@omnicross/daemon 0.1.0 → 0.1.2

package/dist/index.js

@@ -11,6 +11,7 @@ import {
   __resetProviderProxyForTests,
   getProviderProxy
 } from "@omnicross/core/provider-proxy";
+import { PricingEngine, UsageRecorder } from "@omnicross/core/usage";
 import {
   setSubscriptionAccountService,
   setSubscriptionProviderRegistry,
@@ -203,23 +204,23 @@ function decodeEnvKey(raw) {
   }
   return buf;
 }
-function readKeyFile(path) {
-  const raw = readFileSync(path);
+function readKeyFile(path2) {
+  const raw = readFileSync(path2);
   if (raw.length === KEY_BYTES2) return raw;
   const text = raw.toString("utf8").trim();
   if (/^[0-9a-fA-F]{64}$/.test(text)) return Buffer.from(text, "hex");
   const b64 = Buffer.from(text, "base64");
   if (b64.length === KEY_BYTES2) return b64;
   throw new Error(
-    `master key file '${path}' is invalid: expected 32 raw bytes, 64 hex chars, or 32-byte base64`
+    `master key file '${path2}' is invalid: expected 32 raw bytes, 64 hex chars, or 32-byte base64`
   );
 }
-function generateKeyFile(path) {
+function generateKeyFile(path2) {
   const key = randomBytes2(KEY_BYTES2);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, key, { mode: 384 });
+  mkdirSync(dirname(path2), { recursive: true });
+  writeFileSync(path2, key, { mode: 384 });
   try {
-    chmodSync(path, 384);
+    chmodSync(path2, 384);
   } catch {
   }
   return key;
@@ -598,25 +599,25 @@ var secretBox = null;
 function setSecretBox(box) {
   secretBox = box;
 }
-function loadConfig(path) {
+function loadConfig(path2) {
   let raw;
   try {
-    raw = readFileSync2(path, "utf8");
+    raw = readFileSync2(path2, "utf8");
   } catch {
-    throw new Error(`config: cannot read file at '${path}'`);
+    throw new Error(`config: cannot read file at '${path2}'`);
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`config: '${path}' is not valid JSON`);
+    throw new Error(`config: '${path2}' is not valid JSON`);
   }
   const validated = validateConfig(parsed);
   return secretBox ? decryptConfigSecrets(validated, secretBox) : validated;
 }
-function saveConfig(path, cfg) {
+function saveConfig(path2, cfg) {
   const toWrite = secretBox ? encryptConfigSecrets(cfg, secretBox) : cfg;
-  writeFileSync2(path, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
+  writeFileSync2(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
 }
 
 // src/pool/resolveEnvKey.ts
@@ -862,7 +863,8 @@ async function handleOAuthComplete(providerId, body, deps) {
     const reason = exchangeError instanceof Error ? exchangeError.message : "token exchange failed";
     return err2(502, `oauth token exchange failed for '${providerId}': ${reason}`);
   }
-  await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block);
+  const label = typeof body["label"] === "string" && body["label"].trim() ? body["label"].trim() : void 0;
+  await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
   const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
   return { status: 200, body: status ? { account: status } : { ok: true } };
 }
@@ -895,8 +897,207 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
   };
 }
 
-// src/ports/account-multi.ts
+// src/admin/cliLaunch.ts
+import { exec, spawn } from "child_process";
 import { randomUUID } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { delimiter, join as join2 } from "path";
+import {
+  buildChatCliLaunchConfig,
+  buildClaudeCliLaunchConfig,
+  buildCodexLaunchConfig,
+  buildGeminiCliLaunchConfig
+} from "@omnicross/cli-launcher";
+var LAUNCHABLE_CLIS = [
+  { id: "claude", displayName: "Claude Code", command: "claude" },
+  { id: "codex", displayName: "Codex CLI", command: "codex" },
+  { id: "gemini", displayName: "Gemini CLI", command: "gemini" },
+  { id: "qwen", displayName: "Qwen Code", command: "qwen" },
+  { id: "copilot", displayName: "GitHub Copilot CLI", command: "copilot" },
+  { id: "opencode", displayName: "OpenCode", command: "opencode" }
+];
+var INSTALL_COMMANDS = {
+  claude: "npm install -g @anthropic-ai/claude-code",
+  codex: "npm install -g @openai/codex",
+  gemini: "npm install -g @google/gemini-cli",
+  qwen: "npm install -g @qwen-code/qwen-code",
+  copilot: "npm install -g @github/copilot",
+  opencode: "npm install -g opencode-ai"
+};
+var LAUNCHABLE_IDS = new Set(LAUNCHABLE_CLIS.map((c) => c.id));
+function isLaunchCliId(id) {
+  return id !== void 0 && LAUNCHABLE_IDS.has(id);
+}
+function probeDefault(candidate) {
+  const segments = (process.env["PATH"] ?? "").split(delimiter).filter(Boolean);
+  for (const seg of segments) {
+    const full = join2(seg, candidate);
+    if (existsSync2(full)) return full;
+  }
+  return null;
+}
+function isCliInstalled(command, platform = process.platform, probe = probeDefault) {
+  if (platform === "win32") {
+    return Boolean(probe(`${command}.exe`) || probe(`${command}.cmd`) || probe(`${command}.bat`));
+  }
+  return Boolean(probe(command));
+}
+function detectClis(platform = process.platform, probe = probeDefault) {
+  return LAUNCHABLE_CLIS.map((c) => ({
+    id: c.id,
+    displayName: c.displayName,
+    command: c.command,
+    installed: isCliInstalled(c.command, platform, probe),
+    installable: Boolean(INSTALL_COMMANDS[c.id])
+  }));
+}
+function resolveLaunchTarget(providers, requested) {
+  const pick = (requested?.providerId ? providers.find((p) => p.id === requested.providerId) : void 0) ?? providers.find((p) => p.enabled !== false && firstModel(p)) ?? providers.find((p) => firstModel(p));
+  if (!pick) {
+    throw new Error("no provider with a model is configured \u2014 add one on the Providers page first");
+  }
+  const model = requested?.model || firstModel(pick);
+  if (!model) {
+    throw new Error(`provider "${pick.id}" has no models \u2014 add a model on the Providers page first`);
+  }
+  return { providerId: pick.id, model };
+}
+function firstModel(p) {
+  return p.models?.[0] ?? p.modelConfigs?.[0]?.id;
+}
+async function buildLaunchEnv(cli, llmConfig, target) {
+  const common = {
+    llmConfig,
+    providerId: target.providerId,
+    model: target.model,
+    sessionId: `dashboard:${cli}`
+  };
+  switch (cli) {
+    case "claude":
+      return buildClaudeCliLaunchConfig(common);
+    case "codex":
+      return buildCodexLaunchConfig(common);
+    case "gemini":
+      return buildGeminiCliLaunchConfig(common);
+    case "qwen":
+    case "copilot":
+    case "opencode":
+      return buildChatCliLaunchConfig({ backendId: cli, ...common });
+  }
+}
+function shq(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+var defaultTerminalOpener = ({ cli, command, extraArgs, env, cwd, platform }) => {
+  const childEnv = { ...process.env, ...env };
+  if (platform === "win32") {
+    const args = ["/c", "start", `"omnicross ${cli}"`];
+    if (cwd) args.push("/D", `"${cwd}"`);
+    args.push("cmd", "/k", command, ...extraArgs);
+    spawn(process.env["ComSpec"] || "cmd.exe", args, {
+      env: childEnv,
+      windowsVerbatimArguments: true,
+      detached: true,
+      stdio: "ignore"
+    }).unref();
+    return;
+  }
+  const exportLine = Object.entries(env).map(([k, v]) => `export ${k}=${shq(v)}`).join("; ");
+  const runLine = [command, ...extraArgs].map(shq).join(" ");
+  const script = `${exportLine}; ${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
+  if (platform === "darwin") {
+    const osa = `tell application "Terminal" to do script ${JSON.stringify(script)}`;
+    spawn("osascript", ["-e", osa], { detached: true, stdio: "ignore" }).unref();
+    return;
+  }
+  spawn("x-terminal-emulator", ["-e", "bash", "-lc", `${script}; exec bash`], {
+    detached: true,
+    stdio: "ignore"
+  }).unref();
+};
+var sessions = /* @__PURE__ */ new Map();
+function errBody(message) {
+  return { error: { type: "admin_api_error", message } };
+}
+var defaultCommandRunner = (command) => new Promise((resolve) => {
+  exec(command, { timeout: 18e4 }, (err5, _stdout, stderr) => {
+    if (err5) resolve({ ok: false, error: stderr.trim() || err5.message });
+    else resolve({ ok: true });
+  });
+});
+async function handleCliInstall(cli, runner = defaultCommandRunner) {
+  const cmd = INSTALL_COMMANDS[cli];
+  if (!cmd) {
+    return { status: 400, body: errBody(`no install command for cli '${cli}' (manual install only)`) };
+  }
+  const result = await runner(cmd);
+  if (!result.ok) {
+    return { status: 500, body: errBody(result.error || "install failed") };
+  }
+  return { status: 200, body: { ok: true } };
+}
+function handleCliList(platform = process.platform, probe = probeDefault) {
+  return { status: 200, body: { clis: detectClis(platform, probe) } };
+}
+function handleCliSessions() {
+  const list = [...sessions.values()].map(({ onSessionEnd: _drop, ...rest }) => rest);
+  return { status: 200, body: { sessions: list } };
+}
+function handleCliStop(id) {
+  const s = sessions.get(id);
+  if (!s) return { status: 404, body: errBody(`session '${id}' not found`) };
+  try {
+    s.onSessionEnd();
+  } catch {
+  }
+  sessions.delete(id);
+  return { status: 200, body: { ok: true } };
+}
+async function handleCliLaunch(cli, body, ctx) {
+  const platform = ctx.platform ?? process.platform;
+  const probe = ctx.probe ?? probeDefault;
+  const meta = LAUNCHABLE_CLIS.find((c) => c.id === cli);
+  if (!meta) return { status: 404, body: errBody(`unknown cli '${cli}'`) };
+  if (!isCliInstalled(meta.command, platform, probe)) {
+    return { status: 400, body: errBody(`"${meta.command}" is not installed (not found on PATH)`) };
+  }
+  let target;
+  try {
+    target = resolveLaunchTarget(ctx.providers, {
+      providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
+      model: typeof body["model"] === "string" ? body["model"] : void 0
+    });
+  } catch (err5) {
+    return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "no launch target") };
+  }
+  let launch;
+  try {
+    launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+  } catch (err5) {
+    return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "failed to build launch env") };
+  }
+  const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
+  const opener = ctx.opener ?? defaultTerminalOpener;
+  try {
+    opener({ cli, command: meta.command, extraArgs: launch.extraArgs ?? [], env: launch.env, cwd, platform });
+  } catch (err5) {
+    launch.onSessionEnd();
+    return { status: 500, body: errBody(err5 instanceof Error ? err5.message : "failed to open terminal") };
+  }
+  const id = randomUUID();
+  sessions.set(id, {
+    id,
+    cli,
+    providerId: target.providerId,
+    model: target.model,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    onSessionEnd: launch.onSessionEnd
+  });
+  return { status: 200, body: { sessionId: id, providerId: target.providerId, model: target.model } };
+}
+
+// src/ports/account-multi.ts
+import { randomUUID as randomUUID2 } from "crypto";
 var PROVIDER_KEYS = {
   claude: { block: "claude", accounts: "claudeAccounts", active: "activeClaudeAccountId" },
   codex: { block: "codex", accounts: "codexAccounts", active: "activeCodexAccountId" },
@@ -962,7 +1163,7 @@ function migrateLazily(config) {
 }
 function addAccount(config, p, tokens, label) {
   const accounts = [...getAccounts(config, p)];
-  const id = randomUUID();
+  const id = randomUUID2();
   accounts.push({
     id,
     label: label ?? `Account ${accounts.length + 1}`,
@@ -999,6 +1200,13 @@ function setActiveAccount(config, p, id) {
   deriveMirror(config, p);
   return { ok: true };
 }
+function listAccounts(config, p) {
+  return getAccounts(config, p);
+}
+function getAccountById(config, p, id) {
+  const account = getAccounts(config, p).find((a) => a.id === id);
+  return account ? { id: account.id, tokens: account.tokens } : void 0;
+}
 function getActiveAccount(config, p) {
   const active = getAccounts(config, p).find((a) => a.id === getActiveId(config, p));
   return active ? { id: active.id, tokens: active.tokens } : void 0;
@@ -1032,12 +1240,27 @@ function sanitizeAccounts(config, p) {
       id: a.id,
       label: a.label,
       status: t.status ?? "unconfigured",
+      authMethod: t.authMethod,
+      subscriptionLevel: t.subscriptionLevel,
       expiresAt: t.expiresAt,
+      lastRefreshedAt: t.lastRefreshedAt,
+      isSetupToken: t.isSetupToken,
       hasAccessToken: !!(t.accessToken || t.apiKey),
-      isActive: a.id === activeId
+      isActive: a.id === activeId,
+      syncWarning: t.syncWarning
     };
   });
 }
+function renameAccount(config, p, id, label) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { ok: false };
+  setAccounts(
+    config,
+    p,
+    accounts.map((a) => a.id === id ? { ...a, label } : a)
+  );
+  return { ok: true };
+}
 function clearProvider(config, p) {
   setBlock(config, p, void 0);
   setAccounts(config, p, void 0);
@@ -1284,6 +1507,169 @@ async function handleImport(body, deps) {
   }
 }
 
+// src/admin/usagePricing.ts
+var err4 = (status, message) => ({
+  status,
+  body: { error: { type: "admin_api_error", message } }
+});
+function parseFiniteInt(raw) {
+  if (raw === null || raw.trim() === "") return null;
+  const n = Number(raw);
+  return Number.isFinite(n) && Number.isInteger(n) ? n : null;
+}
+function parseRange(query) {
+  const startTs = parseFiniteInt(query.get("startTs"));
+  const endTs = parseFiniteInt(query.get("endTs"));
+  if (startTs === null || endTs === null) {
+    return err4(400, "startTs and endTs are required finite-integer unix-millis query params");
