@omnicross/daemon 0.1.4 → 0.1.5

package/dist/cli.cjs

@@ -934,7 +934,7 @@ async function keysRevoke(db, id) {
 // src/commands/launch.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs21 = require("fs");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 var import_node_util3 = require("util");
 var import_cli_launcher2 = require("@omnicross/cli-launcher");
 
@@ -2213,12 +2213,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+var import_node_path4 = require("path");
 var import_auditSink = require("@omnicross/core/pipeline/auditSink");
+var import_upstreamTrace = require("@omnicross/core/pipeline/upstreamTrace");
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -2230,9 +2234,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    (0, import_upstreamTrace.setUpstreamTracePath)(config.captureBodies ? (0, import_node_path4.join)(auditDir, "upstream-trace.jsonl") : null);
   } else {
     (0, import_auditSink.setAuditCaptureConfig)(null);
     (0, import_auditSink.setAuditSink)(null);
+    (0, import_upstreamTrace.setUpstreamTracePath)(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -4096,7 +4102,7 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 var import_node_fs6 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_module = require("module");
-var import_node_path4 = __toESM(require("path"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 var import_meta = {};
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -4117,13 +4123,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return (0, import_node_fs6.existsSync)(import_node_path4.default.join(fromEnv, "index.html")) ? import_node_path4.default.resolve(fromEnv) : null;
+    return (0, import_node_fs6.existsSync)(import_node_path5.default.join(fromEnv, "index.html")) ? import_node_path5.default.resolve(fromEnv) : null;
   }
   try {
     const req = (0, import_node_module.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
-    const dist = import_node_path4.default.join(import_node_path4.default.dirname(pkgJson), "dist");
-    return (0, import_node_fs6.existsSync)(import_node_path4.default.join(dist, "index.html")) ? dist : null;
+    const dist = import_node_path5.default.join(import_node_path5.default.dirname(pkgJson), "dist");
+    return (0, import_node_fs6.existsSync)(import_node_path5.default.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -4165,16 +4171,16 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
     return true;
   }
-  const filePath = import_node_path4.default.resolve(uiDist, rel === "" ? "index.html" : rel);
-  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path4.default.sep)) {
+  const filePath = import_node_path5.default.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path5.default.sep)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
     return true;
   }
   let target = filePath;
   if (!(0, import_node_fs6.existsSync)(target) || (0, import_node_fs6.statSync)(target).isDirectory()) {
-    if (import_node_path4.default.extname(rel) === "") {
-      target = import_node_path4.default.join(uiDist, "index.html");
+    if (import_node_path5.default.extname(rel) === "") {
+      target = import_node_path5.default.join(uiDist, "index.html");
     } else {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
@@ -4182,14 +4188,14 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     }
   }
   const body = await (0, import_promises.readFile)(target);
-  const type = CONTENT_TYPES[import_node_path4.default.extname(target).toLowerCase()] ?? "application/octet-stream";
+  const type = CONTENT_TYPES[import_node_path5.default.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
   return true;
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -5442,7 +5448,7 @@ var JsonVoucherDb = class {
 
