[client] Derive Windows SSH privilege checks from the token and group membership (#6966)

People who only ever reach private services through the reverse proxy were
invisible to activity accounting. Active users are counted from user.LastLogin
or from the LastSeen of a peer they own, and neither column was written on the
proxy paths — so a person signing in via SSO to a proxied service, or a peer
serving one over the mesh, never showed up in the 24 hour numbers.
Both writes now happen where the proxy already authenticates:
- GenerateSessionToken stamps LastLogin after the session token is signed,
  the same column and the same way the dashboard and device login paths do.
- ValidateTunnelPeer stamps the calling peer's LastSeen, the column its owner
  activates through.
The policy lives in a new reverseproxy/activity manager rather than in the gRPC
service, matching the module layout the other reverse proxy domains use. It
skips what can never count — service users, embedded proxy peers and WASM
clients — and throttles peer writes to once an hour, well inside the window
accounting asks about and far above the proxy's five minute tunnel cache.
The peer write is a single indexed UPDATE that touches only
peer_status_last_seen. Connected and SessionStartedAt are left alone so the
session-ownership fencing MarkPeerConnectedIfNewerSession relies on is never
disturbed, and the timestamp comes from the database clock rather than the
caller, for the same reason the other status writers take it from there. The
caller's cutoff travels into the statement's WHERE, so concurrent requests for
one peer collapse into a single write instead of each acting on its own stale
read, and a peer that was never seen — NULL last seen, since Status is an
embedded pointer — still records its first activity.
Nothing outside the reverse proxy changes behaviour: the only addition
elsewhere is the RefreshPeerLastSeen store method the manager calls.

CONTRIBUTING.md

@@ -112,6 +112,7 @@ aligns with our security standards and design expectations.
         - [Test suite](#test-suite)
     - [Checklist before submitting a PR](#checklist-before-submitting-a-pr)
     - [When we close a PR](#when-we-close-a-pr)
+    - [Translations](#translations)
     - [Other project repositories](#other-project-repositories)
     - [Contributor License Agreement](#contributor-license-agreement)
 
@@ -612,6 +613,17 @@ A closed PR is not a rejected idea. Take it back to the
 [discussion](https://github.com/netbirdio/netbird/discussions), settle the
 approach, and reopen the work from there.
 
+## Translations
+
+Desktop UI translations are not contributed through pull requests. Translate on
+[Crowdin](https://crowdin.com/project/netbird) instead: no ticket needed, just
+join the project and pick your language. Crowdin syncs with this repository and
+opens the service PRs itself, so hand-edited locale files would conflict with
+the next sync. Style, terminology, and review guidance live in
+[client/ui/i18n/TRANSLATING.md](client/ui/i18n/TRANSLATING.md). To request a
+language the project does not offer yet, ask on the Crowdin project page or in
+a [discussion](https://github.com/netbirdio/netbird/discussions).
+
 ## Other project repositories
 
 NetBird project is composed of 3 main repositories:

agent-network/README.md

@@ -40,35 +40,6 @@ You can then use this private endpoint to configure your AI agents, whether that
 Full step-by-step setup:
 **https://docs.netbird.io/agent-network/quickstart**
 
-## Client settings that don't follow the endpoint
-
-Most of an agent's traffic follows the base URL you hand it, but a few
-client-side checks call their vendor directly and never reach the proxy. On a
-network that blocks direct egress they fail even though inference works, so
-they are worth setting once when you roll the endpoint out.
-
-For Claude Code:
-
-- **Fast mode** checks availability against `api.anthropic.com` rather than the
-  configured base URL. Set `CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1` when the
-  agent authenticates with `ANTHROPIC_AUTH_TOKEN` alone (the usual shape when
-  the proxy injects the real provider key) or when a TLS-inspecting proxy
-  answers the check itself. Set
-  `CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1` when the network refuses the
-  connection outright. Fast mode is an Anthropic-API feature, so it is
-  unavailable on a Bedrock- or Vertex-backed endpoint whatever you set.
-- **Model discovery** is off by default. Set
-  `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` for the picker to list the
-  models your policies authorise; the proxy filters the response to that set.
-  The client gives discovery a three-second budget and treats any redirect as
-  a failure, so the endpoint must serve `/v1/models` directly.
-- **The WebFetch domain safety check** also calls `api.anthropic.com` directly
-  and is unaffected by the variables above.
-
-Allowing direct egress to `api.anthropic.com` covers the network cases but not
-the credential one, where the check reaches Anthropic and is rejected because
-the agent presents a proxy-issued key.
-
 ## Architecture 
 
 Agent Network is built on two existing NetBird capabilities:

client/ssh/server/command_execution_windows.go

@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi
 
 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}
 
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{

client/ssh/server/port_forwarding.go

@@ -133,7 +133,12 @@ func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, resu
 		return nil
 	}
 
-	if result.User != nil && isPrivilegedUsername(result.User.Username) {
+	// Only uid 0 may bind below the threshold, which is the kernel's own rule and
+	// is asked directly rather than through isPrivilegedOrUnknown: that helper
+	// reports an account it cannot evaluate as privileged, which is safe for a
+	// refusal and unsafe for a grant such as this one. Windows has returned
+	// above, so Uid here is a Unix uid and never a SID.
+	if result.User != nil && result.User.Uid == "0" {
 		return nil
 	}
 

client/ssh/server/privileges_other.go

@@ -0,0 +1,16 @@
+//go:build !windows
+
+package server
+
+// isProcessElevated is only meaningful on Windows; other platforms use the
+// effective UID check in isCurrentProcessPrivileged.
+func isProcessElevated() bool {
+	return false
+}
+
+// isWindowsAccountPrivilegedOrUnknown is only reachable on Windows. Report
+// privileged on other platforms so a caller refusing privileged accounts fails
+// closed.
+func isWindowsAccountPrivilegedOrUnknown(string) bool {
+	return true
+}

client/ssh/server/privileges_windows.go

@@ -0,0 +1,228 @@
+//go:build windows
+
+package server
+
+import (
+	"fmt"
+	"strings"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
+	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
+)
+
+const (
+	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
+	// the user belongs to through a global group.
+	lgIncludeIndirect  = 0x1
+	maxPreferredLength = 0xFFFFFFFF
+)
+
+// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
+type localGroupUsersInfo0 struct {
+	name *uint16
+}
+
+// isProcessElevated reports whether the current process token is elevated
+// (TokenElevation): true for elevated administrators, the built-in
+// Administrator, administrators with UAC disabled, and SYSTEM; false for
+// standard users and administrators running with a UAC-filtered token.
+func isProcessElevated() bool {
+	return windows.GetCurrentProcessToken().IsElevated()
+}
+
+// isWindowsAccountPrivilegedOrUnknown reports whether the account is privileged
+// on this machine: a well-known service account, a built-in Administrator
+// (RID 500), or a member of the local Administrators group, directly or through
+// nested groups.
+//
+// An account whose privilege cannot be determined counts as privileged, which
+// is why the name says "or unknown". That is fail-closed for a caller that
+// refuses privileged accounts, and fail-open for a caller that grants something
+// to them, so only the former may use this.
+func isWindowsAccountPrivilegedOrUnknown(username string) bool {
+	sid, _, _, err := windows.LookupSID("", username)
+	if err != nil {
+		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
+		return true
+	}
+
+	if isPrivilegedUserSID(sid) {
+		return true
+	}
+
+	member, err := isLocalAdminsMember(username)
+	if err != nil {
+		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
+		return true
+	}
+	return member
+}
+
+// isPrivilegedUserSID reports whether the SID itself identifies a privileged
+// principal, without consulting group membership.
+func isPrivilegedUserSID(sid *windows.SID) bool {
+	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
+		windows.WinLocalSystemSid,
+		windows.WinLocalServiceSid,
+		windows.WinNetworkServiceSid,
+		windows.WinBuiltinAdministratorsSid,
+	}
+	for _, sidType := range wellKnown {
+		if sid.IsWellKnown(sidType) {
+			return true
+		}
+	}
+	return isBuiltinAdministratorSID(sid)
+}
+
+// isBuiltinAdministratorSID reports whether the SID is a machine or domain
+// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
+// that account; it can be renamed but cannot be removed from the
+// Administrators group.
+func isBuiltinAdministratorSID(sid *windows.SID) bool {
+	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
+		return false
+	}
+	count := sid.SubAuthorityCount()
+	if count < 2 || sid.SubAuthority(0) != 21 {
+		return false
+	}
+	return sid.SubAuthority(uint32(count-1)) == 500
+}
+
+// isLocalAdminsMember reports whether the account is a member of the local
+// Administrators group.
+//
+// Local accounts are checked against the local SAM, which is authoritative for
+// them and, unlike a token, cannot under-report: UAC filters the tokens of
+// local administrators, and a filtered token carries Administrators as
+// deny-only, which a membership check on the token would read as "not a
+// member". Domain accounts are exempt from that filtering, so for them an S4U
+// token is preferred because its group list is LSA's transitive expansion and
+// therefore covers nested and universal groups plus the machine's own local
+// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
+// logon, so it serves as the fallback when no token can be obtained.
+func isLocalAdminsMember(username string) (bool, error) {
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	if err != nil {
+		return false, fmt.Errorf("create Administrators SID: %w", err)
+	}
+
+	account, domain := parseUsername(username)
+	if NewPrivilegeDropper().isLocalUser(domain) {
+		return localGroupsContainSID(account, adminSid)
+	}
+
+	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
+	if s4uErr == nil {
+		return member, nil
+	}
+	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
+
+	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
+	if err != nil {
+		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
+	}
+	return member, nil
+}
+
+// s4uTokenIsMember obtains an S4U token for the account and checks whether the
+// given SID is enabled in it.
+func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
+	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		if err := windows.CloseHandle(token); err != nil {
+			log.Debugf("close S4U token: %v", err)
+		}
+	}()
+	return windows.Token(token).IsMember(sid)
+}
+
+// localGroupsContainSID reports whether the wanted group is among the local
+// groups the account belongs to, directly or through a global group.
+//
+// The wanted SID is resolved to its group name once and compared against the
+// enumerated names. Well-known SIDs resolve from a static table, so that lookup
+// needs no domain controller, and it keeps the comparison correct for a renamed
+// or localized group because both sides then carry the new name. Resolving each
+// enumerated name back to a SID instead would add a lookup per group that can
+// block until it times out while a domain controller is unreachable, and cannot
+// change the outcome: the names enumerated here are local groups of this
+// machine, whose names are unique, so a name match identifies the group.
+//
+// A failure to resolve the wanted SID is returned rather than reported as
+// "not a member", so a privilege check built on this fails closed.
+func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
+	wantName, _, _, err := want.LookupAccount("")
+	if err != nil {
+		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
+	}
+
+	groups, err := netUserGetLocalGroups(username)
+	if err != nil {
+		return false, err
+	}
+
+	for _, group := range groups {
+		if strings.EqualFold(group, wantName) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// netUserGetLocalGroups returns the names of the local groups the account is a
+// member of, including indirect membership through global groups.
+func netUserGetLocalGroups(username string) ([]string, error) {
+	name16, err := windows.UTF16PtrFromString(username)
+	if err != nil {
+		return nil, fmt.Errorf("convert username: %w", err)
+	}
+
+	var buf *byte
+	var entriesRead, totalEntries uint32
+	status, _, _ := procNetUserGetLocalGroups.Call(
+		0, // local server
+		uintptr(unsafe.Pointer(name16)),
+		0, // level 0: LOCALGROUP_USERS_INFO_0
+		lgIncludeIndirect,
+		uintptr(unsafe.Pointer(&buf)),
+		maxPreferredLength,
+		uintptr(unsafe.Pointer(&entriesRead)),
+		uintptr(unsafe.Pointer(&totalEntries)),
+	)
+	if status != 0 {
+		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
+	}
+	if buf == nil {
+		return nil, nil
+	}
+	defer func() {
+		if err := windows.NetApiBufferFree(buf); err != nil {
+			log.Debugf("free NetApi buffer: %v", err)
+		}
+	}()
+
+	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
+	// short read is not expected. Report it rather than silently returning a
+	// subset of the account's groups.
+	if entriesRead != totalEntries {
+		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
+	}
+
+	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
+	groups := make([]string, 0, entriesRead)
+	for _, entry := range entries {
+		groups = append(groups, windows.UTF16PtrToString(entry.name))
+	}
+	return groups, nil
+}

client/ssh/server/privileges_windows_test.go

@@ -0,0 +1,293 @@
+//go:build windows
+
+package server
+
+import (
+	"os/user"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// filterNormalAccount limits NetUserEnum to normal user accounts.
+const filterNormalAccount = 0x2
+
+// TOKEN_ELEVATION_TYPE values.
+const (
+	tokenElevationTypeDefault = 1
+	tokenElevationTypeFull    = 2
+	tokenElevationTypeLimited = 3
+)
+
+// tokenElevationType reads TokenElevationType from a token.
+func tokenElevationType(token windows.Token) (uint32, error) {
+	var elevationType, returnedLen uint32
+	err := windows.GetTokenInformation(token, windows.TokenElevationType,
+		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
+	if err != nil {
+		return 0, err
+	}
+	return elevationType, nil
+}
+
+// userInfo0 mirrors USER_INFO_0.
+type userInfo0 struct {
+	name *uint16
+}
+
+func mustParseSID(t *testing.T, s string) *windows.SID {
+	t.Helper()
+	sid, err := windows.StringToSid(s)
+	require.NoError(t, err, "parse SID %s", s)
+	return sid
+}
+
+// localAccountNames returns the names of the local user accounts.
+func localAccountNames(t *testing.T) []string {
+	t.Helper()
+
+	var buf *byte
+	var entriesRead, totalEntries, resume uint32
+	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
+		&entriesRead, &totalEntries, &resume)
+	require.NoError(t, err, "enumerate local users")
+	t.Cleanup(func() {
+		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
+	})
+
+	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
+	names := make([]string, 0, entriesRead)
+	for _, entry := range entries {
+		names = append(names, windows.UTF16PtrToString(entry.name))
+	}
+	return names
+}
+
+// localAccountNameByRID returns the name of the local account carrying the
+// given RID. Accounts such as Administrator and Guest can be renamed and are
+// localized, so tests must not name them literally.
+func localAccountNameByRID(t *testing.T, rid uint32) string {
+	t.Helper()
+
+	for _, name := range localAccountNames(t) {
+		sid, _, _, err := windows.LookupSID("", name)
+		if err != nil {
+			continue
+		}
+		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
+			continue
+		}
+		count := sid.SubAuthorityCount()
+		if count < 2 || sid.SubAuthority(0) != 21 {
+			continue
+		}
+		if sid.SubAuthority(uint32(count-1)) == rid {
+			return name
+		}
+	}
+
+	t.Fatalf("no local account with RID %d", rid)
+	return ""
+}
+
+// wellKnownAccountName resolves a well-known SID to the qualified account name
+// the local system uses for it, which is localized.
+func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
+	t.Helper()
+
+	sid, err := windows.CreateWellKnownSid(sidType)
+	require.NoError(t, err, "create well-known SID")
+	name, domain, _, err := sid.LookupAccount("")
+	require.NoError(t, err, "resolve %s to an account name", sid)
+	if domain == "" {
+		return name
+	}
+	return domain + `\` + name
+}
+
+func TestIsBuiltinAdministratorSID(t *testing.T) {
+	tests := []struct {
+		name string
+		sid  string
+		want bool
+	}{
+		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
+		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
+		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
+		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
+		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
+		{"system", "S-1-5-18", false},
+		{"administrators_group", "S-1-5-32-544", false},
+		{"non_nt_authority", "S-1-1-0", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
+			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
+		})
+	}
+}
+
+func TestIsPrivilegedUserSID(t *testing.T) {
+	tests := []struct {
+		name string
+		sid  string
+		want bool
+	}{
+		{"local_system", "S-1-5-18", true},
+		{"local_service", "S-1-5-19", true},
+		{"network_service", "S-1-5-20", true},
+		{"administrators_group", "S-1-5-32-544", true},
+		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
+		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
+		{"users_group", "S-1-5-32-545", false},
+		{"everyone", "S-1-1-0", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
+			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
+		})
+	}
+}
+
+func TestIsWindowsAccountPrivilegedOrUnknown(t *testing.T) {
+	tests := []struct {
+		name     string
+		username string
+		want     bool
+	}{
+		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
+		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
+		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
+		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
+		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
+		// exist on every Windows installation, though they may be disabled.
+		{"builtin_administrator", localAccountNameByRID(t, 500), true},
+		{"guest", localAccountNameByRID(t, 501), false},
+		// Unresolvable accounts fail closed.
+		{"nonexistent_user", "netbird-no-such-user", true},
+		{"empty_username", "", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsAccountPrivilegedOrUnknown(tt.username)
+			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
+		})
+	}
+}
+
+func TestIsProcessElevated(t *testing.T) {
+	elevated := isProcessElevated()
+
+	// TokenElevationType is a second, independent view of the same token:
+	// Full means elevated and Limited means a filtered administrator, while
+	// Default covers both a standard user and an administrator with no linked
+	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
+	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
+	require.NoError(t, err, "read token elevation type")
+
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
+	// counts only enabled SIDs, so a filtered administrator reports false here.
+	member, err := windows.Token(0).IsMember(adminSid)
+	require.NoError(t, err, "check own Administrators membership")
+
+	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
+
+	switch elevationType {
+	case tokenElevationTypeFull:
+		assert.True(t, elevated, "a token of elevation type Full must report elevated")
+	case tokenElevationTypeLimited:
+		assert.False(t, elevated, "a filtered administrator token must not report elevated")
+	}
+
+	// Administrators enabled in the token means the token wields administrative
+	// rights, which is what elevation reports.
+	if member {
+		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
+	}
+}
+
+// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
+// for domain accounts. S4U logons need the TCB privilege, so the test runs
+// only as SYSTEM (which is how CI executes the suite). For local accounts the
+// token's Administrators membership must agree with the SAM enumeration.
+func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
+	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
+	require.NoError(t, err, "create SYSTEM SID")
+	current, err := user.Current()
+	require.NoError(t, err, "get current user")
+	if current.Uid != system.String() {
+		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
+	}
+
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	checked := 0
+	for _, name := range localAccountNames(t) {
+		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
+		if err != nil {
+			// Disabled or logon-restricted accounts cannot get an S4U logon.
+			t.Logf("skipping %s: %v", name, err)
+			continue
+		}
+		viaSAM, err := localGroupsContainSID(name, adminSid)
+		require.NoError(t, err, "enumerate local groups for %s", name)
+
+		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
+		checked++
+	}
+	// Ineligible accounts are skipped, so without this the test could report
+	// success while comparing nothing at all.
+	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
+	t.Logf("checked %d local accounts via S4U", checked)
+}
+
+// TestLocalGroupsContainSID_Administrator checks the positive case against the
+// built-in Administrator, a member of Administrators on every installation.
+func TestLocalGroupsContainSID_Administrator(t *testing.T) {
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	administrator := localAccountNameByRID(t, 500)
+	member, err := localGroupsContainSID(administrator, adminSid)
+	require.NoError(t, err, "enumerate local groups for %s", administrator)
+	assert.True(t, member, "%s is a member of the Administrators group", administrator)
+}
+
+// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
+// that resolves to no group: the error must surface rather than being reported
+// as "not a member", so the privilege check treats the account as privileged.
+func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
+	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
+
+	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
+	require.Error(t, err, "must report an error when the wanted group cannot be identified")
+}
+
+func TestLocalGroupsContainSID_Guest(t *testing.T) {
+	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
+	require.NoError(t, err, "create Guests SID")
+	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	guest := localAccountNameByRID(t, 501)
+
+	inGuests, err := localGroupsContainSID(guest, guestsSid)
+	require.NoError(t, err, "enumerate local groups for %s", guest)
+	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
+
+	inAdmins, err := localGroupsContainSID(guest, adminsSid)
+	require.NoError(t, err, "enumerate local groups for %s", guest)
+	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
+}

client/ssh/server/server_config_test.go

@@ -239,6 +239,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 		forwardType   string
 		port          uint32
 		username      string
+		uid           string
 		expectError   bool
 		errorMsg      string
 		skipOnWindows bool
@@ -248,6 +249,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "remote",
 			port:          80,
 			username:      "testuser",
+			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -257,6 +259,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "tcpip-forward",
 			port:          443,
 			username:      "testuser",
+			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -266,6 +269,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        8080,
 			username:    "testuser",
+			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -273,6 +277,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        0,
 			username:    "testuser",
+			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -280,13 +285,35 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        22,
 			username:    "root",
+			uid:         "0",
 			expectError: false,
 		},
+		{
+			// Only uid 0 is privileged, whatever the account is called.
+			name:          "uid 0 under another name may bind a privileged port",
+			forwardType:   "remote",
+			port:          22,
+			username:      "toor",
+			uid:           "0",
+			expectError:   false,
+			skipOnWindows: true,
+		},
+		{
+			name:          "account named root without uid 0 may not",
+			forwardType:   "remote",
+			port:          22,
+			username:      "root",
+			uid:           "1000",
+			expectError:   true,
+			errorMsg:      "cannot bind to privileged port",
+			skipOnWindows: true,
+		},
 		{
 			name:        "local forward privileged port allowed for non-root",
 			forwardType: "local",
 			port:        80,
 			username:    "testuser",
+			uid:         "1000",
 			expectError: false,
 		},
 	}
@@ -299,7 +326,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 
 			result := PrivilegeCheckResult{
 				Allowed: true,
-				User:    &user.User{Username: tt.username},
+				User:    &user.User{Username: tt.username, Uid: tt.uid},
 			}
 
 			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
@@ -420,6 +447,13 @@ func TestServer_PortConflictHandling(t *testing.T) {
 
 func TestServer_IsPrivilegedUser(t *testing.T) {
 
+	// Windows classification depends on account SIDs and group membership, and
+	// the accounts involved carry localized, renameable names. It is covered by
+	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
+	if runtime.GOOS == "windows" {
+		t.Skip("covered by TestIsWindowsAccountPrivileged")
+	}
+
 	tests := []struct {
 		username    string
 		expected    bool
@@ -440,44 +474,16 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-	}
-
-	// Add Windows-specific tests
-	if runtime.GOOS == "windows" {
-		tests = append(tests, []struct {
-			username    string
-			expected    bool
-			description string
-		}{
-			{
-				username:    "Administrator",
-				expected:    true,
-				description: "Administrator should be considered privileged on Windows",
-			},
-			{
-				username:    "administrator",
-				expected:    true,
-				description: "administrator should be considered privileged on Windows (case insensitive)",
-			},
-		}...)
-	} else {
-		// On non-Windows systems, Administrator should not be privileged
-		tests = append(tests, []struct {
-			username    string
-			expected    bool
-			description string
-		}{
-			{
-				username:    "Administrator",
-				expected:    false,
-				description: "Administrator should not be privileged on non-Windows systems",
-			},
-		}...)
+		{
+			username:    "Administrator",
+			expected:    false,
+			description: "Administrator should not be privileged on non-Windows systems",
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			result := isPrivilegedUsername(tt.username)
+			result := isPrivilegedOrUnknown(tt.username)
 			assert.Equal(t, tt.expected, result, tt.description)
 		})
 	}

client/ssh/server/sftp_windows.go

@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := s.parseUsername(targetUser.Username)
+	username, domain := parseUsername(targetUser.Username)
 
 	netbirdPath, err := os.Executable()
 	if err != nil {

client/ssh/server/user_utils.go

@@ -16,11 +16,6 @@ var (
 	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
 )
 
-// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
-func isPlatformUnix() bool {
-	return getCurrentOS() != "windows"
-}
-
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
 	getCurrentUser         = currentUserWithGetent
@@ -29,6 +24,9 @@ var (
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 
 	getEuid = os.Geteuid
+
+	getProcessElevated                   = isProcessElevated
+	getWindowsAccountPrivilegedOrUnknown = isWindowsAccountPrivilegedOrUnknown
 )
 
 const (
@@ -65,6 +63,13 @@ type PrivilegeCheckResult struct {
 	RequiresUserSwitching bool
 }
 
+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
 // CheckPrivileges performs comprehensive privilege checking for all SSH features.
 // This is the single source of truth for privilege decisions across the SSH server.
 func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
@@ -75,7 +80,7 @@ func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult
 
 	// Handle empty username case - but still check root access controls
 	if req.RequestedUsername == "" {
-		if isPrivilegedUsername(context.currentUser.Username) && !context.allowRoot {
+		if isPrivilegedOrUnknown(context.currentUser.Username) && !context.allowRoot {
 			return PrivilegeCheckResult{
 				Allowed: false,
 				Error:   &PrivilegedUserError{Username: context.currentUser.Username},
@@ -135,7 +140,7 @@ func (s *Server) checkUserRequest(ctx *privilegeCheckContext, req PrivilegeCheck
 
 	needsUserSwitching := !isSameResolvedUser(resolvedUser, ctx.currentUser)
 
-	if isPrivilegedUsername(resolvedUser.Username) && !ctx.allowRoot {
+	if isPrivilegedOrUnknown(resolvedUser.Username) && !ctx.allowRoot {
 		return PrivilegeCheckResult{
 			Allowed:               false,
 			Error:                 &PrivilegedUserError{Username: resolvedUser.Username},
@@ -175,6 +180,42 @@ func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, err
 	return u, nil
 }
 
+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result, err := s.userPrivilegeCheck(username)
+	if err != nil {
+		return nil, err
+	}
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
 // isSameResolvedUser compares two resolved user identities
 func isSameResolvedUser(user1, user2 *user.User) bool {
 	if user1 == nil || user2 == nil {
@@ -183,13 +224,6 @@ func isSameResolvedUser(user1, user2 *user.User) bool {
 	return user1.Uid == user2.Uid
 }
 
-// privilegeCheckContext holds all context needed for privilege checking
-type privilegeCheckContext struct {
-	currentUser           *user.User
-	currentUserPrivileged bool
-	allowRoot             bool
-}
-
 // isSameUser checks if two usernames refer to the same user
 // SECURITY: This function must be conservative - it should only return true
 // when we're certain both usernames refer to the exact same user identity
@@ -253,159 +287,30 @@ func isWindowsSameUser(requestedUsername, currentUsername string) bool {
 	return strings.EqualFold(reqDomain, curDomain)
 }
 
-// SetAllowRootLogin configures root login access
-func (s *Server) SetAllowRootLogin(allow bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.allowRootLogin = allow
-}
-
-// userNameLookup performs user lookup with root login permission check
-func (s *Server) userNameLookup(username string) (*user.User, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return nil, result.Error
-	}
-
-	return result.User, nil
-}
-
-// userPrivilegeCheck performs user lookup with full privilege check result
-func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return result, result.Error
-	}
-
-	return result, nil
-}
-
-// isPrivilegedUsername checks if the given username represents a privileged user across platforms.
-// On Unix: root
-// On Windows: Administrator, SYSTEM (case-insensitive)
-// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
-func isPrivilegedUsername(username string) bool {
+// isPrivilegedOrUnknown reports whether the given username represents a
+// privileged user, or on Windows an account whose privilege could not be
+// determined.
+// On Unix: root.
+// On Windows: well-known service accounts, built-in Administrator accounts,
+// and members of the local Administrators group; handles domain-qualified
+// usernames like "DOMAIN\user" or "user@domain.com". An account that cannot be
+// resolved or evaluated is reported as privileged.
+//
+// Use this to refuse privileged accounts, never to grant them anything: the
+// undetermined case is safe for a refusal and unsafe for a grant.
+func isPrivilegedOrUnknown(username string) bool {
 	if getCurrentOS() != "windows" {
 		return username == "root"
 	}
-
-	bareUsername := username
-	// Handle Windows domain format: DOMAIN\username
-	if idx := strings.LastIndex(username, `\`); idx != -1 {
-		bareUsername = username[idx+1:]
-	}
-	// Handle email-style format: username@domain.com
-	if idx := strings.Index(bareUsername, "@"); idx != -1 {
-		bareUsername = bareUsername[:idx]
-	}
-
-	return isWindowsPrivilegedUser(bareUsername)
-}
-
-// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
-func isWindowsPrivilegedUser(bareUsername string) bool {
-	// common privileged usernames (case insensitive)
-	privilegedNames := []string{
-		"administrator",
-		"admin",
-		"root",
-		"system",
-		"localsystem",
-		"networkservice",
-		"localservice",
-	}
-
-	usernameLower := strings.ToLower(bareUsername)
-	for _, privilegedName := range privilegedNames {
-		if usernameLower == privilegedName {
-			return true
-		}
-	}
-
-	// computer accounts (ending with $) are not privileged by themselves
-	// They only gain privileges through group membership or specific SIDs
-
-	if targetUser, err := lookupUser(bareUsername); err == nil {
-		return isWindowsPrivilegedSID(targetUser.Uid)
-	}
-
-	return false
-}
-
-// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
-func isWindowsPrivilegedSID(sid string) bool {
-	privilegedSIDs := []string{
-		"S-1-5-18",     // Local System (SYSTEM)
-		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
-		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
-		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
-		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
-	}
-
-	for _, privilegedSID := range privilegedSIDs {
-		if sid == privilegedSID {
-			return true
-		}
-	}
-
-	// Check for domain administrator accounts (RID 500 in any domain)
-	// Format: S-1-5-21-domain-domain-domain-500
-	// This is reliable as RID 500 is reserved for the domain Administrator account
-	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
-		return true
-	}
-
-	// Check for other well-known privileged RIDs in domain contexts
-	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
-	if strings.HasPrefix(sid, "S-1-5-21-") {
-		if strings.HasSuffix(sid, "-512") || // Domain Admins group
-			strings.HasSuffix(sid, "-516") || // Domain Controllers group
-			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
-			return true
-		}
-	}
-
-	return false
+	return getWindowsAccountPrivilegedOrUnknown(username)
 }
 
 // isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
 // On Unix systems, this means running as root (UID 0).
-// On Windows, this means running as Administrator or SYSTEM.
+// On Windows, this means the process token is elevated (administrators, SYSTEM).
 func isCurrentProcessPrivileged() bool {
 	if getCurrentOS() == "windows" {
-		return isWindowsElevated()
+		return getProcessElevated()
 	}
 	return getEuid() == 0
 }
-
-// isWindowsElevated checks if the current process is running with elevated privileges on Windows
-func isWindowsElevated() bool {
-	currentUser, err := getCurrentUser()
-	if err != nil {
-		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
-		return false
-	}
-
-	if isWindowsPrivilegedSID(currentUser.Uid) {
-		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
-		return true
-	}
-
-	if isPrivilegedUsername(currentUser.Username) {
-		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
-		return true
-	}
-
-	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
-	return false
-}

client/ssh/server/user_utils_test.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os/user"
 	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -27,8 +28,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 	originalLookupUser := lookupUser
 	originalGetCurrentOS := getCurrentOS
 	originalGetEuid := getEuid
-
-	// Reset caches to ensure clean test state
+	originalGetProcessElevated := getProcessElevated
+	originalGetWindowsAccountPrivilegedOrUnknown := getWindowsAccountPrivilegedOrUnknown
 
 	// Set test values - inject platform dependencies
 	getCurrentUser = func() (*user.User, error) {
@@ -53,16 +54,31 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		return euid
 	}
 
-	// Mock privilege detection based on the test user
-	getIsProcessPrivileged = func() bool {
+	// Simulate the Windows token elevation check based on the fixture user:
+	// the built-in Administrator (RID 500) and SYSTEM run elevated.
+	getProcessElevated = func() bool {
 		if currentUser == nil {
 			return false
 		}
-		// Check both username and SID for Windows systems
-		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
+		return currentUser.Uid == "S-1-5-18" || strings.HasSuffix(currentUser.Uid, "-500")
+	}
+
+	// Simulate the Windows account classifier for the fixture accounts.
+	// "root" does not exist on Windows; the real classifier fails closed on
+	// unresolvable accounts, so it counts as privileged here too.
+	getWindowsAccountPrivilegedOrUnknown = func(username string) bool {
+		bare := username
+		if idx := strings.LastIndex(bare, `\`); idx != -1 {
+			bare = bare[idx+1:]
+		}
+		if idx := strings.Index(bare, "@"); idx != -1 {
+			bare = bare[:idx]
+		}
+		switch strings.ToLower(bare) {
+		case "administrator", "system", "root":
 			return true
 		}
-		return isPrivilegedUsername(currentUser.Username)
+		return false
 	}
 
 	// Return cleanup function
@@ -71,10 +87,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		lookupUser = originalLookupUser
 		getCurrentOS = originalGetCurrentOS
 		getEuid = originalGetEuid
-
-		getIsProcessPrivileged = isCurrentProcessPrivileged
-
-		// Reset caches after test
+		getProcessElevated = originalGetProcessElevated
+		getWindowsAccountPrivilegedOrUnknown = originalGetWindowsAccountPrivilegedOrUnknown
 	}
 }
 
@@ -421,6 +435,9 @@ func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
 }
 
 func TestPrivilegedUsernameDetection(t *testing.T) {
+	// Windows classification is syscall-backed (SID resolution, group
+	// membership) and is covered by privileges_windows_test.go; here only the
+	// Unix logic and the platform dispatch are exercised.
 	tests := []struct {
 		name       string
 		username   string
@@ -432,25 +449,9 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 		{"unix_regular_user", "alice", "linux", false},
 		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive
 
-		// Windows tests
+		// Windows dispatch to the (mocked) account classifier
 		{"windows_administrator", "Administrator", "windows", true},
-		{"windows_system", "SYSTEM", "windows", true},
-		{"windows_admin", "admin", "windows", true},
-		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
-		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
-		{"windows_email_admin", "admin@domain.com", "windows", true},
 		{"windows_regular_user", "alice", "windows", false},
-		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
-		{"windows_localsystem", "localsystem", "windows", true},
-		{"windows_networkservice", "networkservice", "windows", true},
-		{"windows_localservice", "localservice", "windows", true},
-
-		// Computer accounts (these depend on current user context in real implementation)
-		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
-		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
-
-		// Cross-platform
-		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
 	}
 
 	for _, tt := range tests {
@@ -459,50 +460,8 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 			cleanup := setupTestDependencies(nil, nil, tt.platform, 1000, nil, nil)
 			defer cleanup()
 
-			result := isPrivilegedUsername(tt.username)
-			assert.Equal(t, tt.privileged, result)
-		})
-	}
-}
-
-func TestWindowsPrivilegedSIDDetection(t *testing.T) {
-	tests := []struct {
-		name        string
-		sid         string
-		privileged  bool
-		description string
-	}{
-		// Well-known system accounts
-		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
-		{"local_service", "S-1-5-19", true, "Local Service"},
-		{"network_service", "S-1-5-20", true, "Network Service"},
-		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
-		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
-
-		// Domain accounts
-		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
-		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
-		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
-		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
-
-		// Regular users
-		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
-		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
-		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
-
-		// Groups that are not privileged
-		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
-		{"power_users", "S-1-5-32-547", false, "Power Users group"},
-
-		// Invalid SIDs
-		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
-		{"empty_sid", "", false, "Empty SID"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsPrivilegedSID(tt.sid)
-			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
+			result := isPrivilegedOrUnknown(tt.username)
+			assert.Equal(t, tt.privileged, result, "privilege classification for %s on %s", tt.username, tt.platform)
 		})
 	}
 }

client/ssh/server/userswitching_windows.go

@@ -91,7 +91,7 @@ func validateUsernameFormat(username string) error {
 func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
 	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)
 
-	username, _ := s.parseUsername(localUser.Username)
+	username, _ := parseUsername(localUser.Username)
 	if err := validateUsername(username); err != nil {
 		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
 	}
@@ -102,7 +102,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 // createUserSwitchCommand creates a command with Windows user switching.
 // Returns the command and a cleanup function that must be called after starting the process.
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 
 	shell := getUserShell(localUser.Uid)
 
@@ -138,7 +138,7 @@ func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session,
 }
 
 // parseUsername extracts username and domain from a Windows username
-func (s *Server) parseUsername(fullUsername string) (username, domain string) {
+func parseUsername(fullUsername string) (username, domain string) {
 	// Handle DOMAIN\username format
 	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
 		domain = fullUsername[:idx]

client/ui/i18n/TRANSLATING.md

@@ -2,9 +2,24 @@
 
 A short brief for translating the desktop UI — for any translator, human or AI agent (*"you"* = whoever's translating).
 
-**Drive an agent with:** *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* — or *"…and review the existing German translation."*
+**Translations are managed on Crowdin: <https://crowdin.com/project/netbird>.** Join the project, pick your language, and translate in the editor. Each string carries a context note (the `description` from the source file) telling you what it is and where it shows up, and the project's glossary, style guide, and QA checks mirror this document.
 
-> 💡 **The one habit that matters most:** read each key's `description` before translating it. Labels are terse and ambiguous on their own; the `description` tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
+> 💡 **The one habit that matters most:** read each string's context before translating it. Labels are terse and ambiguous on their own; the context tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
+
+---
+
+## How contributions flow
+
+```text
+i18n/locales/en/common.json ──sync──▶ Crowdin ──service PR──▶ i18n/locales/<code>/common.json
+```
+
+- `i18n/locales/en/common.json` is the source of truth. New and changed strings sync to Crowdin automatically (see `crowdin.yml` in the repository root).
+- Crowdin opens and updates a service pull request with the translated bundles, keeping the source's file shape and key order. Keys nobody has translated yet are left out of the export; the app falls back to English for them at runtime. Maintainers review and merge that PR.
+- Don't hand-edit `i18n/locales/<code>/common.json` in your own PRs: the next sync would conflict with or overwrite your changes. Translate on Crowdin instead.
+- Missing your language? Request it on the Crowdin project page or in a [GitHub discussion](https://github.com/netbirdio/netbird/discussions). When a language first ships, a maintainer adds its row to `i18n/locales/_index.json` with `code`, `displayName` (the native name), and `englishName`, which puts it in the app's language picker.
+
+**Prefer translating with an AI agent?** That still works: drive it with *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* as before, but deliver the result to Crowdin instead of a pull request. Download your language's file from the Crowdin editor, let the agent translate it, and upload it back (the editor's offline translation flow). Crowdin runs its QA checks on upload, and the next service PR carries the strings into the repo.
 
 ---
 
@@ -30,25 +45,6 @@ A **business zero-trust VPN** — an encrypted **overlay mesh** between a compan
 
 ---
 
-## The files
-
-```
-i18n/locales/_index.json         shipped-language list
-i18n/locales/en/common.json      source of truth — message + description
-i18n/locales/<code>/common.json  a target — message only
-```
-
-Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
-
-| ✅ Do | ❌ Don't |
-|---|---|
-| Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |
-| Put **only `message`** in target bundles | Copy `description` into a target bundle |
-| Give every key a non-empty `message` | Leave keys missing or empty |
-| Save valid UTF-8 JSON, no BOM | Add trailing commas or break the JSON |
-
----
-
 ## Hard rules — get these exactly right
 
 These are the usual ways a translation *breaks the app*, not just reads oddly.
@@ -58,7 +54,7 @@ These are the usual ways a translation *breaks the app*, not just reads oddly.
 | Copy `{placeholders}` verbatim — `{version}`, `{count}`, `{name}`… | Translate the word inside the braces (`{verbleibend}` breaks it) |
 | Reposition a placeholder so the sentence flows | Drop or duplicate a placeholder |
 | Preserve every `\n`, leading/trailing space, and trailing `...` | Trim "invisible" spaces or the `...` (they're load-bearing) |
-| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the description flags |
+| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the context flags |
 
 **Plurals:** the app has only a *one / other* split — the singular key fires only when `count == 1`; the `{count}` key covers everything else (0, 2, 5, 100…). Languages with more than two forms (ru, pl, uk) can't be fully correct here — use the form that fits the widest range (Russian genitive plural: `минут` / `часов` / `дней`). Don't invent extra keys or cram multiple forms into one string. When no single form fits every value — a unit label after a number field, say — reach for a number-agnostic form (an abbreviation, or wording that reads the same for 1 and 100) instead of forcing a plural the *one / other* split can't supply.
 
@@ -78,13 +74,15 @@ When a brand sits beside a common noun, keep its exact spelling but join them th
 
 > **Use the word that language's IT users actually say.** Translate when a natural, common term exists; keep the English term *only* when the literal translation would be awkward or no one in that field really uses it.
 
-Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing bundles:** match how a term was already rendered for your language rather than re-deciding it.
+Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing translation:** match how a term was already rendered for your language rather than re-deciding it.
 
 Two checks before you commit a term:
 
 - **Prefer established localized wording.** If a widely used tool in this space (for example WireGuard) ships your language, its wording for a shared term such as *handshake* is what users already expect — look at the translated app, not just English docs. For generic UI verbs and formal address, follow your OS vendor's style guide (Microsoft / Apple / Google).
 - **Watch for false friends.** A literal translation can collide with a *different* established term in your field — confirm your word doesn't already mean something else in this domain before using it.
 
+These tiers are mirrored in the Crowdin project glossary, so the editor highlights them inline. When you settle a new Tier C term for your language, add its translation to the glossary entry so it sticks for everyone who comes after you.
+
 ---
 
 ## Style
@@ -98,7 +96,7 @@ Two checks before you commit a term:
 
 Where it reads naturally, aim to keep each string **roughly the same length** as the English — the UI is tight and over-long strings can wrap or truncate. It's a soft preference, not a rule: if your language simply needs more words, use them.
 
-A few habits that keep a bundle reading like one product rather than a word-for-word port:
+A few habits that keep a translation reading like one product rather than a word-for-word port:
 
 - **Translate meaning, not words.** Render what a string *does*. An idiom or an awkward source phrase should become natural in your language, not a literal calque.
 - **Keep one voice within a family.** Sibling strings — the connection states, every settings *help* caption, every "… Failed" title — should share a grammatical form. If one member sounds wrong in that form, re-voice the whole family rather than leave one odd sibling.
@@ -107,27 +105,26 @@ A few habits that keep a bundle reading like one product rather than a word-for-
 
 ---
 
-## Procedure
+## Reviewing a language
 
-**New language** — read `en/common.json` *with* descriptions → settle your Tier C terms → write `i18n/locales/<code>/common.json` (same keys and order as `en`, `message` only, placeholders & brands preserved) → add a row to `_index.json` (`{"code","displayName"` = native name`,"englishName"}`) → run the QA list. Use the locale-code style the existing entries use (e.g. `fr`, `pt`, `zh-CN`).
+**On Crowdin:** proofread in the editor — context, glossary highlights, and QA flags sit inline next to each string.
 
-**Review (de / hu / …)** — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Fix in place, then report what you changed (especially term standardizations) so a native speaker can sanity-check.
+**In the repo** — e.g. driving an AI agent with *"Read `i18n/TRANSLATING.md` and review the existing German translation"* — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Report what you found, and apply the fixes **on Crowdin** — direct edits to the locale files are overwritten by the next sync.
 
 ---
 
 ## QA before you finish
 
-- [ ] Valid JSON · **every `en` key** present, same order · **no `description`** fields
 - [ ] Every `{placeholder}`, `\n`, and intentional space preserved · `...` / `… Failed` / `{name}` quotes kept
-- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing bundle for your language)
+- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing translation for your language)
 - [ ] Buttons & tray short · locale punctuation and capitalization applied
-- [ ] New language added to `_index.json`
+- [ ] Crowdin QA flags resolved (variables, glossary terms, punctuation)
 - [ ] **Tested in the running app** ↓
 
 ---
 
 ## Test it in the app
 
-A bundle can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
+A translation can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
 
 How to run the app and switch language: see the project README. Can't run it (e.g. a headless agent)? Say so in your summary — don't silently skip this step.

crowdin.yml

@@ -0,0 +1,11 @@
+skip_untranslated_strings: true
+skip_untranslated_files: true
+import_eq_suggestions: true
+
+files:
+  - source: /client/ui/i18n/locales/en/common.json
+    translation: /client/ui/i18n/locales/%two_letters_code%/common.json
+    type: chrome
+    languages_mapping:
+      two_letters_code:
+        zh-CN: zh-CN

e2e/agentnetwork/custom_pricing_test.go

@@ -23,10 +23,9 @@ import (
 // model the client asks for. The proxy prices off the REQUEST model, not the
 // upstream response model, so a made-up model id billed at operator rates lets
 // these tests assert exact costs without a real vendor key.
-// Sourced from the harness so the counts can't drift from the mock's config.
 const (
-	vllmPromptTokens     = harness.VLLMChatInputTokens
-	vllmCompletionTokens = harness.VLLMChatOutputTokens
+	vllmPromptTokens     = 11
+	vllmCompletionTokens = 2
 )
 
