@omnicross/daemon 0.1.7 → 0.1.8

package/dist/cli.cjs

@@ -1765,10 +1765,12 @@ async function keysRevoke(db, id) {
 
 // src/commands/launch.ts
 var import_node_child_process2 = require("child_process");
+var import_node_crypto15 = require("crypto");
 var import_node_fs25 = require("fs");
 var import_node_path17 = require("path");
 var import_node_util4 = require("util");
-var import_cli_launcher2 = require("@omnicross/cli-launcher");
+var import_cli_launcher3 = require("@omnicross/cli-launcher");
+var import_provider_proxy5 = require("@omnicross/core/provider-proxy");
 
 // src/bootstrap.ts
 var import_node_fs24 = require("fs");
@@ -1778,13 +1780,14 @@ var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/Gemin
 var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
 var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
-var import_SubscriptionAccountHealth3 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
-var import_AccountAllowanceScheduling4 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
-var import_provider_proxy = require("@omnicross/core/provider-proxy");
+var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
+var import_cli_launcher2 = require("@omnicross/cli-launcher");
 var import_outbound_api6 = require("@omnicross/core/outbound-api");
 var import_usage = require("@omnicross/core/usage");
 var import_subscriptions4 = require("@omnicross/subscriptions");
@@ -2467,6 +2470,88 @@ async function handleWebhookTest(req, res) {
   res.end(JSON.stringify({ result }));
 }
 
+// src/admin/routeLeaseApi.ts
+var import_provider_proxy = require("@omnicross/core/provider-proxy");
+var MAX_BODY_BYTES = 64 * 1024;
+var SAFE_LEASE_ID = /^[A-Za-z0-9-]{1,128}$/u;
+async function readJson(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > MAX_BODY_BYTES) throw new import_provider_proxy.RouteLeaseError("invalid_request", "request body is too large");
+    chunks.push(buffer);
+  }
+  if (chunks.length === 0) return {};
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new import_provider_proxy.RouteLeaseError("invalid_request", "request body is not valid JSON");
+  }
+}
+function json(res, status, body, noStore = false) {
+  res.statusCode = status;
+  res.setHeader("Content-Type", "application/json");
+  if (noStore) res.setHeader("Cache-Control", "no-store");
+  res.end(JSON.stringify(body));
+}
+function leaseId(value) {
+  if (!value || !SAFE_LEASE_ID.test(value)) throw new import_provider_proxy.RouteLeaseError("invalid_request", "lease id is invalid");
+  return value;
+}
+function header(req, name) {
+  const value = req.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function writeError(res, error, noStore) {
+  const safe = error instanceof import_provider_proxy.RouteLeaseError ? error : new import_provider_proxy.RouteLeaseError("upstream_unavailable", "route lease operation failed safely");
+  if (safe.retryAfterSeconds !== void 0) res.setHeader("Retry-After", String(safe.retryAfterSeconds));
+  json(res, safe.status, safe.toResponse(), noStore);
+}
+async function handleRouteLeaseApi(req, res, path2, deps) {
+  const method = (req.method ?? "GET").toUpperCase();
+  const noStore = method === "POST" && (path2 === "/admin/api/route-leases" || path2.endsWith("/renew"));
+  try {
+    if (!(0, import_provider_proxy.isLoopbackAddress)(req.socket.remoteAddress)) {
+      throw new import_provider_proxy.RouteLeaseError("control_unauthorized", "route lease control plane is loopback only");
+    }
+    const manager = deps.routeLeaseManager;
+    if (!manager) throw new import_provider_proxy.RouteLeaseError("daemon_not_ready", "route lease manager is unavailable");
+    const base = "/admin/api/route-leases";
+    const suffix = path2.slice(base.length).replace(/^\/+|\/+$/gu, "");
+    const segments = suffix ? suffix.split("/") : [];
+    if (segments.length === 1 && segments[0] === "capabilities") {
+      if (method !== "GET" && method !== "HEAD") throw new import_provider_proxy.RouteLeaseError("invalid_request", "method is not allowed");
+      return json(res, 200, import_provider_proxy.ROUTE_LEASE_CAPABILITIES);
+    }
+    if (segments.length === 0) {
+      if (method === "GET") return json(res, 200, { leases: manager.list() });
+      if (method === "POST") {
+        const outcome = await manager.createFromRequest(await readJson(req), header(req, "idempotency-key"));
+        return json(res, outcome.created ? 201 : 200, outcome.result, true);
+      }
+      throw new import_provider_proxy.RouteLeaseError("invalid_request", "method is not allowed");
+    }
+    const id = leaseId(segments[0]);
+    if (segments.length === 1) {
+      if (method === "GET") return json(res, 200, manager.get(id));
+      if (method === "DELETE") return json(res, 200, manager.release(id));
+      throw new import_provider_proxy.RouteLeaseError("invalid_request", "method is not allowed");
+    }
+    if (segments.length === 2 && segments[1] === "renew" && method === "POST") {
+      const body = await readJson(req);
+      const ttl = (0, import_provider_proxy.normalizeRouteLeaseTtl)(