 // src/ports/JsonSubscriptionCredentialStore.ts
 var import_node_fs14 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
@@ -5524,9 +5530,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 var import_node_fs12 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 function externalStorePath(provider, home = (0, import_node_os2.homedir)()) {
-  return provider === "claude" ? (0, import_node_path5.join)(home, ".claude", ".credentials.json") : (0, import_node_path5.join)(home, ".codex", "auth.json");
+  return provider === "claude" ? (0, import_node_path6.join)(home, ".claude", ".credentials.json") : (0, import_node_path6.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -5589,7 +5595,7 @@ function readExternalCliCredentials(provider, home = (0, import_node_os2.homedir
 // src/ports/external-cli-store.ts
 var import_node_fs13 = require("fs");
 var import_node_os3 = require("os");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function markerPath(provider, home) {
   return `${externalStorePath(provider, home)}.omnicross-managed`;
 }
@@ -5624,7 +5630,7 @@ function readExistingObject(path2) {
   }
 }
 function writeAtomic(path2, content) {
-  (0, import_node_fs13.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path7.dirname)(path2), { recursive: true });
   const temp = `${path2}.omnicross-tmp`;
   (0, import_node_fs13.writeFileSync)(temp, content, "utf8");
   (0, import_node_fs13.renameSync)(temp, path2);
@@ -6295,7 +6301,7 @@ var JsonSubscriptionCredentialStore = class {
    *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
    *  write — incl. child 4's future refresh writes — lands encrypted. */
   persist(config) {
-    (0, import_node_fs14.mkdirSync)((0, import_node_path7.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs14.mkdirSync)((0, import_node_path8.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
     (0, import_node_fs14.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
@@ -6645,7 +6651,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 var import_node_fs15 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6671,8 +6677,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6728,7 +6734,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          (0, import_node_fs15.unlinkSync)((0, import_node_path8.join)(this.auditDir, file));
+          (0, import_node_fs15.unlinkSync)((0, import_node_path9.join)(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6752,14 +6758,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 var import_node_fs16 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!(0, import_node_fs16.existsSync)(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!(0, import_node_fs16.existsSync)(auditDir2)) return [];
   let files;
   try {
-    files = (0, import_node_fs16.readdirSync)(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = (0, import_node_fs16.readdirSync)(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6770,7 +6776,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = (0, import_node_fs16.readFileSync)((0, import_node_path9.join)(auditDir, file), "utf8");
+      raw = (0, import_node_fs16.readFileSync)((0, import_node_path10.join)(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6800,10 +6806,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 var import_node_fs17 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6836,7 +6842,7 @@ var AuditWriter = class {
       (0, import_node_fs17.mkdirSync)(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = (0, import_node_path10.join)(this.auditDir, auditFileName(record.ts));
+    const file = (0, import_node_path11.join)(this.auditDir, auditFileName(record.ts));
     (0, import_node_fs17.appendFileSync)(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6844,7 +6850,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 var import_node_fs18 = require("fs");
 var import_node_crypto10 = require("crypto");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
@@ -6915,7 +6921,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = (0, import_node_path11.join)(this.billingDir, billingFileName(event.ts));
+    const file = (0, import_node_path12.join)(this.billingDir, billingFileName(event.ts));
     (0, import_node_fs18.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6965,7 +6971,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = (0, import_node_path11.join)(this.billingDir, deliveredFileName(event.ts));
+      const file = (0, import_node_path12.join)(this.billingDir, deliveredFileName(event.ts));
       (0, import_node_fs18.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6982,7 +6988,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 var import_node_fs19 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!(0, import_node_fs19.existsSync)(billingDir)) return view;
@@ -7019,7 +7025,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs19.readFileSync)((0, import_node_path12.join)(dir, file), "utf8");
+    raw = (0, import_node_fs19.readFileSync)((0, import_node_path13.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7460,7 +7466,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7536,7 +7542,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7546,9 +7552,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,
@@ -7637,9 +7643,9 @@ function buildCliSpawnPlan(opts) {
   };
 }
 function resolveInPathDefault(candidate) {
-  const segments = (process.env["PATH"] ?? "").split(import_node_path13.delimiter).filter(Boolean);
+  const segments = (process.env["PATH"] ?? "").split(import_node_path14.delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = (0, import_node_path13.join)(seg, candidate);
+    const full = (0, import_node_path14.join)(seg, candidate);
     if ((0, import_node_fs21.existsSync)(full)) return full;
   }
   return null;

