@omnicross/daemon 0.1.0 → 0.1.2

package/dist/index.d.cts

@@ -1,10 +1,12 @@
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
 import { OutboundKeyDb, OutboundApiServer } from '@omnicross/core/outbound-api';
 import { ProviderProxy } from '@omnicross/core/provider-proxy';
+import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, SubscriptionProviderRegistry, SubscriptionAccountService } from '@omnicross/subscriptions';
-import { OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, Logger, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow } from '@omnicross/core';
+import { OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, Logger, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow } from '@omnicross/core';
 import http from 'node:http';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
+import { PricingEntry, PricingEntryInput, PricingResolution } from '@omnicross/contracts/pricing-types';
 import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, SubscriptionAccountSanitized } from '@omnicross/contracts/account-tokens-types';
 
@@ -391,6 +393,96 @@ declare function loadConfig(path: string): DaemonConfig;
  *  `enc:` untouched) before serializing. */
 declare function saveConfig(path: string, cfg: DaemonConfig): void;
 
+/**
+ * external-cli-credentials — read-only access to the external CLI native
+ * credential stores (external-cli-sync).
+ *
+ * The daemon never WRITES these files (they belong to the CLIs); it only reads
+ * them back to (a) recover from the rotating-refresh-token race — when e.g.
+ * Claude Code refreshes `~/.claude/.credentials.json` it rotates OUR stored
+ * refresh token out from under us, and the external file then holds the only
+ * live credential — and (b) detect divergence for the account-list warning.
+ *
+ * File shapes (mirrors the shapes the CLIs themselves write):
+ *   claude `~/.claude/.credentials.json`
+ *     → `{ claudeAiOauth: { accessToken, refreshToken?, expiresAt(number ms),
+ *          scopes? } }`
+ *   codex `~/.codex/auth.json`
+ *     → `{ tokens: { id_token?, access_token, refresh_token? } }` — no explicit
+ *       expiry; the access token's JWT `exp` claim is the only expiry signal.
+ *
+ * Gemini is deliberately excluded: the gemini CLI's oauth store is not a
+ * supported import source (parity with the host app's external-sync scope).
+ *
+ * @module @omnicross/daemon/ports/external-cli-credentials
+ */
+/** The two external CLI providers with a readable native store. */
+type ExternalCliProvider = 'claude' | 'codex';
+/**
+ * External credentials parsed OUT of a native store file. Field axes match the
+ * internal `*TokenConfig` shapes: `expiresAt` is an ISO STRING here (converted
+ * from the native ms number / codex JWT `exp`).
+ */
+interface ExternalCliCredentials {
+    accessToken?: string;
+    refreshToken?: string;
+    /** ISO string. */
+    expiresAt?: string;
+    /** codex only. */
+    idToken?: string;
+    /** claude only. */
+    scopes?: string[];
+}
+/** Reader port — injectable so tests never touch the real home directory. */
+type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentials | null;
+
+/**
+ * external-cli-store — WRITE side of the external CLI native credential stores
+ * (external-cli-sync, import + write-back).
+ *
+ * Counterpart of `external-cli-credentials` (the read side). The daemon only
+ * ever writes a file it MANAGES: an explicit "import existing CLI login" puts
+ * an `.omnicross-managed` marker (recording the owning account id) next to the
+ * native store, and every subsequent successful refresh of THAT account writes
+ * the rotated credential back into the file. Without the write-back, the
+ * daemon's refresh would rotate the single-use refresh token and silently log
+ * the user's bare CLI out — the write-back keeps both sides on the same live
+ * credential.
+ *
+ * Safety properties:
+ *  - NEVER writes without a matching marker (an unmanaged / foreign-account
+ *    file is untouched);
+ *  - read-then-merge: unrelated top-level keys in the native file (e.g.
+ *    claude `email`, codex `OPENAI_API_KEY`) are preserved;
+ *  - one-time `.omnicross-backup` of the original file before the FIRST
+ *    overwrite (restorable by hand if the user wants the daemon out);
+ *  - atomic write (temp file → rename) so a crash never leaves a torn file.
+ *
+ * The envelope shapes mirror what the CLIs themselves write — the round-trip
+ * test parses a written file back through `external-cli-credentials` to keep
+ * the two sides from drifting.