+        body && typeof body === "object" && !Array.isArray(body) ? body.ttlSeconds : void 0
+      );
+      return json(res, 200, manager.renew(id, ttl), true);
+    }
+    throw new import_provider_proxy.RouteLeaseError("lease_not_found", "route lease endpoint was not found");
+  } catch (error) {
+    writeError(res, error, noStore);
+  }
+}
+
 // src/admin/adminApi.ts
 var import_node_http = __toESM(require("http"), 1);
 var import_outbound_api3 = require("@omnicross/core/outbound-api");
@@ -3016,8 +3101,34 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 var import_node_child_process = require("child_process");
 var import_node_crypto6 = require("crypto");
 var import_node_fs8 = require("fs");
+var import_node_net = require("net");
+var import_node_os3 = require("os");
 var import_node_path7 = require("path");
 var import_cli_launcher = require("@omnicross/cli-launcher");
+var import_provider_proxy2 = require("@omnicross/core/provider-proxy");
+
+// src/routeLeaseRenewal.ts
+var TERMINAL_LEASE_TTL_SECONDS = 600;
+var TERMINAL_LEASE_RENEW_INTERVAL_MS = 5 * 60 * 1e3;
+var TERMINAL_LEASE_MAX_LIFETIME_MS = 24 * 60 * 60 * 1e3;
+function startTerminalLeaseRenewal(manager, leaseId2) {
+  const stopAt = Date.now() + TERMINAL_LEASE_MAX_LIFETIME_MS;
+  const timer = setInterval(() => {
+    if (Date.now() >= stopAt) {
+      clearInterval(timer);
+      return;
+    }
+    try {
+      manager.renew(leaseId2, TERMINAL_LEASE_TTL_SECONDS);
+    } catch {
+      clearInterval(timer);
+    }
+  }, TERMINAL_LEASE_RENEW_INTERVAL_MS);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+
+// src/admin/cliLaunch.ts
 var LAUNCHABLE_CLIS = [
   { id: "claude", displayName: "Claude Code", command: "claude" },
   { id: "codex", displayName: "Codex CLI", command: "codex" },
@@ -3098,34 +3209,183 @@ async function buildLaunchEnv(cli, llmConfig, target) {
 function shq(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-var defaultTerminalOpener = ({ cli, command, extraArgs, env, cwd, platform }) => {
+var MAC_TERMINAL_BOOTSTRAP_SOURCE = `
+'use strict';
+const fs = require('node:fs');
+const net = require('node:net');
+const { spawn } = require('node:child_process');
+const [socketPath, launchDir, cwd, command, ...args] = process.argv.slice(2);
+let payload = '';
+const socket = net.createConnection(socketPath);
+socket.setEncoding('utf8');
+socket.on('data', (chunk) => { payload += chunk; });
+socket.on('end', () => {
+  const descriptor = JSON.parse(payload);
+  if (!descriptor || Array.isArray(descriptor) || Object.values(descriptor).some((value) => typeof value !== 'string')) {
+    throw new Error('invalid terminal launch descriptor');
+  }
+  try { fs.rmSync(launchDir, { recursive: true, force: true }); } catch {}
+  const child = spawn(command, args, {
+    cwd: cwd || undefined,
+    env: { ...process.env, ...descriptor },
+    stdio: 'inherit',
+  });
+  child.on('error', (error) => { console.error(error.message); process.exitCode = 1; });
+  child.on('exit', (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exitCode = code == null ? 1 : code;
+  });
+});
+socket.on('error', (error) => { console.error(error.message); process.exitCode = 1; });
+`;
+var MAC_TERMINAL_IPC_TIMEOUT_MS = 12e4;
+function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }, spawnProcess = import_node_child_process.spawn, macIpc = {}) {
   const childEnv = { ...process.env, ...env };
   if (platform === "win32") {
     const args = ["/c", "start", `"omnicross ${cli}"`];
     if (cwd) args.push("/D", `"${cwd}"`);
     args.push("cmd", "/k", command, ...extraArgs);
-    (0, import_node_child_process.spawn)(process.env["ComSpec"] || "cmd.exe", args, {
+    spawnProcess(process.env["ComSpec"] || "cmd.exe", args, {
       env: childEnv,
       windowsVerbatimArguments: true,
       detached: true,
       stdio: "ignore"
     }).unref();
-    return;
+    return () => {
+    };
   }
-  const exportLine = Object.entries(env).map(([k, v]) => `export ${k}=${shq(v)}`).join("; ");
   const runLine = [command, ...extraArgs].map(shq).join(" ");
-  const script = `${exportLine}; ${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
+  const script = `${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
   if (platform === "darwin") {
-    const osa = `tell application "Terminal" to do script ${JSON.stringify(script)}`;
-    (0, import_node_child_process.spawn)("osascript", ["-e", osa], { detached: true, stdio: "ignore" }).unref();
-    return;
+    const launchDir = (0, import_node_fs8.mkdtempSync)((0, import_node_path7.join)((0, import_node_os3.tmpdir)(), "omnicross-terminal-"));
+    const commandFile = (0, import_node_path7.join)(launchDir, "launch.command");
+    const bootstrapFile = (0, import_node_path7.join)(launchDir, "bootstrap.cjs");
+    const socketPath = macIpc.socketPath ?? (0, import_node_path7.join)(launchDir, "descriptor.sock");
+    const openerEnv = { ...process.env };
+    for (const key of Object.keys(env)) delete openerEnv[key];
+    let claimed = false;
+    let cleaned = false;
+    let failureNotified = false;