 // pricedEnv is a connected single-provider agent-network deployment pointed at

e2e/agentnetwork/gateway_protocol_test.go

@@ -1,455 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// Models each catalog surface is registered with in the matrix below. They
-// differ per provider so the router's choice is unambiguous: a request that
-// lands on the wrong provider record fails the surface assertion instead of
-// passing by coincidence.
-const (
-	matrixAnthropicModel = "claude-sonnet-5"
-	matrixBedrockModel   = "anthropic.claude-sonnet-5"
-	// matrixBedrockPathModel is what a Bedrock SDK client puts in the URL: a
-	// cross-region inference profile with a release date and version suffix.
-	// The proxy must normalise it back to matrixBedrockModel to route and price.
-	matrixBedrockPathModel = "us.anthropic.claude-sonnet-5-20250101-v1:0"
-	// matrixVertexModel differs from the Anthropic record's model on purpose:
-	// a shared id would leave two routes claiming it and make which one serves
-	// /v1/messages depend on declaration order.
-	matrixVertexModel   = "claude-haiku-4-5"
-	matrixVertexProject = "e2e-project"
-	matrixVertexRegion  = "us-east5"
-)
-
-// gatewayEnv is a connected client plus a set of provider records, all pointed
-// at one mock upstream, so several wire shapes can be driven over a single
-// tunnel.
-type gatewayEnv struct {
-	endpoint string
-	proxyIP  string
-	client   *harness.Client
-	proxy    *harness.Proxy
-	vllm     *harness.VLLM
-	// providerIDs maps the catalog id to the created provider record id.
-	providerIDs map[string]string
-}
-
-// provisionGatewayMatrix brings up one mock upstream and one provider record
-// per catalog surface, all authorised for the same group by a single policy.
-// Sharing one proxy and client keeps the wire-shape cases to one tunnel setup;
-// each case still creates its own session id so its access-log row is findable.
-func provisionGatewayMatrix(t *testing.T, ctx context.Context) gatewayEnv {
-	t.Helper()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-matrix"})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-gw-matrix-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	// The mock ignores auth, so a dummy credential satisfies each catalog
-	// entry's auth template. Vertex is the exception: its api_key is a GCP
-	// service-account keyfile the proxy mints an OAuth token from, and a dummy
-	// one cannot mint. That is deliberate — the Vertex case below asserts on
-	// routing, which happens before the token mint.
-	dummyKey := "sk-gw-e2e"
-	dummyKeyfile := "keyfile::" + "e2e-not-a-real-service-account-key"
-
-	specs := []struct {
-		name      string
-		catalogID string
-		apiKey    string
-		models    []api.AgentNetworkProviderModel
-	}{
-		{
-			name: "openai", catalogID: "openai_api", apiKey: dummyKey,
-			models: []api.AgentNetworkProviderModel{{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002}},
-		},
-		{
-			name: "anthropic", catalogID: "anthropic_api", apiKey: dummyKey,
-			models: []api.AgentNetworkProviderModel{{Id: matrixAnthropicModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
-		},
-		{
-			name: "bedrock", catalogID: "bedrock_api", apiKey: dummyKey,
-			models: []api.AgentNetworkProviderModel{{Id: matrixBedrockModel, InputPer1k: 0.003, OutputPer1k: 0.015}},
-		},
-		{
-			name: "vertex", catalogID: "vertex_ai_api", apiKey: dummyKeyfile,
-			models: []api.AgentNetworkProviderModel{{Id: matrixVertexModel, InputPer1k: 0.001, OutputPer1k: 0.005}},
-		},
-	}
-
-	providerIDs := make(map[string]string, len(specs))
-	ids := make([]string, 0, len(specs))
-	for _, spec := range specs {
-		key := spec.apiKey
-		models := spec.models
-		prov, perr := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-			Name:        "e2e-gw-" + spec.name,
-			ProviderId:  spec.catalogID,
-			UpstreamUrl: vllm.URL,
-			ApiKey:      &key,
-			Enabled:     ptr(true),
-			Models:      &models,
-		})
-		require.NoError(t, perr, "create %s provider", spec.name)
-		id := prov.Id
-		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
-		providerIDs[spec.catalogID] = id
-		ids = append(ids, id)
-	}
-
-	// Uncapped token limit: never blocks the handful of tokens driven here, but
-	// switches on usage metering so consumption and cost land in the row.
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-gw-matrix",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: ids,
-		Limits: &api.AgentNetworkPolicyLimits{
-			TokenLimit: api.AgentNetworkPolicyTokenLimit{
-				Enabled:       true,
-				GroupCap:      10_000_000,
-				UserCap:       10_000_000,
-				WindowSeconds: 60,
-			},
-		},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-matrix", sk.Key)
-	return gatewayEnv{
-		endpoint:    endpoint,
-		proxyIP:     proxyIP,
-		client:      cl,
-		proxy:       px,
-		vllm:        vllm,
-		providerIDs: providerIDs,
-	}
-}
-
-// connectClient starts a proxy and a tunnel client for the shared account and
-// waits until the client can reach the proxy peer, returning the endpoint and
-// the proxy's tunnel IP to pin requests to.
-func connectClient(t *testing.T, ctx context.Context, name, setupKey string) (string, string, *harness.Client, *harness.Proxy) {
-	t.Helper()
-
-	settings, err := srv.GetSettings(ctx)
-	require.NoError(t, err, "read settings")
-	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
-
-	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-"+name+"-proxy")
-	require.NoError(t, err, "mint proxy token")
-	px, err := harness.StartProxy(ctx, srv, proxyToken)
-	require.NoError(t, err, "start proxy")
-	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
-
-	cl, err := harness.StartClient(ctx, srv, setupKey)
-	require.NoError(t, err, "start client")
-	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
-
-	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// The probe resolves the endpoint and its first packet wakes the lazy proxy
-	// peer, so WaitProxyPeer then observes it connected.
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
-	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
-		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
-	}
-	return settings.Endpoint, proxyIP, cl, px
-}
-
-// callUntil retries an HTTP call through the tunnel until it returns one of the
-// wanted statuses or the deadline passes, absorbing the DNS and tunnel jitter
-// the first call through a fresh tunnel can hit. The last status and body are
-// returned either way so the caller can assert with real detail.
-func callUntil(t *testing.T, call func() (int, string, error), want ...int) (int, string) {
-	t.Helper()
-	wanted := make(map[int]struct{}, len(want))
-	for _, w := range want {
-		wanted[w] = struct{}{}
-	}
-
-	var code int
-	var body string
-	deadline := time.Now().Add(90 * time.Second)
-	for time.Now().Before(deadline) {
-		c, b, err := call()
-		if err == nil {
-			code, body = c, b
-			if _, ok := wanted[code]; ok {
-				return code, body
-			}
-		}
-		time.Sleep(5 * time.Second)
-	}
-	return code, body
-}
-
-// TestGatewayProtocolProviderMatrix drives one request per wire shape over a
-// single tunnel, with a provider record per catalog surface behind it. It is
-// the regression net for the routing and parser-selection changes: each case
-// asserts the surface the request was metered under and the token counts that
-// surface's own usage block carries, so a request parsed by the wrong provider's
-// parser meters zero and fails rather than passing on a coincidence.
-func TestGatewayProtocolProviderMatrix(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	env := provisionGatewayMatrix(t, ctx)
-	diag := func() string {
-		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
-			env.vllm.Logs(context.Background()), env.proxy.Logs(context.Background()))
-	}
-
-	t.Run("openai chat completions", func(t *testing.T) {
-		session := "e2e-gw-openai"
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, harness.VLLMModel, "ping", session)
-		}, 200)
-		require.Equal(t, 200, code, "openai chat must succeed; body: %s%s", body, diag())
-		require.Contains(t, body, "chat.completion", "body must be an OpenAI completion; got: %s", body)
-
-		row := findAccessLogBySession(t, ctx, session)
-		require.NotNil(t, row.Provider)
-		assert.Equal(t, "openai", *row.Provider, "the OpenAI chat path must meter under the openai surface")
-		assert.Equal(t, int64(harness.VLLMChatInputTokens), row.InputTokens, "OpenAI usage block must be read")
-		assert.Equal(t, int64(harness.VLLMChatOutputTokens), row.OutputTokens)
-	})
-
-	t.Run("anthropic messages", func(t *testing.T) {
-		session := "e2e-gw-anthropic"
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages, matrixAnthropicModel, "ping", session)
-		}, 200)
-		require.Equal(t, 200, code, "anthropic messages must succeed; body: %s%s", body, diag())
-
-		row := findAccessLogBySession(t, ctx, session)
-		require.NotNil(t, row.Provider)
-		assert.Equal(t, "anthropic", *row.Provider, "the /v1/messages path must meter under the anthropic surface")
-		// These counts only appear if the Anthropic parser read the response:
-		// its usage fields are named differently from the OpenAI block.
-		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens,
-			"Anthropic input_tokens must be read; zero here means the wrong parser ran")
-		assert.Equal(t, int64(harness.VLLMMessagesOutputTokens), row.OutputTokens)
-		assert.Positive(t, row.CachedInputTokens, "the Anthropic cache-read bucket must be recorded")
-		assert.Positive(t, row.CostUsd, "a metered request must carry a cost")
-		require.NotNil(t, row.ResolvedProviderId)
-		assert.Equal(t, env.providerIDs["anthropic_api"], *row.ResolvedProviderId,
-			"a vendor-tagged request must not cross to another provider's record")
-	})
-
-	t.Run("bedrock invoke normalises the path model", func(t *testing.T) {
-		session := "e2e-gw-bedrock"
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Bedrock(ctx, env.endpoint, env.proxyIP, matrixBedrockPathModel, "ping", session)
-		}, 200)
-		require.Equal(t, 200, code, "bedrock invoke must succeed; body: %s%s", body, diag())
-
-		row := findAccessLogBySession(t, ctx, session)
-		require.NotNil(t, row.Provider)
-		assert.Equal(t, "bedrock", *row.Provider, "a native Bedrock path must meter under the bedrock surface")
-		require.NotNil(t, row.Model)
-		assert.Equal(t, matrixBedrockModel, *row.Model,
-			"the inference-profile prefix, release date and version suffix must be normalised away")
-		assert.Equal(t, int64(harness.VLLMMessagesInputTokens), row.InputTokens)
-	})
-
-	t.Run("anthropic token counting", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, "/v1/messages/count_tokens",
-				fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":"ping"}]}`, matrixAnthropicModel),
-				[]string{"anthropic-version: 2023-06-01"})
-		}, 200)
-		assert.Equal(t, 200, code, "token counting must route rather than deny; body: %s%s", body, diag())
-	})
-
-	t.Run("bedrock token counting", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP,
-				"/model/"+matrixBedrockPathModel+"/count-tokens",
-				`{"input":{"converse":{"messages":[{"role":"user","content":[{"text":"ping"}]}]}}}`, nil)
-		}, 200)
-		assert.Equal(t, 200, code,
-			"the Bedrock count-tokens action must route; denying it pushes counting onto the billable inference path; body: %s%s",
-			body, diag())
-	})
-
-	t.Run("vertex token counting reaches its provider", func(t *testing.T) {
-		// The dummy service-account key cannot mint an OAuth token, so the
-		// request stops at the upstream credential. Both outcomes render as
-		// 403, so the deny code is what distinguishes them: upstream_auth_failed
-		// means the path resolved to the Vertex route and only the credential
-		// failed, while model_not_routable would mean the method segment was
-		// swallowed into the model id and no route ever claimed it.
-		path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s/count-tokens:rawPredict",
-			matrixVertexProject, matrixVertexRegion, matrixVertexModel)
-		_, body := callUntil(t, func() (int, string, error) {
-			return env.client.PostJSON(ctx, env.endpoint, env.proxyIP, path,
-				`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"ping"}]}`, nil)
-		}, 403)
-		assert.NotContains(t, body, "model_not_routable",
-			"the count-tokens method segment must not be parsed as part of the model id; body: %s%s", body, diag())
-		assert.Contains(t, body, "llm_policy.upstream_auth_failed",
-			"the request must reach the Vertex route and fail only at the credential; body: %s%s", body, diag())
-	})
-
-	t.Run("connection warming probe", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Get(ctx, env.endpoint, env.proxyIP, "/api/hello", nil)
-		}, 200)
-		assert.NotEqual(t, 403, code,
-			"the warm-up probe carries no model and must not be refused as unroutable; body: %s%s", body, diag())
-	})
-
-	t.Run("unknown model denies in the caller's error shape", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireMessages,
-				"claude-not-a-real-model-9", "ping", "e2e-gw-unknown")
-		}, 403)
-		require.Equal(t, 403, code, "a model no provider claims must still be refused; body: %s%s", body, diag())
-
-		// The NetBird fields stay where they were for existing consumers.
-		assert.Contains(t, body, "llm_policy.model_not_routable", "the deny code must be preserved")
-		// And the vendor's own envelope rides alongside, so the client can show
-		// the reason instead of an unexplained API error.
-		assert.Contains(t, body, `"type":"error"`, "an Anthropic caller must get the Anthropic error envelope")
-		assert.Contains(t, body, "permission_error", "403 must map to the vendor's permission error type")
-	})
-}
-
-// TestModelDiscoveryWithModelAllowlist covers gateway model discovery on an
-// account that restricts models, which is the configuration that broke: the
-// listing carries no model, and the per-model allowlist fails closed on an
-// undetermined one, so discovery denied for exactly the accounts using the
-// feature. It also asserts the allowlist still refuses a model outside it, so
-// the exemption cannot be read as a way around the gate.
-func TestModelDiscoveryWithModelAllowlist(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gw-discovery"})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-gw-discovery-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	// One provider enumerating a single model, while the upstream's own listing
-	// advertises two. The proxy must serve the shorter list.
-	dummyKey := "sk-discovery-e2e"
-	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "e2e-gw-discovery",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
-		Models: &[]api.AgentNetworkProviderModel{
-			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
-		},
-	})
-	require.NoError(t, err, "create provider")
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	// The model allowlist is what makes this a regression test: without a
-	// guardrail enabled, discovery was never gated in the first place.
-	var gr api.AgentNetworkGuardrailRequest
-	gr.Name = "e2e-gw-discovery-allowlist"
-	gr.Checks.ModelAllowlist.Enabled = true
-	gr.Checks.ModelAllowlist.Models = []string{harness.VLLMModel}
-	guard, err := srv.CreateGuardrail(ctx, gr)
-	require.NoError(t, err, "create guardrail")
-	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
-
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-gw-discovery",
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: []string{prov.Id},
-		GuardrailIds:           &[]string{guard.Id},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	endpoint, proxyIP, cl, px := connectClient(t, ctx, "gw-discovery", sk.Key)
-	diag := func() string {
-		return fmt.Sprintf("\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
-			vllm.Logs(context.Background()), px.Logs(context.Background()))
-	}
-
-	t.Run("listing is served and bounded by policy", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Get(ctx, endpoint, proxyIP, "/v1/models?limit=1000", nil)
-		}, 200)
-		require.Equal(t, 200, code,
-			"discovery must not be refused because the request carries no model; body: %s%s", body, diag())
-
-		assert.Contains(t, body, harness.VLLMModel, "the authorised model must reach the picker")
-		assert.NotContains(t, body, harness.VLLMUnlistedModel,
-			"a model the policy does not authorise must not be offered; body: %s", body)
-	})
-
-	t.Run("allowlist still refuses a model outside it", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
-				harness.VLLMUnlistedModel, "ping", "e2e-gw-discovery-blocked")
-		}, 403)
-		require.Equal(t, 403, code,
-			"exempting model-less endpoints must not exempt inference; body: %s%s", body, diag())
-		assert.True(t,
-			strings.Contains(body, "llm_policy.model_blocked") || strings.Contains(body, "llm_policy.model_not_routable"),
-			"the refusal must name a model policy code; body: %s", body)
-	})
-
-	t.Run("allowlisted model still routes", func(t *testing.T) {
-		code, body := callUntil(t, func() (int, string, error) {
-			return cl.Chat(ctx, endpoint, proxyIP, harness.WireChat,
-				harness.VLLMModel, "ping", "e2e-gw-discovery-allowed")
-		}, 200)
-		require.Equal(t, 200, code, "the allowlisted model must still be served; body: %s%s", body, diag())
-	})
-}

e2e/harness/client.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -295,29 +294,10 @@ func withSessionID(headers []string, sessionID string) []string {
 	return append(headers, "x-session-id: "+sessionID)
 }
 
-// Get issues a GET to the agent-network endpoint over the client's tunnel.
-// Model discovery and the connection-warming probe are read-only endpoints
-// that carry no body, so they can't go through the chat helpers.
-func (cl *Client) Get(ctx context.Context, endpoint, proxyIP, path string, extraHeaders []string) (int, string, error) {
-	return cl.do(ctx, http.MethodGet, endpoint, proxyIP, path, "", extraHeaders)
-}
-
-// PostJSON issues an arbitrary JSON POST over the client's tunnel, for wire
-// shapes the typed helpers don't cover (token counting, say).
-func (cl *Client) PostJSON(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
-	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
-}
-
-// post issues a JSON POST. Retained as the shorthand the chat helpers use.
-func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
-	return cl.do(ctx, http.MethodPost, endpoint, proxyIP, path, body, extraHeaders)
-}
-
-// do runs curl in a throwaway container sharing the client's network
+// post runs curl in a throwaway container sharing the client's network
 // namespace so the request traverses the WireGuard tunnel, pinning the endpoint
-// to the proxy IP. It returns the HTTP status and response body. An empty body
-// sends no payload, which is what a GET needs.
-func (cl *Client) do(ctx context.Context, method, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+// to the proxy IP. It returns the HTTP status and response body.
+func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
 	url := "https://" + endpoint + path
 	args := []string{
 		"run", "--rm",
@@ -326,15 +306,13 @@ func (cl *Client) do(ctx context.Context, method, endpoint, proxyIP, path, body
 		"-sk", "--connect-timeout", "5", "--max-time", "90",
 		"--resolve", endpoint + ":443:" + proxyIP,
 		"-o", "/dev/stderr", "-w", "%{http_code}",
-		"-X", method, url,
+		"-X", "POST", url,
 		"-H", "Content-Type: application/json",
 	}
 	for _, h := range extraHeaders {
 		args = append(args, "-H", h)
 	}
-	if body != "" {
-		args = append(args, "--data", body)
-	}
+	args = append(args, "--data", body)
 	cmd := exec.CommandContext(ctx, "docker", args...)
 	// -w writes the status code to stdout; -o /dev/stderr writes the body to
 	// stderr so we can capture both separately.

e2e/harness/vllm.go

@@ -22,42 +22,14 @@ const (
 	// matches a real small model commonly served by vLLM so the provider's
 	// enumerated model and the client's request line up.
 	VLLMModel = "Qwen/Qwen2.5-0.5B-Instruct"
-	// VLLMUnlistedModel is a second id the mock's model listing advertises but
-	// no test provider enumerates, so a filtered listing is observably shorter
-	// than the upstream's own.
-	VLLMUnlistedModel = "Qwen/Qwen2.5-7B-Instruct"
-)
-
-// Token counts the mock reports per wire shape. Tests assert on these rather
-// than on "> 0" so a response parsed with the wrong provider's parser (which
-// would read a different field, or none) fails loudly instead of passing on
-// a coincidental non-zero.
-const (
-	// VLLMChatInputTokens / VLLMChatOutputTokens ride the OpenAI usage block.
-	VLLMChatInputTokens  = 11
-	VLLMChatOutputTokens = 2
-	// VLLMMessagesInputTokens / VLLMMessagesOutputTokens ride the Anthropic
-	// usage block, whose field names the OpenAI parser cannot read.
-	VLLMMessagesInputTokens  = 17
-	VLLMMessagesOutputTokens = 3
 )
 
 // vllmNginxConf emulates a vLLM OpenAI-compatible server over plain HTTP (vLLM's
-// default: no TLS, port 8000), and additionally answers the wire shapes the
-// other catalog surfaces speak so one mock can stand in for every provider the
-// proxy routes to. Running actual vLLM in CI is infeasible (GPU + multi-GB model
+// default: no TLS, port 8000). It answers /v1/models with a one-model list and
+// any chat/completions path with a canned OpenAI-shaped chat completion carrying
+// a non-zero usage block, so the proxy's OpenAI parser records real token
+// consumption. Running actual vLLM in CI is infeasible (GPU + multi-GB model
 // download), so this stands in for the wire contract the proxy depends on.
-//
-// Each shape answers with its own vendor's usage block, so a response parsed
-// under the wrong surface meters zero rather than passing by accident:
-//
-//   - /v1/chat/completions (and any unmatched path): OpenAI chat completion.
-//   - /v1/messages: Anthropic Messages, snake_case usage plus a cache bucket.
-//   - /model/{id}/invoke: Bedrock InvokeModel, which carries the Anthropic body.
-//   - the token-counting endpoints: a count, with no usage block at all.
-//
-// The model listing advertises two models so a policy that authorises one
-// produces an observably shorter list than the upstream's own.
 const vllmNginxConf = `pid /tmp/nginx.pid;
 events {}
 http {
@@ -65,26 +37,7 @@ http {
     listen 8000;
     location = /v1/models {
       default_type application/json;
-      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"},{"id":"Qwen/Qwen2.5-7B-Instruct","object":"model","owned_by":"vllm"}]}';
-    }
-    location = /v1/messages {
-      default_type application/json;
-      return 200 '{"id":"msg_e2e","type":"message","role":"assistant","model":"claude-sonnet-5","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
-    }
-    location = /v1/messages/count_tokens {
-      default_type application/json;
-      return 200 '{"input_tokens":7}';
-    }
-    location ~ ^/model/.+/invoke$ {
-      default_type application/json;
-      return 200 '{"id":"msg_e2e_bedrock","type":"message","role":"assistant","content":[{"type":"text","text":"pong"}],"stop_reason":"end_turn","usage":{"input_tokens":17,"output_tokens":3,"cache_read_input_tokens":5}}';
-    }
-    location ~ ^/model/.+/count-tokens$ {
-      default_type application/json;
-      return 200 '{"inputTokens":9}';
-    }
-    location = /api/hello {
-      return 200;
+      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"}]}';
     }
     location / {
       default_type application/json;

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -296,8 +296,6 @@ var providers = []Provider{
 		// account to be on >= 30-day data retention or all requests
 		// 400.
 		Models: []Model{
-			{ID: "claude-opus-5", Label: "Claude Opus 5", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
 			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
@@ -357,8 +355,6 @@ var providers = []Provider{
 		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
 		// per-region Llama 3 entries; standalone 3.3 not yet listed.
 		Models: []Model{
-			{ID: "anthropic.claude-opus-5", Label: "Claude Opus 5 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-sonnet-5", Label: "Claude Sonnet 5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
@@ -410,8 +406,6 @@ var providers = []Provider{
 		// exists — the router denies unmeterable publishers rather than forward
 		// them uncounted.
 		Models: []Model{
-			{ID: "claude-opus-5", Label: "Claude Opus 5 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-sonnet-5", Label: "Claude Sonnet 5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
 			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
 			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
 			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},

management/internals/modules/agentnetwork/catalog/catalog_test.go

@@ -1,36 +0,0 @@
-package catalog
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestClaudeLineupSelectable pins the models Claude Code resolves to by
-// default. A model absent from the lineup can't be ticked on a provider
-// record, so llm_router denies it as not-routable and the operator has no
-// way to authorise the client's own default.
-func TestClaudeLineupSelectable(t *testing.T) {
-	for providerID, wanted := range map[string][]string{
-		"anthropic_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
-		"bedrock_api":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5", "anthropic.claude-haiku-4-5"},
-		"vertex_ai_api": {"claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"},
-	} {
-		provider, ok := Lookup(providerID)
-		require.True(t, ok, "catalog must define %s", providerID)
-
-		selectable := make(map[string]Model, len(provider.Models))
-		for _, m := range provider.Models {
-			selectable[m.ID] = m
-		}
-		for _, id := range wanted {
-			model, found := selectable[id]
-			require.True(t, found, "%s must offer %s", providerID, id)
-			assert.NotEmpty(t, model.Label, "%s/%s needs a label for the picker", providerID, id)
-			assert.Positive(t, model.InputPer1k, "%s/%s needs an input rate", providerID, id)
-			assert.Positive(t, model.OutputPer1k, "%s/%s needs an output rate", providerID, id)
-			assert.Positive(t, model.ContextWindow, "%s/%s needs a context window", providerID, id)
-		}
-	}
-}

management/internals/modules/agentnetwork/pricing/defaults.go

@@ -47,11 +47,17 @@ var supplementalDefaults = map[string]map[string]Entry{
 		"gpt-5-nano": {InputPer1k: 0.00005, OutputPer1k: 0.0004, CachedInputPer1k: 0.000005},
 	},
 	"anthropic": {
+		// claude-opus-5 is not yet in the catalog lineup but gateway /
+		// grandfathered traffic uses it; priced so it isn't skipped.
+		"claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
 		// "kimi-k3[1m]" is the 1M-context alias some Claude Code guides
 		// configure against Moonshot's Anthropic-compatible endpoint;
 		// priced identically to kimi-k3 so those requests aren't skipped.
 		"kimi-k3[1m]": {InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003},
 	},
+	"bedrock": {
+		"anthropic.claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
+	},
 }
 
 var (

management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml

@@ -82,11 +82,6 @@ anthropic:
     output_per_1k: 0.015
     cache_read_per_1k: 0.0003
     cache_creation_per_1k: 0.00375
-  claude-sonnet-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
   kimi-k3:
     input_per_1k: 0.003
     output_per_1k: 0.015
@@ -150,11 +145,6 @@ bedrock:
     output_per_1k: 0.015
     cache_read_per_1k: 0.0003
     cache_creation_per_1k: 0.00375
-  anthropic.claude-sonnet-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
   meta.llama3-3-70b-instruct:
     input_per_1k: 0.00072
     output_per_1k: 0.00072

management/internals/modules/agentnetwork/pricing/defaults_test.go

@@ -116,13 +116,11 @@ func TestDefaultTable_PinnedRates(t *testing.T) {
 	assert.InDelta(t, 0.010, fable.InputPer1k, 1e-9, "claude-fable-5 input")
 	assert.InDelta(t, 0.0125, fable.CacheCreationPer1k, 1e-9, "claude-fable-5 cache creation")
 
