@omnicross/daemon 0.1.6 → 0.1.8

package/dist/index.cjs

@@ -53,20 +53,21 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/bootstrap.ts
-var import_node_fs22 = require("fs");
+var import_node_fs23 = require("fs");
 var import_audit_types = require("@omnicross/contracts/audit-types");
 var import_billing_types = require("@omnicross/contracts/billing-types");
 var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
 var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
 var import_outbound_api4 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
-var import_SubscriptionAccountHealth3 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
-var import_AccountAllowanceScheduling4 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
-var import_provider_proxy = require("@omnicross/core/provider-proxy");
+var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
+var import_cli_launcher2 = require("@omnicross/cli-launcher");
 var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_usage = require("@omnicross/core/usage");
 var import_subscriptions4 = require("@omnicross/subscriptions");
@@ -147,7 +148,7 @@ async function runCodexLoopback(sessionId, codeVerifier, state, signal, deps) {
     const code = await deps.codexAwaitLoopback(state, void 0, signal);
     const result = await import_subscriptions.codexOAuth.exchangeCodeForTokens(
       { authorizationCode: code, codeVerifier, state },
-      deps.oauthExchangeFetch
+      deps.oauthExchangeFetch("codex")
     );
     const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
     const block = {
@@ -649,6 +650,17 @@ function handleAuditQuery(req, res, reader) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ records }));
 }
+async function handleAuditStatsQuery(req, res, reader) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const query2 = {};
+  const from = intParam(url.searchParams.get("from"));
+  if (from !== void 0) query2.from = from;
+  const to = intParam(url.searchParams.get("to"));
+  if (to !== void 0) query2.to = to;
+  const stats = reader ? await reader(query2) : { requestCount: 0, errorCount: 0, complete: true };
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(stats));
+}
 
 // src/admin/billingStatusApi.ts
 function handleBillingStatus(res, reader) {
@@ -745,6 +757,88 @@ async function handleWebhookTest(req, res) {
   res.end(JSON.stringify({ result }));
 }
 