+ *
+ * @module @omnicross/daemon/ports/external-cli-store
+ */
+
+/** Token blocks the write-back accepts (the two external-store providers). */
+type ExternalWritableTokens = ClaudeTokenConfig | CodexTokenConfig;
+/**
+ * Injectable port over the external store writes (tests use an in-memory fake;
+ * the store wires `realExternalCliStore`).
+ */
+interface ExternalCliStorePort {
+    /** The owning account id recorded by the marker, or undefined when unmanaged. */
+    readMarkerAccountId(provider: ExternalCliProvider): string | undefined;
+    /** Record (or move) ownership of the provider's native store to an account. */
+    writeMarker(provider: ExternalCliProvider, accountId: string): void;
+    /**
+     * Write the refreshed tokens back into the native store — ONLY when the
+     * marker names `accountId`. Returns true when a write happened.
+     */
+    writeBack(provider: ExternalCliProvider, accountId: string, tokens: ExternalWritableTokens): boolean;
+}
+
 /**
  * JsonSubscriptionCredentialStore — the daemon's file-backed
  * `SubscriptionCredentialStore` port impl (design D1).
@@ -452,6 +544,10 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     private readonly tokensPath;
     private readonly box;
     private readonly fetchImpl;
+    /** Injectable external CLI native-store reader (external-cli-sync). */
+    private readonly externalCliReader;
+    /** Injectable external CLI native-store WRITER (marker-gated write-back). */
+    private readonly externalCliStore;
     /**
      * @param tokensPath  on-disk `tokens.json` location.
      * @param box         at-rest `SecretBox` (encrypt-on-write / decrypt-on-read).
@@ -460,7 +556,20 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      *                    is unchanged; tests inject a mock fetch. NOT used by any
      *                    read/write path — only by `refresh*Token`.
      */
-    constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike);
+    constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike, 
+    /** Injectable external CLI native-store reader (external-cli-sync). */
+    externalCliReader?: ExternalCliReader, 
+    /** Injectable external CLI native-store WRITER (marker-gated write-back). */
+    externalCliStore?: ExternalCliStorePort);
+    /**
+     * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
+     * SINGLE-USE: two concurrent refreshes of one account each spend the same
+     * token and the loser bricks a healthy account. Every refresh entry point
+     * (auth-strategy lazy refresh, 401 retry, background scheduler) funnels
+     * through `coalesce`, so overlapping callers share ONE upstream round-trip.
+     */
+    private readonly inFlightRefreshes;
+    private coalesce;
     /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
      *  file is absent/corrupt). This is the hot read — the codex / gemini auth
      *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
@@ -478,6 +587,17 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * Used by the admin accounts GET (secret-IN-never-OUT).
      */
     listSanitizedAccounts(): Promise<Record<string, SubscriptionAccountSanitized[]>>;
+    /**
+     * List-time credential-conflict warnings (external-cli-sync). Computed, not
+     * persisted: (a) `duplicate-token` when two accounts of one provider share a
+     * credential, (b) `external-divergent` when the external CLI native store has
+     * rotated PAST the ACTIVE account (claude/codex only). A warning persisted by
+     * a failed refresh (`external-not-rotated`) takes precedence — it is the most
+     * actionable state.
+     */
+    private attachSyncWarnings;
+    /** Read the external CLI store, never letting an fs/parse error escape. */
+    private safeReadExternal;
     /**
      * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
      * the block has no refresh_token (setup-token / manual) — no upstream call, the
@@ -501,6 +621,58 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * destroy the ability to refresh again). HONEST `false` when no refresh_token.
      */
     refreshGeminiToken(): Promise<boolean>;
+    /**
+     * Refresh a SPECIFIC account by id (background scheduler sweep,
+     * external-cli-sync). Unlike the active-account refreshers it does NOT
+     * attempt the external-import fallback — the external CLI file's lineage can
+     * only plausibly match the ACTIVE account. Coalesced per `provider:id`; on
+     * failure flags ONLY that account `expired`.
+     */
+    refreshAccountById(provider: 'claude' | 'codex' | 'gemini', id: string): Promise<boolean>;
+    /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
+    private refreshUpstream;
+    /**
+     * External-import fallback for a FAILED active-account refresh
+     * (external-cli-sync). Reads the CLI native store; imports when the external
+     * lineage ROTATED (different refresh token) or its access token is still
+     * valid. When the imported access token is already expired it refreshes once
+     * with the rotated refresh token. A `not-rotated` outcome persists the
+     * `external-not-rotated` warning on the (about-to-be-expired) account so the
+     * UI can tell "genuine revocation" apart from a plain refresh failure.