+  }
+  return { startTs, endTs };
+}
+var isRange = (v) => v.startTs !== void 0 && !("status" in v);
+async function handleUsageGet(view, query, deps) {
+  const range = parseRange(query);
+  if (!isRange(range)) return range;
+  switch (view) {
+    case "totals":
+      return { status: 200, body: await deps.usageRecorder.getTotals(range) };
+    case "by-model":
+      return { status: 200, body: await deps.usageRecorder.getByModel(range) };
+    case "by-api-key": {
+      const rows = await deps.usageRecorder.getByApiKey(range);
+      const labels = poolKeyLabels(loadConfig(deps.configPath));
+      return {
+        status: 200,
+        body: rows.map((r) => {
+          if (r.apiKeyId === null) {
+            return { ...r, label: "unattributed", providerId: null };
+          }
+          const known = labels.get(r.apiKeyId);
+          return known ? { ...r, label: known.label, providerId: known.providerId } : { ...r, label: r.apiKeyId };
+        })
+      };
+    }
+    default:
+      return err4(404, `unknown usage view '${view ?? ""}'`);
+  }
+}
+function poolKeyLabels(cfg) {
+  const out = /* @__PURE__ */ new Map();
+  for (const provider of cfg.providers) {
+    for (const key of provider.apiKeys ?? []) {
+      out.set(key.id, {
+        label: key.label && key.label.length > 0 ? key.label : key.id,
+        providerId: provider.id
+      });
+    }
+  }
+  return out;
+}
+var INVALID_PRICE = /* @__PURE__ */ Symbol("invalid-price");
+function parseOptionalPrice(b, key) {
+  if (!(key in b) || b[key] === null || b[key] === void 0) return null;
+  const v = b[key];
+  return typeof v === "number" && Number.isFinite(v) ? v : INVALID_PRICE;
+}
+function parsePricingEntryInput(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const b = raw;
+  const providerId = typeof b["providerId"] === "string" && b["providerId"].trim() ? b["providerId"].trim() : "";
+  const modelId = typeof b["modelId"] === "string" && b["modelId"].trim() ? b["modelId"].trim() : "";
+  const inputPrice = b["inputPricePer1m"];
+  const outputPrice = b["outputPricePer1m"];
+  if (!providerId || !modelId) return null;
+  if (typeof inputPrice !== "number" || !Number.isFinite(inputPrice)) return null;
+  if (typeof outputPrice !== "number" || !Number.isFinite(outputPrice)) return null;
+  const cacheRead = parseOptionalPrice(b, "cacheReadPricePer1m");
+  const cacheWrite = parseOptionalPrice(b, "cacheWritePricePer1m");
+  if (cacheRead === INVALID_PRICE || cacheWrite === INVALID_PRICE) return null;
+  return {
+    providerId,
+    modelId,
+    inputPricePer1m: inputPrice,
+    outputPricePer1m: outputPrice,
+    cacheReadPricePer1m: cacheRead,
+    cacheWritePricePer1m: cacheWrite
+  };
+}
+async function handlePricingList(deps) {
+  return { status: 200, body: { entries: await deps.pricingEngine.getAll() } };
+}
+async function handlePricingUpsert(body, deps) {
+  const input = parsePricingEntryInput(body);
+  if (!input) {
+    return err4(400, "invalid pricing entry (providerId, modelId, finite numeric inputPricePer1m/outputPricePer1m required)");
+  }
+  const entry = await deps.pricingEngine.upsertManual(input);
+  return { status: 200, body: { entry } };
+}
+async function handlePricingDelete(query, deps) {
+  const providerId = query.get("providerId")?.trim() ?? "";
+  const modelId = query.get("modelId")?.trim() ?? "";
+  if (!providerId || !modelId) {
+    return err4(400, "delete requires providerId and modelId query params");
+  }
+  const deleted = await deps.pricingStore.delete(providerId, modelId);
+  if (deleted) await deps.pricingEngine.invalidateCache();
+  return { status: 200, body: { deleted } };
+}
+async function handlePricingFetchLatest(deps) {
+  try {
+    const result = await deps.pricingEngine.fetchLatestFromSource();
+    return {
+      status: 200,
+      body: {
+        appliedCount: result.applied.length,
+        conflicts: result.conflicts,
+        fetchedAt: result.fetchedAt,
+        sourceUrl: result.sourceUrl
+      }
+    };
+  } catch (e) {
+    return err4(502, `pricing-source fetch failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function handlePricingResolveConflicts(body, deps) {
+  const raw = body["resolutions"];
+  if (!Array.isArray(raw)) {
+    return err4(400, "resolve-conflicts requires { resolutions: [...] }");
+  }
+  const currentRows = await deps.pricingStore.getAll();
+  const userEditedKeys = new Set(
+    currentRows.filter((r) => r.userEdited).map((r) => `${r.providerId}::${r.modelId}`)
+  );
+  const decisions = [];
+  const pendingIncoming = /* @__PURE__ */ new Map();
+  let staleCount = 0;
+  for (const item of raw) {
+    if (!item || typeof item !== "object") return err4(400, "invalid resolution entry");
+    const r = item;
+    const action = r["action"];
+    if (action !== "overwrite" && action !== "skip") {
+      return err4(400, "resolution action must be 'overwrite' or 'skip'");
+    }
+    const providerId = typeof r["providerId"] === "string" && r["providerId"].trim() ? r["providerId"].trim() : "";
+    const modelId = typeof r["modelId"] === "string" && r["modelId"].trim() ? r["modelId"].trim() : "";
+    if (!providerId || !modelId) {
+      return err4(400, "each resolution requires top-level providerId and modelId");
+    }
+    const incoming = parsePricingEntryInput(r["incoming"]);
+    if (!incoming) return err4(400, "each resolution must echo a valid incoming pricing entry");
+    if (incoming.providerId !== providerId || incoming.modelId !== modelId) {
+      return err4(400, "resolution providerId/modelId must match the echoed incoming entry");
+    }
+    const key = `${providerId}::${modelId}`;
+    if (action === "overwrite" && !userEditedKeys.has(key)) {
+      staleCount += 1;
+      continue;
+    }
+    decisions.push({ providerId, modelId, action });
+    pendingIncoming.set(key, incoming);
+  }
+  const resolution = await deps.pricingEngine.resolveConflicts(decisions, pendingIncoming);
+  return { status: 200, body: { ...resolution, staleCount } };
+}
+
 // src/admin/adminApi.ts
 function readBody(req) {
   return new Promise((resolve, reject) => {
@@ -1374,9 +1760,9 @@ function toProviderView(row) {
     selectedApiModeId: row.selectedApiModeId
   };
 }
-async function handleAdminApi(req, res, path, deps) {
+async function handleAdminApi(req, res, path2, deps) {
   const method = (req.method ?? "GET").toUpperCase();
-  const sub = path.slice("/admin/api/".length);
+  const sub = path2.slice("/admin/api/".length);
   const [resource, ...rest] = sub.split("/").filter((s) => s.length > 0);
   try {
     switch (resource) {
@@ -1390,6 +1776,8 @@ async function handleAdminApi(req, res, path, deps) {
         return await handleServer(req, res, method, deps);
       case "accounts":
         return await handleAccounts(req, res, method, rest, deps);
+      case "cli":
+        return await handleCli(req, res, method, rest, deps);
       case "status":
         return await handleStatus(res, method, deps);
       case "playground":
@@ -1398,13 +1786,48 @@ async function handleAdminApi(req, res, path, deps) {
         return await handleMigrationExport(req, res, method, deps);
       case "import":
         return await handleMigrationImport(req, res, method, deps);
+      case "usage":
+        return await handleUsage(req, res, method, rest, deps);
+      case "pricing":
+        return await handlePricing(req, res, method, rest, deps);
       default:
         return writeJsonError(res, 404, `unknown admin resource '${resource}'`);
     }
-  } catch (err4) {
-    writeJsonError(res, 500, err4 instanceof Error ? err4.message : String(err4));
+  } catch (err5) {
+    writeJsonError(res, 500, err5 instanceof Error ? err5.message : String(err5));
   }
 }
+function requestQuery(req) {
+  const raw = req.url ?? "";
+  const qIdx = raw.indexOf("?");
+  return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
+}
+function writeResult(res, result) {
+  writeJson(res, result.status, result.body);
+}
+async function handleUsage(req, res, method, rest, deps) {
+  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
+  return writeResult(res, await handleUsageGet(rest[0], requestQuery(req), deps));
+}
+async function handlePricing(req, res, method, rest, deps) {
+  if (rest.length === 0) {
+    if (method === "GET") return writeResult(res, await handlePricingList(deps));
+    if (method === "PUT") {
+      return writeResult(res, await handlePricingUpsert(await readJsonBody(req), deps));
+    }
+    if (method === "DELETE") {
+      return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
+    }
+    return writeJsonError(res, 405, `method ${method} not allowed on pricing`);
+  }
+  if (method === "POST" && rest.length === 1 && rest[0] === "fetch-latest") {
+    return writeResult(res, await handlePricingFetchLatest(deps));
+  }
+  if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody(req), deps));
+  }
+  return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
+}
 function migrationDeps(deps) {
   return {
     configPath: deps.configPath,
@@ -1451,6 +1874,11 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "POST" && rest.length === 2 && rest[1] === "test") {
     return await handleTestModel(req, res, rest[0], cfg);
   }
+  if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
+    const row = cfg.providers.find((p) => p.id === rest[0]);
+    if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
+    return writeJson(res, 200, { apiKey: row.apiKey ?? "" });
+  }
   if (method === "GET") {
     return writeJson(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
@@ -1546,8 +1974,8 @@ async function handleDiscoverModels(res, id, cfg) {
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
     return writeJson(res, 200, { models });
-  } catch (err4) {
-    const message = err4 instanceof Error ? err4.message : String(err4);
+  } catch (err5) {
+    const message = err5 instanceof Error ? err5.message : String(err5);
     return writeJson(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
@@ -1606,8 +2034,8 @@ async function handleTestModel(req, res, id, cfg) {
       latencyMs,
       sample: extractSampleText(text, row.apiFormat)
     });
-  } catch (err4) {
-    const message = err4 instanceof Error ? err4.message : String(err4);
+  } catch (err5) {
+    const message = err5 instanceof Error ? err5.message : String(err5);
     return writeJson(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
@@ -1956,7 +2384,8 @@ async function handleAccounts(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
-    return writeJson(res, 200, { accounts, providerAccounts });
+    const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
+    return writeJson(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
@@ -1976,6 +2405,47 @@ async function handleAccounts(req, res, method, rest, deps) {
       const result = await handleOAuthComplete(providerId, body2, deps);
       return writeJson(res, result.status, result.body);
     }
+    if (method === "POST" && rest[1] === "accounts") {
+      const body2 = await readJsonBody(req);
+      const block = validateTokenBody(providerId, body2);
+      if (!block) {
+        return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
+      }
+      const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
+      await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
+      const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
+      return writeJson(res, 200, status2 ? { account: status2 } : { ok: true });
+    }
+    if (method === "POST" && rest[1] === "import-external") {
+      if (providerId !== "claude" && providerId !== "codex") {
+        return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
+      }
+      const body2 = await readJsonBody(req);
+      const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
+      const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
+      if (!result.ok) {
+        return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
+      }
+      const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
+      return writeJson(res, 200, { ok: true, account: status2 ?? void 0 });
+    }
+    if (method === "POST" && rest[1] === "refresh") {
+      if (providerId === "opencodego") {
+        return writeJsonError(res, 400, "opencodego credentials are not refreshable");
+      }
+      const writer = deps.subscriptionTokenWriter;
+      const ok = providerId === "claude" ? await writer.refreshClaudeToken() : providerId === "codex" ? await writer.refreshCodexToken() : await writer.refreshGeminiToken();
+      const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
+      return writeJson(res, 200, { ok, account: status2 ?? void 0 });
+    }
+    if (method === "POST" && rest[2] === "label") {
+      const accountId = rest[1];
+      const body2 = await readJsonBody(req);
+      const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
+      const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
+      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJson(res, 200, { ok: true });
+    }
     if (method === "PUT" && rest[1] === "active") {
       const body2 = await readJsonBody(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
@@ -2005,6 +2475,44 @@ async function handleAccounts(req, res, method, rest, deps) {
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
+async function handleCli(req, res, method, rest, deps) {