+    let timer;
+    const notifyFailure = () => {
+      cleanup();
+      if (failureNotified) return;
+      failureNotified = true;
+      try {
+        onFailure?.();
+      } catch {
+      }
+    };
+    const handleLaunchFailure = () => {
+      if (claimed) cleanup();
+      else notifyFailure();
+    };
+    const sockets = /* @__PURE__ */ new Set();
+    const server = (0, import_node_net.createServer)((socket) => {
+      socket.unref();
+      sockets.add(socket);
+      socket.once("close", () => sockets.delete(socket));
+      try {
+        macIpc.onAccepted?.(socket);
+      } catch {
+        cleanup();
+        return;
+      }
+      if (claimed || cleaned) {
+        socket.destroy();
+        return;
+      }
+      claimed = true;
+      try {
+        macIpc.onClaimed?.();
+        if (cleaned) return;
+        socket.end(JSON.stringify(env), cleanup);
+      } catch {
+        cleanup();
+      }
+    });
+    const cleanup = () => {
+      if (!cleaned) {
+        cleaned = true;
+        if (timer) clearTimeout(timer);
+        for (const socket of sockets) socket.destroy();
+        sockets.clear();
+        try {
+          server.close();
+        } catch {
+        }
+      }
+      try {
+        if (macIpc.removeArtifacts) {
+          macIpc.removeArtifacts(launchDir);
+        } else {
+          (0, import_node_fs8.rmSync)(launchDir, {
+            recursive: true,
+            force: true,
+            maxRetries: 3,
+            retryDelay: 20
+          });
+        }
+      } catch {
+      }
+    };
+    try {
+      (0, import_node_fs8.writeFileSync)(bootstrapFile, MAC_TERMINAL_BOOTSTRAP_SOURCE, { encoding: "utf8", mode: 448 });
+      (0, import_node_fs8.writeFileSync)(commandFile, `#!/bin/bash
+rm -f -- "$0"
+exec ${shq(process.execPath)} ${shq(bootstrapFile)} ${shq(socketPath)} ${shq(launchDir)} ${shq(cwd ?? "")} ${runLine}
+`, {
+        encoding: "utf8",
+        mode: 448
+      });
+      (0, import_node_fs8.chmodSync)(commandFile, 448);
+      (0, import_node_fs8.chmodSync)(bootstrapFile, 448);
+      server.once("error", handleLaunchFailure);
+      server.listen(socketPath, () => {
+        if (cleaned) return;
+        try {
+          macIpc.onListening?.();
+          if (cleaned) return;
+          if (process.platform !== "win32") (0, import_node_fs8.chmodSync)(socketPath, 384);
+          const opener = spawnProcess("open", ["-n", "-a", "Terminal", commandFile], {
+            env: openerEnv,
+            detached: true,
+            stdio: "ignore"
+          });
+          opener.once("error", handleLaunchFailure);
+          opener.unref();
+          server.unref();
+        } catch {
+          handleLaunchFailure();
+        }
+      });
+      timer = setTimeout(handleLaunchFailure, macIpc.timeoutMs ?? MAC_TERMINAL_IPC_TIMEOUT_MS);
+      timer.unref?.();
+      return cleanup;
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
   }
-  (0, import_node_child_process.spawn)("x-terminal-emulator", ["-e", "bash", "-lc", `${script}; exec bash`], {
+  spawnProcess("x-terminal-emulator", ["-e", "bash", "-lc", `${script}; exec bash`], {
+    env: childEnv,
     detached: true,
     stdio: "ignore"
   }).unref();
-};
+  return () => {
+  };
+}
+var defaultTerminalOpener = (input) => openTerminal(input);
 var sessions = /* @__PURE__ */ new Map();
+function resetCliSessions() {
+  for (const s of sessions.values()) {
+    try {
+      s.onSessionEnd();
+    } catch {
+    }
+  }
+  sessions.clear();
+}
 function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
@@ -3180,29 +3440,81 @@ async function handleCliLaunch(cli, body, ctx) {
   } catch (err5) {
     return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "no launch target") };
   }
+  const id = (0, import_node_crypto6.randomUUID)();
+  let leaseId2;
   let launch;
   try {
-    launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+    if ((cli === "claude" || cli === "codex") && ctx.routeLeaseManager) {
+      const outcome = await ctx.routeLeaseManager.createFromRequest({
+        schemaVersion: import_provider_proxy2.ROUTE_LEASE_REQUEST_SCHEMA,
+        consumer: "omnicross-terminal",
+        runtime: cli,
+        upstream: { kind: "provider", providerId: target.providerId },
+        model: target.model,
+        execution: { sessionId: id }
+      }, `omnicross-terminal:${id}`);
+      leaseId2 = outcome.result.leaseId;
+      const stopRenewal = startTerminalLeaseRenewal(ctx.routeLeaseManager, leaseId2);
+      launch = {
+        env: outcome.result.launch.env,
+        extraArgs: outcome.result.launch.extraArgs,
+        onSessionEnd: () => {
+          stopRenewal();
+          ctx.routeLeaseManager?.release(outcome.result.leaseId);
+        }
+      };
+    } else {
+      launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+    }
   } catch (err5) {
-    return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "failed to build launch env") };
+    const status = err5 instanceof import_provider_proxy2.RouteLeaseError ? err5.status : 400;