package/dist/cli.js

@@ -911,7 +911,7 @@ async function keysRevoke(db, id) {
 // src/commands/launch.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync15 } from "fs";
-import { delimiter as delimiter2, join as join10 } from "path";
+import { delimiter as delimiter2, join as join11 } from "path";
 import { parseArgs as parseArgs3 } from "util";
 import {
   buildChatCliLaunchConfig as buildChatCliLaunchConfig2,
@@ -2234,12 +2234,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+import { join as join4 } from "path";
 import { setAuditCaptureConfig, setAuditSink } from "@omnicross/core/pipeline/auditSink";
+import { setUpstreamTracePath } from "@omnicross/core/pipeline/upstreamTrace";
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -2251,9 +2255,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    setUpstreamTracePath(config.captureBodies ? join4(auditDir, "upstream-trace.jsonl") : null);
   } else {
     setAuditCaptureConfig(null);
     setAuditSink(null);
+    setUpstreamTracePath(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -4209,7 +4215,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -5551,9 +5557,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function externalStorePath(provider, home = homedir2()) {
-  return provider === "claude" ? join4(home, ".claude", ".credentials.json") : join4(home, ".codex", "auth.json");
+  return provider === "claude" ? join5(home, ".claude", ".credentials.json") : join5(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -6672,7 +6678,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 import { existsSync as existsSync11, readdirSync, unlinkSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6698,8 +6704,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6755,7 +6761,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          unlinkSync(join5(this.auditDir, file));
+          unlinkSync(join6(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6779,14 +6785,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!existsSync12(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!existsSync12(auditDir2)) return [];
   let files;
   try {
-    files = readdirSync2(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = readdirSync2(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6797,7 +6803,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = readFileSync12(join6(auditDir, file), "utf8");
+      raw = readFileSync12(join7(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6827,10 +6833,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6863,7 +6869,7 @@ var AuditWriter = class {
       mkdirSync4(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = join7(this.auditDir, auditFileName(record.ts));
+    const file = join8(this.auditDir, auditFileName(record.ts));
     appendFileSync2(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6871,7 +6877,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync5 } from "fs";
 import { createHmac } from "crypto";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -6942,7 +6948,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join8(this.billingDir, billingFileName(event.ts));
+    const file = join9(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6992,7 +6998,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join8(this.billingDir, deliveredFileName(event.ts));
+      const file = join9(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -7009,7 +7015,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync13 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!existsSync13(billingDir)) return view;
@@ -7046,7 +7052,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync13(join9(dir, file), "utf8");
+    raw = readFileSync13(join10(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7487,7 +7493,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7563,7 +7569,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7573,9 +7579,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => fetchUpstream6(url, init)
   });
   setWebhookRuntime(webhookDispatcher, getSharedAccountHealth2());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,
@@ -7666,7 +7672,7 @@ function buildCliSpawnPlan(opts) {
 function resolveInPathDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean);
   for (const seg of segments) {
-    const full = join10(seg, candidate);
+    const full = join11(seg, candidate);
     if (existsSync15(full)) return full;
   }
   return null;

package/dist/index.cjs

@@ -1903,12 +1903,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+var import_node_path3 = require("path");
 var import_auditSink = require("@omnicross/core/pipeline/auditSink");
+var import_upstreamTrace = require("@omnicross/core/pipeline/upstreamTrace");
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -1920,9 +1924,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    (0, import_upstreamTrace.setUpstreamTracePath)(config.captureBodies ? (0, import_node_path3.join)(auditDir, "upstream-trace.jsonl") : null);
   } else {
     (0, import_auditSink.setAuditCaptureConfig)(null);
     (0, import_auditSink.setAuditSink)(null);
+    (0, import_upstreamTrace.setUpstreamTracePath)(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -1932,9 +1938,11 @@ function applyAuditConfig(config) {
 function resetAuditRuntimeForTests() {
   (0, import_auditSink.setAuditCaptureConfig)(null);
   (0, import_auditSink.setAuditSink)(null);
+  (0, import_upstreamTrace.setUpstreamTracePath)(null);
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
+  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -3800,7 +3808,7 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 var import_node_fs4 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_module = require("module");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
 var import_meta = {};
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -3821,13 +3829,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return (0, import_node_fs4.existsSync)(import_node_path3.default.join(fromEnv, "index.html")) ? import_node_path3.default.resolve(fromEnv) : null;
+    return (0, import_node_fs4.existsSync)(import_node_path4.default.join(fromEnv, "index.html")) ? import_node_path4.default.resolve(fromEnv) : null;
   }
   try {
     const req = (0, import_node_module.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
-    const dist = import_node_path3.default.join(import_node_path3.default.dirname(pkgJson), "dist");
-    return (0, import_node_fs4.existsSync)(import_node_path3.default.join(dist, "index.html")) ? dist : null;
+    const dist = import_node_path4.default.join(import_node_path4.default.dirname(pkgJson), "dist");
+    return (0, import_node_fs4.existsSync)(import_node_path4.default.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -3869,16 +3877,16 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
     return true;
   }
-  const filePath = import_node_path3.default.resolve(uiDist, rel === "" ? "index.html" : rel);
-  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path3.default.sep)) {
+  const filePath = import_node_path4.default.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path4.default.sep)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
     return true;
   }
   let target = filePath;
   if (!(0, import_node_fs4.existsSync)(target) || (0, import_node_fs4.statSync)(target).isDirectory()) {
-    if (import_node_path3.default.extname(rel) === "") {
-      target = import_node_path3.default.join(uiDist, "index.html");
+    if (import_node_path4.default.extname(rel) === "") {
+      target = import_node_path4.default.join(uiDist, "index.html");
     } else {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
@@ -3886,14 +3894,14 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     }
   }
   const body = await (0, import_promises.readFile)(target);
-  const type = CONTENT_TYPES[import_node_path3.default.extname(target).toLowerCase()] ?? "application/octet-stream";
+  const type = CONTENT_TYPES[import_node_path4.default.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
   return true;
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -4275,21 +4283,21 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-var import_node_path4 = require("path");
+var import_node_path5 = require("path");
 function defaultVouchersPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "vouchers.json");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "vouchers.json");
 }
 function defaultPricingPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "pricing.json");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "pricing.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "usage-events.jsonl");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "audit");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "billing");
+  return (0, import_node_path5.join)((0, import_node_path5.dirname)(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
@@ -5286,7 +5294,7 @@ var JsonVoucherDb = class {
 
