-opus-5"}, ids,
+		"a dated or provider-prefixed id must match its registered form")
+}
+
+// TestModelDiscoveryFilter_PreservesEnvelopeFields guards the rest of the
+// document: clients read paging fields alongside data.
+func TestModelDiscoveryFilter_PreservesEnvelopeFields(t *testing.T) {
+	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}],"has_more":true,"first_id":"x"}`) //nolint:bodyclose // in-memory body, replaced by the filter
+	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp))                  //nolint:bodyclose // in-memory body, replaced by the filter
+
+	raw, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(raw, &doc))
+	assert.Equal(t, true, doc["has_more"], "paging fields must survive the rewrite")
+	assert.Equal(t, "x", doc["first_id"])
+	assert.Equal(t, strconv.Itoa(len(raw)), resp.Header.Get("Content-Length"),
+		"Content-Length must match the rewritten body")
+}
+
+// TestModelDiscoveryFilter_PassesThroughUnfilterable covers the responses
+// the filter must not touch: a compressed body it cannot parse, a non-JSON
+// body, an error status, and a document with no data array.
+func TestModelDiscoveryFilter_PassesThroughUnfilterable(t *testing.T) {
+	cases := map[string]func() *http.Response{
+		"compressed": func() *http.Response {
+			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
+			resp.Header.Set("Content-Encoding", "gzip")
+			return resp
+		},
+		"not json": func() *http.Response {
+			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
+			resp.Header.Set("Content-Type", "text/html")
+			return resp
+		},
+		"error status": func() *http.Response {
+			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
+			resp.StatusCode = http.StatusInternalServerError
+			return resp
+		},
+		"no data array": func() *http.Response {
+			return jsonListingResponse(`{"object":"list"}`)
+		},
+	}
+
+	for name, build := range cases {
+		t.Run(name, func(t *testing.T) {
+			resp := build() //nolint:bodyclose // in-memory body, replaced by the filter
+			original, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			resp.Body = io.NopCloser(bytes.NewReader(original))
+
+			require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
+
+			got, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.Equal(t, string(original), string(got), "an unfilterable response must reach the client unchanged")
+		})
+	}
+}
+
+// TestModelDiscoveryFilter_RunsNextHook pins that an existing
+// ModifyResponse hook still runs after filtering.
+func TestModelDiscoveryFilter_RunsNextHook(t *testing.T) {
+	called := false
+	next := func(*http.Response) error {
+		called = true
+		return nil
+	}
+
+	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}]}`)                //nolint:bodyclose // in-memory body, replaced by the filter
+	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, next)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
+	assert.True(t, called, "the chained hook must still run")
+}
+
+// TestModelDiscoveryFilter_KeepsSlashBearingIDs covers self-hosted backends
+// whose model ids carry a slash of their own. Treating the slash as a
+// gateway prefix and keeping only the tail dropped every such model from
+// the picker even though the policy named it exactly.
+func TestModelDiscoveryFilter_KeepsSlashBearingIDs(t *testing.T) {
+	ids := listedIDs(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, `{
+		"object": "list",
+		"data": [
+			{"id": "Qwen/Qwen2.5-0.5B-Instruct"},
+			{"id": "Qwen/Qwen2.5-7B-Instruct"}
+		]
+	}`)
+
+	assert.Equal(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, ids,
+		"a slash inside the model id is part of the id, not a provider prefix")
+}
+
+// TestModelDiscoveryFilter_ForwardsOversizedBodyIntact covers a listing past
+// the buffering cap. The filter reads one byte beyond the cap to detect the
+// size; forwarding only what it read would hand the client a body truncated
+// at exactly 1 MiB — valid-looking, short, and unparseable as JSON. The bytes
+// already read must be spliced back in front of the unread remainder so the
+// response reaches the client exactly as the upstream sent it.
+func TestModelDiscoveryFilter_ForwardsOversizedBodyIntact(t *testing.T) {
+	// A well-formed listing whose single entry pads the body past the cap.
+	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
+	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
+	require.Greater(t, len(body), maxDiscoveryBodyBytes+1,
+		"the fixture must exceed the cap by more than the one-byte probe")
+
+	resp := jsonListingResponse(body)                        //nolint:bodyclose // in-memory body
+	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
+
+	got, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Equal(t, len(body), len(got),
+		"an oversized listing must reach the client whole, not truncated at the cap")
+	assert.Equal(t, body, string(got), "the forwarded bytes must be the upstream's own")
+
+	var doc map[string]json.RawMessage
+	assert.NoError(t, json.Unmarshal(got, &doc),
+		"the forwarded body must still parse as JSON")
+}
+
+// TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders pins that the
+// oversized path leaves the response metadata alone. Rewriting Content-Length
+// to the truncated prefix is what made the corruption invisible to the client
+// until it tried to parse.
+func TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders(t *testing.T) {
+	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
+	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
+
+	resp := jsonListingResponse(body) //nolint:bodyclose // in-memory body
+	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
+	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
+
+	assert.Equal(t, int64(len(body)), resp.ContentLength,
+		"ContentLength must keep describing the body the client receives")
+	assert.Equal(t, strconv.Itoa(len(body)), resp.Header.Get("Content-Length"),
+		"the Content-Length header must not be rewritten to the truncated prefix")
+}