+// src/admin/routeLeaseApi.ts
+var import_provider_proxy = require("@omnicross/core/provider-proxy");
+var MAX_BODY_BYTES = 64 * 1024;
+var SAFE_LEASE_ID = /^[A-Za-z0-9-]{1,128}$/u;
+async function readJson(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > MAX_BODY_BYTES) throw new import_provider_proxy.RouteLeaseError("invalid_request", "request body is too large");
+    chunks.push(buffer);
+  }
+  if (chunks.length === 0) return {};
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new import_provider_proxy.RouteLeaseError("invalid_request", "request body is not valid JSON");
+  }
+}
+function json(res, status, body, noStore = false) {
+  res.statusCode = status;
+  res.setHeader("Content-Type", "application/json");
+  if (noStore) res.setHeader("Cache-Control", "no-store");
+  res.end(JSON.stringify(body));
+}
+function leaseId(value) {
+  if (!value || !SAFE_LEASE_ID.test(value)) throw new import_provider_proxy.RouteLeaseError("invalid_request", "lease id is invalid");
+  return value;
+}
+function header(req, name) {
+  const value = req.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function writeError(res, error, noStore) {
+  const safe = error instanceof import_provider_proxy.RouteLeaseError ? error : new import_provider_proxy.RouteLeaseError("upstream_unavailable", "route lease operation failed safely");
+  if (safe.retryAfterSeconds !== void 0) res.setHeader("Retry-After", String(safe.retryAfterSeconds));
+  json(res, safe.status, safe.toResponse(), noStore);
+}
+async function handleRouteLeaseApi(req, res, path2, deps) {
+  const method = (req.method ?? "GET").toUpperCase();
+  const noStore = method === "POST" && (path2 === "/admin/api/route-leases" || path2.endsWith("/renew"));
+  try {
+    if (!(0, import_provider_proxy.isLoopbackAddress)(req.socket.remoteAddress)) {
+      throw new import_provider_proxy.RouteLeaseError("control_unauthorized", "route lease control plane is loopback only");
+    }
+    const manager = deps.routeLeaseManager;
+    if (!manager) throw new import_provider_proxy.RouteLeaseError("daemon_not_ready", "route lease manager is unavailable");
+    const base = "/admin/api/route-leases";
+    const suffix = path2.slice(base.length).replace(/^\/+|\/+$/gu, "");
+    const segments = suffix ? suffix.split("/") : [];
+    if (segments.length === 1 && segments[0] === "capabilities") {
+      if (method !== "GET" && method !== "HEAD") throw new import_provider_proxy.RouteLeaseError("invalid_request", "method is not allowed");
+      return json(res, 200, import_provider_proxy.ROUTE_LEASE_CAPABILITIES);
+    }
+    if (segments.length === 0) {
+      if (method === "GET") return json(res, 200, { leases: manager.list() });
+      if (method === "POST") {
+        const outcome = await manager.createFromRequest(await readJson(req), header(req, "idempotency-key"));
+        return json(res, outcome.created ? 201 : 200, outcome.result, true);
+      }
+      throw new import_provider_proxy.RouteLeaseError("invalid_request", "method is not allowed");
+    }
+    const id = leaseId(segments[0]);
+    if (segments.length === 1) {
+      if (method === "GET") return json(res, 200, manager.get(id));
+      if (method === "DELETE") return json(res, 200, manager.release(id));
+      throw new import_provider_proxy.RouteLeaseError("invalid_request", "method is not allowed");
+    }
+    if (segments.length === 2 && segments[1] === "renew" && method === "POST") {
+      const body = await readJson(req);
+      const ttl = (0, import_provider_proxy.normalizeRouteLeaseTtl)(
+        body && typeof body === "object" && !Array.isArray(body) ? body.ttlSeconds : void 0
+      );
+      return json(res, 200, manager.renew(id, ttl), true);
+    }
+    throw new import_provider_proxy.RouteLeaseError("lease_not_found", "route lease endpoint was not found");
+  } catch (error) {
+    writeError(res, error, noStore);
+  }
+}
+
 // src/admin/adminApi.ts
 var import_node_http = __toESM(require("http"), 1);
 var import_outbound_api2 = require("@omnicross/core/outbound-api");
@@ -2144,7 +2238,13 @@ function listMappablePresets() {
       name: preset.name,
       apiFormat: resolved.format,
       baseUrl: preset.api_base_url,
-      models: Array.isArray(preset.models) ? preset.models : []
+      models: Array.isArray(preset.models) ? preset.models : [],
+      nameKey: preset.nameKey,
+      icon: preset.icon,
+      description: preset.description,
+      features: preset.features,
+      website: preset.website,
+      modelsEndpoint: preset.modelsEndpoint
     });
   }
   return { mappable, excluded };
@@ -2533,7 +2633,7 @@ async function handleOAuthComplete(providerId, body, deps) {
   const rawCode = typeof body["code"] === "string" ? body["code"] : "";
   if (!sessionId) return err2(400, "oauth complete requires { sessionId }");
   if (!rawCode) return err2(400, "oauth complete requires { code }");
-  const session = deps.oauthSessions.take(sessionId);
+  const session = deps.oauthSessions.peek(sessionId);
   if (!session) return err2(410, "oauth session is unknown, expired, or already used");
   if (session.providerId !== providerId) {
     return err2(400, `oauth session does not match provider '${providerId}'`);
@@ -2547,13 +2647,15 @@ async function handleOAuthComplete(providerId, body, deps) {
     }
     code = splitCode;
   }
+  const exchangeFetch = deps.oauthExchangeFetch(providerId);
   let block;
   try {
-    block = providerId === "claude" ? await exchangeClaude(code, session.codeVerifier, session.state, deps.oauthExchangeFetch) : await exchangeGemini(code, session.codeVerifier, deps.oauthExchangeFetch);
+    block = providerId === "claude" ? await exchangeClaude(code, session.codeVerifier, session.state, exchangeFetch) : await exchangeGemini(code, session.codeVerifier, exchangeFetch);
   } catch (exchangeError) {
     const reason = exchangeError instanceof Error ? exchangeError.message : "token exchange failed";
     return err2(502, `oauth token exchange failed for '${providerId}': ${reason}`);
   }
+  deps.oauthSessions.consume(sessionId);
   const label = typeof body["label"] === "string" && body["label"].trim() ? body["label"].trim() : void 0;
   await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
   const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
@@ -2592,8 +2694,34 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 var import_node_child_process = require("child_process");
 var import_node_crypto6 = require("crypto");
 var import_node_fs6 = require("fs");
+var import_node_net = require("net");
+var import_node_os3 = require("os");
 var import_node_path5 = require("path");
 var import_cli_launcher = require("@omnicross/cli-launcher");
+var import_provider_proxy2 = require("@omnicross/core/provider-proxy");
+
+// src/routeLeaseRenewal.ts
+var TERMINAL_LEASE_TTL_SECONDS = 600;
+var TERMINAL_LEASE_RENEW_INTERVAL_MS = 5 * 60 * 1e3;
+var TERMINAL_LEASE_MAX_LIFETIME_MS = 24 * 60 * 60 * 1e3;
+function startTerminalLeaseRenewal(manager, leaseId2) {
+  const stopAt = Date.now() + TERMINAL_LEASE_MAX_LIFETIME_MS;
+  const timer = setInterval(() => {
+    if (Date.now() >= stopAt) {
+      clearInterval(timer);
+      return;
+    }
+    try {
+      manager.renew(leaseId2, TERMINAL_LEASE_TTL_SECONDS);
+    } catch {
+      clearInterval(timer);
+    }
+  }, TERMINAL_LEASE_RENEW_INTERVAL_MS);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+
+// src/admin/cliLaunch.ts
 var LAUNCHABLE_CLIS = [
   { id: "claude", displayName: "Claude Code", command: "claude" },
   { id: "codex", displayName: "Codex CLI", command: "codex" },
@@ -2674,34 +2802,183 @@ async function buildLaunchEnv(cli, llmConfig, target) {
 function shq(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-var defaultTerminalOpener = ({ cli, command, extraArgs, env, cwd, platform }) => {
+var MAC_TERMINAL_BOOTSTRAP_SOURCE = `
+'use strict';
+const fs = require('node:fs');
+const net = require('node:net');
+const { spawn } = require('node:child_process');
+const [socketPath, launchDir, cwd, command, ...args] = process.argv.slice(2);
+let payload = '';
+const socket = net.createConnection(socketPath);
+socket.setEncoding('utf8');
+socket.on('data', (chunk) => { payload += chunk; });
+socket.on('end', () => {
+  const descriptor = JSON.parse(payload);
+  if (!descriptor || Array.isArray(descriptor) || Object.values(descriptor).some((value) => typeof value !== 'string')) {
+    throw new Error('invalid terminal launch descriptor');
+  }
+  try { fs.rmSync(launchDir, { recursive: true, force: true }); } catch {}
+  const child = spawn(command, args, {
+    cwd: cwd || undefined,
+    env: { ...process.env, ...descriptor },
+    stdio: 'inherit',
+  });
+  child.on('error', (error) => { console.error(error.message); process.exitCode = 1; });
+  child.on('exit', (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exitCode = code == null ? 1 : code;
+  });
+});
+socket.on('error', (error) => { console.error(error.message); process.exitCode = 1; });
+`;
+var MAC_TERMINAL_IPC_TIMEOUT_MS = 12e4;
+function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }, spawnProcess = import_node_child_process.spawn, macIpc = {}) {
   const childEnv = { ...process.env, ...env };
   if (platform === "win32") {
     const args = ["/c", "start", `"omnicross ${cli}"`];
     if (cwd) args.push("/D", `"${cwd}"`);
     args.push("cmd", "/k", command, ...extraArgs);
-    (0, import_node_child_process.spawn)(process.env["ComSpec"] || "cmd.exe", args, {
+    spawnProcess(process.env["ComSpec"] || "cmd.exe", args, {
       env: childEnv,
       windowsVerbatimArguments: true,
       detached: true,
       stdio: "ignore"
     }).unref();
-    return;
+    return () => {
+    };
   }
-  const exportLine = Object.entries(env).map(([k, v]) => `export ${k}=${shq(v)}`).join("; ");
   const runLine = [command, ...extraArgs].map(shq).join(" ");
-  const script = `${exportLine}; ${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
+  const script = `${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
   if (platform === "darwin") {
-    const osa = `tell application "Terminal" to do script ${JSON.stringify(script)}`;
-    (0, import_node_child_process.spawn)("osascript", ["-e", osa], { detached: true, stdio: "ignore" }).unref();
-    return;
+    const launchDir = (0, import_node_fs6.mkdtempSync)((0, import_node_path5.join)((0, import_node_os3.tmpdir)(), "omnicross-terminal-"));
+    const commandFile = (0, import_node_path5.join)(launchDir, "launch.command");
+    const bootstrapFile = (0, import_node_path5.join)(launchDir, "bootstrap.cjs");
+    const socketPath = macIpc.socketPath ?? (0, import_node_path5.join)(launchDir, "descriptor.sock");
+    const openerEnv = { ...process.env };
+    for (const key of Object.keys(env)) delete openerEnv[key];
+    let claimed = false;
+    let cleaned = false;
+    let failureNotified = false;
+    let timer;
+    const notifyFailure = () => {
+      cleanup();
+      if (failureNotified) return;
+      failureNotified = true;
+      try {
+        onFailure?.();
+      } catch {
+      }
+    };
+    const handleLaunchFailure = () => {
+      if (claimed) cleanup();
+      else notifyFailure();
+    };
+    const sockets = /* @__PURE__ */ new Set();
+    const server = (0, import_node_net.createServer)((socket) => {
+      socket.unref();
+      sockets.add(socket);
+      socket.once("close", () => sockets.delete(socket));
+      try {
+        macIpc.onAccepted?.(socket);
+      } catch {
+        cleanup();
+        return;
+      }
+      if (claimed || cleaned) {
+        socket.destroy();
+        return;
+      }
+      claimed = true;
+      try {
+        macIpc.onClaimed?.();
+        if (cleaned) return;
+        socket.end(JSON.stringify(env), cleanup);
+      } catch {
+        cleanup();
+      }
+    });
+    const cleanup = () => {
+      if (!cleaned) {
+        cleaned = true;
+        if (timer) clearTimeout(timer);
+        for (const socket of sockets) socket.destroy();
+        sockets.clear();
+        try {
+          server.close();
+        } catch {
+        }
+      }
+      try {
+        if (macIpc.removeArtifacts) {
+          macIpc.removeArtifacts(launchDir);
+        } else {
+          (0, import_node_fs6.rmSync)(launchDir, {
+            recursive: true,
+            force: true,
+            maxRetries: 3,
+            retryDelay: 20
+          });
+        }
+      } catch {
+      }
+    };
+    try {
+      (0, import_node_fs6.writeFileSync)(bootstrapFile, MAC_TERMINAL_BOOTSTRAP_SOURCE, { encoding: "utf8", mode: 448 });
+      (0, import_node_fs6.writeFileSync)(commandFile, `#!/bin/bash
+rm -f -- "$0"
+exec ${shq(process.execPath)} ${shq(bootstrapFile)} ${shq(socketPath)} ${shq(launchDir)} ${shq(cwd ?? "")} ${runLine}
+`, {
+        encoding: "utf8",
+        mode: 448
+      });
+      (0, import_node_fs6.chmodSync)(commandFile, 448);
+      (0, import_node_fs6.chmodSync)(bootstrapFile, 448);
+      server.once("error", handleLaunchFailure);
+      server.listen(socketPath, () => {
+        if (cleaned) return;
+        try {
+          macIpc.onListening?.();
+          if (cleaned) return;
+          if (process.platform !== "win32") (0, import_node_fs6.chmodSync)(socketPath, 384);
+          const opener = spawnProcess("open", ["-n", "-a", "Terminal", commandFile], {
+            env: openerEnv,
+            detached: true,
+            stdio: "ignore"
+          });
+          opener.once("error", handleLaunchFailure);
+          opener.unref();
+          server.unref();
+        } catch {
+          handleLaunchFailure();
+        }
+      });
+      timer = setTimeout(handleLaunchFailure, macIpc.timeoutMs ?? MAC_TERMINAL_IPC_TIMEOUT_MS);
+      timer.unref?.();
+      return cleanup;
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
   }
-  (0, import_node_child_process.spawn)("x-terminal-emulator", ["-e", "bash", "-lc", `${script}; exec bash`], {
+  spawnProcess("x-terminal-emulator", ["-e", "bash", "-lc", `${script}; exec bash`], {
+    env: childEnv,
     detached: true,
     stdio: "ignore"
   }).unref();
-};
+  return () => {
+  };
+}
+var defaultTerminalOpener = (input) => openTerminal(input);
 var sessions = /* @__PURE__ */ new Map();
+function resetCliSessions() {
+  for (const s of sessions.values()) {
+    try {
+      s.onSessionEnd();
+    } catch {
+    }
+  }
+  sessions.clear();
+}
 function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
@@ -2756,29 +3033,81 @@ async function handleCliLaunch(cli, body, ctx) {
   } catch (err5) {
     return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "no launch target") };
   }
+  const id = (0, import_node_crypto6.randomUUID)();
+  let leaseId2;
   let launch;
   try {
-    launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+    if ((cli === "claude" || cli === "codex") && ctx.routeLeaseManager) {
+      const outcome = await ctx.routeLeaseManager.createFromRequest({
+        schemaVersion: import_provider_proxy2.ROUTE_LEASE_REQUEST_SCHEMA,
+        consumer: "omnicross-terminal",
+        runtime: cli,
+        upstream: { kind: "provider", providerId: target.providerId },
+        model: target.model,
+        execution: { sessionId: id }
+      }, `omnicross-terminal:${id}`);
+      leaseId2 = outcome.result.leaseId;
+      const stopRenewal = startTerminalLeaseRenewal(ctx.routeLeaseManager, leaseId2);
+      launch = {
+        env: outcome.result.launch.env,
+        extraArgs: outcome.result.launch.extraArgs,
+        onSessionEnd: () => {
+          stopRenewal();
+          ctx.routeLeaseManager?.release(outcome.result.leaseId);
+        }
+      };
+    } else {
+      launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+    }
   } catch (err5) {
-    return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "failed to build launch env") };
+    const status = err5 instanceof import_provider_proxy2.RouteLeaseError ? err5.status : 400;
+    return { status, body: errBody(err5 instanceof Error ? err5.message : "failed to build launch env") };
   }
   const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
   const opener = ctx.opener ?? defaultTerminalOpener;
+  let openerCleanup;
+  let ended = false;
+  let published = false;
+  const onSessionEnd = () => {
+    if (ended) return;
+    ended = true;
+    if (published) sessions.delete(id);
+    try {
+      openerCleanup?.();
+    } finally {
+      launch.onSessionEnd();
+    }
+  };
   try {
-    opener({ cli, command: meta.command, extraArgs: launch.extraArgs ?? [], env: launch.env, cwd, platform });
+    const cleanup = opener({
+      cli,
+      command: meta.command,
+      extraArgs: launch.extraArgs ?? [],
+      env: launch.env,
+      cwd,
+      platform,
+      onFailure: onSessionEnd
+    });
+    if (cleanup) openerCleanup = cleanup;
   } catch (err5) {
-    launch.onSessionEnd();
+    onSessionEnd();
     return { status: 500, body: errBody(err5 instanceof Error ? err5.message : "failed to open terminal") };
   }
-  const id = (0, import_node_crypto6.randomUUID)();
+  if (ended) {
+    openerCleanup?.();
+    return { status: 500, body: errBody("failed to open terminal") };
+  }
   sessions.set(id, {
     id,
     cli,
     providerId: target.providerId,
     model: target.model,
+    ...leaseId2 ? { leaseId: leaseId2 } : {},
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    onSessionEnd: launch.onSessionEnd
+    onSessionEnd
   });
+  published = true;
+  if (ended) sessions.delete(id);
   return { status: 200, body: { sessionId: id, providerId: target.providerId, model: target.model } };
 }
 
