@omnicross/daemon 0.1.0

package/dist/cli.cjs

@@ -0,0 +1,4562 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/commands/import-ccr.ts
+var import_node_fs3 = require("fs");
+var import_node_util = require("util");
+
+// src/ccr-import.ts
+function parseCcrConfig(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("CCR config: top-level value must be an object");
+  }
+  const obj = raw;
+  const Providers = Array.isArray(obj["Providers"]) ? obj["Providers"] : [];
+  const Router = obj["Router"] && typeof obj["Router"] === "object" ? obj["Router"] : {};
+  return { Providers, Router };
+}
+function inferApiFormat(provider) {
+  const hay = `${provider.api_base_url ?? ""} ${provider.name ?? ""}`.toLowerCase();
+  if (hay.includes("anthropic") || hay.includes("claude")) {
+    return { format: "anthropic", ambiguous: false };
+  }
+  if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
+    return { format: "gemini", ambiguous: false };
+  }
+  if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
+    return { format: "openai", ambiguous: false };
+  }
+  return { format: "openai", ambiguous: true };
+}
+function mapProviders(providers, notes) {
+  const rows = [];
+  for (const [i, p] of providers.entries()) {
+    const id = p.name?.trim();
+    if (!id) {
+      notes.push(`Providers[${i}] has no name \u2014 skipped.`);
+      continue;
+    }
+    const { format, ambiguous } = inferApiFormat(p);
+    if (ambiguous) {
+      notes.push(
+        `Provider '${id}': could not infer apiFormat from base URL \u2014 defaulted to 'openai'. Edit the config if this provider speaks a different wire format.`
+      );
+    }
+    rows.push({
+      id,
+      apiFormat: format,
+      baseUrl: p.api_base_url ?? "",
+      apiKey: p.api_key ?? "",
+      models: Array.isArray(p.models) ? p.models : void 0
+    });
+  }
+  return rows;
+}
+function noteRouterRoles(router, notes) {
+  if (router.think) {
+    notes.push(`Router.think \u2192 folded into 'default' (omnicross has no think slot).`);
+  }
+  if (router.longContext) {
+    notes.push(
+      `Router.longContext \u2192 folded into 'default' (no longContext slot; longContextThreshold dropped).`
+    );
+  }
+  if (router.image) {
+    notes.push(`Router.image \u2192 mapped to 'vision' (CCR forceUseImageAgent dropped).`);
+  }
+  if (router.webSearch) {
+    notes.push(
+      `Router.webSearch \u2192 DROPPED. omnicross injects web search via an interception port rather than routing to a natively-online model; the CCR webSearch model ('${router.webSearch}') was not carried over.`
+    );
+  }
+}
+function mapCcrToOmnicross(ccr) {
+  const notes = [];
+  const providers = mapProviders(ccr.Providers ?? [], notes);
+  noteRouterRoles(ccr.Router ?? {}, notes);
+  return { config: { providers }, notes };
+}
+
+// src/config.ts
+var import_node_fs2 = require("fs");
+
+// src/secrets/envelope.ts
+var import_node_crypto = require("crypto");
+var ENVELOPE_PREFIX = "enc:";
+var ENVELOPE_VERSION = "v1";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function isEnvelope(s) {
+  return s.startsWith(ENVELOPE_PREFIX);
+}
+function parseEnvelope(envelope) {
+  const parts = envelope.split(":");
+  if (parts.length !== 5 || `${parts[0]}:` !== ENVELOPE_PREFIX) {
+    throw new Error("secret envelope is malformed (expected enc:v1:<iv>:<tag>:<ciphertext>)");
+  }
+  const [, version, ivB64, tagB64, ctB64] = parts;
+  if (version !== ENVELOPE_VERSION) {
+    throw new Error(`unsupported secret envelope version '${version}' (expected ${ENVELOPE_VERSION})`);
+  }
+  const iv = Buffer.from(ivB64, "base64");
+  const tag = Buffer.from(tagB64, "base64");
+  const ciphertext = Buffer.from(ctB64, "base64");
+  if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
+    throw new Error("secret envelope has an invalid iv/tag length");
+  }
+  return { version, iv, tag, ciphertext };
+}
+function encryptValue(plain, key) {
+  if (key.length !== KEY_BYTES) {
+    throw new Error(`secret key must be ${KEY_BYTES} bytes`);
+  }
+  const iv = (0, import_node_crypto.randomBytes)(IV_BYTES);
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return [
+    ENVELOPE_PREFIX.slice(0, -1),
+    // 'enc' (prefix without its trailing ':')
+    ENVELOPE_VERSION,
+    iv.toString("base64"),
+    tag.toString("base64"),
+    ciphertext.toString("base64")
+  ].join(":");
+}
+function decryptValue(envelope, key) {
+  if (key.length !== KEY_BYTES) {
+    throw new Error(`secret key must be ${KEY_BYTES} bytes`);
+  }
+  const { iv, tag, ciphertext } = parseEnvelope(envelope);
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return plain.toString("utf8");
+}
+
+// src/secrets/masterKey.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var MASTER_KEY_ENV = "OMNICROSS_MASTER_KEY";
+var KEY_BYTES2 = 32;
+function defaultMasterKeyPath() {
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".omnicross", "master.key");
+}
+function decodeEnvKey(raw) {
+  const trimmed = raw.trim();
+  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {
+    return Buffer.from(trimmed, "hex");
+  }
+  const buf = Buffer.from(trimmed, "base64");
+  if (buf.length !== KEY_BYTES2) {
+    throw new Error(
+      `${MASTER_KEY_ENV} is invalid: expected 64 hex chars or base64 decoding to ${KEY_BYTES2} bytes`
+    );
+  }
+  return buf;
+}
+function readKeyFile(path) {
+  const raw = (0, import_node_fs.readFileSync)(path);
+  if (raw.length === KEY_BYTES2) return raw;
+  const text = raw.toString("utf8").trim();
+  if (/^[0-9a-fA-F]{64}$/.test(text)) return Buffer.from(text, "hex");
+  const b64 = Buffer.from(text, "base64");
+  if (b64.length === KEY_BYTES2) return b64;
+  throw new Error(
+    `master key file '${path}' is invalid: expected 32 raw bytes, 64 hex chars, or 32-byte base64`
+  );
+}
+function generateKeyFile(path) {
+  const key = (0, import_node_crypto2.randomBytes)(KEY_BYTES2);
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
+  (0, import_node_fs.writeFileSync)(path, key, { mode: 384 });
+  try {
+    (0, import_node_fs.chmodSync)(path, 384);
+  } catch {
+  }
+  return key;
+}
+function resolveMasterKey(options = {}) {
+  const envRaw = options.envVar ?? process.env[MASTER_KEY_ENV];
+  if (typeof envRaw === "string" && envRaw.trim().length > 0) {
+    return decodeEnvKey(envRaw);
+  }
+  const keyFilePath = options.keyFilePath ?? defaultMasterKeyPath();
+  if ((0, import_node_fs.existsSync)(keyFilePath)) {
+    return readKeyFile(keyFilePath);
+  }
+  return generateKeyFile(keyFilePath);
+}
+
+// src/secrets/SecretBox.ts
+function isEnvRef(value) {
+  return value.startsWith("$");
+}
+var SecretBox = class {
+  /** The raw 32-byte master key (resolved lazily). Held privately; never logged. */
+  key;
+  /** The lazy resolver (used once, then nulled after caching the key). */
+  resolver;
+  constructor(key) {
+    if (typeof key === "function") {
+      this.key = null;
+      this.resolver = key;
+    } else {
+      if (key.length !== 32) {
+        throw new Error("SecretBox requires a 32-byte master key");
+      }
+      this.key = key;
+      this.resolver = null;
+    }
+  }
+  /** Resolve (and cache) the master key on first crypto use. Validates length. */
+  getKey() {
+    if (this.key) return this.key;
+    if (!this.resolver) {
+      throw new Error("SecretBox has no master key");
+    }
+    const resolved = this.resolver();
+    if (resolved.length !== 32) {
+      throw new Error("SecretBox requires a 32-byte master key");
+    }
+    this.key = resolved;
+    this.resolver = null;
+    return resolved;
+  }
+  /** Encrypt a plaintext value into a fresh `enc:v1:...` envelope (unconditional). */
+  encrypt(plain) {
+    return encryptValue(plain, this.getKey());
+  }
+  /**
+   * Decrypt an `enc:v1:...` envelope to plaintext. Wraps a GCM verification
+   * failure (wrong master key or a tampered envelope) into a clear, actionable
+   * error — the original crypto error (which carries no secret material) is
+   * intentionally NOT re-surfaced verbatim and the ciphertext/key are never
+   * placed in the message.
+   */
+  decrypt(envelope) {
+    try {
+      return decryptValue(envelope, this.getKey());
+    } catch {
+      throw new Error(
+        `failed to decrypt a stored secret: the master key does not match (wrong ${"OMNICROSS_MASTER_KEY"} / master.key) or the encrypted value was tampered with`
+      );
+    }
+  }
+  /**
+   * READ-direction tri-state: decrypt an `enc:` envelope; pass a `$ENV`
+   * reference or legacy plaintext through unchanged. Idempotent on any
+   * non-envelope value.
+   */
+  decryptMaybe(value) {
+    if (!value) return value;
+    if (isEnvRef(value)) return value;
+    if (isEnvelope(value)) return this.decrypt(value);
+    return value;
+  }
+  /**
+   * WRITE-direction tri-state: encrypt legacy plaintext; pass a `$ENV` reference
+   * (never encrypt indirection) or an already-`enc:` envelope (no `enc:enc:`
+   * nesting) through unchanged. Idempotent — re-applying never re-encrypts.
+   */
+  encryptMaybe(value) {
+    if (!value) return value;
+    if (isEnvRef(value)) return value;
+    if (isEnvelope(value)) return value;
+    return this.encrypt(value);
+  }
+};
+
+// src/secrets/secretFields.ts
+function transformProvider(provider, fn) {
+  const next = { ...provider, apiKey: fn(provider.apiKey) };
+  if (provider.apiKeys) {
+    next.apiKeys = provider.apiKeys.map((entry) => ({ ...entry, apiKey: fn(entry.apiKey) }));
+  }
+  if (provider.codingPlan && typeof provider.codingPlan.apiKey === "string" && provider.codingPlan.apiKey.length > 0) {
+    next.codingPlan = { ...provider.codingPlan, apiKey: fn(provider.codingPlan.apiKey) };
+  }
+  if (provider.apiModes) {
+    next.apiModes = provider.apiModes.map(
+      (mode) => typeof mode.apiKey === "string" && mode.apiKey.length > 0 ? { ...mode, apiKey: fn(mode.apiKey) } : mode
+    );
+  }
+  return next;
+}
+function transformConfigSecrets(cfg, fn) {
+  const next = {
+    ...cfg,
+    providers: cfg.providers.map((p) => transformProvider(p, fn))
+  };
+  if (cfg.admin && typeof cfg.admin.token === "string" && cfg.admin.token.length > 0) {
+    next.admin = { ...cfg.admin, token: fn(cfg.admin.token) };
+  }
+  return next;
+}
+function encryptConfigSecrets(cfg, box) {
+  return transformConfigSecrets(cfg, (v) => box.encryptMaybe(v));
+}
+function decryptConfigSecrets(cfg, box) {
+  return transformConfigSecrets(cfg, (v) => box.decryptMaybe(v));
+}
+var TOKEN_FIELDS = {
+  claude: ["accessToken", "refreshToken"],
+  codex: ["accessToken", "refreshToken", "idToken"],
+  gemini: ["accessToken", "refreshToken"],
+  opencodego: ["apiKey"]
+};
+function transformTokenBlock(block, fields, fn) {
+  const next = { ...block };
+  for (const field of fields) {
+    const value = next[field];
+    if (typeof value === "string" && value.length > 0) {
+      next[field] = fn(value);
+    }
+  }
+  return next;
+}
+function transformTokens(tokens, fn) {
+  const next = { ...tokens };
+  const bag = next;
+  for (const [provider, fields] of Object.entries(TOKEN_FIELDS)) {
+    const block = bag[provider];
+    if (block && typeof block === "object" && !Array.isArray(block)) {
+      bag[provider] = transformTokenBlock(block, fields, fn);
+    }
+    const accountsKey = `${provider}Accounts`;
+    const accounts = bag[accountsKey];
+    if (Array.isArray(accounts)) {
+      bag[accountsKey] = accounts.map((entry) => {
+        if (entry && typeof entry === "object" && "tokens" in entry && entry.tokens && typeof entry.tokens === "object") {
+          return {
+            ...entry,
+            tokens: transformTokenBlock(
+              entry.tokens,
+              fields,
+              fn
+            )
+          };
+        }
+        return entry;
+      });
+    }
+  }
+  return next;
+}
+function encryptTokens(tokens, box) {
+  return transformTokens(tokens, (v) => box.encryptMaybe(v));
+}
+function decryptTokens(tokens, box) {
+  return transformTokens(tokens, (v) => box.decryptMaybe(v));
+}
+
+// src/config.ts
+var DEFAULT_ADMIN_PORT = 8766;
+function validateAdmin(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const a = raw;
+  const out = {};
+  if (typeof a["enabled"] === "boolean") out.enabled = a["enabled"];
+  if (typeof a["port"] === "number" && Number.isFinite(a["port"])) out.port = a["port"];
+  if (typeof a["networkBinding"] === "boolean") out.networkBinding = a["networkBinding"];
+  if (typeof a["token"] === "string" && a["token"].length > 0) out.token = a["token"];
+  return out;
+}
+function resolveAdminConfig(admin) {
+  return {
+    enabled: admin?.enabled !== false,
+    port: typeof admin?.port === "number" ? admin.port : DEFAULT_ADMIN_PORT,
+    networkBinding: admin?.networkBinding === true,
+    token: typeof admin?.token === "string" && admin.token.length > 0 ? admin.token : void 0
+  };
+}
+var VALID_FORMATS = ["openai", "anthropic", "gemini"];
+function validateApiKeys(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const k = item;
+    const id = k["id"];
+    const apiKey = k["apiKey"];
+    if (typeof id !== "string" || !id.trim()) continue;
+    if (typeof apiKey !== "string" || apiKey.length === 0) continue;
+    const entry = { id, apiKey };
+    if (typeof k["label"] === "string" && k["label"].length > 0) entry.label = k["label"];
+    if (typeof k["enabled"] === "boolean") entry.enabled = k["enabled"];
+    if (typeof k["weight"] === "number" && Number.isFinite(k["weight"])) entry.weight = k["weight"];
+    out.push(entry);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function validateModelConfigs(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const m = item;
+    const id = m["id"];
+    if (typeof id !== "string" || !id.trim()) continue;
+    const entry = { id };
+    if (typeof m["name"] === "string" && m["name"].length > 0) entry.name = m["name"];
+    if (typeof m["group"] === "string" && m["group"].length > 0) entry.group = m["group"];
+    if (typeof m["enabled"] === "boolean") entry.enabled = m["enabled"];
+    if (typeof m["vision"] === "boolean") entry.vision = m["vision"];
+    if (typeof m["reasoning"] === "boolean") entry.reasoning = m["reasoning"];
+    out.push(entry);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function validateTransformerEntry(item) {
+  if (typeof item === "string") return item.length > 0 ? item : null;
+  if (Array.isArray(item) && item.length === 2) {
+    const [name, opts] = item;
+    if (typeof name === "string" && name.length > 0 && opts && typeof opts === "object" && !Array.isArray(opts)) {
+      return [name, opts];
+    }
+  }
+  return null;
+}
+function validateTransformer(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const t = raw;
+  const out = {};
+  let kept = false;
+  if (Array.isArray(t["use"])) {
+    const use = [];
+    for (const item of t["use"]) {
+      const entry = validateTransformerEntry(item);
+      if (entry !== null) use.push(entry);
+    }
+    if (use.length > 0) {
+      out.use = use;
+      kept = true;
+    }
+  }
+  for (const key of Object.keys(t)) {
+    if (key === "use") continue;
+    const value = t[key];
+    if (value && typeof value === "object") {
+      out[key] = value;
+      kept = true;
+    }
+  }
+  return kept ? out : void 0;
+}
+function validateCodingPlan(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const c = raw;
+  const enabled = c["enabled"] === true;
+  const baseUrl = typeof c["baseUrl"] === "string" && c["baseUrl"].length > 0 ? c["baseUrl"] : void 0;
+  const apiKey = typeof c["apiKey"] === "string" && c["apiKey"].length > 0 ? c["apiKey"] : void 0;
+  const note = typeof c["note"] === "string" && c["note"].length > 0 ? c["note"] : void 0;
+  if (!enabled && !baseUrl && !apiKey && !note) return void 0;
+  const out = { enabled };
+  if (baseUrl) out.baseUrl = baseUrl;
+  if (apiKey) out.apiKey = apiKey;
+  if (note) out.note = note;
+  return out;
+}
+function validateApiModes(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const m = item;
+    const id = typeof m["id"] === "string" && m["id"].trim() ? m["id"].trim() : "";
+    const baseUrl = typeof m["baseUrl"] === "string" && m["baseUrl"].length > 0 ? m["baseUrl"] : "";
+    if (!id || !baseUrl) continue;
+    const label = typeof m["label"] === "string" && m["label"].length > 0 ? m["label"] : id;
+    const entry = { id, label, baseUrl };
+    if (typeof m["apiKey"] === "string" && m["apiKey"].length > 0) entry.apiKey = m["apiKey"];
+    if (typeof m["apiKeyPrefix"] === "string" && m["apiKeyPrefix"].length > 0) entry.apiKeyPrefix = m["apiKeyPrefix"];
+    if (typeof m["note"] === "string" && m["note"].length > 0) entry.note = m["note"];
+    out.push(entry);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function validateProvider(raw, index) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error(`config: providers[${index}] is not an object`);
+  }
+  const p = raw;
+  const id = p["id"];
+  const apiFormat = p["apiFormat"];
+  const baseUrl = p["baseUrl"];
+  const apiKey = p["apiKey"];
+  if (typeof id !== "string" || !id.trim()) {
+    throw new Error(`config: providers[${index}].id is required`);
+  }
+  if (typeof apiFormat !== "string" || !VALID_FORMATS.includes(apiFormat)) {
+    throw new Error(
+      `config: providers[${index}].apiFormat must be one of ${VALID_FORMATS.join(", ")}`
+    );
+  }
+  if (typeof baseUrl !== "string" || !baseUrl.trim()) {
+    throw new Error(`config: providers[${index}].baseUrl is required`);
+  }
+  if (typeof apiKey !== "string") {
+    throw new Error(`config: providers[${index}].apiKey is required`);
+  }
+  const models = p["models"];
+  const name = typeof p["name"] === "string" && p["name"].length > 0 ? p["name"] : void 0;
+  const enabled = typeof p["enabled"] === "boolean" ? p["enabled"] : void 0;
+  const isOfficial = typeof p["isOfficial"] === "boolean" ? p["isOfficial"] : void 0;
+  const apiVersion = typeof p["apiVersion"] === "string" && p["apiVersion"].length > 0 ? p["apiVersion"] : void 0;
+  const maxConcurrency = typeof p["maxConcurrency"] === "number" && Number.isFinite(p["maxConcurrency"]) ? p["maxConcurrency"] : void 0;
+  const modelsEndpoint = typeof p["modelsEndpoint"] === "string" && p["modelsEndpoint"].length > 0 ? p["modelsEndpoint"] : void 0;
+  return {
+    id,
+    name,
+    apiFormat,
+    baseUrl,
+    apiKey,
+    models: Array.isArray(models) ? models.filter((m) => typeof m === "string") : void 0,
+    // Per-model metadata (app-parity child 2): load-guard, collapse-to-undefined.
+    modelConfigs: validateModelConfigs(p["modelConfigs"]),
+    apiKeys: validateApiKeys(p["apiKeys"]),
+    enabled,
+    isOfficial,
+    apiVersion,
+    maxConcurrency,
+    modelsEndpoint,
+    // Provider transformer config (app-parity child 5): load-guard, collapse-to-
+    // undefined; non-secret; ENFORCED via resolveTransformerChain (parity-2 child 2).
+    transformer: validateTransformer(p["transformer"]),
+    // Coding-plan endpoint (app-parity-2 child 3): load-guard, collapse-to-undefined.
+    // SECRET-bearing (apiKey encrypted at rest); enforced by core's resolveProviderEndpoint.
+    codingPlan: validateCodingPlan(p["codingPlan"]),
+    // API modes (app-parity-2 child 4): load-guard, collapse-to-undefined. Each
+    // mode's apiKey is SECRET (encrypted at rest); enforced by core (layer 1).