+  if (method === "GET" && rest.length === 0) {
+    const result = handleCliList(process.platform, deps.cliPathProbe);
+    return writeJson(res, result.status, result.body);
+  }
+  if (method === "GET" && rest[0] === "sessions") {
+    const result = handleCliSessions();
+    return writeJson(res, result.status, result.body);
+  }
+  if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
+    const result = handleCliStop(rest[1]);
+    return writeJson(res, result.status, result.body);
+  }
+  if (method === "POST" && rest[1] === "install") {
+    const cli = rest[0];
+    if (!isLaunchCliId(cli)) {
+      return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
+    }
+    const result = await handleCliInstall(cli, deps.cliCommandRunner);
+    return writeJson(res, result.status, result.body);
+  }
+  if (method === "POST" && rest[1] === "launch") {
+    const cli = rest[0];
+    if (!isLaunchCliId(cli)) {
+      return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
+    }
+    const body = await readJsonBody(req);
+    const providers = loadConfig(deps.configPath).providers ?? [];
+    const result = await handleCliLaunch(cli, body, {
+      llmConfig: deps.llmConfig,
+      providers,
+      opener: deps.cliTerminalOpener,
+      probe: deps.cliPathProbe
+    });
+    return writeJson(res, result.status, result.body);
+  }
+  return writeJsonError(res, 405, `method ${method} not allowed on cli`);
+}
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
@@ -2040,21 +2548,21 @@ async function handlePlayground(req, res, method, deps) {
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path = resolvePlaygroundPath(endpoint, isRecord(payload) ? payload : {});
-  if (!path) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
+  const path2 = resolvePlaygroundPath(endpoint, isRecord(payload) ? payload : {});
+  if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
-  await proxyToOutbound(res, status.port, path, key, upstreamBody);
+  await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
 function isRecord(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function proxyToOutbound(res, outboundPort, path, key, body) {
+function proxyToOutbound(res, outboundPort, path2, key, body) {
   return new Promise((resolve) => {
     const upstream = http.request(
       {
         host: "127.0.0.1",
         port: outboundPort,
-        path,
+        path: path2,
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -2074,8 +2582,8 @@ function proxyToOutbound(res, outboundPort, path, key, body) {
         });
       }
     );
-    upstream.on("error", (err4) => {
-      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err4.message}`);
+    upstream.on("error", (err5) => {
+      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err5.message}`);
       else res.end();
       resolve();
     });
@@ -2084,463 +2592,105 @@ function proxyToOutbound(res, outboundPort, path, key, body) {
   });
 }
 
-// src/admin/client.ts
-var DASHBOARD_JS = String.raw`
-(function () {
-  var $ = function (id) { return document.getElementById(id); };
-  var authToken = null; // set if a 401 ever comes back (token-gated deploys)
-
-  function headers(extra) {
-    var h = extra || {};
-    if (authToken) h['Authorization'] = 'Bearer ' + authToken;
-    return h;
-  }
-
-  async function api(method, path, body) {
-    var opt = { method: method, headers: headers(body ? { 'Content-Type': 'application/json' } : {}) };
-    if (body) opt.body = JSON.stringify(body);
-    var res = await fetch('/admin/api/' + path, opt);
-    if (res.status === 401 && !authToken) {
-      var t = window.prompt('Admin token required');
-      if (t) { authToken = t; return api(method, path, body); }
-    }
-    var text = await res.text();
-    var json = null;
-    try { json = text ? JSON.parse(text) : null; } catch (e) { json = { raw: text }; }
-    return { status: res.status, json: json };
-  }
-
-  function clear(el) { while (el.firstChild) el.removeChild(el.firstChild); }
-  function td(text) { var c = document.createElement('td'); c.textContent = text == null ? '' : String(text); return c; }
-  function btn(label, cls, fn) { var b = document.createElement('button'); b.textContent = label; if (cls) b.className = cls; b.onclick = fn; return b; }
-
-  // ── Status ────────────────────────────────────────────────────────────────
-  async function loadStatus() {
-    var r = await api('GET', 'status');
-    var s = r.json || {};
-    $('statusBadge').textContent = s.running ? ('running :' + s.port) : 'stopped';
-    var html = '';
-    if (s.running) {
-      html += 'Outbound server <span class="pill ok">running</span> on port ' + s.port + '<br/>';
-      if (s.formats) {
-        html += '<div class="mono muted">' +
-          'chat: ' + s.formats.chat + '<br/>responses: ' + s.formats.responses +
-          '<br/>messages: ' + s.formats.messages + '<br/>gemini: ' + s.formats.gemini + '</div>';
-      }
-    } else {
-      html += 'Outbound server <span class="pill bad">stopped</span>';
-    }
-    $('statusBody').innerHTML = html;
-  }
-
-  // ── Providers ───────────────────────────────────────────────────────────────
-  // Curated presets loaded from GET /admin/api/presets. Selecting one prefills
-  // the add-form (format/base/models); the WRITE still goes through the existing
-  // POST/PUT /admin/api/providers path (no new write endpoint).
-  var presetsById = {};
-  var presetModels = []; // models staged by the last preset prefill
-
-  async function loadPresets() {
-    var r = await api('GET', 'presets');
-    var sel = $('pPreset');
-    // Keep the placeholder; drop any previously appended options.
-    while (sel.options.length > 1) sel.remove(1);
-    presetsById = {};
-    (r.json && r.json.presets || []).forEach(function (p) {
-      presetsById[p.id] = p;
-      var opt = document.createElement('option');
-      opt.value = p.id;
-      opt.textContent = p.name + ' (' + p.apiFormat + ')';
-      sel.appendChild(opt);
-    });
-  }
-
-  function onPresetChange() {
-    var p = presetsById[$('pPreset').value];
-    if (!p) { presetModels = []; return; }
-    if (!$('pId').value.trim()) $('pId').value = p.id;
-    $('pFormat').value = p.apiFormat;
-    $('pBase').value = p.baseUrl;
-    presetModels = Array.isArray(p.models) ? p.models.slice() : [];
-  }
-
-  async function loadProviders() {
-    var r = await api('GET', 'providers');
-    var body = $('providersTable').querySelector('tbody');
-    clear(body);
-    (r.json && r.json.providers || []).forEach(function (p) {
-      var tr = document.createElement('tr');
-      tr.appendChild(td(p.id));
-      tr.appendChild(td(p.apiFormat));
-      tr.appendChild(td(p.baseUrl));
-      tr.appendChild(td(p.hasApiKey ? p.apiKeyMasked : '(none)'));
-      var act = document.createElement('td');
-      act.appendChild(btn('Edit', 'secondary', function () {
-        $('pId').value = p.id; $('pFormat').value = p.apiFormat; $('pBase').value = p.baseUrl; $('pKey').value = '';
-      }));
-      act.appendChild(btn('Pool', 'secondary', function () { loadProviderKeys(p.id); }));
-      act.appendChild(btn('Delete', 'danger', async function () {
-        if (window.confirm('Delete provider ' + p.id + '?')) { await api('DELETE', 'providers/' + encodeURIComponent(p.id)); loadProviders(); }
-      }));
-      tr.appendChild(act);
-      body.appendChild(tr);
-    });
-  }
-
-  // ── Pool health (read-only; key-pool change) ──────────────────────────────
-  // GET /admin/api/providers/:id/keys → masked pool view. Multi-key is
-  // cold-standby + observable in v1 (no outbound failover yet — see panel note).
-  async function loadProviderKeys(providerId) {
-    var r = await api('GET', 'providers/' + encodeURIComponent(providerId) + '/keys');
-    var panel = $('poolPanel');
-    var body = $('poolTable').querySelector('tbody');
-    clear(body);
-    $('poolTitle').textContent = 'API key pool — ' + providerId;
-    (r.json && r.json.keys || []).forEach(function (k) {
-      var tr = document.createElement('tr');
-      tr.appendChild(td(k.id));
-      tr.appendChild(td(k.label));
-      tr.appendChild(td(k.apiKeyMasked));
-      tr.appendChild(td(k.enabled ? 'yes' : 'no'));
-      tr.appendChild(td(k.weight));
-      var h = '';
-      if (k.health && k.health.autoDisabled) h += 'auto-disabled (' + k.health.autoDisabled.status + ') ';
-      if (k.health && k.health.cooldown) h += 'cooldown until ' + new Date(k.health.cooldown.until).toLocaleTimeString();
-      tr.appendChild(td(h || 'ok'));
-      body.appendChild(tr);
-    });
-    panel.style.display = 'block';
-  }
-
-  async function saveProvider() {
-    $('pErr').textContent = '';
-    var id = $('pId').value.trim();
-    if (!id) { $('pErr').textContent = 'id required'; return; }
-    var payload = { id: id, apiFormat: $('pFormat').value, baseUrl: $('pBase').value.trim(), apiKey: $('pKey').value };
-    // Carry the preset-prefilled models (existing parseProviderInput accepts them).
-    if (presetModels.length) payload.models = presetModels;
-    // Try PUT first (edit, blank key keeps existing); fall back to POST (create).
-    var r = await api('PUT', 'providers/' + encodeURIComponent(id), payload);
-    if (r.status === 404) r = await api('POST', 'providers', payload);
-    if (r.status >= 400) { $('pErr').textContent = (r.json && r.json.error && r.json.error.message) || ('error ' + r.status); return; }
-    $('pId').value = ''; $('pBase').value = ''; $('pKey').value = '';
-    $('pPreset').value = ''; presetModels = []; // reset the picker after a write
-    loadProviders();
-  }
-
-  // ── Keys ────────────────────────────────────────────────────────────────────
-  async function loadKeys() {
-    var r = await api('GET', 'keys');
-    var body = $('keysTable').querySelector('tbody');
-    clear(body);
-    (r.json && r.json.keys || []).forEach(function (k) {
-      var tr = document.createElement('tr');
-      tr.appendChild(td(k.name));
-      tr.appendChild(td(k.keyPrefix));
-      tr.appendChild(td(k.enabled ? 'yes' : 'no'));
-      tr.appendChild(td(k.revoked ? 'yes' : 'no'));
-      var act = document.createElement('td');
-      if (!k.revoked) {
-        act.appendChild(btn(k.enabled ? 'Disable' : 'Enable', 'secondary', async function () {
-          await api('POST', 'keys/' + encodeURIComponent(k.id) + '/enabled', { enabled: !k.enabled }); loadKeys();
-        }));
-        act.appendChild(btn('Revoke', 'danger', async function () {
-          if (window.confirm('Revoke ' + k.name + '?')) { await api('POST', 'keys/' + encodeURIComponent(k.id) + '/revoke'); loadKeys(); }
-        }));
-      }
-      tr.appendChild(act);
-      body.appendChild(tr);
-    });
-  }
-
-  function showKeyModal(plaintext) {
-    $('keyPlaintext').textContent = plaintext;
-    $('keyModalBg').classList.add('show');
-    $('keyCopy').onclick = function () { navigator.clipboard && navigator.clipboard.writeText(plaintext); };
-    $('keyClose').onclick = function () {
-      $('keyModalBg').classList.remove('show');
-      $('keyPlaintext').textContent = ''; // never persist the plaintext
-    };
-  }
-
-  async function createKey() {
-    var name = $('kName').value.trim() || 'key';
-    var r = await api('POST', 'keys', { name: name });
-    if (r.json && r.json.plaintextOnce) { showKeyModal(r.json.plaintextOnce); $('kName').value = ''; loadKeys(); }
-  }
-
-  // ── Server config ───────────────────────────────────────────────────────────
-  async function loadServer() {
-    var r = await api('GET', 'server');
-    var s = (r.json && r.json.server) || {};
-    $('sEnabled').checked = !!s.enabled;
-    $('sLan').checked = !!s.networkBinding;
-    $('sPort').value = s.port || '';
-    var body = $('endpointsTable').querySelector('tbody');
-    clear(body);
-    (s.endpoints || []).forEach(function (e) {
-      var tr = document.createElement('tr');
-      tr.appendChild(td(e.endpoint));
-      tr.appendChild(td(e.defaultModel));
-      tr.appendChild(td(e.useSubscription ? 'yes' : 'no'));
-      body.appendChild(tr);
-    });
+// src/admin/uiStatic.ts
+import { existsSync as existsSync3, statSync } from "fs";
+import { readFile } from "fs/promises";
+import { createRequire } from "module";
+import path from "path";
+var CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".map": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8"
+};
+function resolveUiDist() {
+  const fromEnv = process.env["OMNICROSS_UI_DIST"];
+  if (fromEnv) {
+    return existsSync3(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
   }
-
-  async function saveServer() {
-    var patch = { enabled: $('sEnabled').checked, networkBinding: $('sLan').checked };
-    var port = parseInt($('sPort').value, 10);
-    if (port) patch.port = port;
-    await api('PUT', 'server', patch);
-    loadServer(); loadStatus();
+  try {
+    const req = createRequire(typeof __filename !== "undefined" ? __filename : import.meta.url);
+    const pkgJson = req.resolve("@omnicross/ui/package.json");
+    const dist = path.join(path.dirname(pkgJson), "dist");
+    return existsSync3(path.join(dist, "index.html")) ? dist : null;
+  } catch {
+    return null;
   }
-
-  // ── Accounts ────────────────────────────────────────────────────────────────
-  // The GET stays token-free (status only). The Save/Clear actions WRITE tokens
-  // (secret IN); the form never renders an existing/stored token (write-only).