@@ -2798,8 +3127,8 @@ function validateAuditSegment(patch) {
     }
   }
   const maxBodyBytes = audit["maxBodyBytes"];
-  if (maxBodyBytes !== void 0 && (typeof maxBodyBytes !== "number" || !Number.isFinite(maxBodyBytes) || maxBodyBytes < 0)) {
-    errors.push("audit.maxBodyBytes must be a non-negative number");
+  if (maxBodyBytes !== void 0 && (typeof maxBodyBytes !== "number" || !Number.isFinite(maxBodyBytes) || maxBodyBytes < -1)) {
+    errors.push("audit.maxBodyBytes must be -1 or a non-negative number");
   }
   const retentionDays = audit["retentionDays"];
   if (retentionDays !== void 0 && (typeof retentionDays !== "number" || !Number.isFinite(retentionDays) || retentionDays < 0)) {
@@ -3234,18 +3563,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
-var import_node_path6 = require("path");
 var import_auditSink = require("@omnicross/core/pipeline/auditSink");
 var import_upstreamTrace = require("@omnicross/core/pipeline/upstreamTrace");
 var writer = null;
 var sweeper = null;
-var auditDir = "";
-function setAuditRuntime(w, s, dir) {
+function setAuditRuntime(w, s) {
   writer = w;
   sweeper = s;
-  auditDir = dir;
 }
 function applyAuditConfig(config) {
+  (0, import_upstreamTrace.setUpstreamTracePath)(null);
   const enabled = config?.enabled === true && writer !== null;
   if (enabled && config) {
     (0, import_auditSink.setAuditCaptureConfig)(config);
@@ -3255,11 +3582,9 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
-    (0, import_upstreamTrace.setUpstreamTracePath)(config.captureBodies ? (0, import_node_path6.join)(auditDir, "upstream-trace.jsonl") : null);
   } else {
     (0, import_auditSink.setAuditCaptureConfig)(null);
     (0, import_auditSink.setAuditSink)(null);
-    (0, import_upstreamTrace.setUpstreamTracePath)(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -3273,7 +3598,6 @@ function resetAuditRuntimeForTests() {
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
-  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -3675,7 +3999,7 @@ function sealPack(bundleJson, passphrase) {
   cipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
   const ciphertext = Buffer.concat([cipher.update(bundleJson, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
-  const header = {
+  const header2 = {
     magic: PACK_MAGIC,
     v: PACK_VERSION,
     kdf: KDF_ALGORITHM,
@@ -3686,7 +4010,7 @@ function sealPack(bundleJson, passphrase) {
     iv: iv.toString("base64"),
     tag: tag.toString("base64")
   };
-  return `${PACK_PREFIX}${toB64Url(JSON.stringify(header))}.${ciphertext.toString("base64")}`;
+  return `${PACK_PREFIX}${toB64Url(JSON.stringify(header2))}.${ciphertext.toString("base64")}`;
 }
 function parsePack(packString) {
   if (typeof packString !== "string" || !packString.startsWith(PACK_PREFIX)) {
@@ -3697,28 +4021,28 @@ function parsePack(packString) {
   if (dot < 0) throw new PackAuthError("migration pack is malformed (missing body)");
   const headerB64Url = rest.slice(0, dot);
   const ctB64 = rest.slice(dot + 1);
-  let header;
+  let header2;
   try {
-    header = JSON.parse(fromB64Url(headerB64Url));
+    header2 = JSON.parse(fromB64Url(headerB64Url));
   } catch {
     throw new PackAuthError("migration pack is malformed (unreadable header)");
   }
-  if (!header || header.magic !== PACK_MAGIC || header.v !== PACK_VERSION || header.kdf !== KDF_ALGORITHM || typeof header.salt !== "string" || typeof header.iv !== "string" || typeof header.tag !== "string" || typeof header.N !== "number" || typeof header.r !== "number" || typeof header.p !== "number") {
+  if (!header2 || header2.magic !== PACK_MAGIC || header2.v !== PACK_VERSION || header2.kdf !== KDF_ALGORITHM || typeof header2.salt !== "string" || typeof header2.iv !== "string" || typeof header2.tag !== "string" || typeof header2.N !== "number" || typeof header2.r !== "number" || typeof header2.p !== "number") {
     throw new PackAuthError("migration pack is malformed (unsupported header)");
   }
   const ciphertext = Buffer.from(ctB64, "base64");
-  return { header, ciphertext };
+  return { header: header2, ciphertext };
 }
 function openPack(packString, passphrase) {
   assertPassphraseStrength(passphrase);
-  const { header, ciphertext } = parsePack(packString);
-  const salt = Buffer.from(header.salt, "base64");
-  const iv = Buffer.from(header.iv, "base64");
-  const tag = Buffer.from(header.tag, "base64");
+  const { header: header2, ciphertext } = parsePack(packString);
+  const salt = Buffer.from(header2.salt, "base64");
+  const iv = Buffer.from(header2.iv, "base64");
+  const tag = Buffer.from(header2.tag, "base64");
   if (iv.length !== IV_BYTES2 || tag.length !== TAG_BYTES2) {
     throw new PackAuthError("migration pack is malformed (invalid iv/tag length)");
   }
-  const key = deriveKey(passphrase, salt, header.N, header.r, header.p);
+  const key = deriveKey(passphrase, salt, header2.N, header2.r, header2.p);
   const decipher = (0, import_node_crypto8.createDecipheriv)("aes-256-gcm", key, iv);
   decipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
   decipher.setAuthTag(tag);
@@ -4054,10 +4378,10 @@ function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeError(res, status, message) {
+function writeError2(res, status, message) {
   writeJson2(res, status, { error: { type: "account_allowance_error", message } });
 }
-function readJson(req) {
+function readJson2(req) {
   return new Promise((resolve2, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
@@ -4083,10 +4407,10 @@ function allowanceProvider(value) {
   return value === "claude" || value === "codex" ? value : null;
 }
 async function handleAccountAllowanceApi(req, res, method, rest, service) {
-  if (!service) return writeError(res, 501, "account allowance service is not available");
+  if (!service) return writeError2(res, 501, "account allowance service is not available");
   if (method === "GET" && rest.length === 1 && rest[0] === "scheduling") {
     if (!service.getSchedulingStatus) {
-      return writeError(res, 501, "allowance scheduling diagnostics are not available");
+      return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
     return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
   }
@@ -4094,30 +4418,32 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     const params = query(req);
     const pathProvider = rest.length >= 2 ? rest[0] : null;
     const providerId = allowanceProvider(pathProvider ?? params.get("providerId") ?? params.get("provider"));
-    if (providerId === null) return writeError(res, 400, "providerId must be claude or codex");
+    if (providerId === null) return writeError2(res, 400, "providerId must be claude or codex");
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
     return writeJson2(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
-    const body = await readJson(req);
+    const body = await readJson2(req);
     const requestedProvider = allowanceProvider(
       typeof body["providerId"] === "string" ? body["providerId"] : "claude"
     );
     if (requestedProvider !== "claude") {
-      return writeError(res, 400, "only Claude allowances support explicit refresh");
+      return writeError2(res, 400, "only Claude allowances support explicit refresh");
     }
     const accountId = typeof body["accountId"] === "string" && body["accountId"].trim() ? body["accountId"].trim() : void 0;
     const allowances = await service.refreshClaude(accountId);
     if (accountId && allowances.length === 0) {
-      return writeError(res, 404, `Claude account '${accountId}' not found`);
+      return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
     return writeJson2(res, 200, { allowances });
   }
-  return writeError(res, 405, `method ${method} not allowed on account allowances`);
+  return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
 