+    return { status, body: errBody(err5 instanceof Error ? err5.message : "failed to build launch env") };
   }
   const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
   const opener = ctx.opener ?? defaultTerminalOpener;
+  let openerCleanup;
+  let ended = false;
+  let published = false;
+  const onSessionEnd = () => {
+    if (ended) return;
+    ended = true;
+    if (published) sessions.delete(id);
+    try {
+      openerCleanup?.();
+    } finally {
+      launch.onSessionEnd();
+    }
+  };
   try {
-    opener({ cli, command: meta.command, extraArgs: launch.extraArgs ?? [], env: launch.env, cwd, platform });
+    const cleanup = opener({
+      cli,
+      command: meta.command,
+      extraArgs: launch.extraArgs ?? [],
+      env: launch.env,
+      cwd,
+      platform,
+      onFailure: onSessionEnd
+    });
+    if (cleanup) openerCleanup = cleanup;
   } catch (err5) {
-    launch.onSessionEnd();
+    onSessionEnd();
     return { status: 500, body: errBody(err5 instanceof Error ? err5.message : "failed to open terminal") };
   }
-  const id = (0, import_node_crypto6.randomUUID)();
+  if (ended) {
+    openerCleanup?.();
+    return { status: 500, body: errBody("failed to open terminal") };
+  }
   sessions.set(id, {
     id,
     cli,
     providerId: target.providerId,
     model: target.model,
+    ...leaseId2 ? { leaseId: leaseId2 } : {},
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    onSessionEnd: launch.onSessionEnd
+    onSessionEnd
   });
+  published = true;
+  if (ended) sessions.delete(id);
   return { status: 200, body: { sessionId: id, providerId: target.providerId, model: target.model } };
 }
 
@@ -4079,7 +4391,7 @@ function sealPack(bundleJson, passphrase) {
   cipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
   const ciphertext = Buffer.concat([cipher.update(bundleJson, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
-  const header = {
+  const header2 = {
     magic: PACK_MAGIC,
     v: PACK_VERSION,
     kdf: KDF_ALGORITHM,
@@ -4090,7 +4402,7 @@ function sealPack(bundleJson, passphrase) {
     iv: iv.toString("base64"),
     tag: tag.toString("base64")
   };
-  return `${PACK_PREFIX}${toB64Url(JSON.stringify(header))}.${ciphertext.toString("base64")}`;
+  return `${PACK_PREFIX}${toB64Url(JSON.stringify(header2))}.${ciphertext.toString("base64")}`;
 }
 function parsePack(packString) {
   if (typeof packString !== "string" || !packString.startsWith(PACK_PREFIX)) {
@@ -4101,28 +4413,28 @@ function parsePack(packString) {
   if (dot < 0) throw new PackAuthError("migration pack is malformed (missing body)");
   const headerB64Url = rest.slice(0, dot);
   const ctB64 = rest.slice(dot + 1);
-  let header;
+  let header2;
   try {
-    header = JSON.parse(fromB64Url(headerB64Url));
+    header2 = JSON.parse(fromB64Url(headerB64Url));
   } catch {
     throw new PackAuthError("migration pack is malformed (unreadable header)");
   }
-  if (!header || header.magic !== PACK_MAGIC || header.v !== PACK_VERSION || header.kdf !== KDF_ALGORITHM || typeof header.salt !== "string" || typeof header.iv !== "string" || typeof header.tag !== "string" || typeof header.N !== "number" || typeof header.r !== "number" || typeof header.p !== "number") {
+  if (!header2 || header2.magic !== PACK_MAGIC || header2.v !== PACK_VERSION || header2.kdf !== KDF_ALGORITHM || typeof header2.salt !== "string" || typeof header2.iv !== "string" || typeof header2.tag !== "string" || typeof header2.N !== "number" || typeof header2.r !== "number" || typeof header2.p !== "number") {
     throw new PackAuthError("migration pack is malformed (unsupported header)");
   }
   const ciphertext = Buffer.from(ctB64, "base64");
-  return { header, ciphertext };
+  return { header: header2, ciphertext };
 }
 function openPack(packString, passphrase) {
   assertPassphraseStrength(passphrase);
-  const { header, ciphertext } = parsePack(packString);
-  const salt = Buffer.from(header.salt, "base64");
-  const iv = Buffer.from(header.iv, "base64");
-  const tag = Buffer.from(header.tag, "base64");
+  const { header: header2, ciphertext } = parsePack(packString);
+  const salt = Buffer.from(header2.salt, "base64");
+  const iv = Buffer.from(header2.iv, "base64");
+  const tag = Buffer.from(header2.tag, "base64");
   if (iv.length !== IV_BYTES2 || tag.length !== TAG_BYTES2) {
     throw new PackAuthError("migration pack is malformed (invalid iv/tag length)");
   }
-  const key = deriveKey(passphrase, salt, header.N, header.r, header.p);
+  const key = deriveKey(passphrase, salt, header2.N, header2.r, header2.p);
   const decipher = (0, import_node_crypto8.createDecipheriv)("aes-256-gcm", key, iv);
   decipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
   decipher.setAuthTag(tag);
@@ -4458,10 +4770,10 @@ function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeError(res, status, message) {
+function writeError2(res, status, message) {
   writeJson2(res, status, { error: { type: "account_allowance_error", message } });
 }
-function readJson(req) {
+function readJson2(req) {