-	// Every id below must stay priced whichever source provides it: the
-	// catalog lineup for the current Claude 5 family, supplementalDefaults
-	// for the ids the dashboard deliberately doesn't offer.
+	// Supplementals present on their surfaces.
 	for surface, ids := range map[string][]string{
 		"openai":    {"gpt-5", "gpt-5-mini", "gpt-5-nano"},
-		"anthropic": {"claude-opus-5", "claude-sonnet-5", "kimi-k3[1m]", "kimi-k3"},
-		"bedrock":   {"anthropic.claude-opus-5", "anthropic.claude-sonnet-5"},
+		"anthropic": {"claude-opus-5", "kimi-k3[1m]", "kimi-k3"},
+		"bedrock":   {"anthropic.claude-opus-5"},
 	} {
 		for _, id := range ids {
 			_, ok := table[surface][id]

management/internals/modules/reverseproxy/activity/interface.go

@@ -0,0 +1,25 @@
+// Package activity records that a principal used a reverse proxy service, so
+// that activity accounting counts people and devices which reach services
+// through the proxy but never touch the dashboard or the management API.
+package activity
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// Manager records reverse proxy usage against the timestamps activity
+// accounting reads. Both methods are best effort from the caller's point of
+// view: a lost record is corrected by the next request, and no authorization
+// decision reads them back.
+type Manager interface {
+	// RecordUserLogin records a completed SSO sign-in to a proxied service.
+	// Service users have no interactive login and are ignored.
+	RecordUserLogin(ctx context.Context, accountID string, user *types.User) error
+	// RecordPeerSeen records that a peer reached a private service over the
+	// mesh, which is what lets its owner count as active. Peers activity
+	// accounting excludes, and peers already seen recently, are ignored.
+	RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error
+}

management/internals/modules/reverseproxy/activity/manager/manager.go

@@ -0,0 +1,66 @@
+package manager
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// peerSeenInterval is how stale a peer's LastSeen must be before reaching a
+// private service refreshes it. Positive tunnel validations are cached on the
+// proxy for five minutes, so without a floor a busy peer would rewrite its row
+// behind every request; an hour still sits well inside the window activity
+// accounting asks about.
+const peerSeenInterval = time.Hour
+
+type managerImpl struct {
+	store store.Store
+}
+
+// NewManager returns the activity manager backed by the management store.
+func NewManager(store store.Store) activity.Manager {
+	return &managerImpl{store: store}
+}
+
+// RecordUserLogin stamps the login the same way the dashboard and device login
+// paths do, so a person who only ever reaches proxied services still has a
+// login on record.
+func (m *managerImpl) RecordUserLogin(ctx context.Context, accountID string, user *types.User) error {
+	if user == nil || user.IsServiceUser {
+		return nil
+	}
+
+	return m.store.SaveUserLastLogin(ctx, accountID, user.Id, time.Now().UTC())
+}
+
+// RecordPeerSeen stamps LastSeen, the column a peer activates its owner
+// through. The peer the caller already holds answers the throttle without a
+// query, so a peer seen inside the interval costs nothing to skip; the same
+// cutoff goes to the store, which enforces it inside the UPDATE so concurrent
+// requests for one peer cannot each write off their own stale read.
+func (m *managerImpl) RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error {
+	if peer == nil || !countsTowardActivity(peer) {
+		return nil
+	}
+
+	staleBefore := time.Now().UTC().Add(-peerSeenInterval)
+	if peer.Status != nil && peer.Status.LastSeen.After(staleBefore) {
+		return nil
+	}
+
+	_, err := m.store.RefreshPeerLastSeen(ctx, accountID, peer.ID, staleBefore)
+
+	return err
+}
+
+// countsTowardActivity reports whether the peer represents a device a person
+// actually runs. Embedded proxy peers are infrastructure and browser (WASM)
+// clients are ephemeral sessions, so activity accounting ignores both and a
+// write for them could never count.
+func countsTowardActivity(peer *peer.Peer) bool {
+	return !peer.ProxyMeta.Embedded && peer.Meta.KernelVersion != "wasm"
+}

management/internals/modules/reverseproxy/activity/manager/manager_test.go

@@ -0,0 +1,149 @@
+package manager
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// recordingStore captures the two writes the activity manager makes. The
+// embedded interface satisfies the rest and panics if anything else is called,
+// which keeps the manager honest about its surface.
+type recordingStore struct {
+	store.Store
+	logins []loginWrite
+	seen   []seenWrite
+}
+
+type loginWrite struct {
+	accountID string
+	userID    string
+	at        time.Time
+}
+
+type seenWrite struct {
+	accountID   string
+	peerID      string
+	staleBefore time.Time
+}
+
+func (s *recordingStore) SaveUserLastLogin(_ context.Context, accountID, userID string, lastLogin time.Time) error {
+	s.logins = append(s.logins, loginWrite{accountID: accountID, userID: userID, at: lastLogin})
+	return nil
+}
+
+func (s *recordingStore) RefreshPeerLastSeen(_ context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	s.seen = append(s.seen, seenWrite{accountID: accountID, peerID: peerID, staleBefore: staleBefore})
+	return true, nil
+}
+
+func TestRecordUserLogin(t *testing.T) {
+	tests := []struct {
+		name        string
+		user        *types.User
+		expectWrite bool
+	}{
+		{
+			name:        "regular user is recorded",
+			user:        &types.User{Id: "user1", AccountID: "account1"},
+			expectWrite: true,
+		},
+		{
+			// Activity accounting never counts service users, so a row for one
+			// would be noise.
+			name:        "service user is ignored",
+			user:        &types.User{Id: "svc1", AccountID: "account1", IsServiceUser: true},
+			expectWrite: false,
+		},
+		{
+			name:        "missing user is ignored",
+			user:        nil,
+			expectWrite: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &recordingStore{}
+			require.NoError(t, NewManager(st).RecordUserLogin(context.Background(), "account1", tt.user))
+
+			if !tt.expectWrite {
+				assert.Empty(t, st.logins, "no login should have been recorded")
+				return
+			}
+
+			require.Len(t, st.logins, 1, "exactly one login should have been recorded")
+			assert.Equal(t, "account1", st.logins[0].accountID, "login must be recorded against the service account")
+			assert.Equal(t, tt.user.Id, st.logins[0].userID, "login must be recorded against the signing-in user")
+			assert.Equal(t, time.UTC, st.logins[0].at.Location(), "timestamps are written in UTC")
+			assert.WithinDuration(t, time.Now().UTC(), st.logins[0].at, time.Minute, "login should be stamped now")
+		})
+	}
+}
+
+func TestRecordPeerSeen(t *testing.T) {
+	tests := []struct {
+		name        string
+		peer        *peer.Peer
+		expectWrite bool
+	}{
+		{
+			name:        "peer seen long ago is recorded",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: true,
+		},
+		{
+			name:        "peer never seen is recorded",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{}},
+			expectWrite: true,
+		},
+		{
+			// The throttle. The caller already holds the peer, so skipping a
+			// recently seen one costs nothing.
+			name:        "peer seen inside the interval is skipped",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-10 * time.Minute)}},
+			expectWrite: false,
+		},
+		{
+			name:        "embedded proxy peer is skipped",
+			peer:        &peer.Peer{ID: "peer1", ProxyMeta: peer.ProxyMeta{Embedded: true}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: false,
+		},
+		{
+			name:        "browser client is skipped",
+			peer:        &peer.Peer{ID: "peer1", Meta: peer.PeerSystemMeta{KernelVersion: "wasm"}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: false,
+		},
+		{
+			name:        "missing peer is ignored",
+			peer:        nil,
+			expectWrite: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &recordingStore{}
+			require.NoError(t, NewManager(st).RecordPeerSeen(context.Background(), "account1", tt.peer))
+
+			if !tt.expectWrite {
+				assert.Empty(t, st.seen, "no activity should have been recorded")
+				return
+			}
+
+			require.Len(t, st.seen, 1, "exactly one activity write should have been recorded")
+			assert.Equal(t, "account1", st.seen[0].accountID, "activity must be recorded against the service account")
+			assert.Equal(t, tt.peer.ID, st.seen[0].peerID, "activity must be recorded against the calling peer")
+			assert.Equal(t, time.UTC, st.seen[0].staleBefore.Location(), "cutoffs are passed in UTC")
+			assert.WithinDuration(t, time.Now().UTC().Add(-peerSeenInterval), st.seen[0].staleBefore, time.Minute,
+				"the store must enforce the same interval the local check applies")
+		})
+	}
+}

management/internals/server/boot.go

@@ -27,6 +27,8 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
+	proxyactivity "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
+	proxyactivitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
@@ -231,6 +233,7 @@ func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.PKCEVerifierStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
+			proxyService.SetActivityManager(s.ProxyActivityManager())
 			proxyService.SetProxyController(s.ServiceProxyController())
 			proxyService.SetAgentNetworkSynthesizer(newAgentNetworkSynthesizer(s.Store()))
 			proxyService.SetAgentNetworkLimitsService(s.AgentNetworkManager())
@@ -290,6 +293,13 @@ func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
 	})
 }
 
+// ProxyActivityManager records reverse proxy usage for activity accounting.
+func (s *BaseServer) ProxyActivityManager() proxyactivity.Manager {
+	return Create(s, func() proxyactivity.Manager {
+		return proxyactivitymanager.NewManager(s.Store())
+	})
+}
+
 func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	return Create(s, func() accesslogs.Manager {
 		accessLogManager := accesslogsmanager.NewManager(s.Store(), s.PermissionsManager(), s.GeoLocationManager())

management/internals/shared/grpc/proxy.go

@@ -32,6 +32,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -128,6 +129,9 @@ type ProxyServiceServer struct {
 	// Manager for IdP-enriched user data (may be nil when no IdP is configured)
 	idpManager idp.Manager
 
+	// Manager that records reverse proxy usage for activity accounting
+	activityManager activity.Manager
+
 	// Store for one-time authentication tokens
 	tokenStore *OneTimeTokenStore
 
@@ -250,6 +254,13 @@ func (s *ProxyServiceServer) SetServiceManager(manager rpservice.Manager) {
 	s.serviceManager = manager
 }
 
+// SetActivityManager wires the manager that records reverse proxy usage.
+func (s *ProxyServiceServer) SetActivityManager(manager activity.Manager) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.activityManager = manager
+}
+
 // SetAgentNetworkSynthesizer wires the agent-network service synthesiser.
 // Optional — when nil the snapshot path skips agent-network synthesis. The
 // modules layer injects this after both the proxy server and the agent-network
@@ -1717,7 +1728,7 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 
 	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
 
-	return sessionkey.SignToken(
+	token, err := sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
 		user.Email,
@@ -1727,6 +1738,25 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 		groupNames,
 		proxyauth.DefaultSessionExpiry,
 	)
+	if err != nil {
+		return "", err
+	}
+
+	s.recordUserLogin(ctx, service.AccountID, user)
+
+	return token, nil
+}
+
+// recordUserLogin hands the sign-in to the activity manager. The RPC must not
+// fail on it, so the error is logged and dropped here rather than returned.
+func (s *ProxyServiceServer) recordUserLogin(ctx context.Context, accountID string, user *types.User) {
+	if s.activityManager == nil {
+		return
+	}
+
+	if err := s.activityManager.RecordUserLogin(ctx, accountID, user); err != nil {
+		log.WithContext(ctx).Debugf("record proxy login for user %s: %v", user.Id, err)
+	}
 }
 
 // ValidateUserGroupAccess checks if a user has access to a service.
@@ -2076,6 +2106,8 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 		return nil, err
 	}
 
+	s.recordPeerSeen(ctx, service.AccountID, peer)
+
 	log.WithFields(log.Fields{
 		"domain":       domain,
 		"tunnel_ip":    tunnelIPStr,
@@ -2093,6 +2125,18 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}, nil
 }
 
+// recordPeerSeen hands the mesh request to the activity manager. The RPC must
+// not fail on it, so the error is logged and dropped here rather than returned.
+func (s *ProxyServiceServer) recordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) {
+	if s.activityManager == nil {
+		return
+	}
+
+	if err := s.activityManager.RecordPeerSeen(ctx, accountID, peer); err != nil {
+		log.WithContext(ctx).Debugf("record proxy activity for peer %s: %v", peer.ID, err)
+	}
+}
+
 // resolvePeerOwner returns the user a peer is linked to, once per request so
 // the status gate and the identity resolution below share a single lookup.
 // Unlinked peers (machine agents) have no owner. A lookup that fails returns

management/internals/shared/grpc/proxy_group_access_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -155,6 +156,27 @@ type mockTunnelPeersManager struct {
 	groupsErr error
 }
 
+// mockActivityManager records what the RPC handed to the activity manager. The
+// policy (throttling, exclusions) is the manager's and is tested there; these
+// tests only pin which requests reach it.
+type mockActivityManager struct {
+	seenMarks []seenMark
+}
+
+type seenMark struct {
+	accountID string
+	peerID    string
+}
+
+func (m *mockActivityManager) RecordUserLogin(_ context.Context, _ string, _ *types.User) error {
+	return nil
+}
+
+func (m *mockActivityManager) RecordPeerSeen(_ context.Context, accountID string, peer *peer.Peer) error {
+	m.seenMarks = append(m.seenMarks, seenMark{accountID: accountID, peerID: peer.ID})
+	return nil
+}
+
 func (m *mockTunnelPeersManager) GetPeerByTunnelIP(_ context.Context, _ string, _ net.IP) (*peer.Peer, error) {
 	return m.peer, m.peerErr
 }
@@ -745,6 +767,78 @@ func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
 	}
 }
 
+// TestValidateTunnelPeerRecordsActivity pins that a granted mesh request is
+// handed to the activity manager. Which of those the manager then writes is its
+// own decision, covered by its tests.
+func TestValidateTunnelPeerRecordsActivity(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+		peerID    = "peer1"
+	)
+
+	activityManager := &mockActivityManager{}
+	server := &ProxyServiceServer{
+		activityManager: activityManager,
+		serviceManager: &mockReverseProxyManager{
+			proxiesByAccount: map[string][]*service.Service{
+				accountID: {{Domain: domain, AccountID: accountID}},
+			},
+		},
+		peersManager: &mockTunnelPeersManager{
+			peer: &peer.Peer{ID: peerID, Name: "agent", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+		},
+		usersManager: &mockUsersManager{users: map[string]*types.User{}},
+	}
+
+	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+		Domain:   domain,
+		TunnelIp: "100.64.0.1",
+	})
+
+	require.NoError(t, err)
+	require.True(t, resp.GetValid(), "peer should be granted access")
+
+	require.Len(t, activityManager.seenMarks, 1, "a granted peer should reach the activity manager once")
+	assert.Equal(t, accountID, activityManager.seenMarks[0].accountID, "activity must be attributed to the service account")
+	assert.Equal(t, peerID, activityManager.seenMarks[0].peerID, "activity must be attributed to the calling peer")
+}
+
+// TestValidateTunnelPeerDeniedRecordsNoActivity keeps the write on the granted
+// path only: a refused peer is not evidence its owner was active.
+func TestValidateTunnelPeerDeniedRecordsNoActivity(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+	)
+
+	activityManager := &mockActivityManager{}
+	server := &ProxyServiceServer{
+		activityManager: activityManager,
+		serviceManager: &mockReverseProxyManager{
+			proxiesByAccount: map[string][]*service.Service{
+				accountID: {{Domain: domain, AccountID: accountID}},
+			},
+		},
+		peersManager: &mockTunnelPeersManager{
+			peer: &peer.Peer{ID: "peer1", Name: "agent", UserID: "user1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+		},
+		// The owner is blocked, so the tunnel gate denies before the mint.
+		usersManager: &mockUsersManager{users: map[string]*types.User{
+			"user1": {Id: "user1", AccountID: accountID, Blocked: true},
+		}},
+	}
+
+	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+		Domain:   domain,
+		TunnelIp: "100.64.0.1",
+	})
+
+	require.NoError(t, err)
+	require.False(t, resp.GetValid(), "blocked owner should be denied")
+	assert.Empty(t, activityManager.seenMarks, "a denied peer must not be marked seen")
+}
+
 func TestGetAccountProxyByDomain(t *testing.T) {
 	tests := []struct {
 		name             string

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	activitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
@@ -221,6 +222,7 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	)
 
 	proxyService.SetServiceManager(&testServiceManager{store: testStore})
+	proxyService.SetActivityManager(activitymanager.NewManager(testStore))
 
 	handler := NewAuthCallbackHandler(proxyService, nil)
 
@@ -538,6 +540,55 @@ func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
 // TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account
 // is pending approval or blocked never receives a session token from the OIDC
 // callback, and that the redirect carries a description the proxy can render.
+// TestAuthCallback_RecordsUserLogin drives the real OIDC callback and asserts
+// the login lands on the user row. That timestamp is what activity accounting
+// reads, and it is the only signal that can ever count someone who reaches
+// proxy-protected services from a browser and never opens the dashboard.
+func TestAuthCallback_RecordsUserLogin(t *testing.T) {
+	setup := setupAuthCallbackTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+
+	before, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+	require.NoError(t, err)
+	require.Nil(t, before.LastLogin, "fixture user starts with no login on record")
+
+	setup.oidcServer.tokenSubject = "allowedUserId"
+	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+
+	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+	rec := httptest.NewRecorder()
+	setup.router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusFound, rec.Code)
+
+	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+	require.NoError(t, err)
+	require.NotNil(t, after.LastLogin, "a completed proxy SSO login must be recorded on the user")
+	require.WithinDuration(t, time.Now().UTC(), after.LastLogin.UTC(), time.Minute, "login should be stamped at sign-in time")
+}
+
+// TestAuthCallback_DeniedUserLoginNotRecorded keeps the write on the granted
+// path: a refused sign-in is not a login.
+func TestAuthCallback_DeniedUserLoginNotRecorded(t *testing.T) {
+	setup := setupAuthCallbackTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+
+	setup.oidcServer.tokenSubject = "blockedUserId"
+	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+
+	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+	rec := httptest.NewRecorder()
+	setup.router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusFound, rec.Code)
+
+	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "blockedUserId")
+	require.NoError(t, err)
+	require.Nil(t, after.LastLogin, "a denied user must not be recorded as having logged in")
+}
+
 func TestAuthCallback_UserDeniedByAccountStatus(t *testing.T) {
 	tests := []struct {
 		name            string

management/server/store/sql_store.go

@@ -599,6 +599,34 @@ func (s *SqlStore) ApproveAccountPeers(ctx context.Context, accountID string) (i
 	return int(result.RowsAffected), nil
 }
 
+// RefreshPeerLastSeen updates only peer_status_last_seen. Every other status
+// column is left untouched: peer_status_connected and
+// peer_status_session_started_at belong to the sync stream that owns the
+// session, and a blind write here would corrupt the fencing
+// MarkPeerConnectedIfNewerSession relies on.
+//
+// LastSeen comes from the database clock for the same reason it does there: a
+// Go-side timestamp is taken before the write and can land after a connect that
+// used CURRENT_TIMESTAMP, dragging the column backwards.
+//
+// staleBefore carries the caller's throttle into the same statement, so
+// concurrent requests for one peer collapse into a single write instead of
+// each racing on its own stale read. The column is nullable — Status is an
+// embedded pointer, so a peer stored without one leaves it NULL — and NULL
+// loses every comparison, hence the explicit branch for a peer never seen.
+func (s *SqlStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	result := s.db.WithContext(ctx).
+		Model(&nbpeer.Peer{}).
+		Where(accountAndIDQueryCondition, accountID, peerID).
+		Where("(peer_status_last_seen IS NULL OR peer_status_last_seen < ?)", staleBefore).
+		Update("peer_status_last_seen", gorm.Expr("CURRENT_TIMESTAMP"))
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "refresh peer last seen: %v", result.Error)
+	}
+
+	return result.RowsAffected > 0, nil
+}
+
 // SaveUsers saves the given list of users to the database.
 func (s *SqlStore) SaveUsers(ctx context.Context, users []*types.User) error {
 	if len(users) == 0 {

management/server/store/sql_store_activity_test.go

@@ -0,0 +1,122 @@
+package store
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const activityAccountID = "activityAccountId"
+
+func newActivityTestStore(t *testing.T) Store {
+	t.Helper()
+
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	require.NoError(t, store.SaveAccount(context.Background(), &types.Account{
+		Id:        activityAccountID,
+		Domain:    "activity.example.com",
+		CreatedAt: time.Now().UTC(),
+	}))
+
+	return store
+}
+
+func TestRefreshPeerLastSeen(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := time.Now().UTC().Add(-3 * time.Hour)
+	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.True(t, refreshed, "a peer seen three hours ago is stale enough to refresh")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
+	assert.True(t, peer.Status.LastSeen.After(stored), "last seen must move forward")
+}
+
+// TestRefreshPeerLastSeenHonoursCutoff covers the throttle the caller relies on:
+// two concurrent requests both read the same stale peer, but only the statement
+// that still finds LastSeen behind the cutoff writes.
+func TestRefreshPeerLastSeenHonoursCutoff(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := time.Now().UTC().Add(-10 * time.Minute)
+	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.False(t, refreshed, "a peer seen inside the interval must not be written")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, stored, peer.Status.LastSeen.UTC(), time.Second, "last seen must be left where it was")
+}
+
+// TestRefreshPeerLastSeenRecordsNeverSeenPeer covers the nullable column. Status
+// is an embedded pointer, so a peer stored without one leaves last seen NULL,
+// and NULL loses the cutoff comparison — such a peer would never record its
+// first activity.
+func TestRefreshPeerLastSeenRecordsNeverSeenPeer(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := activityPeer(time.Time{})
+	stored.Status = nil
+	require.NoError(t, store.AddPeerToAccount(ctx, stored))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.True(t, refreshed, "a peer that was never seen must record its first activity")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
+}
+
+// TestRefreshPeerLastSeenLeavesSessionStateAlone pins the column boundary: the
+// connected flag and the session token belong to the sync stream that owns the
+// peer's session, and a blind write here would corrupt its fencing. This is why
+// SavePeerStatus is not reused for an activity bump.
+func TestRefreshPeerLastSeenLeavesSessionStateAlone(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+
+	stored := activityPeer(time.Date(2026, 3, 1, 9, 0, 0, 0, time.UTC))
+	stored.Status.Connected = true
+	stored.Status.SessionStartedAt = 1234567890
+	require.NoError(t, store.AddPeerToAccount(ctx, stored))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	require.True(t, refreshed, "the peer is stale enough to refresh")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should move forward")
+	assert.True(t, peer.Status.Connected, "connected flag must survive an activity write")
+	assert.Equal(t, int64(1234567890), peer.Status.SessionStartedAt, "session token must survive an activity write")
+}
+
+func activityPeer(lastSeen time.Time) *nbpeer.Peer {
+	return &nbpeer.Peer{
+		ID:        "activityPeer",
+		AccountID: activityAccountID,
+		Key:       "activityPeerKey",
+		IP:        netip.MustParseAddr("100.64.0.9"),
+		Name:      "activity-peer",
+		DNSLabel:  "activity-peer",
+		Status:    &nbpeer.PeerStatus{LastSeen: lastSeen},
+	}
+}

management/server/store/store.go

@@ -180,6 +180,14 @@ type Store interface {
 	// Returns true when the update happened, false when this stream lost
 	// the race against a newer session.
 	MarkPeerConnectedIfNewerSession(ctx context.Context, accountID, peerID string, newSessionStartedAt int64) (bool, error)
+	// RefreshPeerLastSeen records that a peer was just seen, stamping the
+	// database clock like the other status writers. Connected and
+	// SessionStartedAt are left alone, so this never interferes with the
+	// session-ownership protocol MarkPeerConnectedIfNewerSession implements.
+	// The write only lands when the stored LastSeen is older than
+	// staleBefore, which keeps a caller's throttle atomic under concurrent
+	// requests for the same peer. Returns true when the update happened.
+	RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error)
 	// MarkPeerDisconnectedIfSameSession sets the peer to disconnected and
 	// resets SessionStartedAt to zero, but only when the stored
 	// SessionStartedAt equals the given sessionStartedAt. LastSeen is

management/server/store/store_mock.go

@@ -3261,6 +3261,21 @@ func (mr *MockStoreMockRecorder) MarkProxyAccessTokenUsed(ctx, tokenID interface
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkProxyAccessTokenUsed", reflect.TypeOf((*MockStore)(nil).MarkProxyAccessTokenUsed), ctx, tokenID)
 }
 