 // src/ports/JsonSubscriptionCredentialStore.ts
 var import_node_fs13 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
@@ -5368,9 +5376,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 var import_node_fs11 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 function externalStorePath(provider, home = (0, import_node_os2.homedir)()) {
-  return provider === "claude" ? (0, import_node_path5.join)(home, ".claude", ".credentials.json") : (0, import_node_path5.join)(home, ".codex", "auth.json");
+  return provider === "claude" ? (0, import_node_path6.join)(home, ".claude", ".credentials.json") : (0, import_node_path6.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -5433,7 +5441,7 @@ function readExternalCliCredentials(provider, home = (0, import_node_os2.homedir
 // src/ports/external-cli-store.ts
 var import_node_fs12 = require("fs");
 var import_node_os3 = require("os");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function markerPath(provider, home) {
   return `${externalStorePath(provider, home)}.omnicross-managed`;
 }
@@ -5468,7 +5476,7 @@ function readExistingObject(path2) {
   }
 }
 function writeAtomic(path2, content) {
-  (0, import_node_fs12.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path7.dirname)(path2), { recursive: true });
   const temp = `${path2}.omnicross-tmp`;
   (0, import_node_fs12.writeFileSync)(temp, content, "utf8");
   (0, import_node_fs12.renameSync)(temp, path2);
@@ -6139,7 +6147,7 @@ var JsonSubscriptionCredentialStore = class {
    *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
    *  write — incl. child 4's future refresh writes — lands encrypted. */
   persist(config) {
-    (0, import_node_fs13.mkdirSync)((0, import_node_path7.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs13.mkdirSync)((0, import_node_path8.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
     (0, import_node_fs13.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
@@ -6489,7 +6497,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 var import_node_fs14 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6515,8 +6523,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6572,7 +6580,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          (0, import_node_fs14.unlinkSync)((0, import_node_path8.join)(this.auditDir, file));
+          (0, import_node_fs14.unlinkSync)((0, import_node_path9.join)(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6596,14 +6604,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 var import_node_fs15 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!(0, import_node_fs15.existsSync)(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!(0, import_node_fs15.existsSync)(auditDir2)) return [];
   let files;
   try {
-    files = (0, import_node_fs15.readdirSync)(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = (0, import_node_fs15.readdirSync)(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6614,7 +6622,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = (0, import_node_fs15.readFileSync)((0, import_node_path9.join)(auditDir, file), "utf8");
+      raw = (0, import_node_fs15.readFileSync)((0, import_node_path10.join)(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6644,10 +6652,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 var import_node_fs16 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6680,7 +6688,7 @@ var AuditWriter = class {
       (0, import_node_fs16.mkdirSync)(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = (0, import_node_path10.join)(this.auditDir, auditFileName(record.ts));
+    const file = (0, import_node_path11.join)(this.auditDir, auditFileName(record.ts));
     (0, import_node_fs16.appendFileSync)(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6688,7 +6696,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 var import_node_fs17 = require("fs");
 var import_node_crypto10 = require("crypto");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
@@ -6759,7 +6767,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = (0, import_node_path11.join)(this.billingDir, billingFileName(event.ts));
+    const file = (0, import_node_path12.join)(this.billingDir, billingFileName(event.ts));
     (0, import_node_fs17.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6809,7 +6817,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = (0, import_node_path11.join)(this.billingDir, deliveredFileName(event.ts));
+      const file = (0, import_node_path12.join)(this.billingDir, deliveredFileName(event.ts));
       (0, import_node_fs17.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6826,7 +6834,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 var import_node_fs18 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!(0, import_node_fs18.existsSync)(billingDir)) return view;
@@ -6863,7 +6871,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs18.readFileSync)((0, import_node_path12.join)(dir, file), "utf8");
+    raw = (0, import_node_fs18.readFileSync)((0, import_node_path13.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7304,7 +7312,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7380,7 +7388,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7390,9 +7398,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,