-  async function loadAccounts() {
-    var r = await api('GET', 'accounts');
-    var body = $('accountsTable').querySelector('tbody');
-    clear(body);
-    (r.json && r.json.accounts || []).forEach(function (a) {
-      var tr = document.createElement('tr');
-      tr.appendChild(td(a.displayName || a.providerId));
-      tr.appendChild(td(a.kind));
-      var st = document.createElement('td');
-      var ok = a.credentialStatus && a.credentialStatus.ok;
-      var pill = document.createElement('span');
-      pill.className = 'pill ' + (ok ? 'ok' : 'bad');
-      pill.textContent = ok ? 'ok' : ((a.credentialStatus && a.credentialStatus.reason) || 'no credential');
-      st.appendChild(pill);
-      tr.appendChild(st);
-      var act = document.createElement('td');
-      act.appendChild(btn('Clear', 'danger', async function () {
-        if (window.confirm('Clear ' + a.providerId + ' token?')) {
-          await api('DELETE', 'accounts/' + encodeURIComponent(a.providerId));
-          loadAccounts();
-        }
-      }));
-      tr.appendChild(act);
-      body.appendChild(tr);
-    });
-    renderProviderAccounts(r.json && r.json.providerAccounts || {});
+}
+async function handleUiStatic(req, res, urlPath, uiDist) {
+  if (urlPath !== "/ui" && !urlPath.startsWith("/ui/")) return false;
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    res.writeHead(405, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "method_not_allowed", message: "GET/HEAD only" } }));
+    return true;
   }
-
-  // Per-provider sanitized accounts (multi-account). Secrets IN-never-OUT: this
-  // view shows id/label/status/active only — set-active + delete are STATUS-ONLY.
-  function renderProviderAccounts(byProvider) {
-    var body = $('providerAccountsTable').querySelector('tbody');
-    clear(body);
-    Object.keys(byProvider).forEach(function (provider) {
-      (byProvider[provider] || []).forEach(function (acc) {
-        var tr = document.createElement('tr');
-        tr.appendChild(td(provider));
-        tr.appendChild(td(acc.label || acc.id));
-        tr.appendChild(td(acc.status));
-        tr.appendChild(td(acc.isActive ? 'yes' : ''));
-        var act = document.createElement('td');
-        if (!acc.isActive) {
-          act.appendChild(btn('Set active', '', async function () {
-            await api('PUT', 'accounts/' + encodeURIComponent(provider) + '/active', { id: acc.id });
-            loadAccounts();
-          }));
+  if (!uiDist) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          type: "ui_not_installed",
+          message: "Control Panel UI not installed (@omnicross/ui has no built dist). Install/build @omnicross/ui or set OMNICROSS_UI_DIST."
         }
-        act.appendChild(btn('Delete', 'danger', async function () {
-          if (window.confirm('Delete account ' + (acc.label || acc.id) + '?')) {
-            await api('DELETE', 'accounts/' + encodeURIComponent(provider) + '/' + encodeURIComponent(acc.id));
-            loadAccounts();
-          }
-        }));
-        tr.appendChild(act);
-        body.appendChild(tr);
-      });
-    });
-  }
-
-  async function saveAccount() {
-    $('acErr').textContent = '';
-    var provider = $('acProvider').value;
-    var raw = $('acBody').value.trim();
-    if (!raw) { $('acErr').textContent = 'paste a token JSON'; return; }
-    var payload; try { payload = JSON.parse(raw); } catch (e) { $('acErr').textContent = 'invalid JSON'; return; }
-    var r = await api('PUT', 'accounts/' + encodeURIComponent(provider), payload);
-    if (r.status >= 400) { $('acErr').textContent = (r.json && r.json.error && r.json.error.message) || ('error ' + r.status); return; }
-    $('acBody').value = ''; // never persist/echo the just-saved token
-    loadAccounts();
-  }
-
-  // ── Playground ──────────────────────────────────────────────────────────────
-  async function sendPlayground() {
-    var pre = $('plResponse');
-    pre.classList.remove('muted');
-    pre.textContent = 'sending…';
-    var bodyText = $('plBody').value;
-    var parsed; try { parsed = JSON.parse(bodyText); } catch (e) { parsed = bodyText; }
-    var r = await fetch('/admin/api/playground', {
-      method: 'POST',
-      headers: headers({ 'Content-Type': 'application/json' }),
-      body: JSON.stringify({ endpoint: $('plEndpoint').value, key: $('plKey').value, body: parsed }),
-    });
-    var text = await r.text();
-    pre.textContent = '[' + r.status + ']\n' + text;
+      })
+    );
+    return true;
   }
-
-  function wire() {
-    $('pSave').onclick = saveProvider;
-    $('pPreset').onchange = onPresetChange;
-    $('kCreate').onclick = createKey;
-    $('sSave').onclick = saveServer;
-    $('acSave').onclick = saveAccount;
-    $('plSend').onclick = sendPlayground;
-    refresh();
+  if (urlPath === "/ui") {
+    res.writeHead(302, { Location: "/ui/" });
+    res.end();
+    return true;
   }
-
-  function refresh() {
-    loadStatus(); loadProviders(); loadPresets(); loadKeys(); loadServer(); loadAccounts();
+  let rel;
+  try {
+    rel = decodeURIComponent(urlPath.slice("/ui/".length));
+  } catch {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "bad_request", message: "malformed path" } }));
+    return true;
+  }
+  if (rel.includes("\\") || rel.includes("\0")) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
+    return true;
+  }
+  const filePath = path.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + path.sep)) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
+    return true;
+  }
+  let target = filePath;
+  if (!existsSync3(target) || statSync(target).isDirectory()) {
+    if (path.extname(rel) === "") {
+      target = path.join(uiDist, "index.html");
+    } else {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
+      return true;
+    }
   }
-
-  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', wire);
-  else wire();
-})();
-`;
-
-// src/admin/html.ts
-var STYLE = `
-:root { --bg:#0f1115; --panel:#171a21; --line:#272b35; --fg:#e6e8ec; --muted:#8b91a0; --accent:#5b8cff; --danger:#ff5b6e; --ok:#3ecf8e; }
-* { box-sizing: border-box; }
-body { margin:0; font:14px/1.5 system-ui,-apple-system,Segoe UI,Roboto,sans-serif; background:var(--bg); color:var(--fg); }
-header { padding:14px 20px; border-bottom:1px solid var(--line); display:flex; align-items:center; gap:12px; }
-header h1 { font-size:16px; margin:0; font-weight:600; }
-header .badge { font-size:12px; color:var(--muted); }
-main { padding:20px; display:grid; gap:20px; max-width:980px; margin:0 auto; }
-section { background:var(--panel); border:1px solid var(--line); border-radius:10px; padding:16px; }
-section h2 { font-size:14px; margin:0 0 12px; font-weight:600; }
-table { width:100%; border-collapse:collapse; font-size:13px; }
-th, td { text-align:left; padding:6px 8px; border-bottom:1px solid var(--line); }
-th { color:var(--muted); font-weight:500; }
-input, select, textarea { background:var(--bg); color:var(--fg); border:1px solid var(--line); border-radius:6px; padding:6px 8px; font:inherit; }
-textarea { width:100%; min-height:90px; resize:vertical; font-family:ui-monospace,Menlo,monospace; }
-button { background:var(--accent); color:#fff; border:0; border-radius:6px; padding:6px 12px; cursor:pointer; font:inherit; }
-button.secondary { background:#2a2f3a; }
-button.danger { background:var(--danger); }
-.row { display:flex; gap:8px; flex-wrap:wrap; align-items:center; margin-top:8px; }
-.muted { color:var(--muted); }
-.mono { font-family:ui-monospace,Menlo,monospace; }
-.pill { padding:1px 8px; border-radius:999px; font-size:12px; }
-.pill.ok { background:rgba(62,207,142,.15); color:var(--ok); }
-.pill.bad { background:rgba(255,91,110,.15); color:var(--danger); }
-pre { background:var(--bg); border:1px solid var(--line); border-radius:6px; padding:10px; overflow:auto; max-height:320px; white-space:pre-wrap; }
-.modal-bg { position:fixed; inset:0; background:rgba(0,0,0,.6); display:none; align-items:center; justify-content:center; }
-.modal-bg.show { display:flex; }
-.modal { background:var(--panel); border:1px solid var(--line); border-radius:10px; padding:20px; max-width:520px; width:90%; }
-.warn { color:var(--danger); font-size:13px; margin:8px 0; }
-.err { color:var(--danger); font-size:13px; }
-`;
-var BODY = `
-<header>
-  <h1>omnicross daemon dashboard</h1>
-  <span class="badge" id="statusBadge">connecting\u2026</span>
-</header>
-<main>
-  <section id="statusSection">
-    <h2>Runtime status</h2>
-    <div id="statusBody" class="muted">loading\u2026</div>
-  </section>
-
-  <section>
-    <h2>Providers</h2>
-    <table id="providersTable"><thead><tr><th>id</th><th>format</th><th>base URL</th><th>key</th><th></th></tr></thead><tbody></tbody></table>
-    <div class="row">
-      <select id="pPreset"><option value="">-- \u9009\u62E9\u9884\u7F6E --</option></select>
-      <input id="pId" placeholder="id" size="10" />
-      <select id="pFormat"><option value="openai">openai</option><option value="anthropic">anthropic</option><option value="gemini">gemini</option></select>
-      <input id="pBase" placeholder="base URL" size="26" />
-      <input id="pKey" placeholder="apiKey (blank = keep on edit)" size="22" />
-      <button id="pSave">Save provider</button>
-    </div>
-    <div class="err" id="pErr"></div>
-    <div id="poolPanel" style="display:none; margin-top:12px;">
-      <h2 id="poolTitle" style="font-size:13px;">API key pool</h2>
-      <p class="muted" style="margin:0 0 8px;">Read-only. Multi-key is <b>cold-standby + observable</b> in v1: outbound failover does not yet rotate keys (null-session boundary \u2014 pending the core seam). Keys are masked; edit the pool via the provider's <span class="mono">apiKeys</span>.</p>
-      <table id="poolTable"><thead><tr><th>id</th><th>label</th><th>key</th><th>enabled</th><th>weight</th><th>health</th></tr></thead><tbody></tbody></table>
-    </div>
-  </section>
-
-  <section>
-    <h2>Named keys</h2>
-    <table id="keysTable"><thead><tr><th>name</th><th>prefix</th><th>enabled</th><th>revoked</th><th></th></tr></thead><tbody></tbody></table>
-    <div class="row">
-      <input id="kName" placeholder="key name" size="16" />
-      <button id="kCreate">Create key</button>