   return new Promise((resolve3, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
@@ -4487,10 +4799,10 @@ function allowanceProvider(value) {
   return value === "claude" || value === "codex" ? value : null;
 }
 async function handleAccountAllowanceApi(req, res, method, rest, service) {
-  if (!service) return writeError(res, 501, "account allowance service is not available");
+  if (!service) return writeError2(res, 501, "account allowance service is not available");
   if (method === "GET" && rest.length === 1 && rest[0] === "scheduling") {
     if (!service.getSchedulingStatus) {
-      return writeError(res, 501, "allowance scheduling diagnostics are not available");
+      return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
     return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
   }
@@ -4498,27 +4810,27 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     const params = query(req);
     const pathProvider = rest.length >= 2 ? rest[0] : null;
     const providerId = allowanceProvider(pathProvider ?? params.get("providerId") ?? params.get("provider"));
-    if (providerId === null) return writeError(res, 400, "providerId must be claude or codex");
+    if (providerId === null) return writeError2(res, 400, "providerId must be claude or codex");
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
     return writeJson2(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
-    const body = await readJson(req);
+    const body = await readJson2(req);
     const requestedProvider = allowanceProvider(
       typeof body["providerId"] === "string" ? body["providerId"] : "claude"
     );
     if (requestedProvider !== "claude") {
-      return writeError(res, 400, "only Claude allowances support explicit refresh");
+      return writeError2(res, 400, "only Claude allowances support explicit refresh");
     }
     const accountId = typeof body["accountId"] === "string" && body["accountId"].trim() ? body["accountId"].trim() : void 0;
     const allowances = await service.refreshClaude(accountId);
     if (accountId && allowances.length === 0) {
-      return writeError(res, 404, `Claude account '${accountId}' not found`);
+      return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
     return writeJson2(res, 200, { allowances });
   }
-  return writeError(res, 405, `method ${method} not allowed on account allowances`);
+  return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
 
 // src/admin/adminApi.ts
@@ -5750,6 +6062,7 @@ async function handleCli(req, res, method, rest, deps) {
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
       providers,
+      routeLeaseManager: deps.routeLeaseManager,
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
@@ -6013,7 +6326,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.7" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.8" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -6133,6 +6446,10 @@ var AdminServer = class {
       await handleWebhookTest(req, res);
       return;
     }
+    if (path2 === "/admin/api/route-leases" || path2.startsWith("/admin/api/route-leases/")) {
+      await handleRouteLeaseApi(req, res, path2, this.deps);
+      return;
+    }
     if (path2.startsWith("/admin/api/")) {
       await handleAdminApi(req, res, path2, this.deps);
       return;
@@ -6144,8 +6461,8 @@ var AdminServer = class {
   }
   /** Constant-time bearer/header check against the configured token. */
   isAuthorized(req, token) {
-    const header = req.headers["authorization"];
-    const bearer = typeof header === "string" && header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : void 0;
+    const header2 = req.headers["authorization"];
+    const bearer = typeof header2 === "string" && header2.startsWith("Bearer ") ? header2.slice("Bearer ".length).trim() : void 0;
     const xToken = req.headers["x-admin-token"];
     const presented = bearer ?? (typeof xToken === "string" ? xToken.trim() : void 0);
     return constantTimeEquals(presented, token);
@@ -7510,9 +7827,9 @@ function findDuplicateCredentialIds(accounts) {
 
 // src/ports/external-cli-credentials.ts
 var import_node_fs16 = require("fs");
-var import_node_os3 = require("os");
+var import_node_os4 = require("os");
 var import_node_path9 = require("path");
-function externalStorePath(provider, home = (0, import_node_os3.homedir)()) {
+function externalStorePath(provider, home = (0, import_node_os4.homedir)()) {
   return provider === "claude" ? (0, import_node_path9.join)(home, ".claude", ".credentials.json") : (0, import_node_path9.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
@@ -7560,7 +7877,7 @@ function parseCodexTokensEnvelope(raw) {
   }
   return parsed;
 }
-function readExternalCliCredentials(provider, home = (0, import_node_os3.homedir)()) {
+function readExternalCliCredentials(provider, home = (0, import_node_os4.homedir)()) {
   const path2 = externalStorePath(provider, home);
   if (!(0, import_node_fs16.existsSync)(path2)) return null;
   let raw;
@@ -9445,6 +9762,76 @@ var TokenRefreshScheduler = class {
   }
 };
 
+// src/routeLeaseSubscriptionPreflight.ts