 // src/admin/adminApi.ts
+var import_AccountRouteActivity = require("@omnicross/core/pipeline/AccountRouteActivity");
+var import_ServerOverloadCounter = require("@omnicross/core/pipeline/ServerOverloadCounter");
 function readBody(req) {
   return new Promise((resolve2, reject) => {
     const chunks = [];
@@ -4154,6 +4480,9 @@ function toKeyInfo(row) {
     id: row.id,
     name: row.name,
     keyPrefix: row.keyPrefix,
+    // True only when a reversible `keySecret` envelope was persisted at creation
+    // — gates the UI "view key" eye. Legacy hash-only rows read as absent.
+    revealable: Boolean(row.keySecret),
     enabled: row.enabled,
     createdAt: row.createdAt,
     lastUsedAt: row.lastUsedAt,
@@ -4809,7 +5138,13 @@ function handlePresets(res, method) {
     name: p.name,
     apiFormat: p.apiFormat,
     baseUrl: p.baseUrl,
-    models: p.models
+    models: p.models,
+    nameKey: p.nameKey,
+    icon: p.icon,
+    description: p.description,
+    features: p.features,
+    website: p.website,
+    modelsEndpoint: p.modelsEndpoint
   }));
   return writeJson3(res, 200, { presets, excluded });
 }
@@ -4843,12 +5178,27 @@ async function handleKeys(req, res, method, rest, deps) {
       plaintextOnce: created.plaintextOnce
     });
   }
+  if (method === "GET" && rest.length === 2 && rest[1] === "reveal") {
+    const revealed = await deps.keyDb.outboundApiKeysReveal(rest[0]);
+    if (revealed !== null) return writeJson3(res, 200, { key: revealed });
+    const exists = (await deps.keyDb.outboundApiKeysList()).some((r) => r.id === rest[0]);
+    if (!exists) return writeJsonError(res, 404, `key '${rest[0]}' not found`);
+    return writeJsonError(
+      res,
+      409,
+      `key '${rest[0]}' is not revealable (created before revealable key storage)`
+    );
+  }
   const id = rest[0];
   const action = rest[1];
   if (method === "POST" && id && action === "revoke") {
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
     return writeJson3(res, ok ? 200 : 404, { ok });
   }
+  if (method === "DELETE" && id && !action) {
+    const ok = await deps.keyDb.outboundApiKeysDelete(id);
+    return writeJson3(res, ok ? 200 : 404, { ok });
+  }
   if (method === "POST" && id && action === "enabled") {
     const body = await readJsonBody3(req);
     const enabled = body["enabled"] === true;
@@ -5025,6 +5375,40 @@ async function handleServer(req, res, method, deps) {
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
 async function handleAccounts(req, res, method, rest, deps) {
+  if (rest[0] === "route-activity" && rest.length === 1) {
+    if (method !== "GET") {
+      return writeJsonError(res, 405, `method ${method} not allowed on account route activity`);
+    }
+    const query2 = requestQuery(req);
+    const parsedLimit = Number(query2.get("limit") ?? "100");
+    const records = (0, import_AccountRouteActivity.getSharedAccountRouteActivity)().list({
+      providerId: query2.get("providerId") ?? void 0,
+      accountId: query2.get("accountId") ?? void 0,
+      sessionKey: query2.get("sessionKey") ?? void 0,
+      limit: Number.isFinite(parsedLimit) ? parsedLimit : 100
+    });
+    return writeJson3(res, 200, {
+      available: true,
+      records,
+      capacity: import_AccountRouteActivity.ACCOUNT_ROUTE_ACTIVITY_LIMIT,
+      collectedAt: Date.now()
+    });
+  }
+  if (rest[0] === "overload-counters" && rest.length === 1) {
+    if (method !== "GET") {
+      return writeJsonError(res, 405, `method ${method} not allowed on overload counters`);
+    }
+    const query2 = requestQuery(req);
+    const entries = (0, import_ServerOverloadCounter.getSharedOverloadCounter)().list({
+      providerId: query2.get("providerId") ?? void 0,
+      accountId: query2.get("accountId") ?? void 0
+    });
+    return writeJson3(res, 200, {
+      available: true,
+      entries,
+      collectedAt: Date.now()
+    });
+  }
   if (rest[0] === "allowances") {
     return handleAccountAllowanceApi(
       req,
@@ -5171,8 +5555,13 @@ async function handleAccounts(req, res, method, rest, deps) {
       if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
         return writeJsonError(res, 404, `account '${accountId}' not found`);
       }
-      const result = await deps.accountProbeService.probeAccount(providerId, accountId);
-      return writeJson3(res, 200, { ok: result.ok, marked: result.marked });
+      const result = await deps.accountProbeService.testAccountConnection(providerId, accountId);
+      return writeJson3(res, 200, {
+        ok: result.ok,
+        marked: result.marked,
+        tier: result.tier,
+        model: result.model
+      });
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
@@ -5281,6 +5670,7 @@ async function handleCli(req, res, method, rest, deps) {
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
       providers,
+      routeLeaseManager: deps.routeLeaseManager,
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
@@ -5451,7 +5841,7 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 var import_node_fs7 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_module = require("module");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_path6 = __toESM(require("path"), 1);
 var import_meta = {};
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -5472,13 +5862,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return (0, import_node_fs7.existsSync)(import_node_path7.default.join(fromEnv, "index.html")) ? import_node_path7.default.resolve(fromEnv) : null;
+    return (0, import_node_fs7.existsSync)(import_node_path6.default.join(fromEnv, "index.html")) ? import_node_path6.default.resolve(fromEnv) : null;
   }
   try {
     const req = (0, import_node_module.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
-    const dist = import_node_path7.default.join(import_node_path7.default.dirname(pkgJson), "dist");
-    return (0, import_node_fs7.existsSync)(import_node_path7.default.join(dist, "index.html")) ? dist : null;
+    const dist = import_node_path6.default.join(import_node_path6.default.dirname(pkgJson), "dist");
+    return (0, import_node_fs7.existsSync)(import_node_path6.default.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -5520,16 +5910,16 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
     return true;
   }
-  const filePath = import_node_path7.default.resolve(uiDist, rel === "" ? "index.html" : rel);
-  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path7.default.sep)) {
+  const filePath = import_node_path6.default.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path6.default.sep)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
     return true;
   }
   let target = filePath;
   if (!(0, import_node_fs7.existsSync)(target) || (0, import_node_fs7.statSync)(target).isDirectory()) {
-    if (import_node_path7.default.extname(rel) === "") {
-      target = import_node_path7.default.join(uiDist, "index.html");
+    if (import_node_path6.default.extname(rel) === "") {
+      target = import_node_path6.default.join(uiDist, "index.html");
     } else {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
@@ -5537,14 +5927,14 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     }
   }
   const body = await (0, import_promises.readFile)(target);
-  const type = CONTENT_TYPES[import_node_path7.default.extname(target).toLowerCase()] ?? "application/octet-stream";
+  const type = CONTENT_TYPES[import_node_path6.default.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
   return true;
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.6" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.8" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -5652,6 +6042,10 @@ var AdminServer = class {
       handleAuditQuery(req, res, this.deps.auditReader);
       return;
     }
+    if (path2 === "/admin/api/audit/stats" && (req.method === "GET" || req.method === "HEAD")) {
+      await handleAuditStatsQuery(req, res, this.deps.auditStatsReader);
+      return;
+    }
     if (path2 === "/admin/api/billing-status" && (req.method === "GET" || req.method === "HEAD")) {
       handleBillingStatus(res, this.deps.billingStatusReader);
       return;
@@ -5660,6 +6054,10 @@ var AdminServer = class {
       await handleWebhookTest(req, res);
       return;
     }
+    if (path2 === "/admin/api/route-leases" || path2.startsWith("/admin/api/route-leases/")) {
+      await handleRouteLeaseApi(req, res, path2, this.deps);
+      return;
+    }
     if (path2.startsWith("/admin/api/")) {
       await handleAdminApi(req, res, path2, this.deps);
       return;
@@ -5671,8 +6069,8 @@ var AdminServer = class {
   }
   /** Constant-time bearer/header check against the configured token. */
   isAuthorized(req, token) {
-    const header = req.headers["authorization"];
-    const bearer = typeof header === "string" && header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : void 0;
+    const header2 = req.headers["authorization"];
+    const bearer = typeof header2 === "string" && header2.startsWith("Bearer ") ? header2.slice("Bearer ".length).trim() : void 0;
     const xToken = req.headers["x-admin-token"];
     const presented = bearer ?? (typeof xToken === "string" ? xToken.trim() : void 0);
     return constantTimeEquals(presented, token);
@@ -5768,20 +6166,36 @@ var OAuthSessionStore = class {
     return sessionId;
   }
   /**
-   * SINGLE-USE consume: return + delete the session for `sessionId`, or `null`
-   * when it is unknown, already used, or past its TTL (in which case it is
-   * dropped). A `null` return means the completer must reject (no exchange, no
-   * write).
+   * NON-DESTRUCTIVE lookup: return the session for `sessionId`, or `null` when
+   * it is unknown, already consumed, or past its TTL (an expired entry is
+   * dropped here). A `null` return means the completer must reject (no
+   * exchange, no write).
+   *
+   * Deliberately NOT a consume: the completer peeks, runs the token exchange,
+   * and only {@link consume}s once a token has actually been minted. Consuming
+   * up-front burned the session on EVERY failed exchange (a mistyped/expired
+   * pasted code, a proxy hiccup), so the user's natural retry hit
+   * "session is unknown, expired, or already used" and the login became
+   * unrecoverable without restarting the whole flow.
    */
-  take(sessionId) {
+  peek(sessionId) {
     this.sweep();
     const session = this.sessions.get(sessionId);
     if (!session) return null;
-    this.sessions.delete(sessionId);
-    if (Date.now() - session.createdAt > this.ttlMs) return null;
+    if (Date.now() - session.createdAt > this.ttlMs) {
+      this.sessions.delete(sessionId);
+      return null;
+    }
     return session;
   }
-  /** Drop every session past its TTL. Called on each put/take. */
+  /**
+   * SINGLE-USE burn: drop the session so the same `sessionId` can never be
+   * completed twice. Called ONLY after a successful token exchange.
+   */
+  consume(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+  /** Drop every session past its TTL. Called on each put/peek. */
   sweep() {
     const now = Date.now();
     for (const [id, session] of this.sessions) {
@@ -5796,6 +6210,10 @@ var LOOPBACK_HOST = "127.0.0.1";
 var LOOPBACK_PORT = 1455;
 var CALLBACK_PATH = "/auth/callback";
 var DEFAULT_TIMEOUT_MS = 5 * 6e4;
+var HTML_HEADERS = {
+  "Content-Type": "text/html",
+  Connection: "close"
+};
 function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
@@ -5806,30 +6224,31 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      server2.close(() => fn());
+      fn();
+      server2.close();
     };
     const server = (0, import_node_http3.createServer)((req, res) => {
       const url = new URL(req.url ?? "", `http://${LOOPBACK_HOST}:${LOOPBACK_PORT}`);
       if (url.pathname !== CALLBACK_PATH) {
-        res.writeHead(404, { "Content-Type": "text/html" });
+        res.writeHead(404, HTML_HEADERS);
         res.end(pageHtml("Not found"));
         return;
       }
       const code = url.searchParams.get("code");
       const state = url.searchParams.get("state");
       if (!code) {
-        res.writeHead(400, { "Content-Type": "text/html" });
+        res.writeHead(400, HTML_HEADERS);
         res.end(pageHtml("Login failed: missing authorization code."));
         finish(server, () => reject(new Error("login: callback did not include an authorization code")));
         return;
       }
       if (state !== expectedState) {
-        res.writeHead(400, { "Content-Type": "text/html" });
+        res.writeHead(400, HTML_HEADERS);
         res.end(pageHtml("Login failed: state mismatch."));
         finish(server, () => reject(new Error("login: callback state did not match (possible CSRF) \u2014 aborting")));
         return;
       }
-      res.writeHead(200, { "Content-Type": "text/html" });
+      res.writeHead(200, HTML_HEADERS);
       res.end(pageHtml("Login complete."));
       finish(server, () => resolve2(code));
     });
@@ -5926,30 +6345,30 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-var import_node_path8 = require("path");
+var import_node_path7 = require("path");
 function defaultVouchersPath(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "vouchers.json");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "vouchers.json");
 }
 function defaultIntegrationsPath(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "integrations.json");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "integrations.json");
 }
 function defaultPricingPath(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "pricing.json");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "pricing.json");
 }
 function defaultPricingRefreshStatePath(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "pricing-refresh.json");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "pricing-refresh.json");
 }
 function defaultAccountAllowancePath(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "allowance-cache.json");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "allowance-cache.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "usage-events.jsonl");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "audit");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "billing");
+  return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
@@ -6342,8 +6761,12 @@ var JsonlUsageEventStore = class {
       reasoningTokens: 0,
       costUsd: 0,
       costSavedByCacheUsd: 0,
-      eventCount: 0
+      eventCount: 0,
+      cacheEligibleEventCount: 0,
+      coldCacheEventCount: 0,
+      medianCacheHitRate: null
     };
+    const perEventHitRates = [];
     for (const row of this.readRows(range)) {
       totals.inputTokens += row.inputTokens;
       totals.outputTokens += row.outputTokens;
@@ -6353,7 +6776,14 @@ var JsonlUsageEventStore = class {
       totals.costUsd += row.costUsd;
       totals.costSavedByCacheUsd += row.costSavedByCacheUsd;
       totals.eventCount += 1;
+      const promptSideTokens = row.inputTokens + row.cacheReadTokens + row.cacheCreationTokens;
+      if (promptSideTokens > 0) {
+        totals.cacheEligibleEventCount += 1;
+        if (row.cacheReadTokens === 0) totals.coldCacheEventCount += 1;
+        perEventHitRates.push(row.cacheReadTokens / promptSideTokens);
+      }
     }
+    totals.medianCacheHitRate = median(perEventHitRates);
     return totals;
   }
   async getByModel(range) {
@@ -6587,6 +7017,15 @@ var NUMERIC_FIELDS = [
 ];
 var NULLABLE_STRING_FIELDS = ["messageId", "parentMessageId", "sessionId", "apiKeyId"];
 var isStringOrNull = (v) => v === null || typeof v === "string";
+var CACHE_KEY_SOURCES = /* @__PURE__ */ new Set([
+  "client",
+  "session-header",
+  "thread-header",
+  "body-session-id",
+  "body-thread-id",
+  "content-fingerprint",
+  "none"
+]);
 function isUsageEventRecord(parsed) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
   const r = parsed;
@@ -6594,6 +7033,10 @@ function isUsageEventRecord(parsed) {
   if (typeof r["providerId"] !== "string") return false;
   if (typeof r["model"] !== "string") return false;
   if (typeof r["engineOrigin"] !== "string") return false;
+  if (r["cacheKeySource"] !== void 0 && (typeof r["cacheKeySource"] !== "string" || !CACHE_KEY_SOURCES.has(r["cacheKeySource"]))) return false;
+  if (r["cacheKeyInjected"] !== void 0 && typeof r["cacheKeyInjected"] !== "boolean") {
+    return false;
+  }
   for (const f of NULLABLE_STRING_FIELDS) {
     if (!isStringOrNull(r[f])) return false;
   }
@@ -6603,14 +7046,30 @@ function isUsageEventRecord(parsed) {
   }
   return true;
 }
+function median(values) {
+  if (values.length === 0) return null;
+  values.sort((a, b) => a - b);
+  const middle = Math.floor(values.length / 2);
+  return values.length % 2 === 1 ? values[middle] : (values[middle - 1] + values[middle]) / 2;
+}
 