+     */
+    private tryExternalImport;
+    /**
+     * Marker-gated external write-back (external-cli-sync). After a successful
+     * refresh of the account that OWNS the provider's native CLI store (imported
+     * via `importExternalCliAccount`), push the rotated credential back into the
+     * file — otherwise the daemon's refresh invalidates the single-use refresh
+     * token and silently logs the bare CLI out. NON-FATAL: the internal store is
+     * already persisted; a failed external write only leaves the file stale,
+     * which the `external-divergent` warning surfaces.
+     */
+    private resyncExternal;
+    /** Read the marker's owning account id, never letting an fs error escape. */
+    private safeReadMarker;
+    /**
+     * DAEMON-ONLY (admin import button): which providers have a usable external
+     * CLI credential on THIS machine. Pure detection — reads the native files,
+     * never mutates anything, never returns a token.
+     */
+    listExternalCliAvailability(): Promise<Record<ExternalCliProvider, boolean>>;
+    /**
+     * DAEMON-ONLY (admin import button): import the external CLI's current login
+     * as a NEW account (+ activate), and take MANAGED ownership of the native
+     * store (marker) so subsequent refreshes write back — keeping the bare CLI
+     * and the daemon on the same live credential instead of silently killing one
+     * side's single-use refresh token.
+     */
+    importExternalCliAccount(provider: ExternalCliProvider, label?: string): Promise<{
+        ok: true;
+        id: string;
+    } | {
+        ok: false;
+        reason: 'no-credential';
+    }>;
     /**
      * Materialize a lazily-synthesized account id to disk (design D3). On a legacy
      * single-slot file, `readConfig` synthesizes a NON-deterministic account id
@@ -555,6 +727,14 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     removeAccount(providerId: SubscriptionProviderId, id: string): Promise<{
         removed: boolean;
     }>;
+    /**
+     * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
+     * rejects an unknown id. Label-only — no token material is read or written
+     * (the secret-free invariant holds).
+     */
+    renameAccount(providerId: SubscriptionProviderId, id: string, label: string): Promise<{
+        ok: boolean;
+    }>;
     /**
      * DAEMON-ONLY CLEAR (design D1/D3, NOT on the port). Remove a single provider's
      * block from `tokens.json` and re-persist (the strategies already tolerate an
@@ -614,7 +794,22 @@ interface SubscriptionTokenWriter {
     removeAccount(providerId: SubscriptionProviderId, id: string): Promise<{
         removed: boolean;
     }>;
+    /** Rename one account's label (label-only; rejects an unknown id). */
+    renameAccount(providerId: SubscriptionProviderId, id: string, label: string): Promise<{
+        ok: boolean;
+    }>;
     listSanitizedAccounts(): Promise<Record<string, SubscriptionAccountSanitized[]>>;
+    refreshClaudeToken(): Promise<boolean>;
+    refreshCodexToken(): Promise<boolean>;
+    refreshGeminiToken(): Promise<boolean>;
+    listExternalCliAvailability(): Promise<Record<'claude' | 'codex', boolean>>;
+    importExternalCliAccount(providerId: 'claude' | 'codex', label?: string): Promise<{
+        ok: true;
+        id: string;
+    } | {
+        ok: false;
+        reason: 'no-credential';
+    }>;
 }
 
 /**
@@ -926,6 +1121,109 @@ declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
     private readFile;
 }
 
+/**
+ * JsonPricingStore — the daemon's file-backed `PricingStore` port impl.
+ *
+ * Durable storage for the model pricing table, backed by a pretty-printed json
+ * file (a sibling of `config.json`, `pricing.json` by convention) holding a
+ * `PricingEntry[]`. Reads tolerate a missing/corrupt file (→ empty table);
+ * every mutation rewrites the full array (the table is at most a few thousand
+ * rows — same trade-off as `JsonOutboundKeyDb`). The table starts EMPTY: no
+ * seeding — the first pricing-source refresh (or a manual upsert) populates it.
+ *
+ * Beyond the core port, the store exposes a STORE-LOCAL `delete` (the port is
+ * frozen; the admin DELETE route calls the concrete class and then invalidates
+ * the engine cache).