+var import_provider_proxy3 = require("@omnicross/core/provider-proxy");
+var import_AccountAllowanceScheduling4 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_SubscriptionAccountHealth3 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_accountModelMap = require("@omnicross/subscriptions/scheduler/accountModelMap");
+var PROVIDERS = /* @__PURE__ */ new Set(["claude", "codex", "gemini", "opencodego"]);
+function accountArray(config, providerId) {
+  const record = config;
+  const key = `${providerId}Accounts`;
+  const accounts = record[key];
+  if (Array.isArray(accounts)) return accounts;
+  const legacy = record[providerId];
+  if (!legacy || typeof legacy !== "object") return [];
+  const activeKey = `active${providerId[0].toUpperCase()}${providerId.slice(1)}AccountId`;
+  return [{ id: String(record[activeKey] ?? "active"), enabled: true, tokens: legacy }];
+}
+function hasCredential(providerId, account) {
+  const tokens = account.tokens;
+  if (providerId === "opencodego") return typeof tokens.apiKey === "string" && tokens.apiKey.length > 0;
+  return typeof tokens.accessToken === "string" && tokens.accessToken.length > 0;
+}
+function safeProviderId(value) {
+  if (!PROVIDERS.has(value)) {
+    throw new import_provider_proxy3.RouteLeaseError("upstream_not_found", "subscription provider was not found");
+  }
+  return value;
+}
+function createRouteLeaseSubscriptionPreflight(credentials) {
+  return {
+    async assertAvailable(upstream, model) {
+      const providerId = safeProviderId(upstream.providerId);
+      const config = await credentials.getFullConfig();
+      const all = accountArray(config, providerId);
+      if (all.length === 0) {
+        throw new import_provider_proxy3.RouteLeaseError("upstream_unavailable", "subscription provider has no configured account");
+      }
+      let bounded = all;
+      if (upstream.kind === "account") {
+        bounded = all.filter((account) => account.id === upstream.accountId);
+      } else if (upstream.kind === "account-group") {
+        bounded = all.filter((account) => account.group?.trim() === upstream.group);
+      }
+      if (bounded.length === 0) {
+        throw new import_provider_proxy3.RouteLeaseError("upstream_not_found", "the selected subscription resource was not found");
+      }
+      const modelEligible = bounded.filter(
+        (account) => (0, import_accountModelMap.accountSupportsModel)(account.supportedModels, model)
+      );
+      if (modelEligible.length === 0) {
+        throw new import_provider_proxy3.RouteLeaseError("model_not_configured", "model is not supported by the selected subscription resource");
+      }
+      const credentialEligible = modelEligible.filter(
+        (account) => account.enabled !== false && hasCredential(providerId, account)
+      );
+      const health2 = (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)();
+      const allowance = (0, import_AccountAllowanceScheduling4.getSharedAccountAllowanceScheduling)();
+      const candidates = credentialEligible.filter(
+        (account) => health2.isSchedulable(providerId, account.id) && allowance.preview(providerId, account.id, account.priority ?? 50).schedulable
+      );
+      if (candidates.length > 0) return;
+      if (upstream.kind === "account") {
+        throw new import_provider_proxy3.RouteLeaseError("upstream_unavailable", "the selected subscription account is unavailable");
+      }
+      throw new import_provider_proxy3.RouteLeaseError("upstream_exhausted", "the selected subscription pool has no eligible account", {
+        retryAfterSeconds: 30
+      });
+    }
+  };
+}
+
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto14 = require("crypto");
 var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
@@ -9627,7 +10014,7 @@ function buildDaemon(config, paths) {
     new JsonAccountAllowancePersistence(defaultAccountAllowancePath(paths.configPath))
   );
   (0, import_AccountAllowanceStore4.setSharedAccountAllowanceStore)(accountAllowanceStore);
-  (0, import_AccountAllowanceScheduling4.getSharedAccountAllowanceScheduling)().configure(
+  (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(
     (0, import_outbound_api5.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
@@ -9694,11 +10081,22 @@ function buildDaemon(config, paths) {
   const usageRecorder = new import_usage.UsageRecorder(usageEventStore, pricingEngine, logger, {
     onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at)
   });
-  const providerProxy = (0, import_provider_proxy.getProviderProxy)({ llmConfig, apiKeyPool, usageRecorder });
+  const providerProxy = (0, import_provider_proxy4.getProviderProxy)({ llmConfig, apiKeyPool, usageRecorder });
+  const routeLeaseManager = new import_provider_proxy4.RouteLeaseManager(
+    providerProxy,
+    new import_provider_proxy4.RouteLeaseTargetResolver(llmConfig, {
+      providerKeys: apiKeyPool,
+      subscriptions: createRouteLeaseSubscriptionPreflight(credentialStore)
+    }),
+    import_cli_launcher2.routeLeaseDescriptorPort,
+    { logger }
+  );