 // src/ports/JsonOutboundKeyDb.ts
 var import_node_fs11 = require("fs");
 var JsonOutboundKeyDb = class {
-  constructor(keysPath) {
+  /**
+   * @param secretBox OPTIONAL reversible-secret codec. When present, a created
+   * key's plaintext is persisted as a `keySecret` `enc:` envelope (enabling the
+   * operator "view key" affordance via `outboundApiKeysReveal`). When absent the
+   * store stays hash-only (byte-identical to the legacy behavior) and reveal
+   * always returns `null`. Existing 1-arg call sites (tests, lightweight
+   * embedders) keep working.
+   */
+  constructor(keysPath, secretBox3) {
     this.keysPath = keysPath;
+    this.secretBox = secretBox3;
   }
   keysPath;
+  secretBox;
   async outboundApiKeysList() {
     return this.readRows();
   }
@@ -6636,10 +7095,27 @@ var JsonOutboundKeyDb = class {
       allowedEndpoints: input.allowedEndpoints,
       loopbackOnly: input.loopbackOnly
     };
+    if (input.plaintext && this.secretBox) {
+      row.keySecret = this.secretBox.encrypt(input.plaintext);
+    }
     rows.push(row);
     this.writeRows(rows);
     return row;
   }
+  async outboundApiKeysReveal(id) {
+    const rows = this.readRows();
+    const row = rows.find((r) => r.id === id);
+    if (!row || !row.keySecret || !this.secretBox) return null;
+    return this.secretBox.decrypt(row.keySecret);
+  }
+  async outboundApiKeysDelete(id) {
+    const rows = this.readRows();
+    const idx = rows.findIndex((r) => r.id === id);
+    if (idx < 0) return false;
+    rows.splice(idx, 1);
+    this.writeRows(rows);
+    return true;
+  }
   async outboundApiKeysRevoke(id) {
     return this.mutateRow(id, (row) => {
       if (row.revokedAt !== null) return false;
@@ -7088,7 +7564,7 @@ var JsonVoucherDb = class {
 
 // src/ports/JsonSubscriptionCredentialStore.ts
 var import_node_fs16 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path9 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
@@ -7138,10 +7614,10 @@ function findDuplicateCredentialIds(accounts) {
 