+ *
+ * @module @omnicross/daemon/ports/JsonPricingStore
+ */
+
+declare class JsonPricingStore implements PricingStore {
+    private readonly pricingPath;
+    constructor(pricingPath: string);
+    getAll(): Promise<PricingEntry[]>;
+    /**
+     * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
+     * user provenance (source 'user', userEdited, editedAt now) so the row is
+     * protected from auto-overwrite during source refreshes; a non-user upsert
+     * stamps source 'litellm' and clears nothing it should not (a plain source
+     * upsert through this method overwrites the row wholesale).
+     */
+    upsert(input: PricingEntryInput, asUserEdit: boolean): Promise<PricingEntry>;
+    /**
+     * Apply a batch fetched from a pricing source. Rows whose local copy is
+     * user-edited are NOT applied — they come back as `{ current, incoming }`
+     * conflicts; everything else is upserted (source 'litellm'). ONE file write
+     * for the whole batch.
+     */
+    bulkApplyFromSource(entries: PricingEntryInput[]): Promise<{
+        applied: PricingEntry[];
+        conflicts: Array<{
+            current: PricingEntry;
+            incoming: PricingEntryInput;
+        }>;
+    }>;
+    /**
+     * Apply per-row conflict decisions: 'overwrite' replaces the local row with
+     * the incoming values (clearing the user-edited mark), 'skip' counts only.
+     */
+    applyResolutions(resolutions: Array<{
+        incoming: PricingEntryInput;
+        action: 'overwrite' | 'skip';
+    }>): Promise<PricingResolution>;
+    /**
+     * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
+     * was actually removed. The admin DELETE handler calls this then invalidates
+     * the engine cache.
+     */
+    delete(providerId: string, modelId: string): Promise<boolean>;
+    /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
+    private applyUpsert;
+    /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
+    private readRows;
+    private writeRows;
+}
+
+/**
+ * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
+ * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
+ *
+ * This is the EXTERNAL-terminal analogue of `commands/launch.ts`: it reuses the
+ * same `@omnicross/cli-launcher` builders (which register one route on the
+ * RESIDENT `ProviderProxy` and return the redirect env — `ANTHROPIC_BASE_URL` +
+ * a one-shot ROUTE token, codex's `-c base_url=…` overrides, etc.), then opens a
+ * NEW terminal window running the CLI with that env injected. The route token —
+ * NOT an upstream credential — is the only secret in the env; it is removed when
+ * the session is stopped (`onSessionEnd`).
+ *
+ * SECRET DISCIPLINE: the env carries a route token (proxy-scoped, revocable),
+ * never a provider key. On win32 the token rides the spawned process environment
+ * (inherited by the terminal), never the command line / a file on disk.
+ *
+ * @module @omnicross/daemon/admin/cliLaunch
+ */
+
+/** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
+type PathProbe = (candidate: string) => string | null;
+/** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
+type TerminalOpener = (input: {
+    cli: string;
+    command: string;
+    extraArgs: string[];
+    env: Record<string, string>;
+    cwd?: string;
+    platform: NodeJS.Platform;
+}) => void;
+/**
+ * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
+ * default execs the install command with a bounded timeout). Returns the host's
+ * honest install outcome — `error` carries stderr/the failure reason.
+ */
+type CommandRunner = (command: string) => Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+
 /**
  * migration.ts — the export gather + import apply logic for the passphrase pack
  * (app-parity child 6, design D2/D3/D5).
@@ -1072,6 +1370,32 @@ interface AdminApiDeps {
      * Wired from the concrete `credentialStore` in `bootstrap.ts`.
      */
     readonly migrationCredentialStore: MigrationCredentialStore;
+    /**
+     * Usage-stats query facade (usage-pricing child) — delegates to the JSONL
+     * usage-event store. Aggregates only; carries no key material.
+     */
+    readonly usageRecorder: UsageRecorder;
+    /** Pricing engine (upsert / source refresh / conflict resolution). */
+    readonly pricingEngine: PricingEngine;
+    /**
+     * CONCRETE pricing store — ONLY for the store-local row `delete` (the core
+     * `PricingStore` port is frozen; delete is a daemon-local extra).
+     */
+    readonly pricingStore: JsonPricingStore;
+    /**
+     * External-terminal opener for the Code CLI launch route (dashboard parity).
+     * Optional — defaults to the real `defaultTerminalOpener`; tests inject a spy so
+     * no terminal window is actually spawned.
+     */
+    readonly cliTerminalOpener?: TerminalOpener;
+    /** Injectable PATH probe for CLI detection (tests fake "installed"). */
+    readonly cliPathProbe?: PathProbe;
+    /**
+     * Injectable shell runner for the Code CLI install route. Optional — defaults
+     * to the real `exec`-based runner; tests inject a stub so no package manager
+     * actually runs.