+// RefreshPeerLastSeen mocks base method.
+func (m *MockStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RefreshPeerLastSeen", ctx, accountID, peerID, staleBefore)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RefreshPeerLastSeen indicates an expected call of RefreshPeerLastSeen.
+func (mr *MockStoreMockRecorder) RefreshPeerLastSeen(ctx, accountID, peerID, staleBefore interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RefreshPeerLastSeen", reflect.TypeOf((*MockStore)(nil).RefreshPeerLastSeen), ctx, accountID, peerID, staleBefore)
+}
+
 // RemovePeerFromAllGroups mocks base method.
 func (m *MockStore) RemovePeerFromAllGroups(ctx context.Context, peerID string) error {
 	m.ctrl.T.Helper()

proxy/internal/llm/model.go

@@ -13,14 +13,6 @@ func NormalizeBedrockModel(modelID string) string {
 	return sharedllm.NormalizeBedrockModel(modelID)
 }
 
-// NormalizeAnthropicModel strips the trailing "-YYYYMMDD" release-date suffix
-// from an Anthropic model id so a dated id a client pins matches the undated
-// one the operator registered. Thin delegate to shared/llm for the same
-// contract reason as the two below.
-func NormalizeAnthropicModel(modelID string) string {
-	return sharedllm.NormalizeAnthropicModel(modelID)
-}
-
 // NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
 // so it matches the catalog/pricing key. Thin delegate to shared/llm, kept
 // beside NormalizeBedrockModel for the same contract reason.

proxy/internal/llm/pricing/pricing.go

@@ -10,8 +10,6 @@ package pricing
 import (
 	"fmt"
 	"math"
-
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
 )
 
 // Entry is a single model's input and output pricing, expressed in USD per
@@ -94,10 +92,7 @@ func NewTable(raw map[string]map[string]EntryJSON) (*Table, error) {
 	return &Table{entries: entries}, nil
 }
 
-// Lookup returns the entry for the given provider surface and model. A
-// dated Anthropic id falls back to its undated form, so a client pinning
-// "claude-sonnet-4-5-20250929" bills at the registered "claude-sonnet-4-5"
-// rate instead of recording no cost at all.
+// Lookup returns the entry for the given provider surface and model.
 func (t *Table) Lookup(provider, model string) (Entry, bool) {
 	if t == nil {
 		return Entry{}, false
@@ -106,14 +101,7 @@ func (t *Table) Lookup(provider, model string) (Entry, bool) {
 	if !ok {
 		return Entry{}, false
 	}
-	if e, found := byModel[model]; found {
-		return e, true
-	}
-	undated := sharedllm.NormalizeAnthropicModel(model)
-	if undated == model {
-		return Entry{}, false
-	}
-	e, ok := byModel[undated]
+	e, ok := byModel[model]
 	return e, ok
 }
 

proxy/internal/llm/pricing/pricing_test.go

@@ -175,22 +175,3 @@ func TestNewTable_NilAndEmpty(t *testing.T) {
 	require.NoError(t, err)
 	assert.Empty(t, entries, "nil in, empty (never-matching) map out for the per-record map")
 }
-
-// TestLookup_DatedAnthropicIDFallsBackToUndated covers a client pinning a
-// release date on a model priced under its undated id. Without the
-// fallback the request records no cost at all.
-func TestLookup_DatedAnthropicIDFallsBackToUndated(t *testing.T) {
-	table, err := NewTable(map[string]map[string]EntryJSON{
-		"anthropic": {
-			"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015},
-		},
-	})
-	require.NoError(t, err, "table must build from a valid defaults map")
-
-	entry, ok := table.Lookup("anthropic", "claude-sonnet-4-5-20250929")
-	require.True(t, ok, "a dated id must resolve to the undated entry")
-	assert.InDelta(t, 0.003, entry.InputPer1K, 1e-9, "dated id must bill at the registered rate")
-
-	_, ok = table.Lookup("anthropic", "claude-sonnet-9-9-20250929")
-	assert.False(t, ok, "an unknown family must stay unpriced")
-}

proxy/internal/middleware/builtin/cost_meter/middleware.go

@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/netbirdio/netbird/proxy/internal/llm"
 	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
@@ -176,28 +175,13 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 // Anthropic route still bills its cache buckets additively.
 func (m *Middleware) lookupCosts(md []middleware.KV, surface, model string, inTokens, outTokens, cachedTokens, cacheCreationTokens int64) (pricing.Costs, bool) {
 	if recordID := lookupKV(md, middleware.KeyLLMResolvedProviderID); recordID != "" {
-		if entry, ok := perRecordEntry(m.perRecord[recordID], model); ok {
+		if entry, ok := m.perRecord[recordID][model]; ok {
 			return pricing.EntryCosts(entry, surface, inTokens, outTokens, cachedTokens, cacheCreationTokens), true
 		}
 	}
 	return m.defaults.Costs(surface, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 }
 
-// perRecordEntry resolves the operator's stored price for a model on one
-// provider record, falling back to the undated form of a dated Anthropic id
-// so a client that pins a release date still bills at the registered rate.
-func perRecordEntry(byModel map[string]pricing.Entry, model string) (pricing.Entry, bool) {
-	if entry, ok := byModel[model]; ok {
-		return entry, true
-	}
-	undated := llm.NormalizeAnthropicModel(model)
-	if undated == model {
-		return pricing.Entry{}, false
-	}
-	entry, ok := byModel[undated]
-	return entry, ok
-}
-
 // usd renders a cost as the fixed-precision string every cost.usd_* key
 // carries, so the per-bucket values and the aggregates round identically.
 //

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -84,10 +84,8 @@ func (m *Middleware) MutationsSupported() bool { return false }
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	model, modelPresent := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 	providerID, _ := lookupMetadata(in.Metadata, middleware.KeyLLMResolvedProviderID)
-	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	nonInference, _ := lookupMetadata(in.Metadata, middleware.KeyLLMNonInference)
 
-	if denial := m.evaluateAllowlist(providerID, surface, model, modelPresent, nonInference == "true"); denial != nil {
+	if denial := m.evaluateAllowlist(providerID, model, modelPresent); denial != nil {
 		return denial, nil
 	}
 
@@ -116,7 +114,7 @@ func (m *Middleware) Close() error { return nil }
 // evaluateAllowlist denies when the resolved provider's allowlist rejects the
 // model; nil means proceed. Scoped to the provider llm_router resolved, so an
 // unrestricted provider (absent from config) is never caught by another's list.
-func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelPresent, nonInference bool) *middleware.Output {
+func (m *Middleware) evaluateAllowlist(providerID, model string, modelPresent bool) *middleware.Output {
 	if len(m.cfg.ProviderAllowlists) == 0 {
 		return nil
 	}
@@ -124,7 +122,7 @@ func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelP
 	// if this request targets a restricted provider — fail closed. llm_router
 	// normally stamps the provider first, so this is a defensive guard.
 	if providerID == "" {
-		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	allowlist, restricted := m.cfg.ProviderAllowlists[providerID]
 	if !restricted {
@@ -135,29 +133,18 @@ func (m *Middleware) evaluateAllowlist(providerID, surface, model string, modelP
 	// Fail closed: with an allowlist in effect for this provider, a request whose
 	// model the parser couldn't extract (absent/empty) is denied. This enforces
 	// the allowlist for path-routed providers (Bedrock, Vertex) with no body model.
-	//
-	// The exception is a non-inference endpoint the router already authorised.
-	// The model listing and the connection-warming probe name no model
-	// anywhere — not in a body, not in the path — so failing closed here
-	// rejected model discovery for exactly the accounts that configured an
-	// allowlist, which is the outage this endpoint is meant to avoid. The
-	// per-model lookup does name one (the router stamps it from the path), so
-	// it still falls through to the allowlist check below.
 	if !modelPresent || normaliseModel(model) == "" {
-		if nonInference {
-			return nil
-		}
-		return denyModel(surface, "", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
+		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	if modelInAllowlist(allowlist, model) {
 		return nil
 	}
-	return denyModel(surface, model, denyCodeModel, denyMessageModel, denyReasonModel)
+	return denyModel(model, denyCodeModel, denyMessageModel, denyReasonModel)
 }
 
 // denyModel builds a 403 deny Output for a model-allowlist rejection. model is
 // included in the details only when non-empty.
-func denyModel(surface, model, code, message, reason string) *middleware.Output {
+func denyModel(model, code, message, reason string) *middleware.Output {
 	details := map[string]string{}
 	if model != "" {
 		details["model"] = model
@@ -169,7 +156,6 @@ func denyModel(surface, model, code, message, reason string) *middleware.Output
 			Code:    code,
 			Message: message,
 			Details: details,
-			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -343,52 +343,3 @@ func TestFactoryNormalisesAllowlist(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out2.Decision, "trimmed entry must still match")
 }
-
-// TestAllowlistSkipsNonInferenceWithoutModel covers the reported regression:
-// GET /v1/models carries no model anywhere, so the fail-closed rule above
-// denied model discovery for exactly the accounts that configured a provider
-// allowlist — the clients that read a 403 here render an empty model picker.
-// The router authorises those endpoints by path before the guardrail sees
-// them, so an absent model there is expected rather than undeterminable.
-func TestAllowlistSkipsNonInferenceWithoutModel(t *testing.T) {
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-		middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
-	))
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision,
-		"model discovery must not be refused because it names no model")
-}
-
-// TestAllowlistStillAppliesToNonInferenceWithModel pins that the exemption is
-// scoped to requests that genuinely name nothing. The per-model lookup
-// (GET /v1/models/{id}) is non-inference too, but the router stamps the model
-// from its path, so the allowlist must still decide it — otherwise the
-// exemption becomes a way to confirm a model the policy blocks.
-func TestAllowlistStillAppliesToNonInferenceWithModel(t *testing.T) {
-	mw := New(providerCfg("gpt-4o"))
-
-	t.Run("model in the allowlist", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
-			middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-		))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"an allowlisted model must stay reachable")
-	})
-
-	t.Run("model outside the allowlist", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-			middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"},
-			middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-5"},
-		))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionDeny, out.Decision,
-			"non-inference must not become a way past the allowlist")
-		require.NotNil(t, out.DenyReason)
-		assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code,
-			"a named but blocked model is blocked, not unknown")
-	})
-}

proxy/internal/middleware/builtin/llm_identity_inject/middleware.go

@@ -217,32 +217,6 @@ func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mut
 	return mutations
 }
 
-// bodyInjectableSurfaces are the request-body dialects that accept the
-// OpenAI-standard identity fields this middleware writes. A surface
-// outside this set gets header-only stamping: "user" and "metadata.tags"
-// are not part of the Anthropic Messages schema, which rejects unknown
-// top-level fields and permits only "user_id" under metadata, so writing
-// them into an Anthropic-shaped body turns a working request into a 400.
-// Claude Code speaks that shape through gateway records pinned to the
-// OpenAI parser, so the check keys on the detected surface rather than
-// on the provider record.
-var bodyInjectableSurfaces = map[string]struct{}{
-	"openai": {},
-	// An empty surface means no parser claimed the path (a custom gateway
-	// base). Those upstreams are OpenAI-compatible by convention, so keep
-	// the long-standing behaviour rather than silently dropping identity.
-	"": {},
-}
-
-// bodyAcceptsOpenAIIdentity reports whether the request body may carry the
-// OpenAI-standard identity fields, read from the surface llm_request_parser
-// resolved from the request path.
-func bodyAcceptsOpenAIIdentity(in *middleware.Input) bool {
-	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	_, ok := bodyInjectableSurfaces[surface]
-	return ok
-}
-
 // injectIntoBody parses the request body and writes the supplied
 // identity dimensions into it. Tags land at metadata.tags (creating
 // the metadata object when absent); the user identity lands at the
@@ -251,8 +225,6 @@ func bodyAcceptsOpenAIIdentity(in *middleware.Input) bool {
 // was written. Returns ok=false (no mutation) when:
 //
 //   - both inputs are empty (nothing to write);
-//   - the body speaks a dialect without these fields (see
-//     bodyInjectableSurfaces);
 //   - the body is empty or truncated (we don't have the full document
 //     to safely round-trip);
 //   - the body isn't a JSON object (skip silently — this middleware
@@ -273,9 +245,6 @@ func injectIntoBody(in *middleware.Input, tags []string, userID string) ([]byte,
 	if in == nil || len(in.Body) == 0 || in.BodyTruncated {
 		return nil, false
 	}
-	if !bodyAcceptsOpenAIIdentity(in) {
-		return nil, false
-	}
 	var doc map[string]any
 	if err := json.Unmarshal(in.Body, &doc); err != nil {
 		return nil, false

proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go

@@ -704,57 +704,3 @@ func TestInject_ExtraHeaders_EmptyValueSkipped(t *testing.T) {
 			"empty extra value must not be stamped")
 	}
 }
-
-// TestInject_AnthropicBodyIsNotRewritten pins the shape gate. Claude Code
-// reaches a LiteLLM record on /v1/messages, where "user" is not a
-// permitted top-level field and metadata accepts only "user_id", so
-// writing the OpenAI-standard fields would turn a working request into a
-// 400 naming a field the client never sent. Header stamping still runs, so
-// spend tracking and per-end-user budgets keep working.
-func TestInject_AnthropicBodyIsNotRewritten(t *testing.T) {
-	rule := liteLLMRuleWithBody()
-	rule.HeaderPair.EndUserIDInBody = true
-	mw := New(Config{Providers: []ProviderInjection{rule}})
-
-	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
-	in.UserEmail = "alice@example.com"
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-	in.Body = []byte(`{"model":"claude-sonnet-5","messages":[]}`)
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	assert.Empty(t, out.Mutations.BodyReplace,
-		"an Anthropic-shaped body must reach the upstream unmodified")
-
-	var endUser string
-	for _, kv := range out.Mutations.HeadersAdd {
-		if kv.Key == "x-litellm-end-user-id" {
-			endUser = kv.Value
-		}
-	}
-	assert.Equal(t, "alice@example.com", endUser,
-		"header stamping must still carry identity when body inject is skipped")
-}
-
-// TestInject_OpenAIBodyStillRewritten guards the gate against
-// over-reaching: the OpenAI surface must keep its body-level identity,
-// which is the only path LiteLLM's tag-budget check reads.
-func TestInject_OpenAIBodyStillRewritten(t *testing.T) {
-	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
-
-	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "openai"})
-	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	require.NotEmpty(t, out.Mutations.BodyReplace, "the OpenAI surface still gets body tags")
-
-	var doc map[string]any
-	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
-	meta, ok := doc["metadata"].(map[string]any)
-	require.True(t, ok, "metadata must be an object")
-	assert.NotEmpty(t, meta["tags"], "metadata.tags must still be written")
-}

proxy/internal/middleware/builtin/llm_limit_check/middleware.go

@@ -84,15 +84,6 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 		return allowNoAttribution(), nil
 	}
 
-	// Model-listing and other non-inference endpoints carry no model, and
-	// management's per-model allowlist fails closed on an empty one. The
-	// router has already authorised the route against the caller's groups
-	// and the request consumes no tokens, so gating it on a model that
-	// cannot exist would only break gateway model discovery.
-	if lookupKV(in.Metadata, middleware.KeyLLMNonInference) == "true" {
-		return allowNoAttribution(), nil
-	}
-
 	providerID := lookupKV(in.Metadata, middleware.KeyLLMResolvedProviderID)
 	if providerID == "" {
 		// llm_router didn't emit a resolved provider id — usually
@@ -126,7 +117,7 @@ func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middlew
 	}
 
 	if resp.GetDecision() == "deny" {
-		return denyFromManagement(resp, lookupKV(in.Metadata, middleware.KeyLLMProvider)), nil
+		return denyFromManagement(resp), nil
 	}
 	return allowFromManagement(resp), nil
 }
@@ -170,7 +161,7 @@ func allowFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.O
 // envelope. The deny code surfaces verbatim through the framework's
 // fixed JSON template; arbitrary middleware bytes can't reach the
 // wire.
-func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse, surface string) *middleware.Output {
+func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Output {
 	code := resp.GetDenyCode()
 	if code == "" {
 		code = "llm_policy.cap_exceeded"
@@ -185,7 +176,6 @@ func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse, surface string
 		DenyReason: &middleware.DenyReason{
 			Code:    code,
 			Message: denyMessageForCode(code),
-			Surface: surface,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},

proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go

@@ -224,35 +224,3 @@ func TestMetadataKeys_Allowlist(t *testing.T) {
 	}
 	assert.ElementsMatch(t, want, keys)
 }
-
-// TestInvoke_NonInferenceSkipsPreflight covers gateway model discovery:
-// GET /v1/models carries no model, and management's per-model allowlist
-// fails closed on an empty one, so a pre-flight would deny discovery for
-// exactly the accounts that use the model allowlist. The router marks the
-// request non-inference after authorising the route, and the gate must
-// then allow without calling management at all.
-func TestInvoke_NonInferenceSkipsPreflight(t *testing.T) {
-	mgmt := &fakeMgmt{
-		checkResp: &proto.CheckLLMPolicyLimitsResponse{
-			Decision: "deny",
-			DenyCode: "llm_policy.model_blocked",
-		},
-	}
-	m := New(mgmt, nil)
-
-	out := runInvoke(t, m, &middleware.Input{
-		AccountID:  "acc-1",
-		UserID:     "user-bob",
-		UserGroups: []string{"grp-engineers"},
-		Metadata: []middleware.KV{
-			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
-			{Key: middleware.KeyLLMNonInference, Value: "true"},
-		},
-	})
-
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model-less endpoints must not be gated on a model")
-	assert.Nil(t, mgmt.checkReq, "no pre-flight may be sent for a non-inference request")
-
-	assert.Empty(t, lookupKV(out.Metadata, middleware.KeyLLMSelectedPolicyID),
-		"no policy is attributed when nothing was metered")
-}

proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go

@@ -1,13 +1,9 @@
 package llm_request_parser
 
 import (
-	"context"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
 func TestParseBedrockPath(t *testing.T) {
@@ -40,25 +36,3 @@ func TestParseBedrockPath(t *testing.T) {
 		}
 	}
 }
-
-// TestInvoke_BedrockCountTokens covers the dedicated token-counting
-// endpoint. Denying it does not break the client, it just pushes context
-// counting back onto the inference endpoint, which is billable.
-func TestInvoke_BedrockCountTokens(t *testing.T) {
-	mw := newMiddleware(t)
-
-	out, err := mw.Invoke(context.Background(), &middleware.Input{
-		URL:  "/model/us.anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens",
-		Body: []byte(`{"input":{"converse":{"messages":[]}}}`),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision)
-
-	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
-	require.True(t, ok, "count-tokens carries a model in the path and must emit it")
-	assert.Equal(t, "anthropic.claude-sonnet-4-5", model, "model must be normalized like any other action")
-
-	stream, _ := metaValue(t, out.Metadata, middleware.KeyLLMStream)
-	assert.Equal(t, "false", stream, "count-tokens never streams")
-}

proxy/internal/middleware/builtin/llm_request_parser/middleware.go

@@ -61,8 +61,6 @@ func (middlewareImpl) MetadataKeys() []string {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
-		middleware.KeyLLMAgentID,
-		middleware.KeyLLMParentAgentID,
 	}
 }
 
@@ -74,9 +72,9 @@ func (middlewareImpl) Close() error { return nil }
 
 // Invoke detects the LLM provider, parses request facts, and emits
 // metadata. Always returns DecisionAllow; never errors. Provider
-// selection prefers the request path, falling back to the configured
-// providerID (synthesiser-stamped on agent-network targets) so requests
-// routed to a custom upstream URL still resolve.
+// selection prefers the configured providerID (synthesiser-stamped on
+// agent-network targets) so requests routed to a custom upstream URL
+// still resolve. Falls back to URL sniffing when no providerID is set.
 func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
 	out := &middleware.Output{Decision: middleware.DecisionAllow}
 	if in == nil {
@@ -94,14 +92,9 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 		return m.invokeBedrock(in, br), nil
 	}
 
-	// A path that names an API surface wins over the configured providerID:
-	// a gateway record pinned to "openai" still serves Claude Code on
-	// /v1/messages, and reading that body with the OpenAI parser loses the
-	// Anthropic usage block and prices the request on the wrong surface.
-	// providerID stays the fallback for upstreams whose path says nothing.
-	parser, ok := llm.DetectParser(extractPath(in.URL))
+	parser, ok := llm.ParserByName(m.providerID)
 	if !ok {
-		parser, ok = llm.ParserByName(m.providerID)
+		parser, ok = llm.DetectParser(extractPath(in.URL))
 	}
 	if !ok {
 		return out, nil
@@ -123,9 +116,9 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	}
 	appendSessionID := func(md []middleware.KV) []middleware.KV {
 		if sessionID != "" {
-			md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+			return append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 		}
-		return appendAgentIDs(md, in.Headers)
+		return md
 	}
 
 	facts, err := parser.ParseRequest(in.Body)
@@ -167,41 +160,6 @@ func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middle
 	return out, nil
 }
 