 // src/ports/external-cli-credentials.ts
 var import_node_fs15 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path9 = require("path");
-function externalStorePath(provider, home = (0, import_node_os3.homedir)()) {
-  return provider === "claude" ? (0, import_node_path9.join)(home, ".claude", ".credentials.json") : (0, import_node_path9.join)(home, ".codex", "auth.json");
+var import_node_os4 = require("os");
+var import_node_path8 = require("path");
+function externalStorePath(provider, home = (0, import_node_os4.homedir)()) {
+  return provider === "claude" ? (0, import_node_path8.join)(home, ".claude", ".credentials.json") : (0, import_node_path8.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -7188,7 +7664,7 @@ function parseCodexTokensEnvelope(raw) {
   }
   return parsed;
 }
-function readExternalCliCredentials(provider, home = (0, import_node_os3.homedir)()) {
+function readExternalCliCredentials(provider, home = (0, import_node_os4.homedir)()) {
   const path2 = externalStorePath(provider, home);
   if (!(0, import_node_fs15.existsSync)(path2)) return null;
   let raw;
@@ -7231,9 +7707,15 @@ var JsonSubscriptionCredentialStore = class {
    * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
    * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
    * ctx so the per-account/provider proxy applies. `@internal` also a test seam.
+   *
+   * `redactBodies` is REQUIRED here: this round-trip sends the refresh_token and
+   * receives a fresh access/refresh token pair. Carrying a `providerId` opts the
+   * call into the upstream trace (so a failing refresh is diagnosable), and the
+   * trace captures bodies verbatim — without this flag every refresh would write
+   * a plaintext token pair into `upstream-trace.jsonl`.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
   }
   /**
    * In-flight refresh coalescing. OAuth refresh tokens are
@@ -7758,7 +8240,7 @@ var JsonSubscriptionCredentialStore = class {
    *  `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
    *  write incl. child 4's future refresh writes lands encrypted. */
   persist(config) {
-    (0, import_node_fs16.mkdirSync)((0, import_node_path10.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs16.mkdirSync)((0, import_node_path9.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
     (0, import_node_fs16.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
@@ -7793,6 +8275,124 @@ var JsonSubscriptionCredentialStore = class {
 // src/AccountHealthProbeScheduler.ts
 var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 
+// src/probe/CodexGenerationProbe.ts
+var import_codexCliHeaders = require("@omnicross/core/provider-proxy/identity/codexCliHeaders");
+var CODEX_GENERATION_PROBE_MODEL = "gpt-5.6-luna";
+var CODEX_GENERATION_PROBE_URL = "https://chatgpt.com/backend-api/codex/responses";
+var MAX_STREAM_BYTES = 256 * 1024;
+var PROBE_INSTRUCTION = "Return exactly PONG and no other text.";
+function buildCodexGenerationProbeInit(token, signal) {
+  return {
+    method: "POST",
+    signal,
+    headers: {
+      ...import_codexCliHeaders.DEFAULT_CODEX_CLI_HEADERS,
+      Authorization: `Bearer ${token}`,
+      Accept: (0, import_codexCliHeaders.codexAcceptHeader)(true),
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      model: CODEX_GENERATION_PROBE_MODEL,
+      input: [
+        {
+          role: "developer",
+          content: [{ type: "input_text", text: PROBE_INSTRUCTION }]
+        },
+        {
+          role: "user",
+          content: [{ type: "input_text", text: "Connection probe." }]
+        }
+      ],
+      // GPT-5.6 otherwise defaults to medium reasoning. A connectivity probe
+      // needs the lowest-cost path and no tool reasoning.
+      reasoning: { effort: "none" },
+      stream: true,
+      store: false
+    })
+  };
+}
+async function readCodexGenerationProbeStream(response) {
+  if (!response.body) return { completed: false, outputChars: 0 };
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let bytes = 0;
+  let outputChars = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > MAX_STREAM_BYTES) {
+        await reader.cancel();
+        return { completed: false, outputChars };
+      }
+      buffer += decoder.decode(value, { stream: true });
+      buffer = buffer.replace(/\r\n/g, "\n");
+      let boundary = buffer.indexOf("\n\n");
+      while (boundary >= 0) {
+        const block = buffer.slice(0, boundary);
+        buffer = buffer.slice(boundary + 2);
+        const event = parseSseBlock(block);
+        if (event) {
+          const type = event["type"];
+          if (type === "response.output_text.delta" && typeof event["delta"] === "string") {
+            outputChars += event["delta"].length;
+          } else if (type === "response.output_text.done" && typeof event["text"] === "string") {
+            outputChars = Math.max(outputChars, event["text"].length);
+          } else if (type === "response.failed" || type === "error") {
+            await reader.cancel();
+            return { completed: false, outputChars };
+          } else if (type === "response.completed") {
+            const completedResponse = asRecord(event["response"]);
+            const status = completedResponse?.["status"];
+            outputChars = Math.max(outputChars, countCompletedOutputChars(completedResponse));
+            await reader.cancel();
+            return {
+              completed: (status === void 0 || status === "completed") && outputChars > 0,
+              outputChars
+            };
+          }
+        }
+        boundary = buffer.indexOf("\n\n");
+      }
+    }
+  } catch {
+    return { completed: false, outputChars };
+  } finally {
+    reader.releaseLock();
+  }
+  return { completed: false, outputChars };
+}
+function parseSseBlock(block) {
+  const data = block.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+  if (!data || data === "[DONE]") return null;
+  try {
+    return JSON.parse(data);
+  } catch {
+    return null;
+  }
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" ? value : void 0;
+}
+function countCompletedOutputChars(response) {
+  const output = response?.["output"];
+  if (!Array.isArray(output)) return 0;
+  let chars = 0;
+  for (const item of output) {
+    const content = asRecord(item)?.["content"];
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      const record = asRecord(part);
+      if (record?.["type"] === "output_text" && typeof record["text"] === "string") {
+        chars += record["text"].length;
+      }
+    }
+  }
+  return chars;
+}
+
 // src/probe/ProbeStrategy.ts
 var PROVIDER_PROBE_PLANS = {
   claude: {
@@ -7920,17 +8520,17 @@ var AccountHealthProbeScheduler = class {
     }
     if (readThrew) {
       this.record(providerId, accountId, { ts: now, ok: false, status: null, tier: "local" });
-      return { ok: false, marked: false };
+      return { ok: false, marked: false, tier: "local" };
     }
     if (!token) {
       this.health.recordUpstreamOutcome(providerId, accountId, { status: 401, now });
       this.record(providerId, accountId, { ts: now, ok: false, status: 401, tier: "local" });
-      return { ok: false, marked: true };
+      return { ok: false, marked: true, tier: "local" };
     }
     const plan = this.planFor(providerId);
     if (plan.kind === "local") {
       this.record(providerId, accountId, { ts: now, ok: true, tier: "local" });
-      return { ok: true, marked: false };
+      return { ok: true, marked: false, tier: "local" };
     }
     const start = this.now();
     let status = null;
@@ -7955,7 +8555,60 @@ var AccountHealthProbeScheduler = class {
       latencyMs,
       tier: "upstream"
     });
-    return { ok: status !== null && status < 400, marked };
+    return { ok: status !== null && status < 400, marked, tier: "upstream" };
+  }
+  /**
+   * Manual connection test. Codex performs a real, quota-consuming generation;
+   * every other provider keeps its existing cheap probe. Scheduled sweeps never
+   * call this method, so they remain non-billable.
+   */
+  async testAccountConnection(providerId, accountId) {
+    if (providerId !== "codex") return this.probeAccount(providerId, accountId);
+    const now = this.now();
+    let token;
+    try {
+      token = await this.store.getAccessTokenForAccount(providerId, accountId);
+    } catch {
+      this.record(providerId, accountId, { ts: now, ok: false, status: null, tier: "local" });
+      return { ok: false, marked: false, tier: "local", model: CODEX_GENERATION_PROBE_MODEL };
+    }
+    if (!token) {
+      this.health.recordUpstreamOutcome(providerId, accountId, { status: 401, now });
+      this.record(providerId, accountId, { ts: now, ok: false, status: 401, tier: "local" });
+      return { ok: false, marked: true, tier: "local", model: CODEX_GENERATION_PROBE_MODEL };
+    }
+    const startedAt = this.now();
+    let attempt = await this.runCodexGenerationAttempt(accountId, token);
+    if (attempt.status === 401 && this.store.refreshAccountToken) {
+      try {
+        if (await this.store.refreshAccountToken(providerId, accountId)) {
+          const refreshed = await this.store.getAccessTokenForAccount(providerId, accountId);
+          if (refreshed) attempt = await this.runCodexGenerationAttempt(accountId, refreshed);
+        }
+      } catch {
+      }
+    }
+    const latencyMs = this.now() - startedAt;
+    const ok = attempt.status !== null && attempt.status >= 200 && attempt.status < 300 && attempt.completed;
+    let marked = false;
+    if (ok) {
+      this.health.clearTransientMark(providerId, accountId);
+    } else if (attempt.status === 401 || attempt.status === 403) {
+      marked = this.applyOutcome(providerId, accountId, attempt.status, attempt.bodyText, now);
+    }
+    this.record(providerId, accountId, {
+      ts: now,
+      ok,
+      status: attempt.status,
+      latencyMs,
+      tier: "generation"
+    });
+    return {
+      ok,
+      marked,
+      tier: "generation",
+      model: CODEX_GENERATION_PROBE_MODEL
+    };
   }
   /** Per-account rolling history for the authed admin surface (design D5). */
   getAllHistory() {
@@ -8012,6 +8665,24 @@ var AccountHealthProbeScheduler = class {
       return "";
     }
   }
+  async runCodexGenerationAttempt(accountId, token) {
+    try {
+      const timeoutMs = Math.max(this.config.timeoutMs, 15e3);
+      const response = await this.fetchImpl(
+        CODEX_GENERATION_PROBE_URL,
+        buildCodexGenerationProbeInit(token, AbortSignal.timeout(timeoutMs)),
+        { providerId: "codex", accountId, redactBodies: true }
+      );
+      if (response.status < 200 || response.status >= 300) {
+        const bodyText = response.status === 403 ? await this.readBounded(response) : void 0;
+        return { status: response.status, completed: false, bodyText };
+      }
+      const stream = await readCodexGenerationProbeStream(response);
+      return { status: response.status, completed: stream.completed };
+    } catch {
+      return { status: null, completed: false };
+    }
+  }
   key(providerId, accountId) {
     return `${providerId}${KEY_SEP}${accountId}`;
   }
@@ -8107,7 +8778,7 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-var import_node_fs17 = require("fs");
+var import_node_fs18 = require("fs");
 var import_node_path11 = require("path");
 
 // src/audit/auditFiles.ts
@@ -8130,12 +8801,206 @@ function auditFileDateMs(fileName) {
   return d.getTime();
 }
 