-    </div>
-  </section>
-
-  <section>
-    <h2>Server config</h2>
-    <div class="row">
-      <label><input type="checkbox" id="sEnabled" /> enabled</label>
-      <label><input type="checkbox" id="sLan" /> networkBinding (LAN)</label>
-      <label>port <input id="sPort" size="6" /></label>
-      <button id="sSave">Apply server config</button>
-    </div>
-    <table id="endpointsTable"><thead><tr><th>endpoint</th><th>defaultModel</th><th>subscription</th></tr></thead><tbody></tbody></table>
-  </section>
-
-  <section>
-    <h2>Accounts <span class="muted">(subscription tokens)</span></h2>
-    <table id="accountsTable"><thead><tr><th>provider</th><th>kind</th><th>status</th><th></th></tr></thead><tbody></tbody></table>
-    <h3>Per-provider accounts <span class="muted">(multi-account \u2014 sanitized, no tokens)</span></h3>
-    <table id="providerAccountsTable"><thead><tr><th>provider</th><th>label</th><th>status</th><th>active</th><th></th></tr></thead><tbody></tbody></table>
-    <div class="row">
-      <select id="acProvider"><option value="claude">claude</option><option value="codex">codex</option><option value="gemini">gemini</option><option value="opencodego">opencodego</option></select>
-      <button id="acSave">Save token</button>
-    </div>
-    <textarea id="acBody" placeholder='{"authMethod":"oauth","status":"authorized","accessToken":"\u2026","refreshToken":"\u2026"}'></textarea>
-    <p class="muted">Write-only: paste a token JSON to authorize this provider. The token is shown only on entry \u2014 it is never read back or displayed. Stored as plain JSON in <span class="mono">tokens.json</span>.</p>
-    <div class="err" id="acErr"></div>
-  </section>
-
-  <section>
-    <h2>Playground</h2>
-    <div class="row">
-      <select id="plEndpoint"><option value="chat">chat</option><option value="responses">responses</option><option value="messages">messages</option><option value="gemini">gemini</option></select>
-      <input id="plKey" placeholder="named key (sk-omnicross-\u2026)" size="30" />
-      <button id="plSend">Send</button>
-    </div>
-    <textarea id="plBody">{"model":"","messages":[{"role":"user","content":"ping"}]}</textarea>
-    <pre id="plResponse" class="muted">response will appear here</pre>
-  </section>
-</main>
-
-<div class="modal-bg" id="keyModalBg">
-  <div class="modal">
-    <h2>Key created</h2>
-    <p class="warn">This secret is shown ONCE. Copy it now \u2014 it cannot be retrieved again.</p>
-    <pre id="keyPlaintext" class="mono"></pre>
-    <div class="row">
-      <button id="keyCopy">Copy</button>
-      <button class="secondary" id="keyClose">Close</button>
-    </div>
-  </div>
-</div>
-`;
-var DASHBOARD_HTML = `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>omnicross daemon dashboard</title>
-<style>${STYLE}</style>
-</head>
-<body>
-${BODY}
-<script>${DASHBOARD_JS}</script>
-</body>
-</html>`;
+  const body = await readFile(target);
+  const type = CONTENT_TYPES[path.extname(target).toLowerCase()] ?? "application/octet-stream";
+  res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
+  res.end(req.method === "HEAD" ? void 0 : body);
+  return true;
+}
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
 var LAN_ADDR = "0.0.0.0";
+var DAEMON_VERSION = true ? "0.1.2" : "0.0.0-dev";
 var AdminServer = class {
   constructor(deps) {
     this.deps = deps;
@@ -2549,6 +2699,8 @@ var AdminServer = class {
   server = null;
   boundPort = 0;
   boundAddr = LOOPBACK_ADDR;
+  /** Control Panel dist dir (resolved once at first request; null = no UI). */
+  uiDist;
   /**
    * Start the admin listener honoring the resolved admin config. Returns the
    * actual bound port, or `0` when it refuses/declines to bind (disabled or the
@@ -2577,13 +2729,13 @@ var AdminServer = class {
       const server = http2.createServer((req, res) => {
         this.onRequest(req, res);
       });
-      const onError = (err4) => {
-        if (err4.code === "EADDRINUSE" && port !== 0) {
+      const onError = (err5) => {
+        if (err5.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
           this.listen(bindAddr, 0).then(resolve, reject);
           return;
         }
-        reject(err4);
+        reject(err5);
       };
       server.on("error", onError);
       server.listen(port, bindAddr, () => {
@@ -2601,8 +2753,8 @@ var AdminServer = class {
   }
   /** Per-request handler: auth gate (when a token is set) → routing. */
   onRequest(req, res) {
-    void this.dispatch(req, res).catch((err4) => {
-      const message = err4 instanceof Error ? err4.message : String(err4);
+    void this.dispatch(req, res).catch((err5) => {
+      const message = err5 instanceof Error ? err5.message : String(err5);
       console.error("[AdminServer] unhandled error:", message);
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
@@ -2612,22 +2764,26 @@ var AdminServer = class {
   }
   async dispatch(req, res) {
     const cfg = this.deps.getAdminConfig();
+    res.setHeader("x-omnicross-daemon", DAEMON_VERSION);
+    res.setHeader("x-omnicross-pid", String(process.pid));
     if (cfg.token && !this.isAuthorized(req, cfg.token)) {
       res.writeHead(401, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "unauthorized", message: "admin token required" } }));
       return;
     }
     const url = req.url ?? "/";
-    const path = url.split("?")[0];
-    if ((req.method === "GET" || req.method === "HEAD") && (path === "/" || path === "/admin")) {
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(req.method === "HEAD" ? void 0 : DASHBOARD_HTML);
+    const path2 = url.split("?")[0];
+    if ((req.method === "GET" || req.method === "HEAD") && (path2 === "/" || path2 === "/admin")) {
+      res.writeHead(302, { Location: "/ui/" });
+      res.end();
       return;
     }
-    if (path.startsWith("/admin/api/")) {
-      await handleAdminApi(req, res, path, this.deps);
+    if (path2.startsWith("/admin/api/")) {
+      await handleAdminApi(req, res, path2, this.deps);
       return;
     }
+    if (this.uiDist === void 0) this.uiDist = resolveUiDist();
+    if (await handleUiStatic(req, res, path2, this.uiDist)) return;
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "not_found", message: "no such admin route" } }));
   }
@@ -2750,18 +2906,18 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
       res.end(pageHtml("Login complete."));
       finish(server, () => resolve(code));
     });
-    server.on("error", (err4) => {
+    server.on("error", (err5) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      if (err4.code === "EADDRINUSE") {
+      if (err5.code === "EADDRINUSE") {
         reject(
           new Error(
             `login: cannot bind ${LOOPBACK_HOST}:${LOOPBACK_PORT} (address in use) \u2014 another codex login or process is holding the port`
           )
         );
       } else {
-        reject(err4);
+        reject(err5);
       }
     });
     const timer = setTimeout(() => {
@@ -2836,6 +2992,15 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
   };
 }
 
+// src/commands/paths.ts
+import { dirname as dirname2, join as join3 } from "path";
+function defaultPricingPath(configPath) {
+  return join3(dirname2(configPath), "pricing.json");
+}
+function defaultUsageEventsPath(configPath) {
+  return join3(dirname2(configPath), "usage-events.jsonl");
+}
+
 // src/ports/ConfigFileProviderConfigSource.ts
 import {
   registerBuiltinTransformers,
@@ -3048,8 +3213,211 @@ var JsonApiServerSettingsStore = class {
   }
 };
 
+// src/ports/JsonlUsageEventStore.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { appendFileSync, existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+var JsonlUsageEventStore = class {
+  constructor(eventsPath, isPriced) {
+    this.eventsPath = eventsPath;
+    this.isPriced = isPriced;
+  }
+  eventsPath;
+  isPriced;
+  /** Persist one event: assign `id`, stamp `ts` when absent, append ONE line. */
+  async insert(input) {
+    const row = {
+      ...input,
+      id: randomUUID3(),
+      ts: input.ts ?? Date.now()
+    };
+    appendFileSync(this.eventsPath, JSON.stringify(row) + "\n", "utf8");
+    return row.id;
+  }
+  async getTotals(range) {
+    const totals = {
+      inputTokens: 0,
+      outputTokens: 0,
+      cacheReadTokens: 0,
+      cacheCreationTokens: 0,
+      reasoningTokens: 0,
+      costUsd: 0,
+      costSavedByCacheUsd: 0,
+      eventCount: 0
+    };
+    for (const row of this.readRows(range)) {
+      totals.inputTokens += row.inputTokens;
+      totals.outputTokens += row.outputTokens;
+      totals.cacheReadTokens += row.cacheReadTokens;
+      totals.cacheCreationTokens += row.cacheCreationTokens;
+      totals.reasoningTokens += row.reasoningTokens;
+      totals.costUsd += row.costUsd;
+      totals.costSavedByCacheUsd += row.costSavedByCacheUsd;
+      totals.eventCount += 1;
+    }
+    return totals;
+  }
+  async getByModel(range) {
+    const groups = /* @__PURE__ */ new Map();
+    for (const row of this.readRows(range)) {
+      const key = `${row.providerId}::${row.model}`;
+      let g = groups.get(key);
+      if (!g) {
+        g = {
+          providerId: row.providerId,
+          model: row.model,
+          eventCount: 0,
+          inputTokens: 0,
+          outputTokens: 0,
+          cacheReadTokens: 0,
+          cacheCreationTokens: 0,
+          costUsd: 0,
+          costSavedByCacheUsd: 0,
+          unpriced: false
+        };
+        groups.set(key, g);
+      }
+      g.eventCount += 1;
+      g.inputTokens += row.inputTokens;
+      g.outputTokens += row.outputTokens;
+      g.cacheReadTokens += row.cacheReadTokens;
+      g.cacheCreationTokens += row.cacheCreationTokens;
+      g.costUsd += row.costUsd;
+      g.costSavedByCacheUsd += row.costSavedByCacheUsd;
+    }
+    const rows = Array.from(groups.values());
+    for (const g of rows) {
+      g.unpriced = !await this.isPriced(g.providerId, g.model);
+    }
+    return rows;
+  }
+  /**
+   * Group by RAW apiKeyId (null forms the unattributed sentinel group). Label
+   * here is the raw id fallback — the admin handler resolves display labels
+   * against the configured pool keys (the store stays config-schema-free).