+  providerProxy.registerBeforeStop(() => routeLeaseManager.shutdown());
+  providerProxy.registerBeforeStop(() => resetCliSessions());
   llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
   const accountHealthProbeScheduler = new AccountHealthProbeScheduler(
     credentialStore,
-    (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)(),
+    (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)(),
     logger,
     import_outbound_api5.DEFAULT_ACCOUNT_PROBE
   );
@@ -9745,6 +10143,7 @@ function buildDaemon(config, paths) {
     keySpendReader: keySpendTracker,
     settingsStore,
     outboundApiServer,
+    routeLeaseManager,
     subscriptionAccounts,
     accountAllowanceService,
     allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
@@ -9837,7 +10236,7 @@ function buildDaemon(config, paths) {
     logger,
     fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
   });
-  setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)());
+  setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
   const auditWriter = new AuditWriter(auditDir, logger);
   const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
   setAuditRuntime(auditWriter, auditPruneSweeper);
@@ -9852,7 +10251,7 @@ function buildDaemon(config, paths) {
   const tokenRefreshScheduler = new TokenRefreshScheduler(credentialStore, logger);
   const accountHealthSweeper = new AccountHealthSweeper(
     credentialStore,
-    (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)(),
+    (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)(),
     logger
   );
   return {
@@ -9861,6 +10260,7 @@ function buildDaemon(config, paths) {
     keyDb,
     settingsStore,
     providerProxy,
+    routeLeaseManager,
     outboundApiServer,
     apiKeyPool,
     autoDisableStore,
@@ -9976,32 +10376,17 @@ async function runLaunch(argv, deps) {
     await daemon.llmConfig.ready();
     await daemon.providerProxy.start();
   } catch (err5) {
-    daemon.apiKeyPool.dispose();
-    daemon.tokenRefreshScheduler.dispose();
-    daemon.claudeAllowanceRefreshScheduler.dispose();
-    daemon.accountHealthSweeper.dispose();
-    daemon.accountHealthProbeScheduler.dispose();
-    daemon.auditPruneSweeper.dispose();
-    daemon.billingRetrySweeper.dispose();
-    daemon.pricingRefreshScheduler.dispose();
+    await shutdownLaunchDaemon(daemon);
     throw err5;
   }
   let launch;
   try {
-    launch = await buildLaunchConfig(cli, daemon.llmConfig, {
+    launch = await buildLaunchConfig(cli, daemon, {
       providerId: values.provider,
       model: values.model
     });
   } catch (err5) {
-    await daemon.providerProxy.stop();
-    daemon.apiKeyPool.dispose();
-    daemon.tokenRefreshScheduler.dispose();
-    daemon.claudeAllowanceRefreshScheduler.dispose();
-    daemon.accountHealthSweeper.dispose();
-    daemon.accountHealthProbeScheduler.dispose();
-    daemon.auditPruneSweeper.dispose();
-    daemon.billingRetrySweeper.dispose();
-    daemon.pricingRefreshScheduler.dispose();
+    await shutdownLaunchDaemon(daemon);
     throw err5;
   }
   try {
@@ -10020,21 +10405,40 @@ async function runLaunch(argv, deps) {
       cwd: values.cwd
     });
   } finally {
-    launch.onSessionEnd();
-    await daemon.providerProxy.stop();
-    daemon.apiKeyPool.dispose();
-    daemon.tokenRefreshScheduler.dispose();
-    daemon.claudeAllowanceRefreshScheduler.dispose();
-    daemon.accountHealthSweeper.dispose();
-    daemon.accountHealthProbeScheduler.dispose();
-    daemon.auditPruneSweeper.dispose();
-    daemon.billingRetrySweeper.dispose();
-    daemon.pricingRefreshScheduler.dispose();
-  }
-}
-async function buildLaunchConfig(cli, llmConfig, opts) {
+    try {
+      launch.onSessionEnd();
+    } finally {
+      await shutdownLaunchDaemon(daemon);
+    }
+  }
+}
+async function buildLaunchConfig(cli, daemon, opts) {
+  if (cli === "claude" || cli === "codex") {
+    const internalId = (0, import_node_crypto15.randomUUID)();
+    const outcome = await daemon.routeLeaseManager.createFromRequest({
+      schemaVersion: import_provider_proxy5.ROUTE_LEASE_REQUEST_SCHEMA,
+      consumer: "omnicross-terminal",
+      runtime: cli,
+      upstream: { kind: "provider", providerId: opts.providerId },
+      model: opts.model,
+      execution: { sessionId: `launch:${cli}:${internalId}` }
+    }, `omnicross-launch:${internalId}`);
+    const stopRenewal = startTerminalLeaseRenewal(
+      daemon.routeLeaseManager,
+      outcome.result.leaseId
+    );
+    return {
+      baseUrl: daemon.providerProxy.getBaseUrl(),
+      env: outcome.result.launch.env,
+      extraArgs: outcome.result.launch.extraArgs,
+      onSessionEnd: () => {
+        stopRenewal();
+        daemon.routeLeaseManager.release(outcome.result.leaseId);
+      }
+    };
+  }
   const common = {
-    llmConfig,
+    llmConfig: daemon.llmConfig,
     providerId: opts.providerId,
     model: opts.model,
     // Stable, bounded session id — pool failover (poolseam) fires on launch
@@ -10042,22 +10446,30 @@ async function buildLaunchConfig(cli, llmConfig, opts) {
     sessionId: `launch:${cli}`
   };