proxy/internal/proxy/reverseproxy.go

@@ -363,6 +363,9 @@ func (p *ReverseProxy) forwardUpstream(respWriter http.ResponseWriter, r *http.R
 	if result.rewriteRedirects {
 		rp.ModifyResponse = p.rewriteLocationFunc(effectiveURL, rewriteMatchedPath, r) //nolint:bodyclose
 	}
+	if upstreamRewrite != nil && len(upstreamRewrite.DiscoveryModels) > 0 {
+		rp.ModifyResponse = modelDiscoveryFilter(upstreamRewrite.DiscoveryModels, rp.ModifyResponse) //nolint:bodyclose // the hook replaces the body and closes the original
+	}
 	rp.ServeHTTP(respWriter, r.WithContext(ctx))
 }
 

shared/llm/model.go

@@ -46,6 +46,27 @@ func NormalizeBedrockModel(modelID string) string {
 	return bedrockVersionSuffix.ReplaceAllString(m, "")
 }
 
+// anthropicDatedModel matches a Claude model id carrying the trailing
+// "-YYYYMMDD" release-date suffix Anthropic appends to a pinned release,
+// capturing the id without it. The "claude" anchor is load-bearing: pricing
+// looks every model up through this helper regardless of surface, and an
+// operator may register a custom id with any shape at all, so an unanchored
+// "-\d{8}$" would let "internal-llm-20250101" silently inherit the rate
+// registered for "internal-llm". The anchor also covers the vendor-prefixed
+// forms ("anthropic.claude-...", "us.anthropic.claude-...").
+var anthropicDatedModel = regexp.MustCompile(`(?i)^(.*claude.*)-\d{8}$`)
+
+// NormalizeAnthropicModel strips the trailing release-date suffix from a
+// Claude model id, e.g. "claude-sonnet-4-5-20250929" -> "claude-sonnet-4-5",
+// so a dated id a client pins matches the undated one the operator
+// registered. Ids that are not Claude-family are returned untouched.
+// Callers try the verbatim id first and fall back to this, so two dated
+// releases of the same family stay distinct wherever both are registered
+// explicitly.
+func NormalizeAnthropicModel(modelID string) string {
+	return anthropicDatedModel.ReplaceAllString(modelID, "$1")
+}
+
 // NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
 // (e.g. "claude-sonnet-4-5@20250929" -> "claude-sonnet-4-5") so it matches
 // the catalog/pricing key. Vertex publisher models are priced under their

shared/llm/model_test.go

@@ -34,3 +34,29 @@ func TestNormalizeVertexModel(t *testing.T) {
 		require.Equal(t, want, NormalizeVertexModel(in), "normalize %q", in)
 	}
 }
+
+func TestNormalizeAnthropicModel(t *testing.T) {
+	cases := map[string]string{
+		"claude-sonnet-4-5-20250929":            "claude-sonnet-4-5",
+		"claude-3-5-haiku-20241022":             "claude-3-5-haiku",
+		"claude-sonnet-5":                       "claude-sonnet-5",
+		"claude-opus-4-8":                       "claude-opus-4-8",
+		"anthropic.claude-haiku-4-5":            "anthropic.claude-haiku-4-5",
+		"anthropic.claude-sonnet-4-5-20250929":  "anthropic.claude-sonnet-4-5",
+		"us.anthropic.claude-opus-4-8-20250101": "us.anthropic.claude-opus-4-8",
+		// Non-Claude ids must survive untouched even when they end in eight
+		// consecutive digits: an operator can register a custom model under
+		// any id, and pricing looks every one of them up through this helper.
+		"gpt-4o":                  "gpt-4o",
+		"gpt-4o-2024-08-06":       "gpt-4o-2024-08-06",
+		"gpt-4o-20240806":         "gpt-4o-20240806",
+		"internal-llm-20250101":   "internal-llm-20250101",
+		"deepseek-r1-20250120":    "deepseek-r1-20250120",
+		"Qwen/Qwen2.5-20250101":   "Qwen/Qwen2.5-20250101",
+		"gemini-2-5-pro-20250101": "gemini-2-5-pro-20250101",
+		"":                        "",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, NormalizeAnthropicModel(in), "normalize %q", in)
+	}
+}

shared/management/http/api/openapi.yml

@@ -4608,7 +4608,7 @@ components:
 