+// src/audit/auditStats.ts
+var import_node_fs17 = require("fs");
+var import_node_path10 = require("path");
+var SIDECAR_VERSION = 1;
+var META_PREFIX_BYTES = 64 * 1024;
+var READ_CHUNK_BYTES = 4 * 1024 * 1024;
+function auditStatsFileName(auditFile) {
+  return auditFile.replace(/\.jsonl$/, ".stats.json");
+}
+function readPersisted(path2) {
+  if (!(0, import_node_fs17.existsSync)(path2)) return null;
+  try {
+    const value = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
+    if (value.version !== SIDECAR_VERSION || !Number.isSafeInteger(value.auditBytes) || (value.auditBytes ?? -1) < 0 || !Number.isSafeInteger(value.requestCount) || (value.requestCount ?? -1) < 0 || !Number.isSafeInteger(value.errorCount) || (value.errorCount ?? -1) < 0 || (value.errorCount ?? 0) > (value.requestCount ?? -1) || typeof value.complete !== "boolean" || value.minTs !== null && !Number.isFinite(value.minTs) || value.maxTs !== null && !Number.isFinite(value.maxTs)) {
+      return null;
+    }
+    return value;
+  } catch {
+    return null;
+  }
+}
+function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfter, record) {
+  const statsPath = (0, import_node_path10.join)((0, import_node_path10.dirname)(auditPath), auditStatsFileName((0, import_node_path10.basename)(auditPath)));
+  const previous = auditBytesBefore === 0 ? {
+    version: SIDECAR_VERSION,
+    auditBytes: 0,
+    requestCount: 0,
+    errorCount: 0,
+    complete: true,
+    minTs: null,
+    maxTs: null
+  } : readPersisted(statsPath);
+  if (!previous || !previous.complete || previous.auditBytes !== auditBytesBefore) return;
+  const next = {
+    version: SIDECAR_VERSION,
+    auditBytes: auditBytesAfter,
+    requestCount: previous.requestCount + 1,
+    errorCount: previous.errorCount + (record.status >= 400 || Boolean(record.error) ? 1 : 0),
+    complete: true,
+    minTs: previous.minTs === null ? record.ts : Math.min(previous.minTs, record.ts),
+    maxTs: previous.maxTs === null ? record.ts : Math.max(previous.maxTs, record.ts)
+  };
+  (0, import_node_fs17.writeFileSync)(statsPath, JSON.stringify(next), "utf8");
+}
+function queryCovers(stats, from, to) {
+  return stats.requestCount === 0 || stats.minTs !== null && stats.maxTs !== null && from <= stats.minTs && to >= stats.maxTs;
+}
+function fileOverlaps(file, from, to) {
+  const start = auditFileDateMs(file);
+  if (start === null) return false;
+  const date = new Date(start);
+  const end = new Date(date.getFullYear(), date.getMonth(), date.getDate() + 1).getTime();
+  return end > from && start <= to;
+}
+function parseMetadataPrefix(prefix, prefixTruncated) {
+  const text = prefix.toString("utf8");
+  const tsMatch = /(?:^|,)"ts":(-?\d+)/.exec(text);
+  const statusMatch = /(?:^|,)"status":(-?\d+)/.exec(text);
+  const errorMatch = /(?:^|,)"error":"((?:\\.|[^"\\])*)"/.exec(text);
+  const bodyStarted = /,(?:"requestBody"|"responseBody"):/.test(text);
+  return {
+    ts: tsMatch ? Number(tsMatch[1]) : void 0,
+    status: statusMatch ? Number(statusMatch[1]) : void 0,
+    hasError: Boolean(errorMatch?.[1]),
+    complete: Boolean(tsMatch && statusMatch && (!prefixTruncated || bodyStarted))
+  };
+}
+async function scanAuditFile(auditPath, startByte, auditBytes, from, to) {
+  let requestCount = 0;
+  let errorCount = 0;
+  let filteredRequestCount = 0;
+  let filteredErrorCount = 0;
+  let minTs = null;
+  let maxTs = null;
+  let complete = true;
+  let prefixParts = [];
+  let prefixBytes = 0;
+  let prefixTruncated = false;
+  const consumeLine = () => {
+    if (prefixBytes === 0 && !prefixTruncated) return;
+    const prefix = Buffer.concat(prefixParts, prefixBytes);
+    const metadata = parseMetadataPrefix(prefix, prefixTruncated);
+    if (!metadata.complete || metadata.ts === void 0 || metadata.status === void 0) {
+      complete = false;
+    } else {
+      requestCount += 1;
+      const isError = metadata.status >= 400 || metadata.hasError;
+      if (isError) errorCount += 1;
+      minTs = minTs === null ? metadata.ts : Math.min(minTs, metadata.ts);
+      maxTs = maxTs === null ? metadata.ts : Math.max(maxTs, metadata.ts);
+      if (metadata.ts >= from && metadata.ts <= to) {
+        filteredRequestCount += 1;
+        if (isError) filteredErrorCount += 1;
+      }
+    }
+    prefixParts = [];
+    prefixBytes = 0;
+    prefixTruncated = false;
+  };
+  if (auditBytes > startByte) {
+    const stream = (0, import_node_fs17.createReadStream)(auditPath, {
+      start: startByte,
+      end: auditBytes - 1,
+      highWaterMark: READ_CHUNK_BYTES
+    });
+    for await (const value of stream) {
+      const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+      let offset = 0;
+      while (offset < chunk.length) {
+        const newline = chunk.indexOf(10, offset);
+        const end = newline === -1 ? chunk.length : newline;
+        if (prefixBytes < META_PREFIX_BYTES) {
+          const retained = Math.min(META_PREFIX_BYTES - prefixBytes, end - offset);
+          if (retained > 0) {
+            prefixParts.push(Buffer.from(chunk.subarray(offset, offset + retained)));
+            prefixBytes += retained;
+          }
+          if (retained < end - offset) prefixTruncated = true;
+        } else if (end > offset) {
+          prefixTruncated = true;
+        }
+        if (newline === -1) break;
+        consumeLine();
+        offset = newline + 1;
+      }
+    }
+  }
+  if (prefixBytes > 0 || prefixTruncated) complete = false;
+  return {
+    all: {
+      version: SIDECAR_VERSION,
+      auditBytes,
+      requestCount,
+      errorCount,
+      complete,
+      minTs,
+      maxTs
+    },
+    filtered: { requestCount: filteredRequestCount, errorCount: filteredErrorCount, complete }
+  };
+}
+function mergePersistedStats(previous, appended) {
+  return {
+    version: SIDECAR_VERSION,
+    auditBytes: appended.auditBytes,
+    requestCount: previous.requestCount + appended.requestCount,
+    errorCount: previous.errorCount + appended.errorCount,
+    complete: previous.complete && appended.complete,
+    minTs: previous.minTs === null ? appended.minTs : appended.minTs === null ? previous.minTs : Math.min(previous.minTs, appended.minTs),
+    maxTs: previous.maxTs === null ? appended.maxTs : appended.maxTs === null ? previous.maxTs : Math.max(previous.maxTs, appended.maxTs)
+  };
+}
+async function readAuditStats(auditDir, query2 = {}) {
+  if (!(0, import_node_fs17.existsSync)(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
+  const from = typeof query2.from === "number" ? query2.from : -Infinity;
+  const to = typeof query2.to === "number" ? query2.to : Infinity;
+  let files;
+  try {
+    files = (0, import_node_fs17.readdirSync)(auditDir).filter((file) => AUDIT_FILE_RE.test(file) && fileOverlaps(file, from, to)).sort();
+  } catch {
+    return { requestCount: 0, errorCount: 0, complete: false };
+  }
+  const total = { requestCount: 0, errorCount: 0, complete: true };
+  for (const file of files) {
+    const auditPath = (0, import_node_path10.join)(auditDir, file);
+    try {
+      const auditBytes = (0, import_node_fs17.statSync)(auditPath).size;
+      const statsPath = (0, import_node_path10.join)(auditDir, auditStatsFileName(file));
+      const persisted = readPersisted(statsPath);
+      if (persisted && persisted.complete && persisted.auditBytes === auditBytes && queryCovers(persisted, from, to)) {
+        total.requestCount += persisted.requestCount;
+        total.errorCount += persisted.errorCount;
+        continue;
+      }
+      const resumable = persisted && persisted.complete && persisted.auditBytes < auditBytes && queryCovers(persisted, from, to) ? persisted : null;
+      const scanned = await scanAuditFile(
+        auditPath,
+        resumable?.auditBytes ?? 0,
+        auditBytes,
+        from,
+        to
+      );
+      total.requestCount += scanned.filtered.requestCount + (resumable?.requestCount ?? 0);
+      total.errorCount += scanned.filtered.errorCount + (resumable?.errorCount ?? 0);
+      total.complete = total.complete && scanned.filtered.complete;
+      const current = resumable ? mergePersistedStats(resumable, scanned.all) : scanned.all;
+      if (current.complete) (0, import_node_fs17.writeFileSync)(statsPath, JSON.stringify(current), "utf8");
+    } catch {
+      total.complete = false;
+    }
+  }
+  return total;
+}
+
 // src/audit/AuditPruneSweeper.ts
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir2;
+  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -8182,17 +9047,19 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!(0, import_node_fs17.existsSync)(this.auditDir)) return 0;
+      if (!(0, import_node_fs18.existsSync)(this.auditDir)) return 0;
       const today = new Date(this.now());
       const todayMidnight = new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
       const cutoff = todayMidnight - (this.config.retentionDays - 1) * DAY_MS;
       let removed = 0;
-      for (const file of (0, import_node_fs17.readdirSync)(this.auditDir)) {
+      for (const file of (0, import_node_fs18.readdirSync)(this.auditDir)) {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          (0, import_node_fs17.unlinkSync)((0, import_node_path11.join)(this.auditDir, file));
+          (0, import_node_fs18.unlinkSync)((0, import_node_path11.join)(this.auditDir, file));
           removed += 1;
+          const statsPath = (0, import_node_path11.join)(this.auditDir, auditStatsFileName(file));
+          if ((0, import_node_fs18.existsSync)(statsPath)) (0, import_node_fs18.unlinkSync)(statsPath);
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
             file,
@@ -8214,15 +9081,15 @@ var AuditPruneSweeper = class {
 };
 
 // src/audit/auditReader.ts
-var import_node_fs18 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_path12 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir2, query2 = {}) {
-  if (!(0, import_node_fs18.existsSync)(auditDir2)) return [];
+function readAuditRecords(auditDir, query2 = {}) {
+  if (!(0, import_node_fs19.existsSync)(auditDir)) return [];
   let files;
   try {
-    files = (0, import_node_fs18.readdirSync)(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
+    files = (0, import_node_fs19.readdirSync)(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
@@ -8233,7 +9100,7 @@ function readAuditRecords(auditDir2, query2 = {}) {
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = (0, import_node_fs18.readFileSync)((0, import_node_path12.join)(auditDir2, file), "utf8");
+      raw = (0, import_node_fs19.readFileSync)((0, import_node_path12.join)(auditDir, file), "utf8");
     } catch {
       continue;
     }
@@ -8262,11 +9129,11 @@ function isAuditRecord(value) {
 }
 
 // src/audit/AuditWriter.ts
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 var import_node_path13 = require("path");
 var AuditWriter = class {
-  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir2;
+  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir;
     this.logger = logger;
     this.defer = defer;
   }
@@ -8296,16 +9163,30 @@ var AuditWriter = class {
    */
   appendNow(record) {
     if (!this.dirEnsured) {
-      (0, import_node_fs19.mkdirSync)(this.auditDir, { recursive: true });
+      (0, import_node_fs20.mkdirSync)(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
     const file = (0, import_node_path13.join)(this.auditDir, auditFileName(record.ts));
-    (0, import_node_fs19.appendFileSync)(file, JSON.stringify(record) + "\n", "utf8");
+    const line = JSON.stringify(record) + "\n";
+    const auditBytesBefore = (0, import_node_fs20.existsSync)(file) ? (0, import_node_fs20.statSync)(file).size : 0;
+    (0, import_node_fs20.appendFileSync)(file, line, "utf8");
+    try {
+      updateAuditStatsAfterAppend(
+        file,
+        auditBytesBefore,
+        auditBytesBefore + Buffer.byteLength(line, "utf8"),
+        record
+      );
+    } catch (error) {
+      this.logger.warn("[AuditWriter] failed to update audit stats", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
   }
 };
 
 // src/billing/BillingPublisher.ts
-var import_node_fs20 = require("fs");
+var import_node_fs21 = require("fs");
 var import_node_crypto13 = require("crypto");
 var import_node_path14 = require("path");
 var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
@@ -8379,7 +9260,7 @@ var BillingPublisher = class {
   appendNow(event) {
     this.ensureDir();
     const file = (0, import_node_path14.join)(this.billingDir, billingFileName(event.ts));
-    (0, import_node_fs20.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
+    (0, import_node_fs21.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
    * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
@@ -8429,7 +9310,7 @@ var BillingPublisher = class {
     try {
       this.ensureDir();
       const file = (0, import_node_path14.join)(this.billingDir, deliveredFileName(event.ts));
-      (0, import_node_fs20.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
+      (0, import_node_fs21.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
         error: error instanceof Error ? error.message : String(error)
@@ -8438,20 +9319,20 @@ var BillingPublisher = class {
   }
   ensureDir() {
     if (this.dirEnsured) return;
-    (0, import_node_fs20.mkdirSync)(this.billingDir, { recursive: true });
+    (0, import_node_fs21.mkdirSync)(this.billingDir, { recursive: true });
     this.dirEnsured = true;
   }
 };
 