+     */
+    readonly cliCommandRunner?: CommandRunner;
 }
 /**
  * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
@@ -1098,8 +1422,9 @@ declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerRespo
  *  - HARD SAFETY GATE: `networkBinding` (LAN/`0.0.0.0`) without a non-empty
  *    `admin.token` → `start` REFUSES to bind (logs + stays down, fail closed).
  *
- * Routing: `GET /` (and `GET /admin`) → `DASHBOARD_HTML`; `* /admin/api/*` → the
- * management API (`handleAdminApi`); everything else → `404`.
+ * Routing: `GET /` (and `GET /admin`) → `302 /ui/`; `* /admin/api/*` → the
+ * management API (`handleAdminApi`); `GET /ui[/...]` → the Control Panel static
+ * UI (`handleUiStatic`, from `@omnicross/ui`); everything else → `404`.
  *
  * @module @omnicross/daemon/admin/AdminServer
  */
@@ -1122,6 +1447,8 @@ declare class AdminServer {
     private server;
     private boundPort;
     private boundAddr;
+    /** Control Panel dist dir (resolved once at first request; null = no UI). */
+    private uiDist;
     constructor(deps: AdminServerDeps);
     /**
      * Start the admin listener honoring the resolved admin config. Returns the
@@ -1196,17 +1523,69 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
     private writeRows;
 }
 
+/**
+ * TokenRefreshScheduler — proactive background OAuth token refresh
+ * (external-cli-sync).
+ *
+ * The auth strategies already refresh LAZILY (lead-window check before each
+ * request + 401 retry), but a daemon that sits idle past a token's lifetime
+ * pays the refresh latency — or a dead rotated token — on the first request.
+ * This scheduler sweeps every account of every OAuth provider on an interval
+ * and refreshes any token entering the expiry lead window.
+ *
+ * Safety properties:
+ *  - the store coalesces in-flight refreshes per account, so a sweep can never
+ *    double-spend a single-use refresh token against a concurrent lazy refresh;
+ *  - accounts already flagged `expired` are skipped (a dead refresh token is
+ *    not retried every tick — recovery is the external-import fallback or a
+ *    re-login);
+ *  - the ACTIVE account routes through the provider's active refresher (which
+ *    carries the external CLI import fallback); non-active accounts refresh
+ *    by id;
+ *  - one sweep runs at a time (a long sweep never overlaps the next tick).
+ *
+ * Modeled on `ApiKeyPoolService`'s interval lifecycle: `start()` arms an
+ * `unref()`ed timer, `dispose()` clears it.
+ *
+ * @module @omnicross/daemon/TokenRefreshScheduler
+ */
+
+declare class TokenRefreshScheduler {
+    private readonly store;
+    private readonly logger;
+    private readonly intervalMs;
+    private readonly leadMs;
+    private timer;
+    private sweeping;
+    constructor(store: JsonSubscriptionCredentialStore, logger: Logger, intervalMs?: number, leadMs?: number);
+    /** Arm the sweep interval. Idempotent. The timer never holds the loop open. */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /** One sweep over every account of every OAuth provider. Exposed for tests. */
+    sweep(now?: number): Promise<void>;
+    /** Expiring within the lead window, refreshable, and not already dead. */
+    private needsRefresh;
+    /** Refresh one account; failures are logged, never thrown (the store has
+     *  already flagged the account `expired`). */
+    private refreshOne;
+    private refreshActive;
+}
+
 /**
  * bootstrap.ts — `buildDaemon` wires `@omnicross/core`'s `ProviderProxy` +
  * `OutboundApiServer` STANDALONE (design D6).
  *
  * A DB-backed embedder wires the same `@omnicross/core` surface differently;
- * this standalone wiring makes three SUBSTITUTIONS (file-backed ports replace
- * DB-backed ones) and three SUBTRACTIONS:
+ * this standalone wiring makes SUBSTITUTIONS (file-backed ports replace
+ * DB-backed ones) and SUBTRACTIONS:
  *  - no `CompletionService` (the BYO proxy path doesn't need it),
- *  - no `apiKeyPool` / `usageRecorder` (optional `ProviderProxyDeps`),
  *  - no `anthropicIngressHandlerFactory` (→ `/v1/messages` returns 502 by core's
  *    existing contract — no daemon code needed).