+   */
+  async getByApiKey(range) {
+    const groups = /* @__PURE__ */ new Map();
+    for (const row of this.readRows(range)) {
+      const key = row.apiKeyId;
+      let g = groups.get(key);
+      if (!g) {
+        g = {
+          apiKeyId: key,
+          label: key ?? "unattributed",
+          providerId: key === null ? null : row.providerId,
+          eventCount: 0,
+          inputTokens: 0,
+          outputTokens: 0,
+          costUsd: 0
+        };
+        groups.set(key, g);
+      }
+      g.eventCount += 1;
+      g.inputTokens += row.inputTokens;
+      g.outputTokens += row.outputTokens;
+      g.costUsd += row.costUsd;
+    }
+    return Array.from(groups.values());
+  }
+  async getMessagesForSession(sessionId) {
+    return this.readAllRows().filter((r) => r.sessionId === sessionId).sort((a, b) => a.ts - b.ts).map((r) => ({
+      id: r.id,
+      ts: r.ts,
+      messageId: r.messageId,
+      parentMessageId: r.parentMessageId,
+      sessionId: r.sessionId,
+      providerId: r.providerId,
+      model: r.model,
+      apiKeyId: r.apiKeyId,
+      engineOrigin: r.engineOrigin,
+      inputTokens: r.inputTokens,
+      outputTokens: r.outputTokens,
+      cacheReadTokens: r.cacheReadTokens,
+      cacheCreationTokens: r.cacheCreationTokens,
+      reasoningTokens: r.reasoningTokens,
+      costUsd: r.costUsd,
+      costSavedByCacheUsd: r.costSavedByCacheUsd
+    }));
+  }
+  async getSessionCacheStats(sessionId) {
+    const stats = {
+      sessionId,
+      inputTokens: 0,
+      cacheReadTokens: 0,
+      cacheCreationTokens: 0,
+      outputTokens: 0,
+      eventCount: 0,
+      hitRate: 0
+    };
+    for (const r of this.readAllRows()) {
+      if (r.sessionId !== sessionId) continue;
+      stats.inputTokens += r.inputTokens;
+      stats.cacheReadTokens += r.cacheReadTokens;
+      stats.cacheCreationTokens += r.cacheCreationTokens;
+      stats.outputTokens += r.outputTokens;
+      stats.eventCount += 1;
+    }
+    const promptSide = stats.inputTokens + stats.cacheReadTokens + stats.cacheCreationTokens;
+    stats.hitRate = promptSide > 0 ? stats.cacheReadTokens / promptSide : 0;
+    return stats;
+  }
+  /** Rows inside `startTs <= ts < endTs` (endTs EXCLUSIVE). */
+  readRows(range) {
+    return this.readAllRows().filter((r) => r.ts >= range.startTs && r.ts < range.endTs);
+  }
+  /** Parse every line, skipping malformed/torn lines defensively. */
+  readAllRows() {
+    if (!existsSync4(this.eventsPath)) return [];
+    let raw;
+    try {
+      raw = readFileSync4(this.eventsPath, "utf8");
+    } catch {
+      return [];
+    }
+    const rows = [];
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (isUsageEventRecord(parsed)) rows.push(parsed);
+      } catch {
+      }
+    }
+    return rows;
+  }
+};
+var NUMERIC_FIELDS = [
+  "ts",
+  "inputTokens",
+  "outputTokens",
+  "cacheReadTokens",
+  "cacheCreationTokens",
+  "reasoningTokens",
+  "costUsd",
+  "costSavedByCacheUsd"
+];
+var NULLABLE_STRING_FIELDS = ["messageId", "parentMessageId", "sessionId", "apiKeyId"];
+var isStringOrNull = (v) => v === null || typeof v === "string";
+function isUsageEventRecord(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+  const r = parsed;
+  if (typeof r["id"] !== "string") return false;
+  if (typeof r["providerId"] !== "string") return false;
+  if (typeof r["model"] !== "string") return false;
+  if (typeof r["engineOrigin"] !== "string") return false;
+  for (const f of NULLABLE_STRING_FIELDS) {
+    if (!isStringOrNull(r[f])) return false;
+  }
+  for (const f of NUMERIC_FIELDS) {
+    const v = r[f];
+    if (typeof v !== "number" || !Number.isFinite(v)) return false;
+  }
+  return true;
+}
+
 // src/ports/JsonOutboundKeyDb.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 var JsonOutboundKeyDb = class {
   constructor(keysPath) {
     this.keysPath = keysPath;
@@ -3113,9 +3481,9 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync2(this.keysPath)) return [];
+    if (!existsSync5(this.keysPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync4(this.keysPath, "utf8"));
+      const parsed = JSON.parse(readFileSync5(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
@@ -3126,14 +3494,357 @@ var JsonOutboundKeyDb = class {
   }
 };
 
+// src/ports/JsonPricingStore.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+var JsonPricingStore = class {
+  constructor(pricingPath) {
+    this.pricingPath = pricingPath;
+  }
+  pricingPath;
+  async getAll() {
+    return this.readRows();
+  }
+  /**
+   * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
+   * user provenance (source 'user', userEdited, editedAt now) so the row is
+   * protected from auto-overwrite during source refreshes; a non-user upsert
+   * stamps source 'litellm' and clears nothing it should not (a plain source
+   * upsert through this method overwrites the row wholesale).
+   */
+  async upsert(input, asUserEdit) {
+    const rows = this.readRows();
+    const entry = this.applyUpsert(rows, input, asUserEdit);
+    this.writeRows(rows);
+    return entry;
+  }
+  /**
+   * Apply a batch fetched from a pricing source. Rows whose local copy is
+   * user-edited are NOT applied — they come back as `{ current, incoming }`
+   * conflicts; everything else is upserted (source 'litellm'). ONE file write
+   * for the whole batch.
+   */
+  async bulkApplyFromSource(entries) {
+    const rows = this.readRows();
+    const applied = [];
+    const conflicts = [];
+    for (const incoming of entries) {
+      const current = rows.find(
+        (r) => r.providerId === incoming.providerId && r.modelId === incoming.modelId
+      );
+      if (current && current.userEdited) {
+        conflicts.push({ current, incoming });
+        continue;
+      }
+      applied.push(this.applyUpsert(
+        rows,
+        incoming,
+        /* asUserEdit */
+        false
+      ));
+    }
+    if (applied.length > 0) this.writeRows(rows);
+    return { applied, conflicts };
+  }
+  /**
+   * Apply per-row conflict decisions: 'overwrite' replaces the local row with
+   * the incoming values (clearing the user-edited mark), 'skip' counts only.
+   */
+  async applyResolutions(resolutions) {
+    const rows = this.readRows();
+    let overwrittenCount = 0;
+    let skippedCount = 0;
+    for (const r of resolutions) {
+      if (r.action === "skip") {
+        skippedCount += 1;
+        continue;
+      }
+      this.applyUpsert(
+        rows,
+        r.incoming,
+        /* asUserEdit */
+        false
+      );
+      overwrittenCount += 1;
+    }
+    if (overwrittenCount > 0) this.writeRows(rows);
+    return { overwrittenCount, skippedCount };
+  }
+  /**
+   * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
+   * was actually removed. The admin DELETE handler calls this then invalidates
+   * the engine cache.
+   */
+  async delete(providerId, modelId) {
+    const rows = this.readRows();
+    const idx = rows.findIndex((r) => r.providerId === providerId && r.modelId === modelId);
+    if (idx < 0) return false;
+    rows.splice(idx, 1);
+    this.writeRows(rows);
+    return true;
+  }
+  /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
+  applyUpsert(rows, input, asUserEdit) {
+    const now = Date.now();
+    const entry = {
+      providerId: input.providerId,
+      modelId: input.modelId,
+      inputPricePer1m: input.inputPricePer1m,
+      outputPricePer1m: input.outputPricePer1m,
+      cacheReadPricePer1m: input.cacheReadPricePer1m ?? null,
+      cacheWritePricePer1m: input.cacheWritePricePer1m ?? null,
+      source: asUserEdit ? "user" : "litellm",
+      userEdited: asUserEdit,
+      editedAt: asUserEdit ? now : null,
+      updatedAt: now
+    };
+    const idx = rows.findIndex(
+      (r) => r.providerId === input.providerId && r.modelId === input.modelId
+    );
+    if (idx >= 0) rows[idx] = entry;
+    else rows.push(entry);
+    return entry;
+  }
+  /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
+  readRows() {
+    if (!existsSync6(this.pricingPath)) return [];
+    try {
+      const parsed = JSON.parse(readFileSync6(this.pricingPath, "utf8"));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  writeRows(rows) {
+    writeFileSync5(this.pricingPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+  }
+};
+
 // src/ports/JsonSubscriptionCredentialStore.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname2 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname4 } from "path";
 import {
   claudeOAuth as claudeOAuth2,
   codexOAuth as codexOAuth2,
   geminiOAuth as geminiOAuth2
 } from "@omnicross/subscriptions";
+
+// src/ports/account-sync.ts
+var IMPORT_EXPIRY_MARGIN_MS = 6e4;
+function viewOf(tokens) {
+  return tokens;
+}
+function decideExternalImport(captured, external, now = Date.now()) {
+  if (!external?.accessToken) return "no-credential";
+  const capturedRt = viewOf(captured).refreshToken;
+  const hasNewRefresh = Boolean(external.refreshToken && external.refreshToken !== capturedRt);
+  const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > now + IMPORT_EXPIRY_MARGIN_MS : true;
+  return hasNewRefresh || accessStillValid ? "import" : "not-rotated";
+}
+function buildImportedTokens(captured, external) {
+  const imported = {
+    ...captured,
+    accessToken: external.accessToken,
+    status: "authorized",
+    errorMessage: void 0,
+    syncWarning: void 0,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (external.refreshToken) imported.refreshToken = external.refreshToken;
+  if (external.expiresAt) imported.expiresAt = external.expiresAt;
+  else delete imported.expiresAt;
+  if (external.idToken) imported.idToken = external.idToken;
+  if (external.scopes) imported.scopes = external.scopes;
+  return imported;
+}
+function buildTokensFromExternal(provider, external) {
+  const base = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: external.accessToken,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (provider === "claude") {
+    const tokens2 = { ...base };
+    if (external.refreshToken) tokens2.refreshToken = external.refreshToken;
+    if (external.expiresAt) tokens2.expiresAt = external.expiresAt;
+    if (external.scopes) tokens2.scopes = external.scopes;
+    return tokens2;
+  }
+  const tokens = { ...base };
+  if (external.refreshToken) tokens.refreshToken = external.refreshToken;
+  if (external.expiresAt) tokens.expiresAt = external.expiresAt;
+  if (external.idToken) tokens.idToken = external.idToken;
+  return tokens;
+}
+function isExternalDivergent(stored, external) {
+  if (!external?.accessToken || !external.refreshToken) return false;
+  const view = viewOf(stored);
+  if (!view.refreshToken || external.refreshToken === view.refreshToken) return false;
+  const storedExp = view.expiresAt ? Date.parse(view.expiresAt) : NaN;
+  const externalExp = external.expiresAt ? Date.parse(external.expiresAt) : Infinity;
+  return !Number.isFinite(storedExp) || externalExp > storedExp;
+}
+function findDuplicateCredentialIds(accounts) {
+  const byCredential = /* @__PURE__ */ new Map();
+  for (const account of accounts) {
+    const view = viewOf(account.tokens);
+    const credential = view.refreshToken ?? view.apiKey ?? view.accessToken;
+    if (!credential) continue;
+    const ids = byCredential.get(credential) ?? [];
+    ids.push(account.id);
+    byCredential.set(credential, ids);
+  }
+  const duplicates = /* @__PURE__ */ new Set();
+  for (const ids of byCredential.values()) {
+    if (ids.length > 1) for (const id of ids) duplicates.add(id);
+  }
+  return duplicates;
+}
+
+// src/ports/external-cli-credentials.ts
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4 } from "path";
+function externalStorePath(provider, home = homedir2()) {
+  return provider === "claude" ? join4(home, ".claude", ".credentials.json") : join4(home, ".codex", "auth.json");
+}
+function decodeJwtExpiryMs(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return void 0;
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof decoded.exp === "number" && Number.isFinite(decoded.exp)) {
+      return decoded.exp * 1e3;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function parseClaudeOAuthEnvelope(raw) {
+  const oauth = raw?.claudeAiOauth;
+  if (!oauth || typeof oauth.accessToken !== "string" || !oauth.accessToken) return null;
+  const parsed = { accessToken: oauth.accessToken };
+  if (typeof oauth.refreshToken === "string" && oauth.refreshToken) {
+    parsed.refreshToken = oauth.refreshToken;
+  }
+  if (typeof oauth.expiresAt === "number" && Number.isFinite(oauth.expiresAt)) {
+    parsed.expiresAt = new Date(oauth.expiresAt).toISOString();
+  }
+  if (Array.isArray(oauth.scopes) && oauth.scopes.every((s) => typeof s === "string")) {
+    parsed.scopes = oauth.scopes;
+  }
+  return parsed;
+}
+function parseCodexTokensEnvelope(raw) {
+  const tokens = raw?.tokens;
+  if (!tokens) return null;
+  const accessToken = typeof tokens.access_token === "string" && tokens.access_token ? tokens.access_token : void 0;
+  const idToken = typeof tokens.id_token === "string" && tokens.id_token ? tokens.id_token : void 0;
+  if (!accessToken && !idToken) return null;
+  const parsed = {};
+  if (accessToken) {
+    parsed.accessToken = accessToken;
+    const expMs = decodeJwtExpiryMs(accessToken);
+    if (expMs !== void 0) parsed.expiresAt = new Date(expMs).toISOString();
+  }
+  if (idToken) parsed.idToken = idToken;
+  if (typeof tokens.refresh_token === "string" && tokens.refresh_token) {
+    parsed.refreshToken = tokens.refresh_token;
+  }
+  return parsed;
+}
+function readExternalCliCredentials(provider, home = homedir2()) {
+  const path2 = externalStorePath(provider, home);
+  if (!existsSync7(path2)) return null;
+  let raw;
+  try {
+    const parsed = JSON.parse(readFileSync7(path2, "utf8"));
+    raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return null;
+  }
+  return provider === "claude" ? parseClaudeOAuthEnvelope(raw) : parseCodexTokensEnvelope(raw);
+}
+
+// src/ports/external-cli-store.ts
+import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync8, renameSync, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3 } from "path";
+function markerPath(provider, home) {
+  return `${externalStorePath(provider, home)}.omnicross-managed`;
+}
+function backupPath(provider, home) {
+  return `${externalStorePath(provider, home)}.omnicross-backup`;
+}
+function buildClaudeOAuthEnvelope(tokens) {
+  if (!tokens.accessToken) return null;
+  const envelope = { accessToken: tokens.accessToken };
+  if (tokens.refreshToken) envelope.refreshToken = tokens.refreshToken;
+  if (tokens.expiresAt) {
+    const ms = Date.parse(tokens.expiresAt);
+    if (Number.isFinite(ms)) envelope.expiresAt = ms;
+  }
+  if (tokens.scopes && tokens.scopes.length > 0) envelope.scopes = tokens.scopes;
+  return envelope;
+}
+function buildCodexTokensEnvelope(tokens) {
+  if (!tokens.accessToken && !tokens.idToken) return null;
+  const envelope = { access_token: tokens.accessToken ?? "" };
+  if (tokens.idToken) envelope.id_token = tokens.idToken;
+  if (tokens.refreshToken) envelope.refresh_token = tokens.refreshToken;
+  return envelope;
+}
+function readExistingObject(path2) {
+  if (!existsSync8(path2)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync8(path2, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeAtomic(path2, content) {
+  mkdirSync2(dirname3(path2), { recursive: true });
+  const temp = `${path2}.omnicross-tmp`;
+  writeFileSync6(temp, content, "utf8");
+  renameSync(temp, path2);
+}
+function createExternalCliStore(home = homedir3()) {
+  return {
+    readMarkerAccountId(provider) {
+      const path2 = markerPath(provider, home);
+      if (!existsSync8(path2)) return void 0;
+      try {
+        const parsed = JSON.parse(readFileSync8(path2, "utf8"));
+        return typeof parsed.accountId === "string" && parsed.accountId ? parsed.accountId : void 0;
+      } catch {
+        return void 0;
+      }
+    },
+    writeMarker(provider, accountId) {
+      writeAtomic(
+        markerPath(provider, home),
+        JSON.stringify({ accountId, at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
+      );
+    },
+    writeBack(provider, accountId, tokens) {
+      const owner = this.readMarkerAccountId(provider);
+      if (owner !== accountId) return false;
+      const envelope = provider === "claude" ? buildClaudeOAuthEnvelope(tokens) : buildCodexTokensEnvelope(tokens);
+      if (!envelope) return false;
+      const storePath = externalStorePath(provider, home);
+      if (existsSync8(storePath) && !existsSync8(backupPath(provider, home))) {
+        copyFileSync(storePath, backupPath(provider, home));
+      }
+      const existing = readExistingObject(storePath);
+      const merged = provider === "claude" ? { ...existing, claudeAiOauth: envelope } : { ...existing, tokens: envelope };
+      writeAtomic(storePath, JSON.stringify(merged, null, 2) + "\n");
+      return true;
+    }
+  };
+}
+
+// src/ports/JsonSubscriptionCredentialStore.ts
 var JsonSubscriptionCredentialStore = class {
   /**
    * @param tokensPath  on-disk `tokens.json` location.