+    apiModes: validateApiModes(p["apiModes"]),
+    selectedApiModeId: typeof p["selectedApiModeId"] === "string" && p["selectedApiModeId"].length > 0 ? p["selectedApiModeId"] : void 0
+  };
+}
+function validateConfig(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("config: top-level value must be an object");
+  }
+  const obj = raw;
+  const providersRaw = obj["providers"];
+  if (!Array.isArray(providersRaw)) {
+    throw new Error("config: 'providers' must be an array");
+  }
+  const providers = providersRaw.map((p, i) => validateProvider(p, i));
+  const server = obj["server"];
+  const admin = validateAdmin(obj["admin"]);
+  return { providers, server, admin };
+}
+var secretBox = null;
+function setSecretBox(box) {
+  secretBox = box;
+}
+function loadConfig(path) {
+  let raw;
+  try {
+    raw = (0, import_node_fs2.readFileSync)(path, "utf8");
+  } catch {
+    throw new Error(`config: cannot read file at '${path}'`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`config: '${path}' is not valid JSON`);
+  }
+  const validated = validateConfig(parsed);
+  return secretBox ? decryptConfigSecrets(validated, secretBox) : validated;
+}
+function saveConfig(path, cfg) {
+  const toWrite = secretBox ? encryptConfigSecrets(cfg, secretBox) : cfg;
+  (0, import_node_fs2.writeFileSync)(path, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
+}
+
+// src/commands/paths.ts
+var import_node_path2 = require("path");
+function defaultKeysPath(configPath) {
+  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "keys.json");
+}
+function defaultTokensPath(configPath) {
+  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "tokens.json");
+}
+function resolveSecretBox(masterKeyFilePath) {
+  return new SecretBox(() => resolveMasterKey({ keyFilePath: masterKeyFilePath }));
+}
+
+// src/commands/import-ccr.ts
+async function runImportCcr(argv) {
+  const { values, positionals } = (0, import_node_util.parseArgs)({
+    args: argv,
+    options: {
+      out: { type: "string", short: "o" },
+      "master-key-file": { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const ccrPath = positionals[0];
+  if (!ccrPath) {
+    throw new Error("import-ccr: a <ccr-config-path> is required");
+  }
+  const outPath = values.out ?? "omnicross.config.json";
+  let raw;
+  try {
+    raw = JSON.parse((0, import_node_fs3.readFileSync)(ccrPath, "utf8"));
+  } catch {
+    throw new Error(`import-ccr: cannot read or parse '${ccrPath}'`);
+  }
+  const ccr = parseCcrConfig(raw);
+  const { config, notes } = mapCcrToOmnicross(ccr);
+  setSecretBox(resolveSecretBox(values["master-key-file"]));
+  try {
+    saveConfig(outPath, config);
+  } finally {
+    setSecretBox(null);
+  }
+  console.info(`Wrote omnicross config \u2192 ${outPath}`);
+  console.info(`  providers: ${config.providers.length}`);
+  if (notes.length > 0) {
+    console.info("Notes:");
+    for (const note of notes) console.info(`  \u2022 ${note}`);
+  }
+}
+
+// src/commands/keys.ts
+var import_node_util2 = require("util");
+var import_outbound_api = require("@omnicross/core/outbound-api");
+
+// src/ports/JsonOutboundKeyDb.ts
+var import_node_fs4 = require("fs");
+var JsonOutboundKeyDb = class {
+  constructor(keysPath) {
+    this.keysPath = keysPath;
+  }
+  keysPath;
+  async outboundApiKeysList() {
+    return this.readRows();
+  }
+  async outboundApiKeysGetByHash(hash) {
+    const rows = this.readRows();
+    const row = rows.find(
+      (r) => r.keyHash === hash && r.enabled && r.revokedAt === null
+    );
+    return row ?? null;
+  }
+  async outboundApiKeysCreate(input) {
+    const rows = this.readRows();
+    const row = {
+      id: input.id,
+      name: input.name,
+      keyHash: input.keyHash,
+      keyPrefix: input.keyPrefix,
+      enabled: true,
+      createdAt: input.createdAt ?? Date.now(),
+      lastUsedAt: null,
+      revokedAt: null
+    };
+    rows.push(row);
+    this.writeRows(rows);
+    return row;
+  }
+  async outboundApiKeysRevoke(id) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      row.revokedAt = Date.now();
+      row.enabled = false;
+      return true;
+    });
+  }
+  async outboundApiKeysTouchLastUsed(id) {
+    return this.mutateRow(id, (row) => {
+      row.lastUsedAt = Date.now();
+      return true;
+    });
+  }
+  async outboundApiKeysSetEnabled(id, enabled) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      row.enabled = enabled;
+      return true;
+    });
+  }
+  /** Apply `fn` to the row with `id`, persisting when it returns true. */
+  mutateRow(id, fn) {
+    const rows = this.readRows();
+    const row = rows.find((r) => r.id === id);
+    if (!row) return false;
+    const changed = fn(row);
+    if (changed) this.writeRows(rows);
+    return changed;
+  }
+  /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
+  readRows() {
+    if (!(0, import_node_fs4.existsSync)(this.keysPath)) return [];
+    try {
+      const parsed = JSON.parse((0, import_node_fs4.readFileSync)(this.keysPath, "utf8"));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  writeRows(rows) {
+    (0, import_node_fs4.writeFileSync)(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+  }
+};
+
+// src/commands/keys.ts
+async function runKeys(argv) {
+  const { values, positionals } = (0, import_node_util2.parseArgs)({
+    args: argv,
+    options: { config: { type: "string", short: "c" } },
+    allowPositionals: true
+  });
+  const configPath = values.config;
+  if (!configPath) {
+    throw new Error("keys: --config <path> is required");
+  }
+  const db = new JsonOutboundKeyDb(defaultKeysPath(configPath));
+  const action = positionals[0];
+  switch (action) {
+    case "add":
+      return keysAdd(db, positionals[1]);
+    case "list":
+      return keysList(db);
+    case "revoke":
+      return keysRevoke(db, positionals[1]);
+    default:
+      throw new Error(`keys: unknown action '${action ?? ""}' (expected add|list|revoke)`);
+  }
+}
+async function keysAdd(db, name) {
+  if (!name) throw new Error("keys add: a <name> is required");
+  const created = await (0, import_outbound_api.createNamedKey)(db, name);
+  console.info(`Created key '${created.name}' (id: ${created.id}).`);
+  console.info("");
+  console.info(`  ${created.plaintextOnce}`);
+  console.info("");
+  console.info("This is the ONLY time the full key is shown \u2014 store it now.");
+}
+async function keysList(db) {
+  const rows = await db.outboundApiKeysList();
+  if (rows.length === 0) {
+    console.info("No keys.");
+    return;
+  }
+  for (const r of rows) {
+    const state = r.revokedAt !== null ? "revoked" : r.enabled ? "enabled" : "disabled";
+    const last = r.lastUsedAt ? new Date(r.lastUsedAt).toISOString() : "never";
+    console.info(
+      `${r.id}  ${r.keyPrefix}\u2026  ${state}  name=${r.name}  created=${new Date(r.createdAt).toISOString()}  lastUsed=${last}`
+    );
+  }
+}
+async function keysRevoke(db, id) {
+  if (!id) throw new Error("keys revoke: an <id> is required");
+  const ok = await db.outboundApiKeysRevoke(id);
+  console.info(ok ? `Revoked key '${id}'.` : `No active key with id '${id}'.`);
+}
+
+// src/commands/launch.ts
+var import_node_child_process = require("child_process");
+var import_node_fs7 = require("fs");
+var import_node_path4 = require("path");
+var import_node_util3 = require("util");
+var import_cli_launcher = require("@omnicross/cli-launcher");
+
+// src/bootstrap.ts
+var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
+var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
+var import_outbound_api4 = require("@omnicross/core/outbound-api");
+var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
+var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
+var import_provider_proxy = require("@omnicross/core/provider-proxy");
+var import_subscriptions4 = require("@omnicross/subscriptions");
+
+// src/admin/accountsCodexOAuth.ts
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+var import_subscriptions = require("@omnicross/subscriptions");
+var DEFAULT_CODEX_OAUTH_TTL_MS = 10 * 60 * 1e3;
+var CodexOAuthSessionStore = class {
+  constructor(ttlMs = DEFAULT_CODEX_OAUTH_TTL_MS) {
+    this.ttlMs = ttlMs;
+  }
+  ttlMs;
+  sessions = /* @__PURE__ */ new Map();
+  activeSessionId = null;
+  /** Whether a codex sign-in is currently in flight (port 1455 held). */
+  isBusy() {
+    this.sweep();
+    return this.activeSessionId !== null;
+  }
+  /** Mint a fresh sessionId, mark it pending + active, return the id. */
+  begin() {
+    this.sweep();
+    const sessionId = import_node_crypto3.default.randomBytes(24).toString("base64url");
+    this.sessions.set(sessionId, { status: "pending", createdAt: Date.now() });
+    this.activeSessionId = sessionId;
+    return sessionId;
+  }
+  /** Settle a flow (done/error) + free the active slot. */
+  settle(sessionId, status, error) {
+    const prior = this.sessions.get(sessionId);
+    this.sessions.set(sessionId, { status, error, createdAt: prior?.createdAt ?? Date.now() });
+    if (this.activeSessionId === sessionId) this.activeSessionId = null;
+  }
+  /** Read a flow's status (token-free), or null when unknown/expired. */
+  get(sessionId) {
+    this.sweep();
+    return this.sessions.get(sessionId) ?? null;
+  }
+  /** Drop expired flows; free the active slot if the active flow expired. */
+  sweep() {
+    const now = Date.now();
+    for (const [id, s] of this.sessions) {
+      if (now - s.createdAt > this.ttlMs) {
+        this.sessions.delete(id);
+        if (this.activeSessionId === id) this.activeSessionId = null;
+      }
+    }
+  }
+};
+function err(status, message) {
+  return { status, body: { error: { type: "admin_api_error", message } } };
+}
+function handleCodexOAuthStart(deps) {
+  if (deps.codexSessions.isBusy()) {
+    return err(
+      409,
+      "a codex sign-in is already in progress (loopback 127.0.0.1:1455 is held) \u2014 finish it in the browser or wait for it to time out"
+    );
+  }
+  const { authUrl, codeVerifier, state } = import_subscriptions.codexOAuth.generateAuthParams();
+  const sessionId = deps.codexSessions.begin();
+  void runCodexLoopback(sessionId, codeVerifier, state, deps);
+  return { status: 200, body: { authUrl, sessionId } };
+}
+async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
+  try {
+    const code = await deps.codexAwaitLoopback(state);
+    const result = await import_subscriptions.codexOAuth.exchangeCodeForTokens(
+      { authorizationCode: code, codeVerifier, state },
+      deps.oauthExchangeFetch
+    );
+    const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+    const block = {
+      authMethod: "oauth",
+      status: "authorized",
+      accessToken: result.accessToken,
+      refreshToken: result.refreshToken,
+      idToken: result.idToken,
+      expiresAt,
+      lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await deps.subscriptionAccountAppender.appendProviderAccount("codex", block);
+    deps.codexSessions.settle(sessionId, "done");
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : "codex sign-in failed";
+    deps.codexSessions.settle(sessionId, "error", reason);
+  }
+}
+function handleCodexOAuthStatus(sessionId, deps) {
+  const s = deps.codexSessions.get(sessionId);
+  if (!s) return err(404, "unknown or expired codex sign-in session");
+  return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
+}
+
+// src/admin/AdminServer.ts
+var import_node_crypto6 = require("crypto");
+var import_node_http2 = __toESM(require("http"), 1);
+
+// src/admin/adminApi.ts
+var import_node_http = __toESM(require("http"), 1);
+var import_outbound_api2 = require("@omnicross/core/outbound-api");
+
+// src/pool/resolveEnvKey.ts
+function resolveEnvKey(rawKey) {
+  if (!rawKey) return "";
+  if (rawKey.startsWith("$")) {
+    return process.env[rawKey.slice(1)] || "";
+  }
+  return rawKey;
+}
+
+// src/preset-catalog.ts
+var presetsModule = __toESM(require("@omnicross/contracts/provider-presets"), 1);
+function normalizeCatalogModule(m) {
+  const ns = m ?? {};
+  const fromDefault = ns["default"];
+  const picked = (Array.isArray(ns["LLM_PROVIDER_PRESETS"]) ? ns : fromDefault) ?? ns;
+  if (!Array.isArray(picked["LLM_PROVIDER_PRESETS"])) {
+    throw new Error(
+      "preset-catalog: @omnicross/contracts/provider-presets did not resolve a usable catalog (no LLM_PROVIDER_PRESETS array on the namespace or its .default)"
+    );
+  }
+  return picked;
+}
+var catalog = normalizeCatalogModule(presetsModule);
+function getCatalog() {
+  return catalog.getAllProviderPresets();
+}
+function getPresetById(idOrPresetId) {
+  return catalog.getPresetById(idOrPresetId);
+}
+
+// src/preset-map.ts
+var EXCLUSION_REASONS = {
+  "openai-response": "daemon rows have no openai-response format; the Responses API needs a transformer chain that a BYO daemon provider row cannot express.",
+  "azure-openai": "Azure needs an apiVersion + a deployment-name-as-model URL template + an empty baseUrl; a daemon provider row cannot express that shape."
+};
+var FORMAT_MAP = {
+  openai: "openai",
+  anthropic: "anthropic",
+  google: "gemini",
+  "openai-response": null,
+  "azure-openai": null
+};
+function resolveFormat(raw) {
+  const fmt = raw;
+  if (fmt === void 0 || !(fmt in FORMAT_MAP)) {
+    return {
+      excludedReason: `unknown/unsupported preset apiFormat '${String(raw)}'; no daemon format mapping.`
+    };
+  }
+  const mapped = FORMAT_MAP[fmt];
+  if (mapped === null) {
+    return { excludedReason: EXCLUSION_REASONS[fmt] };
+  }
+  return { format: mapped };
+}
+function mapPresetToProvider(preset, opts) {
+  const resolved = resolveFormat(preset.apiFormat);
+  if ("excludedReason" in resolved) {
+    return { excluded: { id: opts.id ?? preset.id, reason: resolved.excludedReason } };
+  }
+  if (!opts.key) {
+    return { missingKey: true };
+  }
+  const provider = {
+    id: opts.id ?? preset.id,
+    apiFormat: resolved.format,
+    baseUrl: opts.baseUrlOverride ?? preset.api_base_url,
+    apiKey: opts.key,
+    models: Array.isArray(preset.models) ? preset.models : void 0
+  };
+  return { provider };
+}
+function listMappablePresets() {
+  const mappable = [];
+  const excluded = [];
+  for (const preset of getCatalog()) {
+    const resolved = resolveFormat(preset.apiFormat);
+    if ("excludedReason" in resolved) {
+      excluded.push({ id: preset.id, reason: resolved.excludedReason });
+      continue;
+    }
+    mappable.push({
+      id: preset.id,
+      presetId: preset.presetId,
+      name: preset.name,
+      apiFormat: resolved.format,
+      baseUrl: preset.api_base_url,
+      models: Array.isArray(preset.models) ? preset.models : []
+    });
+  }
+  return { mappable, excluded };
+}
+
+// src/admin/accountsOAuth.ts
+var import_subscriptions2 = require("@omnicross/subscriptions");
+
+// src/admin/accountsWrite.ts
+var VALID_PROVIDER_IDS = [
+  "claude",
+  "codex",
+  "gemini",
+  "opencodego"
+];
+function asSubscriptionProviderId(id) {
+  return VALID_PROVIDER_IDS.includes(id) ? id : null;
+}
+var CLAUDE_AUTH_METHODS = /* @__PURE__ */ new Set(["oauth", "setup_token", "manual"]);
+var OAUTH_AUTH_METHODS = /* @__PURE__ */ new Set(["oauth", "manual"]);
+var TOKEN_STATUSES = /* @__PURE__ */ new Set([
+  "unconfigured",
+  "authorized",
+  "configured",
+  "expired",
+  "error"
+]);
+var OPENCODEGO_STATUSES = /* @__PURE__ */ new Set(["unconfigured", "configured", "error"]);
+function str(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function strArr(v) {
+  if (!Array.isArray(v)) return void 0;
+  return v.filter((x) => typeof x === "string");
+}
+function validateClaude(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (!authMethod || !CLAUDE_AUTH_METHODS.has(authMethod)) return null;
+  if (!status || !TOKEN_STATUSES.has(status)) return null;
+  const subscriptionLevel = str(body["subscriptionLevel"]);
+  const out = {
+    authMethod,
+    status
+  };
+  if (subscriptionLevel === "Free" || subscriptionLevel === "Pro" || subscriptionLevel === "Max") {
+    out.subscriptionLevel = subscriptionLevel;
+  }
+  copyOptional(out, body, ["accessToken", "refreshToken", "expiresAt", "setupTokenExpiresAt", "lastRefreshedAt", "errorMessage"]);
+  const scopes = strArr(body["scopes"]);
+  if (scopes) out.scopes = scopes;
+  if (typeof body["isSetupToken"] === "boolean") out.isSetupToken = body["isSetupToken"];
+  return out;
+}
+function validateCodex(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (!authMethod || !OAUTH_AUTH_METHODS.has(authMethod)) return null;
+  if (!status || !TOKEN_STATUSES.has(status)) return null;
+  const out = {
+    authMethod,
+    status
+  };
+  copyOptional(out, body, [
+    "accessToken",
+    "refreshToken",
+    "idToken",
+    "expiresAt",
+    "accountId",
+    "email",
+    "organizationId",
+    "lastRefreshedAt",
+    "errorMessage"
+  ]);
+  return out;
+}
+function validateGemini(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (!authMethod || !OAUTH_AUTH_METHODS.has(authMethod)) return null;
+  if (!status || !TOKEN_STATUSES.has(status)) return null;
+  const out = {
+    authMethod,
+    status
+  };
+  copyOptional(out, body, ["accessToken", "refreshToken", "expiresAt", "lastRefreshedAt", "errorMessage"]);
+  return out;
+}
+function validateOpenCodeGo(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (authMethod !== "manual") return null;
+  if (!status || !OPENCODEGO_STATUSES.has(status)) return null;
+  const out = {
+    authMethod: "manual",
+    status
+  };
+  copyOptional(out, body, ["apiKey", "baseUrl", "zenBaseUrl", "lastRefreshedAt", "errorMessage"]);
+  if (body["modelMap"] && typeof body["modelMap"] === "object") {
+    out.modelMap = body["modelMap"];
+  }
+  if (body["fallbacks"] && typeof body["fallbacks"] === "object") {
+    out.fallbacks = body["fallbacks"];
+  }
+  return out;
+}
+function copyOptional(out, body, keys) {
+  const sink = out;
+  for (const key of keys) {
+    const v = body[key];
+    if (typeof v === "string") sink[key] = v;
+  }
+}
+function validateTokenBody(providerId, body) {
+  switch (providerId) {
+    case "claude":
+      return validateClaude(body);
+    case "codex":
+      return validateCodex(body);
+    case "gemini":
+      return validateGemini(body);
+    case "opencodego":
+      return validateOpenCodeGo(body);
+    default:
+      return null;
+  }
+}
+async function statusEntryFor(reader, providerId) {
+  const all = await reader.listAll();
+  return all.find((a) => a.providerId === providerId) ?? null;
+}
+
+// src/admin/accountsOAuth.ts
+var OAUTH_HTTP_PROVIDERS = /* @__PURE__ */ new Set(["claude", "gemini"]);
+function err2(status, message) {
+  return { status, body: { error: { type: "admin_api_error", message } } };
+}
+function handleOAuthStart(providerId, deps) {
+  if (!OAUTH_HTTP_PROVIDERS.has(providerId)) {
+    return err2(400, `oauth not available for provider '${providerId}'`);
+  }
+  const flow = providerId === "claude" ? import_subscriptions2.claudeOAuth : import_subscriptions2.geminiOAuth;
+  const { authUrl, codeVerifier, state } = flow.generateAuthParams();
+  const sessionId = deps.oauthSessions.put({ providerId, codeVerifier, state });
+  return { status: 200, body: { authUrl, sessionId } };
+}
+async function handleOAuthComplete(providerId, body, deps) {
+  if (!OAUTH_HTTP_PROVIDERS.has(providerId)) {
+    return err2(400, `oauth not available for provider '${providerId}'`);
+  }
+  const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : "";
+  const rawCode = typeof body["code"] === "string" ? body["code"] : "";
+  if (!sessionId) return err2(400, "oauth complete requires { sessionId }");
+  if (!rawCode) return err2(400, "oauth complete requires { code }");
+  const session = deps.oauthSessions.take(sessionId);
+  if (!session) return err2(410, "oauth session is unknown, expired, or already used");
+  if (session.providerId !== providerId) {
+    return err2(400, `oauth session does not match provider '${providerId}'`);
+  }
+  let code = rawCode.trim();
+  if (providerId === "claude") {
+    const [splitCode, pastedState] = code.split("#");
+    if (!splitCode) return err2(400, "no authorization code was provided");
+    if (pastedState && pastedState !== session.state) {
+      return err2(400, "oauth state did not match (possible CSRF) \u2014 aborting");
+    }
+    code = splitCode;
+  }
+  let block;
+  try {
+    block = providerId === "claude" ? await exchangeClaude(code, session.codeVerifier, session.state, deps.oauthExchangeFetch) : await exchangeGemini(code, session.codeVerifier, deps.oauthExchangeFetch);
+  } catch (exchangeError) {
+    const reason = exchangeError instanceof Error ? exchangeError.message : "token exchange failed";
+    return err2(502, `oauth token exchange failed for '${providerId}': ${reason}`);
+  }
+  await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block);
+  const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
+  return { status: 200, body: status ? { account: status } : { ok: true } };
+}
+async function exchangeClaude(code, codeVerifier, state, exchangeFetch) {
+  const result = await import_subscriptions2.claudeOAuth.exchangeCodeForTokens(
+    { authorizationCode: code, codeVerifier, state },
+    exchangeFetch
+  );
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  return {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt,
+    scopes: result.scopes,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function exchangeGemini(code, codeVerifier, exchangeFetch) {
+  const result = await import_subscriptions2.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  return {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/ports/account-multi.ts
+var import_node_crypto4 = require("crypto");
+var PROVIDER_KEYS = {
+  claude: { block: "claude", accounts: "claudeAccounts", active: "activeClaudeAccountId" },
+  codex: { block: "codex", accounts: "codexAccounts", active: "activeCodexAccountId" },
+  gemini: { block: "gemini", accounts: "geminiAccounts", active: "activeGeminiAccountId" },
+  opencodego: {
+    block: "opencodego",
+    accounts: "opencodegoAccounts",
+    active: "activeOpencodegoAccountId"
+  }
+};
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+function legacyAccountId(provider) {
+  return `legacy-${provider}`;
+}
+function getAccounts(config, p) {
+  return config[PROVIDER_KEYS[p].accounts] ?? [];
+}
+function setAccounts(config, p, accounts) {
+  config[PROVIDER_KEYS[p].accounts] = accounts;
+}
+function getActiveId(config, p) {
+  return config[PROVIDER_KEYS[p].active];
+}
+function setActiveId(config, p, id) {
+  config[PROVIDER_KEYS[p].active] = id;
+}
+function getBlock(config, p) {
+  return config[PROVIDER_KEYS[p].block];
+}
+function setBlock(config, p, block) {
+  config[PROVIDER_KEYS[p].block] = block;
+}
+function deriveMirror(config, p) {
+  const accounts = getAccounts(config, p);
+  const active = accounts.find((a) => a.id === getActiveId(config, p));
+  if (!active) {
+    setBlock(config, p, void 0);
+    setActiveId(config, p, void 0);
+    if (accounts.length === 0) setAccounts(config, p, void 0);
+    return;
+  }
+  setBlock(config, p, clone(active.tokens));
+}
+function migrateLazily(config) {
+  const next = { ...config };
+  for (const p of Object.keys(PROVIDER_KEYS)) {
+    const block = getBlock(next, p);
+    if (!block || getAccounts(next, p).length > 0) continue;
+    const entry = {
+      // DETERMINISTIC id — stable across reads.