-// agentIDHeader and parentAgentIDHeader carry sub-agent attribution: a
-// coding agent that spawns helpers stamps the spawned agent's id, plus the
-// spawning agent's when that helper is itself nested. Both are opaque
-// identifiers rather than content, so they're emitted regardless of the
-// prompt-collection toggle, the same way the session id is.
-const (
-	agentIDHeader       = "x-claude-code-agent-id"
-	parentAgentIDHeader = "x-claude-code-parent-agent-id"
-)
-
-// appendAgentIDs stamps the sub-agent attribution headers onto the metadata
-// bag, skipping either one the request doesn't carry.
-func appendAgentIDs(md []middleware.KV, headers []middleware.KV) []middleware.KV {
-	for _, pair := range []struct{ key, header string }{
-		{middleware.KeyLLMAgentID, agentIDHeader},
-		{middleware.KeyLLMParentAgentID, parentAgentIDHeader},
-	} {
-		if v := headerValue(headers, pair.header); v != "" {
-			md = append(md, middleware.KV{Key: pair.key, Value: v})
-		}
-	}
-	return md
-}
-
-// headerValue returns the first non-empty value for the named header.
-// Headers arrive in canonical form, so the match is case-insensitive.
-func headerValue(headers []middleware.KV, want string) string {
-	for _, kv := range headers {
-		if strings.EqualFold(kv.Key, want) && kv.Value != "" {
-			return kv.Value
-		}
-	}
-	return ""
-}
-
 // sessionIDHeaders are request header names that may carry a client
 // session identifier, checked in order, case-insensitively. Matching is
 // against Go's canonical header form, so use the hyphenated names the
@@ -215,8 +173,10 @@ var sessionIDHeaders = []string{"x-claude-code-session-id", "session-id", "x-ses
 // canonical form, so the match is case-insensitive.
 func sessionIDFromHeaders(headers []middleware.KV) string {
 	for _, want := range sessionIDHeaders {
-		if v := headerValue(headers, want); v != "" {
-			return v
+		for _, kv := range headers {
+			if strings.EqualFold(kv.Key, want) && kv.Value != "" {
+				return kv.Value
+			}
 		}
 	}
 	return ""
@@ -292,12 +252,6 @@ func parseVertexPath(reqPath string) (vertexRequest, bool) {
 	if c := strings.LastIndex(rest, ":"); c >= 0 {
 		model, action = rest[:c], rest[c+1:]
 	}
-	// Token counting hangs off the model as its own path segment
-	// (".../models/{model}/count-tokens:rawPredict"), so anything past the
-	// first "/" belongs to the method rather than the model id.
-	if slash := strings.Index(model, "/"); slash >= 0 {
-		model = model[:slash]
-	}
 	model = llm.NormalizeVertexModel(model)
 	if model == "" {
 		return vertexRequest{}, false
@@ -344,7 +298,6 @@ func (m middlewareImpl) invokeVertex(in *middleware.Input, vx vertexRequest) *mi
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
-	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {
@@ -392,9 +345,7 @@ func trimBedrockNamespace(reqPath string) string {
 //
 //	/model/{modelId}/{action}
 //
-// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream,
-// count-tokens}. Token counting carries a model and no usage, so it routes
-// like any other action and meters to zero.
+// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream}.
 // The modelId may be URL-encoded and may carry a cross-region inference-profile
 // prefix and a version suffix; normalizeBedrockModel strips both so the model
 // matches catalog pricing.
@@ -418,7 +369,7 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 		return bedrockRequest{}, false
 	}
 	switch action {
-	case "invoke", "converse", "count-tokens":
+	case "invoke", "converse":
 		return bedrockRequest{model: model}, true
 	case "invoke-with-response-stream", "converse-stream":
 		return bedrockRequest{model: model, stream: true}, true
@@ -446,7 +397,6 @@ func (m middlewareImpl) invokeBedrock(in *middleware.Input, br bedrockRequest) *
 	if sessionID != "" {
 		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
 	}
-	md = appendAgentIDs(md, in.Headers)
 
 	promptTruncated := false
 	if parser != nil && m.capturePrompt {

proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go

@@ -45,8 +45,6 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 		middleware.KeyLLMRequestPromptRaw,
 		middleware.KeyLLMCaptureTruncated,
 		middleware.KeyLLMSessionID,
-		middleware.KeyLLMAgentID,
-		middleware.KeyLLMParentAgentID,
 	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
@@ -232,31 +230,6 @@ func TestInvoke_ProviderIDConfigBypassesURLSniff(t *testing.T) {
 	assert.Equal(t, "gpt-4o-mini", model)
 }
 
-func TestInvoke_PathSurfaceBeatsProviderIDConfig(t *testing.T) {
-	// Gateway records (LiteLLM, Portkey, OpenRouter) pin provider_id
-	// "openai", but the same record serves Claude Code on /v1/messages.
-	// Parsing that body as OpenAI reads no usage off the Anthropic
-	// response and prices the request on a surface where no claude-*
-	// model exists, so the path has to win.
-	mw, err := Factory{}.New([]byte(`{"provider_id":"openai"}`))
-	require.NoError(t, err, "factory must accept provider_id config")
-
-	out, err := mw.Invoke(context.Background(), &middleware.Input{
-		URL:  "/v1/messages",
-		Body: []byte(`{"model":"claude-sonnet-5","stream":true,"messages":[{"role":"user","content":"Hi"}]}`),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, out)
-
-	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
-	require.True(t, ok, "provider must be emitted")
-	assert.Equal(t, "anthropic", provider, "the /v1/messages path selects the Anthropic surface")
-
-	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
-	require.True(t, ok, "model must be extracted")
-	assert.Equal(t, "claude-sonnet-5", model)
-}
-
 func TestInvoke_UnknownProviderIDFallsBackToURL(t *testing.T) {
 	mw, err := Factory{}.New([]byte(`{"provider_id":"not-a-real-parser"}`))
 	require.NoError(t, err, "factory must accept any provider_id string")
@@ -443,81 +416,3 @@ func TestInvoke_NilInputAllows(t *testing.T) {
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "nil input still allows")
 	assert.Empty(t, out.Metadata, "nil input emits no metadata")
 }
-
-// TestParseVertexPath_CountTokensKeepsModel covers Vertex token counting,
-// where the method hangs off the model as its own path segment. Splitting
-// only on the final colon swallowed "/count-tokens" into the model id, so
-// the router saw a model no route could claim.
-func TestParseVertexPath_CountTokensKeepsModel(t *testing.T) {
-	cases := map[string]struct {
-		model  string
-		stream bool
-	}{
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:rawPredict":                       {model: "claude-sonnet-5"},
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5:streamRawPredict":                 {model: "claude-sonnet-5", stream: true},
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5/count-tokens:rawPredict":          {model: "claude-sonnet-5"},
-		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-5@20250929/count-tokens:rawPredict": {model: "claude-sonnet-5"},
-	}
-	for path, want := range cases {
-		vx, ok := parseVertexPath(path)
-		require.True(t, ok, "must parse %q", path)
-		assert.Equal(t, want.model, vx.model, "model for %q", path)
-		assert.Equal(t, want.stream, vx.stream, "stream flag for %q", path)
-		assert.Equal(t, "anthropic", vx.publisher, "publisher for %q", path)
-	}
-}
-
-// TestInvoke_EmitsAgentIDs covers sub-agent attribution: several agents run
-// in parallel inside one session, and without their ids every request in
-// the session attributes to the session alone.
-func TestInvoke_EmitsAgentIDs(t *testing.T) {
-	mw := newMiddleware(t)
-
-	t.Run("spawned agent", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), &middleware.Input{
-			URL:  "/v1/messages",
-			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
-			Headers: []middleware.KV{
-				{Key: "X-Claude-Code-Session-Id", Value: "sess-1"},
-				{Key: "X-Claude-Code-Agent-Id", Value: "agent-7"},
-			},
-		})
-		require.NoError(t, err)
-
-		agent, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
-		require.True(t, ok, "the spawned agent's id must be emitted")
-		assert.Equal(t, "agent-7", agent)
-
-		_, ok = metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
-		assert.False(t, ok, "a top-level agent has no parent to emit")
-	})
-
-	t.Run("nested agent", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), &middleware.Input{
-			URL:  "/v1/messages",
-			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
-			Headers: []middleware.KV{
-				{Key: "X-Claude-Code-Agent-Id", Value: "agent-9"},
-				{Key: "X-Claude-Code-Parent-Agent-Id", Value: "agent-7"},
-			},
-		})
-		require.NoError(t, err)
-
-		agent, _ := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
-		assert.Equal(t, "agent-9", agent)
-		parent, ok := metaValue(t, out.Metadata, middleware.KeyLLMParentAgentID)
-		require.True(t, ok, "a nested agent must carry the spawning agent's id")
-		assert.Equal(t, "agent-7", parent)
-	})
-
-	t.Run("absent on a plain request", func(t *testing.T) {
-		out, err := mw.Invoke(context.Background(), &middleware.Input{
-			URL:  "/v1/messages",
-			Body: []byte(`{"model":"claude-sonnet-5","messages":[]}`),
-		})
-		require.NoError(t, err)
-
-		_, ok := metaValue(t, out.Metadata, middleware.KeyLLMAgentID)
-		assert.False(t, ok, "no key is emitted when the client sends no agent id")
-	})
-}

proxy/internal/middleware/builtin/llm_router/bedrock_route_test.go

@@ -1,13 +1,9 @@
 package llm_router
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/middleware"
 )
 
 // TestRouteClaimsModel_BedrockNormalizesCandidate guards the fix for the native
@@ -32,86 +28,3 @@ func TestRouteClaimsModel_BedrockNormalizesCandidate(t *testing.T) {
 	assert.False(t, routeClaimsModel(openai, "us.gpt-4o"),
 		"non-Bedrock routes must not strip a us. prefix")
 }
-
-// TestRouter_BedrockCountTokensRoutes pins that the token-counting action
-// reaches the Bedrock route instead of denying as not-routable.
-func TestRouter_BedrockCountTokensRoutes(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "bedrock-prod",
-		Bedrock:         true,
-		Models:          []string{"anthropic.claude-sonnet-4-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
-	}}})
-
-	in := newInputWithModelAndURL("anthropic.claude-sonnet-4-5",
-		"/model/anthropic.claude-sonnet-4-5-20250929-v1:0/count-tokens")
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "bedrock"})
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "count-tokens must route, not deny")
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host)
-}
-
-// TestRouter_BedrockInferenceProfilesRoutes covers the startup lookups a
-// client makes to resolve a configured inference profile. They carry no
-// model, so before they were recognised they denied and wrote a policy
-// rejection into the access log on every session start.
-func TestRouter_BedrockInferenceProfilesRoutes(t *testing.T) {
-	bedrock := ProviderRoute{
-		ID:              "bedrock-prod",
-		Bedrock:         true,
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
-	}
-	openai := ProviderRoute{
-		ID:              "openai-prod",
-		Models:          []string{"gpt-4o"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.openai.com",
-	}
-	mw := New(Config{Providers: []ProviderRoute{openai, bedrock}})
-
-	for _, path := range []string{
-		"/inference-profiles?type=SYSTEM_DEFINED",
-		"/inference-profiles/us.anthropic.claude-sonnet-5",
-	} {
-		out, err := mw.Invoke(context.Background(), newModellessInput(path))
-		require.NoError(t, err)
-		require.NotNil(t, out)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision, "%s must route", path)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, "bedrock-runtime.eu-central-1.amazonaws.com", out.Mutations.RewriteUpstream.Host,
-			"%s must reach the Bedrock provider, not the first authorised one", path)
-
-		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-		assert.Equal(t, "true", nonInference, "%s carries no model to gate on", path)
-	}
-}
-
-// TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix pins that the
-// optional gateway namespace is removed before the request goes upstream.
-func TestRouter_BedrockNamespacedInferenceProfilesStripsPrefix(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "bedrock-prod",
-		Bedrock:         true,
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
-	}}})
-
-	out, err := mw.Invoke(context.Background(), newModellessInput("/bedrock/inference-profiles"))
-	require.NoError(t, err)
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "/bedrock", out.Mutations.RewriteUpstream.StripPathPrefix,
-		"the namespace prefix must not reach the real Bedrock endpoint")
-}

proxy/internal/middleware/builtin/llm_router/middleware.go

@@ -109,10 +109,6 @@ func (m *Middleware) MetadataKeys() []string {
 		middleware.KeyLLMAuthorisingGroups,
 		middleware.KeyLLMPolicyDecision,
 		middleware.KeyLLMPolicyReason,
-		middleware.KeyLLMNonInference,
-		// Emitted only for the per-model lookup, whose model lives in the path
-		// rather than a body the parser could read.
-		middleware.KeyLLMModel,
 	}
 }
 
@@ -141,26 +137,29 @@ const (
 // known to a provider that no policy authorises for the caller deny
 // with no_authorised_provider.
 func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
-	reqPath := requestPath(in.URL)
-	// The caller's API dialect, used to mirror a denial in the vendor's own
-	// error shape so the client can explain it to the user.
-	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
-	model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
-
 	// Vertex AI carries the model in the URL path, not the body, and is
 	// selected by path rather than by the model/vendor table. Route it before
 	// the model lookup so a model the parser extracted from the path can't be
 	// claimed by a same-vendor direct provider (e.g. claude-* on api.anthropic.com).
+	reqPath := requestPath(in.URL)
 	if isVertexPath(reqPath) {
+		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		// The request parser emits no llm.provider for a Vertex publisher it
 		// can't parse (e.g. google/gemini). Forwarding such a request would
 		// bypass token/budget metering, so deny it rather than serve it
 		// unmetered.
-		if surface == "" {
-			return denyUnmeterable(surface), nil
+		if vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider); vendor == "" {
+			return denyUnmeterable(), nil
 		}
 		route, outcome := m.matchVertex(reqPath, model, in.UserGroups)
-		return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
+		switch outcome {
+		case matchOutcomeFound:
+			return m.allowWithRoute(route, in.UserGroups), nil
+		case matchOutcomeUnauthorised:
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyUnknownModel(model), nil
+		}
 	}
 
 	// Bedrock likewise carries the model in the URL path (/model/{id}/{action}),
@@ -168,120 +167,52 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	// before the model lookup; when the prefix is present, strip it from the
 	// forwarded path so the real Bedrock endpoint receives its native path.
 	if isBedrockPath(reqPath) {
+		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
 		native, hadPrefix := splitBedrockNamespace(reqPath)
 		route, outcome := m.matchBedrock(native, model, in.UserGroups)
-		return m.decide(route, outcome, surface, model, in.UserGroups, func(out *middleware.Output) {
-			if hadPrefix {
-				stripBedrockNamespace(out)
+		switch outcome {
+		case matchOutcomeFound:
+			out := m.allowWithRoute(route, in.UserGroups)
+			if hadPrefix && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+				out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
 			}
-		}), nil
+			return out, nil
+		case matchOutcomeUnauthorised:
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyUnknownModel(model), nil
+		}
 	}
 
-	// GET /v1/models/{id} carries no body, so no model reaches the router in
-	// metadata — but the path names one, and answering it confirms a model
-	// exists and is reachable. Authorise it against the model table like any
-	// other per-model request, then mark it non-inference so it still skips
-	// the token pre-flight it would otherwise charge nothing against.
-	if detail, isDetail := modelDetailID(reqPath); isDetail && isNonInferenceMethod(in.Method) {
-		route, outcome := m.matchRoute(detail, surface, reqPath, in.UserGroups)
-		return m.decide(route, outcome, surface, detail, in.UserGroups, func(out *middleware.Output) {
-			markNonInference(out)
-			// The parser reads models from JSON bodies only, and this request
-			// has none, so stamp the one the path names. Without it the
-			// guardrail's own allowlist — a separate, possibly narrower list
-			// than the route's — never sees a model to check.
-			out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMModel, Value: detail})
-		}), nil
+	model, ok := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+	if !ok || model == "" {
+		// Non-inference endpoints (model listing) carry no model but still
+		// need rewriting from the synth placeholder to a real upstream;
+		// clients such as Codex call GET /v1/models at startup to enumerate
+		// availability and read a 403 as "model unavailable".
+		route, outcome := m.matchModelless(requestPath(in.URL), in.UserGroups)
+		switch outcome {
+		case matchOutcomeFound:
+			return m.allowWithRoute(route, in.UserGroups), nil
+		case matchOutcomeUnauthorised:
+			// A recognised model-less endpoint exists but no provider
+			// authorises the caller — deny as an authorisation failure
+			// rather than masking it as a missing model.
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyMissingModel(), nil
+		}
 	}
 
-	if model == "" {
-		return m.routeModelless(reqPath, surface, in.Method, in.UserGroups), nil
-	}
-
-	route, outcome := m.matchRoute(model, surface, reqPath, in.UserGroups)
-	return m.decide(route, outcome, surface, model, in.UserGroups, nil), nil
-}
-
-// decide turns a per-model match result into the middleware's decision. Every
-// surface that routes by model shares the same two denial arms — a model no
-// route claims is not routable, one that some route claims but none authorises
-// for this caller is an authorisation failure — so they live here once.
-// decorate, when non-nil, adjusts the allow with whatever that surface needs.
-func (m *Middleware) decide(
-	route ProviderRoute,
-	outcome matchOutcome,
-	surface, model string,
-	userGroups []string,
-	decorate func(*middleware.Output),
-) *middleware.Output {
+	vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	route, outcome := m.matchRoute(model, vendor, requestPath(in.URL), in.UserGroups)
 	switch outcome {
 	case matchOutcomeFound:
-		out := m.allowWithRoute(route, surface, userGroups)
-		if decorate != nil {
-			decorate(out)
-		}
-		return out
+		return m.allowWithRoute(route, in.UserGroups), nil
 	case matchOutcomeUnauthorised:
-		return denyNoAuthorisedRoute(surface, model)
+		return denyNoAuthorisedRoute(model), nil
 	default:
-		return denyUnknownModel(surface, model)
-	}
-}
-
-// routeModelless serves the endpoints that name no model at all: the model
-// listing, the connection-warming probe, and the Bedrock inference-profile
-// lookup. They still need rewriting from the synth placeholder to a real
-// upstream — clients such as Codex call GET /v1/models at startup to enumerate
-// availability and read a 403 as "model unavailable".
-func (m *Middleware) routeModelless(reqPath, surface, method string, userGroups []string) *middleware.Output {
-	route, outcome := m.matchModelless(reqPath, method, userGroups)
-	switch outcome {
-	case matchOutcomeFound:
-		out := m.allowWithRoute(route, surface, userGroups)
-		markNonInference(out)
-		if _, hadPrefix := splitBedrockNamespace(reqPath); hadPrefix {
-			stripBedrockNamespace(out)
-		}
-		// A route that enumerates its models bounds what the caller may use,
-		// so the picker must not offer the rest: every entry outside the list
-		// is a request the chain will deny.
-		if reqPath == modelListingPath && len(route.Models) > 0 &&
-			out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
-			out.Mutations.RewriteUpstream.DiscoveryModels = append([]string(nil), route.Models...)
-		}
-		return out
-	case matchOutcomeUnauthorised:
-		// A recognised model-less endpoint exists but no provider authorises
-		// the caller — deny as an authorisation failure rather than masking it
-		// as a missing model.
-		return denyNoAuthorisedRoute(surface, "")
-	default:
-		return denyMissingModel(surface)
-	}
-}
-
-// isNonInferenceMethod reports whether a request method is one the
-// non-inference endpoints actually use: the listing and the per-model lookup
-// are GET, the connection-warming probe is HEAD or GET. The method is the only
-// thing separating "GET /v1/models/{id}" from a POST to the same path carrying
-// an inference body, and the non-inference mark exempts a request from the
-// token pre-flight — so anything else falls through to normal per-model
-// routing, which denies when the request names no model.
-func isNonInferenceMethod(method string) bool {
-	return method == http.MethodGet || method == http.MethodHead
-}
-
-// markNonInference tags an allow as a request that spends no tokens, so the
-// limit check skips the management pre-flight it would charge nothing against.
-func markNonInference(out *middleware.Output) {
-	out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMNonInference, Value: "true"})
-}
-
-// stripBedrockNamespace tells the rewrite to drop the optional "/bedrock"
-// gateway namespace so the upstream receives its native Bedrock path.
-func stripBedrockNamespace(out *middleware.Output) {
-	if out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
-		out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
+		return denyUnknownModel(model), nil
 	}
 }
 
@@ -369,60 +300,12 @@ func (m *Middleware) matchRoute(model, vendor, reqPath string, userGroups []stri
 	return best, matchOutcomeFound
 }
 
-// connectionWarmPath is the probe Anthropic clients send before their first
-// inference request to open the upstream connection early. Forwarding it
-// warms the connection the request will actually use; denying it only fills
-// the access log with rejections at every session start.
-const connectionWarmPath = "/api/hello"
-
-// modelListingPath is the endpoint clients read at startup to populate
-// their model picker. Its response is a list the proxy can bound; the
-// per-model "/v1/models/{id}" lookup returns a single object and is left
-// alone.
-const modelListingPath = "/v1/models"
-
-// isModelLessPath reports whether reqPath is a known non-inference endpoint
-// that legitimately carries no model at all: the model listing and the
-// connection-warming probe. These must route to an upstream rather than
-// deny, so model enumeration works end to end. The per-model
-// "/v1/models/{id}" lookup is deliberately excluded — it names a model, so
-// it is authorised against the model table instead (see modelDetailID).
+// isModelLessPath reports whether reqPath is a known OpenAI-shaped
+// non-inference endpoint that legitimately carries no model in its
+// request (the model-listing endpoints). These must route to an upstream
+// rather than deny, so model enumeration works end to end.
 func isModelLessPath(reqPath string) bool {
-	return reqPath == modelListingPath || reqPath == connectionWarmPath
-}
-
-// modelDetailID returns the model id named by a "/v1/models/{id}" lookup.
-// reqPath comes from url.URL.Path, which is already percent-decoded, so an
-// id carrying a "/" (a self-hosted "Qwen/Qwen2.5-0.5B-Instruct" sent as
-// "Qwen%2FQwen2.5-...") arrives whole and everything after the prefix is the
-// id, separators included.
-func modelDetailID(reqPath string) (string, bool) {
-	if !strings.HasPrefix(reqPath, modelListingPath+"/") {
-		return "", false
-	}
-	id := strings.TrimPrefix(reqPath, modelListingPath+"/")
-	if id == "" {
-		return "", false
-	}
-	return id, true
-}
-
-// isBedrockModelLessPath reports whether reqPath is a Bedrock
-// inference-profile lookup, optionally behind the "/bedrock" gateway
-// namespace. Clients read these at startup to resolve a configured profile
-// to its underlying model. They carry no model of their own, so they route
-// by path to a Bedrock provider rather than through the model table.
-//
-// On native AWS these live on the control plane ("bedrock.<region>") while a
-// provider's upstream is normally the runtime host ("bedrock-runtime.<region>"),
-// so forwarding yields a 404 there. That is deliberate: a client has one base
-// URL, so pointing it straight at the runtime host 404s identically, and
-// forwarding keeps the proxy transparent instead of inventing a policy denial
-// the client would never otherwise see. Operators whose Bedrock upstream is a
-// gateway that does serve the lookup get a working answer.
-func isBedrockModelLessPath(reqPath string) bool {
-	native, _ := splitBedrockNamespace(reqPath)
-	return native == "/inference-profiles" || strings.HasPrefix(native, "/inference-profiles/")
+	return reqPath == "/v1/models" || strings.HasPrefix(reqPath, "/v1/models/")
 }
 