   switch (cli) {
-    case "claude":
-      return (0, import_cli_launcher2.buildClaudeCliLaunchConfig)(common);
-    case "codex":
-      return (0, import_cli_launcher2.buildCodexLaunchConfig)(common);
     case "gemini":
-      return (0, import_cli_launcher2.buildGeminiCliLaunchConfig)(common);
+      return (0, import_cli_launcher3.buildGeminiCliLaunchConfig)(common);
     case "qwen":
     case "copilot":
     case "opencode":
-      return (0, import_cli_launcher2.buildChatCliLaunchConfig)({ backendId: cli, ...common });
+      return (0, import_cli_launcher3.buildChatCliLaunchConfig)({ backendId: cli, ...common });
     default: {
       const _exhaustive = cli;
       throw new Error(`Unsupported launch CLI: ${String(_exhaustive)}`);
     }
   }
 }
+async function shutdownLaunchDaemon(daemon) {
+  daemon.routeLeaseManager.shutdown();
+  await daemon.providerProxy.stop();
+  daemon.apiKeyPool.dispose();
+  daemon.tokenRefreshScheduler.dispose();
+  daemon.claudeAllowanceRefreshScheduler.dispose();
+  daemon.accountHealthSweeper.dispose();
+  daemon.accountHealthProbeScheduler.dispose();
+  daemon.auditPruneSweeper.dispose();
+  daemon.billingRetrySweeper.dispose();
+  daemon.pricingRefreshScheduler.dispose();
+}
 function spawnCliInherit(plan) {
   return new Promise((resolve3, reject) => {
     const child = (0, import_node_child_process2.spawn)(plan.command, plan.args, {
@@ -10104,7 +10516,7 @@ var import_node_readline = require("readline");
 var import_node_util5 = require("util");
 var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_subscriptions5 = require("@omnicross/subscriptions");
-var PROVIDERS = ["claude", "codex", "gemini"];
+var PROVIDERS2 = ["claude", "codex", "gemini"];
 async function runLogin(argv, deps) {
   const { values, positionals } = (0, import_node_util5.parseArgs)({
     args: argv,
@@ -10118,10 +10530,10 @@ async function runLogin(argv, deps) {
   });
   const provider = positionals[0];
   if (!provider) {
-    throw new Error(`login: a <provider> is required (one of ${PROVIDERS.join("|")})`);
+    throw new Error(`login: a <provider> is required (one of ${PROVIDERS2.join("|")})`);
   }
   if (!isLoginProvider(provider)) {
-    throw new Error(`login: unknown provider '${provider}' (expected ${PROVIDERS.join("|")})`);
+    throw new Error(`login: unknown provider '${provider}' (expected ${PROVIDERS2.join("|")})`);
   }
   if (!values.config) {
     throw new Error("login: --config <path> is required");
@@ -10227,7 +10639,7 @@ async function loginGemini(store, deps, exchangeFetch, label) {
   return expiresAt;
 }
 function isLoginProvider(value) {
-  return PROVIDERS.includes(value);
+  return PROVIDERS2.includes(value);
 }
 async function presentUrl(authUrl, deps) {
   console.info("Open this URL in your browser to authorize:");
@@ -10273,7 +10685,7 @@ function promptPaste(prompt) {
 }
 
 // src/commands/providers.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_node_util6 = require("util");
 async function runProviders(argv) {
   const { values, positionals } = (0, import_node_util6.parseArgs)({
@@ -10395,7 +10807,7 @@ function providersAddKey(configPath, providerId, opts) {
   const cfg = loadConfig(configPath);
   const row = cfg.providers.find((p) => p.id === providerId);
   if (!row) throw new Error(`providers add-key: unknown provider '${providerId}'`);
-  const entry = { id: (0, import_node_crypto15.randomUUID)(), apiKey: opts.key };
+  const entry = { id: (0, import_node_crypto16.randomUUID)(), apiKey: opts.key };
   if (opts.label) entry.label = opts.label;
   if (opts.weight !== void 0) {
     const w = Number(opts.weight);
@@ -10670,8 +11082,8 @@ function tokensSuffix(configPath) {
 // src/commands/start.ts
 var import_node_util8 = require("util");
 var import_outbound_api7 = require("@omnicross/core/outbound-api");
-var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_SubscriptionAccountHealth5 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_AccountAllowanceScheduling6 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 
 // src/identity/identityRuntime.ts
 var import_SubscriptionIdentityStore4 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
@@ -10731,11 +11143,11 @@ async function runStart(argv) {
   await daemon.llmConfig.ready();
   await daemon.providerProxy.start();
   const serverConfig = await (0, import_outbound_api7.loadServerConfig)(daemon.settingsStore);
-  (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)().configure({
+  (0, import_SubscriptionAccountHealth5.getSharedAccountHealth)().configure({
     overloadEnabled: serverConfig.accountHealth?.overloadCooldownEnabled,
     overloadTtlMs: serverConfig.accountHealth?.overloadCooldownMs
   });
-  (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(serverConfig.allowanceScheduling);
+  (0, import_AccountAllowanceScheduling6.getSharedAccountAllowanceScheduling)().configure(serverConfig.allowanceScheduling);
   daemon.claudeAllowanceRefreshScheduler.configure(serverConfig.allowanceScheduling);
   await daemon.outboundApiServer.applyConfig({
     enabled: true,