@@ -3143,14 +3854,33 @@ var JsonSubscriptionCredentialStore = class {
    *                    is unchanged; tests inject a mock fetch. NOT used by any
    *                    read/write path — only by `refresh*Token`.
    */
-  constructor(tokensPath, box, fetchImpl = (url, init) => fetch(url, init)) {
+  constructor(tokensPath, box, fetchImpl = (url, init) => fetch(url, init), externalCliReader = readExternalCliCredentials, externalCliStore = createExternalCliStore()) {
     this.tokensPath = tokensPath;
     this.box = box;
     this.fetchImpl = fetchImpl;
+    this.externalCliReader = externalCliReader;
+    this.externalCliStore = externalCliStore;
   }
   tokensPath;
   box;
   fetchImpl;
+  externalCliReader;
+  externalCliStore;
+  /**
+   * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
+   * SINGLE-USE: two concurrent refreshes of one account each spend the same
+   * token and the loser bricks a healthy account. Every refresh entry point
+   * (auth-strategy lazy refresh, 401 retry, background scheduler) funnels
+   * through `coalesce`, so overlapping callers share ONE upstream round-trip.
+   */
+  inFlightRefreshes = /* @__PURE__ */ new Map();
+  coalesce(key, task) {
+    const existing = this.inFlightRefreshes.get(key);
+    if (existing) return existing;
+    const run = task().finally(() => this.inFlightRefreshes.delete(key));
+    this.inFlightRefreshes.set(key, run);
+    return run;
+  }
   /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
    *  file is absent/corrupt). This is the hot read — the codex / gemini auth
    *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
@@ -3178,10 +3908,41 @@ var JsonSubscriptionCredentialStore = class {
     const out = {};
     for (const provider of ["claude", "codex", "gemini", "opencodego"]) {
       const sanitized = sanitizeAccounts(config, provider);
-      if (sanitized.length > 0) out[provider] = sanitized;
+      if (sanitized.length > 0) out[provider] = this.attachSyncWarnings(config, provider, sanitized);
     }
     return out;
   }
+  /**
+   * List-time credential-conflict warnings (external-cli-sync). Computed, not
+   * persisted: (a) `duplicate-token` when two accounts of one provider share a
+   * credential, (b) `external-divergent` when the external CLI native store has
+   * rotated PAST the ACTIVE account (claude/codex only). A warning persisted by
+   * a failed refresh (`external-not-rotated`) takes precedence — it is the most
+   * actionable state.
+   */
+  attachSyncWarnings(config, provider, sanitized) {
+    const duplicates = findDuplicateCredentialIds(listAccounts(config, provider));
+    let divergentId;
+    if (provider === "claude" || provider === "codex") {
+      const active = getActiveAccount(config, provider);
+      if (active && isExternalDivergent(active.tokens, this.safeReadExternal(provider))) {
+        divergentId = active.id;
+      }
+    }
+    if (duplicates.size === 0 && !divergentId) return sanitized;
+    return sanitized.map((account) => {
+      const computed = account.id === divergentId ? "external-divergent" : duplicates.has(account.id) ? "duplicate-token" : void 0;
+      return { ...account, syncWarning: account.syncWarning ?? computed };
+    });
+  }
+  /** Read the external CLI store, never letting an fs/parse error escape. */
+  safeReadExternal(provider) {
+    try {
+      return this.externalCliReader(provider);
+    } catch {
+      return null;
+    }
+  }
   /**
    * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
    * the block has no refresh_token (setup-token / manual) — no upstream call, the
@@ -3191,30 +3952,44 @@ var JsonSubscriptionCredentialStore = class {
    * errorMessage → `false`.
    */
   async refreshClaudeToken() {
-    const config = this.readConfig();
-    const active = getActiveAccount(config, "claude");
-    const claude = active?.tokens;
-    if (!active || !claude?.refreshToken) return false;
-    const capturedId = active.id;
-    this.materializeMigration(config);
-    try {
-      const result = await claudeOAuth2.refreshAccessToken(claude.refreshToken, this.fetchImpl);
-      const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
-      const next = {
-        ...claude,
-        accessToken: result.accessToken,
-        refreshToken: result.refreshToken,
-        expiresAt,
-        status: "authorized",
-        lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        errorMessage: void 0
-      };
-      this.writeBackById("claude", capturedId, next);
-      return true;
-    } catch (error) {
-      this.markExpiredById("claude", capturedId, claude, error);
-      return false;
-    }
+    return this.coalesce("claude:active", async () => {
+      const config = this.readConfig();
+      const active = getActiveAccount(config, "claude");
+      const claude = active?.tokens;
+      if (!active || !claude?.refreshToken) return false;
+      const capturedId = active.id;
+      this.materializeMigration(config);
+      try {
+        const result = await claudeOAuth2.refreshAccessToken(claude.refreshToken, this.fetchImpl);
+        const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+        const next = {
+          ...claude,
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken,
+          expiresAt,
+          status: "authorized",
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          errorMessage: void 0,
+          syncWarning: void 0
+        };
+        this.writeBackById("claude", capturedId, next);
+        this.resyncExternal("claude", capturedId, next);
+        return true;
+      } catch (error) {
+        if (await this.tryExternalImport("claude", capturedId, claude, async (rt) => {
+          const r = await claudeOAuth2.refreshAccessToken(rt, this.fetchImpl);
+          return {
+            accessToken: r.accessToken,
+            refreshToken: r.refreshToken,
+            expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
+          };
+        })) {
+          return true;
+        }
+        this.markExpiredById("claude", capturedId, claude, error);
+        return false;
+      }
+    });
   }
   /**
    * Refresh the Codex (ChatGPT) OAuth access token. Same shape
@@ -3222,31 +3997,46 @@ var JsonSubscriptionCredentialStore = class {
    * HONEST `false` when no refresh_token.
    */
   async refreshCodexToken() {
-    const config = this.readConfig();
-    const active = getActiveAccount(config, "codex");
-    const codex = active?.tokens;
-    if (!active || !codex?.refreshToken) return false;
-    const capturedId = active.id;
-    this.materializeMigration(config);
-    try {
-      const result = await codexOAuth2.refreshAccessToken(codex.refreshToken, this.fetchImpl);
-      const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
-      const next = {
-        ...codex,
-        accessToken: result.accessToken,
-        refreshToken: result.refreshToken,
-        idToken: result.idToken,
-        expiresAt,
-        status: "authorized",
-        lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        errorMessage: void 0
-      };
-      this.writeBackById("codex", capturedId, next);
-      return true;
-    } catch (error) {
-      this.markExpiredById("codex", capturedId, codex, error);
-      return false;
-    }
+    return this.coalesce("codex:active", async () => {
+      const config = this.readConfig();
+      const active = getActiveAccount(config, "codex");
+      const codex = active?.tokens;
+      if (!active || !codex?.refreshToken) return false;
+      const capturedId = active.id;
+      this.materializeMigration(config);
+      try {
+        const result = await codexOAuth2.refreshAccessToken(codex.refreshToken, this.fetchImpl);
+        const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+        const next = {
+          ...codex,
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken,
+          idToken: result.idToken,
+          expiresAt,
+          status: "authorized",
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          errorMessage: void 0,
+          syncWarning: void 0
+        };
+        this.writeBackById("codex", capturedId, next);
+        this.resyncExternal("codex", capturedId, next);
+        return true;
+      } catch (error) {
+        if (await this.tryExternalImport("codex", capturedId, codex, async (rt) => {
+          const r = await codexOAuth2.refreshAccessToken(rt, this.fetchImpl);
+          return {
+            accessToken: r.accessToken,
+            refreshToken: r.refreshToken,
+            idToken: r.idToken,
+            expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
+          };
+        })) {
+          return true;
+        }
+        this.markExpiredById("codex", capturedId, codex, error);
+        return false;
+      }
+    });
   }
   /**
    * Refresh the Gemini (Google) OAuth access token. The Google
@@ -3256,30 +4046,175 @@ var JsonSubscriptionCredentialStore = class {
    * destroy the ability to refresh again). HONEST `false` when no refresh_token.
    */
   async refreshGeminiToken() {
-    const config = this.readConfig();
-    const active = getActiveAccount(config, "gemini");
-    const gemini = active?.tokens;
-    if (!active || !gemini?.refreshToken) return false;
-    const capturedId = active.id;
-    this.materializeMigration(config);
-    try {
-      const result = await geminiOAuth2.refreshAccessToken(gemini.refreshToken, this.fetchImpl);
-      const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
-      const next = {
-        ...gemini,
-        // KEEP the existing refreshToken (response omits it).
-        accessToken: result.accessToken,
-        expiresAt,
-        status: "authorized",
-        lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        errorMessage: void 0
-      };
-      this.writeBackById("gemini", capturedId, next);
-      return true;
-    } catch (error) {
-      this.markExpiredById("gemini", capturedId, gemini, error);
+    return this.coalesce("gemini:active", async () => {
+      const config = this.readConfig();
+      const active = getActiveAccount(config, "gemini");
+      const gemini = active?.tokens;
+      if (!active || !gemini?.refreshToken) return false;
+      const capturedId = active.id;
+      this.materializeMigration(config);
+      try {
+        const result = await geminiOAuth2.refreshAccessToken(gemini.refreshToken, this.fetchImpl);
+        const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+        const next = {
+          ...gemini,
+          // KEEP the existing refreshToken (response omits it).
+          accessToken: result.accessToken,
+          expiresAt,
+          status: "authorized",
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          errorMessage: void 0
+        };
+        this.writeBackById("gemini", capturedId, next);
+        return true;
+      } catch (error) {
+        this.markExpiredById("gemini", capturedId, gemini, error);
+        return false;
+      }
+    });
+  }
+  /**
+   * Refresh a SPECIFIC account by id (background scheduler sweep,
+   * external-cli-sync). Unlike the active-account refreshers it does NOT
+   * attempt the external-import fallback — the external CLI file's lineage can
+   * only plausibly match the ACTIVE account. Coalesced per `provider:id`; on
+   * failure flags ONLY that account `expired`.