 // isVertexPath reports whether reqPath is a Google Vertex AI publisher
@@ -449,33 +332,20 @@ func splitBedrockNamespace(reqPath string) (string, bool) {
 	return reqPath, false
 }
 
-// bedrockActions are the runtime actions that follow the model id in a
-// Bedrock path. count-tokens is here so a client can price its context
-// against the dedicated endpoint; denying it pushes that work back onto
-// the inference endpoint, which bills for it.
-var bedrockActions = []string{
-	"/invoke",
-	"/invoke-with-response-stream",
-	"/converse",
-	"/converse-stream",
-	"/count-tokens",
-}
-
 // isBedrockPath reports whether reqPath is an AWS Bedrock runtime model
-// endpoint: /model/{modelId}/{action} — optionally behind a "/bedrock"
-// gateway-namespace prefix. The model lives in the path, so these requests
-// are routed by path to the Bedrock provider.
+// endpoint: /model/{modelId}/{action} where action is invoke,
+// invoke-with-response-stream, converse, or converse-stream — optionally behind
+// a "/bedrock" gateway-namespace prefix. The model lives in the path, so these
+// requests are routed by path to the Bedrock provider.
 func isBedrockPath(reqPath string) bool {
 	native, _ := splitBedrockNamespace(reqPath)
 	if !strings.HasPrefix(native, "/model/") {
 		return false
 	}
-	for _, action := range bedrockActions {
-		if strings.HasSuffix(native, action) {
-			return true
-		}
-	}
-	return false
+	return strings.HasSuffix(native, "/invoke") ||
+		strings.HasSuffix(native, "/invoke-with-response-stream") ||
+		strings.HasSuffix(native, "/converse") ||
+		strings.HasSuffix(native, "/converse-stream")
 }
 
 // matchVertex selects the Vertex provider authorised for the caller's groups
@@ -555,26 +425,19 @@ func (m *Middleware) matchPathRoute(reqPath, model string, userGroups []string,
 // declaration order), matchOutcomeUnauthorised when no provider authorises
 // the caller, or matchOutcomeUnknownModel when the path isn't a recognised
 // model-less endpoint.
-func (m *Middleware) matchModelless(reqPath, method string, userGroups []string) (ProviderRoute, matchOutcome) {
-	if !isNonInferenceMethod(method) {
+func (m *Middleware) matchModelless(reqPath string, userGroups []string) (ProviderRoute, matchOutcome) {
+	if !isModelLessPath(reqPath) {
 		return ProviderRoute{}, matchOutcomeUnknownModel
 	}
-	var eligible func(ProviderRoute) bool
-	switch {
-	case isBedrockModelLessPath(reqPath):
-		eligible = func(r ProviderRoute) bool { return r.Bedrock }
-	case isModelLessPath(reqPath):
+	var candidates []ProviderRoute
+	for _, route := range m.cfg.Providers {
 		// Vertex/Bedrock are path-routed and don't serve OpenAI-style
 		// model-listing endpoints; including them here could rewrite a
 		// GET /v1/models to an upstream that 404s it.
-		eligible = func(r ProviderRoute) bool { return !r.Vertex && !r.Bedrock }
-	default:
-		return ProviderRoute{}, matchOutcomeUnknownModel
-	}
-
-	var candidates []ProviderRoute
-	for _, route := range m.cfg.Providers {
-		if eligible(route) && routeAuthorisesGroups(route, userGroups) {
+		if route.Vertex || route.Bedrock {
+			continue
+		}
+		if routeAuthorisesGroups(route, userGroups) {
 			candidates = append(candidates, route)
 		}
 	}
@@ -701,16 +564,6 @@ func routeClaimsModel(route ProviderRoute, model string) bool {
 		if route.Bedrock && llm.NormalizeBedrockModel(candidate) == model {
 			return true
 		}
-		// A client may pin a dated Anthropic id ("claude-sonnet-4-5-20250929")
-		// where the operator registered the undated one. Only an undated
-		// registration absorbs a dated request: normalising both sides would
-		// let a route pinned to one dated release claim a different one, so an
-		// operator who deliberately pinned a build would silently serve
-		// another — and with several such routes, ordering would decide which.
-		if candidate == llm.NormalizeAnthropicModel(candidate) &&
-			candidate == llm.NormalizeAnthropicModel(model) {
-			return true
-		}
 	}
 	return false
 }
@@ -759,7 +612,7 @@ func requestPath(raw string) string {
 // provider id so identity-stamping middlewares (llm_identity_inject)
 // tag the request with ONLY the groups that authorised this specific
 // route — not every group the peer happens to be in.
-func (m *Middleware) allowWithRoute(route ProviderRoute, surface string, userGroups []string) *middleware.Output {
+func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *middleware.Output {
 	rewrite := &middleware.UpstreamRewrite{
 		Scheme: route.UpstreamScheme,
 		Host:   route.UpstreamHost,
@@ -781,7 +634,7 @@ func (m *Middleware) allowWithRoute(route ProviderRoute, surface string, userGro
 		// request time (cached + auto-refreshed) instead of a static value.
 		bearer, err := m.gcpBearer(route.GCPServiceAccountKeyB64)
 		if err != nil {
-			return denyUpstreamAuth(surface)
+			return denyUpstreamAuth()
 		}
 		authValue = bearer
 	}
@@ -851,12 +704,11 @@ func (m *Middleware) gcpTokenSource(saKeyB64 string) (oauth2.TokenSource, error)
 // denyUpstreamAuth is returned when the router cannot obtain the upstream
 // credential (e.g. a malformed service-account key or an unreachable token
 // endpoint). It surfaces as a 502 — an upstream problem, not a policy denial.
-func denyUpstreamAuth(surface string) *middleware.Output {
+func denyUpstreamAuth() *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 502,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeUpstreamAuth,
 			Message: "could not obtain upstream credential",
 		},
@@ -870,12 +722,11 @@ func denyUpstreamAuth(surface string) *middleware.Output {
 // denyUnmeterable returns the deny envelope for a path-routed request whose
 // publisher has no parser surface, so its usage can't be metered. Serving it
 // would bypass token/budget caps, so it is rejected with a 403.
-func denyUnmeterable(surface string) *middleware.Output {
+func denyUnmeterable() *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeUnmeterable,
 			Message: "request publisher is not supported for metering",
 		},
@@ -888,12 +739,11 @@ func denyUnmeterable(surface string) *middleware.Output {
 
 // denyMissingModel returns the deny envelope for a request whose
 // envelope has no llm.model metadata.
-func denyMissingModel(surface string) *middleware.Output {
+func denyMissingModel() *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: "missing llm.model on request envelope",
 		},
@@ -906,12 +756,11 @@ func denyMissingModel(surface string) *middleware.Output {
 
 // denyUnknownModel returns the deny envelope for a model that no
 // configured provider claims.
-func denyUnknownModel(surface, model string) *middleware.Output {
+func denyUnknownModel(model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeNotRoutable,
 			Message: fmt.Sprintf("no provider configured for model %s", model),
 			Details: map[string]string{"model": model},
@@ -926,12 +775,11 @@ func denyUnknownModel(surface, model string) *middleware.Output {
 // denyNoAuthorisedRoute returns the deny envelope for a model that one
 // or more providers claim, but where no policy authorises the caller's
 // groups for any of those providers.
-func denyNoAuthorisedRoute(surface, model string) *middleware.Output {
+func denyNoAuthorisedRoute(model string) *middleware.Output {
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Surface: surface,
 			Code:    denyCodeNoAuthorisedRoute,
 			Message: fmt.Sprintf("no policy authorises model %s for the caller's groups", model),
 			Details: map[string]string{"model": model},

proxy/internal/middleware/builtin/llm_router/middleware_test.go

@@ -2,7 +2,6 @@ package llm_router
 
 import (
 	"context"
-	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -61,8 +60,6 @@ func TestMiddlewareIdentity(t *testing.T) {
 		[]string{
 			middleware.KeyLLMResolvedProviderID,
 			middleware.KeyLLMAuthorisingGroups,
-			middleware.KeyLLMNonInference,
-			middleware.KeyLLMModel,
 			middleware.KeyLLMPolicyDecision,
 			middleware.KeyLLMPolicyReason,
 		},
@@ -174,12 +171,8 @@ func TestRouter_MissingModel(t *testing.T) {
 // from which a model could be parsed). UserGroups matches defaultTestGroup.
 func newModellessInput(reqURL string) *middleware.Input {
 	return &middleware.Input{
-		Slot: middleware.SlotOnRequest,
-		URL:  reqURL,
-		// The non-inference endpoints are read requests; the method is what
-		// separates them from an inference body posted to the same path, so
-		// state it rather than leaning on the zero value.
-		Method:     http.MethodGet,
+		Slot:       middleware.SlotOnRequest,
+		URL:        reqURL,
 		UserGroups: []string{defaultTestGroup},
 	}
 }
@@ -204,12 +197,6 @@ func TestRouter_ModelLessPath_RoutesToAuthorisedProvider(t *testing.T) {
 
 	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "openai-prod", provider, "resolved provider must be the authorised route")
-
-	// The limits gate reads this to tell "no model applies here" from
-	// "the model could not be determined", which fails closed.
-	nonInference, ok := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-	require.True(t, ok, "model-less allow must mark the request non-inference")
-	assert.Equal(t, "true", nonInference)
 }
 
 func TestRouter_ModelLessPath_MultiProviderDeclarationOrder(t *testing.T) {
@@ -886,262 +873,3 @@ func TestRouter_EmptyModelsClaimsAnyModel(t *testing.T) {
 	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
 	assert.Equal(t, "litellm", resolved)
 }
-
-// TestRouter_DatedAnthropicModelRoutes covers a client pinning a release
-// date on a model the operator registered undated. Exact matches still win,
-// so an operator who registers both dated releases keeps them distinct.
-func TestRouter_DatedAnthropicModelRoutes(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "anthropic-prod",
-		Vendor:          "anthropic",
-		Models:          []string{"claude-sonnet-4-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}}})
-
-	in := newInputWithModelAndURL("claude-sonnet-4-5-20250929", "/v1/messages")
-	in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "a dated id must route to the undated registration")
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
-}
-
-// TestRouter_ConnectionWarmProbeRoutes covers the HEAD /api/hello probe an
-// Anthropic client sends before its first request. Forwarding it warms the
-// connection that request will use; denying it only wrote a rejection into
-// the access log at every session start.
-func TestRouter_ConnectionWarmProbeRoutes(t *testing.T) {
-	mw := New(Config{Providers: []ProviderRoute{{
-		ID:              "anthropic-prod",
-		Vendor:          "anthropic",
-		Models:          []string{"claude-sonnet-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}}})
-
-	in := newModellessInput("/api/hello")
-	in.Method = http.MethodHead
-
-	out, err := mw.Invoke(context.Background(), in)
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "the warm-up probe must reach the upstream")
-	require.NotNil(t, out.Mutations)
-	require.NotNil(t, out.Mutations.RewriteUpstream)
-	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
-
-	nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-	assert.Equal(t, "true", nonInference, "the probe carries no model to gate on")
-}
-
-// TestRouter_ModelListingCarriesAuthorisedModels pins the list the proxy
-// bounds the discovery response with. A catch-all route enumerates nothing,
-// so it must not bound the upstream's list at all.
-func TestRouter_ModelListingCarriesAuthorisedModels(t *testing.T) {
-	enumerated := ProviderRoute{
-		ID:              "anthropic-prod",
-		Models:          []string{"claude-sonnet-5", "claude-haiku-4-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}
-
-	t.Run("enumerated route bounds the listing", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"},
-			out.Mutations.RewriteUpstream.DiscoveryModels,
-			"the picker must be bounded by what the route authorises")
-	})
-
-	t.Run("catch-all route leaves the listing alone", func(t *testing.T) {
-		catchAll := enumerated
-		catchAll.Models = nil
-		mw := New(Config{Providers: []ProviderRoute{catchAll}})
-
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"a route that claims every model cannot bound the upstream's list")
-	})
-
-	t.Run("per-model lookup is not a listing", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
-		require.NoError(t, err)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Empty(t, out.Mutations.RewriteUpstream.DiscoveryModels,
-			"the single-object lookup has no data array to filter")
-	})
-}
-
-// TestRouter_ModelDetailHonoursAllowlist pins that GET /v1/models/{id} is
-// authorised against the model table. It carries no body model, so treating
-// it as a model-less endpoint would let a caller confirm a model the route
-// does not list — the listing itself is bounded to the allowlist, so the
-// detail lookup must be too.
-func TestRouter_ModelDetailHonoursAllowlist(t *testing.T) {
-	enumerated := ProviderRoute{
-		ID:              "anthropic-prod",
-		Models:          []string{"claude-sonnet-5"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "api.anthropic.com",
-	}
-
-	t.Run("allowlisted model routes and skips metering", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host)
-
-		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-		assert.Equal(t, "true", nonInference, "a detail lookup spends no tokens")
-	})
-
-	t.Run("model outside the allowlist denies", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-opus-5"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionDeny, out.Decision,
-			"a model no route lists must not be confirmed by the detail lookup")
-	})
-
-	t.Run("dated id matches its undated registration", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{enumerated}})
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/claude-sonnet-5-20250929"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"a pinned release of an allowlisted family stays reachable")
-	})
-
-	t.Run("catch-all route still answers every lookup", func(t *testing.T) {
-		catchAll := enumerated
-		catchAll.Models = nil
-		mw := New(Config{Providers: []ProviderRoute{catchAll}})
-
-		out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models/anything-at-all"))
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"a gateway that enumerates nothing cannot refuse a lookup")
-	})
-}
-
-// TestRouter_NonInferenceRequiresReadMethod pins that the non-inference mark —
-// which exempts a request from the token pre-flight — is reachable only by the
-// read methods these endpoints actually use. A POST to the same path could
-// carry an inference body, so it must not buy the exemption; it falls through
-// to normal per-model routing instead, which denies when no model is named.
-func TestRouter_NonInferenceRequiresReadMethod(t *testing.T) {
-	route := ProviderRoute{
-		ID:              "gateway",
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "gateway.example.com",
-	}
-
-	for _, path := range []string{"/v1/models", "/v1/models/claude-sonnet-5", "/api/hello"} {
-		t.Run("POST "+path, func(t *testing.T) {
-			mw := New(Config{Providers: []ProviderRoute{route}})
-
-			in := newModellessInput(path)
-			in.Method = http.MethodPost
-
-			out, err := mw.Invoke(context.Background(), in)
-			require.NoError(t, err)
-			assert.Equal(t, middleware.DecisionDeny, out.Decision,
-				"a write to a non-inference path must not route unmetered")
-
-			nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-			assert.NotEqual(t, "true", nonInference,
-				"only a read method may skip the token pre-flight")
-		})
-	}
-
-	t.Run("HEAD keeps the warm probe working", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{route}})
-
-		in := newModellessInput(connectionWarmPath)
-		in.Method = http.MethodHead
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision,
-			"the HEAD warm probe must still reach the upstream")
-
-		nonInference, _ := metaValue(t, out.Metadata, middleware.KeyLLMNonInference)
-		assert.Equal(t, "true", nonInference,
-			"the HEAD warm probe carries no model to meter")
-	})
-}
-
-// TestRouter_PinnedDatedModelStaysDistinct pins that a route registered
-// against one dated Anthropic release does not claim another. Normalising
-// both sides of the comparison made every dated build of a family
-// interchangeable, so an operator who deliberately pinned a build would have
-// served a different one — and with several such routes, declaration or path
-// order would have decided which.
-func TestRouter_PinnedDatedModelStaysDistinct(t *testing.T) {
-	pinned := ProviderRoute{
-		ID:              "anthropic-pinned",
-		Vendor:          "anthropic",
-		Models:          []string{"claude-sonnet-4-5-20250101"},
-		AllowedGroupIDs: []string{defaultTestGroup},
-		UpstreamScheme:  "https",
-		UpstreamHost:    "pinned.example.com",
-	}
-
-	t.Run("a different dated release is not claimed", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{pinned}})
-		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
-		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionDeny, out.Decision,
-			"a route pinned to one dated build must not serve another")
-	})
-
-	t.Run("its own dated release still routes", func(t *testing.T) {
-		mw := New(Config{Providers: []ProviderRoute{pinned}})
-		in := newInputWithModelAndURL("claude-sonnet-4-5-20250101", "/v1/messages")
-		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		assert.Equal(t, middleware.DecisionAllow, out.Decision, "the exact match must still route")
-	})
-
-	t.Run("two pinned builds each route to their own provider", func(t *testing.T) {
-		other := pinned
-		other.ID = "anthropic-pinned-newer"
-		other.Models = []string{"claude-sonnet-4-5-20250202"}
-		other.UpstreamHost = "newer.example.com"
-		mw := New(Config{Providers: []ProviderRoute{pinned, other}})
-
-		in := newInputWithModelAndURL("claude-sonnet-4-5-20250202", "/v1/messages")
-		in.Metadata = append(in.Metadata, middleware.KV{Key: middleware.KeyLLMProvider, Value: "anthropic"})
-
-		out, err := mw.Invoke(context.Background(), in)
-		require.NoError(t, err)
-		require.Equal(t, middleware.DecisionAllow, out.Decision)
-		require.NotNil(t, out.Mutations)
-		require.NotNil(t, out.Mutations.RewriteUpstream)
-		assert.Equal(t, "newer.example.com", out.Mutations.RewriteUpstream.Host,
-			"declaration order must not decide between two deliberately pinned builds")
-	})
-}

proxy/internal/middleware/decision.go

@@ -11,78 +11,11 @@ var codeRegex = regexp.MustCompile(`^[a-z][a-z0-9._-]{0,63}$`)
 // denyResponse is the on-wire shape rendered by RenderDenyResponse.
 // Keeping this as a typed struct ensures we never leak
 // middleware-supplied bytes outside known fields.
-//
-// Type and Error mirror the denial in the vendor's own error shape when
-// the request reached a known LLM surface. LLM clients only parse their
-// provider's envelope, so without the mirror a budget stop reaches the
-// user as an unexplained API error. The NetBird fields stay where they
-// were, so the body is a superset and existing consumers are unaffected.
 type denyResponse struct {
 	Code       string            `json:"code"`
 	Message    string            `json:"message,omitempty"`
 	Details    map[string]string `json:"details,omitempty"`
 	Middleware string            `json:"middleware,omitempty"`
-	Type       string            `json:"type,omitempty"`
-	Error      *providerError    `json:"error,omitempty"`
-}
-
-// providerError is the nested error object both vendor envelopes carry.
-type providerError struct {
-	Type    string `json:"type"`
-	Message string `json:"message,omitempty"`
-	Code    string `json:"code,omitempty"`
-}
-
-// Vendor error types keyed by HTTP status, per each provider's published
-// error reference.
-const (
-	anthropicErrInvalidRequest = "invalid_request_error"
-	anthropicErrPermission     = "permission_error"
-	anthropicErrRateLimit      = "rate_limit_error"
-	anthropicErrAPI            = "api_error"
-	openAIErrInvalidRequest    = "invalid_request_error"
-	openAIErrRateLimit         = "rate_limit_error"
-)
-
-// providerEnvelope returns the vendor-shaped mirror for a denial on the
-// given surface, or nil when the surface has no envelope we can speak.
-// message is the already-redacted public message.
-func providerEnvelope(surface, code, message string, status int) (string, *providerError) {
-	switch surface {
-	case "anthropic":
-		return "error", &providerError{
-			Type:    anthropicErrorType(status),
-			Message: message,
-		}
-	case "openai":
-		return "", &providerError{
-			Type:    openAIErrorType(status),
-			Message: message,
-			Code:    code,
-		}
-	default:
-		return "", nil
-	}
-}
-
-func anthropicErrorType(status int) string {
-	switch status {
-	case http.StatusForbidden:
-		return anthropicErrPermission
-	case http.StatusTooManyRequests:
-		return anthropicErrRateLimit
-	case http.StatusBadRequest:
-		return anthropicErrInvalidRequest
-	default:
-		return anthropicErrAPI
-	}
-}
-
-func openAIErrorType(status int) string {
-	if status == http.StatusTooManyRequests {
-		return openAIErrRateLimit
-	}
-	return openAIErrInvalidRequest
 }
 
 // RenderDenyResponse writes a structured JSON deny body. Status is
@@ -103,7 +36,6 @@ func RenderDenyResponse(w http.ResponseWriter, middlewareID string, reason *Deny
 		Message:    truncate(Scan(reason.Message), 256),
 		Middleware: truncate(Scan(middlewareID), 64),
 	}
-	resp.Type, resp.Error = providerEnvelope(reason.Surface, resp.Code, resp.Message, status)
 	if n := len(reason.Details); n > 0 {
 		resp.Details = make(map[string]string, min(n, 8))
 		for k, v := range reason.Details {

proxy/internal/middleware/decision_test.go

@@ -1,92 +0,0 @@
-package middleware
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// decodeDeny renders a denial and returns the parsed body plus the status.
-func decodeDeny(t *testing.T, reason *DenyReason, status int) (map[string]any, int) {
-	t.Helper()
-	rec := httptest.NewRecorder()
-	RenderDenyResponse(rec, "llm_limit_check", reason, status)
-
-	var body map[string]any
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body), "deny body must be valid JSON")
-	return body, rec.Code
-}
-
-// TestRenderDeny_AnthropicSurfaceMirrorsVendorShape covers a budget stop
-// reaching Claude Code. The client only parses the Anthropic envelope, so
-// without the mirror the user sees an unexplained API error instead of the
-// reason their request was refused.
-func TestRenderDeny_AnthropicSurfaceMirrorsVendorShape(t *testing.T) {
-	body, status := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.budget_cap_exceeded",
-		Message: "LLM policy limit exceeded",
-		Surface: "anthropic",
-	}, http.StatusForbidden)
-
-	assert.Equal(t, http.StatusForbidden, status)
-	assert.Equal(t, "error", body["type"], "Anthropic errors carry type=error at the top level")
-
-	errObj, ok := body["error"].(map[string]any)
-	require.True(t, ok, "error must be an object")
-	assert.Equal(t, "permission_error", errObj["type"], "403 maps to permission_error")
-	assert.Equal(t, "LLM policy limit exceeded", errObj["message"])
-
-	// The NetBird fields stay put so existing consumers keep working.
-	assert.Equal(t, "llm_policy.budget_cap_exceeded", body["code"])
-	assert.Equal(t, "LLM policy limit exceeded", body["message"])
-	assert.Equal(t, "llm_limit_check", body["middleware"])
-}
-
-// TestRenderDeny_OpenAISurfaceMirrorsVendorShape pins the OpenAI envelope,
-// which nests the code and carries no top-level type.
-func TestRenderDeny_OpenAISurfaceMirrorsVendorShape(t *testing.T) {
-	body, _ := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.model_blocked",
-		Message: "model is not in the policy allowlist",
-		Surface: "openai",
-	}, http.StatusForbidden)
-
-	assert.NotContains(t, body, "type", "OpenAI errors have no top-level type")
-
-	errObj, ok := body["error"].(map[string]any)
-	require.True(t, ok, "error must be an object")
-	assert.Equal(t, "invalid_request_error", errObj["type"])
-	assert.Equal(t, "llm_policy.model_blocked", errObj["code"], "the NetBird code rides in the vendor code field")
-	assert.Equal(t, "model is not in the policy allowlist", errObj["message"])
-}
-
-// TestRenderDeny_RateLimitStatusMapsToVendorRateLimit pins the mapping a
-// client's backoff keys on.
-func TestRenderDeny_RateLimitStatusMapsToVendorRateLimit(t *testing.T) {
-	body, status := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.token_cap_exceeded",
-		Message: "LLM policy limit exceeded",
-		Surface: "anthropic",
-	}, http.StatusTooManyRequests)
-
-	assert.Equal(t, http.StatusTooManyRequests, status, "429 must survive the status clamp")
-	errObj := body["error"].(map[string]any)
-	assert.Equal(t, "rate_limit_error", errObj["type"])
-}
-
-// TestRenderDeny_NoSurfaceKeepsLegacyShape guards non-LLM middlewares and
-// denials raised before a surface is known.
-func TestRenderDeny_NoSurfaceKeepsLegacyShape(t *testing.T) {
-	body, _ := decodeDeny(t, &DenyReason{
-		Code:    "llm_policy.model_not_routable",
-		Message: "no provider configured for model x",
-	}, http.StatusForbidden)
-
-	assert.NotContains(t, body, "type", "no surface means no vendor mirror")
-	assert.NotContains(t, body, "error", "no surface means no vendor mirror")
-	assert.Equal(t, "llm_policy.model_not_routable", body["code"])
-}

proxy/internal/middleware/keys.go

@@ -22,15 +22,6 @@ const (
 	// body. Empty for clients that don't send one.
 	KeyLLMSessionID = "llm.session_id"
 