     FleetDMMatchAttributes:
       type: object
-      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
       additionalProperties: false
       properties:
         disk_encryption_enabled:
@@ -5729,57 +5729,6 @@ components:
       required:
         - name
         - checks
-    AgentNetworkMeSetup:
-      type: object
-      description: The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
-      properties:
-        configured:
-          type: boolean
-          description: False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
-        endpoint:
-          type: string
-          description: The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
-          example: https://calm-otter.proxy.example.com
-        providers:
-          type: array
-          description: The providers at least one of the caller's policies authorizes, in creation order.
-          items:
-            $ref: '#/components/schemas/AgentNetworkMeProvider'
-      required:
-        - configured
-        - endpoint
-        - providers
-    AgentNetworkMeProvider:
-      type: object
-      description: One provider the caller may use, reduced to what a local tool needs for configuration.
-      properties:
-        name:
-          type: string
-          description: Operator-assigned provider label.
-          example: Bedrock prod
-        catalog_id:
-          type: string
-          description: Catalog entry id naming the provider type.
-          example: bedrock_api
-        api_flavor:
-          type: string
-          description: Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
-          example: anthropic
-        all_models_allowed:
-          type: boolean
-          description: True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
-        models:
-          type: array
-          description: The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
-          items:
-            type: string
-          example: [ "anthropic.claude-sonnet-4-5" ]
-      required:
-        - name
-        - catalog_id
-        - api_flavor
-        - all_models_allowed
-        - models
     AgentNetworkConsumption:
       type: object
       description: One per-(dimension, window) consumption counter row. The proxy ticks one row per dimension on every served LLM request; the dashboard reads this listing to surface live counter growth.
@@ -13774,46 +13723,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/agent-network/me/setup:
-    get:
-      summary: Retrieve the caller's Agent Network setup
-      description: Returns everything the caller needs to configure a local AI tool and nothing more - the account's Agent Network endpoint plus the providers and models the caller's own policies allow. Available to every authenticated user regardless of role; the response never contains provider credentials, policy or guardrail configuration, or providers the caller cannot reach.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: The caller-scoped Agent Network connection info
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AgentNetworkMeSetup'
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/agent-network/me/consumption:
-    get:
-      summary: List the caller's own Agent Network consumption
-      description: Returns the caller's own per-window token and cost counters (the user dimension recorded for the calling user), ordered window-newest-first. Available to every authenticated user regardless of role. Empty list when the caller has not consumed anything yet.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: A JSON Array of the caller's own consumption counter rows
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/AgentNetworkConsumption'
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings

shared/management/http/api/types.gen.go

@@ -2167,36 +2167,6 @@ type AgentNetworkGuardrailRequest struct {
 	Name string `json:"name"`
 }
 
-// AgentNetworkMeProvider One provider the caller may use, reduced to what a local tool needs for configuration.
-type AgentNetworkMeProvider struct {
-	// AllModelsAllowed True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
-	AllModelsAllowed bool `json:"all_models_allowed"`
-
-	// ApiFlavor Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
-	ApiFlavor string `json:"api_flavor"`
-
-	// CatalogId Catalog entry id naming the provider type.
-	CatalogId string `json:"catalog_id"`
-
-	// Models The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
-	Models []string `json:"models"`
-
-	// Name Operator-assigned provider label.
-	Name string `json:"name"`
-}
-
-// AgentNetworkMeSetup The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
-type AgentNetworkMeSetup struct {
-	// Configured False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
-	Configured bool `json:"configured"`
-
-	// Endpoint The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
-	Endpoint string `json:"endpoint"`
-
-	// Providers The providers at least one of the caller's policies authorizes, in creation order.
-	Providers []AgentNetworkMeProvider `json:"providers"`
-}
-
 // AgentNetworkPolicy defines model for AgentNetworkPolicy.
 type AgentNetworkPolicy struct {
 	// CreatedAt Timestamp when the policy was created.
@@ -2906,7 +2876,7 @@ type EDRFleetDMRequest struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours. Minimum value is 24 hours
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 }
 
@@ -2939,7 +2909,7 @@ type EDRFleetDMResponse struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours.
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 
 	// UpdatedAt Timestamp of when the integration was last updated.
@@ -3159,7 +3129,7 @@ type Event struct {
 // EventActivityCode The string code of the activity that occurred during the event
 type EventActivityCode string
 
-// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
 type FleetDMMatchAttributes struct {
 	// DiskEncryptionEnabled Whether disk encryption (FileVault/BitLocker) must be enabled on the host
 	DiskEncryptionEnabled *bool `json:"disk_encryption_enabled,omitempty"`