+   */
+  async refreshAccountById(provider, id) {
+    return this.coalesce(`${provider}:${id}`, async () => {
+      const config = this.readConfig();
+      const account = getAccountById(config, provider, id);
+      const captured = account?.tokens;
+      if (!account || !captured?.refreshToken) return false;
+      this.materializeMigration(config);
+      try {
+        const refreshed = await this.refreshUpstream(provider, captured.refreshToken);
+        const next = {
+          ...captured,
+          accessToken: refreshed.accessToken,
+          // Gemini's refresh response omits a new refresh token — keep the captured.
+          refreshToken: refreshed.refreshToken ?? captured.refreshToken,
+          expiresAt: refreshed.expiresAt,
+          status: "authorized",
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          errorMessage: void 0,
+          syncWarning: void 0
+        };
+        if (refreshed.idToken) next.idToken = refreshed.idToken;
+        this.writeBackById(provider, id, next);
+        if (provider !== "gemini") this.resyncExternal(provider, id, next);
+        return true;
+      } catch (error) {
+        this.markExpiredById(provider, id, captured, error);
+        return false;
+      }
+    });
+  }
+  /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
+  async refreshUpstream(provider, refreshToken) {
+    const flow = provider === "claude" ? claudeOAuth2 : provider === "codex" ? codexOAuth2 : geminiOAuth2;
+    const r = await flow.refreshAccessToken(refreshToken, this.fetchImpl);
+    return {
+      accessToken: r.accessToken,
+      refreshToken: r.refreshToken,
+      idToken: r.idToken,
+      expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
+    };
+  }
+  /**
+   * External-import fallback for a FAILED active-account refresh
+   * (external-cli-sync). Reads the CLI native store; imports when the external
+   * lineage ROTATED (different refresh token) or its access token is still
+   * valid. When the imported access token is already expired it refreshes once
+   * with the rotated refresh token. A `not-rotated` outcome persists the
+   * `external-not-rotated` warning on the (about-to-be-expired) account so the
+   * UI can tell "genuine revocation" apart from a plain refresh failure.
+   */
+  async tryExternalImport(provider, capturedId, captured, refreshWithToken) {
+    const markerOwner = this.safeReadMarker(provider);
+    if (markerOwner && markerOwner !== capturedId) return false;
+    const external = this.safeReadExternal(provider);
+    const decision = decideExternalImport(captured, external);
+    if (decision === "not-rotated") {
+      captured.syncWarning = "external-not-rotated";
       return false;
     }
+    if (decision !== "import" || !external) return false;
+    let imported = buildImportedTokens(
+      captured,
+      external
+    );
+    const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > Date.now() + 6e4 : true;
+    if (!accessStillValid) {
+      try {
+        const refreshed = await refreshWithToken(external.refreshToken);
+        imported = {
+          ...imported,
+          accessToken: refreshed.accessToken,
+          refreshToken: refreshed.refreshToken ?? imported.refreshToken,
+          expiresAt: refreshed.expiresAt,
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        if (refreshed.idToken) imported.idToken = refreshed.idToken;
+      } catch {
+        return false;
+      }
+    }
+    this.writeBackById(provider, capturedId, imported);
+    this.resyncExternal(provider, capturedId, imported);
+    return true;
+  }
+  /**
+   * Marker-gated external write-back (external-cli-sync). After a successful
+   * refresh of the account that OWNS the provider's native CLI store (imported
+   * via `importExternalCliAccount`), push the rotated credential back into the
+   * file — otherwise the daemon's refresh invalidates the single-use refresh
+   * token and silently logs the bare CLI out. NON-FATAL: the internal store is
+   * already persisted; a failed external write only leaves the file stale,
+   * which the `external-divergent` warning surfaces.
+   */
+  resyncExternal(provider, accountId, tokens) {
+    try {
+      this.externalCliStore.writeBack(provider, accountId, tokens);
+    } catch {
+    }
+  }
+  /** Read the marker's owning account id, never letting an fs error escape. */
+  safeReadMarker(provider) {
+    try {
+      return this.externalCliStore.readMarkerAccountId(provider);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * DAEMON-ONLY (admin import button): which providers have a usable external
+   * CLI credential on THIS machine. Pure detection — reads the native files,
+   * never mutates anything, never returns a token.
+   */
+  async listExternalCliAvailability() {
+    return {
+      claude: Boolean(this.safeReadExternal("claude")?.accessToken),
+      codex: Boolean(this.safeReadExternal("codex")?.accessToken)
+    };
+  }
+  /**
+   * DAEMON-ONLY (admin import button): import the external CLI's current login
+   * as a NEW account (+ activate), and take MANAGED ownership of the native
+   * store (marker) so subsequent refreshes write back — keeping the bare CLI
+   * and the daemon on the same live credential instead of silently killing one
+   * side's single-use refresh token.
+   */
+  async importExternalCliAccount(provider, label) {
+    const external = this.safeReadExternal(provider);
+    if (!external?.accessToken) return { ok: false, reason: "no-credential" };
+    const tokens = buildTokensFromExternal(provider, external);
+    const result = await this.appendProviderAccount(provider, tokens, label);
+    try {
+      this.externalCliStore.writeMarker(provider, result.id);
+    } catch {
+    }
+    return { ok: true, id: result.id };
   }
   /**
    * Materialize a lazily-synthesized account id to disk (design D3). On a legacy
@@ -3363,6 +4298,18 @@ var JsonSubscriptionCredentialStore = class {
     this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
     return result;
   }
+  /**
+   * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
+   * rejects an unknown id. Label-only — no token material is read or written
+   * (the secret-free invariant holds).
+   */
+  async renameAccount(providerId, id, label) {
+    const current = this.readConfig();
+    const result = renameAccount(current, providerId, id, label);
+    if (!result.ok) return result;
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
   /**
    * DAEMON-ONLY CLEAR (design D1/D3, NOT on the port). Remove a single provider's
    * block from `tokens.json` and re-persist (the strategies already tolerate an
@@ -3379,9 +4326,9 @@ var JsonSubscriptionCredentialStore = class {
    *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
    *  write — incl. child 4's future refresh writes — lands encrypted. */
   persist(config) {
-    mkdirSync2(dirname2(this.tokensPath), { recursive: true });
+    mkdirSync3(dirname4(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
-    writeFileSync5(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+    writeFileSync7(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
   /**
    * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
@@ -3397,10 +4344,10 @@ var JsonSubscriptionCredentialStore = class {
    * `config.ts loadConfig`, which decrypts outside its parse try.
    */
   readConfig() {
-    if (!existsSync3(this.tokensPath)) return { updatedAt: "" };
+    if (!existsSync9(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
-      const raw = JSON.parse(readFileSync5(this.tokensPath, "utf8"));
+      const raw = JSON.parse(readFileSync9(this.tokensPath, "utf8"));
       parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
     } catch {
       parsed = null;
@@ -3411,6 +4358,95 @@ var JsonSubscriptionCredentialStore = class {
   }
 };
 
+// src/TokenRefreshScheduler.ts
+var REFRESH_LEAD_MS = 5 * 6e4;
+var SWEEP_INTERVAL_MS = 6e4;
+var OAUTH_PROVIDERS = ["claude", "codex", "gemini"];
+var TokenRefreshScheduler = class {
+  constructor(store, logger, intervalMs = SWEEP_INTERVAL_MS, leadMs = REFRESH_LEAD_MS) {
+    this.store = store;
+    this.logger = logger;
+    this.intervalMs = intervalMs;
+    this.leadMs = leadMs;
+  }
+  store;
+  logger;
+  intervalMs;
+  leadMs;
+  timer = null;
+  sweeping = false;
+  /** Arm the sweep interval. Idempotent. The timer never holds the loop open. */
+  start() {
+    if (this.timer) return;
+    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+  dispose() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+  /** One sweep over every account of every OAuth provider. Exposed for tests. */
+  async sweep(now = Date.now()) {
+    if (this.sweeping) return;
+    this.sweeping = true;
+    try {
+      const config = await this.store.getFullConfig();
+      for (const provider of OAUTH_PROVIDERS) {
+        const activeId = getActiveAccount(config, provider)?.id;
+        for (const account of listAccounts(config, provider)) {
+          if (!this.needsRefresh(account.tokens, now)) continue;
+          await this.refreshOne(provider, account.id, account.id === activeId);
+        }
+      }
+    } catch (error) {
+      this.logger.warn("token-refresh sweep failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      this.sweeping = false;
+    }
+  }
+  /** Expiring within the lead window, refreshable, and not already dead. */
+  needsRefresh(tokens, now) {
+    const t = tokens;
+    if (!t.refreshToken || t.status === "expired" || t.status === "error") return false;
+    if (!t.expiresAt) return false;
+    const expiresAt = Date.parse(t.expiresAt);
+    return Number.isFinite(expiresAt) && now >= expiresAt - this.leadMs;
+  }
+  /** Refresh one account; failures are logged, never thrown (the store has
+   *  already flagged the account `expired`). */
+  async refreshOne(provider, id, isActive) {
+    try {
+      const ok = isActive ? await this.refreshActive(provider) : await this.store.refreshAccountById(provider, id);
+      if (!ok) {
+        this.logger.warn("background token refresh failed", { provider, accountId: id });
+      } else {
+        this.logger.info("background token refresh succeeded", { provider, accountId: id });
+      }
+    } catch (error) {
+      this.logger.warn("background token refresh threw", {
+        provider,
+        accountId: id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  refreshActive(provider) {
+    switch (provider) {
+      case "claude":
+        return this.store.refreshClaudeToken();
+      case "codex":
+        return this.store.refreshCodexToken();
+      case "gemini":
+        return this.store.refreshGeminiToken();
+    }
+  }
+};
+
 // src/bootstrap.ts
 function buildDaemon(config, paths) {
   const logger = new ConsoleLogger();
@@ -3443,7 +4479,14 @@ function buildDaemon(config, paths) {
       autoDisableStore.markAutoDisabled(keyId, status, at);
     }
   );
-  const providerProxy = getProviderProxy({ llmConfig, apiKeyPool });
+  const pricingStore = new JsonPricingStore(defaultPricingPath(paths.configPath));
+  const pricingEngine = new PricingEngine(pricingStore, logger);
+  const usageEventStore = new JsonlUsageEventStore(
+    defaultUsageEventsPath(paths.configPath),
+    async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
+  );
+  const usageRecorder = new UsageRecorder(usageEventStore, pricingEngine, logger);
+  const providerProxy = getProviderProxy({ llmConfig, apiKeyPool, usageRecorder });
   llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
   const outboundApiServer = getOutboundApiServer({
     db: keyDb,
@@ -3489,10 +4532,23 @@ function buildDaemon(config, paths) {
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
     // rest). Confined to the export/import handlers; never reached by a GET.
     migrationCredentialStore: credentialStore,
+    // Code CLI launch (dashboard parity): the external-terminal opener + PATH probe
+    // default to the real implementations; tests inject spies so no window spawns.
+    cliTerminalOpener: paths.cliTerminalOpener,
+    cliPathProbe: paths.cliPathProbe,
+    cliCommandRunner: paths.cliCommandRunner,
+    // Usage/pricing admin surface (usage-pricing child): stats queries go
+    // through the recorder facade, pricing mutations through the engine, and
+    // the row DELETE through the concrete store (delete is store-local — the
+    // core port stays frozen). None of these can reach key material.
+    usageRecorder,
+    pricingEngine,
+    pricingStore,
     // Use the DECRYPTED config so `admin.token` (if stored as `enc:`) is the
     // plaintext bearer the AdminServer's constant-time compare expects (D4).
     getAdminConfig: () => resolveAdminConfig(decryptedConfig.admin)
   });
+  const tokenRefreshScheduler = new TokenRefreshScheduler(credentialStore, logger);
   return {
     logger,
     llmConfig,
@@ -3505,7 +4561,11 @@ function buildDaemon(config, paths) {
     credentialStore,
     subscriptionRegistry,
     subscriptionAccounts,
-    adminServer
+    pricingStore,
+    pricingEngine,
+    usageRecorder,
+    adminServer,
+    tokenRefreshScheduler
   };
 }
 function resetDaemonSingletonsForTests() {
@@ -3594,7 +4654,6 @@ export {
   AdminServer,
   ConfigFileProviderConfigSource,
   ConsoleLogger,
-  DASHBOARD_HTML,
   DEFAULT_ADMIN_PORT,
   JsonApiServerSettingsStore,
   JsonOutboundKeyDb,