-	// Sub-agent attribution (emitted by llm_request_parser from the
-	// client's request headers). A coding agent that spawns helpers
-	// stamps the spawned agent's id, and the spawning agent's id when
-	// the helper is itself nested, so cost within one session can be
-	// split across the agents that ran in parallel. These identify an
-	// agent, not a person or a device: never treat them as a user id.
-	KeyLLMAgentID       = "llm.agent_id"
-	KeyLLMParentAgentID = "llm.parent_agent_id"
-
 	// LLM response-side metadata (emitted by llm_response_parser).
 	//nolint:gosec // metadata key name, not a credential
 	KeyLLMInputTokens = "llm.input_tokens"
@@ -75,14 +66,6 @@ const (
 	// downstream gateways' spend logs.
 	KeyLLMAuthorisingGroups = "llm.authorising_groups"
 
-	// LLM non-inference marker (emitted by llm_router on the allow path
-	// for endpoints that legitimately carry no model, such as model
-	// listing). The router still authorises these against the caller's
-	// groups; the marker only tells the limits gate that a per-model
-	// allowlist has nothing to evaluate, so an empty model must not be
-	// read as an undetermined one. Never derived from client input.
-	KeyLLMNonInference = "llm.non_inference"
-
 	// LLM policy attribution (emitted by llm_limit_check on the allow
 	// path). Names the policy that paid for this request and the
 	// dimension counters the post-flight llm_limit_record middleware

proxy/internal/middleware/types.go

@@ -179,12 +179,6 @@ type DenyReason struct {
 	Code    string
 	Message string
 	Details map[string]string
-	// Surface names the LLM API dialect the caller speaks (the
-	// llm.provider value), so the rendered body can mirror the denial in
-	// that vendor's error shape alongside the NetBird fields. Empty for
-	// non-LLM middlewares and for denials raised before a surface was
-	// resolved; the body then carries the NetBird fields alone.
-	Surface string
 }
 
 // Output is the value each middleware returns to the dispatcher. The
@@ -253,12 +247,6 @@ type UpstreamRewrite struct {
 	// without verifying its TLS certificate. Set by llm_router from the
 	// provider's skip_tls_verification for self-hosted / internal gateways.
 	SkipTLSVerify bool
-	// DiscoveryModels, when non-empty, is the set of model ids the resolved
-	// route authorises, and the proxy drops everything else from the
-	// model-listing response. Empty leaves the upstream's list untouched,
-	// which is what a route that claims every model wants. Set by
-	// llm_router on a model-listing request only.
-	DiscoveryModels []string
 }
 
 // AuthHeader is a single name/value pair the proxy injects on the

proxy/internal/proxy/discovery_filter.go

@@ -1,191 +0,0 @@
-package proxy
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// maxDiscoveryBodyBytes bounds the model-listing response the filter will
-// buffer. A listing is a few kilobytes of ids; anything larger is not a
-// listing we recognise, and buffering it to rewrite would cost more than
-// the filtering is worth.
-const maxDiscoveryBodyBytes = 1 << 20
-
-// modelDiscoveryFilter returns a ModifyResponse hook that drops models the
-// caller's policy does not authorise from a model-listing response, then
-// delegates to next (which may be nil).
-//
-// Clients populate their model picker from this endpoint, so an unfiltered
-// list offers models the very next request denies. The filter is
-// best-effort: a response it cannot safely rewrite passes through
-// untouched rather than reaching the client corrupted.
-func modelDiscoveryFilter(allowed []string, next func(*http.Response) error) func(*http.Response) error {
-	permitted := make(map[string]struct{}, len(allowed)*2)
-	for _, id := range allowed {
-		permitted[id] = struct{}{}
-		permitted[sharedllm.NormalizeAnthropicModel(id)] = struct{}{}
-	}
-
-	return func(resp *http.Response) error {
-		if err := filterModelListing(resp, permitted); err != nil {
-			return err
-		}
-		if next == nil {
-			return nil
-		}
-		return next(resp)
-	}
-}
-
-// filterModelListing rewrites the response body in place, keeping only the
-// entries whose id the policy authorises. Responses that are not a plain
-// JSON listing are left alone.
-func filterModelListing(resp *http.Response, permitted map[string]struct{}) error {
-	if !isPlainJSONListing(resp) {
-		return nil
-	}
-
-	// One byte past the cap, so an oversized body is detectable without
-	// buffering all of it.
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxDiscoveryBodyBytes+1))
-	if err != nil {
-		_ = resp.Body.Close()
-		return err
-	}
-	if len(body) > maxDiscoveryBodyBytes {
-		// Too large to filter. Put the bytes already read back in front of the
-		// unread remainder and forward the response exactly as the upstream
-		// sent it, headers included. Buffering what was read and closing here
-		// would truncate the body at the cap and hand the client a short,
-		// invalid listing — worse than not filtering at all.
-		resp.Body = spliceBody(body, resp.Body)
-		return nil
-	}
-	if err := resp.Body.Close(); err != nil {
-		return err
-	}
-
-	filtered, ok := filterListingBody(body, permitted)
-	if !ok {
-		restoreBody(resp, body)
-		return nil
-	}
-	restoreBody(resp, filtered)
-	return nil
-}
-
-// isPlainJSONListing reports whether the response is a JSON body the filter
-// can parse. A content-encoded body is skipped: the transport only
-// transparently decompresses what it negotiated itself, and the client
-// negotiates its own encoding on this request.
-func isPlainJSONListing(resp *http.Response) bool {
-	if resp == nil || resp.Body == nil {
-		return false
-	}
-	if resp.StatusCode != http.StatusOK {
-		return false
-	}
-	if enc := resp.Header.Get("Content-Encoding"); enc != "" && !strings.EqualFold(enc, "identity") {
-		return false
-	}
-	return strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "application/json")
-}
-
-// filterListingBody returns the listing with unauthorised entries removed.
-// ok is false when the body is not a listing shape, in which case the
-// caller must forward the original bytes.
-func filterListingBody(body []byte, permitted map[string]struct{}) ([]byte, bool) {
-	var doc map[string]json.RawMessage
-	if err := json.Unmarshal(body, &doc); err != nil {
-		return nil, false
-	}
-	raw, present := doc["data"]
-	if !present {
-		return nil, false
-	}
-	var entries []map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &entries); err != nil {
-		return nil, false
-	}
-
-	kept := make([]map[string]json.RawMessage, 0, len(entries))
-	for _, entry := range entries {
-		if entryPermitted(entry, permitted) {
-			kept = append(kept, entry)
-		}
-	}
-
-	encoded, err := json.Marshal(kept)
-	if err != nil {
-		return nil, false
-	}
-	doc["data"] = encoded
-	out, err := json.Marshal(doc)
-	if err != nil {
-		return nil, false
-	}
-	return out, true
-}
-
-// entryPermitted reports whether a listing entry names a model the policy
-// authorises, trying every form the same model is written in.
-func entryPermitted(entry map[string]json.RawMessage, permitted map[string]struct{}) bool {
-	raw, ok := entry["id"]
-	if !ok {
-		return false
-	}
-	var id string
-	if err := json.Unmarshal(raw, &id); err != nil {
-		return false
-	}
-	for _, candidate := range modelIDForms(id) {
-		if _, ok := permitted[candidate]; ok {
-			return true
-		}
-	}
-	return false
-}
-
-// modelIDForms returns the forms a single model id may be written in: the id
-// itself, its undated form, and the same two with a gateway's provider
-// prefix removed ("vertex_ai/claude-sonnet-5"). The bare id is tried first,
-// because a self-hosted id can legitimately contain a slash of its own
-// ("Qwen/Qwen2.5-0.5B-Instruct") and must not be cut down to its tail.
-func modelIDForms(id string) []string {
-	if id == "" {
-		return nil
-	}
-	forms := []string{id, sharedllm.NormalizeAnthropicModel(id)}
-	if slash := strings.LastIndex(id, "/"); slash >= 0 {
-		tail := id[slash+1:]
-		forms = append(forms, tail, sharedllm.NormalizeAnthropicModel(tail))
-	}
-	return forms
-}
-
-// restoreBody puts body back on the response and fixes the length headers
-// so the client reads exactly what is there.
-// spliceBody returns a ReadCloser that yields prefix followed by whatever is
-// left in rest, closing rest when closed. It lets the filter put back bytes it
-// consumed while deciding, without owning the rest of the stream.
-func spliceBody(prefix []byte, rest io.ReadCloser) io.ReadCloser {
-	return struct {
-		io.Reader
-		io.Closer
-	}{
-		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
-		Closer: rest,
-	}
-}
-
-func restoreBody(resp *http.Response, body []byte) {
-	resp.Body = io.NopCloser(bytes.NewReader(body))
-	resp.ContentLength = int64(len(body))
-	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
-}

proxy/internal/proxy/discovery_filter_test.go

@@ -1,217 +0,0 @@
-package proxy
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// jsonListingResponse builds a 200 model-listing response with the given
-// body, as an upstream would return it.
-func jsonListingResponse(body string) *http.Response {
-	resp := &http.Response{
-		StatusCode:    http.StatusOK,
-		Header:        http.Header{},
-		Body:          io.NopCloser(strings.NewReader(body)),
-		ContentLength: int64(len(body)),
-	}
-	resp.Header.Set("Content-Type", "application/json")
-	return resp
-}
-
-// listedIDs runs the filter and returns the ids left in the response.
-func listedIDs(t *testing.T, allowed []string, body string) []string {
-	t.Helper()
-	resp := jsonListingResponse(body)                            //nolint:bodyclose // in-memory body, replaced by the filter
-	require.NoError(t, modelDiscoveryFilter(allowed, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
-
-	raw, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-
-	var doc struct {
-		Data []struct {
-			ID string `json:"id"`
-		} `json:"data"`
-	}
-	require.NoError(t, json.Unmarshal(raw, &doc), "filtered body must stay valid JSON")
-
-	ids := make([]string, 0, len(doc.Data))
-	for _, entry := range doc.Data {
-		ids = append(ids, entry.ID)
-	}
-	return ids
-}
-
-// TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels covers the picker a
-// developer sees: an unfiltered upstream list offers every model the shared
-// key can reach, and each one the policy excludes is a request the chain
-// denies a moment later.
-func TestModelDiscoveryFilter_KeepsOnlyAuthorisedModels(t *testing.T) {
-	ids := listedIDs(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, `{
-		"data": [
-			{"id": "claude-opus-5", "display_name": "Claude Opus 5"},
-			{"id": "claude-sonnet-5", "display_name": "Claude Sonnet 5"},
-			{"id": "claude-haiku-4-5"}
-		],
-		"has_more": false
-	}`)
-
-	assert.Equal(t, []string{"claude-sonnet-5", "claude-haiku-4-5"}, ids,
-		"only the models the route authorises may reach the picker")
-}
-
-// TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs pins the two id forms
-// a gateway returns for a model the operator registered plainly.
-func TestModelDiscoveryFilter_MatchesDatedAndPrefixedIDs(t *testing.T) {
-	ids := listedIDs(t, []string{"claude-sonnet-4-5", "anthropic.claude-opus-5"}, `{
-		"data": [
-			{"id": "claude-sonnet-4-5-20250929"},
-			{"id": "bedrock/anthropic.claude-opus-5"},
-			{"id": "gpt-4o"}
-		]
-	}`)
-
-	assert.Equal(t, []string{"claude-sonnet-4-5-20250929", "bedrock/anthropic.claude-opus-5"}, ids,
-		"a dated or provider-prefixed id must match its registered form")
-}
-
-// TestModelDiscoveryFilter_PreservesEnvelopeFields guards the rest of the
-// document: clients read paging fields alongside data.
-func TestModelDiscoveryFilter_PreservesEnvelopeFields(t *testing.T) {
-	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}],"has_more":true,"first_id":"x"}`) //nolint:bodyclose // in-memory body, replaced by the filter
-	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp))                  //nolint:bodyclose // in-memory body, replaced by the filter
-
-	raw, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-
-	var doc map[string]any
-	require.NoError(t, json.Unmarshal(raw, &doc))
-	assert.Equal(t, true, doc["has_more"], "paging fields must survive the rewrite")
-	assert.Equal(t, "x", doc["first_id"])
-	assert.Equal(t, strconv.Itoa(len(raw)), resp.Header.Get("Content-Length"),
-		"Content-Length must match the rewritten body")
-}
-
-// TestModelDiscoveryFilter_PassesThroughUnfilterable covers the responses
-// the filter must not touch: a compressed body it cannot parse, a non-JSON
-// body, an error status, and a document with no data array.
-func TestModelDiscoveryFilter_PassesThroughUnfilterable(t *testing.T) {
-	cases := map[string]func() *http.Response{
-		"compressed": func() *http.Response {
-			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
-			resp.Header.Set("Content-Encoding", "gzip")
-			return resp
-		},
-		"not json": func() *http.Response {
-			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
-			resp.Header.Set("Content-Type", "text/html")
-			return resp
-		},
-		"error status": func() *http.Response {
-			resp := jsonListingResponse(`{"data":[{"id":"gpt-4o"}]}`)
-			resp.StatusCode = http.StatusInternalServerError
-			return resp
-		},
-		"no data array": func() *http.Response {
-			return jsonListingResponse(`{"object":"list"}`)
-		},
-	}
-
-	for name, build := range cases {
-		t.Run(name, func(t *testing.T) {
-			resp := build() //nolint:bodyclose // in-memory body, replaced by the filter
-			original, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			resp.Body = io.NopCloser(bytes.NewReader(original))
-
-			require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, nil)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
-
-			got, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			assert.Equal(t, string(original), string(got), "an unfilterable response must reach the client unchanged")
-		})
-	}
-}
-
-// TestModelDiscoveryFilter_RunsNextHook pins that an existing
-// ModifyResponse hook still runs after filtering.
-func TestModelDiscoveryFilter_RunsNextHook(t *testing.T) {
-	called := false
-	next := func(*http.Response) error {
-		called = true
-		return nil
-	}
-
-	resp := jsonListingResponse(`{"data":[{"id":"claude-sonnet-5"}]}`)                //nolint:bodyclose // in-memory body, replaced by the filter
-	require.NoError(t, modelDiscoveryFilter([]string{"claude-sonnet-5"}, next)(resp)) //nolint:bodyclose // in-memory body, replaced by the filter
-	assert.True(t, called, "the chained hook must still run")
-}
-
-// TestModelDiscoveryFilter_KeepsSlashBearingIDs covers self-hosted backends
-// whose model ids carry a slash of their own. Treating the slash as a
-// gateway prefix and keeping only the tail dropped every such model from
-// the picker even though the policy named it exactly.
-func TestModelDiscoveryFilter_KeepsSlashBearingIDs(t *testing.T) {
-	ids := listedIDs(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, `{
-		"object": "list",
-		"data": [
-			{"id": "Qwen/Qwen2.5-0.5B-Instruct"},
-			{"id": "Qwen/Qwen2.5-7B-Instruct"}
-		]
-	}`)
-
-	assert.Equal(t, []string{"Qwen/Qwen2.5-0.5B-Instruct"}, ids,
-		"a slash inside the model id is part of the id, not a provider prefix")
-}
-
-// TestModelDiscoveryFilter_ForwardsOversizedBodyIntact covers a listing past
-// the buffering cap. The filter reads one byte beyond the cap to detect the
-// size; forwarding only what it read would hand the client a body truncated
-// at exactly 1 MiB — valid-looking, short, and unparseable as JSON. The bytes
-// already read must be spliced back in front of the unread remainder so the
-// response reaches the client exactly as the upstream sent it.
-func TestModelDiscoveryFilter_ForwardsOversizedBodyIntact(t *testing.T) {
-	// A well-formed listing whose single entry pads the body past the cap.
-	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
-	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
-	require.Greater(t, len(body), maxDiscoveryBodyBytes+1,
-		"the fixture must exceed the cap by more than the one-byte probe")
-
-	resp := jsonListingResponse(body)                        //nolint:bodyclose // in-memory body
-	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
-
-	got, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-	assert.Equal(t, len(body), len(got),
-		"an oversized listing must reach the client whole, not truncated at the cap")
-	assert.Equal(t, body, string(got), "the forwarded bytes must be the upstream's own")
-
-	var doc map[string]json.RawMessage
-	assert.NoError(t, json.Unmarshal(got, &doc),
-		"the forwarded body must still parse as JSON")
-}
-
-// TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders pins that the
-// oversized path leaves the response metadata alone. Rewriting Content-Length
-// to the truncated prefix is what made the corruption invisible to the client
-// until it tried to parse.
-func TestModelDiscoveryFilter_OversizedBodyKeepsUpstreamHeaders(t *testing.T) {
-	padding := strings.Repeat("x", maxDiscoveryBodyBytes)
-	body := `{"object":"list","data":[{"id":"gpt-4o","note":"` + padding + `"}]}`
-
-	resp := jsonListingResponse(body) //nolint:bodyclose // in-memory body
-	resp.Header.Set("Content-Length", strconv.Itoa(len(body)))
-	require.NoError(t, modelDiscoveryFilter(nil, nil)(resp)) //nolint:bodyclose // in-memory body
-
-	assert.Equal(t, int64(len(body)), resp.ContentLength,
-		"ContentLength must keep describing the body the client receives")
-	assert.Equal(t, strconv.Itoa(len(body)), resp.Header.Get("Content-Length"),
-		"the Content-Length header must not be rewritten to the truncated prefix")
-}

proxy/internal/proxy/reverseproxy.go

@@ -363,9 +363,6 @@ func (p *ReverseProxy) forwardUpstream(respWriter http.ResponseWriter, r *http.R
 	if result.rewriteRedirects {
 		rp.ModifyResponse = p.rewriteLocationFunc(effectiveURL, rewriteMatchedPath, r) //nolint:bodyclose
 	}
-	if upstreamRewrite != nil && len(upstreamRewrite.DiscoveryModels) > 0 {
-		rp.ModifyResponse = modelDiscoveryFilter(upstreamRewrite.DiscoveryModels, rp.ModifyResponse) //nolint:bodyclose // the hook replaces the body and closes the original
-	}
 	rp.ServeHTTP(respWriter, r.WithContext(ctx))
 }
 

shared/llm/model.go

@@ -46,27 +46,6 @@ func NormalizeBedrockModel(modelID string) string {
 	return bedrockVersionSuffix.ReplaceAllString(m, "")
 }
 
-// anthropicDatedModel matches a Claude model id carrying the trailing
-// "-YYYYMMDD" release-date suffix Anthropic appends to a pinned release,
-// capturing the id without it. The "claude" anchor is load-bearing: pricing
-// looks every model up through this helper regardless of surface, and an
-// operator may register a custom id with any shape at all, so an unanchored
-// "-\d{8}$" would let "internal-llm-20250101" silently inherit the rate
-// registered for "internal-llm". The anchor also covers the vendor-prefixed
-// forms ("anthropic.claude-...", "us.anthropic.claude-...").
-var anthropicDatedModel = regexp.MustCompile(`(?i)^(.*claude.*)-\d{8}$`)
-
-// NormalizeAnthropicModel strips the trailing release-date suffix from a
-// Claude model id, e.g. "claude-sonnet-4-5-20250929" -> "claude-sonnet-4-5",
-// so a dated id a client pins matches the undated one the operator
-// registered. Ids that are not Claude-family are returned untouched.
-// Callers try the verbatim id first and fall back to this, so two dated
-// releases of the same family stay distinct wherever both are registered
-// explicitly.
-func NormalizeAnthropicModel(modelID string) string {
-	return anthropicDatedModel.ReplaceAllString(modelID, "$1")
-}
-
 // NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
 // (e.g. "claude-sonnet-4-5@20250929" -> "claude-sonnet-4-5") so it matches
 // the catalog/pricing key. Vertex publisher models are priced under their

shared/llm/model_test.go

@@ -34,29 +34,3 @@ func TestNormalizeVertexModel(t *testing.T) {
 		require.Equal(t, want, NormalizeVertexModel(in), "normalize %q", in)
 	}
 }
-
-func TestNormalizeAnthropicModel(t *testing.T) {
-	cases := map[string]string{
-		"claude-sonnet-4-5-20250929":            "claude-sonnet-4-5",
-		"claude-3-5-haiku-20241022":             "claude-3-5-haiku",
-		"claude-sonnet-5":                       "claude-sonnet-5",
-		"claude-opus-4-8":                       "claude-opus-4-8",
-		"anthropic.claude-haiku-4-5":            "anthropic.claude-haiku-4-5",
-		"anthropic.claude-sonnet-4-5-20250929":  "anthropic.claude-sonnet-4-5",
-		"us.anthropic.claude-opus-4-8-20250101": "us.anthropic.claude-opus-4-8",
-		// Non-Claude ids must survive untouched even when they end in eight
-		// consecutive digits: an operator can register a custom model under
-		// any id, and pricing looks every one of them up through this helper.
-		"gpt-4o":                  "gpt-4o",
-		"gpt-4o-2024-08-06":       "gpt-4o-2024-08-06",
-		"gpt-4o-20240806":         "gpt-4o-20240806",
-		"internal-llm-20250101":   "internal-llm-20250101",
-		"deepseek-r1-20250120":    "deepseek-r1-20250120",
-		"Qwen/Qwen2.5-20250101":   "Qwen/Qwen2.5-20250101",
-		"gemini-2-5-pro-20250101": "gemini-2-5-pro-20250101",
-		"":                        "",
-	}
-	for in, want := range cases {
-		require.Equal(t, want, NormalizeAnthropicModel(in), "normalize %q", in)
-	}
-}