+      id: legacyAccountId(p),
+      label: "Account 1",
+      createdAt: next.updatedAt || (/* @__PURE__ */ new Date()).toISOString(),
+      tokens: clone(block)
+    };
+    setAccounts(next, p, [entry]);
+    setActiveId(next, p, entry.id);
+    setBlock(next, p, clone(entry.tokens));
+  }
+  return next;
+}
+function addAccount(config, p, tokens, label) {
+  const accounts = [...getAccounts(config, p)];
+  const id = (0, import_node_crypto4.randomUUID)();
+  accounts.push({
+    id,
+    label: label ?? `Account ${accounts.length + 1}`,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    tokens: clone(tokens)
+  });
+  setAccounts(config, p, accounts);
+  setActiveId(config, p, id);
+  deriveMirror(config, p);
+  return { id };
+}
+function removeAccount(config, p, id) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { removed: false };
+  const wasActive = getActiveId(config, p) === id;
+  const remaining = accounts.filter((a) => a.id !== id);
+  setAccounts(config, p, remaining.length ? remaining : void 0);
+  if (wasActive) {
+    setActiveId(config, p, remaining.length ? mostRecent(remaining).id : void 0);
+  }
+  deriveMirror(config, p);
+  return { removed: true };
+}
+function mostRecent(accounts) {
+  return accounts.reduce((best, cur) => {
+    const bestT = best.createdAt ? Date.parse(best.createdAt) : 0;
+    const curT = cur.createdAt ? Date.parse(cur.createdAt) : 0;
+    return curT >= bestT ? cur : best;
+  }, accounts[0]);
+}
+function setActiveAccount(config, p, id) {
+  if (!getAccounts(config, p).some((a) => a.id === id)) return { ok: false };
+  setActiveId(config, p, id);
+  deriveMirror(config, p);
+  return { ok: true };
+}
+function getActiveAccount(config, p) {
+  const active = getAccounts(config, p).find((a) => a.id === getActiveId(config, p));
+  return active ? { id: active.id, tokens: active.tokens } : void 0;
+}
+function writeBackRefreshById(config, p, capturedId, refreshedTokens) {
+  if (capturedId) {
+    setAccounts(
+      config,
+      p,
+      getAccounts(config, p).map(
+        (a) => a.id === capturedId ? { ...a, tokens: clone(refreshedTokens) } : a
+      )
+    );
+  }
+  deriveMirror(config, p);
+}
+function writeActiveTokens(config, p, tokens) {
+  const active = getActiveAccount(config, p);
+  if (active) {
+    writeBackRefreshById(config, p, active.id, tokens);
+  } else {
+    addAccount(config, p, tokens);
+  }
+}
+function sanitizeAccounts(config, p) {
+  const accounts = getAccounts(config, p);
+  const activeId = getActiveId(config, p);
+  return accounts.map((a) => {
+    const t = a.tokens;
+    return {
+      id: a.id,
+      label: a.label,
+      status: t.status ?? "unconfigured",
+      expiresAt: t.expiresAt,
+      hasAccessToken: !!(t.accessToken || t.apiKey),
+      isActive: a.id === activeId
+    };
+  });
+}
+function clearProvider(config, p) {
+  setBlock(config, p, void 0);
+  setAccounts(config, p, void 0);
+  setActiveId(config, p, void 0);
+}
+var DAEMON_PROVIDER_KEYS = PROVIDER_KEYS;
+
+// src/migration/packCodec.ts
+var import_node_crypto5 = require("crypto");
+var PACK_MAGIC = "OMCXPACK";
+var PACK_VERSION = 1;
+var KDF_ALGORITHM = "scrypt";
+var PACK_PREFIX = `${PACK_MAGIC}${PACK_VERSION}.`;
+var KEY_BYTES3 = 32;
+var IV_BYTES2 = 12;
+var TAG_BYTES2 = 16;
+var SCRYPT_N = 1 << 15;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_SALT_BYTES = 16;
+var SCRYPT_MAXMEM = 128 * SCRYPT_R * SCRYPT_N * 2;
+var MIN_PASSPHRASE_LENGTH = 8;
+var WeakPassphraseError = class extends Error {
+  constructor() {
+    super(`passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters`);
+    this.name = "WeakPassphraseError";
+  }
+};
+var PackAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PackAuthError";
+  }
+};
+function assertPassphraseStrength(passphrase) {
+  if (typeof passphrase !== "string" || passphrase.length < MIN_PASSPHRASE_LENGTH) {
+    throw new WeakPassphraseError();
+  }
+}
+function toB64Url(s) {
+  return Buffer.from(s, "utf8").toString("base64url");
+}
+function fromB64Url(s) {
+  return Buffer.from(s, "base64url").toString("utf8");
+}
+function deriveKey(passphrase, salt, N, r, p) {
+  return (0, import_node_crypto5.scryptSync)(passphrase, salt, KEY_BYTES3, { N, r, p, maxmem: SCRYPT_MAXMEM });
+}
+function aadFor(magic, version, kdf) {
+  return Buffer.from(`${magic}|${version}|${kdf}`, "utf8");
+}
+function sealPack(bundleJson, passphrase) {
+  assertPassphraseStrength(passphrase);
+  const salt = (0, import_node_crypto5.randomBytes)(SCRYPT_SALT_BYTES);
+  const iv = (0, import_node_crypto5.randomBytes)(IV_BYTES2);
+  const key = deriveKey(passphrase, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P);
+  const cipher = (0, import_node_crypto5.createCipheriv)("aes-256-gcm", key, iv);
+  cipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
+  const ciphertext = Buffer.concat([cipher.update(bundleJson, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const header = {
+    magic: PACK_MAGIC,
+    v: PACK_VERSION,
+    kdf: KDF_ALGORITHM,
+    salt: salt.toString("base64"),
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64")
+  };
+  return `${PACK_PREFIX}${toB64Url(JSON.stringify(header))}.${ciphertext.toString("base64")}`;
+}
+function parsePack(packString) {
+  if (typeof packString !== "string" || !packString.startsWith(PACK_PREFIX)) {
+    throw new PackAuthError("migration pack is malformed (bad magic/version prefix)");
+  }
+  const rest = packString.slice(PACK_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0) throw new PackAuthError("migration pack is malformed (missing body)");
+  const headerB64Url = rest.slice(0, dot);
+  const ctB64 = rest.slice(dot + 1);
+  let header;
+  try {
+    header = JSON.parse(fromB64Url(headerB64Url));
+  } catch {
+    throw new PackAuthError("migration pack is malformed (unreadable header)");
+  }
+  if (!header || header.magic !== PACK_MAGIC || header.v !== PACK_VERSION || header.kdf !== KDF_ALGORITHM || typeof header.salt !== "string" || typeof header.iv !== "string" || typeof header.tag !== "string" || typeof header.N !== "number" || typeof header.r !== "number" || typeof header.p !== "number") {
+    throw new PackAuthError("migration pack is malformed (unsupported header)");
+  }
+  const ciphertext = Buffer.from(ctB64, "base64");
+  return { header, ciphertext };
+}
+function openPack(packString, passphrase) {
+  assertPassphraseStrength(passphrase);
+  const { header, ciphertext } = parsePack(packString);
+  const salt = Buffer.from(header.salt, "base64");
+  const iv = Buffer.from(header.iv, "base64");
+  const tag = Buffer.from(header.tag, "base64");
+  if (iv.length !== IV_BYTES2 || tag.length !== TAG_BYTES2) {
+    throw new PackAuthError("migration pack is malformed (invalid iv/tag length)");
+  }
+  const key = deriveKey(passphrase, salt, header.N, header.r, header.p);
+  const decipher = (0, import_node_crypto5.createDecipheriv)("aes-256-gcm", key, iv);
+  decipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
+  decipher.setAuthTag(tag);
+  try {
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+  } catch {
+    throw new PackAuthError("wrong passphrase or tampered migration pack");
+  }
+}
+
+// src/migration/migration.ts
+var BUNDLE_VERSION = 1;
+async function gatherExport(deps, passphrase) {
+  const cfg = loadConfig(deps.configPath);
+  const tokens = await deps.credentialStore.getFullConfig();
+  const bundle = {
+    v: BUNDLE_VERSION,
+    providers: cfg.providers,
+    tokens
+  };
+  return sealPack(JSON.stringify(bundle), passphrase);
+}
+var SUBSCRIPTION_PROVIDERS = ["claude", "codex", "gemini", "opencodego"];
+function collectProviderTokenBlocks(tokens, provider) {
+  const keys = DAEMON_PROVIDER_KEYS[provider];
+  const bag = tokens;
+  const accounts = bag[keys.accounts];
+  if (Array.isArray(accounts)) {
+    const blocks = [];
+    for (const entry of accounts) {
+      if (entry && typeof entry === "object" && "tokens" in entry) {
+        const tk = entry.tokens;
+        if (tk && typeof tk === "object" && !Array.isArray(tk)) {
+          blocks.push(tk);
+        }
+      }
+    }
+    if (blocks.length > 0) return blocks;
+  }
+  const mirror = bag[keys.block];
+  if (mirror && typeof mirror === "object" && !Array.isArray(mirror)) {
+    return [mirror];
+  }
+  return [];
+}
+async function applyImport(packString, passphrase, mode, deps, parseProviderInput2) {
+  const bundleJson = openPack(packString, passphrase);
+  let bundle;
+  try {
+    const parsed = JSON.parse(bundleJson);
+    if (!parsed || typeof parsed !== "object") throw new Error("not an object");
+    bundle = parsed;
+  } catch {
+    throw new Error("migration pack contents are unreadable");
+  }
+  const rawProviders = Array.isArray(bundle.providers) ? bundle.providers : [];
+  const rawTokens = bundle.tokens && typeof bundle.tokens === "object" ? bundle.tokens : { updatedAt: "" };
+  const validatedProviders = [];
+  for (const raw of rawProviders) {
+    if (!raw || typeof raw !== "object") {
+      throw new Error("migration pack has an invalid provider row");
+    }
+    const validated = parseProviderInput2(raw, void 0);
+    if (!validated) {
+      throw new Error("migration pack has an invalid provider row");
+    }
+    validatedProviders.push(validated);
+  }
+  const validatedTokens = [];
+  for (const provider of SUBSCRIPTION_PROVIDERS) {
+    const blocks = collectProviderTokenBlocks(rawTokens, provider);
+    for (const block of blocks) {
+      const valid = validateTokenBody(provider, block);
+      if (!valid) {
+        throw new Error(`migration pack has an invalid token block for '${provider}'`);
+      }
+      validatedTokens.push({ provider, block: valid });
+    }
+  }
+  const cfg = loadConfig(deps.configPath);
+  const counts = {
+    providerKeys: 0,
+    poolKeys: 0,
+    tokenSets: 0,
+    duplicates: 0,
+    skipped: []
+  };
+  for (const incoming of validatedProviders) {
+    const idx = cfg.providers.findIndex((p) => p.id === incoming.id);
+    if (idx >= 0 && mode !== "overwrite") {
+      counts.skipped.push(incoming.id);
+      continue;
+    }
+    if (idx >= 0) {
+      cfg.providers[idx] = incoming;
+    } else {
+      cfg.providers.push(incoming);
+    }
+    counts.providerKeys += 1;
+    if (incoming.apiKeys) counts.poolKeys += incoming.apiKeys.length;
+  }
+  saveConfig(deps.configPath, cfg);
+  deps.llmConfig.reload(cfg);
+  for (const { provider, block } of validatedTokens) {
+    await deps.credentialStore.appendProviderAccount(provider, block);
+    counts.tokenSets += 1;
+  }
+  return counts;
+}
+
+// src/admin/adminMigration.ts
+function err3(status, message) {
+  return { status, body: { error: { type: "admin_api_error", message } } };
+}
+async function handleExport(body, deps) {
+  const passphrase = typeof body["passphrase"] === "string" ? body["passphrase"] : "";
+  try {
+    const pack = await gatherExport(deps, passphrase);
+    return { status: 200, body: { pack, version: BUNDLE_VERSION } };
+  } catch (error) {
+    if (error instanceof WeakPassphraseError) {
+      return err3(400, error.message);
+    }
+    return err3(500, "failed to build the migration pack");
+  }
+}
+async function handleImport(body, deps) {
+  const blob = typeof body["blob"] === "string" ? body["blob"] : "";
+  const passphrase = typeof body["passphrase"] === "string" ? body["passphrase"] : "";
+  const mode = body["mode"] === "overwrite" ? "overwrite" : "merge";
+  if (!blob) return err3(400, "import requires { blob }");
+  try {
+    const counts = await applyImport(blob, passphrase, mode, deps, deps.parseProviderInput);
+    return { status: 200, body: counts };
+  } catch (error) {
+    if (error instanceof WeakPassphraseError) {
+      return err3(400, error.message);
+    }
+    return err3(400, error instanceof Error ? error.message : "import failed");
+  }
+}
+
+// src/admin/adminApi.ts
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+async function readJsonBody(req) {
+  const raw = await readBody(req);
+  if (!raw.trim()) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeJsonError(res, status, message) {
+  writeJson(res, status, { error: { type: "admin_api_error", message } });
+}
+function maskProviderApiKey(apiKey) {
+  if (!apiKey) return "";
+  if (apiKey.startsWith("$")) return "$ENV(\u2022\u2022\u2022)";
+  const last4 = apiKey.length >= 4 ? apiKey.slice(-4) : apiKey;
+  return `sk-\u2026${last4}`;
+}
+function toKeyInfo(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    keyPrefix: row.keyPrefix,
+    enabled: row.enabled,
+    createdAt: row.createdAt,
+    lastUsedAt: row.lastUsedAt,
+    revoked: row.revokedAt !== null
+  };
+}
+function toProviderView(row) {
+  return {
+    id: row.id,
+    // app-parity-2 child 1: mutable display name (non-secret) round-trips verbatim;
+    // absent stays absent (the app falls back to the id for display).
+    name: row.name,
+    apiFormat: row.apiFormat,
+    baseUrl: row.baseUrl,
+    models: row.models ?? [],
+    // app-parity child 2: per-model metadata round-trips verbatim (non-secret —
+    // no masking; absent stays absent so a flat-models-only row has no key).
+    modelConfigs: row.modelConfigs,
+    hasApiKey: row.apiKey.length > 0,
+    apiKeyMasked: maskProviderApiKey(row.apiKey),
+    // app-foundation D8: absent `enabled` reads as enabled (back-compat).
+    enabled: row.enabled !== false,
+    // app-parity child 1: non-secret scalar fields round-trip verbatim (no masking).
+    isOfficial: row.isOfficial,
+    apiVersion: row.apiVersion,
+    maxConcurrency: row.maxConcurrency,
+    modelsEndpoint: row.modelsEndpoint,
+    // app-parity child 5: transformer config round-trips VERBATIM (non-secret —
+    // transform-rule names + options, no key material; absent stays absent).
+    transformer: row.transformer,
+    // app-parity-2 child 3: coding-plan endpoint MASKED — the secret `apiKey` is
+    // NEVER serialized out (only a `hasApiKey` boolean); enabled/baseUrl/note are
+    // non-secret. Absent stays absent.
+    codingPlan: row.codingPlan ? {
+      enabled: row.codingPlan.enabled,
+      baseUrl: row.codingPlan.baseUrl,
+      hasApiKey: typeof row.codingPlan.apiKey === "string" && row.codingPlan.apiKey.length > 0,
+      note: row.codingPlan.note
+    } : void 0,
+    // app-parity-2 child 4: API modes MASKED — each mode's secret `apiKey` is
+    // NEVER serialized out (only a per-mode `hasApiKey`); id/label/baseUrl/prefix/
+    // note are non-secret. Absent stays absent.
+    apiModes: row.apiModes ? row.apiModes.map((m) => ({
+      id: m.id,
+      label: m.label,
+      baseUrl: m.baseUrl,
+      hasApiKey: typeof m.apiKey === "string" && m.apiKey.length > 0,
+      apiKeyPrefix: m.apiKeyPrefix,
+      note: m.note
+    })) : void 0,
+    selectedApiModeId: row.selectedApiModeId
+  };
+}
+async function handleAdminApi(req, res, path, deps) {
+  const method = (req.method ?? "GET").toUpperCase();
+  const sub = path.slice("/admin/api/".length);
+  const [resource, ...rest] = sub.split("/").filter((s) => s.length > 0);
+  try {
+    switch (resource) {
+      case "providers":
+        return await handleProviders(req, res, method, rest, deps);
+      case "presets":
+        return handlePresets(res, method);
+      case "keys":
+        return await handleKeys(req, res, method, rest, deps);
+      case "server":
+        return await handleServer(req, res, method, deps);
+      case "accounts":
+        return await handleAccounts(req, res, method, rest, deps);
+      case "status":
+        return await handleStatus(res, method, deps);
+      case "playground":
+        return await handlePlayground(req, res, method, deps);
+      case "export":
+        return await handleMigrationExport(req, res, method, deps);
+      case "import":
+        return await handleMigrationImport(req, res, method, deps);
+      default:
+        return writeJsonError(res, 404, `unknown admin resource '${resource}'`);
+    }
+  } catch (err4) {
+    writeJsonError(res, 500, err4 instanceof Error ? err4.message : String(err4));
+  }
+}
+function migrationDeps(deps) {
+  return {
+    configPath: deps.configPath,
+    llmConfig: deps.llmConfig,
+    credentialStore: deps.migrationCredentialStore,
+    parseProviderInput
+  };
+}
+async function handleMigrationExport(req, res, method, deps) {
+  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
+  const body = await readJsonBody(req);
+  const result = await handleExport(body, migrationDeps(deps));
+  return writeJson(res, result.status, result.body);
+}
+async function handleMigrationImport(req, res, method, deps) {
+  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
+  const body = await readJsonBody(req);
+  const result = await handleImport(body, migrationDeps(deps));
+  return writeJson(res, result.status, result.body);
+}
+async function handleProviders(req, res, method, rest, deps) {
+  const cfg = loadConfig(deps.configPath);
+  if (method === "GET" && rest.length === 2 && rest[1] === "keys") {
+    return await handleProviderKeys(res, rest[0], cfg, deps);
+  }
+  if (method === "POST" && rest.length === 2 && rest[1] === "keys") {
+    return await handleAddProviderKey(req, res, rest[0], cfg, deps);
+  }
+  if (method === "POST" && rest.length === 4 && rest[1] === "keys" && rest[3] === "enabled") {
+    return await handleToggleProviderKey(req, res, rest[0], rest[2], cfg, deps);
+  }
+  if (method === "PUT" && rest.length === 3 && rest[1] === "keys") {
+    return await handleUpdateProviderKey(req, res, rest[0], rest[2], cfg, deps);
+  }
+  if (method === "DELETE" && rest.length === 3 && rest[1] === "keys") {
+    return await handleDeleteProviderKey(res, rest[0], rest[2], cfg, deps);
+  }
+  if (method === "POST" && rest.length === 1 && rest[0] === "reorder") {
+    return await handleProviderReorder(req, res, cfg, deps);
+  }
+  if (method === "POST" && rest.length === 2 && rest[1] === "discover-models") {
+    return await handleDiscoverModels(res, rest[0], cfg);
+  }
+  if (method === "POST" && rest.length === 2 && rest[1] === "test") {
+    return await handleTestModel(req, res, rest[0], cfg);
+  }
+  if (method === "GET") {
+    return writeJson(res, 200, { providers: cfg.providers.map(toProviderView) });
+  }
+  if (method === "POST") {
+    const body = await readJsonBody(req);
+    const provider = parseProviderInput(body, void 0);
+    if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
+    if (cfg.providers.some((p) => p.id === provider.id)) {
+      return writeJsonError(res, 409, `provider '${provider.id}' already exists`);
+    }
+    cfg.providers.push(provider);
+    persistProviders(cfg, deps);
+    return writeJson(res, 201, { provider: toProviderView(provider) });
+  }
+  const id = rest[0];
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  const idx = cfg.providers.findIndex((p) => p.id === id);
+  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (method === "PUT") {
+    const body = await readJsonBody(req);
+    const existing = cfg.providers[idx];
+    const updated = parseProviderInput(body, existing);
+    if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
+    cfg.providers[idx] = updated;
+    persistProviders(cfg, deps);
+    return writeJson(res, 200, { provider: toProviderView(updated) });
+  }
+  if (method === "DELETE") {
+    cfg.providers.splice(idx, 1);
+    persistProviders(cfg, deps);
+    return writeJson(res, 200, { ok: true });
+  }
+  return writeJsonError(res, 405, `method ${method} not allowed on providers`);
+}
+function persistProviders(cfg, deps) {
+  saveConfig(deps.configPath, cfg);
+  deps.llmConfig.reload(cfg);
+}
+async function handleProviderReorder(req, res, cfg, deps) {
+  const body = await readJsonBody(req);
+  const rawOrder = body["order"];
+  if (!Array.isArray(rawOrder)) {
+    return writeJsonError(res, 400, "reorder requires { order: string[] }");
+  }
+  const order = rawOrder.filter((x) => typeof x === "string");
+  const byId = new Map(cfg.providers.map((p) => [p.id, p]));
+  const seen = /* @__PURE__ */ new Set();
+  const reordered = [];
+  for (const id of order) {
+    const row = byId.get(id);
+    if (row && !seen.has(id)) {
+      reordered.push(row);
+      seen.add(id);
+    }
+  }
+  for (const row of cfg.providers) {
+    if (!seen.has(row.id)) {
+      reordered.push(row);
+      seen.add(row.id);
+    }
+  }
+  cfg.providers = reordered;
+  persistProviders(cfg, deps);
+  return writeJson(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+}
+async function handleDiscoverModels(res, id, cfg) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  const row = cfg.providers.find((p) => p.id === id);
+  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (row.apiFormat !== "openai") {
+    return writeJson(res, 200, { models: [], unsupportedFormat: true });
+  }
+  const resolvedKey = resolveEnvKey(row.apiKey);
+  const base = row.baseUrl.replace(/\/+$/, "");
+  const url = `${base}/models`;
+  try {
+    const headers = { Accept: "application/json" };
+    if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
+    const response = await fetch(url, { method: "GET", headers });
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      let message = text.slice(0, 300);
+      try {
+        const parsed = JSON.parse(text);
+        message = parsed?.error?.message || parsed?.message || message;
+      } catch {
+      }
+      return writeJson(res, 200, {
+        models: [],
+        error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
+      });
+    }
+    const data = await response.json();
+    const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
+    return writeJson(res, 200, { models });
+  } catch (err4) {
+    const message = err4 instanceof Error ? err4.message : String(err4);
+    return writeJson(res, 200, { models: [], error: `discovery failed: ${message}` });
+  }
+}
+async function handleTestModel(req, res, id, cfg) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  const row = cfg.providers.find((p) => p.id === id);
+  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  const body = await readJsonBody(req);
+  const model = typeof body["model"] === "string" ? body["model"].trim() : "";
+  if (!model) return writeJsonError(res, 400, "test requires a { model } string");
+  if (row.apiFormat === "gemini") {
+    return writeJson(res, 200, { ok: false, unsupportedFormat: true });
+  }
+  const resolvedKey = resolveEnvKey(row.apiKey);
+  if (!resolvedKey) {
+    return writeJson(res, 200, { ok: false, message: "no API key configured for this provider" });
+  }
+  const url = row.baseUrl.replace(/\/+$/, "");
+  const prompt = "Reply with the single word: OK.";
+  const headers = { "Content-Type": "application/json" };
+  let payload;
+  if (row.apiFormat === "anthropic") {
+    headers["x-api-key"] = resolvedKey;
+    headers["anthropic-version"] = "2023-06-01";
+    payload = { model, max_tokens: 16, messages: [{ role: "user", content: prompt }] };
+  } else {
+    headers["Authorization"] = `Bearer ${resolvedKey}`;
+    payload = {
+      model,
+      max_tokens: 16,
+      stream: false,
+      messages: [{ role: "user", content: prompt }]
+    };
+  }
+  const startedAt = Date.now();
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload)
+    });
+    const latencyMs = Date.now() - startedAt;
+    const text = await response.text().catch(() => "");
+    if (!response.ok) {
+      let message = text.slice(0, 300);
+      try {
+        const parsed = JSON.parse(text);
+        message = parsed?.error?.message || parsed?.message || message;
+      } catch {
+      }
+      return writeJson(res, 200, { ok: false, status: response.status, latencyMs, message });
+    }
+    return writeJson(res, 200, {
+      ok: true,
+      status: response.status,
+      latencyMs,
+      sample: extractSampleText(text, row.apiFormat)
+    });
+  } catch (err4) {
+    const message = err4 instanceof Error ? err4.message : String(err4);
+    return writeJson(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+  }
+}
+function extractSampleText(text, apiFormat) {
+  try {
+    const data = JSON.parse(text);
+    if (apiFormat === "anthropic") {
+      const content2 = data["content"]?.[0]?.text;
+      return typeof content2 === "string" ? content2.slice(0, 200) : "";
+    }
+    const choice = data["choices"]?.[0];
+    const content = choice?.message?.content;
+    return typeof content === "string" ? content.slice(0, 200) : "";
+  } catch {
+    return "";
+  }
+}
+function toPoolKeyView(row, cooldown, deps) {
+  const entries = row.apiKeys && row.apiKeys.length > 0 ? row.apiKeys : row.apiKey.length > 0 ? [{ id: `${row.id}:default`, apiKey: row.apiKey, weight: 1, enabled: true }] : [];
+  return entries.map((e) => {
+    const auto = deps.autoDisableStore.get(e.id);
+    const cd = cooldown[e.id];
+    const health = {};
+    if (cd) health.cooldown = cd;
+    if (auto) health.autoDisabled = { status: auto.status, at: auto.at, reason: auto.reason };
+    return {
+      id: e.id,
+      label: e.label && e.label.length > 0 ? e.label : e.id,
+      // An auto-disabled key reads disabled even when the config flag is true.
+      enabled: e.enabled !== false && !deps.autoDisableStore.isDisabled(e.id),
+      weight: typeof e.weight === "number" && Number.isFinite(e.weight) ? e.weight : 1,
+      apiKeyMasked: maskProviderApiKey(e.apiKey),
+      ...Object.keys(health).length > 0 ? { health } : {}
+    };
+  });
+}
+async function handleProviderKeys(res, id, cfg, deps) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  const row = cfg.providers.find((p) => p.id === id);
+  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  const cooldown = await deps.apiKeyPool.getKeyHealth(id);
+  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+}
+function parsePoolKeyInput(body, existing) {
+  const out = {};
+  if (typeof body["label"] === "string" && body["label"].length > 0) out.label = body["label"];
+  else if (existing?.label) out.label = existing.label;
+  if (typeof body["weight"] === "number" && Number.isFinite(body["weight"])) out.weight = body["weight"];
+  else if (typeof existing?.weight === "number") out.weight = existing.weight;
+  if (typeof body["enabled"] === "boolean") out.enabled = body["enabled"];
+  else if (typeof existing?.enabled === "boolean") out.enabled = existing.enabled;
+  const submitted = typeof body["apiKey"] === "string" && body["apiKey"].length > 0 ? body["apiKey"] : "";
+  const apiKey = submitted || existing?.apiKey || "";
+  if (apiKey) out.apiKey = apiKey;
+  return out;
+}
+async function handleAddProviderKey(req, res, id, cfg, deps) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  const idx = cfg.providers.findIndex((p) => p.id === id);
+  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  const body = await readJsonBody(req);
+  const parsed = parsePoolKeyInput(body);
+  if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
+  const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const entry = { id: keyId, apiKey: parsed.apiKey };
+  if (parsed.label !== void 0) entry.label = parsed.label;
+  if (parsed.enabled !== void 0) entry.enabled = parsed.enabled;
+  if (parsed.weight !== void 0) entry.weight = parsed.weight;
+  const row = cfg.providers[idx];
+  row.apiKeys = [...row.apiKeys ?? [], entry];
+  persistProviders(cfg, deps);
+  const cooldown = await deps.apiKeyPool.getKeyHealth(id);
+  return writeJson(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+}
+async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  const idx = cfg.providers.findIndex((p) => p.id === id);
+  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  const row = cfg.providers[idx];
+  const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
+  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
+  const body = await readJsonBody(req);
+  const existing = row.apiKeys[keyIdx];
+  const parsed = parsePoolKeyInput(body, existing);
+  const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
+  if (parsed.label !== void 0) entry.label = parsed.label;
+  if (parsed.enabled !== void 0) entry.enabled = parsed.enabled;
+  if (parsed.weight !== void 0) entry.weight = parsed.weight;
+  row.apiKeys[keyIdx] = entry;
+  persistProviders(cfg, deps);
+  const cooldown = await deps.apiKeyPool.getKeyHealth(id);
+  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+}
+async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  const idx = cfg.providers.findIndex((p) => p.id === id);
+  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  const row = cfg.providers[idx];
+  const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
+  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
+  row.apiKeys.splice(keyIdx, 1);
+  if (row.apiKeys.length === 0) row.apiKeys = void 0;
+  persistProviders(cfg, deps);
+  const cooldown = await deps.apiKeyPool.getKeyHealth(id);
+  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+}
+async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
+  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  const idx = cfg.providers.findIndex((p) => p.id === id);
+  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  const row = cfg.providers[idx];
+  const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
+  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
+  const body = await readJsonBody(req);
+  row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
+  persistProviders(cfg, deps);
+  const cooldown = await deps.apiKeyPool.getKeyHealth(id);
+  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+}
+function parseApiKeysInput(raw, existing) {
+  if (!Array.isArray(raw)) return existing;
+  const byId = new Map((existing ?? []).map((e) => [e.id, e]));
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const k = item;
+    const id = typeof k["id"] === "string" && k["id"].trim() ? k["id"].trim() : "";
+    if (!id) continue;
+    const prior = byId.get(id);
+    const submittedKey = typeof k["apiKey"] === "string" && k["apiKey"].length > 0 ? k["apiKey"] : "";
+    const apiKey = submittedKey || prior?.apiKey || "";
+    if (!apiKey) continue;
+    const entry = { id, apiKey };
+    if (typeof k["label"] === "string" && k["label"].length > 0) entry.label = k["label"];
+    else if (prior?.label) entry.label = prior.label;
+    if (typeof k["enabled"] === "boolean") entry.enabled = k["enabled"];
+    else if (typeof prior?.enabled === "boolean") entry.enabled = prior.enabled;
+    if (typeof k["weight"] === "number" && Number.isFinite(k["weight"])) entry.weight = k["weight"];
+    else if (typeof prior?.weight === "number") entry.weight = prior.weight;
+    out.push(entry);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function parseModelConfigsInput(raw, existing) {
+  if (!Array.isArray(raw)) return existing;
+  const byId = new Map((existing ?? []).map((e) => [e.id, e]));
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const m = item;
+    const id = typeof m["id"] === "string" && m["id"].trim() ? m["id"].trim() : "";
+    if (!id) continue;
+    const prior = byId.get(id);
+    const entry = { id };
+    if (typeof m["name"] === "string" && m["name"].length > 0) entry.name = m["name"];
+    else if (prior?.name) entry.name = prior.name;
+    if (typeof m["group"] === "string" && m["group"].length > 0) entry.group = m["group"];
+    else if (prior?.group) entry.group = prior.group;
+    if (typeof m["enabled"] === "boolean") entry.enabled = m["enabled"];
+    else if (typeof prior?.enabled === "boolean") entry.enabled = prior.enabled;
+    if (typeof m["vision"] === "boolean") entry.vision = m["vision"];
+    else if (typeof prior?.vision === "boolean") entry.vision = prior.vision;
+    if (typeof m["reasoning"] === "boolean") entry.reasoning = m["reasoning"];
+    else if (typeof prior?.reasoning === "boolean") entry.reasoning = prior.reasoning;
+    out.push(entry);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function parseTransformerInput(raw, existing) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return existing;
+  const t = raw;
+  const out = {};
+  let kept = false;
+  if (Array.isArray(t["use"])) {
+    const use = [];
+    for (const item of t["use"]) {
+      const entry = validateTransformerEntry(item);
+      if (entry !== null) use.push(entry);
+    }
+    if (use.length > 0) {
+      out.use = use;
+      kept = true;
+    }
+  }
+  for (const key of Object.keys(t)) {
+    if (key === "use") continue;
+    const value = t[key];
+    if (value && typeof value === "object") {
+      out[key] = value;
+      kept = true;
+    }
+  }
+  return kept ? out : void 0;
+}
+function parseCodingPlanInput(raw, existing) {
+  const enabled = raw["enabled"] === true;
+  const baseUrl = typeof raw["baseUrl"] === "string" && raw["baseUrl"].length > 0 ? raw["baseUrl"] : raw["baseUrl"] === null ? void 0 : existing?.baseUrl;
+  const apiKey = typeof raw["apiKey"] === "string" && raw["apiKey"].length > 0 ? raw["apiKey"] : existing?.apiKey;
+  const note = typeof raw["note"] === "string" && raw["note"].length > 0 ? raw["note"] : raw["note"] === null ? void 0 : existing?.note;
+  if (!enabled && !baseUrl && !apiKey && !note) return void 0;
+  const out = { enabled };
+  if (baseUrl) out.baseUrl = baseUrl;
+  if (apiKey) out.apiKey = apiKey;
+  if (note) out.note = note;
+  return out;
+}
+function parseApiModesInput(raw, existing) {
+  if (!Array.isArray(raw)) return existing;
+  const byId = new Map((existing ?? []).map((m) => [m.id, m]));
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const m = item;
+    const id = typeof m["id"] === "string" && m["id"].trim() ? m["id"].trim() : "";
+    const baseUrl = typeof m["baseUrl"] === "string" && m["baseUrl"].length > 0 ? m["baseUrl"] : "";
+    if (!id || !baseUrl) continue;
+    const prior = byId.get(id);
+    const label = typeof m["label"] === "string" && m["label"].length > 0 ? m["label"] : prior?.label ?? id;
+    const entry = { id, label, baseUrl };
+    if (typeof m["apiKey"] === "string" && m["apiKey"].length > 0) entry.apiKey = m["apiKey"];
+    else if (prior?.apiKey) entry.apiKey = prior.apiKey;
+    const prefix = typeof m["apiKeyPrefix"] === "string" && m["apiKeyPrefix"].length > 0 ? m["apiKeyPrefix"] : prior?.apiKeyPrefix;
+    if (prefix) entry.apiKeyPrefix = prefix;
+    const note = typeof m["note"] === "string" && m["note"].length > 0 ? m["note"] : prior?.note;
+    if (note) entry.note = note;
+    out.push(entry);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function parseProviderInput(body, existing) {
+  const id = existing ? existing.id : typeof body["id"] === "string" && body["id"].trim() ? body["id"].trim() : void 0;
+  const apiFormat = body["apiFormat"];
+  const baseUrl = body["baseUrl"];
+  if (!id) return null;
+  const name = typeof body["name"] === "string" && body["name"].length > 0 ? body["name"] : body["name"] === null ? void 0 : existing?.name;
+  if (apiFormat !== "openai" && apiFormat !== "anthropic" && apiFormat !== "gemini") return null;
+  if (typeof baseUrl !== "string" || !baseUrl.trim()) return null;
+  const rawKey = body["apiKey"];
+  let apiKey = typeof rawKey === "string" && rawKey.length > 0 ? rawKey : existing?.apiKey ?? "";
+  const models = Array.isArray(body["models"]) ? body["models"].filter((m) => typeof m === "string") : existing?.models;
+  const modelConfigs = body["modelConfigs"] === null ? void 0 : parseModelConfigsInput(body["modelConfigs"], existing?.modelConfigs);
+  const apiKeys = parseApiKeysInput(body["apiKeys"], existing?.apiKeys);
+  const enabled = typeof body["enabled"] === "boolean" ? body["enabled"] : existing?.enabled;
+  const isOfficial = typeof body["isOfficial"] === "boolean" ? body["isOfficial"] : existing?.isOfficial;
+  const apiVersion = typeof body["apiVersion"] === "string" && body["apiVersion"].length > 0 ? body["apiVersion"] : body["apiVersion"] === null ? void 0 : existing?.apiVersion;
+  const modelsEndpoint = typeof body["modelsEndpoint"] === "string" && body["modelsEndpoint"].length > 0 ? body["modelsEndpoint"] : body["modelsEndpoint"] === null ? void 0 : existing?.modelsEndpoint;
+  const maxConcurrency = typeof body["maxConcurrency"] === "number" && Number.isFinite(body["maxConcurrency"]) ? body["maxConcurrency"] : body["maxConcurrency"] === null ? void 0 : existing?.maxConcurrency;
+  const transformer = body["transformer"] === null ? void 0 : parseTransformerInput(body["transformer"], existing?.transformer);
+  const codingPlan = body["codingPlan"] === null ? void 0 : body["codingPlan"] === void 0 ? existing?.codingPlan : body["codingPlan"] && typeof body["codingPlan"] === "object" && !Array.isArray(body["codingPlan"]) ? parseCodingPlanInput(body["codingPlan"], existing?.codingPlan) : existing?.codingPlan;
+  const apiModes = body["apiModes"] === null ? void 0 : parseApiModesInput(body["apiModes"], existing?.apiModes);
+  const selectedApiModeId = typeof body["selectedApiModeId"] === "string" && body["selectedApiModeId"].length > 0 ? body["selectedApiModeId"] : body["selectedApiModeId"] === null ? void 0 : existing?.selectedApiModeId;
+  if (typeof body["selectedApiModeId"] === "string" && body["selectedApiModeId"].length > 0 && body["selectedApiModeId"] !== existing?.selectedApiModeId && !(typeof rawKey === "string" && rawKey.length > 0)) {
+    const mode = apiModes?.find((m) => m.id === selectedApiModeId);
+    if (mode?.apiKey && typeof body["baseUrl"] === "string" && body["baseUrl"] === mode.baseUrl) {
+      apiKey = mode.apiKey;
+    }
+  }
+  return {
+    id,
+    name,
+    apiFormat,
+    baseUrl: baseUrl.trim(),
+    apiKey,
+    models,
+    modelConfigs,
+    apiKeys,
+    enabled,
+    isOfficial,
+    apiVersion,
+    maxConcurrency,
+    modelsEndpoint,
+    transformer,
+    codingPlan,
+    apiModes,
+    selectedApiModeId
+  };
+}
+function handlePresets(res, method) {
+  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on presets`);
+  const { mappable, excluded } = listMappablePresets();
+  const presets = mappable.map((p) => ({
+    id: p.id,
+    presetId: p.presetId,
+    name: p.name,
+    apiFormat: p.apiFormat,
+    baseUrl: p.baseUrl,
+    models: p.models
+  }));
+  return writeJson(res, 200, { presets, excluded });
+}
+async function handleKeys(req, res, method, rest, deps) {
+  if (method === "GET" && rest.length === 0) {
+    const rows = await deps.keyDb.outboundApiKeysList();
+    return writeJson(res, 200, { keys: rows.map(toKeyInfo) });
+  }
+  if (method === "POST" && rest.length === 0) {
+    const body = await readJsonBody(req);
+    const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
+    const created = await (0, import_outbound_api2.createNamedKey)(deps.keyDb, name);
+    return writeJson(res, 201, {
+      id: created.id,
+      name: created.name,
+      keyPrefix: created.keyPrefix,
+      createdAt: created.createdAt,
+      plaintextOnce: created.plaintextOnce
+    });
+  }
+  const id = rest[0];
+  const action = rest[1];
+  if (method === "POST" && id && action === "revoke") {
+    const ok = await deps.keyDb.outboundApiKeysRevoke(id);
+    return writeJson(res, ok ? 200 : 404, { ok });
+  }
+  if (method === "POST" && id && action === "enabled") {
+    const body = await readJsonBody(req);
+    const enabled = body["enabled"] === true;
+    const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
+    return writeJson(res, ok ? 200 : 404, { ok, enabled });
+  }
+  return writeJsonError(res, 405, `method ${method} not allowed on keys`);
+}
+async function handleServer(req, res, method, deps) {
+  if (method === "GET") {
+    const config = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+    return writeJson(res, 200, { server: config });
+  }
+  if (method === "PUT") {
+    const patch = await readJsonBody(req);
+    const current = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+    const merged = (0, import_outbound_api2.mergeServerConfig)(current, patch);
+    await (0, import_outbound_api2.saveServerConfig)(deps.settingsStore, merged);
+    await deps.outboundApiServer.applyConfig({
+      enabled: merged.enabled,
+      networkBinding: merged.networkBinding,
+      endpoints: merged.endpoints,
+      port: merged.port
+    });
+    return writeJson(res, 200, { server: merged });
+  }
+  return writeJsonError(res, 405, `method ${method} not allowed on server`);
+}
+async function handleAccounts(req, res, method, rest, deps) {
+  if (method === "GET" && rest.length === 0) {
+    const accounts = await deps.subscriptionAccounts.listAll();
+    const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+    return writeJson(res, 200, { accounts, providerAccounts });
+  }
+  if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
+    const result = handleCodexOAuthStatus(rest[2], deps);
+    return writeJson(res, result.status, result.body);
+  }
+  if (method === "PUT" || method === "POST" || method === "DELETE") {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) {
+      return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    }
+    if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
+      const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
+      return writeJson(res, result.status, result.body);
+    }
+    if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
+      const body2 = await readJsonBody(req);
+      const result = await handleOAuthComplete(providerId, body2, deps);
+      return writeJson(res, result.status, result.body);
+    }
+    if (method === "PUT" && rest[1] === "active") {
+      const body2 = await readJsonBody(req);
+      const id = typeof body2["id"] === "string" ? body2["id"] : "";
+      if (!id) return writeJsonError(res, 400, "active switch requires { id }");
+      const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
+      if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
+      return writeJson(res, 200, { ok: true });
+    }
+    if (method === "DELETE" && rest.length >= 2) {
+      const accountId = rest[1];
+      const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
+      if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJson(res, 200, { ok: true });
+    }
+    if (method === "DELETE") {
+      await deps.subscriptionTokenWriter.clearProvider(providerId);
+      return writeJson(res, 200, { ok: true });
+    }
+    const body = await readJsonBody(req);
+    const config = validateTokenBody(providerId, body);
+    if (!config) {
+      return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
+    }
+    await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
+    const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
+    return writeJson(res, 200, status ? { account: status } : { ok: true });
+  }
+  return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
+}
+async function handleStatus(res, method, deps) {
+  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
+  const status = deps.outboundApiServer.getStatus();
+  const serverConfig = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const endpoints = serverConfig.endpoints.map((e) => ({
+    endpoint: e.endpoint,
+    model: e.defaultModel,
+    useSubscription: e.useSubscription
+  }));
+  return writeJson(res, 200, { ...status, endpoints });
+}
+function resolvePlaygroundPath(endpoint, body) {
+  switch (endpoint) {
+    case "chat":
+      return "/v1/chat/completions";
+    case "responses":
+      return "/v1/responses";
+    case "messages":
+      return "/v1/messages";
+    case "gemini": {
+      const model = typeof body["model"] === "string" ? body["model"] : "gemini-pro";
+      return `/v1beta/models/${encodeURIComponent(model)}:generateContent`;
+    }
+    default:
+      return null;
+  }
+}
+async function handlePlayground(req, res, method, deps) {
+  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
+  const body = await readJsonBody(req);
+  const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
+  const key = typeof body["key"] === "string" ? body["key"] : "";
+  const payload = body["body"];
+  const status = deps.outboundApiServer.getStatus();
+  if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
+  const path = resolvePlaygroundPath(endpoint, isRecord(payload) ? payload : {});
+  if (!path) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
+  const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
+  await proxyToOutbound(res, status.port, path, key, upstreamBody);
+}
+function isRecord(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function proxyToOutbound(res, outboundPort, path, key, body) {
+  return new Promise((resolve) => {
+    const upstream = import_node_http.default.request(
+      {
+        host: "127.0.0.1",
+        port: outboundPort,
+        path,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+          Authorization: `Bearer ${key}`
+        }
+      },
+      (proxRes) => {
+        const headers = {};
+        const ct = proxRes.headers["content-type"];
+        if (ct) headers["Content-Type"] = ct;
+        res.writeHead(proxRes.statusCode ?? 502, headers);
+        proxRes.on("data", (chunk) => res.write(chunk));
+        proxRes.on("end", () => {
+          res.end();
+          resolve();
+        });
+      }
+    );
+    upstream.on("error", (err4) => {
+      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err4.message}`);
+      else res.end();
+      resolve();
+    });
+    upstream.write(body);
+    upstream.end();
+  });
+}
+
+// src/admin/client.ts
+var DASHBOARD_JS = String.raw`
+(function () {
+  var $ = function (id) { return document.getElementById(id); };
+  var authToken = null; // set if a 401 ever comes back (token-gated deploys)
+
+  function headers(extra) {
+    var h = extra || {};
+    if (authToken) h['Authorization'] = 'Bearer ' + authToken;
+    return h;
+  }
+
+  async function api(method, path, body) {
+    var opt = { method: method, headers: headers(body ? { 'Content-Type': 'application/json' } : {}) };
+    if (body) opt.body = JSON.stringify(body);
+    var res = await fetch('/admin/api/' + path, opt);
+    if (res.status === 401 && !authToken) {
+      var t = window.prompt('Admin token required');
+      if (t) { authToken = t; return api(method, path, body); }
+    }
+    var text = await res.text();
+    var json = null;
+    try { json = text ? JSON.parse(text) : null; } catch (e) { json = { raw: text }; }
+    return { status: res.status, json: json };
+  }
+
+  function clear(el) { while (el.firstChild) el.removeChild(el.firstChild); }
+  function td(text) { var c = document.createElement('td'); c.textContent = text == null ? '' : String(text); return c; }
+  function btn(label, cls, fn) { var b = document.createElement('button'); b.textContent = label; if (cls) b.className = cls; b.onclick = fn; return b; }
+
+  // ── Status ────────────────────────────────────────────────────────────────
+  async function loadStatus() {
+    var r = await api('GET', 'status');
+    var s = r.json || {};
+    $('statusBadge').textContent = s.running ? ('running :' + s.port) : 'stopped';
+    var html = '';
+    if (s.running) {
+      html += 'Outbound server <span class="pill ok">running</span> on port ' + s.port + '<br/>';
+      if (s.formats) {
+        html += '<div class="mono muted">' +
+          'chat: ' + s.formats.chat + '<br/>responses: ' + s.formats.responses +
+          '<br/>messages: ' + s.formats.messages + '<br/>gemini: ' + s.formats.gemini + '</div>';
+      }
+    } else {
+      html += 'Outbound server <span class="pill bad">stopped</span>';
+    }
+    $('statusBody').innerHTML = html;
+  }
+
+  // ── Providers ───────────────────────────────────────────────────────────────
+  // Curated presets loaded from GET /admin/api/presets. Selecting one prefills
+  // the add-form (format/base/models); the WRITE still goes through the existing
+  // POST/PUT /admin/api/providers path (no new write endpoint).
+  var presetsById = {};
+  var presetModels = []; // models staged by the last preset prefill
+
+  async function loadPresets() {
+    var r = await api('GET', 'presets');
+    var sel = $('pPreset');
+    // Keep the placeholder; drop any previously appended options.
+    while (sel.options.length > 1) sel.remove(1);
+    presetsById = {};
+    (r.json && r.json.presets || []).forEach(function (p) {
+      presetsById[p.id] = p;
+      var opt = document.createElement('option');
+      opt.value = p.id;
+      opt.textContent = p.name + ' (' + p.apiFormat + ')';
+      sel.appendChild(opt);
+    });
+  }
+
+  function onPresetChange() {
+    var p = presetsById[$('pPreset').value];
+    if (!p) { presetModels = []; return; }
+    if (!$('pId').value.trim()) $('pId').value = p.id;
+    $('pFormat').value = p.apiFormat;
+    $('pBase').value = p.baseUrl;
+    presetModels = Array.isArray(p.models) ? p.models.slice() : [];
+  }
+
+  async function loadProviders() {
+    var r = await api('GET', 'providers');
+    var body = $('providersTable').querySelector('tbody');
+    clear(body);
+    (r.json && r.json.providers || []).forEach(function (p) {
+      var tr = document.createElement('tr');
+      tr.appendChild(td(p.id));
+      tr.appendChild(td(p.apiFormat));
+      tr.appendChild(td(p.baseUrl));
+      tr.appendChild(td(p.hasApiKey ? p.apiKeyMasked : '(none)'));
+      var act = document.createElement('td');
+      act.appendChild(btn('Edit', 'secondary', function () {
+        $('pId').value = p.id; $('pFormat').value = p.apiFormat; $('pBase').value = p.baseUrl; $('pKey').value = '';
+      }));
+      act.appendChild(btn('Pool', 'secondary', function () { loadProviderKeys(p.id); }));
+      act.appendChild(btn('Delete', 'danger', async function () {
+        if (window.confirm('Delete provider ' + p.id + '?')) { await api('DELETE', 'providers/' + encodeURIComponent(p.id)); loadProviders(); }
+      }));
+      tr.appendChild(act);
+      body.appendChild(tr);
+    });
+  }
+
+  // ── Pool health (read-only; key-pool change) ──────────────────────────────
+  // GET /admin/api/providers/:id/keys → masked pool view. Multi-key is
+  // cold-standby + observable in v1 (no outbound failover yet — see panel note).
+  async function loadProviderKeys(providerId) {
+    var r = await api('GET', 'providers/' + encodeURIComponent(providerId) + '/keys');
+    var panel = $('poolPanel');
+    var body = $('poolTable').querySelector('tbody');
+    clear(body);
+    $('poolTitle').textContent = 'API key pool — ' + providerId;
+    (r.json && r.json.keys || []).forEach(function (k) {
+      var tr = document.createElement('tr');
+      tr.appendChild(td(k.id));
+      tr.appendChild(td(k.label));
+      tr.appendChild(td(k.apiKeyMasked));
+      tr.appendChild(td(k.enabled ? 'yes' : 'no'));
+      tr.appendChild(td(k.weight));
+      var h = '';
+      if (k.health && k.health.autoDisabled) h += 'auto-disabled (' + k.health.autoDisabled.status + ') ';
+      if (k.health && k.health.cooldown) h += 'cooldown until ' + new Date(k.health.cooldown.until).toLocaleTimeString();
+      tr.appendChild(td(h || 'ok'));
+      body.appendChild(tr);
+    });
+    panel.style.display = 'block';
+  }
+
+  async function saveProvider() {
+    $('pErr').textContent = '';
+    var id = $('pId').value.trim();
+    if (!id) { $('pErr').textContent = 'id required'; return; }
+    var payload = { id: id, apiFormat: $('pFormat').value, baseUrl: $('pBase').value.trim(), apiKey: $('pKey').value };
+    // Carry the preset-prefilled models (existing parseProviderInput accepts them).
+    if (presetModels.length) payload.models = presetModels;
+    // Try PUT first (edit, blank key keeps existing); fall back to POST (create).
+    var r = await api('PUT', 'providers/' + encodeURIComponent(id), payload);
+    if (r.status === 404) r = await api('POST', 'providers', payload);
+    if (r.status >= 400) { $('pErr').textContent = (r.json && r.json.error && r.json.error.message) || ('error ' + r.status); return; }
+    $('pId').value = ''; $('pBase').value = ''; $('pKey').value = '';
+    $('pPreset').value = ''; presetModels = []; // reset the picker after a write
+    loadProviders();
+  }
+
+  // ── Keys ────────────────────────────────────────────────────────────────────
+  async function loadKeys() {
+    var r = await api('GET', 'keys');
+    var body = $('keysTable').querySelector('tbody');
+    clear(body);
+    (r.json && r.json.keys || []).forEach(function (k) {
+      var tr = document.createElement('tr');
+      tr.appendChild(td(k.name));
+      tr.appendChild(td(k.keyPrefix));
+      tr.appendChild(td(k.enabled ? 'yes' : 'no'));
+      tr.appendChild(td(k.revoked ? 'yes' : 'no'));
+      var act = document.createElement('td');
+      if (!k.revoked) {
+        act.appendChild(btn(k.enabled ? 'Disable' : 'Enable', 'secondary', async function () {
+          await api('POST', 'keys/' + encodeURIComponent(k.id) + '/enabled', { enabled: !k.enabled }); loadKeys();
+        }));
+        act.appendChild(btn('Revoke', 'danger', async function () {
+          if (window.confirm('Revoke ' + k.name + '?')) { await api('POST', 'keys/' + encodeURIComponent(k.id) + '/revoke'); loadKeys(); }
+        }));
+      }
+      tr.appendChild(act);
+      body.appendChild(tr);
+    });
+  }
+
+  function showKeyModal(plaintext) {
+    $('keyPlaintext').textContent = plaintext;
+    $('keyModalBg').classList.add('show');
+    $('keyCopy').onclick = function () { navigator.clipboard && navigator.clipboard.writeText(plaintext); };
+    $('keyClose').onclick = function () {
+      $('keyModalBg').classList.remove('show');
+      $('keyPlaintext').textContent = ''; // never persist the plaintext
+    };
+  }
+
+  async function createKey() {
+    var name = $('kName').value.trim() || 'key';
+    var r = await api('POST', 'keys', { name: name });
+    if (r.json && r.json.plaintextOnce) { showKeyModal(r.json.plaintextOnce); $('kName').value = ''; loadKeys(); }
+  }
+
+  // ── Server config ───────────────────────────────────────────────────────────
+  async function loadServer() {
+    var r = await api('GET', 'server');
+    var s = (r.json && r.json.server) || {};
+    $('sEnabled').checked = !!s.enabled;
+    $('sLan').checked = !!s.networkBinding;
+    $('sPort').value = s.port || '';
+    var body = $('endpointsTable').querySelector('tbody');
+    clear(body);
+    (s.endpoints || []).forEach(function (e) {
+      var tr = document.createElement('tr');
+      tr.appendChild(td(e.endpoint));
+      tr.appendChild(td(e.defaultModel));
+      tr.appendChild(td(e.useSubscription ? 'yes' : 'no'));
+      body.appendChild(tr);
+    });
+  }
+
+  async function saveServer() {
+    var patch = { enabled: $('sEnabled').checked, networkBinding: $('sLan').checked };
+    var port = parseInt($('sPort').value, 10);
+    if (port) patch.port = port;
+    await api('PUT', 'server', patch);
+    loadServer(); loadStatus();
+  }
+
+  // ── Accounts ────────────────────────────────────────────────────────────────
+  // The GET stays token-free (status only). The Save/Clear actions WRITE tokens
+  // (secret IN); the form never renders an existing/stored token (write-only).
+  async function loadAccounts() {
+    var r = await api('GET', 'accounts');
+    var body = $('accountsTable').querySelector('tbody');
+    clear(body);
+    (r.json && r.json.accounts || []).forEach(function (a) {
+      var tr = document.createElement('tr');
+      tr.appendChild(td(a.displayName || a.providerId));
+      tr.appendChild(td(a.kind));
+      var st = document.createElement('td');
+      var ok = a.credentialStatus && a.credentialStatus.ok;
+      var pill = document.createElement('span');
+      pill.className = 'pill ' + (ok ? 'ok' : 'bad');
+      pill.textContent = ok ? 'ok' : ((a.credentialStatus && a.credentialStatus.reason) || 'no credential');
+      st.appendChild(pill);
+      tr.appendChild(st);
+      var act = document.createElement('td');
+      act.appendChild(btn('Clear', 'danger', async function () {
+        if (window.confirm('Clear ' + a.providerId + ' token?')) {
+          await api('DELETE', 'accounts/' + encodeURIComponent(a.providerId));
+          loadAccounts();
+        }
+      }));
+      tr.appendChild(act);
+      body.appendChild(tr);
+    });
+    renderProviderAccounts(r.json && r.json.providerAccounts || {});
+  }
+
+  // Per-provider sanitized accounts (multi-account). Secrets IN-never-OUT: this
+  // view shows id/label/status/active only — set-active + delete are STATUS-ONLY.
+  function renderProviderAccounts(byProvider) {
+    var body = $('providerAccountsTable').querySelector('tbody');
+    clear(body);
+    Object.keys(byProvider).forEach(function (provider) {
+      (byProvider[provider] || []).forEach(function (acc) {
+        var tr = document.createElement('tr');
+        tr.appendChild(td(provider));
+        tr.appendChild(td(acc.label || acc.id));
+        tr.appendChild(td(acc.status));
+        tr.appendChild(td(acc.isActive ? 'yes' : ''));
+        var act = document.createElement('td');
+        if (!acc.isActive) {
+          act.appendChild(btn('Set active', '', async function () {
+            await api('PUT', 'accounts/' + encodeURIComponent(provider) + '/active', { id: acc.id });
+            loadAccounts();
+          }));
+        }
+        act.appendChild(btn('Delete', 'danger', async function () {
+          if (window.confirm('Delete account ' + (acc.label || acc.id) + '?')) {
+            await api('DELETE', 'accounts/' + encodeURIComponent(provider) + '/' + encodeURIComponent(acc.id));
+            loadAccounts();
+          }
+        }));
+        tr.appendChild(act);
+        body.appendChild(tr);
+      });
+    });
+  }
+
+  async function saveAccount() {
+    $('acErr').textContent = '';
+    var provider = $('acProvider').value;
+    var raw = $('acBody').value.trim();
+    if (!raw) { $('acErr').textContent = 'paste a token JSON'; return; }
+    var payload; try { payload = JSON.parse(raw); } catch (e) { $('acErr').textContent = 'invalid JSON'; return; }
+    var r = await api('PUT', 'accounts/' + encodeURIComponent(provider), payload);
+    if (r.status >= 400) { $('acErr').textContent = (r.json && r.json.error && r.json.error.message) || ('error ' + r.status); return; }
+    $('acBody').value = ''; // never persist/echo the just-saved token
+    loadAccounts();
+  }
+
+  // ── Playground ──────────────────────────────────────────────────────────────
+  async function sendPlayground() {
+    var pre = $('plResponse');
+    pre.classList.remove('muted');
+    pre.textContent = 'sending…';
+    var bodyText = $('plBody').value;
+    var parsed; try { parsed = JSON.parse(bodyText); } catch (e) { parsed = bodyText; }
+    var r = await fetch('/admin/api/playground', {
+      method: 'POST',
+      headers: headers({ 'Content-Type': 'application/json' }),
+      body: JSON.stringify({ endpoint: $('plEndpoint').value, key: $('plKey').value, body: parsed }),
+    });
+    var text = await r.text();
+    pre.textContent = '[' + r.status + ']\n' + text;
+  }
+
+  function wire() {
+    $('pSave').onclick = saveProvider;
+    $('pPreset').onchange = onPresetChange;
+    $('kCreate').onclick = createKey;
+    $('sSave').onclick = saveServer;
+    $('acSave').onclick = saveAccount;
+    $('plSend').onclick = sendPlayground;
+    refresh();
+  }
+
+  function refresh() {
+    loadStatus(); loadProviders(); loadPresets(); loadKeys(); loadServer(); loadAccounts();
+  }
+
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', wire);
+  else wire();
+})();
+`;
+
+// src/admin/html.ts
+var STYLE = `
+:root { --bg:#0f1115; --panel:#171a21; --line:#272b35; --fg:#e6e8ec; --muted:#8b91a0; --accent:#5b8cff; --danger:#ff5b6e; --ok:#3ecf8e; }
+* { box-sizing: border-box; }
+body { margin:0; font:14px/1.5 system-ui,-apple-system,Segoe UI,Roboto,sans-serif; background:var(--bg); color:var(--fg); }
+header { padding:14px 20px; border-bottom:1px solid var(--line); display:flex; align-items:center; gap:12px; }
+header h1 { font-size:16px; margin:0; font-weight:600; }
+header .badge { font-size:12px; color:var(--muted); }
+main { padding:20px; display:grid; gap:20px; max-width:980px; margin:0 auto; }
+section { background:var(--panel); border:1px solid var(--line); border-radius:10px; padding:16px; }
+section h2 { font-size:14px; margin:0 0 12px; font-weight:600; }
+table { width:100%; border-collapse:collapse; font-size:13px; }
+th, td { text-align:left; padding:6px 8px; border-bottom:1px solid var(--line); }
+th { color:var(--muted); font-weight:500; }
+input, select, textarea { background:var(--bg); color:var(--fg); border:1px solid var(--line); border-radius:6px; padding:6px 8px; font:inherit; }
+textarea { width:100%; min-height:90px; resize:vertical; font-family:ui-monospace,Menlo,monospace; }
+button { background:var(--accent); color:#fff; border:0; border-radius:6px; padding:6px 12px; cursor:pointer; font:inherit; }
+button.secondary { background:#2a2f3a; }
+button.danger { background:var(--danger); }
+.row { display:flex; gap:8px; flex-wrap:wrap; align-items:center; margin-top:8px; }
+.muted { color:var(--muted); }
+.mono { font-family:ui-monospace,Menlo,monospace; }
+.pill { padding:1px 8px; border-radius:999px; font-size:12px; }
+.pill.ok { background:rgba(62,207,142,.15); color:var(--ok); }
+.pill.bad { background:rgba(255,91,110,.15); color:var(--danger); }
+pre { background:var(--bg); border:1px solid var(--line); border-radius:6px; padding:10px; overflow:auto; max-height:320px; white-space:pre-wrap; }
+.modal-bg { position:fixed; inset:0; background:rgba(0,0,0,.6); display:none; align-items:center; justify-content:center; }
+.modal-bg.show { display:flex; }
+.modal { background:var(--panel); border:1px solid var(--line); border-radius:10px; padding:20px; max-width:520px; width:90%; }
+.warn { color:var(--danger); font-size:13px; margin:8px 0; }
+.err { color:var(--danger); font-size:13px; }
+`;
+var BODY = `
+<header>
+  <h1>omnicross daemon dashboard</h1>
+  <span class="badge" id="statusBadge">connecting\u2026</span>
+</header>
+<main>
+  <section id="statusSection">
+    <h2>Runtime status</h2>
+    <div id="statusBody" class="muted">loading\u2026</div>
+  </section>
+
+  <section>
+    <h2>Providers</h2>
+    <table id="providersTable"><thead><tr><th>id</th><th>format</th><th>base URL</th><th>key</th><th></th></tr></thead><tbody></tbody></table>
+    <div class="row">
+      <select id="pPreset"><option value="">-- \u9009\u62E9\u9884\u7F6E --</option></select>
+      <input id="pId" placeholder="id" size="10" />
+      <select id="pFormat"><option value="openai">openai</option><option value="anthropic">anthropic</option><option value="gemini">gemini</option></select>
+      <input id="pBase" placeholder="base URL" size="26" />
+      <input id="pKey" placeholder="apiKey (blank = keep on edit)" size="22" />
+      <button id="pSave">Save provider</button>
+    </div>
+    <div class="err" id="pErr"></div>
+    <div id="poolPanel" style="display:none; margin-top:12px;">
+      <h2 id="poolTitle" style="font-size:13px;">API key pool</h2>
+      <p class="muted" style="margin:0 0 8px;">Read-only. Multi-key is <b>cold-standby + observable</b> in v1: outbound failover does not yet rotate keys (null-session boundary \u2014 pending the core seam). Keys are masked; edit the pool via the provider's <span class="mono">apiKeys</span>.</p>
+      <table id="poolTable"><thead><tr><th>id</th><th>label</th><th>key</th><th>enabled</th><th>weight</th><th>health</th></tr></thead><tbody></tbody></table>
+    </div>
+  </section>
+
+  <section>
+    <h2>Named keys</h2>
+    <table id="keysTable"><thead><tr><th>name</th><th>prefix</th><th>enabled</th><th>revoked</th><th></th></tr></thead><tbody></tbody></table>
+    <div class="row">
+      <input id="kName" placeholder="key name" size="16" />
+      <button id="kCreate">Create key</button>
+    </div>
+  </section>
+
+  <section>
+    <h2>Server config</h2>
+    <div class="row">
+      <label><input type="checkbox" id="sEnabled" /> enabled</label>
+      <label><input type="checkbox" id="sLan" /> networkBinding (LAN)</label>
+      <label>port <input id="sPort" size="6" /></label>
+      <button id="sSave">Apply server config</button>
+    </div>
+    <table id="endpointsTable"><thead><tr><th>endpoint</th><th>defaultModel</th><th>subscription</th></tr></thead><tbody></tbody></table>
+  </section>
+
+  <section>
+    <h2>Accounts <span class="muted">(subscription tokens)</span></h2>
+    <table id="accountsTable"><thead><tr><th>provider</th><th>kind</th><th>status</th><th></th></tr></thead><tbody></tbody></table>
+    <h3>Per-provider accounts <span class="muted">(multi-account \u2014 sanitized, no tokens)</span></h3>
+    <table id="providerAccountsTable"><thead><tr><th>provider</th><th>label</th><th>status</th><th>active</th><th></th></tr></thead><tbody></tbody></table>
+    <div class="row">
+      <select id="acProvider"><option value="claude">claude</option><option value="codex">codex</option><option value="gemini">gemini</option><option value="opencodego">opencodego</option></select>
+      <button id="acSave">Save token</button>
+    </div>
+    <textarea id="acBody" placeholder='{"authMethod":"oauth","status":"authorized","accessToken":"\u2026","refreshToken":"\u2026"}'></textarea>
+    <p class="muted">Write-only: paste a token JSON to authorize this provider. The token is shown only on entry \u2014 it is never read back or displayed. Stored as plain JSON in <span class="mono">tokens.json</span>.</p>
+    <div class="err" id="acErr"></div>
+  </section>
+
+  <section>
+    <h2>Playground</h2>
+    <div class="row">
+      <select id="plEndpoint"><option value="chat">chat</option><option value="responses">responses</option><option value="messages">messages</option><option value="gemini">gemini</option></select>
+      <input id="plKey" placeholder="named key (sk-omnicross-\u2026)" size="30" />
+      <button id="plSend">Send</button>
+    </div>
+    <textarea id="plBody">{"model":"","messages":[{"role":"user","content":"ping"}]}</textarea>
+    <pre id="plResponse" class="muted">response will appear here</pre>
+  </section>
+</main>
+
+<div class="modal-bg" id="keyModalBg">
+  <div class="modal">
+    <h2>Key created</h2>
+    <p class="warn">This secret is shown ONCE. Copy it now \u2014 it cannot be retrieved again.</p>
+    <pre id="keyPlaintext" class="mono"></pre>
+    <div class="row">
+      <button id="keyCopy">Copy</button>
+      <button class="secondary" id="keyClose">Close</button>
+    </div>
+  </div>
+</div>
+`;
+var DASHBOARD_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>omnicross daemon dashboard</title>
+<style>${STYLE}</style>
+</head>
+<body>
+${BODY}
+<script>${DASHBOARD_JS}</script>
+</body>
+</html>`;
+
+// src/admin/AdminServer.ts
+var LOOPBACK_ADDR = "127.0.0.1";
+var LAN_ADDR = "0.0.0.0";
+var AdminServer = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  server = null;
+  boundPort = 0;
+  boundAddr = LOOPBACK_ADDR;
+  /**
+   * Start the admin listener honoring the resolved admin config. Returns the
+   * actual bound port, or `0` when it refuses/declines to bind (disabled or the
+   * LAN fail-closed gate). Idempotent: a second call returns the bound port.
+   */
+  async start() {
+    if (this.server) return this.boundPort;
+    const cfg = this.deps.getAdminConfig();
+    if (!cfg.enabled) return 0;
+    if (cfg.networkBinding && !cfg.token) {
+      console.error(
+        "[AdminServer] REFUSING to bind: admin.networkBinding (LAN/0.0.0.0) requires a non-empty admin.token. Set admin.token in config.json or disable networkBinding. Dashboard stays DOWN (fail closed)."
+      );
+      return 0;
+    }
+    const bindAddr = cfg.networkBinding ? LAN_ADDR : LOOPBACK_ADDR;
+    const actualPort = await this.listen(bindAddr, cfg.port);
+    this.boundAddr = bindAddr;
+    this.boundPort = actualPort;
+    console.info(`[AdminServer] Dashboard listening on ${bindAddr}:${actualPort}`);
+    return actualPort;
+  }
+  /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
+  listen(bindAddr, port) {
+    return new Promise((resolve, reject) => {
+      const server = import_node_http2.default.createServer((req, res) => {
+        this.onRequest(req, res);
+      });
+      const onError = (err4) => {
+        if (err4.code === "EADDRINUSE" && port !== 0) {
+          server.removeListener("error", onError);
+          this.listen(bindAddr, 0).then(resolve, reject);
+          return;
+        }
+        reject(err4);
+      };
+      server.on("error", onError);
+      server.listen(port, bindAddr, () => {
+        const addr = server.address();
+        if (addr && typeof addr === "object") {
+          server.removeListener("error", onError);
+          server.on("error", (e) => console.error("[AdminServer] server error", e));
+          this.server = server;
+          resolve(addr.port);
+        } else {
+          reject(new Error("Failed to get admin server address"));
+        }
+      });
+    });
+  }
+  /** Per-request handler: auth gate (when a token is set) → routing. */
+  onRequest(req, res) {
+    void this.dispatch(req, res).catch((err4) => {
+      const message = err4 instanceof Error ? err4.message : String(err4);
+      console.error("[AdminServer] unhandled error:", message);
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { type: "admin_error", message } }));
+      }
+    });
+  }
+  async dispatch(req, res) {
+    const cfg = this.deps.getAdminConfig();
+    if (cfg.token && !this.isAuthorized(req, cfg.token)) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: { type: "unauthorized", message: "admin token required" } }));
+      return;
+    }
+    const url = req.url ?? "/";
+    const path = url.split("?")[0];
+    if ((req.method === "GET" || req.method === "HEAD") && (path === "/" || path === "/admin")) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(req.method === "HEAD" ? void 0 : DASHBOARD_HTML);
+      return;
+    }
+    if (path.startsWith("/admin/api/")) {
+      await handleAdminApi(req, res, path, this.deps);
+      return;
+    }
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "not_found", message: "no such admin route" } }));
+  }
+  /** Constant-time bearer/header check against the configured token. */
+  isAuthorized(req, token) {
+    const header = req.headers["authorization"];
+    const bearer = typeof header === "string" && header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : void 0;
+    const xToken = req.headers["x-admin-token"];
+    const presented = bearer ?? (typeof xToken === "string" ? xToken.trim() : void 0);
+    return constantTimeEquals(presented, token);
+  }
+  /** Stop the listener and release the port. */
+  async stop() {
+    const server = this.server;
+    if (!server) return;
+    this.server = null;
+    this.boundPort = 0;
+    return new Promise((resolve) => {
+      server.close(() => resolve());
+    });
+  }
+  /** A live status snapshot. */
+  getStatus() {
+    const running = this.server !== null;
+    if (!running) return { running: false, port: 0, url: null };
+    const host = this.boundAddr === LAN_ADDR ? LOOPBACK_ADDR : this.boundAddr;
+    return { running: true, port: this.boundPort, url: `http://${host}:${this.boundPort}` };
+  }
+};
+function constantTimeEquals(a, b) {
+  if (typeof a !== "string") return false;
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  if (bufA.length !== bufB.length) return false;
+  return (0, import_node_crypto6.timingSafeEqual)(bufA, bufB);
+}
+
+// src/admin/oauthSessions.ts
+var import_node_crypto7 = __toESM(require("crypto"), 1);
+var DEFAULT_OAUTH_SESSION_TTL_MS = 10 * 60 * 1e3;
+var OAuthSessionStore = class {
+  constructor(ttlMs = DEFAULT_OAUTH_SESSION_TTL_MS) {
+    this.ttlMs = ttlMs;
+  }
+  ttlMs;
+  sessions = /* @__PURE__ */ new Map();
+  /**
+   * Mint a fresh opaque `sessionId`, stash the pending session, and return the
+   * id. Sweeps expired entries first so the map never grows unbounded.
+   */
+  put(session) {
+    this.sweep();
+    const sessionId = import_node_crypto7.default.randomBytes(24).toString("base64url");
+    this.sessions.set(sessionId, { ...session, createdAt: Date.now() });
+    return sessionId;
+  }
+  /**
+   * SINGLE-USE consume: return + delete the session for `sessionId`, or `null`
+   * when it is unknown, already used, or past its TTL (in which case it is
+   * dropped). A `null` return means the completer must reject (no exchange, no
+   * write).
+   */
+  take(sessionId) {
+    this.sweep();
+    const session = this.sessions.get(sessionId);
+    if (!session) return null;
+    this.sessions.delete(sessionId);
+    if (Date.now() - session.createdAt > this.ttlMs) return null;
+    return session;
+  }
+  /** Drop every session past its TTL. Called on each put/take. */
+  sweep() {
+    const now = Date.now();
+    for (const [id, session] of this.sessions) {
+      if (now - session.createdAt > this.ttlMs) this.sessions.delete(id);
+    }
+  }
+};
+
+// src/commands/loopbackCallback.ts
+var import_node_http3 = require("http");
+var LOOPBACK_HOST = "127.0.0.1";
+var LOOPBACK_PORT = 1455;
+var CALLBACK_PATH = "/auth/callback";
+var DEFAULT_TIMEOUT_MS = 5 * 6e4;
+function pageHtml(message) {
+  return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
+}
+function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (server2, fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server2.close(() => fn());
+    };
+    const server = (0, import_node_http3.createServer)((req, res) => {
+      const url = new URL(req.url ?? "", `http://${LOOPBACK_HOST}:${LOOPBACK_PORT}`);
+      if (url.pathname !== CALLBACK_PATH) {
+        res.writeHead(404, { "Content-Type": "text/html" });
+        res.end(pageHtml("Not found"));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(pageHtml("Login failed: missing authorization code."));
+        finish(server, () => reject(new Error("login: callback did not include an authorization code")));
+        return;
+      }
+      if (state !== expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(pageHtml("Login failed: state mismatch."));
+        finish(server, () => reject(new Error("login: callback state did not match (possible CSRF) \u2014 aborting")));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end(pageHtml("Login complete."));
+      finish(server, () => resolve(code));
+    });
+    server.on("error", (err4) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (err4.code === "EADDRINUSE") {
+        reject(
+          new Error(
+            `login: cannot bind ${LOOPBACK_HOST}:${LOOPBACK_PORT} (address in use) \u2014 another codex login or process is holding the port`
+          )
+        );
+      } else {
+        reject(err4);
+      }
+    });
+    const timer = setTimeout(() => {
+      finish(server, () => reject(new Error(`login: timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the callback`)));
+    }, timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    server.listen(LOOPBACK_PORT, LOOPBACK_HOST);
+  });
+}
+
+// src/pool/autoDisableStore.ts
+var AutoDisableStore = class {
+  records = /* @__PURE__ */ new Map();
+  /** Record (or overwrite) an auth-failure auto-disable for `keyId`. */
+  markAutoDisabled(keyId, status, at) {
+    this.records.set(keyId, { status, at, reason: "auth_failure" });
+  }
+  /** Whether `keyId` is currently auto-disabled in this process. */
+  isDisabled(keyId) {
+    return this.records.has(keyId);
+  }
+  /** Read the auto-disable record for `keyId`, or `undefined` when healthy. */
+  get(keyId) {
+    return this.records.get(keyId);
+  }
+  /** Clear all records (tests / teardown). */
+  clear() {
+    this.records.clear();
+  }
+};
+
+// src/pool/loadPoolKeys.ts
+var secretBox2 = null;
+function setSecretBox2(box) {
+  secretBox2 = box;
+}
+function readKeyValue(rawKey) {
+  return secretBox2 ? secretBox2.decryptMaybe(rawKey) : rawKey;
+}
+function normalizeEntry(providerId, entry, sortOrder, autoDisabled) {
+  const enabledInConfig = entry.enabled !== false;
+  const enabled = enabledInConfig && !autoDisabled.isDisabled(entry.id);
+  return {
+    id: entry.id,
+    providerId,
+    label: entry.label && entry.label.length > 0 ? entry.label : entry.id,
+    apiKey: readKeyValue(entry.apiKey),
+    enabled,
+    weight: typeof entry.weight === "number" && Number.isFinite(entry.weight) ? entry.weight : 1,
+    sortOrder
+  };
+}
+function createPoolKeysLoader(getProviderRow, autoDisabled) {
+  return async (providerId) => {
+    const row = getProviderRow(providerId);
+    if (!row) return [];
+    const pool = (row.apiKeys ?? []).filter((k) => k.apiKey.length > 0);
+    if (pool.length > 0) {
+      return pool.map((entry, i) => normalizeEntry(providerId, entry, i, autoDisabled));
+    }
+    if (row.apiKey.length > 0) {
+      return [
+        normalizeEntry(
+          providerId,
+          { id: `${providerId}:default`, apiKey: row.apiKey, weight: 1, enabled: true },
+          0,
+          autoDisabled
+        )
+      ];
+    }
+    return [];
+  };
+}
+
+// src/ports/ConfigFileProviderConfigSource.ts
+var import_core = require("@omnicross/core");
+var EMPTY_CHAIN = {
+  providerTransformers: [],
+  modelTransformers: []
+};
+var FORMAT_TRANSFORMER = {
+  anthropic: "anthropic",
+  gemini: "gemini"
+};
+var ConfigFileProviderConfigSource = class {
+  providers = /* @__PURE__ */ new Map();
+  transformerService;
+  /**
+   * Optional reload-hook (key-pool change, design D4). A no-type-coupling
+   * callback invoked at the END of `reload(...)`. `buildDaemon` injects
+   * `() => pool.invalidateCache()` so the `ApiKeyPoolService.keyCache` is
+   * flushed after a hot-reload swaps the catalog — WITHOUT this port ever
+   * importing/depending on `ApiKeyPoolService`. Absent = no-op (single-key
+   * boots that never construct a pool stay byte-identical).
+   */
+  reloadHook;
+  constructor(config) {
+    for (const p of config.providers) this.providers.set(p.id, p);
+    this.transformerService = new import_core.TransformerService();
+    void (0, import_core.registerBuiltinTransformers)(this.transformerService);
+  }
+  // ── Reload hook (key-pool design D4) ───────────────────────────────────────
+  /**
+   * Register a callback fired after every `reload(...)`. Used by `buildDaemon`
+   * to invalidate the pool's keyCache on a hot-reload. The port stays ignorant
+   * of what the callback does (no pool type dependency).
+   */
+  setReloadHook(fn) {
+    this.reloadHook = fn;
+  }
+  /**
+   * Read the live (post-reload) provider row for `providerId`, or `undefined`.
+   * Exposed so the pool's `loadKeys` reads the SAME live catalog Map this port
+   * serves (so a hot-reload is observed on the next load after `invalidateCache`).
+   */
+  getProviderRow(providerId) {
+    return this.providers.get(providerId);
+  }
+  /** Await the built-in transformer registration (tests await this before dispatch). */
+  async ready() {
+    await (0, import_core.registerBuiltinTransformers)(this.transformerService);
+  }
+  // ── Hot-reload seam (admin dashboard, RT3 design D6) ───────────────────────
+  /**
+   * Replace the live provider catalog in place (additive — does NOT touch the
+   * ten port methods, the seeded `TransformerService`, or `ready()`). Called by
+   * the admin API after a provider POST/PUT/DELETE persists `config.json`, so the
+   * next outbound request sees the new catalog WITHOUT a daemon restart. The Map
+   * swap is synchronous; an in-flight request keeps its already-resolved
+   * provider (no locking needed for a single-operator local daemon).
+   */
+  reload(config) {
+    this.setProviders(config.providers);
+    this.reloadHook?.();
+  }
+  /** Clear + repopulate the private providers Map from a fresh provider list. */
+  setProviders(providers) {
+    this.providers.clear();
+    for (const p of providers) this.providers.set(p.id, p);
+  }
+  // ── REAL methods ──────────────────────────────────────────────────────────
+  async getProvider(id) {
+    const row = this.providers.get(id);
+    if (!row) return null;
+    return toLLMProvider(row);
+  }
+  getTransformerService() {
+    return this.transformerService;
+  }
+  async getMainTransformer(providerId) {
+    const row = this.providers.get(providerId);
+    if (!row || row.apiFormat === "openai") return null;
+    const name = FORMAT_TRANSFORMER[row.apiFormat];
+    const instances = this.transformerService.resolveTransformerReferences([name]);
+    return instances[0] ?? null;
+  }
+  async resolveTransformerChain(providerId, _model) {
+    const row = this.providers.get(providerId);
+    if (!row) return EMPTY_CHAIN;
+    const customRefs = row.transformer?.use ?? [];
+    if (customRefs.length === 0) return EMPTY_CHAIN;
+    const formatName = row.apiFormat === "openai" ? void 0 : FORMAT_TRANSFORMER[row.apiFormat];
+    const effectiveRefs = formatName ? customRefs.filter((ref) => (typeof ref === "string" ? ref : ref[0]) !== formatName) : customRefs;
+    if (effectiveRefs.length === 0) return EMPTY_CHAIN;
+    return {
+      providerTransformers: this.transformerService.resolveTransformerReferences(effectiveRefs),
+      modelTransformers: []
+    };
+  }
+  // ── STUBS (never hit on the BYO single-key path) ────────────────────────────
+  async resolveRoutedModel() {
+    return null;
+  }
+  async resolveEffectiveModels() {
+    return {};
+  }
+  async getAgentDefaultModels() {
+    return {};
+  }
+  async hasVisionCapability() {
+    return false;
+  }
+  async getGlobalModelParameters() {
+    return {};
+  }
+  async getDiscoveredModelMaxTokens() {
+    return void 0;
+  }
+};
+function resolvePreferredApiKey(row) {
+  if (row.apiKey.length > 0) return row.apiKey;
+  const firstEnabled = row.apiKeys?.find((k) => k.enabled !== false && k.apiKey.length > 0);
+  return firstEnabled?.apiKey ?? "";
+}
+function toLLMProvider(row) {
+  const apiFormat = row.apiFormat === "gemini" ? "google" : row.apiFormat;
+  const transformer = row.apiFormat === "openai" ? void 0 : { use: [FORMAT_TRANSFORMER[row.apiFormat]] };
+  const allModels = row.models ?? [];
+  const models = row.modelConfigs ? allModels.filter((id) => row.modelConfigs.find((c) => c.id === id)?.enabled !== false) : allModels;
+  return {
+    id: row.id,
+    name: row.id,
+    apiFormat,
+    api_base_url: row.baseUrl,
+    api_key: resolvePreferredApiKey(row),
+    models,
+    enabled: true,
+    transformer,
+    // app-parity-2 child 3: POPULATE the coding-plan endpoint onto the core
+    // `LLMProvider` (structurally identical to the contracts `CodingPlanConfig`).
+    // The daemon does NOT resolve endpoints itself — core's shared
+    // `resolveProviderEndpoint` (wired into `buildProviderApiUrl` + the BYO proxy
+    // key path) reads `provider.codingPlan` and, when `enabled` + `baseUrl`, routes
+    // via the coding-plan endpoint (key = `codingPlan.apiKey || api_key`). Absent →
+    // undefined → the plain `api_base_url`/`api_key` path (byte-identical to before).
+    codingPlan: row.codingPlan,
+    // app-parity-2 child 4: POPULATE the API modes + selected id onto the core
+    // `LLMProvider` (structurally identical to the contracts `ApiMode`). Core's
+    // shared `resolveProviderEndpoint` (layer 1) reads them: when a mode is selected
+    // it reports `source:'api-mode'` and uses `api_base_url || mode.baseUrl` /
+    // `api_key || mode.apiKey`. The row's `baseUrl`/`apiKey` hold the EFFECTIVE
+    // endpoint (synced on switch — baseUrl app-side, the secret key server-side in
+    // `parseProviderInput`), so customizations are preserved (the row value wins).
+    apiModes: row.apiModes,
+    selectedApiModeId: row.selectedApiModeId,
+    // Official-Anthropic signature handling only matters for the Anthropic
+    // ingress (deferred → 502); leave it off for the BYO transform path.
+    isOfficial: false
+  };
+}
+
+// src/ports/ConsoleLogger.ts
+var ConsoleLogger = class {
+  info(message, meta) {
+    if (meta === void 0) console.info(message);
+    else console.info(message, meta);
+  }
+  warn(message, meta) {
+    if (meta === void 0) console.warn(message);
+    else console.warn(message, meta);
+  }
+  error(message, error, meta) {
+    if (error === void 0 && meta === void 0) console.error(message);
+    else if (meta === void 0) console.error(message, error);
+    else console.error(message, error, meta);
+  }
+  debug(message, meta) {
+    if (meta === void 0) console.debug(message);
+    else console.debug(message, meta);
+  }
+};
+
+// src/ports/JsonApiServerSettingsStore.ts
+var import_node_fs5 = require("fs");
+var import_outbound_api3 = require("@omnicross/core/outbound-api");
+var JsonApiServerSettingsStore = class {
+  constructor(configPath) {
+    this.configPath = configPath;
+  }
+  configPath;
+  async get(key) {
+    if (key !== import_outbound_api3.OUTBOUND_API_SERVER_CONFIG_KEY) return void 0;
+    const file = this.readFile();
+    return file.server ?? void 0;
+  }
+  async set(key, value) {
+    if (key !== import_outbound_api3.OUTBOUND_API_SERVER_CONFIG_KEY) return;
+    const file = this.readFile();
+    file.server = value;
+    (0, import_node_fs5.writeFileSync)(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
+  }
+  /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
+  readFile() {
+    try {
+      const raw = (0, import_node_fs5.readFileSync)(this.configPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") return parsed;
+    } catch {
+    }
+    return {};
+  }
+};
+
+// src/ports/JsonSubscriptionCredentialStore.ts
+var import_node_fs6 = require("fs");
+var import_node_path3 = require("path");
+var import_subscriptions3 = require("@omnicross/subscriptions");
+var JsonSubscriptionCredentialStore = class {
+  /**
+   * @param tokensPath  on-disk `tokens.json` location.
+   * @param box         at-rest `SecretBox` (encrypt-on-write / decrypt-on-read).
+   * @param fetchImpl   injectable HTTP port for the OAuth refresh round-trips
+   *                    (oauth design D4). Defaults to the global `fetch` so boot
+   *                    is unchanged; tests inject a mock fetch. NOT used by any
+   *                    read/write path — only by `refresh*Token`.
+   */
+  constructor(tokensPath, box, fetchImpl = (url, init) => fetch(url, init)) {
+    this.tokensPath = tokensPath;
+    this.box = box;
+    this.fetchImpl = fetchImpl;
+  }
+  tokensPath;
+  box;
+  fetchImpl;
+  /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
+   *  file is absent/corrupt). This is the hot read — the codex / gemini auth
+   *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
+  async getFullConfig() {
+    return this.readConfig();
+  }
+  /** Current Claude OAuth access token, or `null` when none is stored. No inline
+   *  refresh here — the lead-window / 401-retry refresh is driven by the
+   *  subscription auth strategy, which calls `refreshClaudeToken` (now real). */
+  async getValidClaudeAccessToken() {
+    return this.readConfig().claude?.accessToken ?? null;
+  }
+  /** Current OpenCodeGo static API key, or `null` when none is stored. */
+  async getValidOpenCodeGoApiKey() {
+    return this.readConfig().opencodego?.apiKey ?? null;
+  }
+  /**
+   * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
+   * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
+   * shape (id/label/status/expiresAt/hasAccessToken/isActive) — NEVER a token.
+   * Used by the admin accounts GET (secret-IN-never-OUT).
+   */
+  async listSanitizedAccounts() {
+    const config = this.readConfig();
+    const out = {};
+    for (const provider of ["claude", "codex", "gemini", "opencodego"]) {
+      const sanitized = sanitizeAccounts(config, provider);
+      if (sanitized.length > 0) out[provider] = sanitized;
+    }
+    return out;
+  }
+  /**
+   * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
+   * the block has no refresh_token (setup-token / manual) — no upstream call, the
+   * block is untouched. Otherwise mint via the shared claude refresh flow and
+   * write back access+refresh+expiresAt+status:authorized+lastRefreshedAt.
+   * On failure → status:expired +
+   * errorMessage → `false`.
+   */
+  async refreshClaudeToken() {
+    const config = this.readConfig();
+    const active = getActiveAccount(config, "claude");
+    const claude = active?.tokens;
+    if (!active || !claude?.refreshToken) return false;
+    const capturedId = active.id;
+    this.materializeMigration(config);
+    try {
+      const result = await import_subscriptions3.claudeOAuth.refreshAccessToken(claude.refreshToken, this.fetchImpl);
+      const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+      const next = {
+        ...claude,
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken,
+        expiresAt,
+        status: "authorized",
+        lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        errorMessage: void 0
+      };
+      this.writeBackById("claude", capturedId, next);
+      return true;
+    } catch (error) {
+      this.markExpiredById("claude", capturedId, claude, error);
+      return false;
+    }
+  }
+  /**
+   * Refresh the Codex (ChatGPT) OAuth access token. Same shape
+   * as claude, additionally writing back the refreshed `idToken`.
+   * HONEST `false` when no refresh_token.
+   */
+  async refreshCodexToken() {
+    const config = this.readConfig();
+    const active = getActiveAccount(config, "codex");
+    const codex = active?.tokens;
+    if (!active || !codex?.refreshToken) return false;
+    const capturedId = active.id;
+    this.materializeMigration(config);
+    try {
+      const result = await import_subscriptions3.codexOAuth.refreshAccessToken(codex.refreshToken, this.fetchImpl);
+      const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+      const next = {
+        ...codex,
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken,
+        idToken: result.idToken,
+        expiresAt,
+        status: "authorized",
+        lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        errorMessage: void 0
+      };
+      this.writeBackById("codex", capturedId, next);
+      return true;
+    } catch (error) {
+      this.markExpiredById("codex", capturedId, codex, error);
+      return false;
+    }
+  }
+  /**
+   * Refresh the Gemini (Google) OAuth access token. The Google
+   * refresh response does NOT return a refresh_token, so this writes ONLY
+   * access+expiresAt (+status/lastRefreshedAt) and DELIBERATELY leaves the
+   * existing `refreshToken` untouched (overwriting it with `undefined` would
+   * destroy the ability to refresh again). HONEST `false` when no refresh_token.
+   */
+  async refreshGeminiToken() {
+    const config = this.readConfig();
+    const active = getActiveAccount(config, "gemini");
+    const gemini = active?.tokens;
+    if (!active || !gemini?.refreshToken) return false;
+    const capturedId = active.id;
+    this.materializeMigration(config);
+    try {
+      const result = await import_subscriptions3.geminiOAuth.refreshAccessToken(gemini.refreshToken, this.fetchImpl);
+      const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+      const next = {
+        ...gemini,
+        // KEEP the existing refreshToken (response omits it).
+        accessToken: result.accessToken,
+        expiresAt,
+        status: "authorized",
+        lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        errorMessage: void 0
+      };
+      this.writeBackById("gemini", capturedId, next);
+      return true;
+    } catch (error) {
+      this.markExpiredById("gemini", capturedId, gemini, error);
+      return false;
+    }
+  }
+  /**
+   * Materialize a lazily-synthesized account id to disk (design D3). On a legacy
+   * single-slot file, `readConfig` synthesizes a NON-deterministic account id
+   * per read; without persisting it, the later write-back (which re-reads) would
+   * synthesize a DIFFERENT id and miss the captured account. Persisting the
+   * migrated config here makes the id durable so the write-back keys correctly.
+   * Idempotent: a config whose ids are already on disk re-persists byte-equal.
+   */
+  materializeMigration(migrated) {
+    this.persist(migrated);
+  }
+  /**
+   * Write refreshed tokens back to the captured account by id (oauth design D4),
+   * re-derive the mirror from the CURRENT active id, re-stamp + persist. A switch
+   * mid-refresh leaves the refreshed tokens in the captured (now non-active)
+   * account and keeps the CURRENT active account's tokens in the mirror.
+   */
+  writeBackById(providerId, capturedId, block) {
+    const config = this.readConfig();
+    writeBackRefreshById(config, providerId, capturedId, block);
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /**
+   * Mark the captured account `status:'expired'` + errorMessage on a refresh
+   * failure, keyed by id, then re-derive the mirror.
+   */
+  markExpiredById(providerId, capturedId, block, error) {
+    const errorMessage = error instanceof Error ? error.message : "Refresh failed";
+    this.writeBackById(providerId, capturedId, {
+      ...block,
+      status: "expired",
+      errorMessage
+    });
+  }
+  /**
+   * DAEMON-ONLY WRITE (design D1, NOT on the port). Read-merge the given
+   * provider's token block into the current `AccountTokensConfig`, stamp a fresh
+   * `updatedAt`, and re-persist `tokens.json` as pretty JSON. Preserves every
+   * OTHER provider's existing block (read-merge-write, not overwrite). Reuses the
+   * tolerate-on-read base (`{ updatedAt: '' }` when the file is absent/corrupt),
+   * so a first-ever write still produces a valid config. No cache → the next read
+   * sees this write.
+   */
+  async writeProviderTokens(providerId, config) {
+    const current = this.readConfig();
+    writeActiveTokens(current, providerId, config);
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /**
+   * DAEMON-ONLY login append (design D5, NOT on the port). Append a NEW account
+   * (optional label) and set it active, then re-derive the mirror — used by
+   * `omnicross login <provider> --label` to add an account instead of overwriting.
+   */
+  async appendProviderAccount(providerId, config, label) {
+    const current = this.readConfig();
+    const result = addAccount(current, providerId, config, label);
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY active switch (design D5, NOT on the port). Switch the active
+   * account for a provider; rejects an unknown id. Re-derives the mirror.
+   */
+  async setActiveAccount(providerId, id) {
+    const current = this.readConfig();
+    const result = setActiveAccount(current, providerId, id);
+    if (!result.ok) return result;
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY per-account remove (design D5, NOT on the port). Remove one
+   * account; promote the most-recent remaining on active-removal (or clear the
+   * mirror when none remain). Re-derives the mirror.
+   */
+  async removeAccount(providerId, id) {
+    const current = this.readConfig();
+    const result = removeAccount(current, providerId, id);
+    if (!result.removed) return result;
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY CLEAR (design D1/D3, NOT on the port). Remove a single provider's
+   * block from `tokens.json` and re-persist (the strategies already tolerate an
+   * absent block). Stamps a fresh `updatedAt`. A no-op-shaped write when the
+   * provider was already absent (still re-stamps + persists).
+   */
+  async clearProvider(providerId) {
+    const current = this.readConfig();
+    clearProvider(current, providerId);
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
+   *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
+   *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
+   *  write — incl. child 4's future refresh writes — lands encrypted. */
+  persist(config) {
+    (0, import_node_fs6.mkdirSync)((0, import_node_path3.dirname)(this.tokensPath), { recursive: true });
+    const encrypted = encryptTokens(config, this.box);
+    (0, import_node_fs6.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  }
+  /**
+   * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
+   * the token-material fields so every getter returns plaintext (the
+   * subscription bearer path is byte-identical).
+   *
+   * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
+   * file → empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
+   * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
+   * box's clear, secret-free error (secrets spec "错误密钥 / 篡改的解密失败 UX":
+   * SHALL fail-fast, SHALL NOT 静默降级 — a swallowed decrypt would report "no
+   * tokens" and silently send the WRONG bearer upstream → 401). Mirrors
+   * `config.ts loadConfig`, which decrypts outside its parse try.
+   */
+  readConfig() {
+    if (!(0, import_node_fs6.existsSync)(this.tokensPath)) return { updatedAt: "" };
+    let parsed;
+    try {
+      const raw = JSON.parse((0, import_node_fs6.readFileSync)(this.tokensPath, "utf8"));
+      parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+    } catch {
+      parsed = null;
+    }
+    if (!parsed) return { updatedAt: "" };
+    const decrypted = decryptTokens(parsed, this.box);
+    return migrateLazily(decrypted);
+  }
+};
+
+// src/bootstrap.ts
+function buildDaemon(config, paths) {
+  const logger = new ConsoleLogger();
+  const secretBox3 = new SecretBox(() => resolveMasterKey({ keyFilePath: paths.masterKeyFilePath }));
+  setSecretBox(secretBox3);
+  setSecretBox2(secretBox3);
+  const decryptedConfig = decryptConfigSecrets(config, secretBox3);
+  const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
+  const keyDb = new JsonOutboundKeyDb(paths.keysPath);
+  const settingsStore = new JsonApiServerSettingsStore(paths.configPath);
+  const credentialStore = new JsonSubscriptionCredentialStore(paths.tokensPath, secretBox3);
+  const subscriptionAccounts = new import_subscriptions4.SubscriptionAccountService(credentialStore);
+  (0, import_subscriptions4.setSubscriptionAccountService)(subscriptionAccounts);
+  const subscriptionRegistry = new import_subscriptions4.SubscriptionProviderRegistry(
+    subscriptionAccounts,
+    credentialStore
+  );
+  (0, import_subscriptions4.setSubscriptionProviderRegistry)(subscriptionRegistry);
+  (0, import_gemini_code_assist_resolver.setGeminiCodeAssistResolver)((0, import_GeminiCodeAssistProjectResolver.getGeminiCodeAssistProjectResolver)());
+  const autoDisableStore = new AutoDisableStore();
+  const apiKeyPool = new import_ApiKeyPoolService.ApiKeyPoolService(
+    createPoolKeysLoader((id) => llmConfig.getProviderRow(id), autoDisableStore),
+    resolveEnvKey,
+    logger,
+    async (keyId) => {
+      autoDisableStore.markAutoDisabled(keyId, 0, Date.now());
+      return true;
+    },
+    async (keyId, status, at) => {
+      autoDisableStore.markAutoDisabled(keyId, status, at);
+    }
+  );
+  const providerProxy = (0, import_provider_proxy.getProviderProxy)({ llmConfig, apiKeyPool });
+  llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
+  const outboundApiServer = (0, import_outbound_api4.getOutboundApiServer)({
+    db: keyDb,
+    llmConfig,
+    providerProxy,
+    proxyDeps: providerProxy.getDeps()
+  });
+  const adminServer = new AdminServer({
+    configPath: paths.configPath,
+    llmConfig,
+    keyDb,
+    settingsStore,
+    outboundApiServer,
+    subscriptionAccounts,
+    // Least-authority token WRITER (design D4) — the concrete credential store
+    // exposes `writeProviderTokens` / `clearProvider` as daemon-only methods (NOT
+    // on the `SubscriptionCredentialStore` port). The admin API sees ONLY these two
+    // mutators through the `SubscriptionTokenWriter` shape, never a token read.
+    subscriptionTokenWriter: credentialStore,
+    // Read-only pool-health view (key-pool design D7): the admin API reads
+    // `getKeyHealth` (cooldown) + the in-memory auto-disable store; the key
+    // values themselves NEVER leave (masked via `maskProviderApiKey`).
+    apiKeyPool,
+    autoDisableStore,
+    // Interactive OAuth login over admin HTTP (app-parity child 4, design
+    // D1/D2-a). The in-memory pending-session store (NEVER serialized), the
+    // injected token-exchange fetch (global `fetch` here; mocked in tests), and a
+    // NARROW `{ appendProviderAccount }` handle from the concrete credential store
+    // (NOT widening the least-authority writer — no token-returning read reachable).
+    oauthSessions: new OAuthSessionStore(),
+    // Real global fetch by default; a test seam (`paths.oauthExchangeFetch`) can
+    // inject a mock so no real token endpoint is hit.
+    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => fetch(url, init)),
+    subscriptionAccountAppender: credentialStore,
+    // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
+    // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
+    // the app polls the token-free status. A test seam (`paths.codexAwaitLoopback`)
+    // can inject a mock so no real port is bound.
+    codexSessions: new CodexOAuthSessionStore(),
+    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs) => awaitLoopbackCode(state, timeoutMs)),
+    // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
+    // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
+    // the multi-account append (`appendProviderAccount`, import re-encrypts at-
+    // rest). Confined to the export/import handlers; never reached by a GET.
+    migrationCredentialStore: credentialStore,
+    // Use the DECRYPTED config so `admin.token` (if stored as `enc:`) is the
+    // plaintext bearer the AdminServer's constant-time compare expects (D4).
+    getAdminConfig: () => resolveAdminConfig(decryptedConfig.admin)
+  });
+  return {
+    logger,
+    llmConfig,
+    keyDb,
+    settingsStore,
+    providerProxy,
+    outboundApiServer,
+    apiKeyPool,
+    autoDisableStore,
+    credentialStore,
+    subscriptionRegistry,
+    subscriptionAccounts,
+    adminServer
+  };
+}
+
+// src/commands/launch.ts
+var SUPPORTED_LAUNCH_CLIS = [
+  "claude",
+  "codex",
+  "gemini",
+  "qwen",
+  "copilot",
+  "opencode"
+];
+var CMD_UNSAFE_RE = /[&|<>^"%]/;
+function buildCliSpawnPlan(opts) {
+  const { platform, cliName, cliArgs } = opts;
+  if (platform !== "win32") {
+    return { command: cliName, args: cliArgs, viaCmdShim: false };
+  }
+  const probe = opts.resolveInPath ?? resolveInPathDefault;
+  const exe = probe(`${cliName}.exe`);
+  if (exe) {
+    return { command: exe, args: cliArgs, viaCmdShim: false };
+  }
+  const cmdShim = probe(`${cliName}.cmd`);
+  if (!cmdShim) {
+    return { command: cliName, args: cliArgs, viaCmdShim: false };
+  }
+  const unsafe = [cmdShim, ...cliArgs].filter((a) => CMD_UNSAFE_RE.test(a));
+  if (unsafe.length > 0) {
+    throw new Error(
+      `launch: "${cliName}" resolves to an npm .cmd shim, which must run through cmd.exe \u2014 but ${unsafe.length} argument(s) contain quote/metacharacters (${unsafe[0]}). Refusing to pass them through cmd.exe (it would parse them before the CLI runs). Install the native ${cliName} executable (.exe on PATH) or drop the offending arguments.`
+    );
+  }
+  const payload = [cmdShim, ...cliArgs].map((a) => `"${a}"`).join(" ");
+  return {
+    command: opts.comSpec ?? process.env["ComSpec"] ?? "cmd.exe",
+    args: ["/d", "/s", "/c", `"${payload}"`],
+    viaCmdShim: true
+  };
+}
+function resolveInPathDefault(candidate) {
+  const segments = (process.env["PATH"] ?? "").split(import_node_path4.delimiter).filter(Boolean);
+  for (const seg of segments) {
+    const full = (0, import_node_path4.join)(seg, candidate);
+    if ((0, import_node_fs7.existsSync)(full)) return full;
+  }
+  return null;
+}
+async function runLaunch(argv, deps) {
+  const sep = argv.indexOf("--");
+  const own = sep === -1 ? argv : argv.slice(0, sep);
+  const passthrough = sep === -1 ? [] : argv.slice(sep + 1);
+  const { values, positionals } = (0, import_node_util3.parseArgs)({
+    args: own,
+    options: {
+      provider: { type: "string", short: "p" },
+      model: { type: "string", short: "m" },
+      config: { type: "string", short: "c" },
+      cwd: { type: "string" },
+      "master-key-file": { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const cliName = positionals[0];
+  if (!cliName || !SUPPORTED_LAUNCH_CLIS.includes(cliName)) {
+    throw new Error(
+      `launch: a supported <cli> is required \u2014 one of: ${SUPPORTED_LAUNCH_CLIS.join(", ")}` + (cliName ? ` (got "${cliName}")` : "")
+    );
+  }
+  const cli = cliName;
+  if (!values.provider) throw new Error("launch: --provider <id> is required");
+  if (!values.model) throw new Error("launch: --model <model> is required");
+  if (!values.config) throw new Error("launch: --config <path> is required");
+  const config = loadConfig(values.config);
+  const paths = {
+    configPath: values.config,
+    keysPath: defaultKeysPath(values.config),
+    tokensPath: defaultTokensPath(values.config),
+    masterKeyFilePath: values["master-key-file"]
+  };
+  const daemon = buildDaemon(config, paths);
+  try {
+    await daemon.llmConfig.ready();
+    await daemon.providerProxy.start();
+  } catch (err4) {
+    daemon.apiKeyPool.dispose();
+    throw err4;
+  }
+  let launch;
+  try {
+    launch = await buildLaunchConfig(cli, daemon.llmConfig, {
+      providerId: values.provider,
+      model: values.model
+    });
+  } catch (err4) {
+    await daemon.providerProxy.stop();
+    daemon.apiKeyPool.dispose();
+    throw err4;
+  }
+  try {
+    const plan = buildCliSpawnPlan({
+      platform: process.platform,
+      cliName: cli,
+      cliArgs: [...launch.extraArgs ?? [], ...passthrough],
+      resolveInPath: deps?.resolveInPath
+    });
+    console.info(`launching ${cli} via omnicross proxy ${launch.baseUrl}`);
+    console.info(`  provider: ${values.provider}  model: ${values.model}`);
+    const spawnCli = deps?.spawnCli ?? spawnCliInherit;
+    return await spawnCli({
+      ...plan,
+      env: { ...process.env, ...launch.env },
+      cwd: values.cwd
+    });
+  } finally {
+    launch.onSessionEnd();
+    await daemon.providerProxy.stop();
+    daemon.apiKeyPool.dispose();
+  }
+}
+async function buildLaunchConfig(cli, llmConfig, opts) {
+  const common = {
+    llmConfig,
+    providerId: opts.providerId,
+    model: opts.model,
+    // Stable, bounded session id — pool failover (poolseam) fires on launch
+    // traffic with one binding per CLI flavor.
+    sessionId: `launch:${cli}`
+  };
+  switch (cli) {
+    case "claude":
+      return (0, import_cli_launcher.buildClaudeCliLaunchConfig)(common);
+    case "codex":
+      return (0, import_cli_launcher.buildCodexLaunchConfig)(common);
+    case "gemini":
+      return (0, import_cli_launcher.buildGeminiCliLaunchConfig)(common);
+    case "qwen":
+    case "copilot":
+    case "opencode":
+      return (0, import_cli_launcher.buildChatCliLaunchConfig)({ backendId: cli, ...common });
+    default: {
+      const _exhaustive = cli;
+      throw new Error(`Unsupported launch CLI: ${String(_exhaustive)}`);
+    }
+  }
+}
+function spawnCliInherit(plan) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)(plan.command, plan.args, {
+      stdio: "inherit",
+      env: plan.env,
+      cwd: plan.cwd,
+      // Only the cmd.exe fallback needs verbatim args (we pre-quoted them).
+      windowsVerbatimArguments: plan.viaCmdShim || void 0
+    });
+    const onSignal = (sig) => {
+      try {
+        child.kill(sig);
+      } catch {
+      }
+    };
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+    const detach = () => {
+      process.removeListener("SIGINT", onSignal);
+      process.removeListener("SIGTERM", onSignal);
+    };
+    child.on("error", (err4) => {
+      detach();
+      if (err4.code === "ENOENT") {
+        reject(
+          new Error(
+            `launch: "${plan.command}" not found on PATH \u2014 install the CLI first.`
+          )
+        );
+        return;
+      }
+      reject(err4);
+    });
+    child.on("exit", (code, signal) => {
+      detach();
+      resolve(code ?? (signal ? 1 : 0));
+    });
+  });
+}
+
+// src/commands/login.ts
+var import_node_child_process2 = require("child_process");
+var import_node_readline = require("readline");
+var import_node_util4 = require("util");
+var import_subscriptions5 = require("@omnicross/subscriptions");
+var PROVIDERS = ["claude", "codex", "gemini"];
+async function runLogin(argv, deps) {
+  const { values, positionals } = (0, import_node_util4.parseArgs)({
+    args: argv,
+    options: {
+      config: { type: "string", short: "c" },
+      "master-key-file": { type: "string" },
+      // Optional user label for the appended account (multi-account).
+      label: { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const provider = positionals[0];
+  if (!provider) {
+    throw new Error(`login: a <provider> is required (one of ${PROVIDERS.join("|")})`);
+  }
+  if (!isLoginProvider(provider)) {
+    throw new Error(`login: unknown provider '${provider}' (expected ${PROVIDERS.join("|")})`);
+  }
+  if (!values.config) {
+    throw new Error("login: --config <path> is required");
+  }
+  const resolved = {
+    openBrowser: deps?.openBrowser ?? openBrowser,
+    promptPaste: deps?.promptPaste ?? promptPaste,
+    awaitLoopback: deps?.awaitLoopback ?? ((state) => awaitLoopbackCode(state)),
+    tokensFetch: deps?.tokensFetch
+  };
+  const box = resolveSecretBox(values["master-key-file"]);
+  setSecretBox(box);
+  try {
+    const tokensPath = defaultTokensPath(values.config);
+    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => fetch(url, init));
+    const store = new JsonSubscriptionCredentialStore(tokensPath, box, exchangeFetch);
+    const expiresAt = await runProviderLogin(
+      provider,
+      store,
+      resolved,
+      exchangeFetch,
+      values.label
+    );
+    console.info(`Logged in to '${provider}' \u2192 ${tokensPath}`);
+    console.info(`  token: [stored, encrypted]   expiresAt: ${expiresAt ?? "n/a"}`);
+  } finally {
+    setSecretBox(null);
+  }
+}
+async function runProviderLogin(provider, store, deps, exchangeFetch, label) {
+  if (provider === "codex") return loginCodex(store, deps, exchangeFetch, label);
+  if (provider === "claude") return loginClaude(store, deps, exchangeFetch, label);
+  return loginGemini(store, deps, exchangeFetch, label);
+}
+async function loginCodex(store, deps, exchangeFetch, label) {
+  const { authUrl, codeVerifier, state } = import_subscriptions5.codexOAuth.generateAuthParams();
+  await presentUrl(authUrl, deps);
+  const code = await deps.awaitLoopback(state);
+  const result = await import_subscriptions5.codexOAuth.exchangeCodeForTokens(
+    { authorizationCode: code, codeVerifier, state },
+    exchangeFetch
+  );
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    idToken: result.idToken,
+    expiresAt,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await store.appendProviderAccount("codex", block, label);
+  logMasked("codex", result.accessToken);
+  return expiresAt;
+}
+async function loginClaude(store, deps, exchangeFetch, label) {
+  const { authUrl, codeVerifier, state } = import_subscriptions5.claudeOAuth.generateAuthParams();
+  await presentUrl(authUrl, deps);
+  const pasted = (await deps.promptPaste("Paste the authorization code (code#state): ")).trim();
+  const [code, pastedState] = pasted.split("#");
+  if (!code) throw new Error("login: no authorization code was pasted");
+  if (pastedState && pastedState !== state) {
+    throw new Error("login: pasted state did not match (possible CSRF) \u2014 aborting");
+  }
+  const result = await import_subscriptions5.claudeOAuth.exchangeCodeForTokens(
+    { authorizationCode: code, codeVerifier, state },
+    exchangeFetch
+  );
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt,
+    scopes: result.scopes,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await store.appendProviderAccount("claude", block, label);
+  logMasked("claude", result.accessToken);
+  return expiresAt;
+}
+async function loginGemini(store, deps, exchangeFetch, label) {
+  const { authUrl, codeVerifier } = import_subscriptions5.geminiOAuth.generateAuthParams();
+  await presentUrl(authUrl, deps);
+  const code = (await deps.promptPaste("Paste the authorization code: ")).trim();
+  if (!code) throw new Error("login: no authorization code was pasted");
+  const result = await import_subscriptions5.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await store.appendProviderAccount("gemini", block, label);
+  logMasked("gemini", result.accessToken);
+  return expiresAt;
+}
+function isLoginProvider(value) {
+  return PROVIDERS.includes(value);
+}
+async function presentUrl(authUrl, deps) {
+  console.info("Open this URL in your browser to authorize:");
+  console.info(`  ${authUrl}`);
+  const launched = await deps.openBrowser(authUrl).catch(() => false);
+  if (!launched) {
+    console.info("(Could not open a browser automatically \u2014 open the URL above manually.)");
+  }
+}
+function logMasked(provider, accessToken) {
+  console.info(`  ${provider} access token: ${maskProviderApiKey(accessToken)}`);
+}
+function buildOpenBrowserCommand(platform, url) {
+  if (platform === "win32") {
+    return { command: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+  }
+  if (platform === "darwin") {
+    return { command: "open", args: [url] };
+  }
+  return { command: "xdg-open", args: [url] };
+}
+function openBrowser(url) {
+  return new Promise((resolve) => {
+    try {
+      const { command, args } = buildOpenBrowserCommand(process.platform, url);
+      const child = (0, import_node_child_process2.spawn)(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve(false));
+      child.unref();
+      resolve(true);
+    } catch {
+      resolve(false);
+    }
+  });
+}
+function promptPaste(prompt) {
+  const rl = (0, import_node_readline.createInterface)({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+
+// src/commands/providers.ts
+var import_node_crypto8 = require("crypto");
+var import_node_util5 = require("util");
+async function runProviders(argv) {
+  const { values, positionals } = (0, import_node_util5.parseArgs)({
+    args: argv,
+    options: {
+      config: { type: "string", short: "c" },
+      key: { type: "string" },
+      id: { type: "string" },
+      "base-url": { type: "string", short: "b" },
+      label: { type: "string" },
+      weight: { type: "string" },
+      "master-key-file": { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const configPath = values.config;
+  if (!configPath) {
+    throw new Error("providers: --config <path> is required");
+  }
+  const action = positionals[0];
+  if (action === "presets") return providersPresets();
+  setSecretBox(resolveSecretBox(values["master-key-file"]));
+  try {
+    switch (action) {
+      case "add":
+        return providersAdd(configPath, positionals[1], {
+          key: values.key,
+          id: values.id,
+          baseUrl: values["base-url"]
+        });
+      case "keys":
+        return providersKeys(configPath, positionals[1]);
+      case "add-key":
+        return providersAddKey(configPath, positionals[1], {
+          key: values.key,
+          label: values.label,
+          weight: values.weight
+        });
+      case "rm-key":
+        return providersRmKey(configPath, positionals[1], positionals[2]);
+      default:
+        throw new Error(
+          `providers: unknown action '${action ?? ""}' (expected presets|add|keys|add-key|rm-key)`
+        );
+    }
+  } finally {
+    setSecretBox(null);
+  }
+}
+function providersPresets() {
+  const { mappable, excluded } = listMappablePresets();
+  console.info(`Mappable presets (${mappable.length}):`);
+  for (const p of mappable) {
+    console.info(`  ${p.id}  ${p.apiFormat}  ${p.baseUrl}  models=${p.models.length}`);
+  }
+  if (excluded.length > 0) {
+    console.info("");
+    console.info(`Excluded (${excluded.length}):`);
+    for (const e of excluded) {
+      console.info(`  ${e.id}  EXCLUDED  ${e.reason}`);
+    }
+  }
+}
+function providersAdd(configPath, presetId, opts) {
+  if (!presetId) {
+    throw new Error("providers add: a <presetId> is required");
+  }
+  const preset = getPresetById(presetId);
+  if (!preset) {
+    const ids = listMappablePresets().mappable.map((p) => p.id).join(", ");
+    throw new Error(`providers add: unknown preset '${presetId}'. Available: ${ids}`);
+  }
+  if (!opts.key) {
+    throw new Error(`providers add: --key <key|$ENV_VAR> is required (preset '${presetId}' carries no key)`);
+  }
+  const result = mapPresetToProvider(preset, {
+    key: opts.key,
+    id: opts.id,
+    baseUrlOverride: opts.baseUrl
+  });
+  if ("excluded" in result) {
+    throw new Error(`providers add: preset '${presetId}' cannot be mapped \u2014 ${result.excluded.reason}`);
+  }
+  if ("missingKey" in result) {
+    throw new Error(`providers add: --key <key|$ENV_VAR> is required`);
+  }
+  const { provider } = result;
+  const cfg = loadConfig(configPath);
+  if (cfg.providers.some((p) => p.id === provider.id)) {
+    throw new Error(`providers add: a provider with id '${provider.id}' already exists in ${configPath}`);
+  }
+  cfg.providers.push(provider);
+  saveConfig(configPath, cfg);
+  console.info(`Added provider '${provider.id}' (${provider.apiFormat}) \u2192 ${configPath}`);
+  console.info(`  baseUrl: ${provider.baseUrl}`);
+  console.info(`  models:  ${(provider.models ?? []).length}`);
+}
+function effectivePool(row) {
+  if (row.apiKeys && row.apiKeys.length > 0) return row.apiKeys;
+  if (row.apiKey.length > 0) return [{ id: `${row.id}:default`, apiKey: row.apiKey, weight: 1, enabled: true }];
+  return [];
+}
+function providersKeys(configPath, providerId) {
+  if (!providerId) throw new Error("providers keys: a <providerId> is required");
+  const cfg = loadConfig(configPath);
+  const row = cfg.providers.find((p) => p.id === providerId);
+  if (!row) throw new Error(`providers keys: unknown provider '${providerId}'`);
+  const pool = effectivePool(row);
+  console.info(`Pool for '${providerId}' (${pool.length} key${pool.length === 1 ? "" : "s"}):`);
+  for (const k of pool) {
+    const enabled = k.enabled !== false ? "enabled" : "disabled";
+    const weight = typeof k.weight === "number" ? k.weight : 1;
+    console.info(`  ${k.id}  ${k.label ?? k.id}  ${maskProviderApiKey(k.apiKey)}  ${enabled}  weight=${weight}`);
+  }
+}
+function providersAddKey(configPath, providerId, opts) {
+  if (!providerId) throw new Error("providers add-key: a <providerId> is required");
+  if (!opts.key) throw new Error("providers add-key: --key <key|$ENV_VAR> is required");
+  const cfg = loadConfig(configPath);
+  const row = cfg.providers.find((p) => p.id === providerId);
+  if (!row) throw new Error(`providers add-key: unknown provider '${providerId}'`);
+  const entry = { id: (0, import_node_crypto8.randomUUID)(), apiKey: opts.key };
+  if (opts.label) entry.label = opts.label;
+  if (opts.weight !== void 0) {
+    const w = Number(opts.weight);
+    if (!Number.isFinite(w)) throw new Error("providers add-key: --weight must be a number");
+    entry.weight = w;
+  }
+  row.apiKeys = [...row.apiKeys ?? [], entry];
+  saveConfig(configPath, cfg);
+  console.info(`Added pool key '${entry.id}' to provider '${providerId}' \u2192 ${configPath} (not hot-reloaded)`);
+}
+function providersRmKey(configPath, providerId, keyId) {
+  if (!providerId) throw new Error("providers rm-key: a <providerId> is required");
+  if (!keyId) throw new Error("providers rm-key: a <keyId> is required");
+  const cfg = loadConfig(configPath);
+  const row = cfg.providers.find((p) => p.id === providerId);
+  if (!row) throw new Error(`providers rm-key: unknown provider '${providerId}'`);
+  const before = row.apiKeys ?? [];
+  const after = before.filter((k) => k.id !== keyId);
+  if (after.length === before.length) {
+    throw new Error(`providers rm-key: provider '${providerId}' has no pool key '${keyId}'`);
+  }
+  row.apiKeys = after.length > 0 ? after : void 0;
+  saveConfig(configPath, cfg);
+  console.info(`Removed pool key '${keyId}' from provider '${providerId}' \u2192 ${configPath} (not hot-reloaded)`);
+}
+
+// src/commands/secrets.ts
+var import_node_fs8 = require("fs");
+var import_node_util6 = require("util");
+async function runSecrets(argv) {
+  const { values, positionals } = (0, import_node_util6.parseArgs)({
+    args: argv,
+    options: {
+      config: { type: "string", short: "c" },
+      "master-key-file": { type: "string" },
+      "new-master-key-file": { type: "string" },
+      force: { type: "boolean" }
+    },
+    allowPositionals: true
+  });
+  const args = {
+    config: values.config,
+    masterKeyFile: values["master-key-file"],
+    newMasterKeyFile: values["new-master-key-file"],
+    force: values.force === true
+  };
+  if (!args.config) {
+    throw new Error("secrets: --config <path> is required");
+  }
+  const action = positionals[0];
+  switch (action) {
+    case "encrypt":
+      return secretsEncrypt(args);
+    case "status":
+      return secretsStatus(args);
+    case "rotate":
+      return secretsRotate(args);
+    case "decrypt":
+      return secretsDecrypt(args);
+    default:
+      throw new Error(
+        `secrets: unknown action '${action ?? ""}' (expected encrypt|status|rotate)`
+      );
+  }
+}
+function secretsEncrypt(args) {
+  const box = resolveSecretBox(args.masterKeyFile);
+  setSecretBox(box);
+  try {
+    const cfg = loadConfig(args.config);
+    saveConfig(args.config, cfg);
+    encryptTokensFileInPlace(args.config, box);
+  } finally {
+    setSecretBox(null);
+  }
+  console.info(`Encrypted secrets in ${args.config}` + tokensSuffix(args.config));
+}
+function classify(raw) {
+  if (raw.startsWith("$")) return "env-ref";
+  if (isEnvelope(raw)) return "encrypted";
+  return "plaintext";
+}
+function safeDisplay(raw, cls) {
+  if (cls === "encrypted") return "[encrypted]";
+  return maskProviderApiKey(raw);
+}
+function secretsStatus(args) {
+  const cfg = readRawConfig(args.config);
+  console.info(`Secret status for ${args.config}:`);
+  for (const p of cfg.providers) {
+    reportField(`provider '${p.id}'.apiKey`, p.apiKey);
+    for (const k of p.apiKeys ?? []) {
+      reportField(`provider '${p.id}'.apiKeys['${k.id}']`, k.apiKey);
+    }
+  }
+  if (cfg.admin && typeof cfg.admin.token === "string" && cfg.admin.token.length > 0) {
+    reportField("admin.token", cfg.admin.token);
+  }
+  const tokensPath = defaultTokensPath(args.config);
+  if ((0, import_node_fs8.existsSync)(tokensPath)) {
+    console.info(`Secret status for ${tokensPath}:`);
+    reportTokenFields(tokensPath);
+  }
+}
+function reportField(name, raw) {
+  const cls = classify(raw);
+  console.info(`  ${name}: ${cls}  ${safeDisplay(raw, cls)}`);
+}
+function reportTokenFields(tokensPath) {
+  const parsed = readRawJson(tokensPath);
+  const blocks = {
+    claude: ["accessToken", "refreshToken"],
+    codex: ["accessToken", "refreshToken", "idToken"],
+    gemini: ["accessToken", "refreshToken"],
+    opencodego: ["apiKey"]
+  };
+  for (const [provider, fields] of Object.entries(blocks)) {
+    const block = parsed[provider];
+    if (!block || typeof block !== "object" || Array.isArray(block)) continue;
+    for (const field of fields) {
+      const value = block[field];
+      if (typeof value === "string" && value.length > 0) {
+        reportField(`${provider}.${field}`, value);
+      }
+    }
+  }
+}
+function secretsRotate(args) {
+  if (!args.newMasterKeyFile) {
+    throw new Error("secrets rotate: --new-master-key-file <path> is required");
+  }
+  const oldBox = resolveSecretBox(args.masterKeyFile);
+  const newBox = resolveSecretBox(args.newMasterKeyFile);
+  setSecretBox(oldBox);
+  let cfg;
+  let tokensPlain = null;
+  const tokensPath = defaultTokensPath(args.config);
+  try {
+    cfg = loadConfig(args.config);
+    if ((0, import_node_fs8.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
+  } finally {
+    setSecretBox(null);
+  }
+  setSecretBox(newBox);
+  try {
+    saveConfig(args.config, cfg);
+    if (tokensPlain) writeTokensEncrypted(tokensPath, tokensPlain, newBox);
+  } finally {
+    setSecretBox(null);
+  }
+  console.info(`Rotated master key for ${args.config}` + tokensSuffix(args.config));
+}
+function secretsDecrypt(args) {
+  if (!args.force) {
+    throw new Error(
+      "secrets decrypt: refusing without --force (this writes plaintext secrets to disk)"
+    );
+  }
+  console.error(
+    "WARNING: secrets decrypt --force writes ALL secrets back to PLAINTEXT on disk. Only use this to roll back to an older daemon. The file will no longer be encrypted."
+  );
+  const box = resolveSecretBox(args.masterKeyFile);
+  const tokensPath = defaultTokensPath(args.config);
+  setSecretBox(box);
+  let cfg;
+  let tokensPlain = null;
+  try {
+    cfg = loadConfig(args.config);
+    if ((0, import_node_fs8.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
+  } finally {
+    setSecretBox(null);
+  }
+  saveConfig(args.config, cfg);
+  if (tokensPlain) {
+    (0, import_node_fs8.writeFileSync)(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
+  }
+  console.info(`Decrypted secrets to plaintext in ${args.config}` + tokensSuffix(args.config));
+}
+function readRawConfig(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
+  } catch {
+    throw new Error(`secrets: cannot read or parse '${path}'`);
+  }
+  return validateConfig(parsed);
+}
+function readRawJson(path) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
+function encryptTokensFileInPlace(configPath, box) {
+  const tokensPath = defaultTokensPath(configPath);
+  if (!(0, import_node_fs8.existsSync)(tokensPath)) return;
+  const plain = decryptTokensFile(tokensPath, box);
+  writeTokensEncrypted(tokensPath, plain, box);
+}
+function decryptTokensFile(tokensPath, box) {
+  const raw = readRawJson(tokensPath);
+  return walkTokens(raw, (v) => box.decryptMaybe(v));
+}
+function writeTokensEncrypted(tokensPath, plain, box) {
+  const encrypted = encryptTokens(
+    { updatedAt: "", ...plain },
+    box
+  );
+  (0, import_node_fs8.writeFileSync)(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+}
+var TOKEN_FIELDS2 = {
+  claude: ["accessToken", "refreshToken"],
+  codex: ["accessToken", "refreshToken", "idToken"],
+  gemini: ["accessToken", "refreshToken"],
+  opencodego: ["apiKey"]
+};
+function walkTokens(raw, fn) {
+  const next = { ...raw };
+  for (const [provider, fields] of Object.entries(TOKEN_FIELDS2)) {
+    const block = next[provider];
+    if (!block || typeof block !== "object" || Array.isArray(block)) continue;
+    const nextBlock = { ...block };
+    for (const field of fields) {
+      const value = nextBlock[field];
+      if (typeof value === "string" && value.length > 0) nextBlock[field] = fn(value);
+    }
+    next[provider] = nextBlock;
+  }
+  return next;
+}
+function tokensSuffix(configPath) {
+  return (0, import_node_fs8.existsSync)(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
+}
+
+// src/commands/start.ts
+var import_node_util7 = require("util");
+var import_outbound_api5 = require("@omnicross/core/outbound-api");
+async function runStart(argv) {
+  const { values } = (0, import_node_util7.parseArgs)({
+    args: argv,
+    options: {
+      config: { type: "string", short: "c" },
+      "no-dashboard": { type: "boolean" },
+      "master-key-file": { type: "string" }
+    },
+    allowPositionals: false
+  });
+  const configPath = values.config;
+  if (!configPath) {
+    throw new Error("start: --config <path> is required");
+  }
+  const config = loadConfig(configPath);
+  const paths = {
+    configPath,
+    keysPath: defaultKeysPath(configPath),
+    tokensPath: defaultTokensPath(configPath),
+    masterKeyFilePath: values["master-key-file"]
+  };
+  const daemon = buildDaemon(config, paths);
+  await daemon.llmConfig.ready();
+  await daemon.providerProxy.start();
+  const serverConfig = await (0, import_outbound_api5.loadServerConfig)(daemon.settingsStore);
+  await daemon.outboundApiServer.applyConfig({
+    enabled: true,
+    networkBinding: serverConfig.networkBinding,
+    endpoints: serverConfig.endpoints,
+    port: serverConfig.port
+  });
+  let dashboardUrl = null;
+  if (!values["no-dashboard"]) {
+    await daemon.adminServer.start();
+    dashboardUrl = daemon.adminServer.getStatus().url;
+  }
+  const status = daemon.outboundApiServer.getStatus();
+  console.info("omnicross daemon is running.");
+  if (dashboardUrl) console.info(`  dashboard : ${dashboardUrl}`);
+  console.info(`  loopback : ${status.loopbackUrl ?? "(not bound)"}`);
+  if (status.lanUrl) console.info(`  lan      : ${status.lanUrl}`);
+  if (status.formats) {
+    console.info("  endpoints:");
+    console.info(`    chat      ${status.formats.chat}`);
+    console.info(`    responses ${status.formats.responses}`);
+    console.info(`    gemini    ${status.formats.gemini}`);
+    console.info(`    messages  ${status.formats.messages}`);
+  }
+  console.info("  responses subscription routing: enabled (drop tokens.json + useSubscription:true)");
+  console.info("  (deferred: /v1/messages subscription, Gemini paid Code-Assist tier)");
+  if (dashboardUrl) {
+    console.info("  dashboard: localhost-default; --no-dashboard to disable; admin.token for a bearer gate");
+  }
+  console.info("Press Ctrl+C to stop.");
+}
+
+// src/cli.ts
+var USAGE = `omnicross \u2014 standalone @omnicross/core daemon
+
+Usage:
+  omnicross start --config <path>          Boot the daemon (BYO-key serving).
+  omnicross keys add <name> --config <p>   Mint a named API key (shown once).
+  omnicross keys list --config <p>         List stored keys (no secrets).
+  omnicross keys revoke <id> --config <p>  Revoke a key.
+  omnicross providers presets --config <p>      List curated presets (mappable + excluded).
+  omnicross providers add <presetId> --key <k|$ENV> --config <p> [--id <id>] [--base-url <url>]
+                                           Add a provider row from a preset (+ your key).
+  omnicross providers keys <providerId> --config <p>            List a provider's key pool (masked).
+  omnicross providers add-key <providerId> --key <k|$ENV> --config <p> [--label <l>] [--weight <n>]
+                                           Append a pool key (offline; not hot-reloaded).
+  omnicross providers rm-key <providerId> <keyId> --config <p>  Remove a pool key (offline).
+  omnicross login <provider> --config <p>  Browser OAuth login (claude|codex|gemini); stores tokens encrypted.
+  omnicross launch <cli> --provider <id> --model <m> --config <p> [--cwd <dir>] [-- <cli-args\u2026>]
+                                           Launch a Code CLI (claude|codex|gemini|qwen|copilot|opencode)
+                                           against an in-process proxy (route-token auth; BYO).
+  omnicross import-ccr <ccr.json> [--out <p>]  Translate a CCR config.
+  omnicross secrets encrypt --config <p>   Encrypt all at-rest secrets in place.
+  omnicross secrets status --config <p>    Report each secret field (no values shown).
+  omnicross secrets rotate --config <p> --new-master-key-file <p>  Re-seal under a new master key.
+`;
+async function main() {
+  const [, , subcommand, ...rest] = process.argv;
+  switch (subcommand) {
+    case "start":
+      await runStart(rest);
+      return;
+    case "keys":
+      await runKeys(rest);
+      return;
+    case "providers":
+      await runProviders(rest);
+      return;
+    case "login":
+      await runLogin(rest);
+      return;
+    case "launch":
+      process.exitCode = await runLaunch(rest);
+      return;
+    case "import-ccr":
+      await runImportCcr(rest);
+      return;
+    case "secrets":
+      await runSecrets(rest);
+      return;
+    case void 0:
+    case "-h":
+    case "--help":
+    case "help":
+      console.info(USAGE);
+      return;
+    default:
+      console.error(`Unknown command: ${subcommand}
+`);
+      console.error(USAGE);
+      process.exitCode = 1;
+  }
+}
+main().catch((err4) => {
+  console.error(err4 instanceof Error ? err4.message : String(err4));
+  process.exitCode = 1;
+});