package/dist/index.js

@@ -1888,12 +1888,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+import { join as join3 } from "path";
 import { setAuditCaptureConfig, setAuditSink } from "@omnicross/core/pipeline/auditSink";
+import { setUpstreamTracePath } from "@omnicross/core/pipeline/upstreamTrace";
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -1905,9 +1909,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    setUpstreamTracePath(config.captureBodies ? join3(auditDir, "upstream-trace.jsonl") : null);
   } else {
     setAuditCaptureConfig(null);
     setAuditSink(null);
+    setUpstreamTracePath(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -1917,9 +1923,11 @@ function applyAuditConfig(config) {
 function resetAuditRuntimeForTests() {
   setAuditCaptureConfig(null);
   setAuditSink(null);
+  setUpstreamTracePath(null);
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
+  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -3877,7 +3885,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -4259,21 +4267,21 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 function defaultVouchersPath(configPath) {
-  return join3(dirname2(configPath), "vouchers.json");
+  return join4(dirname2(configPath), "vouchers.json");
 }
 function defaultPricingPath(configPath) {
-  return join3(dirname2(configPath), "pricing.json");
+  return join4(dirname2(configPath), "pricing.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return join3(dirname2(configPath), "usage-events.jsonl");
+  return join4(dirname2(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return join3(dirname2(configPath), "audit");
+  return join4(dirname2(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return join3(dirname2(configPath), "billing");
+  return join4(dirname2(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
@@ -5359,9 +5367,9 @@ function findDuplicateCredentialIds(accounts) {
 // src/ports/external-cli-credentials.ts
 import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function externalStorePath(provider, home = homedir2()) {
-  return provider === "claude" ? join4(home, ".claude", ".credentials.json") : join4(home, ".codex", "auth.json");
+  return provider === "claude" ? join5(home, ".claude", ".credentials.json") : join5(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -6480,7 +6488,7 @@ var AccountHealthSweeper = class {
 
 // src/audit/AuditPruneSweeper.ts
 import { existsSync as existsSync11, readdirSync, unlinkSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6506,8 +6514,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6563,7 +6571,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          unlinkSync(join5(this.auditDir, file));
+          unlinkSync(join6(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6587,14 +6595,14 @@ var AuditPruneSweeper = class {
 
 // src/audit/auditReader.ts
 import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync11 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!existsSync12(auditDir)) return [];
+function readAuditRecords(auditDir2, query = {}) {
+  if (!existsSync12(auditDir2)) return [];
   let files;
   try {
-    files = readdirSync2(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = readdirSync2(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -6605,7 +6613,7 @@ function readAuditRecords(auditDir, query = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = readFileSync11(join6(auditDir, file), "utf8");
+      raw = readFileSync11(join7(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6635,10 +6643,10 @@ function isAuditRecord(value) {
 
 // src/audit/AuditWriter.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6671,7 +6679,7 @@ var AuditWriter = class {
       mkdirSync4(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = join7(this.auditDir, auditFileName(record.ts));
+    const file = join8(this.auditDir, auditFileName(record.ts));
     appendFileSync2(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
@@ -6679,7 +6687,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync5 } from "fs";
 import { createHmac } from "crypto";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -6750,7 +6758,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join8(this.billingDir, billingFileName(event.ts));
+    const file = join9(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6800,7 +6808,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join8(this.billingDir, deliveredFileName(event.ts));
+      const file = join9(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6817,7 +6825,7 @@ var BillingPublisher = class {
 
 // src/billing/billingReader.ts
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync12 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
   if (!existsSync13(billingDir)) return view;
@@ -6854,7 +6862,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync12(join9(dir, file), "utf8");
+    raw = readFileSync12(join10(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7295,7 +7303,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7371,7 +7379,7 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query) => readAuditRecords(auditDir2, query),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -7381,9 +7389,9 @@ function buildDaemon(config, paths) {
     fetchImpl: (url, init) => fetchUpstream6(url, init)
   });
   setWebhookRuntime(webhookDispatcher, getSharedAccountHealth2());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnicross/daemon",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Omnicross standalone daemon 鈥?the bare-Node embedder of @omnicross/core with an admin HTTP API + dashboard.",
   "license": "MIT",
   "author": "Sayo (https://github.com/Dumoedss)",