 // src/billing/billingReader.ts
-var import_node_fs21 = require("fs");
+var import_node_fs22 = require("fs");
 var import_node_path15 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!(0, import_node_fs21.existsSync)(billingDir)) return view;
+  if (!(0, import_node_fs22.existsSync)(billingDir)) return view;
   let files;
   try {
-    files = (0, import_node_fs21.readdirSync)(billingDir);
+    files = (0, import_node_fs22.readdirSync)(billingDir);
   } catch {
     return view;
   }
@@ -8482,7 +9363,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs21.readFileSync)((0, import_node_path15.join)(dir, file), "utf8");
+    raw = (0, import_node_fs22.readFileSync)((0, import_node_path15.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -8668,6 +9549,76 @@ var TokenRefreshScheduler = class {
   }
 };
 
+// src/routeLeaseSubscriptionPreflight.ts
+var import_provider_proxy3 = require("@omnicross/core/provider-proxy");
+var import_AccountAllowanceScheduling4 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_SubscriptionAccountHealth3 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_accountModelMap = require("@omnicross/subscriptions/scheduler/accountModelMap");
+var PROVIDERS = /* @__PURE__ */ new Set(["claude", "codex", "gemini", "opencodego"]);
+function accountArray(config, providerId) {
+  const record = config;
+  const key = `${providerId}Accounts`;
+  const accounts = record[key];
+  if (Array.isArray(accounts)) return accounts;
+  const legacy = record[providerId];
+  if (!legacy || typeof legacy !== "object") return [];
+  const activeKey = `active${providerId[0].toUpperCase()}${providerId.slice(1)}AccountId`;
+  return [{ id: String(record[activeKey] ?? "active"), enabled: true, tokens: legacy }];
+}
+function hasCredential(providerId, account) {
+  const tokens = account.tokens;
+  if (providerId === "opencodego") return typeof tokens.apiKey === "string" && tokens.apiKey.length > 0;
+  return typeof tokens.accessToken === "string" && tokens.accessToken.length > 0;
+}
+function safeProviderId(value) {
+  if (!PROVIDERS.has(value)) {
+    throw new import_provider_proxy3.RouteLeaseError("upstream_not_found", "subscription provider was not found");
+  }
+  return value;
+}
+function createRouteLeaseSubscriptionPreflight(credentials) {
+  return {
+    async assertAvailable(upstream, model) {
+      const providerId = safeProviderId(upstream.providerId);
+      const config = await credentials.getFullConfig();
+      const all = accountArray(config, providerId);
+      if (all.length === 0) {
+        throw new import_provider_proxy3.RouteLeaseError("upstream_unavailable", "subscription provider has no configured account");
+      }
+      let bounded = all;
+      if (upstream.kind === "account") {
+        bounded = all.filter((account) => account.id === upstream.accountId);
+      } else if (upstream.kind === "account-group") {
+        bounded = all.filter((account) => account.group?.trim() === upstream.group);
+      }
+      if (bounded.length === 0) {
+        throw new import_provider_proxy3.RouteLeaseError("upstream_not_found", "the selected subscription resource was not found");
+      }
+      const modelEligible = bounded.filter(
+        (account) => (0, import_accountModelMap.accountSupportsModel)(account.supportedModels, model)
+      );
+      if (modelEligible.length === 0) {
+        throw new import_provider_proxy3.RouteLeaseError("model_not_configured", "model is not supported by the selected subscription resource");
+      }
+      const credentialEligible = modelEligible.filter(
+        (account) => account.enabled !== false && hasCredential(providerId, account)
+      );
+      const health2 = (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)();
+      const allowance = (0, import_AccountAllowanceScheduling4.getSharedAccountAllowanceScheduling)();
+      const candidates = credentialEligible.filter(
+        (account) => health2.isSchedulable(providerId, account.id) && allowance.preview(providerId, account.id, account.priority ?? 50).schedulable
+      );
+      if (candidates.length > 0) return;
+      if (upstream.kind === "account") {
+        throw new import_provider_proxy3.RouteLeaseError("upstream_unavailable", "the selected subscription account is unavailable");
+      }
+      throw new import_provider_proxy3.RouteLeaseError("upstream_exhausted", "the selected subscription pool has no eligible account", {
+        retryAfterSeconds: 30
+      });
+    }
+  };
+}
+
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto14 = require("crypto");
 var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
@@ -8850,11 +9801,11 @@ function buildDaemon(config, paths) {
     new JsonAccountAllowancePersistence(defaultAccountAllowancePath(paths.configPath))
   );
   (0, import_AccountAllowanceStore4.setSharedAccountAllowanceStore)(accountAllowanceStore);
-  (0, import_AccountAllowanceScheduling4.getSharedAccountAllowanceScheduling)().configure(
+  (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(
     (0, import_outbound_api4.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
-  const keyDb = new JsonOutboundKeyDb(paths.keysPath);
+  const keyDb = new JsonOutboundKeyDb(paths.keysPath, secretBox3);
   const voucherDb = new JsonVoucherDb(defaultVouchersPath(paths.configPath));
   const settingsStore = new JsonApiServerSettingsStore(paths.configPath, secretBox3);
   const integrationStateStore = new IntegrationStateStore(
@@ -8917,11 +9868,22 @@ function buildDaemon(config, paths) {
   const usageRecorder = new import_usage.UsageRecorder(usageEventStore, pricingEngine, logger, {
     onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at)
   });
-  const providerProxy = (0, import_provider_proxy.getProviderProxy)({ llmConfig, apiKeyPool, usageRecorder });
+  const providerProxy = (0, import_provider_proxy4.getProviderProxy)({ llmConfig, apiKeyPool, usageRecorder });
+  const routeLeaseManager = new import_provider_proxy4.RouteLeaseManager(
+    providerProxy,
+    new import_provider_proxy4.RouteLeaseTargetResolver(llmConfig, {
+      providerKeys: apiKeyPool,
+      subscriptions: createRouteLeaseSubscriptionPreflight(credentialStore)
+    }),
+    import_cli_launcher2.routeLeaseDescriptorPort,
+    { logger }
+  );
+  providerProxy.registerBeforeStop(() => routeLeaseManager.shutdown());
+  providerProxy.registerBeforeStop(() => resetCliSessions());
   llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
   const accountHealthProbeScheduler = new AccountHealthProbeScheduler(
     credentialStore,
-    (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)(),
+    (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)(),
     logger,
     import_outbound_api4.DEFAULT_ACCOUNT_PROBE
   );
@@ -8955,7 +9917,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir2 = defaultAuditDir(paths.configPath);
+  const auditDir = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -8968,6 +9930,7 @@ function buildDaemon(config, paths) {
     keySpendReader: keySpendTracker,
     settingsStore,
     outboundApiServer,
+    routeLeaseManager,
     subscriptionAccounts,
     accountAllowanceService,
     allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
@@ -8989,10 +9952,16 @@ function buildDaemon(config, paths) {
     // (NOT widening the least-authority writer — no token-returning read reachable).
     oauthSessions: new OAuthSessionStore(),
     // Real global fetch by default; a test seam (`paths.oauthExchangeFetch`) can
-    // inject a mock so no real token endpoint is hit.
-    // upstream-proxy: default the OAuth token-exchange fetch to the proxy-aware
-    // helper so interactive login honors a configured proxy (global/env layers).
-    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)),
+    // inject a mock so no real token endpoint is hit (one FetchLike for every
+    // provider — the ctx below only matters on the real egress path).
+    //
+    // upstream-proxy: a PER-PROVIDER factory, so the exchange carries the same
+    // `{ providerId }` ctx the CLI login and the token refresh already pass.
+    // Without it the interactive login resolved only the global/env proxy layers
+    // — `server.proxy.byProvider[...]` was silently skipped — and the call was
+    // excluded from the upstream trace, so a failing login left no evidence.
+    // `redactBodies` keeps the code/verifier + minted token out of that trace.
+    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { providerId, redactBodies: true }),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -9044,7 +10013,8 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query2) => readAuditRecords(auditDir2, query2),
+    auditReader: (query2) => readAuditRecords(auditDir, query2),
+    auditStatsReader: (query2) => readAuditStats(auditDir, query2),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -9053,10 +10023,10 @@ function buildDaemon(config, paths) {
     logger,
     fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
   });
-  setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)());
-  const auditWriter = new AuditWriter(auditDir2, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
+  setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
+  const auditWriter = new AuditWriter(auditDir, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,
@@ -9068,7 +10038,7 @@ function buildDaemon(config, paths) {
   const tokenRefreshScheduler = new TokenRefreshScheduler(credentialStore, logger);
   const accountHealthSweeper = new AccountHealthSweeper(
     credentialStore,
-    (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)(),
+    (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)(),
     logger
   );
   return {
@@ -9077,6 +10047,7 @@ function buildDaemon(config, paths) {
     keyDb,
     settingsStore,
     providerProxy,
+    routeLeaseManager,
     outboundApiServer,
     apiKeyPool,
     autoDisableStore,
@@ -9101,7 +10072,7 @@ function buildDaemon(config, paths) {
   };
 }
 function resetDaemonSingletonsForTests() {
-  (0, import_provider_proxy.__resetProviderProxyForTests)();
+  (0, import_provider_proxy4.__resetProviderProxyForTests)();
   (0, import_outbound_api4.__resetOutboundApiServerForTests)();
   (0, import_subscriptionRegistryPort.setSubscriptionRegistryForOutbound)(null);
   (0, import_subscriptions4.setSubscriptionProviderRegistry)(null);
@@ -9116,12 +10087,12 @@ function resetDaemonSingletonsForTests() {
   resetBillingRuntimeForTests();
   (0, import_SubscriptionIdentityStore3.__resetSharedIdentityStoreForTests)();
   (0, import_AccountAllowanceStore4.__resetSharedAccountAllowanceStoreForTests)();
-  (0, import_AccountAllowanceScheduling4.__resetSharedAccountAllowanceSchedulingForTests)();
+  (0, import_AccountAllowanceScheduling5.__resetSharedAccountAllowanceSchedulingForTests)();
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!(0, import_node_fs22.existsSync)(tokensPath)) return true;
-    (0, import_node_fs22.accessSync)(tokensPath, import_node_fs22.constants.R_OK);
+    if (!(0, import_node_fs23.existsSync)(tokensPath)) return true;
+    (0, import_node_fs23.accessSync)(tokensPath, import_node_fs23.constants.R_OK);
     return true;
   } catch {
     return false;