+ * (`apiKeyPool` and `usageRecorder` are NO LONGER subtracted: the pool is wired
+ * for multi-key load balancing, and the usage recorder is wired over the
+ * file-backed pricing/usage stores so every served request is cost-stamped and
+ * persisted to `usage-events.jsonl`.)
  *
  * `getProviderProxy` / `getOutboundApiServer` are module singletons, so the boot
  * smoke test calls `__resetProviderProxyForTests` / `__resetOutboundApiServerForTests`
@@ -1239,6 +1618,21 @@ interface DaemonPaths {
      * hit a real token endpoint. Absent → the global `fetch`.
      */
     oauthExchangeFetch?: FetchLike;
+    /**
+     * TEST SEAM (optional): override the Code CLI external-terminal opener so tests
+     * never spawn a window. Absent → the real `defaultTerminalOpener`.
+     */
+    cliTerminalOpener?: TerminalOpener;
+    /**
+     * TEST SEAM (optional): override the Code CLI PATH probe so tests can fake an
+     * installed CLI. Absent → the real PATH scan.
+     */
+    cliPathProbe?: PathProbe;
+    /**
+     * TEST SEAM (optional): override the Code CLI install command runner so tests
+     * never invoke a real package manager. Absent → the real `exec`-based runner.
+     */
+    cliCommandRunner?: CommandRunner;
 }
 /** The constructed daemon handles the CLI commands operate on. */
 interface Daemon {
@@ -1264,8 +1658,21 @@ interface Daemon {
     /** Subscription account service (token-free `listAll`) — now exposed for the
      *  admin dashboard's read-only accounts panel (RT3). */
     readonly subscriptionAccounts: SubscriptionAccountService;
+    /** File-backed pricing table (`pricing.json`; concrete for the admin DELETE). */
+    readonly pricingStore: JsonPricingStore;
+    /** Pricing engine (cost calc + source refresh + conflict resolution). */
+    readonly pricingEngine: PricingEngine;
+    /** Usage recorder over `usage-events.jsonl` — also the admin stats query facade. */
+    readonly usageRecorder: UsageRecorder;
     /** The localhost admin/dashboard HTTP listener (RT3). Started by `start.ts`. */
     readonly adminServer: AdminServer;
+    /**
+     * Proactive background OAuth refresh sweep (external-cli-sync). NOT started
+     * here — `start.ts` arms it for the resident daemon; the short-lived `launch`
+     * boot leaves it off (the lazy strategy refresh covers a single session) but
+     * still disposes it in cleanup.
+     */
+    readonly tokenRefreshScheduler: TokenRefreshScheduler;
 }
 /**
  * Construct the standalone daemon from a loaded config + on-disk paths. Does NOT
@@ -1291,24 +1698,6 @@ declare function buildDaemon(config: DaemonConfig, paths: DaemonPaths): Daemon;
  * via `daemon.adminServer.stop()`. */
 declare function resetDaemonSingletonsForTests(): void;
 
-/**
- * html.ts — the embedded vanilla-JS admin dashboard (RT3, design D7).
- *
- * A SINGLE `text/html` template literal served by `AdminServer` on `GET /`. No
- * framework, no bundler, no new dependency — vanilla `fetch` + DOM. Panels:
- * providers (table + add/edit form), keys (table + create modal showing the
- * one-time plaintext with a copy button + a "shown once" warning, never
- * persisted), server config, read-only accounts status, and a playground
- * (endpoint select + key + request textarea + Send + response area).
- *
- * SECURITY: the create-key plaintext is held only in a local variable inside the
- * modal flow and cleared on dismiss — never written to a field, list, or storage.
- *
- * @module @omnicross/daemon/admin/html
- */
-/** The full dashboard document (style + body + the vanilla client script). */
-declare const DASHBOARD_HTML: string;
-
 /**
  * ccr-import.ts — translate a `claude-code-router` (CCR) `config.json` into an
  * omnicross daemon config (design D9). Pure + testable: `parseCcrConfig(raw)` +
@@ -1372,4 +1761,4 @@ declare function mapCcrToOmnicross(ccr: CcrConfig): {
     notes: string[];
 };
 
-export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConsoleLogger, DASHBOARD_HTML, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type ResolvedAdminConfig, buildDaemon, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };
+export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConsoleLogger, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type ResolvedAdminConfig, buildDaemon, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };