@omnicross/daemon 0.4.4 → 0.4.6

package/dist/cli.js

@@ -1155,7 +1155,7 @@ import {
 } from "@omnicross/core/search";
 
 // src/bootstrap.ts
-import { accessSync, constants as fsConstants, existsSync as existsSync30, mkdirSync as mkdirSync9 } from "fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync31, mkdirSync as mkdirSync9 } from "fs";
 import { dirname as dirname17 } from "path";
 import { DEFAULT_AUDIT_CONFIG } from "@omnicross/contracts/audit-types";
 import { DEFAULT_BILLING_CONFIG } from "@omnicross/contracts/billing-types";
@@ -1352,14 +1352,14 @@ async function runKimiDevicePoll(sessionId, deviceCode, deviceId, fingerprint, s
     {
       fingerprint,
       deadlineMs: DEFAULT_KIMI_OAUTH_TTL_MS,
-      sleep: (ms) => new Promise((resolve11, reject) => {
+      sleep: (ms) => new Promise((resolve12, reject) => {
         const onAbort = () => {
           clearTimeout(timer);
           reject(new Error("login: cancelled"));
         };
         const timer = setTimeout(() => {
           signal.removeEventListener("abort", onAbort);
-          resolve11();
+          resolve12();
         }, ms);
         signal.addEventListener("abort", onAbort, { once: true });
       })
@@ -1435,14 +1435,14 @@ async function runGrokDevicePoll(sessionId, tokenEndpoint, deviceCode, signal, d
     fetchImpl,
     {
       deadlineMs: DEFAULT_GROK_OAUTH_TTL_MS,
-      sleep: (ms) => new Promise((resolve11, reject) => {
+      sleep: (ms) => new Promise((resolve12, reject) => {
         const onAbort = () => {
           clearTimeout(timer);
           reject(new Error("login: cancelled"));
         };
         const timer = setTimeout(() => {
           signal.removeEventListener("abort", onAbort);
-          resolve11();
+          resolve12();
         }, ms);
         signal.addEventListener("abort", onAbort, { once: true });
       })
@@ -1520,14 +1520,14 @@ async function runCopilotDevicePoll(sessionId, deviceCode, signal, deps, enterpr
     {
       deadlineMs: DEFAULT_COPILOT_OAUTH_TTL_MS,
       ...enterpriseUrl ? { enterpriseUrl } : {},
-      sleep: (ms) => new Promise((resolve11, reject) => {
+      sleep: (ms) => new Promise((resolve12, reject) => {
         const onAbort = () => {
           clearTimeout(timer);
           reject(new Error("login: cancelled"));
         };
         const timer = setTimeout(() => {
           signal.removeEventListener("abort", onAbort);
-          resolve11();
+          resolve12();
         }, ms);
         signal.addEventListener("abort", onAbort, { once: true });
       })
@@ -3913,19 +3913,19 @@ function teardown() {
 
 // src/admin/webhookTestApi.ts
 function readJsonBody(req) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       try {
         const raw = Buffer.concat(chunks).toString("utf8");
         const parsed = raw ? JSON.parse(raw) : {};
-        resolve11(parsed && typeof parsed === "object" ? parsed : {});
+        resolve12(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
-        resolve11({});
+        resolve12({});
       }
     });
-    req.on("error", () => resolve11({}));
+    req.on("error", () => resolve12({}));
   });
 }
 async function handleWebhookTest(req, res) {
@@ -4028,13 +4028,771 @@ async function handleRouteLeaseApi(req, res, path2, deps) {
   }
 }
 
+// src/admin/codexSessionManager.ts
+import { homedir as homedir2 } from "os";
+import { basename, join as join6, resolve, win32 } from "path";
+import {
+  copyFile,
+  open,
+  readdir,
+  readFile,
+  rename,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
+import { TextDecoder as TextDecoder2 } from "util";
+var PROVIDER_PROPERTY_NAMES = /* @__PURE__ */ new Set(["model_provider", "model_provider_id"]);
+var FIRST_LINE_LIMIT = 4 * 1024 * 1024;
+var PROVIDER_ID_LIMIT = 256;
+var CodexSessionManagerError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodexSessionManagerError";
+  }
+};
+var CodexSessionManager = class {
+  codexHome;
+  stateDatabasePath;
+  mutationTail = Promise.resolve();
+  constructor(options = {}) {
+    const configuredHome = options.codexHome?.trim() || process.env["CODEX_HOME"]?.trim();
+    this.codexHome = configuredHome || join6(homedir2(), ".codex");
+    this.stateDatabasePath = options.stateDatabasePath?.trim() || join6(this.codexHome, "state_5.sqlite");
+  }
+  async list(projectPath) {
+    const project = await validateProjectPath(projectPath);
+    const [files, state] = await Promise.all([
+      scanSessionFiles(join6(this.codexHome, "sessions")),
+      readStateThreads(this.stateDatabasePath)
+    ]);
+    return mergeSessionMetadata(project.displayPath, this.codexHome, files, state);
+  }
+  async preview(input) {
+    const normalized2 = normalizeApplyInput(input);
+    const project = await validateProjectPath(normalized2.projectPath);
+    const [files, state] = await Promise.all([
+      scanSessionFiles(join6(this.codexHome, "sessions")),
+      readStateThreads(this.stateDatabasePath)
+    ]);
+    const snapshot = mergeSessionMetadata(project.displayPath, this.codexHome, files, state);
+    const plans = await buildProviderPlans(normalized2, snapshot, state.rows);
+    return {
+      projectPath: project.displayPath,
+      fromProvider: normalized2.fromProvider ?? null,
+      toProvider: normalized2.toProvider,
+      stateDatabase: state.status,
+      sessions: plans,
+      warnings: snapshot.warnings
+    };
+  }
+  async apply(input) {
+    return this.withMutationLock(() => this.applyLocked(input));
+  }
+  async applyLocked(input) {
+    const normalized2 = normalizeApplyInput(input);
+    const project = await validateProjectPath(normalized2.projectPath);
+    const [files, state] = await Promise.all([
+      scanSessionFiles(join6(this.codexHome, "sessions")),
+      readStateThreads(this.stateDatabasePath)
+    ]);
+    if (!state.status.available) {
+      throw new CodexSessionManagerError(
+        state.status.reason || `Codex state database is unavailable: ${state.status.path}`
+      );
+    }
+    const snapshot = mergeSessionMetadata(project.displayPath, this.codexHome, files, state);
+    const plans = await buildProviderPlans(normalized2, snapshot, state.rows);
+    const selected = plans.filter((plan) => plan.action !== "no_change");
+    const blocked = selected.filter((plan) => plan.action === "blocked");
+    if (blocked.length > 0) {
+      const details = blocked.map((plan) => `${plan.id}: ${plan.reason || "blocked"}`).join("; ");
+      throw new CodexSessionManagerError(`cannot update selected Codex sessions: ${details}`);
+    }
+    if (selected.length === 0) {
+      return {
+        ok: true,
+        projectPath: project.displayPath,
+        fromProvider: normalized2.fromProvider ?? null,
+        toProvider: normalized2.toProvider,
+        updatedSessions: 0,
+        jsonlFiles: 0,
+        jsonlFields: 0,
+        sqliteRows: 0,
+        backups: []
+      };
+    }
+    const fileChanges = [];
+    for (const plan of selected) {
+      const file = files.get(plan.id);
+      if (!file || file.status !== "ready") {
+        throw new CodexSessionManagerError(
+          `rollout for session '${plan.id}' is unavailable; no files were changed`
+        );
+      }
+      const before = await snapshotFile(file.filePath);
+      const inspection = await inspectAndTransformFile(file.filePath, normalized2.fromProvider, normalized2.toProvider);
+      const after = await snapshotFile(file.filePath);
+      if (!sameFileSnapshot(before, after)) {
+        throw new CodexSessionManagerError(
+          `rollout '${file.filePath}' changed while it was being read; no files were changed`
+        );
+      }
+      if (inspection.changedFields > 0) {
+        fileChanges.push({
+          id: plan.id,
+          filePath: file.filePath,
+          before,
+          transformedText: inspection.transformedText,
+          changedFields: inspection.changedFields
+        });
+      }
+    }
+    const stateRowsById = new Map(state.rows.map((row) => [row.id, row]));
+    const dbChanges = plans.filter((plan) => plan.action === "update").map((plan) => stateRowsById.get(plan.id)).filter((row) => {
+      if (!row) return false;
+      if (normalized2.fromProvider && row.modelProvider !== normalized2.fromProvider) return false;
+      return row.modelProvider !== normalized2.toProvider;
+    });
+    const temporaryFiles = [];
+    const backups = [];
+    let database;
+    let committed = false;
+    try {
+      for (const change of fileChanges) {
+        const tempPath = `${change.filePath}.provider-switch-${randomUUID2()}.tmp`;
+        await writeFile(tempPath, change.transformedText, "utf8");
+        temporaryFiles.push(tempPath);
+      }
+      if (dbChanges.length > 0) {
+        const sqlite = await loadSqlite();
+        database = openDatabase(sqlite, this.stateDatabasePath, false);
+        const databaseBackup = await createDatabaseBackup(sqlite, database, this.stateDatabasePath);
+        backups.push(databaseBackup);
+        database.exec("BEGIN IMMEDIATE");
+        assertDatabaseRowsUnchanged(database, dbChanges);
+      }
+      for (let index = 0; index < fileChanges.length; index += 1) {
+        const change = fileChanges[index];
+        const tempPath = temporaryFiles[index];
+        const current = await snapshotFile(change.filePath);
+        if (!sameFileSnapshot(change.before, current)) {
+          throw new CodexSessionManagerError(
+            `rollout '${change.filePath}' changed before replacement; no files were changed`
+          );
+        }
+        const backupPath = await createUniqueBackupPath(change.filePath);
+        await copyFile(change.filePath, backupPath);
+        backups.push(backupPath);
+        await replaceFileAtomically(tempPath, change.filePath);
+        temporaryFiles[index] = "";
+      }
+      if (database && dbChanges.length > 0) {
+        const update = database.prepare("UPDATE threads SET model_provider = ? WHERE id = ?");
+        for (const row of dbChanges) update.run(normalized2.toProvider, row.id);
+        database.exec("COMMIT");
+        committed = true;
+      } else {
+        committed = true;
+      }
+      return {
+        ok: true,
+        projectPath: project.displayPath,
+        fromProvider: normalized2.fromProvider ?? null,
+        toProvider: normalized2.toProvider,
+        updatedSessions: (/* @__PURE__ */ new Set([...fileChanges.map((change) => change.id), ...dbChanges.map((row) => row.id)])).size,
+        jsonlFiles: fileChanges.length,
+        jsonlFields: fileChanges.reduce((total, change) => total + change.changedFields, 0),
+        sqliteRows: dbChanges.length,
+        backups
+      };
+    } catch (error) {
+      if (database?.isTransaction) {
+        try {
+          database.exec("ROLLBACK");
+        } catch {
+        }
+      }
+      if (!committed) {
+        try {
+          await restoreBackups(backups.filter((path2) => /\.jsonl\.provider-switch-[^/\\]+\.bak$/iu.test(path2)));
+        } catch (restoreError) {
+          const original = error instanceof Error ? error.message : String(error);
+          const restoration = restoreError instanceof Error ? restoreError.message : String(restoreError);
+          throw new CodexSessionManagerError(
+            `${original}; JSONL restoration also failed: ${restoration}`
+          );
+        }
+      }
+      throw error;
+    } finally {
+      if (database?.isOpen) database.close();
+      for (const tempPath of temporaryFiles) {
+        if (!tempPath) continue;
+        await unlinkIfPresent(tempPath);
+      }
+    }
+  }
+  async withMutationLock(operation) {
+    const previous = this.mutationTail;
+    let release;
+    this.mutationTail = new Promise((resolve12) => {
+      release = resolve12;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+};
+function normalizeApplyInput(input) {
+  const projectPath = typeof input.projectPath === "string" ? input.projectPath.trim() : "";
+  const toProvider = typeof input.toProvider === "string" ? input.toProvider.trim() : "";
+  const fromProvider = typeof input.fromProvider === "string" ? input.fromProvider.trim() : void 0;
+  if (!projectPath) throw new CodexSessionManagerError("projectPath must be a non-empty string");
+  validateProviderId(toProvider, "toProvider");
+  if (fromProvider) validateProviderId(fromProvider, "fromProvider");
+  if (!Array.isArray(input.sessionIds) || input.sessionIds.length === 0) {
+    throw new CodexSessionManagerError("sessionIds must contain at least one session id");
+  }
+  const sessionIds = [
+    ...new Set(
+      input.sessionIds.filter((id) => typeof id === "string" && id.trim().length > 0).map((id) => id.trim())
+    )
+  ];
+  if (sessionIds.length === 0) throw new CodexSessionManagerError("sessionIds must contain at least one session id");
+  if (sessionIds.length > 1e4) throw new CodexSessionManagerError("too many sessionIds");
+  return { projectPath, sessionIds, toProvider, ...fromProvider ? { fromProvider } : {} };
+}
+function validateProviderId(value, name) {
+  if (!value) throw new CodexSessionManagerError(`${name} must be a non-empty string`);
+  if (value.length > PROVIDER_ID_LIMIT || /[\u0000-\u001f\u007f]/u.test(value)) {
+    throw new CodexSessionManagerError(`${name} is invalid`);
+  }
+}
+async function validateProjectPath(projectPath) {
+  if (typeof projectPath !== "string" || !projectPath.trim()) {
+    throw new CodexSessionManagerError("projectPath must be a non-empty string");
+  }
+  const displayPath = resolve(projectPath.trim());
+  let info;
+  try {
+    info = await stat(displayPath);
+  } catch {
+    throw new CodexSessionManagerError(`project path does not exist: ${displayPath}`);
+  }
+  if (!info.isDirectory()) throw new CodexSessionManagerError(`project path is not a directory: ${displayPath}`);
+  return { displayPath };
+}
+async function scanSessionFiles(sessionsRoot) {
+  const files = await collectJsonlFiles(sessionsRoot);
+  const records = /* @__PURE__ */ new Map();
+  for (const filePath of files) {
+    let fileStat;
+    try {
+      fileStat = await stat(filePath);
+      const firstLine = await readFirstLine(filePath);
+      const parsed = parseSessionMetadata(firstLine, filePath);
+      if (!parsed.id) continue;
+      const record = {
+        id: parsed.id,
+        filePath,
+        cwd: parsed.cwd,
+        jsonlProvider: parsed.provider,
+        timestamp: parsed.timestamp,
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        status: "ready"
+      };
+      const existing = records.get(record.id);
+      if (!existing || record.mtimeMs > existing.mtimeMs) records.set(record.id, record);
+    } catch {
+      const id = sessionIdFromRolloutPath(filePath);
+      if (!id) continue;
+      let fallbackStat;
+      try {
+        fallbackStat = await stat(filePath);
+      } catch {
+        continue;
+      }
+      const existing = records.get(id);
+      if (!existing || fallbackStat.mtimeMs > existing.mtimeMs) {
+        records.set(id, {
+          id,
+          filePath,
+          cwd: null,
+          jsonlProvider: null,
+          timestamp: null,
+          size: fallbackStat.size,
+          mtimeMs: fallbackStat.mtimeMs,
+          status: "unreadable_rollout"
+        });
+      }
+    }
+  }
+  return records;
+}
+async function collectJsonlFiles(root) {
+  if (!existsSync5(root)) return [];
+  const result = [];
+  const pending = [root];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    let entries;
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const fullPath = join6(current, entry.name);
+      if (entry.isDirectory()) pending.push(fullPath);
+      else if (entry.isFile() && entry.name.toLowerCase().endsWith(".jsonl")) result.push(fullPath);
+    }
+  }
+  return result.sort((a, b) => a.localeCompare(b));
+}
+async function readFirstLine(filePath) {
+  const handle = await open(filePath, "r");
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < FIRST_LINE_LIMIT) {
+      const chunk = Buffer.allocUnsafe(Math.min(128 * 1024, FIRST_LINE_LIMIT - total));
+      const result = await handle.read(chunk, 0, chunk.length, null);
+      if (result.bytesRead === 0) break;
+      const used = chunk.subarray(0, result.bytesRead);
+      const lineEnd = findLineEnd(used);
+      if (lineEnd >= 0) {
+        chunks.push(used.subarray(0, lineEnd));
+        return decodeUtf8(Buffer.concat(chunks));
+      }
+      chunks.push(used);
+      total += result.bytesRead;
+    }
+  } finally {
+    await handle.close();
+  }
+  if (total > 0 && total < FIRST_LINE_LIMIT) return decodeUtf8(Buffer.concat(chunks));
+  throw new CodexSessionManagerError(`session metadata line is too large or incomplete: ${filePath}`);
+}
+function findLineEnd(buffer) {
+  for (let index = 0; index < buffer.length; index += 1) {
+    if (buffer[index] === 10 || buffer[index] === 13) return index;
+  }
+  return -1;
+}
+function parseSessionMetadata(line, filePath) {
+  const value = JSON.parse(line.replace(/^\uFEFF/u, ""));
+  if (!isRecord6(value)) throw new Error("metadata is not an object");
+  const payload = isRecord6(value["payload"]) ? value["payload"] : {};
+  const id = sessionIdFromRolloutPath(filePath) || firstString(payload["session_id"], payload["id"]);
+  return {
+    id,
+    cwd: firstString(payload["cwd"]),
+    provider: firstString(payload["model_provider"]),
+    timestamp: firstString(payload["timestamp"]) || firstString(value["timestamp"])
+  };
+}
+function sessionIdFromRolloutPath(filePath) {
+  const match = basename(filePath).match(/([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\.jsonl$/iu);
+  return match?.[1] ?? null;
+}
+async function readStateThreads(databasePath) {
+  const unavailable = (reason) => ({
+    status: { path: databasePath, available: false, reason },
+    rows: []
+  });
+  if (!existsSync5(databasePath)) return unavailable(`Codex state database not found: ${databasePath}`);
+  let sqlite;
+  try {
+    sqlite = await loadSqlite();
+  } catch (error) {
+    return unavailable(error instanceof Error ? error.message : String(error));
+  }
+  let database;
+  try {
+    database = openDatabase(sqlite, databasePath, true);
+    const columns = new Set(
+      database.prepare("PRAGMA table_info('threads')").all().map((row) => String(row["name"] ?? ""))
+    );
+    for (const required of ["id", "rollout_path", "cwd", "model_provider"]) {
+      if (!columns.has(required)) return unavailable(`state_5.sqlite is missing threads.${required}`);
+    }
+    const selected = ["id", "rollout_path", "cwd", "model_provider", "model", "created_at", "updated_at", "created_at_ms", "updated_at_ms"].filter((column) => columns.has(column));
+    const rows = database.prepare(`SELECT ${selected.join(", ")} FROM threads`).all();
+    return {
+      status: { path: databasePath, available: true },
+      rows: rows.map(toStateThreadRow)
+    };
+  } catch (error) {
+    return unavailable(`could not read Codex state database: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    if (database?.isOpen) database.close();
+  }
+}
+async function loadSqlite() {
+  const specifier = "node:sqlite";
+  try {
+    return await import(specifier);
+  } catch (error) {
+    const cause = error instanceof Error ? error.message : String(error);
+    throw new CodexSessionManagerError(
+      `Codex session SQLite support requires Node.js 22.16 or newer (node:sqlite); this daemon runs ${process.version} (import failed: ${cause})`
+    );
+  }
+}
+function openDatabase(sqlite, databasePath, readOnly) {
+  const database = new sqlite.DatabaseSync(databasePath, { readOnly, timeout: 5e3 });
+  database.exec("PRAGMA busy_timeout = 5000");
+  return database;
+}
+function toStateThreadRow(row) {
+  return {
+    id: String(row["id"] ?? ""),
+    rolloutPath: String(row["rollout_path"] ?? ""),
+    cwd: String(row["cwd"] ?? ""),
+    modelProvider: String(row["model_provider"] ?? ""),
+    model: row["model"] == null ? null : String(row["model"]),
+    createdAt: timestampFromSqlite(row["created_at_ms"] ?? row["created_at"]),
+    updatedAt: timestampFromSqlite(row["updated_at_ms"] ?? row["updated_at"])
+  };
+}
+function timestampFromSqlite(value) {
+  const numeric = typeof value === "bigint" ? Number(value) : typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(numeric) || numeric <= 0) return null;
+  const milliseconds = numeric < 1e11 ? numeric * 1e3 : numeric;
+  const date = new Date(milliseconds);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+function mergeSessionMetadata(projectPath, codexHome, files, state) {
+  const stateRows = new Map(state.rows.map((row) => [row.id, row]));
+  const ids = /* @__PURE__ */ new Set();
+  for (const [id, file] of files) {
+    if (file.cwd && isPathInside(projectPath, file.cwd)) ids.add(id);
+  }
+  for (const row of state.rows) {
+    if (isPathInside(projectPath, row.cwd)) ids.add(row.id);
+  }
+  const sessions2 = [];
+  for (const id of ids) {
+    const file = files.get(id);
+    const row = stateRows.get(id);
+    const cwd = row?.cwd || file?.cwd || projectPath;
+    if (!isPathInside(projectPath, cwd)) continue;
+    const rolloutPath = file?.filePath || row?.rolloutPath || "";
+    const provider = row?.modelProvider || file?.jsonlProvider || null;
+    sessions2.push({
+      id,
+      cwd,
+      rolloutPath,
+      provider,
+      jsonlProvider: file?.jsonlProvider ?? null,
+      model: row?.model ?? null,
+      createdAt: row?.createdAt ?? file?.timestamp ?? null,
+      updatedAt: row?.updatedAt ?? (file ? new Date(file.mtimeMs).toISOString() : null),
+      fileSize: file?.size ?? null,
+      fileModifiedAt: file ? new Date(file.mtimeMs).toISOString() : null,
+      status: file?.status ?? "missing_rollout",
+      inStateDatabase: Boolean(row)
+    });
+  }
+  sessions2.sort((a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "") || a.id.localeCompare(b.id));
+  const warnings = [];
+  if (!state.status.available) warnings.push(state.status.reason || "state database unavailable");
+  return { projectPath, codexHome, stateDatabase: state.status, sessions: sessions2, warnings };
+}
+async function buildProviderPlans(input, snapshot, stateRows) {
+  const byId = new Map(snapshot.sessions.map((session) => [session.id, session]));
+  const stateById = new Map(stateRows.map((row) => [row.id, row]));
+  const plans = [];
+  for (const id of input.sessionIds) {
+    const session = byId.get(id);
+    const row = stateById.get(id);
+    if (!session) {
+      plans.push({
+        id,
+        provider: null,
+        model: null,
+        rolloutPath: "",
+        status: "blocked",
+        providers: [],
+        matchingFields: 0,
+        changedFields: 0,
+        sqliteWillUpdate: false,
+        action: "blocked",
+        reason: "session is not associated with the requested project"
+      });
+      continue;
+    }
+    if (session.status !== "ready") {
+      plans.push({
+        id,
+        provider: session.provider,
+        model: session.model,
+        rolloutPath: session.rolloutPath,
+        status: session.status,
+        providers: [],
+        matchingFields: 0,
+        changedFields: 0,
+        sqliteWillUpdate: false,
+        action: "blocked",
+        reason: "rollout file is missing or unreadable"
+      });
+      continue;
+    }
+    const inspection = await inspectAndTransformFile(session.rolloutPath, input.fromProvider, input.toProvider);
+    const sqliteWillUpdate = Boolean(
+      row && (!input.fromProvider || row.modelProvider === input.fromProvider) && row.modelProvider !== input.toProvider
+    );
+    const changed = inspection.changedFields > 0 || sqliteWillUpdate;
+    plans.push({
+      id,
+      provider: session.provider,
+      model: session.model,
+      rolloutPath: session.rolloutPath,
+      status: "ready",
+      providers: inspection.providers,
+      matchingFields: inspection.matchingFields,
+      changedFields: inspection.changedFields,
+      sqliteWillUpdate,
+      action: changed ? "update" : "no_change"
+    });
+  }
+  return plans;
+}
+async function inspectAndTransformFile(filePath, fromProvider, toProvider) {
+  const bytes = await readFile(filePath);
+  const originalText = decodeUtf8(bytes);
+  const parts = originalText.split(/(\r\n|\n|\r)/u);
+  const providers = /* @__PURE__ */ new Set();
+  let matchingFields = 0;
+  let changedFields = 0;
+  const hasBom = parts[0].startsWith("\uFEFF");
+  for (let index = 0; index < parts.length; index += 2) {
+    const line = parts[index];
+    if (!line.trim()) continue;
+    let value;
+    try {
+      value = JSON.parse(line.replace(index === 0 ? /^\uFEFF/u : /^/u, ""));
+    } catch (error) {
+      throw new CodexSessionManagerError(
+        `invalid JSONL at ${filePath}:${Math.floor(index / 2) + 1}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    const result = replaceStructuredProviderFields(value, fromProvider, toProvider, providers);
+    matchingFields += result.matchingFields;
+    changedFields += result.changedFields;
+    if (result.changedFields > 0) {
+      parts[index] = `${index === 0 && hasBom ? "\uFEFF" : ""}${JSON.stringify(value)}`;
+    }
+  }
+  return {
+    transformedText: parts.join(""),
+    providers: [...providers].sort(),
+    matchingFields,
+    changedFields
+  };
+}
+function replaceStructuredProviderFields(value, fromProvider, toProvider, providers = /* @__PURE__ */ new Set()) {
+  let matchingFields = 0;
+  let changedFields = 0;
+  const visit = (node) => {
+    if (Array.isArray(node)) {
+      for (const child of node) visit(child);
+      return;
+    }
+    if (!isRecord6(node)) return;
+    for (const [key, child] of Object.entries(node)) {
+      if (PROVIDER_PROPERTY_NAMES.has(key) && typeof child === "string") {
+        providers.add(child);
+        if (!fromProvider || child === fromProvider) {
+          matchingFields += 1;
+          if (child !== toProvider) {
+            node[key] = toProvider;
+            changedFields += 1;
+          }
+        }
+      }
+      visit(node[key]);
+    }
+  };
+  visit(value);
+  return { matchingFields, changedFields };
+}
+async function snapshotFile(filePath) {
+  const info = await stat(filePath);
+  return { size: info.size, mtimeMs: info.mtimeMs };
+}
+function sameFileSnapshot(a, b) {
+  return a.size === b.size && a.mtimeMs === b.mtimeMs;
+}
+async function createUniqueBackupPath(filePath) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[.:]/gu, "-");
+  let candidate = `${filePath}.provider-switch-${stamp}.bak`;
+  let suffix = 1;
+  while (existsSync5(candidate)) {
+    candidate = `${filePath}.provider-switch-${stamp}-${suffix}.bak`;
+    suffix += 1;
+  }
+  return candidate;
+}
+async function createDatabaseBackup(sqlite, database, databasePath) {
+  const backupPath = await createUniqueBackupPath(databasePath);
+  if (typeof sqlite.backup !== "function") {
+    throw new CodexSessionManagerError(
+      "Codex session updates require the node:sqlite backup API (Node.js 22.16 or newer)"
+    );
+  }
+  await sqlite.backup(database, backupPath);
+  return backupPath;
+}
+function assertDatabaseRowsUnchanged(database, rows) {
+  const read = database.prepare("SELECT model_provider FROM threads WHERE id = ?");
+  for (const row of rows) {
+    const current = read.get(row.id);
+    if (!current || String(current["model_provider"] ?? "") !== row.modelProvider) {
+      throw new CodexSessionManagerError(
+        `SQLite session '${row.id}' changed while the update was prepared; no files were changed`
+      );
+    }
+  }
+}
+async function replaceFileAtomically(tempPath, targetPath) {
+  try {
+    await rename(tempPath, targetPath);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+    await copyFile(tempPath, targetPath);
+    await unlinkIfPresent(tempPath);
+  }
+}
+async function restoreBackups(backupPaths) {
+  for (const backupPath of backupPaths.reverse()) {
+    if (!existsSync5(backupPath)) continue;
+    const targetPath = backupPath.replace(/\.provider-switch-[^.]+(?:-[0-9]+)?\.bak$/u, "");
+    if (targetPath === backupPath) continue;
+    const tempPath = `${targetPath}.provider-restore-${randomUUID2()}.tmp`;
+    try {
+      await copyFile(backupPath, tempPath);
+      await replaceFileAtomically(tempPath, targetPath);
+    } finally {
+      await unlinkIfPresent(tempPath);
+    }
+  }
+}
+async function unlinkIfPresent(filePath) {
+  try {
+    await unlink(filePath);
+  } catch {
+  }
+}
+function decodeUtf8(bytes) {
+  try {
+    return new TextDecoder2("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new CodexSessionManagerError("Codex session contains invalid UTF-8");
+  }
+}
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function firstString(...values) {
+  for (const value of values) if (typeof value === "string" && value.trim()) return value;
+  return null;
+}
+function normalizeComparablePath(value) {
+  const stripped = value.trim().replace(/^\\\\\?\\/u, "");
+  if (process.platform === "win32") {
+    const normalized2 = win32.normalize(stripped).replace(/[\\/]+$/u, "");
+    return normalized2.toLowerCase();
+  }
+  return stripped.replace(/\/+$/u, "") || "/";
+}
+function isPathInside(projectPath, candidatePath) {
+  const project = normalizeComparablePath(projectPath);
+  const candidate = normalizeComparablePath(candidatePath);
+  if (project === candidate) return true;
+  const separator = process.platform === "win32" ? "\\" : "/";
+  return candidate.startsWith(`${project}${separator}`);
+}
+
+// src/admin/codexSessionApi.ts
+async function handleCodexSessionApi(req, res, path2, manager) {
+  if (!manager) return writeJsonError(res, 501, "Codex session management is not available");
+  try {
+    const method = (req.method ?? "GET").toUpperCase();
+    if (path2 === "/admin/api/codex-sessions" && (method === "GET" || method === "HEAD")) {
+      const projectPath = new URL(req.url ?? "/", "http://localhost").searchParams.get("projectPath") ?? "";
+      return writeJson(res, 200, await manager.list(projectPath));
+    }
+    if (path2 === "/admin/api/codex-sessions/preview" && method === "POST") {
+      const body = await readJsonBody2(req);
+      return writeJson(res, 200, await manager.preview(parseApplyInput(body)));
+    }
+    if (path2 === "/admin/api/codex-sessions/apply" && method === "POST") {
+      const body = await readJsonBody2(req);
+      return writeJson(res, 200, await manager.apply(parseApplyInput(body)));
+    }
+    return writeJsonError(res, 404, "unknown Codex session admin route");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return writeJsonError(res, error instanceof CodexSessionManagerError ? 400 : 500, message);
+  }
+}
+async function readJsonBody2(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  if (chunks.length === 0) return {};
+  try {
+    const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    return isRecord7(value) ? value : {};
+  } catch {
+    throw new CodexSessionManagerError("request body must be a JSON object");
+  }
+}
+function parseApplyInput(body) {
+  const projectPath = body["projectPath"];
+  const sessionIds = body["sessionIds"];
+  const toProvider = body["toProvider"];
+  const fromProvider = body["fromProvider"];
+  if (typeof projectPath !== "string") throw new CodexSessionManagerError("projectPath must be a string");
+  if (!Array.isArray(sessionIds) || !sessionIds.every((value) => typeof value === "string")) {
+    throw new CodexSessionManagerError("sessionIds must be an array of strings");
+  }
+  if (typeof toProvider !== "string") throw new CodexSessionManagerError("toProvider must be a string");
+  if (fromProvider !== void 0 && typeof fromProvider !== "string") {
+    throw new CodexSessionManagerError("fromProvider must be a string when provided");
+  }
+  return {
+    projectPath,
+    sessionIds,
+    toProvider,
+    ...fromProvider === void 0 ? {} : { fromProvider }
+  };
+}
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeJsonError(res, status, message) {
+  writeJson(res, status, { error: { type: "admin_api_error", message } });
+}
+function isRecord7(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
 // src/admin/adminApi.ts
 import http from "http";
 import {
   createNamedKey,
   DEFAULT_IMAGES_SERVER_CONFIG,
   DEFAULT_SEARCH_SERVER_CONFIG as DEFAULT_SEARCH_SERVER_CONFIG2,
-  effectiveOutboundPermissions as effectiveOutboundPermissions2,
+  effectiveOutboundPermissions as effectiveOutboundPermissions3,
   gatewayBindingToEndpointConfig,
   isKindMappedEndpoint,
   loadServerConfig as loadServerConfig3,
@@ -4052,6 +4810,34 @@ import { getSharedAccountHealth } from "@omnicross/core/pipeline/SubscriptionAcc
 import { fetchUpstream as fetchUpstream10 } from "@omnicross/core/pipeline/upstreamFetch";
 import { mergeExtraHeaders } from "@omnicross/core";
 
+// src/admin/testEgressIdentity.ts
+import {
+  getOpenCodeGoUserAgent as getOpenCodeGoUserAgent2,
+  OPENCODE_SESSION_HEADER
+} from "@omnicross/core/provider-proxy/identity/openCodeGoHeaders";
+var ADMIN_PROBE_OPENCODE_SESSION = "omnicross-admin-probe";
+function isOpenCodeUpstream(baseUrl) {
+  if (!baseUrl) return false;
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "opencode.ai" || host.endsWith(".opencode.ai");
+  } catch {
+    return false;
+  }
+}
+function hasHeader2(headers, name) {
+  const lower = name.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === lower);
+}
+function applyAdminProbeIdentity(headers, row) {
+  if (!hasHeader2(headers, "user-agent")) {
+    headers["user-agent"] = getOpenCodeGoUserAgent2();
+  }
+  if (isOpenCodeUpstream(row.baseUrl) && !hasHeader2(headers, OPENCODE_SESSION_HEADER)) {
+    headers[OPENCODE_SESSION_HEADER] = ADMIN_PROBE_OPENCODE_SESSION;
+  }
+}
+
 // src/image-generation/imagesConfigValidation.ts
 import { validateImagesServerConfig } from "@omnicross/core/outbound-api";
 
@@ -4059,7 +4845,7 @@ import { validateImagesServerConfig } from "@omnicross/core/outbound-api";
 import { randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   lstatSync,
   mkdirSync as mkdirSync3,
   realpathSync,
@@ -4067,20 +4853,20 @@ import {
   statSync as statSync4,
   unlinkSync as unlinkSync2
 } from "fs";
-import { homedir as homedir2, tmpdir } from "os";
+import { homedir as homedir3, tmpdir } from "os";
 import {
-  basename,
+  basename as basename2,
   dirname as dirname4,
   isAbsolute,
-  join as join6,
+  join as join7,
   parse,
   relative,
-  resolve
+  resolve as resolve2
 } from "path";
 var OPAQUE_NAME = /^(?:file|directory)-[a-f0-9]{32}(?:\.(?:bin|json|tmp))?$/u;
 var MOUNT_MANIFEST_NAME = "catalog.v1.json";
 function normalized(path2) {
-  const canonical = resolve(path2);
+  const canonical = resolve2(path2);
   return process.platform === "win32" ? canonical.toLowerCase() : canonical;
 }
 function samePath(left, right) {
@@ -4091,26 +4877,26 @@ function isSameOrDescendant(candidate, parent) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function assertNoSymlinkComponents(target) {
-  const absolute = resolve(target);
+  const absolute = resolve2(target);
   const filesystemRoot = parse(absolute).root;
   let cursor = filesystemRoot;
   for (const segment of relative(filesystemRoot, absolute).split(/[\\/]+/u).filter(Boolean)) {
-    cursor = join6(cursor, segment);
-    if (!existsSync5(cursor)) break;
+    cursor = join7(cursor, segment);
+    if (!existsSync6(cursor)) break;
     if (lstatSync(cursor).isSymbolicLink()) {
       throw new TypeError("image storage paths must not traverse a symbolic link");
     }
   }
 }
 function isInsideDetectedWorktree(target) {
-  let cursor = resolve(target);
-  while (!existsSync5(cursor)) {
+  let cursor = resolve2(target);
+  while (!existsSync6(cursor)) {
     const parent = dirname4(cursor);
     if (parent === cursor) break;
     cursor = parent;
   }
   while (true) {
-    if (existsSync5(join6(cursor, ".git"))) return true;
+    if (existsSync6(join7(cursor, ".git"))) return true;
     const parent = dirname4(cursor);
     if (parent === cursor) return false;
     cursor = parent;
@@ -4118,15 +4904,15 @@ function isInsideDetectedWorktree(target) {
 }
 function isBroadRoot(target, options) {
   const filesystemRoot = parse(target).root;
-  const processDirectory = resolve(options.processDirectory ?? process.cwd());
-  const userHome = resolve(options.userHome ?? homedir2());
-  const temporaryDirectory = resolve(options.temporaryDirectory ?? tmpdir());
+  const processDirectory = resolve2(options.processDirectory ?? process.cwd());
+  const userHome = resolve2(options.userHome ?? homedir3());
+  const temporaryDirectory = resolve2(options.temporaryDirectory ?? tmpdir());
   return samePath(target, filesystemRoot) || samePath(target, userHome) || samePath(target, temporaryDirectory) || isSameOrDescendant(processDirectory, target) || isSameOrDescendant(userHome, target) || isSameOrDescendant(temporaryDirectory, target);
 }
 function validateImageRootCandidate(candidate, options = {}) {
   const label = options.label ?? "image storage root";
   if (!candidate.trim() || !isAbsolute(candidate)) return [`${label} must be an absolute path`];
-  const target = resolve(candidate);
+  const target = resolve2(candidate);
   const errors = [];
   if (isBroadRoot(target, options)) errors.push(`${label} is too broad`);
   try {
@@ -4164,22 +4950,22 @@ var DaemonImagePathResolver = class {
   #issued = /* @__PURE__ */ new WeakSet();
   constructor(options) {
     if (!isAbsolute(options.configPath)) throw new TypeError("daemon configPath must be absolute");
-    const applicationDataRoot = resolve(dirname4(options.configPath));
+    const applicationDataRoot = resolve2(dirname4(options.configPath));
     const applicationErrors = validateImageRootCandidate(applicationDataRoot, {
       ...options,
       label: "daemon application data root"
     });
     if (applicationErrors.length > 0) throw new TypeError(applicationErrors.join("; "));
-    const imagesRoot = join6(applicationDataRoot, "images");
-    const durableRoot = resolve(options.storageRoot ?? join6(imagesRoot, "storage"));
+    const imagesRoot = join7(applicationDataRoot, "images");
+    const durableRoot = resolve2(options.storageRoot ?? join7(imagesRoot, "storage"));
     const durableErrors = validateImageRootCandidate(durableRoot, {
       ...options,
       label: "image durable storage root"
     });
     const reservedRoots = [
-      join6(imagesRoot, "temporary"),
-      join6(imagesRoot, "evidence"),
-      join6(imagesRoot, "mount-catalog")
+      join7(imagesRoot, "temporary"),
+      join7(imagesRoot, "evidence"),
+      join7(imagesRoot, "mount-catalog")
     ];
     if (reservedRoots.some((reserved) => isSameOrDescendant(durableRoot, reserved) || isSameOrDescendant(reserved, durableRoot))) {
       durableErrors.push("image durable storage root must not overlap daemon image control roots");
@@ -4188,13 +4974,13 @@ var DaemonImagePathResolver = class {
     const paths = Object.freeze({
       applicationDataRoot,
       imagesRoot,
-      temporaryRoot: join6(imagesRoot, "temporary"),
+      temporaryRoot: join7(imagesRoot, "temporary"),
       durableRoot,
-      artifactsRoot: join6(durableRoot, "artifacts"),
-      stateRoot: join6(durableRoot, "state"),
-      evidenceRoot: join6(imagesRoot, "evidence"),
-      mountManifestRoot: join6(imagesRoot, "mount-catalog"),
-      mountManifestPath: join6(imagesRoot, "mount-catalog", MOUNT_MANIFEST_NAME)
+      artifactsRoot: join7(durableRoot, "artifacts"),
+      stateRoot: join7(durableRoot, "state"),
+      evidenceRoot: join7(imagesRoot, "evidence"),
+      mountManifestRoot: join7(imagesRoot, "mount-catalog"),
+      mountManifestPath: join7(imagesRoot, "mount-catalog", MOUNT_MANIFEST_NAME)
     });
     const rootEntries = [
       ["temporary", paths.temporaryRoot],
@@ -4226,7 +5012,7 @@ var DaemonImagePathResolver = class {
   /** Revalidate immediately before unlinking a resolver-issued file capability. */
   removeFile(target) {
     const path2 = this.verifyDestructiveTarget(target, ["opaque-file", "mount-manifest"]);
-    if (!existsSync5(path2)) return;
+    if (!existsSync6(path2)) return;
     const info = lstatSync(path2);
     if (info.isSymbolicLink() || !info.isFile()) {
       throw new TypeError("refusing to unlink an unverified image file");
@@ -4236,7 +5022,7 @@ var DaemonImagePathResolver = class {
   /** Only empty opaque directories may be removed until the owned-marker layer is composed. */
   removeEmptyDirectory(target) {
     const path2 = this.verifyDestructiveTarget(target, ["opaque-directory"]);
-    if (!existsSync5(path2)) return;
+    if (!existsSync6(path2)) return;
     const info = lstatSync(path2);
     if (info.isSymbolicLink() || !info.isDirectory()) {
       throw new TypeError("refusing to remove an unverified image directory");
@@ -4246,7 +5032,7 @@ var DaemonImagePathResolver = class {
   issue(area, name, kind) {
     const handle = Object.freeze({
       area,
-      absolutePath: join6(this.#roots[area].path, name),
+      absolutePath: join7(this.#roots[area].path, name),
       kind
     });
     this.#issued.add(handle);
@@ -4261,11 +5047,11 @@ var DaemonImagePathResolver = class {
     }
     const root = this.#roots[target.area];
     assertRootIdentity(root);
-    const candidate = resolve(target.absolutePath);
+    const candidate = resolve2(target.absolutePath);
     if (!samePath(dirname4(candidate), root.path) || !isSameOrDescendant(candidate, root.path)) {
       throw new TypeError("refusing a destructive operation outside the verified image root");
     }
-    const name = basename(candidate);
+    const name = basename2(candidate);
     const validName = target.kind === "mount-manifest" ? name === MOUNT_MANIFEST_NAME : OPAQUE_NAME.test(name);
     if (!validName) throw new TypeError("refusing a caller-derived image filename");
     assertNoSymlinkComponents(candidate);
@@ -4729,29 +5515,29 @@ function resolveEnvKey(rawKey) {
 
 // src/integrations/IntegrationManager.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync7, unlinkSync as unlinkSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join7, resolve as resolve3 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync7, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join8, resolve as resolve4 } from "path";
 import {
   createIntegrationKey,
   effectiveOutboundPermissions
 } from "@omnicross/core";
 
 // src/integrations/codexAuthHelper.ts
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 function currentProcessCodexAuthHelper(configPath, masterKeyFilePath) {
   const entrypoint = process.argv[1];
   if (!entrypoint) throw new Error("cannot configure Codex auth helper without a daemon CLI entrypoint");
   return {
     command: process.execPath,
     args: [
-      resolve2(entrypoint),
+      resolve3(entrypoint),
       "integrations",
       "token",
       "codex",
       "--config",
-      resolve2(configPath),
-      ...masterKeyFilePath ? ["--master-key-file", resolve2(masterKeyFilePath)] : []
+      resolve3(configPath),
+      ...masterKeyFilePath ? ["--master-key-file", resolve3(masterKeyFilePath)] : []
     ]
   };
 }
@@ -4759,7 +5545,7 @@ function currentProcessCodexAuthHelper(configPath, masterKeyFilePath) {
 // src/integrations/IntegrationStateStore.ts
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync6,
   renameSync as renameSync3,
@@ -4776,7 +5562,7 @@ var IntegrationStateStore = class {
   path;
   box;
   load() {
-    if (!existsSync6(this.path)) return { ...EMPTY_STATE, clients: {} };
+    if (!existsSync7(this.path)) return { ...EMPTY_STATE, clients: {} };
     let raw;
     try {
       raw = JSON.parse(readFileSync6(this.path, "utf8"));
@@ -4882,7 +5668,7 @@ function atomicWrite(path2, content) {
     }
     throw error;
   } finally {
-    if (existsSync6(path2)) {
+    if (existsSync7(path2)) {
       try {
         chmodSync3(path2, 384);
       } catch {
@@ -5067,7 +5853,7 @@ var IntegrationManager = class {
   constructor(options) {
     this.options = options;
     assertLoopbackGatewayUrl(options.gatewayBaseUrl);
-    this.homeDir = options.homeDir ?? homedir3();
+    this.homeDir = options.homeDir ?? homedir4();
     this.codexAuthHelper = options.codexAuthHelper ?? currentProcessCodexAuthHelper(options.configPath);
   }
   options;
@@ -5081,7 +5867,7 @@ var IntegrationManager = class {
   async plan(client, configPath = this.defaultConfigPath(client)) {
     const state = this.options.stateStore.load();
     const record = state.clients[client];
-    const target = record?.configPath ?? resolve3(configPath);
+    const target = record?.configPath ?? resolve4(configPath);
     const status = await this.statusFor(client, state, await this.options.keyDb.outboundApiKeysList());
     const changes = client === "codex" ? ["model_provider", "model_providers.omnicross", "model_providers.omnicross.auth"] : ["env.ANTHROPIC_BASE_URL", "env.ANTHROPIC_AUTH_TOKEN", "env.ANTHROPIC_API_KEY"];
     if (!record) {
@@ -5097,7 +5883,7 @@ var IntegrationManager = class {
     return { client, configPath: target, action: "repair", canApply: true, changes, warnings };
   }
   async install(client, configPath = this.defaultConfigPath(client)) {
-    const target = resolve3(configPath);
+    const target = resolve4(configPath);
     const state = this.options.stateStore.load();
     const previousState = cloneState(state);
     const existingRecord = state.clients[client];
@@ -5304,6 +6090,33 @@ var IntegrationManager = class {
     }
     return details.secret;
   }
+  /**
+   * Resolve ONE access key's plaintext by id — the `--key-id` variant the
+   * command-auth helper serves for key-scoped Codex launches (each terminal
+   * picks its own gateway key, so concurrent sessions can route to different
+   * upstreams through their keys' bindings). Enforces the SAME usability
+   * contract as the client-bound path: existing, enabled, not revoked,
+   * revealable, and holding the codex-required endpoint permissions.
+   */
+  async getKeyToken(keyId) {
+    const rows = await this.options.keyDb.outboundApiKeysList();
+    const row = rows.find((candidate) => candidate.id === keyId);
+    if (!row) {
+      throw new IntegrationConflictError(`access key '${keyId}' does not exist`);
+    }
+    const secret = await this.options.keyDb.outboundApiKeysReveal(keyId);
+    if (!row.enabled || row.revokedAt !== null || !secret) {
+      throw new IntegrationConflictError(
+        `access key '${keyId}' is disabled, revoked, or not revealable`
+      );
+    }
+    if (!hasRequiredPermissions(row, "codex")) {
+      throw new IntegrationConflictError(
+        `access key '${keyId}' lacks the responses+images endpoint permissions Codex requires`
+      );
+    }
+    return secret;
+  }
   /** Compatibility alias for callers predating per-client bindings. */
   async getGatewayToken(client = "codex") {
     return this.getIntegrationToken(client);
@@ -5444,7 +6257,7 @@ var IntegrationManager = class {
     }
   }
   defaultConfigPath(client) {
-    return client === "codex" ? join7(this.homeDir, ".codex", "config.toml") : join7(this.homeDir, ".claude", "settings.json");
+    return client === "codex" ? join8(this.homeDir, ".codex", "config.toml") : join8(this.homeDir, ".claude", "settings.json");
   }
   renderInstalled(client, base, secret) {
     if (client === "claude") {
@@ -5487,7 +6300,7 @@ function cloneState(state) {
   };
 }
 function readOptional(path2) {
-  return existsSync7(path2) ? readFileSync7(path2, "utf8") : null;
+  return existsSync8(path2) ? readFileSync7(path2, "utf8") : null;
 }
 function sha256(value) {
   return createHash("sha256").update(value, "utf8").digest("hex");
@@ -5547,7 +6360,7 @@ function writeOptional(path2, content) {
     atomicWrite(path2, content);
     return;
   }
-  if (existsSync7(path2)) unlinkSync4(path2);
+  if (existsSync8(path2)) unlinkSync4(path2);
 }
 async function bestEffortRevoke(db, keyId) {
   try {
@@ -5887,7 +6700,7 @@ import { SUBSCRIPTION_MODEL_CATALOG } from "@omnicross/contracts/subscription-mo
 import { ANTIGRAVITY_CODE_ASSIST_ENDPOINT as ANTIGRAVITY_CODE_ASSIST_ENDPOINT2 } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
 import { fetchUpstream as fetchUpstream9 } from "@omnicross/core/pipeline/upstreamFetch";
 import { getAntigravityUserAgent as getAntigravityUserAgent2 } from "@omnicross/core/transformer/transformers/antigravityIdentity";
-function isRecord6(value) {
+function isRecord8(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function optionalString(value) {
@@ -5900,13 +6713,13 @@ function optionalBoolean(value) {
   return typeof value === "boolean" ? value : void 0;
 }
 function parseAntigravityAvailableModels(payload) {
-  if (!isRecord6(payload)) return [];
+  if (!isRecord8(payload)) return [];
   const models = payload["models"];
-  if (!isRecord6(models)) return [];
+  if (!isRecord8(models)) return [];
   const out = [];
   for (const [id, raw] of Object.entries(models)) {
     if (ANTIGRAVITY_DISCOVERY_DENYLIST.has(id)) continue;
-    if (!isRecord6(raw)) continue;
+    if (!isRecord8(raw)) continue;
     if (raw["isInternal"] === true) continue;
     out.push({
       id,
@@ -5967,7 +6780,7 @@ async function fetchAntigravityAvailableModels(accessToken, fetchImpl = (url, in
   }
   if (!response.ok) return null;
   const payload = await response.json().catch(() => null);
-  if (!isRecord6(payload) || !isRecord6(payload["models"])) return null;
+  if (!isRecord8(payload) || !isRecord8(payload["models"])) return null;
   return parseAntigravityAvailableModels(payload);
 }
 async function handleAntigravityModelsRoute(deps) {
@@ -6323,21 +7136,26 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 
 // src/admin/cliLaunch.ts
 import { exec, spawn } from "child_process";
-import { randomUUID as randomUUID2 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync8, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmodSync as chmodSync4, existsSync as existsSync9, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { createServer } from "net";
 import { tmpdir as tmpdir2 } from "os";
-import { delimiter, join as join8 } from "path";
+import { delimiter, join as join9 } from "path";
 import {
   buildChatCliLaunchConfig,
   buildClaudeCliLaunchConfig,
   buildCodexLaunchConfig,
-  buildGeminiCliLaunchConfig
+  buildGeminiCliLaunchConfig,
+  CODEX_PROXY_PROVIDER_NAME
 } from "@omnicross/cli-launcher";
 import {
   ROUTE_LEASE_REQUEST_SCHEMA,
   RouteLeaseError as RouteLeaseError2
 } from "@omnicross/core/provider-proxy";
+import {
+  candidateGatewayBindings,
+  effectiveOutboundPermissions as effectiveOutboundPermissions2
+} from "@omnicross/core/outbound-api";
 
 // src/routeLeaseRenewal.ts
 var TERMINAL_LEASE_TTL_SECONDS = 600;
@@ -6384,8 +7202,8 @@ function isLaunchCliId(id) {
 function probeDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = join8(seg, candidate);
-    if (existsSync8(full)) return full;
+    const full = join9(seg, candidate);
+    if (existsSync9(full)) return full;
   }
   return null;
 }
@@ -6418,6 +7236,75 @@ function resolveLaunchTarget(providers, requested) {
 function firstModel(p) {
   return p.models?.[0] ?? p.modelConfigs?.[0]?.id;
 }
+var CMD_METACHAR_RE = /[&|<>^%]/;
+var KEY_SCOPED_CODEX_PERMISSIONS = ["responses", "images"];
+function buildKeyScopedCodexArgs(input) {
+  let root = input.gatewayBaseUrl;
+  while (root.endsWith("/")) root = root.slice(0, -1);
+  const name = CODEX_PROXY_PROVIDER_NAME;
+  const helperArgs = [...input.authHelper.args, "--key-id", input.keyId];
+  return [
+    "-c",
+    `model_provider="${name}"`,
+    "-c",
+    `model_providers.${name}.name="OmniCross Local Gateway"`,
+    "-c",
+    `model_providers.${name}.base_url="${root}/v1"`,
+    "-c",
+    `model_providers.${name}.wire_api="responses"`,
+    "-c",
+    `model_providers.${name}.supports_websockets=false`,
+    "-c",
+    `model_providers.${name}.http_headers={"X-OpenAI-Actor-Authorization"="omnicross"}`,
+    "-c",
+    `model_providers.${name}.auth.command=${JSON.stringify(input.authHelper.command)}`,
+    "-c",
+    `model_providers.${name}.auth.args=${JSON.stringify(helperArgs)}`,
+    "-c",
+    `model_providers.${name}.auth.refresh_interval_ms=0`,
+    "-c",
+    `model_providers.${name}.auth.timeout_ms=5000`,
+    "-c",
+    "disable_response_storage=true"
+  ];
+}
+async function preflightKeyScopedLaunch(deps, keyId) {
+  if (!deps.gatewayRunning) {
+    return {
+      ok: false,
+      status: 409,
+      message: "the outbound gateway is not running \u2014 key-scoped launches route through it"
+    };
+  }
+  const rows = await deps.keyDb.outboundApiKeysList();
+  const row = rows.find((candidate) => candidate.id === keyId);
+  if (!row) return { ok: false, status: 404, message: `access key '${keyId}' does not exist` };
+  if (!row.enabled || row.revokedAt !== null) {
+    return { ok: false, status: 400, message: `access key '${row.name}' is disabled or revoked` };
+  }
+  const secret = await deps.keyDb.outboundApiKeysReveal(keyId);
+  if (!secret) {
+    return { ok: false, status: 400, message: `access key '${row.name}' is not revealable` };
+  }
+  const allowed = effectiveOutboundPermissions2(row.allowedEndpoints);
+  for (const permission of KEY_SCOPED_CODEX_PERMISSIONS) {
+    if (!allowed.includes(permission)) {
+      return {
+        ok: false,
+        status: 400,
+        message: `access key '${row.name}' lacks the '${permission}' endpoint permission Codex requires`
+      };
+    }
+  }
+  if (candidateGatewayBindings(deps.bindings, keyId, "responses").length === 0) {
+    return {
+      ok: false,
+      status: 400,
+      message: `access key '${row.name}' has no enabled responses route \u2014 bind it to a downstream route on the API Service page first`
+    };
+  }
+  return { ok: true, keyName: row.name };
+}
 async function buildLaunchEnv(cli, llmConfig, target) {
   const common = {
     llmConfig,
@@ -6489,10 +7376,10 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
   const runLine = [command, ...extraArgs].map(shq).join(" ");
   const script = `${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
   if (platform === "darwin") {
-    const launchDir = mkdtempSync(join8(tmpdir2(), "omnicross-terminal-"));
-    const commandFile = join8(launchDir, "launch.command");
-    const bootstrapFile = join8(launchDir, "bootstrap.cjs");
-    const socketPath = macIpc.socketPath ?? join8(launchDir, "descriptor.sock");
+    const launchDir = mkdtempSync(join9(tmpdir2(), "omnicross-terminal-"));
+    const commandFile = join9(launchDir, "launch.command");
+    const bootstrapFile = join9(launchDir, "bootstrap.cjs");
+    const socketPath = macIpc.socketPath ?? join9(launchDir, "descriptor.sock");
     const openerEnv = { ...process.env };
     for (const key of Object.keys(env)) delete openerEnv[key];
     let claimed = false;
@@ -6621,10 +7508,10 @@ function resetCliSessions() {
 function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
-var defaultCommandRunner = (command) => new Promise((resolve11) => {
+var defaultCommandRunner = (command) => new Promise((resolve12) => {
   exec(command, { timeout: 18e4 }, (err9, _stdout, stderr) => {
-    if (err9) resolve11({ ok: false, error: stderr.trim() || err9.message });
-    else resolve11({ ok: true });
+    if (err9) resolve12({ ok: false, error: stderr.trim() || err9.message });
+    else resolve12({ ok: true });
   });
 });
 async function handleCliInstall(cli, runner = defaultCommandRunner) {
@@ -6663,44 +7550,84 @@ async function handleCliLaunch(cli, body, ctx) {
   if (!isCliInstalled(meta.command, platform, probe)) {
     return { status: 400, body: errBody(`"${meta.command}" is not installed (not found on PATH)`) };
   }
+  const keyId = typeof body["keyId"] === "string" && body["keyId"].trim() ? body["keyId"].trim() : void 0;
   let target;
-  try {
-    target = resolveLaunchTarget(ctx.providers, {
-      providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
-      model: typeof body["model"] === "string" ? body["model"] : void 0
-    });
-  } catch (err9) {
-    return { status: 400, body: errBody(err9 instanceof Error ? err9.message : "no launch target") };
-  }
-  const id = randomUUID2();
+  let keyLaunch;
+  const id = randomUUID3();
   let leaseId2;
   let launch;
-  try {
-    if ((cli === "claude" || cli === "codex") && ctx.routeLeaseManager) {
-      const outcome = await ctx.routeLeaseManager.createFromRequest({
-        schemaVersion: ROUTE_LEASE_REQUEST_SCHEMA,
-        consumer: "omnicross-terminal",
-        runtime: cli,
-        upstream: { kind: "provider", providerId: target.providerId },
-        model: target.model,
-        execution: { sessionId: id }
-      }, `omnicross-terminal:${id}`);
-      leaseId2 = outcome.result.leaseId;
-      const stopRenewal = startTerminalLeaseRenewal(ctx.routeLeaseManager, leaseId2);
-      launch = {
-        env: outcome.result.launch.env,
-        extraArgs: outcome.result.launch.extraArgs,
-        onSessionEnd: () => {
-          stopRenewal();
-          ctx.routeLeaseManager?.release(outcome.result.leaseId);
-        }
-      };
-    } else {
-      launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+  if (keyId) {
+    if (cli !== "codex") {
+      return { status: 400, body: errBody("key-scoped launch is only supported for codex") };
+    }
+    const deps = ctx.keyScoped;
+    if (!deps) {
+      return { status: 501, body: errBody("key-scoped launch is not available in this build") };
+    }
+    const preflight = await preflightKeyScopedLaunch(deps, keyId);
+    if (!preflight.ok) return { status: preflight.status, body: errBody(preflight.message) };
+    if (platform === "win32") {
+      const unsafe = [deps.codexAuthHelper.command, ...deps.codexAuthHelper.args].filter((value) => CMD_METACHAR_RE.test(value));
+      if (unsafe.length > 0) {
+        return {
+          status: 400,
+          body: errBody(
+            "the Codex auth-helper path contains cmd.exe metacharacters and cannot be passed through a Windows terminal launch"
+          )
+        };
+      }
+    }
+    keyLaunch = { keyId, keyName: preflight.keyName };
+    launch = {
+      env: {},
+      extraArgs: buildKeyScopedCodexArgs({
+        gatewayBaseUrl: deps.gatewayBaseUrl,
+        authHelper: deps.codexAuthHelper,
+        keyId
+      }),
+      // No route or lease exists to release — the gateway key outlives the
+      // terminal and its bindings route every request.
+      onSessionEnd: () => {
+      }
+    };
+  } else {
+    let resolved;
+    try {
+      resolved = resolveLaunchTarget(ctx.providers, {
+        providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
+        model: typeof body["model"] === "string" ? body["model"] : void 0
+      });
+    } catch (err9) {
+      return { status: 400, body: errBody(err9 instanceof Error ? err9.message : "no launch target") };
+    }
+    target = resolved;
+    try {
+      if ((cli === "claude" || cli === "codex") && ctx.routeLeaseManager) {
+        const outcome = await ctx.routeLeaseManager.createFromRequest({
+          schemaVersion: ROUTE_LEASE_REQUEST_SCHEMA,
+          consumer: "omnicross-terminal",
+          runtime: cli,
+          upstream: { kind: "provider", providerId: resolved.providerId },
+          model: resolved.model,
+          execution: { sessionId: id }
+        }, `omnicross-terminal:${id}`);
+        leaseId2 = outcome.result.leaseId;
+        const stopRenewal = startTerminalLeaseRenewal(ctx.routeLeaseManager, leaseId2);
+        launch = {
+          env: outcome.result.launch.env,
+          extraArgs: outcome.result.launch.extraArgs,
+          onSessionEnd: () => {
+            stopRenewal();
+            ctx.routeLeaseManager?.release(outcome.result.leaseId);
+          }
+        };
+      } else {
+        launch = await buildLaunchEnv(cli, ctx.llmConfig, resolved);
+      }
+    } catch (err9) {
+      const status = err9 instanceof RouteLeaseError2 ? err9.status : 400;
+      return { status, body: errBody(err9 instanceof Error ? err9.message : "failed to build launch env") };
     }
-  } catch (err9) {
-    const status = err9 instanceof RouteLeaseError2 ? err9.status : 400;
-    return { status, body: errBody(err9 instanceof Error ? err9.message : "failed to build launch env") };
   }
   const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
   const opener = ctx.opener ?? defaultTerminalOpener;
@@ -6739,15 +7666,19 @@ async function handleCliLaunch(cli, body, ctx) {
   sessions.set(id, {
     id,
     cli,
-    providerId: target.providerId,
-    model: target.model,
+    providerId: target?.providerId ?? "",
+    model: target?.model ?? "",
+    ...keyLaunch ? { keyId: keyLaunch.keyId, keyName: keyLaunch.keyName } : {},
     ...leaseId2 ? { leaseId: leaseId2 } : {},
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     onSessionEnd
   });
   published = true;
   if (ended) sessions.delete(id);
-  return { status: 200, body: { sessionId: id, providerId: target.providerId, model: target.model } };
+  return {
+    status: 200,
+    body: keyLaunch ? { sessionId: id, keyId: keyLaunch.keyId, keyName: keyLaunch.keyName } : { sessionId: id, providerId: target?.providerId, model: target?.model }
+  };
 }
 
 // src/admin/auditConfigBody.ts
@@ -7081,17 +8012,17 @@ function sanitizeResultField(value, cap) {
   const text = typeof value === "string" ? value : value === null || value === void 0 ? "" : String(value);
   return text.replace(/[\u0000-\u001f\u007f]/gu, "").slice(0, cap);
 }
-function writeJson(res, status, body) {
+function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeErr(res, status, message) {
-  writeJson(res, status, { error: { type: "admin_api_error", message } });
+  writeJson2(res, status, { error: { type: "admin_api_error", message } });
 }
 var SEARCH_MAX_BODY_BYTES = 64 * 1024;
 var SearchBodyTooLargeError = class extends Error {
 };
-async function readJsonBody2(req) {
+async function readJsonBody3(req) {
   const chunks = [];
   let bytes = 0;
   for await (const chunk of req) {
@@ -7111,7 +8042,7 @@ async function readJsonBody2(req) {
 }
 async function readBodyOrReject(req, res) {
   try {
-    return await readJsonBody2(req);
+    return await readJsonBody3(req);
   } catch (error) {
     if (error instanceof SearchBodyTooLargeError) {
       writeErr(res, 400, error.message);
@@ -7169,7 +8100,7 @@ async function handleSearchDiagnostics(res, deps) {
     },
     applySemantics: { codex: "immediate", rest: "restart" }
   };
-  return writeJson(res, 200, { diagnostics: snapshot });
+  return writeJson2(res, 200, { diagnostics: snapshot });
 }
 function persistedSearchContributions(search, fetchImpl) {
   if (fetchImpl) {
@@ -7215,11 +8146,11 @@ async function handleSearchTest(req, res, deps) {
       checkedAt
     );
     const response = { diagnostic, resultCount: results.length };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   } catch (error) {
     const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   }
 }
 async function handleSearchQuery(req, res, deps) {
@@ -7282,18 +8213,18 @@ async function handleSearchQuery(req, res, deps) {
       resultCount: sanitized.length,
       results: sanitized
     };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   } catch (error) {
     const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   }
 }
 
 // src/admin/searchAdminView.ts
 var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
 var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
-function isRecord7(value) {
+function isRecord9(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function redactSearchServerConfig(search) {
@@ -7343,13 +8274,13 @@ function resolveSecretField(entry, field, stored) {
   else delete entry[field];
 }
 function preserveSearchSecrets(incoming, current) {
-  if (!isRecord7(incoming)) return incoming;
+  if (!isRecord9(incoming)) return incoming;
   const section = { ...incoming };
   const providersValue = section["providers"];
-  if (!isRecord7(providersValue)) return section;
+  if (!isRecord9(providersValue)) return section;
   const providers = {};
   for (const [id, entryValue] of Object.entries(providersValue)) {
-    if (!isRecord7(entryValue)) {
+    if (!isRecord9(entryValue)) {
       providers[id] = entryValue;
       continue;
     }
@@ -7427,7 +8358,8 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord8(value) {
+var EFFORT_MAX_LENGTH = 32;
+function isRecord10(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -7447,7 +8379,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord8(entry)) {
+    if (!isRecord10(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -7476,12 +8408,18 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord8(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord10(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
+      } else if (entry.modelMappings.some(
+        (mapping) => mapping.effort !== void 0 && (typeof mapping.effort !== "string" || mapping.effort.trim() === "" || mapping.effort.trim().length > EFFORT_MAX_LENGTH)
+      )) {
+        errors.push(
+          `${path2}.modelMappings effort must be a non-empty string of at most ${EFFORT_MAX_LENGTH} characters`
+        );
       }
     }
-    if (!isRecord8(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord10(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -7496,7 +8434,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord8(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord10(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -7522,23 +8460,23 @@ import {
   toVoucherInfo,
   voucherCodePrefix
 } from "@omnicross/core/outbound-api";
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeErr2(res, status, message) {
-  writeJson2(res, status, { error: { type: "voucher_error", message } });
+  writeJson3(res, status, { error: { type: "voucher_error", message } });
 }
-function readJsonBody3(req) {
-  return new Promise((resolve11, reject) => {
+function readJsonBody4(req) {
+  return new Promise((resolve12, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
-      if (!raw.trim()) return resolve11({});
+      if (!raw.trim()) return resolve12({});
       try {
         const parsed = JSON.parse(raw);
-        resolve11(parsed && typeof parsed === "object" ? parsed : {});
+        resolve12(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
         reject(new Error("invalid-json"));
       }
@@ -7588,13 +8526,13 @@ async function handleVoucher(req, res, method, rest, deps) {
   if (!voucherDb) return writeErr2(res, 501, "Voucher feature is not available");
   if (method === "GET" && rest.length === 0) {
     const rows = await voucherDb.voucherList();
-    return writeJson2(res, 200, { vouchers: rows.map(toVoucherInfo) });
+    return writeJson3(res, 200, { vouchers: rows.map(toVoucherInfo) });
   }
   if (method === "POST" && rest.length === 0) {
     if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     let body;
     try {
-      body = await readJsonBody3(req);
+      body = await readJsonBody4(req);
     } catch {
       return writeErr2(res, 400, "Invalid JSON in request body");
     }
@@ -7607,7 +8545,7 @@ async function handleVoucher(req, res, method, rest, deps) {
       codePrefix: voucherCodePrefix(code),
       ...parsed.input
     });
-    return writeJson2(res, 201, {
+    return writeJson3(res, 201, {
       id: created.id,
       codePrefix: created.codePrefix,
       type: created.type,
@@ -7620,7 +8558,7 @@ async function handleVoucher(req, res, method, rest, deps) {
   if (method === "POST" && id && rest[1] === "revoke") {
     if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     const ok = await voucherDb.voucherRevokeCas(id, Date.now());
-    return writeJson2(res, ok ? 200 : 409, { ok });
+    return writeJson3(res, ok ? 200 : 409, { ok });
   }
   return writeErr2(res, 405, `method ${method} not allowed on voucher`);
 }
@@ -7781,7 +8719,7 @@ import {
 } from "@omnicross/core/outbound-api";
 
 // src/ports/account-multi.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var PROVIDER_KEYS = {
   claude: { block: "claude", accounts: "claudeAccounts", active: "activeClaudeAccountId" },
   codex: { block: "codex", accounts: "codexAccounts", active: "activeCodexAccountId" },
@@ -7855,7 +8793,7 @@ function migrateLazily(config) {
 }
 function addAccount(config, p, tokens, label) {
   const accounts = [...getAccounts(config, p)];
-  const id = randomUUID3();
+  const id = randomUUID4();
   accounts.push({
     id,
     label: label ?? `Account ${accounts.length + 1}`,
@@ -8544,22 +9482,22 @@ async function handlePricingResolveConflicts(body, deps) {
 }
 
 // src/admin/accountAllowanceApi.ts
-function writeJson3(res, status, body) {
+function writeJson4(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeError2(res, status, message) {
-  writeJson3(res, status, { error: { type: "account_allowance_error", message } });
+  writeJson4(res, status, { error: { type: "account_allowance_error", message } });
 }
 function readJson2(req) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
     req.on("end", () => {
       try {
         const text = Buffer.concat(chunks).toString("utf8");
         const parsed = text ? JSON.parse(text) : {};
-        resolve11(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
+        resolve12(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
       } catch (error) {
         reject(error);
       }
@@ -8582,7 +9520,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (!service.getSchedulingStatus) {
       return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
-    return writeJson3(res, 200, { scheduling: service.getSchedulingStatus() });
+    return writeJson4(res, 200, { scheduling: service.getSchedulingStatus() });
   }
   if (method === "GET") {
     const params = query(req);
@@ -8593,7 +9531,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     }
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
-    return writeJson3(res, 200, { allowances });
+    return writeJson4(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
     const body = await readJson2(req);
@@ -8609,7 +9547,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Codex account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "kimi") {
       if (!service.refreshKimi) {
@@ -8619,7 +9557,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Kimi account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "opencodego") {
       if (!service.refreshOpenCodeGo) {
@@ -8629,7 +9567,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `OpenCodeGo account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "copilot") {
       if (!service.refreshCopilot) {
@@ -8639,7 +9577,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Copilot account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "grok") {
       if (!service.refreshGrok) {
@@ -8649,7 +9587,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Grok account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "antigravity") {
       if (!service.refreshAntigravity) {
@@ -8659,7 +9597,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Antigravity account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "gemini") {
       if (!service.refreshGemini) {
@@ -8669,13 +9607,13 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Gemini account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     const allowances = await service.refreshClaude(accountId);
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
-    return writeJson3(res, 200, { allowances });
+    return writeJson4(res, 200, { allowances });
   }
   return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
@@ -8687,14 +9625,14 @@ import {
 } from "@omnicross/core/pipeline/AccountRouteActivity";
 import { getSharedOverloadCounter } from "@omnicross/core/pipeline/ServerOverloadCounter";
 function readBody(req) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve11(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve12(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
-async function readJsonBody4(req) {
+async function readJsonBody5(req) {
   const raw = await readBody(req);
   if (!raw.trim()) return {};
   try {
@@ -8704,12 +9642,12 @@ async function readJsonBody4(req) {
     return {};
   }
 }
-function writeJson4(res, status, body) {
+function writeJson5(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeJsonError(res, status, message) {
-  writeJson4(res, status, { error: { type: "admin_api_error", message } });
+function writeJsonError2(res, status, message) {
+  writeJson5(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -8730,7 +9668,7 @@ function toKeyInfo(row) {
     lastUsedAt: row.lastUsedAt,
     revoked: row.revokedAt !== null,
     kind: row.kind,
-    allowedEndpoints: [...effectiveOutboundPermissions2(row.allowedEndpoints)],
+    allowedEndpoints: [...effectiveOutboundPermissions3(row.allowedEndpoints)],
     legacyPermissions: row.allowedEndpoints === void 0,
     loopbackOnly: row.loopbackOnly,
     maxConcurrency: row.maxConcurrency,
@@ -8748,7 +9686,12 @@ function toKeyInfo(row) {
     // Per-key model restriction (#6) — secret-free scalars the UI pre-fills.
     enableModelRestriction: row.enableModelRestriction,
     restrictionMode: row.restrictionMode,
-    restrictedModels: row.restrictedModels
+    restrictedModels: row.restrictedModels,
+    // Direct upstream passthrough target (key→upstream binding) — references
+    // only, never a credential. Absent = the key is served by the downstream
+    // routes. `boundUpstreamProviderId` is the legacy first-cut shape.
+    boundUpstream: row.boundUpstream,
+    boundUpstreamProviderId: row.boundUpstreamProviderId
   };
 }
 function toProviderView(row) {
@@ -8842,10 +9785,10 @@ async function handleAdminApi(req, res, path2, deps) {
       case "pricing":
         return await handlePricing(req, res, method, rest, deps);
       default:
-        return writeJsonError(res, 404, `unknown admin resource '${resource}'`);
+        return writeJsonError2(res, 404, `unknown admin resource '${resource}'`);
     }
   } catch (err9) {
-    writeJsonError(res, 500, err9 instanceof Error ? err9.message : String(err9));
+    writeJsonError2(res, 500, err9 instanceof Error ? err9.message : String(err9));
   }
 }
 function requestQuery(req) {
@@ -8854,35 +9797,35 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson4(res, result.status, result.body);
+  writeJson5(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on usage`);
   return writeResult(res, await handleUsageGet(rest[0], requestQuery(req), deps));
 }
 async function handleDashboardRoute(res, method, deps) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson4(res, result.status, result.body);
+  return writeJson5(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
     if (method === "GET") return writeResult(res, await handlePricingList(deps));
     if (method === "PUT") {
-      return writeResult(res, await handlePricingUpsert(await readJsonBody4(req), deps));
+      return writeResult(res, await handlePricingUpsert(await readJsonBody5(req), deps));
     }
     if (method === "DELETE") {
       return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
     }
-    return writeJsonError(res, 405, `method ${method} not allowed on pricing`);
+    return writeJsonError2(res, 405, `method ${method} not allowed on pricing`);
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "fetch-latest") {
     return writeResult(res, await handlePricingFetchLatest(deps));
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
-    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody4(req), deps));
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody5(req), deps));
   }
-  return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
+  return writeJsonError2(res, 404, `unknown pricing route '${rest.join("/")}'`);
 }
 function migrationDeps(deps) {
   return {
@@ -8893,16 +9836,16 @@ function migrationDeps(deps) {
   };
 }
 async function handleMigrationExport(req, res, method, deps) {
-  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
-  const body = await readJsonBody4(req);
+  if (method !== "POST") return writeJsonError2(res, 405, `method ${method} not allowed on export`);
+  const body = await readJsonBody5(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson4(res, result.status, result.body);
+  return writeJson5(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
-  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
-  const body = await readJsonBody4(req);
+  if (method !== "POST") return writeJsonError2(res, 405, `method ${method} not allowed on import`);
+  const body = await readJsonBody5(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson4(res, result.status, result.body);
+  return writeJson5(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -8935,52 +9878,52 @@ async function handleProviders(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
-    if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson4(res, 200, { apiKey: row.apiKey ?? "" });
+    if (!row) return writeJsonError2(res, 404, `provider '${rest[0]}' not found`);
+    return writeJson5(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson4(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson5(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const provider = parseProviderInput(body, void 0);
-    if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
+    if (!provider) return writeJsonError2(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
     if (cfg.providers.some((p) => p.id === provider.id)) {
-      return writeJsonError(res, 409, `provider '${provider.id}' already exists`);
+      return writeJsonError2(res, 409, `provider '${provider.id}' already exists`);
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson4(res, 201, { provider: toProviderView(provider) });
+    return writeJson5(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   if (method === "PUT") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const existing = cfg.providers[idx];
     const updated = parseProviderInput(body, existing);
-    if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
+    if (!updated) return writeJsonError2(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson4(res, 200, { provider: toProviderView(updated) });
+    return writeJson5(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson4(res, 200, { ok: true });
+    return writeJson5(res, 200, { ok: true });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on providers`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on providers`);
 }
 function persistProviders(cfg, deps) {
   saveConfig(deps.configPath, cfg);
   deps.llmConfig.reload(cfg);
 }
 async function handleProviderReorder(req, res, cfg, deps) {
-  const body = await readJsonBody4(req);
+  const body = await readJsonBody5(req);
   const rawOrder = body["order"];
   if (!Array.isArray(rawOrder)) {
-    return writeJsonError(res, 400, "reorder requires { order: string[] }");
+    return writeJsonError2(res, 400, "reorder requires { order: string[] }");
   }
   const order = rawOrder.filter((x) => typeof x === "string");
   const byId = new Map(cfg.providers.map((p) => [p.id, p]));
@@ -9001,17 +9944,17 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson4(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson5(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 function expandRowExtraHeaders(row) {
   return mergeExtraHeaders({}, row.extraHeaders);
 }
 async function handleDiscoverModels(res, id, cfg) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
   if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
-    return writeJson4(res, 200, { models: [], unsupportedFormat: true });
+    return writeJson5(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -9020,6 +9963,7 @@ async function handleDiscoverModels(res, id, cfg) {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
     Object.assign(headers, expandRowExtraHeaders(row));
+    applyAdminProbeIdentity(headers, row);
     const response = await fetchUpstream10(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
@@ -9029,32 +9973,32 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson4(res, 200, { models });
+    return writeJson5(res, 200, { models });
   } catch (err9) {
     const message = err9 instanceof Error ? err9.message : String(err9);
-    return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson5(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody4(req);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
+  const body = await readJsonBody5(req);
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
-  if (!model) return writeJsonError(res, 400, "test requires a { model } string");
+  if (!model) return writeJsonError2(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson4(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson5(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson4(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson5(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
   let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
@@ -9078,6 +10022,7 @@ async function handleTestModel(req, res, id, cfg) {
     };
   }
   Object.assign(headers, expandRowExtraHeaders(row));
+  applyAdminProbeIdentity(headers, row);
   const startedAt = Date.now();
   try {
     const response = await fetchUpstream10(
@@ -9094,9 +10039,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson4(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson5(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -9104,7 +10049,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err9) {
     const message = err9 instanceof Error ? err9.message : String(err9);
-    return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson5(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -9141,9 +10086,9 @@ function toPoolKeyView(row, cooldown, deps) {
   });
 }
 async function handleProviderKeys(res, id, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
   const views = toPoolKeyView(row, cooldown, deps);
   if (deps.providerKeyQuota) {
@@ -9155,19 +10100,19 @@ async function handleProviderKeys(res, id, cfg, deps) {
       if (settled.status === "fulfilled" && settled.value) view.quota = settled.value;
     });
   }
-  return writeJson4(res, 200, { keys: views });
+  return writeJson5(res, 200, { keys: views });
 }
 async function handleProviderKeyQuotaRefresh(res, id, keyId, cfg, deps) {
-  if (!deps.providerKeyQuota) return writeJsonError(res, 501, "provider key quota is not available");
-  if (!id || !keyId) return writeJsonError(res, 400, "provider id and key id required in path");
+  if (!deps.providerKeyQuota) return writeJsonError2(res, 501, "provider key quota is not available");
+  if (!id || !keyId) return writeJsonError2(res, 400, "provider id and key id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
   try {
     const quota = await deps.providerKeyQuota.quotaFor(row, keyId, { force: true });
-    if (!quota) return writeJsonError(res, 404, `no quota endpoint for key '${keyId}'`);
-    return writeJson4(res, 200, { quota });
+    if (!quota) return writeJsonError2(res, 404, `no quota endpoint for key '${keyId}'`);
+    return writeJson5(res, 200, { quota });
   } catch {
-    return writeJsonError(res, 502, "quota refresh failed");
+    return writeJsonError2(res, 502, "quota refresh failed");
   }
 }
 function parsePoolKeyInput(body, existing) {
@@ -9184,12 +10129,12 @@ function parsePoolKeyInput(body, existing) {
   return out;
 }
 async function handleAddProviderKey(req, res, id, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody4(req);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
+  const body = await readJsonBody5(req);
   const parsed = parsePoolKeyInput(body);
-  if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
+  if (!parsed.apiKey) return writeJsonError2(res, 400, "add requires a non-empty apiKey");
   const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
   const entry = { id: keyId, apiKey: parsed.apiKey };
   if (parsed.label !== void 0) entry.label = parsed.label;
@@ -9199,17 +10144,17 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
-  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError2(res, 400, "key id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
-  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody4(req);
+  if (keyIdx < 0) return writeJsonError2(res, 404, `pool key '${keyId}' not found`);
+  const body = await readJsonBody5(req);
   const existing = row.apiKeys[keyIdx];
   const parsed = parsePoolKeyInput(body, existing);
   const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
@@ -9219,35 +10164,35 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
-  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError2(res, 400, "key id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
-  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
+  if (keyIdx < 0) return writeJsonError2(res, 404, `pool key '${keyId}' not found`);
   row.apiKeys.splice(keyIdx, 1);
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
-  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError2(res, 400, "key id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
-  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody4(req);
+  if (keyIdx < 0) return writeJsonError2(res, 404, `pool key '${keyId}' not found`);
+  const body = await readJsonBody5(req);
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -9419,7 +10364,7 @@ function parseProviderInput(body, existing) {
   };
 }
 function handlePresets(res, method) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on presets`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on presets`);
   const { mappable, excluded } = listMappablePresets();
   const presets = mappable.map((p) => ({
     id: p.id,
@@ -9438,13 +10383,13 @@ function handlePresets(res, method) {
     // row (the write gateway re-validates via the shared allowlist).
     extraHeaders: p.extraHeaders
   }));
-  return writeJson4(res, 200, { presets, excluded });
+  return writeJson5(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson4(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson5(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -9456,13 +10401,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson4(res, 200, { keys });
+    return writeJson5(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
     const created = await createNamedKey(deps.keyDb, name);
-    return writeJson4(res, 201, {
+    return writeJson5(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -9473,10 +10418,10 @@ async function handleKeys(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal") {
     const revealed = await deps.keyDb.outboundApiKeysReveal(rest[0]);
-    if (revealed !== null) return writeJson4(res, 200, { key: revealed });
+    if (revealed !== null) return writeJson5(res, 200, { key: revealed });
     const exists = (await deps.keyDb.outboundApiKeysList()).some((r) => r.id === rest[0]);
-    if (!exists) return writeJsonError(res, 404, `key '${rest[0]}' not found`);
-    return writeJsonError(
+    if (!exists) return writeJsonError2(res, 404, `key '${rest[0]}' not found`);
+    return writeJsonError2(
       res,
       409,
       `key '${rest[0]}' is not revealable (created before revealable key storage)`
@@ -9486,55 +10431,55 @@ async function handleKeys(req, res, method, rest, deps) {
   const action = rest[1];
   if (method === "POST" && id && action === "revoke") {
     const bound = await integrationKeyRequirement(deps, id);
-    if (bound) return writeJsonError(res, 409, bound);
+    if (bound) return writeJsonError2(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson4(res, ok ? 200 : 404, { ok });
+    return writeJson5(res, ok ? 200 : 404, { ok });
   }
   if (method === "DELETE" && id && !action) {
     const bound = await integrationKeyRequirement(deps, id);
-    if (bound) return writeJsonError(res, 409, bound);
+    if (bound) return writeJsonError2(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysDelete(id);
-    return writeJson4(res, ok ? 200 : 404, { ok });
+    return writeJson5(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const enabled = body["enabled"] === true;
     if (!enabled) {
       const bound = await integrationKeyRequirement(deps, id);
-      if (bound) return writeJsonError(res, 409, bound);
+      if (bound) return writeJsonError2(res, 409, bound);
     }
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson4(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson5(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "permissions") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "permissions")) {
-      return writeJsonError(res, 400, "body must contain only permissions");
+      return writeJsonError2(res, 400, "body must contain only permissions");
     }
     let permissions;
     try {
       permissions = validateOutboundPermissions(body["permissions"]);
     } catch {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         400,
         "permissions must be an array of unique chat, responses, messages, gemini, or images values"
       );
     }
     const before = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-    if (!before) return writeJson4(res, 404, { ok: false });
-    if (before.revokedAt !== null) return writeJson4(res, 409, { ok: false });
+    if (!before) return writeJson5(res, 404, { ok: false });
+    if (before.revokedAt !== null) return writeJson5(res, 409, { ok: false });
     const required = await integrationKeyRequirement(deps, id, permissions);
-    if (required) return writeJsonError(res, 409, required);
+    if (required) return writeJsonError2(res, 409, required);
     const ok = await deps.keyDb.outboundApiKeysSetPermissions(id, permissions);
     if (!ok) {
       const current = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-      return writeJson4(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
+      return writeJson5(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
     }
-    return writeJson4(res, 200, { ok: true, allowedEndpoints: permissions });
+    return writeJson5(res, 200, { ok: true, allowedEndpoints: permissions });
   }
   if (method === "POST" && id && action === "max-concurrency") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const raw = body["maxConcurrency"];
     let value;
     if (raw === null) {
@@ -9542,23 +10487,73 @@ async function handleKeys(req, res, method, rest, deps) {
     } else if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 1e3) {
       value = raw;
     } else {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         400,
         "maxConcurrency must be an integer 1..1000 or null"
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson4(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson5(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+  }
+  if (method === "POST" && id && action === "upstream") {
+    const body = await readJsonBody5(req);
+    let raw;
+    if (Object.prototype.hasOwnProperty.call(body, "target")) {
+      raw = body["target"];
+    } else if (Object.prototype.hasOwnProperty.call(body, "providerId")) {
+      const legacy = body["providerId"];
+      raw = legacy === null || legacy === void 0 ? null : { kind: "provider", providerId: legacy };
+    } else {
+      return writeJsonError2(res, 400, "body must contain target (or the legacy providerId)");
+    }
+    if (raw === null || raw === void 0) {
+      const ok2 = await deps.keyDb.outboundApiKeysSetUpstream(id, null);
+      return writeJson5(res, ok2 ? 200 : 404, { ok: ok2, target: null });
+    }
+    if (typeof raw !== "object" || Array.isArray(raw)) {
+      return writeJsonError2(res, 400, "target must be an object or null");
+    }
+    const t = raw;
+    const kind = t["kind"];
+    const providerId = typeof t["providerId"] === "string" ? t["providerId"].trim() : "";
+    if (!providerId) {
+      return writeJsonError2(res, 400, "target.providerId is required");
+    }
+    if (kind === "provider") {
+      const cfg = loadConfig(deps.configPath);
+      if (!cfg.providers.some((p) => p.id === providerId)) {
+        return writeJsonError2(res, 404, `provider '${providerId}' not found`);
+      }
+    } else if (kind === "account" || kind === "account-group" || kind === "account-pool") {
+      if (providerId !== "claude" && providerId !== "kimi") {
+        return writeJsonError2(
+          res,
+          400,
+          `subscription provider '${providerId}' cannot be direct-bound: its upstream wire differs from the client wire (translation required \u2014 use a downstream route); only claude and kimi subscriptions speak the same Anthropic Messages wire as the client`
+        );
+      }
+      if (kind === "account" && typeof t["accountId"] !== "string") {
+        return writeJsonError2(res, 400, "target.accountId is required for kind account");
+      }
+      if (kind === "account-group" && typeof t["group"] !== "string") {
+        return writeJsonError2(res, 400, "target.group is required for kind account-group");
+      }
+    } else {
+      return writeJsonError2(res, 400, "target.kind must be provider, account, account-group, or account-pool");
+    }
+    const target = raw;
+    const ok = await deps.keyDb.outboundApiKeysSetUpstream(id, target);
+    return writeJson5(res, ok ? 200 : 404, { ok, target });
   }
   if (method === "POST" && id && action === "policy") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const parsed = parseKeyPolicyBody(body);
-    if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
+    if (!parsed.ok) return writeJsonError2(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson4(res, ok ? 200 : 404, { ok });
+    return writeJson5(res, ok ? 200 : 404, { ok });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on keys`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on keys`);
 }
 function validateQueueSegments(patch) {
   const errors = [];
@@ -9722,17 +10717,17 @@ async function handleServer(req, res, method, deps) {
         search: redactSearchServerConfig(config.search)
       };
     }
-    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(server) });
+    return writeJson5(res, 200, { server: projectImagesConfigForAdmin(server) });
   }
   if (method === "PUT") {
-    const patch = await readJsonBody4(req);
+    const patch = await readJsonBody5(req);
     const queueErrors = validateQueueSegments(patch);
     if (queueErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
     }
     const allowanceErrors = validateAllowanceSchedulingSegment(patch);
     if (allowanceErrors.length > 0) {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         400,
         `invalid allowance scheduling config: ${allowanceErrors.join("; ")}`
@@ -9740,19 +10735,19 @@ async function handleServer(req, res, method, deps) {
     }
     const bindingErrors = validateGatewayBindingsSegment(patch);
     if (bindingErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid gateway bindings: ${bindingErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid gateway bindings: ${bindingErrors.join("; ")}`);
     }
     const webhookErrors = validateWebhookSegment(patch);
     if (webhookErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
     }
     const auditErrors = validateAuditSegment(patch);
     if (auditErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid audit config: ${auditErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid audit config: ${auditErrors.join("; ")}`);
     }
     const billingErrors = validateBillingSegment(patch);
     if (billingErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
     }
     const current = await loadServerConfig3(deps.settingsStore);
     let effectivePatch = patch;
@@ -9771,7 +10766,7 @@ async function handleServer(req, res, method, deps) {
         remoteResolverAvailable: deps.imageRemoteResolverAvailable
       });
       if (imageErrors.length > 0) {
-        return writeJsonError(res, 400, `invalid Images config: ${imageErrors.join("; ")}`);
+        return writeJsonError2(res, 400, `invalid Images config: ${imageErrors.join("; ")}`);
       }
       effectivePatch = { ...effectivePatch, images };
     }
@@ -9782,7 +10777,7 @@ async function handleServer(req, res, method, deps) {
       );
       const searchErrors = validateSearchServerConfig(searchPatch);
       if (searchErrors.length > 0) {
-        return writeJsonError(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
+        return writeJsonError2(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
       }
       effectivePatch = {
         ...effectivePatch,
@@ -9824,7 +10819,7 @@ async function handleServer(req, res, method, deps) {
       });
     } catch (error) {
       if (error instanceof ServerConfigTransactionError) {
-        return writeJsonError(res, 500, error.message);
+        return writeJsonError2(res, 500, error.message);
       }
       throw error;
     }
@@ -9845,24 +10840,27 @@ async function handleServer(req, res, method, deps) {
       ...merged,
       search: redactSearchServerConfig(merged.search)
     } : merged;
-    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
+    return writeJson5(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on server`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on server`);
 }
 async function handleAccounts(req, res, method, rest, deps) {
   if (rest[0] === "route-activity" && rest.length === 1) {
     if (method !== "GET") {
-      return writeJsonError(res, 405, `method ${method} not allowed on account route activity`);
+      return writeJsonError2(res, 405, `method ${method} not allowed on account route activity`);
     }
     const query2 = requestQuery(req);
     const parsedLimit = Number(query2.get("limit") ?? "100");
+    const kindParam = query2.get("credentialKind");
+    const credentialKind = kindParam === "subscription-account" || kindParam === "provider-key" ? kindParam : void 0;
     const records = getSharedAccountRouteActivity().list({
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0,
       sessionKey: query2.get("sessionKey") ?? void 0,
+      credentialKind,
       limit: Number.isFinite(parsedLimit) ? parsedLimit : 100
     });
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       available: true,
       records,
       capacity: ACCOUNT_ROUTE_ACTIVITY_LIMIT,
@@ -9871,14 +10869,14 @@ async function handleAccounts(req, res, method, rest, deps) {
   }
   if (rest[0] === "overload-counters" && rest.length === 1) {
     if (method !== "GET") {
-      return writeJsonError(res, 405, `method ${method} not allowed on overload counters`);
+      return writeJsonError2(res, 405, `method ${method} not allowed on overload counters`);
     }
     const query2 = requestQuery(req);
     const entries = getSharedOverloadCounter().list({
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0
     });
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       available: true,
       entries,
       collectedAt: Date.now()
@@ -9897,21 +10895,21 @@ async function handleAccounts(req, res, method, rest, deps) {
     const result = await handleAntigravityModelsRoute({
       resolveAntigravityAccessToken: deps.resolveAntigravityAccessToken ?? (async () => null)
     });
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 0) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson4(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson5(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const parsed = validateAccountBatchBody(body);
-    if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
+    if (!parsed) return writeJsonError2(res, 400, "invalid account batch request");
     const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
     if (!result.ok) {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         404,
         `account '${result.missing.accountId}' not found for provider '${result.missing.providerId}'`
@@ -9922,23 +10920,23 @@ async function handleAccounts(req, res, method, rest, deps) {
         deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
       }
     }
-    return writeJson4(res, 200, { ok: true, affected: result.affected });
+    return writeJson5(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && (rest[0] === "codex" || rest[0] === "kimi" || rest[0] === "grok" || rest[0] === "copilot" || rest[0] === "antigravity") && rest[1] === "oauth" && rest[3] === "status") {
     const result = rest[0] === "codex" ? handleCodexOAuthStatus(rest[2], deps) : rest[0] === "kimi" ? handleKimiOAuthStatus(rest[2], deps) : rest[0] === "grok" ? handleGrokOAuthStatus(rest[2], deps) : rest[0] === "copilot" ? handleCopilotOAuthStatus(rest[2], deps) : handleAntigravityOAuthStatus(rest[2], deps);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "DELETE" && (rest[0] === "codex" || rest[0] === "kimi" || rest[0] === "grok" || rest[0] === "copilot" || rest[0] === "antigravity") && rest[1] === "oauth" && rest[2]) {
     const result = rest[0] === "codex" ? handleCodexOAuthCancel(rest[2], deps) : rest[0] === "kimi" ? handleKimiOAuthCancel(rest[2], deps) : rest[0] === "grok" ? handleGrokOAuthCancel(rest[2], deps) : rest[0] === "copilot" ? handleCopilotOAuthCancel(rest[2], deps) : handleAntigravityOAuthCancel(rest[2], deps);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
     const providerId = asSubscriptionProviderId(rest[0]);
-    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    if (!providerId) return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     const accountId = rest[1];
     const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
-      return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJsonError2(res, 404, `account '${accountId}' not found`);
     }
     const health2 = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
     const allowance = deps.accountAllowanceService?.getSchedulingStatus?.()?.history.filter((entry) => entry.providerId === providerId && entry.accountId === accountId).map((entry) => ({
@@ -9952,88 +10950,88 @@ async function handleAccounts(req, res, method, rest, deps) {
       resumeAt: entry.resumeAt
     })) ?? [];
     const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
-    return writeJson4(res, 200, { diagnostics });
+    return writeJson5(res, 200, { diagnostics });
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "events") {
     const providerId = asSubscriptionProviderId(rest[0]);
-    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    if (!providerId) return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     const accountId = rest[1];
     const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
-      return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJsonError2(res, 404, `account '${accountId}' not found`);
     }
     const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
     const diagnostics = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
-    return writeJson4(res, 200, { events: snapshot?.records ?? [], diagnostics });
+    return writeJson5(res, 200, { events: snapshot?.records ?? [], diagnostics });
   }
   if (method === "PATCH" && rest.length === 2) {
     const providerId = asSubscriptionProviderId(rest[0]);
-    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
-    const body = await readJsonBody4(req);
+    if (!providerId) return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const body = await readJsonBody5(req);
     const patch = validateAccountMetadataPatch(body);
-    if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
+    if (!patch) return writeJsonError2(res, 400, "invalid account metadata patch");
     const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
-    if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
-    return writeJson4(res, 200, { ok: true });
+    if (!result.ok) return writeJsonError2(res, 404, `account '${rest[1]}' not found`);
+    return writeJson5(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) {
-      return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       if (providerId === "codex") {
         const result2 = handleCodexOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "kimi") {
         const result2 = await handleKimiOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "grok") {
         const result2 = await handleGrokOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "copilot") {
-        const body2 = await readJsonBody4(req);
+        const body2 = await readJsonBody5(req);
         const result2 = await handleCopilotOAuthStart(deps, body2["enterpriseUrl"]);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "antigravity") {
         const result2 = handleAntigravityOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       const result = handleOAuthStart(providerId, deps);
-      return writeJson4(res, result.status, result.body);
+      return writeJson5(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson4(res, result.status, result.body);
+      return writeJson5(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const block = validateTokenBody(providerId, body2);
       if (!block) {
-        return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
+        return writeJsonError2(res, 400, `malformed token body for provider '${providerId}'`);
       }
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson4(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson5(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
-        return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
+        return writeJsonError2(res, 400, `provider '${providerId}' has no external CLI store`);
       }
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
       if (!result.ok) {
-        return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
+        return writeJsonError2(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         ok: true,
         account: status2 ?? void 0,
         nativeCredentialMode: result.nativeCredentialMode,
@@ -10043,22 +11041,22 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "refresh") {
       if (providerId === "opencodego") {
-        return writeJsonError(res, 400, "opencodego credentials are not refreshable");
+        return writeJsonError2(res, 400, "opencodego credentials are not refreshable");
       }
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson4(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson5(res, 200, { ok, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest.length === 3 && rest[2] === "test") {
       const accountId = rest[1];
-      if (!deps.accountProbeService) return writeJsonError(res, 501, "account probe service unavailable");
+      if (!deps.accountProbeService) return writeJsonError2(res, 501, "account probe service unavailable");
       const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
       if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
-        return writeJsonError(res, 404, `account '${accountId}' not found`);
+        return writeJsonError2(res, 404, `account '${accountId}' not found`);
       }
       const result = await deps.accountProbeService.testAccountConnection(providerId, accountId);
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         ok: result.ok,
         marked: result.marked,
         tier: result.tier,
@@ -10067,176 +11065,189 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const raw = body2["priority"];
       const priority = typeof raw === "number" ? raw : Number(raw);
       if (!Number.isFinite(priority)) {
-        return writeJsonError(res, 400, "priority must be a finite number");
+        return writeJsonError2(res, 400, "priority must be a finite number");
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const rawProxy = body2["proxy"];
       let proxy;
       if (rawProxy !== null && rawProxy !== void 0) {
         proxy = normalizeProxyConfig(rawProxy);
-        if (!proxy) return writeJsonError(res, 400, "invalid proxy config");
+        if (!proxy) return writeJsonError2(res, 400, "invalid proxy config");
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const parsed = validateSupportedModelsBody(body2["supportedModels"]);
-      if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
+      if (!parsed.ok) return writeJsonError2(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
-      if (!id) return writeJsonError(res, 400, "active switch requires { id }");
+      if (!id) return writeJsonError2(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
-      if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${id}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
-      if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      if (!result.removed) return writeJsonError2(res, 404, `account '${accountId}' not found`);
       deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
-      return writeJson4(res, 200, { ok: true });
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
       deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
-      return writeJson4(res, 200, { ok: true });
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "DELETE") {
-      return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
+      return writeJsonError2(res, 405, "method DELETE not allowed on this accounts path");
     }
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const config = validateTokenBody(providerId, body);
     if (!config) {
-      return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
+      return writeJsonError2(res, 400, `malformed token body for provider '${providerId}'`);
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson4(res, 200, status ? { account: status } : { ok: true });
+    return writeJson5(res, 200, status ? { account: status } : { ok: true });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
-      return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
-      return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown cli '${cli ?? ""}'`);
     }
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const providers = loadConfig(deps.configPath).providers ?? [];
+    const codexAuthHelper = deps.codexAuthHelper;
+    const keyScoped = codexAuthHelper ? await (async () => {
+      const gateway = deps.outboundApiServer.getStatus();
+      const serverConfig = await loadServerConfig3(deps.settingsStore);
+      return {
+        keyDb: deps.keyDb,
+        bindings: serverConfig.bindings ?? [],
+        gatewayRunning: gateway.running,
+        gatewayBaseUrl: gateway.loopbackUrl ?? `http://127.0.0.1:${gateway.port}`,
+        codexAuthHelper
+      };
+    })() : void 0;
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
       providers,
       routeLeaseManager: deps.routeLeaseManager,
+      keyScoped,
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on cli`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on cli`);
 }
 async function handleIntegrations(req, res, method, rest, deps) {
   const factory = deps.integrationManagerFactory;
-  if (!factory) return writeJsonError(res, 501, "native CLI integration is not available");
+  if (!factory) return writeJsonError2(res, 501, "native CLI integration is not available");
   const manager = factory();
   try {
     if (method === "GET" && rest.length === 0) {
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         integrations: await manager.listStatus(),
         gateway: deps.outboundApiServer.getStatus()
       });
     }
     if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
       await manager.rotateGatewayKey();
-      return writeJson4(res, 200, { ok: true, integrations: await manager.listStatus() });
+      return writeJson5(res, 200, { ok: true, integrations: await manager.listStatus() });
     }
     const client = rest[0];
     if (!isIntegrationClient(client)) {
-      return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown integration client '${client ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "key") {
-      const body = await readJsonBody4(req);
+      const body = await readJsonBody5(req);
       if (Object.keys(body).length !== 1 || typeof body.keyId !== "string" || !body.keyId.trim()) {
-        return writeJsonError(res, 400, "body must contain a non-empty keyId string");
+        return writeJsonError2(res, 400, "body must contain a non-empty keyId string");
       }
       const status = await manager.bindIntegrationKey(client, body.keyId.trim());
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "plan") {
-      const body = await readJsonBody4(req);
+      const body = await readJsonBody5(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
-        return writeJsonError(res, 400, "configPath must be a string");
+        return writeJsonError2(res, 400, "configPath must be a string");
       }
       const plan = await manager.plan(client, configPath);
-      return writeJson4(res, 200, { plan });
+      return writeJson5(res, 200, { plan });
     }
     if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
-      const body = await readJsonBody4(req);
+      const body = await readJsonBody5(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
-        return writeJsonError(res, 400, "configPath must be a string");
+        return writeJsonError2(res, 400, "configPath must be a string");
       }
       const status = await manager.install(client, configPath);
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "repair") {
       const status = await manager.repair(client);
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
     if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
       const status = await manager.remove(client);
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
-    return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
+    return writeJsonError2(res, 405, `method ${method} not allowed on integrations`);
   } catch (error) {
     if (error instanceof IntegrationConflictError) {
-      return writeJsonError(res, 409, error.message);
+      return writeJsonError2(res, 409, error.message);
     }
     throw error;
   }
@@ -10379,7 +11390,7 @@ function imageProviderEvidence(images, capabilities) {
 async function handleImagesVerifyLive(req, res, deps) {
   const verifier = deps.imageLiveVerifier;
   if (!verifier) {
-    return writeJsonError(res, 501, "Images live verification is not available");
+    return writeJsonError2(res, 501, "Images live verification is not available");
   }
   const serverConfig = await loadServerConfig3(deps.settingsStore);
   const images = serverConfig.images ?? DEFAULT_IMAGES_SERVER_CONFIG;
@@ -10388,7 +11399,7 @@ async function handleImagesVerifyLive(req, res, deps) {
   req.on("close", () => controller.abort());
   const result = await verifier.verifyLive(images, controller.signal);
   const antigravityRouted = Object.values(images.models).includes("antigravity-subscription");
-  return writeJson4(res, 200, {
+  return writeJson5(res, 200, {
     ...result,
     ...antigravityRouted ? { antigravityDeferred: true } : {}
   });
@@ -10396,18 +11407,18 @@ async function handleImagesVerifyLive(req, res, deps) {
 async function handleImages(req, res, method, rest, deps) {
   if (rest.length === 1 && rest[0] === "verify-live") {
     if (method !== "POST") {
-      return writeJsonError(res, 405, `method ${method} not allowed on Images verify-live`);
+      return writeJsonError2(res, 405, `method ${method} not allowed on Images verify-live`);
     }
     return handleImagesVerifyLive(req, res, deps);
   }
   if (rest.length !== 1 || rest[0] !== "capabilities") {
-    return writeJsonError(res, 404, "unknown Images admin resource");
+    return writeJsonError2(res, 404, "unknown Images admin resource");
   }
   if (method !== "GET") {
-    return writeJsonError(res, 405, `method ${method} not allowed on Images capabilities`);
+    return writeJsonError2(res, 405, `method ${method} not allowed on Images capabilities`);
   }
   const reader = deps.imageRuntimeStatus;
-  if (!reader) return writeJsonError(res, 501, "Images runtime status is not available");
+  if (!reader) return writeJsonError2(res, 501, "Images runtime status is not available");
   const serverConfig = await loadServerConfig3(deps.settingsStore);
   const images = serverConfig.images ?? DEFAULT_IMAGES_SERVER_CONFIG;
   const lifecycle = reader.status();
@@ -10428,7 +11439,7 @@ async function handleImages(req, res, method, rest, deps) {
     httpLeases: safeStatusCount(generation.httpLeases),
     hostedLeases: safeStatusCount(generation.hostedLeases)
   }));
-  return writeJson4(res, 200, {
+  return writeJson5(res, 200, {
     configured: {
       enabled: images.enabled,
       provider: images.models[images.defaultModel] ?? "codex-subscription",
@@ -10455,7 +11466,7 @@ async function handleImages(req, res, method, rest, deps) {
   });
 }
 async function handleStatus(res, method, deps) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
   const serverConfig = await loadServerConfig3(deps.settingsStore);
   const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
@@ -10495,14 +11506,14 @@ async function handleStatus(res, method, deps) {
   })() : void 0;
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       ...status,
       endpoints,
       queueStatus,
       ...imageRuntime ? { imageRuntime } : {}
     });
   }
-  return writeJson4(res, 200, {
+  return writeJson5(res, 200, {
     ...status,
     endpoints,
     ...imageRuntime ? { imageRuntime } : {}
@@ -10525,23 +11536,23 @@ function resolvePlaygroundPath(endpoint, body) {
   }
 }
 async function handlePlayground(req, res, method, deps) {
-  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
-  const body = await readJsonBody4(req);
+  if (method !== "POST") return writeJsonError2(res, 405, `method ${method} not allowed on playground`);
+  const body = await readJsonBody5(req);
   const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
   const key = typeof body["key"] === "string" ? body["key"] : "";
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
-  if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord9(payload) ? payload : {});
-  if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
+  if (!status.running || !status.port) return writeJsonError2(res, 503, "outbound server not running");
+  const path2 = resolvePlaygroundPath(endpoint, isRecord11(payload) ? payload : {});
+  if (!path2) return writeJsonError2(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord9(v) {
+function isRecord11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const upstream = http.request(
       {
         host: "127.0.0.1",
@@ -10562,14 +11573,14 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
         proxRes.on("data", (chunk) => res.write(chunk));
         proxRes.on("end", () => {
           res.end();
-          resolve11();
+          resolve12();
         });
       }
     );
     upstream.on("error", (err9) => {
-      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err9.message}`);
+      if (!res.headersSent) writeJsonError2(res, 502, `playground proxy failed: ${err9.message}`);
       else res.end();
-      resolve11();
+      resolve12();
     });
     upstream.write(body);
     upstream.end();
@@ -10577,8 +11588,8 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 }
 
 // src/admin/uiStatic.ts
-import { existsSync as existsSync9, statSync as statSync5 } from "fs";
-import { readFile } from "fs/promises";
+import { existsSync as existsSync10, statSync as statSync5 } from "fs";
+import { readFile as readFile2 } from "fs/promises";
 import { createRequire } from "module";
 import path from "path";
 var CONTENT_TYPES = {
@@ -10600,13 +11611,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return existsSync9(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
+    return existsSync10(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
   }
   try {
     const req = createRequire(typeof __filename !== "undefined" ? __filename : import.meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
     const dist = path.join(path.dirname(pkgJson), "dist");
-    return existsSync9(path.join(dist, "index.html")) ? dist : null;
+    return existsSync10(path.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -10655,7 +11666,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     return true;
   }
   let target = filePath;
-  if (!existsSync9(target) || statSync5(target).isDirectory()) {
+  if (!existsSync10(target) || statSync5(target).isDirectory()) {
     if (path.extname(rel) === "") {
       target = path.join(uiDist, "index.html");
     } else {
@@ -10664,7 +11675,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
       return true;
     }
   }
-  const body = await readFile(target);
+  const body = await readFile2(target);
   const type = CONTENT_TYPES[path.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
@@ -10672,7 +11683,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.4.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.4.6" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -10711,14 +11722,14 @@ var AdminServer = class {
   }
   /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
   listen(bindAddr, port) {
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const server = http2.createServer((req, res) => {
         this.onRequest(req, res);
       });
       const onError = (err9) => {
         if (err9.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
-          this.listen(bindAddr, 0).then(resolve11, reject);
+          this.listen(bindAddr, 0).then(resolve12, reject);
           return;
         }
         reject(err9);
@@ -10730,7 +11741,7 @@ var AdminServer = class {
           server.removeListener("error", onError);
           server.on("error", (e) => this.deps.logger.error("[AdminServer] server error", e));
           this.server = server;
-          resolve11(addr.port);
+          resolve12(addr.port);
         } else {
           reject(new Error("Failed to get admin server address"));
         }
@@ -10804,6 +11815,10 @@ var AdminServer = class {
       await handleRouteLeaseApi(req, res, path2, this.deps);
       return;
     }
+    if (path2 === "/admin/api/codex-sessions" || path2 === "/admin/api/codex-sessions/preview" || path2 === "/admin/api/codex-sessions/apply") {
+      await handleCodexSessionApi(req, res, path2, this.deps.codexSessionManager);
+      return;
+    }
     if (path2.startsWith("/admin/api/")) {
       await handleAdminApi(req, res, path2, this.deps);
       return;
@@ -10827,8 +11842,8 @@ var AdminServer = class {
     if (!server) return;
     this.server = null;
     this.boundPort = 0;
-    return new Promise((resolve11) => {
-      server.close(() => resolve11());
+    return new Promise((resolve12) => {
+      server.close(() => resolve12());
     });
   }
   /** A live status snapshot. */
@@ -10967,7 +11982,7 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
   const port = binding.port ?? LOOPBACK_PORT;
   const callbackPath = binding.path ?? CALLBACK_PATH;
   const label = binding.label ?? "codex";
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
       if (settled) return;
@@ -10999,7 +12014,7 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       }
       res.writeHead(200, HTML_HEADERS);
       res.end(pageHtml("Login complete."));
-      finish(server, () => resolve11(code));
+      finish(server, () => resolve12(code));
     });
     const abort = () => finish(server, () => reject(new Error("login: cancelled")));
     if (signal?.aborted) {
@@ -11128,7 +12143,7 @@ function secondsUntil9(instant, now) {
   if (!instant) return void 0;
   return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
 }
-function isRecord10(value) {
+function isRecord12(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function detectProviderKeyQuotaAdapter(baseUrl) {
@@ -11195,17 +12210,17 @@ function zaiWindowIdLabel(durationMs) {
   return { id: "quota", label: "Quota" };
 }
 function parseZaiQuotaPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const data = isRecord10(payload["data"]) ? payload["data"] : payload;
+  if (!isRecord12(payload)) return null;
+  const data = isRecord12(payload["data"]) ? payload["data"] : payload;
   if (payload["success"] === false) return null;
   const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
   const byWindow = /* @__PURE__ */ new Map();
   for (const raw of limits) {
-    if (!isRecord10(raw)) continue;
+    if (!isRecord12(raw)) continue;
     const item = raw;
     if (item.type === void 0) continue;
     const details = raw["usageDetails"];
-    if (Array.isArray(details) && details.some((d) => isRecord10(d) && d["modelCode"] === "zread")) {
+    if (Array.isArray(details) && details.some((d) => isRecord12(d) && d["modelCode"] === "zread")) {
       continue;
     }
     const durationMs = zaiWindowDurationMs(item);
@@ -11238,7 +12253,7 @@ function parseZaiQuotaPayload(payload, now) {
 var MINIMAX_STATUS_EXHAUSTED = 2;
 var MINIMAX_SHARED_BUCKET = "general";
 function parseMiniMaxBucket(value) {
-  if (!isRecord10(value)) return null;
+  if (!isRecord12(value)) return null;
   const modelName = typeof value["model_name"] === "string" ? value["model_name"].trim() : "";
   if (!modelName) return null;
   const instant = (v) => {
@@ -11270,9 +12285,9 @@ function minimaxWindow(id, label, windowMinutes, resetsAtMs, remainingPercent, s
   };
 }
 function parseMiniMaxTokenPlanPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
+  if (!isRecord12(payload)) return null;
   const baseResp = payload["base_resp"];
-  if (!isRecord10(baseResp) || baseResp["status_code"] !== 0) return null;
+  if (!isRecord12(baseResp) || baseResp["status_code"] !== 0) return null;
   const buckets = Array.isArray(payload["model_remains"]) ? payload["model_remains"] : [];
   let general = null;
   for (const raw of buckets) {
@@ -11305,11 +12320,11 @@ function parseMiniMaxTokenPlanPayload(payload, now) {
   ];
 }
 function parseUmansUsagePayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const limits = isRecord10(payload["limits"]) ? payload["limits"] : void 0;
-  const requests = limits && isRecord10(limits["requests"]) ? limits["requests"] : void 0;
-  const usage = isRecord10(payload["usage"]) ? payload["usage"] : void 0;
-  const window = isRecord10(payload["window"]) ? payload["window"] : void 0;
+  if (!isRecord12(payload)) return null;
+  const limits = isRecord12(payload["limits"]) ? payload["limits"] : void 0;
+  const requests = limits && isRecord12(limits["requests"]) ? limits["requests"] : void 0;
+  const usage = isRecord12(payload["usage"]) ? payload["usage"] : void 0;
+  const window = isRecord12(payload["window"]) ? payload["window"] : void 0;
   const hardCap = finiteNumber5(requests?.["hard_cap"]);
   const softLimit = finiteNumber5(requests?.["limit"]);
   const requestsInWindow = finiteNumber5(usage?.["requests_in_window"]);
@@ -11336,9 +12351,9 @@ function parseUmansUsagePayload(payload, now) {
   ];
 }
 function parseSyntheticQuotasPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const fiveHour = isRecord10(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
-  const weekly = isRecord10(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
+  if (!isRecord12(payload)) return null;
+  const fiveHour = isRecord12(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
+  const weekly = isRecord12(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
   const windows = [];
   if (fiveHour) {
     const max = finiteNumber5(fiveHour["max"]);
@@ -11379,12 +12394,12 @@ var CLINE_WINDOW_CONFIG = {
   monthly: { id: "thirty-day", label: "30 days", minutes: 30 * 24 * 60 }
 };
 function parseClinePassUsageLimitsPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const data = isRecord10(payload["data"]) ? payload["data"] : payload;
+  if (!isRecord12(payload)) return null;
+  const data = isRecord12(payload["data"]) ? payload["data"] : payload;
   const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
   const windows = [];
   for (const raw of limits) {
-    if (!isRecord10(raw)) continue;
+    if (!isRecord12(raw)) continue;
     const config = CLINE_WINDOW_CONFIG[typeof raw["type"] === "string" ? raw["type"] : ""];
     if (!config) continue;
     const usedPercent = finitePercent4(raw["percentUsed"]);
@@ -11553,7 +12568,7 @@ import { createHmac as createHmac2, randomBytes as randomBytes5 } from "crypto";
 import {
   chmodSync as chmodSync6,
   closeSync as closeSync3,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync3,
   openSync as openSync3,
@@ -11562,7 +12577,7 @@ import {
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync8
 } from "fs";
-import { basename as basename2, dirname as dirname6, join as join10, resolve as resolve4 } from "path";
+import { basename as basename3, dirname as dirname6, join as join11, resolve as resolve5 } from "path";
 import { IMAGE_SERVER_HARD_CEILINGS } from "@omnicross/core/outbound-api";
 
 // src/image-generation/imageTenantHmac.ts
@@ -11571,7 +12586,7 @@ import {
   chmodSync as chmodSync5,
   closeSync as closeSync2,
   constants,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   fstatSync,
   fsyncSync,
   lstatSync as lstatSync2,
@@ -11579,7 +12594,7 @@ import {
   readFileSync as readFileSync8,
   writeFileSync as writeFileSync7
 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var TENANT_SALT_NAME = "tenant-hmac-salt.v1.bin";
 var TENANT_KEY_PATTERN = /^[a-f0-9]{64}$/u;
 var REFERENCE_DOMAIN = Buffer.from("omnicross:image-reference:tenant:v1\0", "utf8");
@@ -11597,8 +12612,8 @@ function deriveImageTenantHmac(salt, purpose, tenantId) {
 }
 function loadOrCreateImageTenantHmacSalt(paths, random) {
   const root = paths.verifiedRoot("mountManifest");
-  const path2 = join9(root, TENANT_SALT_NAME);
-  if (!existsSync10(path2)) {
+  const path2 = join10(root, TENANT_SALT_NAME);
+  if (!existsSync11(path2)) {
     const salt = random(32);
     if (salt.byteLength !== 32) throw new TypeError("image tenant HMAC salt generator returned invalid bytes");
     let fd2;
@@ -11703,8 +12718,8 @@ function validateObservation(value) {
   }
 }
 function samePath2(left, right) {
-  const a = resolve4(left);
-  const b = resolve4(right);
+  const a = resolve5(left);
+  const b = resolve5(right);
   return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 }
 function capabilityValues(entry) {
@@ -11766,7 +12781,7 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
     this.#replaceManifest = options.replaceManifest ?? ((target, contents) => {
       this.#atomicReplace(target, contents);
     });
-    if (existsSync11(this.#manifestPath())) this.#load();
+    if (existsSync12(this.#manifestPath())) this.#load();
   }
   createSource(ttlMs) {
     return new FileCodexImageCapabilityEvidenceSource({ owner: this, ttlMs });
@@ -11878,7 +12893,7 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
     return Math.min(entry.expiresAt, entry.verifiedAt + ttlMs);
   }
   #manifestPath() {
-    return join10(this.#paths.verifiedRoot("evidence"), MANIFEST_NAME);
+    return join11(this.#paths.verifiedRoot("evidence"), MANIFEST_NAME);
   }
   #serialized(entries, revision) {
     const manifest = {
@@ -11923,15 +12938,15 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
     this.#entries = entries;
   }
   #refresh() {
-    if (!existsSync11(this.#manifestPath())) return;
+    if (!existsSync12(this.#manifestPath())) return;
     this.#load();
   }
   #atomicReplace(targetPath, contents) {
     const root = this.#paths.verifiedRoot("evidence");
-    if (!samePath2(dirname6(resolve4(targetPath)), root) || basename2(targetPath) !== MANIFEST_NAME) {
+    if (!samePath2(dirname6(resolve5(targetPath)), root) || basename3(targetPath) !== MANIFEST_NAME) {
       throw new TypeError("Codex image evidence manifest target is invalid");
     }
-    const temporaryPath = join10(
+    const temporaryPath = join11(
       root,
       `.codex-image-evidence.${process.pid}.${this.#random(8).toString("hex")}.tmp`
     );
@@ -11951,7 +12966,7 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
         } catch {
         }
       }
-      if (existsSync11(temporaryPath)) {
+      if (existsSync12(temporaryPath)) {
         try {
           unlinkSync5(temporaryPath);
         } catch {
@@ -12543,11 +13558,11 @@ var DaemonImageExecutionScheduler = class {
         retrySafety: "before_acceptance"
       });
     }
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const waiter = {
         tenantKey,
         signal: request.signal,
-        resolve: resolve11,
+        resolve: resolve12,
         reject,
         onAbort: () => void 0,
         settled: false
@@ -12710,7 +13725,7 @@ import {
   ImageGenerationError as ImageGenerationError3,
   ImageRequestResourceScope
 } from "@omnicross/core/image-generation";
-import { dirname as dirname7, resolve as resolve5 } from "path";
+import { dirname as dirname7, resolve as resolve6 } from "path";
 function capacityExceeded() {
   throw new ImageGenerationError3("image_too_large");
 }
@@ -12795,10 +13810,10 @@ var DaemonImageActiveScopeRegistry = class {
   #temporaryRoot;
   #active = /* @__PURE__ */ new Set();
   constructor(paths) {
-    this.#temporaryRoot = resolve5(paths.paths.temporaryRoot);
+    this.#temporaryRoot = resolve6(paths.paths.temporaryRoot);
   }
   register(privateDirectory) {
-    const normalized2 = resolve5(privateDirectory);
+    const normalized2 = resolve6(privateDirectory);
     if (dirname7(normalized2) !== this.#temporaryRoot || this.#active.has(normalized2)) {
       throw new TypeError("image temporary scope directory is invalid or already active");
     }
@@ -12811,7 +13826,7 @@ var DaemonImageActiveScopeRegistry = class {
     };
   }
   isActive(privateDirectory) {
-    return this.#active.has(resolve5(privateDirectory));
+    return this.#active.has(resolve6(privateDirectory));
   }
   status() {
     return Object.freeze({ activeDirectories: this.#active.size });
@@ -13105,14 +14120,14 @@ function createImageRuntimeGeneration(options) {
 
 // src/image-generation/ImageStartupReconciler.ts
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   lstatSync as lstatSync7,
   readFileSync as readFileSync13,
   readdirSync as readdirSync6,
   rmdirSync as rmdirSync2,
   unlinkSync as unlinkSync9
 } from "fs";
-import { basename as basename6, dirname as dirname11, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve9 } from "path";
+import { basename as basename7, dirname as dirname11, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve10 } from "path";
 import {
   IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT,
   IMAGE_REQUEST_DIRECTORY_MARKER_NAME
@@ -13122,7 +14137,7 @@ import {
 import { randomBytes as randomBytes9 } from "crypto";
 import {
   closeSync as closeSync6,
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   fsyncSync as fsyncSync5,
   lstatSync as lstatSync6,
   openSync as openSync6,
@@ -13132,7 +14147,7 @@ import {
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync11
 } from "fs";
-import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute2, join as join13, resolve as resolve8 } from "path";
+import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute2, join as join14, resolve as resolve9 } from "path";
 import { ImageGenerationError as ImageGenerationError7 } from "@omnicross/core/image-generation";
 
 // src/image-generation/FileImageReferenceStore.ts
@@ -13141,7 +14156,7 @@ import {
   closeSync as closeSync4,
   constants as constants2,
   createReadStream,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   fstatSync as fstatSync2,
   fsyncSync as fsyncSync3,
   lstatSync as lstatSync4,
@@ -13153,8 +14168,8 @@ import {
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync9
 } from "fs";
-import { open } from "fs/promises";
-import { basename as basename3, dirname as dirname8, join as join11, resolve as resolve6 } from "path";
+import { open as open2 } from "fs/promises";
+import { basename as basename4, dirname as dirname8, join as join12, resolve as resolve7 } from "path";
 import { Readable } from "stream";
 import {
   ImageGenerationError as ImageGenerationError5
@@ -13180,8 +14195,8 @@ function safeInteger(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
 function samePath3(left, right) {
-  const normalizedLeft = resolve6(left);
-  const normalizedRight = resolve6(right);
+  const normalizedLeft = resolve7(left);
+  const normalizedRight = resolve7(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 function validEntry2(value) {
@@ -13483,7 +14498,7 @@ var FileImageReferenceStore = class {
         const ownedArtifact = ARTIFACT_FILE.test(name);
         const incomplete = /^artifact-[a-f0-9]{32}\.tmp$/u.test(name);
         if ((!ownedArtifact || referenced.has(name)) && !incomplete) continue;
-        const path2 = resolve6(root, name);
+        const path2 = resolve7(root, name);
         let info;
         try {
           info = lstatSync4(path2);
@@ -13634,10 +14649,10 @@ var FileImageReferenceStore = class {
   async writeArtifact(asset, limits) {
     const root = this.#paths.verifiedRoot("artifacts");
     const suffix = this.#random(16).toString("hex");
-    const tempPath = join11(root, `artifact-${suffix}.tmp`);
+    const tempPath = join12(root, `artifact-${suffix}.tmp`);
     const fileName = `artifact-${suffix}.bin`;
-    const finalPath = join11(root, fileName);
-    const handle = await open(tempPath, "wx", 384);
+    const finalPath = join12(root, fileName);
+    const handle = await open2(tempPath, "wx", 384);
     let reader;
     let observed = 0;
     let writeFailure;
@@ -13686,8 +14701,8 @@ var FileImageReferenceStore = class {
   artifactPath(fileName) {
     if (!ARTIFACT_FILE.test(fileName)) throw new TypeError("invalid image artifact filename");
     const root = this.#paths.verifiedRoot("artifacts");
-    const path2 = resolve6(root, fileName);
-    if (!samePath3(dirname8(path2), root) || basename3(path2) !== fileName) {
+    const path2 = resolve7(root, fileName);
+    if (!samePath3(dirname8(path2), root) || basename4(path2) !== fileName) {
       throw new TypeError("image artifact escaped its root");
     }
     return path2;
@@ -13710,12 +14725,12 @@ var FileImageReferenceStore = class {
   }
   safeUnlinkArtifactPath(path2) {
     const root = this.#paths.verifiedRoot("artifacts");
-    const target = resolve6(path2);
-    const name = basename3(target);
+    const target = resolve7(path2);
+    const name = basename4(target);
     if (!samePath3(dirname8(target), root) || !/^artifact-[a-f0-9]{32}\.(?:bin|tmp)$/u.test(name)) {
       throw new TypeError("refusing to unlink an unverified image artifact");
     }
-    if (!existsSync12(target)) return;
+    if (!existsSync13(target)) return;
     const info = lstatSync4(target);
     if (info.isSymbolicLink() || !info.isFile()) throw new TypeError("refusing to unlink an unverified image artifact");
     unlinkSync6(target);
@@ -13737,7 +14752,7 @@ var FileImageReferenceStore = class {
     });
   }
   manifestPath() {
-    return join11(this.#paths.verifiedRoot("state"), MANIFEST_NAME2);
+    return join12(this.#paths.verifiedRoot("state"), MANIFEST_NAME2);
   }
   persist(entries, tombstones) {
     const manifest = {
@@ -13753,10 +14768,10 @@ var FileImageReferenceStore = class {
   }
   atomicReplace(targetPath, contents) {
     const root = this.#paths.verifiedRoot("state");
-    if (!samePath3(dirname8(resolve6(targetPath)), root) || basename3(targetPath) !== MANIFEST_NAME2) {
+    if (!samePath3(dirname8(resolve7(targetPath)), root) || basename4(targetPath) !== MANIFEST_NAME2) {
       throw new TypeError("invalid image reference manifest target");
     }
-    const temporaryPath = join11(root, `.references.${process.pid}.${this.#random(8).toString("hex")}.tmp`);
+    const temporaryPath = join12(root, `.references.${process.pid}.${this.#random(8).toString("hex")}.tmp`);
     let fd;
     try {
       fd = openSync4(temporaryPath, "wx", 384);
@@ -13772,7 +14787,7 @@ var FileImageReferenceStore = class {
         } catch {
         }
       }
-      if (existsSync12(temporaryPath)) {
+      if (existsSync13(temporaryPath)) {
         try {
           unlinkSync6(temporaryPath);
         } catch {
@@ -13782,7 +14797,7 @@ var FileImageReferenceStore = class {
   }
   loadManifest() {
     const path2 = this.manifestPath();
-    if (!existsSync12(path2)) return;
+    if (!existsSync13(path2)) return;
     const info = lstatSync4(path2);
     if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_MANIFEST_BYTES2) {
       throw new TypeError("image reference manifest is invalid");
@@ -13831,7 +14846,7 @@ var FileImageReferenceStore = class {
 import { randomBytes as randomBytes8 } from "crypto";
 import {
   closeSync as closeSync5,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   fsyncSync as fsyncSync4,
   lstatSync as lstatSync5,
   openSync as openSync5,
@@ -13840,7 +14855,7 @@ import {
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync10
 } from "fs";
-import { basename as basename4, dirname as dirname9, join as join12, resolve as resolve7 } from "path";
+import { basename as basename5, dirname as dirname9, join as join13, resolve as resolve8 } from "path";
 import { ImageGenerationError as ImageGenerationError6 } from "@omnicross/core/image-generation";
 var MANIFEST_VERSION3 = 1;
 var MANIFEST_NAME3 = "responses-image-state.v1.json";
@@ -13893,8 +14908,8 @@ function validPendingReferenceDelete(value) {
   return exactKeys2(row, ["callId", "referenceTenantKey", "referenceId", "expiresAt"]) && typeof row.callId === "string" && CALL_ID_PATTERN.test(row.callId) && isImageTenantHmac(row.referenceTenantKey) && typeof row.referenceId === "string" && REFERENCE_ID_PATTERN.test(row.referenceId) && safeTimestamp2(row.expiresAt);
 }
 function samePath4(left, right) {
-  const normalizedLeft = resolve7(left);
-  const normalizedRight = resolve7(right);
+  const normalizedLeft = resolve8(left);
+  const normalizedRight = resolve8(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 function sameBinding(left, right) {
@@ -14377,7 +15392,7 @@ var FileResponsesImageStateStore = class {
     });
   }
   manifestPath() {
-    return join12(this.#paths.verifiedRoot("state"), MANIFEST_NAME3);
+    return join13(this.#paths.verifiedRoot("state"), MANIFEST_NAME3);
   }
   persist(calls, responses, tombstones, pendingReferenceDeletes) {
     const manifest = {
@@ -14397,10 +15412,10 @@ var FileResponsesImageStateStore = class {
   }
   atomicReplace(targetPath, contents) {
     const root = this.#paths.verifiedRoot("state");
-    if (!samePath4(dirname9(resolve7(targetPath)), root) || basename4(targetPath) !== MANIFEST_NAME3) {
+    if (!samePath4(dirname9(resolve8(targetPath)), root) || basename5(targetPath) !== MANIFEST_NAME3) {
       throw new TypeError("invalid responses image state manifest target");
     }
-    const temporaryPath = join12(
+    const temporaryPath = join13(
       root,
       `.responses-image-state.${process.pid}.${this.#random(8).toString("hex")}.tmp`
     );
@@ -14419,7 +15434,7 @@ var FileResponsesImageStateStore = class {
         } catch {
         }
       }
-      if (existsSync13(temporaryPath)) {
+      if (existsSync14(temporaryPath)) {
         try {
           unlinkSync7(temporaryPath);
         } catch {
@@ -14429,7 +15444,7 @@ var FileResponsesImageStateStore = class {
   }
   loadManifest() {
     const path2 = this.manifestPath();
-    if (!existsSync13(path2)) return;
+    if (!existsSync14(path2)) return;
     const info = lstatSync5(path2);
     if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_MANIFEST_BYTES3) {
       throw new TypeError("responses image state manifest is invalid");
@@ -14523,8 +15538,8 @@ function validMount(value) {
   return exactKeys3(row, ["id", "durableRoot", "createdAt"]) && typeof row.id === "string" && MOUNT_ID_PATTERN.test(row.id) && typeof row.durableRoot === "string" && isAbsolute2(row.durableRoot) && safeInteger2(row.createdAt);
 }
 function samePath5(left, right) {
-  const normalizedLeft = resolve8(left);
-  const normalizedRight = resolve8(right);
+  const normalizedLeft = resolve9(left);
+  const normalizedRight = resolve9(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 var ImageStorageMountCatalog = class {
@@ -14552,7 +15567,7 @@ var ImageStorageMountCatalog = class {
     this.#catalogResolver = this.createResolver(options.activeStorageRoot);
     this.#reconcileCorruptManifests = options.reconcileCorruptManifests ?? false;
     this.#replaceCatalog = options.replaceCatalog ?? ((target, contents) => this.atomicReplace(target, contents));
-    if (existsSync14(this.catalogPath())) {
+    if (existsSync15(this.catalogPath())) {
       try {
         this.loadCatalog();
       } catch (error) {
@@ -14804,15 +15819,15 @@ var ImageStorageMountCatalog = class {
   }
   quarantineManifest(resolver, area, name, label) {
     const root = resolver.verifiedRoot(area);
-    const source = join13(root, name);
-    if (!existsSync14(source)) throw new TypeError("corrupt image manifest is missing");
+    const source = join14(root, name);
+    if (!existsSync15(source)) throw new TypeError("corrupt image manifest is missing");
     const info = lstatSync6(source);
     if (info.isSymbolicLink() || !info.isFile()) {
       throw new TypeError("refusing to quarantine an unverified image manifest");
     }
     for (let attempt = 0; attempt < 8; attempt += 1) {
-      const target = join13(root, `.corrupt-${label}-${this.#random(8).toString("hex")}.json`);
-      if (existsSync14(target)) continue;
+      const target = join14(root, `.corrupt-${label}-${this.#random(8).toString("hex")}.json`);
+      if (existsSync15(target)) continue;
       resolver.verifiedRoot(area);
       renameSync7(source, target);
       this.#corruptManifestsQuarantined += 1;
@@ -14857,10 +15872,10 @@ var ImageStorageMountCatalog = class {
   }
   atomicReplace(targetPath, contents) {
     const root = this.#catalogResolver.verifiedRoot("mountManifest");
-    if (!samePath5(dirname10(resolve8(targetPath)), root) || basename5(targetPath) !== CATALOG_NAME) {
+    if (!samePath5(dirname10(resolve9(targetPath)), root) || basename6(targetPath) !== CATALOG_NAME) {
       throw new TypeError("invalid image storage mount catalog target");
     }
-    const temporaryPath = join13(
+    const temporaryPath = join14(
       root,
       `.catalog.${process.pid}.${this.#random(8).toString("hex")}.tmp`
     );
@@ -14879,7 +15894,7 @@ var ImageStorageMountCatalog = class {
         } catch {
         }
       }
-      if (existsSync14(temporaryPath)) {
+      if (existsSync15(temporaryPath)) {
         try {
           unlinkSync8(temporaryPath);
         } catch {
@@ -15101,12 +16116,12 @@ function positiveInteger4(value, name) {
   return value;
 }
 function samePath6(left, right) {
-  const normalizedLeft = resolve9(left);
-  const normalizedRight = resolve9(right);
+  const normalizedLeft = resolve10(left);
+  const normalizedRight = resolve10(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 function isDirectChild(path2, root) {
-  const target = resolve9(path2);
+  const target = resolve10(path2);
   const rel = relative2(root, target);
   return !samePath6(target, root) && !isAbsolute3(rel) && !rel.startsWith("..") && samePath6(dirname11(target), root);
 }
@@ -15228,8 +16243,8 @@ var ImageStartupReconciler = class {
     let removed = 0;
     let invalid = 0;
     for (const name of readdirSync6(root).filter((value) => pattern.test(value)).slice(0, limit)) {
-      const path2 = resolve9(root, name);
-      if (!isDirectChild(path2, root) || basename6(path2) !== name) {
+      const path2 = resolve10(root, name);
+      if (!isDirectChild(path2, root) || basename7(path2) !== name) {
         invalid += 1;
         continue;
       }
@@ -15251,7 +16266,7 @@ var ImageStartupReconciler = class {
     let invalid = 0;
     let active = 0;
     for (const name of readdirSync6(root).slice(0, this.#maxTemporaryDirectoriesPerPass)) {
-      const path2 = resolve9(root, name);
+      const path2 = resolve10(root, name);
       if (!OWNED_TEMPORARY_DIRECTORY.test(name) || !isDirectChild(path2, root)) {
         foreign += 1;
         continue;
@@ -15266,8 +16281,8 @@ var ImageStartupReconciler = class {
         active += 1;
         continue;
       }
-      const markerPath = resolve9(path2, IMAGE_REQUEST_DIRECTORY_MARKER_NAME);
-      if (!isDirectChild(markerPath, path2) || !existsSync15(markerPath)) {
+      const markerPath = resolve10(path2, IMAGE_REQUEST_DIRECTORY_MARKER_NAME);
+      if (!isDirectChild(markerPath, path2) || !existsSync16(markerPath)) {
         foreign += 1;
         continue;
       }
@@ -15299,7 +16314,7 @@ var ImageStartupReconciler = class {
       throw new TypeError("refusing to remove an unsupported temporary descendant");
     }
     for (const name of readdirSync6(path2)) {
-      this.removeTreeWithoutFollowingSymlinks(resolve9(path2, name), path2);
+      this.removeTreeWithoutFollowingSymlinks(resolve10(path2, name), path2);
     }
     rmdirSync2(path2);
   }
@@ -15768,8 +16783,8 @@ function createHostedImageContributionFactory(manager) {
 function deferredRecord(generation, phase) {
   let resolveDisposed;
   let rejectDisposed;
-  const disposed = new Promise((resolve11, reject) => {
-    resolveDisposed = resolve11;
+  const disposed = new Promise((resolve12, reject) => {
+    resolveDisposed = resolve12;
     rejectDisposed = reject;
   });
   void disposed.catch(() => void 0);
@@ -16348,7 +17363,7 @@ function toLLMProvider(row) {
 // src/ports/ConfigurableLogger.ts
 import {
   createWriteStream,
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   renameSync as renameSync8,
   statSync as statSync6,
   unlinkSync as unlinkSync10
@@ -16400,7 +17415,7 @@ var ConfigurableLogger = class {
     this.fileStream = null;
     this.rotateQueue = [];
     if (!stream) return Promise.resolve();
-    return new Promise((resolve11) => stream.end(() => resolve11()));
+    return new Promise((resolve12) => stream.end(() => resolve12()));
   }
   emit(level, message, error, meta) {
     if (LEVEL_ORDER[level] > this.threshold) return;
@@ -16482,12 +17497,12 @@ var ConfigurableLogger = class {
   /** `<file>.N` unlinked, `<file>.k` → `<file>.k+1`, `<file>` → `<file>.1`. */
   shiftGenerations(path2) {
     const oldest = `${path2}.${this.maxFiles}`;
-    if (existsSync16(oldest)) unlinkSync10(oldest);
+    if (existsSync17(oldest)) unlinkSync10(oldest);
     for (let i = this.maxFiles - 1; i >= 1; i--) {
       const from = `${path2}.${i}`;
-      if (existsSync16(from)) renameSync8(from, `${path2}.${i + 1}`);
+      if (existsSync17(from)) renameSync8(from, `${path2}.${i + 1}`);
     }
-    if (existsSync16(path2)) renameSync8(path2, `${path2}.1`);
+    if (existsSync17(path2)) renameSync8(path2, `${path2}.1`);
   }
   /**
    * Lazily open the append-only file stream; disable the sink on any error. The
@@ -16498,7 +17513,7 @@ var ConfigurableLogger = class {
     if (this.fileDisabled || !this.filePath) return null;
     if (this.fileStream) return this.fileStream;
     try {
-      this.fileBytes = existsSync16(this.filePath) ? statSync6(this.filePath).size : 0;
+      this.fileBytes = existsSync17(this.filePath) ? statSync6(this.filePath).size : 0;
       const stream = createWriteStream(this.filePath, { flags: "a" });
       stream.on("error", () => {
         this.fileDisabled = true;
@@ -16571,7 +17586,7 @@ function safeStringify(value) {
 import { randomBytes as randomBytes10 } from "crypto";
 import {
   closeSync as closeSync7,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   fsyncSync as fsyncSync6,
   openSync as openSync7,
   readFileSync as readFileSync14,
@@ -16579,12 +17594,12 @@ import {
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync12
 } from "fs";
-import { basename as basename7, dirname as dirname12, join as join14 } from "path";
+import { basename as basename8, dirname as dirname12, join as join15 } from "path";
 import { OUTBOUND_API_SERVER_CONFIG_KEY } from "@omnicross/core/outbound-api";
 function atomicReplaceDocument(targetPath, contents) {
-  const tempPath = join14(
+  const tempPath = join15(
     dirname12(targetPath),
-    `.${basename7(targetPath)}.${process.pid}.${randomBytes10(8).toString("hex")}.tmp`
+    `.${basename8(targetPath)}.${process.pid}.${randomBytes10(8).toString("hex")}.tmp`
   );
   let fd;
   try {
@@ -16601,7 +17616,7 @@ function atomicReplaceDocument(targetPath, contents) {
       } catch {
       }
     }
-    if (existsSync17(tempPath)) {
+    if (existsSync18(tempPath)) {
       try {
         unlinkSync11(tempPath);
       } catch {
@@ -16644,13 +17659,13 @@ var JsonApiServerSettingsStore = class {
   }
   /** Capture the exact prior document for an admin transaction rollback. */
   captureDocumentSnapshot() {
-    if (!existsSync17(this.configPath)) return { existed: false };
+    if (!existsSync18(this.configPath)) return { existed: false };
     return { existed: true, bytes: readFileSync14(this.configPath) };
   }
   /** Restore exact prior bytes (including unrelated fields and encrypted secrets). */
   restoreDocumentSnapshot(snapshot) {
     if (!snapshot.existed) {
-      if (existsSync17(this.configPath)) unlinkSync11(this.configPath);
+      if (existsSync18(this.configPath)) unlinkSync11(this.configPath);
       return;
     }
     if (!snapshot.bytes) throw new TypeError("settings snapshot is missing prior bytes");
@@ -16687,13 +17702,13 @@ var JsonApiServerSettingsStore = class {
 };
 
 // src/ports/JsonlUsageEventStore.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 
 // src/usage/usageFiles.ts
-import { readdir } from "fs/promises";
-import { dirname as dirname13, join as join15 } from "path";
+import { readdir as readdir2 } from "fs/promises";
+import { dirname as dirname13, join as join16 } from "path";
 var USAGE_DIR_NAME = "usage";
 var USAGE_SHARD_RE = /^usage-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
 var USAGE_ROLLUP_RE = /^usage-(\d{4})-(\d{2})-(\d{2})\.rollup\.json$/;
@@ -16710,7 +17725,7 @@ function usageRollupName(dayKey) {
   return `usage-${dayKey}.rollup.json`;
 }
 function usageDirFor(eventsPath) {
-  return join15(dirname13(eventsPath), USAGE_DIR_NAME);
+  return join16(dirname13(eventsPath), USAGE_DIR_NAME);
 }
 function dayKeyStartTs(dayKey) {
   const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(dayKey);
@@ -16731,7 +17746,7 @@ function dayKeyEndTs(dayKey) {
 async function listUsageDays(usageDir) {
   let names;
   try {
-    names = await readdir(usageDir);
+    names = await readdir2(usageDir);
   } catch {
     return [];
   }
@@ -16971,12 +17986,12 @@ function isUsageDayRollup(parsed) {
 }
 
 // src/usage/usageRollupStore.ts
-import { mkdir, readFile as readFile2, rename, unlink, writeFile } from "fs/promises";
-import { join as join17 } from "path";
+import { mkdir, readFile as readFile3, rename as rename2, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
+import { join as join18 } from "path";
 
 // src/usage/usageShardCache.ts
-import { open as open2 } from "fs/promises";
-import { join as join16 } from "path";
+import { open as open3 } from "fs/promises";
+import { join as join17 } from "path";
 
 // src/usage/usageRow.ts
 var NUMERIC_FIELDS = [
@@ -17036,10 +18051,10 @@ var NEWLINE2 = 10;
 var READ_CHUNK_BYTES = 8 * 1024 * 1024;
 var DEFAULT_MAX_RESIDENT_DAYS = 3;
 async function streamShardRows(usageDir, dayKey, onRow) {
-  const path2 = join16(usageDir, usageShardName(dayKey));
+  const path2 = join17(usageDir, usageShardName(dayKey));
   let handle;
   try {
-    handle = await open2(path2, "r");
+    handle = await open3(path2, "r");
   } catch {
     return;
   }
@@ -17069,7 +18084,7 @@ async function streamShardRows(usageDir, dayKey, onRow) {
 async function shardSize(usageDir, dayKey) {
   let handle;
   try {
-    handle = await open2(join16(usageDir, usageShardName(dayKey)), "r");
+    handle = await open3(join17(usageDir, usageShardName(dayKey)), "r");
   } catch {
     return null;
   }
@@ -17125,10 +18140,10 @@ var UsageShardCache = class {
     } else {
       this.touch(dayKey);
     }
-    const path2 = join16(this.usageDir, usageShardName(dayKey));
+    const path2 = join17(this.usageDir, usageShardName(dayKey));
     let handle;
     try {
-      handle = await open2(path2, "r");
+      handle = await open3(path2, "r");
     } catch {
       return entry;
     }
@@ -17247,7 +18262,7 @@ var UsageRollupStore = class {
   }
   async readSidecar(dayKey) {
     try {
-      const raw = await readFile2(join17(this.usageDir, usageRollupName(dayKey)), "utf8");
+      const raw = await readFile3(join18(this.usageDir, usageRollupName(dayKey)), "utf8");
       const parsed = JSON.parse(raw);
       return isUsageDayRollup(parsed) && parsed.date === dayKey ? parsed : null;
     } catch {
@@ -17255,14 +18270,14 @@ var UsageRollupStore = class {
     }
   }
   async writeSidecar(dayKey, rollup) {
-    const target = join17(this.usageDir, usageRollupName(dayKey));
+    const target = join18(this.usageDir, usageRollupName(dayKey));
     const temp = `${target}.tmp`;
     try {
       await mkdir(this.usageDir, { recursive: true });
-      await writeFile(temp, JSON.stringify(rollup), "utf8");
-      await rename(temp, target);
+      await writeFile2(temp, JSON.stringify(rollup), "utf8");
+      await rename2(temp, target);
     } catch {
-      await unlink(temp).catch(() => {
+      await unlink2(temp).catch(() => {
       });
     }
   }
@@ -17337,13 +18352,13 @@ var JsonlUsageEventStore = class {
   async insert(input) {
     const row = {
       ...input,
-      id: randomUUID4(),
+      id: randomUUID5(),
       ts: input.ts ?? Date.now()
     };
     const dayKey = usageDayKey(row.ts);
     this.ensureDir();
     const line = JSON.stringify(row) + "\n";
-    appendFileSync(join18(this.usageDir, usageShardName(dayKey)), line, "utf8");
+    appendFileSync(join19(this.usageDir, usageShardName(dayKey)), line, "utf8");
     if (dayKey !== this.lastAppendDay) {
       this.rollups.invalidate(dayKey);
       this.lastAppendDay = dayKey;
@@ -17718,7 +18733,7 @@ function bucketLabel(bucketStartTs, bucket) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
 import {
   validateOutboundPermissions as validateOutboundPermissions3
 } from "@omnicross/core";
@@ -17727,18 +18742,18 @@ import {
 import { randomBytes as randomBytes11 } from "crypto";
 import {
   closeSync as closeSync8,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   fsyncSync as fsyncSync7,
   openSync as openSync8,
   renameSync as renameSync10,
   unlinkSync as unlinkSync12,
   writeFileSync as writeFileSync13
 } from "fs";
-import { basename as basename8, dirname as dirname14, join as join19 } from "path";
+import { basename as basename9, dirname as dirname14, join as join20 } from "path";
 function atomicReplaceUtf8(targetPath, contents) {
-  const tempPath = join19(
+  const tempPath = join20(
     dirname14(targetPath),
-    `.${basename8(targetPath)}.${process.pid}.${randomBytes11(8).toString("hex")}.tmp`
+    `.${basename9(targetPath)}.${process.pid}.${randomBytes11(8).toString("hex")}.tmp`
   );
   let fd;
   try {
@@ -17755,7 +18770,7 @@ function atomicReplaceUtf8(targetPath, contents) {
       } catch {
       }
     }
-    if (existsSync18(tempPath)) {
+    if (existsSync19(tempPath)) {
       try {
         unlinkSync12(tempPath);
       } catch {
@@ -17866,6 +18881,19 @@ var JsonOutboundKeyDb = class {
       return true;
     });
   }
+  async outboundApiKeysSetUpstream(id, target) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      if (target === null) {
+        delete row.boundUpstream;
+        delete row.boundUpstreamProviderId;
+      } else {
+        row.boundUpstream = target;
+        delete row.boundUpstreamProviderId;
+      }
+      return true;
+    });
+  }
   async outboundApiKeysSetPolicy(id, policy) {
     return this.mutateRow(id, (row) => {
       if (row.revokedAt !== null) return false;
@@ -17908,7 +18936,7 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync19(this.keysPath)) return [];
+    if (!existsSync20(this.keysPath)) return [];
     try {
       const parsed = JSON.parse(readFileSync15(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
@@ -17927,8 +18955,8 @@ function applyPolicyField(row, field, value) {
 }
 
 // src/ports/JsonPricingStore.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16, renameSync as renameSync11, rmSync as rmSync3, writeFileSync as writeFileSync14 } from "fs";
-import { randomUUID as randomUUID5 } from "crypto";
+import { existsSync as existsSync21, readFileSync as readFileSync16, renameSync as renameSync11, rmSync as rmSync3, writeFileSync as writeFileSync14 } from "fs";
+import { randomUUID as randomUUID6 } from "crypto";
 var JsonPricingStore = class {
   constructor(pricingPath) {
     this.pricingPath = pricingPath;
@@ -17942,7 +18970,7 @@ var JsonPricingStore = class {
    * otherwise unusable pricing table after a crash or manual file edit.
    */
   hasUsableSnapshot() {
-    if (!existsSync20(this.pricingPath)) return false;
+    if (!existsSync21(this.pricingPath)) return false;
     try {
       const parsed = JSON.parse(readFileSync16(this.pricingPath, "utf8"));
       return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
@@ -18057,7 +19085,7 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync20(this.pricingPath)) return [];
+    if (!existsSync21(this.pricingPath)) return [];
     try {
       const parsed = JSON.parse(readFileSync16(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
@@ -18066,7 +19094,7 @@ var JsonPricingStore = class {
     }
   }
   writeRows(rows) {
-    const temporaryPath = `${this.pricingPath}.${process.pid}.${randomUUID5()}.tmp`;
+    const temporaryPath = `${this.pricingPath}.${process.pid}.${randomUUID6()}.tmp`;
     try {
       writeFileSync14(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
         encoding: "utf8",
@@ -18089,7 +19117,7 @@ function isUsablePricingRow(value) {
 }
 
 // src/pricing/PricingRefreshScheduler.ts
-import { existsSync as existsSync21, readFileSync as readFileSync17, renameSync as renameSync12, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync17, renameSync as renameSync12, writeFileSync as writeFileSync15 } from "fs";
 var EMPTY_STATE2 = {
   lastAttemptAt: null,
   lastSuccessAt: null,
@@ -18127,7 +19155,7 @@ var PricingRefreshScheduler = class {
     this.timer = null;
   }
   getState() {
-    if (!existsSync21(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    if (!existsSync22(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
     try {
       const value = JSON.parse(readFileSync17(this.statePath, "utf8"));
       return {
@@ -18192,7 +19220,7 @@ function finiteOrNull(value) {
 }
 
 // src/ports/JsonVoucherDb.ts
-import { existsSync as existsSync22, readFileSync as readFileSync18, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync16 } from "fs";
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -18270,7 +19298,7 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync22(this.vouchersPath)) return [];
+    if (!existsSync23(this.vouchersPath)) return [];
     try {
       const parsed = JSON.parse(readFileSync18(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
@@ -18284,7 +19312,7 @@ var JsonVoucherDb = class {
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync6, readFileSync as readFileSync20, renameSync as renameSync13 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync6, readFileSync as readFileSync20, renameSync as renameSync13 } from "fs";
 import { dirname as dirname15 } from "path";
 import { getAntigravityProjectResolver as getAntigravityProjectResolver2 } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
 import { getSharedAccountHealth as getSharedAccountHealth2 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
@@ -18342,11 +19370,11 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-import { existsSync as existsSync23, readFileSync as readFileSync19 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join20 } from "path";
-function externalStorePath(provider, home = homedir4()) {
-  return provider === "claude" ? join20(home, ".claude", ".credentials.json") : join20(home, ".codex", "auth.json");
+import { existsSync as existsSync24, readFileSync as readFileSync19 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join21 } from "path";
+function externalStorePath(provider, home = homedir5()) {
+  return provider === "claude" ? join21(home, ".claude", ".credentials.json") : join21(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -18393,9 +19421,9 @@ function parseCodexTokensEnvelope(raw) {
   }
   return parsed;
 }
-function readExternalCliCredentials(provider, home = homedir4()) {
+function readExternalCliCredentials(provider, home = homedir5()) {
   const path2 = externalStorePath(provider, home);
-  if (!existsSync23(path2)) return null;
+  if (!existsSync24(path2)) return null;
   let raw;
   try {
     const parsed = JSON.parse(readFileSync19(path2, "utf8"));
@@ -19202,7 +20230,7 @@ var JsonSubscriptionCredentialStore = class {
    * its parse try.
    */
   readConfig() {
-    if (!existsSync24(this.tokensPath)) return { updatedAt: "" };
+    if (!existsSync25(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
       const raw = JSON.parse(readFileSync20(this.tokensPath, "utf8"));
@@ -19779,21 +20807,21 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-import { createReadStream as createReadStream3, createWriteStream as createWriteStream2, existsSync as existsSync26, readdirSync as readdirSync8, rmSync as rmSync4, unlinkSync as unlinkSync13 } from "fs";
-import { join as join22 } from "path";
+import { createReadStream as createReadStream3, createWriteStream as createWriteStream2, existsSync as existsSync27, readdirSync as readdirSync8, rmSync as rmSync4, unlinkSync as unlinkSync13 } from "fs";
+import { join as join23 } from "path";
 import { pipeline } from "stream/promises";
 import { createGzip } from "zlib";
 
 // src/audit/auditStats.ts
 import {
   createReadStream as createReadStream2,
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   readFileSync as readFileSync21,
   readdirSync as readdirSync7,
   statSync as statSync7,
   writeFileSync as writeFileSync17
 } from "fs";
-import { basename as basename9, dirname as dirname16, join as join21 } from "path";
+import { basename as basename10, dirname as dirname16, join as join22 } from "path";
 var SIDECAR_VERSION = 1;
 var META_PREFIX_BYTES = 64 * 1024;
 var READ_CHUNK_BYTES2 = 4 * 1024 * 1024;
@@ -19801,7 +20829,7 @@ function auditStatsFileName(auditFile) {
   return auditFile.replace(/\.jsonl$/, ".stats.json");
 }
 function readPersisted(path2) {
-  if (!existsSync25(path2)) return null;
+  if (!existsSync26(path2)) return null;
   try {
     const value = JSON.parse(readFileSync21(path2, "utf8"));
     if (value.version !== SIDECAR_VERSION || !Number.isSafeInteger(value.auditBytes) || (value.auditBytes ?? -1) < 0 || !Number.isSafeInteger(value.requestCount) || (value.requestCount ?? -1) < 0 || !Number.isSafeInteger(value.errorCount) || (value.errorCount ?? -1) < 0 || (value.errorCount ?? 0) > (value.requestCount ?? -1) || typeof value.complete !== "boolean" || value.minTs !== null && !Number.isFinite(value.minTs) || value.maxTs !== null && !Number.isFinite(value.maxTs)) {
@@ -19813,7 +20841,7 @@ function readPersisted(path2) {
   }
 }
 function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfter, record) {
-  const statsPath = join21(dirname16(auditPath), auditStatsFileName(basename9(auditPath)));
+  const statsPath = join22(dirname16(auditPath), auditStatsFileName(basename10(auditPath)));
   const previous = auditBytesBefore === 0 ? {
     version: SIDECAR_VERSION,
     auditBytes: 0,
@@ -19944,20 +20972,20 @@ function mergePersistedStats(previous, appended) {
   };
 }
 async function readAuditStats(auditDir, query2 = {}) {
-  if (!existsSync25(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
+  if (!existsSync26(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   let sources;
   try {
     sources = readdirSync7(auditDir).filter((name) => fileOverlaps(name, from, to)).sort().map(
       (name) => AUDIT_DAY_DIR_RE.test(name) ? {
-        auditPath: join21(auditDir, name, AUDIT_META_FILE),
-        statsPath: join21(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
+        auditPath: join22(auditDir, name, AUDIT_META_FILE),
+        statsPath: join22(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
       } : {
-        auditPath: join21(auditDir, name),
-        statsPath: join21(auditDir, auditStatsFileName(name))
+        auditPath: join22(auditDir, name),
+        statsPath: join22(auditDir, auditStatsFileName(name))
       }
-    ).filter((source) => existsSync25(source.auditPath));
+    ).filter((source) => existsSync26(source.auditPath));
   } catch {
     return { requestCount: 0, errorCount: 0, complete: false };
   }
@@ -20055,7 +21083,7 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!existsSync26(this.auditDir)) return 0;
+      if (!existsSync27(this.auditDir)) return 0;
       const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS4;
       let removed = 0;
       for (const name of readdirSync8(this.auditDir)) {
@@ -20063,11 +21091,11 @@ var AuditPruneSweeper = class {
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
           if (isAuditDayDir(name)) {
-            rmSync4(join22(this.auditDir, name), { recursive: true, force: true });
+            rmSync4(join23(this.auditDir, name), { recursive: true, force: true });
           } else {
-            unlinkSync13(join22(this.auditDir, name));
-            const statsPath = join22(this.auditDir, auditStatsFileName(name));
-            if (existsSync26(statsPath)) unlinkSync13(statsPath);
+            unlinkSync13(join23(this.auditDir, name));
+            const statsPath = join23(this.auditDir, auditStatsFileName(name));
+            if (existsSync27(statsPath)) unlinkSync13(statsPath);
           }
           removed += 1;
         } catch (error) {
@@ -20097,14 +21125,14 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.archiving) return 0;
     this.archiving = true;
     try {
-      if (!existsSync26(this.auditDir)) return 0;
+      if (!existsSync27(this.auditDir)) return 0;
       const today = this.todayMidnight();
       let compressed = 0;
       for (const name of readdirSync8(this.auditDir)) {
         if (compressed >= ARCHIVE_BATCH) break;
         const dateMs = auditFileDateMs(name);
         if (dateMs === null || dateMs >= today || !isAuditDayDir(name)) continue;
-        const dayPath = join22(this.auditDir, name);
+        const dayPath = join23(this.auditDir, name);
         try {
           const compaction = compactAuditDay(dayPath);
           if (compaction.shards > 0) {
@@ -20122,7 +21150,7 @@ var AuditPruneSweeper = class {
           });
         }
         compressed += await this.archiveDay(
-          join22(dayPath, AUDIT_BODIES_DIR),
+          join23(dayPath, AUDIT_BODIES_DIR),
           ARCHIVE_BATCH - compressed
         );
       }
@@ -20148,10 +21176,10 @@ var AuditPruneSweeper = class {
     let compressed = 0;
     for (const shard of shards) {
       if (compressed >= budget) break;
-      const source = join22(bodiesPath, shard);
+      const source = join23(bodiesPath, shard);
       const target = `${source}.gz`;
       try {
-        if (existsSync26(target)) {
+        if (existsSync27(target)) {
           unlinkSync13(source);
           continue;
         }
@@ -20160,7 +21188,7 @@ var AuditPruneSweeper = class {
         compressed += 1;
       } catch (error) {
         try {
-          if (existsSync26(target)) unlinkSync13(target);
+          if (existsSync27(target)) unlinkSync13(target);
         } catch {
         }
         this.logger.warn("[AuditPruneSweeper] failed to archive audit body shard", {
@@ -20175,8 +21203,8 @@ var AuditPruneSweeper = class {
 
 // src/usage/usageMigrate.ts
 import { createReadStream as createReadStream4 } from "fs";
-import { mkdir as mkdir2, open as open3, readdir as readdir2, rename as rename2, rm, stat, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
-import { join as join23 } from "path";
+import { mkdir as mkdir2, open as open4, readdir as readdir3, rename as rename3, rm, stat as stat2, unlink as unlink3, writeFile as writeFile3 } from "fs/promises";
+import { join as join24 } from "path";
 import { createInterface } from "readline";
 var FLUSH_BYTES = 4 * 1024 * 1024;
 async function writeLine(writer2, line) {
@@ -20200,14 +21228,14 @@ var IDLE = {
 };
 async function migrateLegacyUsageEvents(opts) {
   const { eventsPath, usageDir, logger } = opts;
-  const legacy = await stat(eventsPath).catch(() => null);
+  const legacy = await stat2(eventsPath).catch(() => null);
   if (!legacy || !legacy.isFile()) return IDLE;
   if (legacy.size === 0) {
-    await unlink2(eventsPath).catch(() => {
+    await unlink3(eventsPath).catch(() => {
     });
     return { ...IDLE, migrated: true };
   }
-  const scratch = join23(usageDir, USAGE_MIGRATING_DIR);
+  const scratch = join24(usageDir, USAGE_MIGRATING_DIR);
   logger?.info("[usage] migrating legacy usage-events.jsonl into day shards", {
     bytes: legacy.size
   });
@@ -20236,7 +21264,7 @@ async function migrateLegacyUsageEvents(opts) {
       let writer2 = writers.get(dayKey);
       if (!writer2) {
         writer2 = {
-          handle: await open3(join23(scratch, usageShardName(dayKey)), "a"),
+          handle: await open4(join24(scratch, usageShardName(dayKey)), "a"),
           buffer: [],
           bytes: 0
         };
@@ -20266,17 +21294,17 @@ async function migrateLegacyUsageEvents(opts) {
   const today = usageDayKey(opts.now ?? Date.now());
   for (const [dayKey, acc] of rollups) {
     if (dayKey === today) continue;
-    const size = await stat(join23(scratch, usageShardName(dayKey))).then((s) => s.size).catch(() => null);
+    const size = await stat2(join24(scratch, usageShardName(dayKey))).then((s) => s.size).catch(() => null);
     if (size === null) continue;
-    await writeFile2(
-      join23(scratch, usageRollupName(dayKey)),
+    await writeFile3(
+      join24(scratch, usageRollupName(dayKey)),
       JSON.stringify(acc.finish(dayKey, size)),
       "utf8"
     );
   }
   await mkdir2(usageDir, { recursive: true });
-  const staged = await readdir2(scratch);
-  const existing = new Set(await readdir2(usageDir).catch(() => []));
+  const staged = await readdir3(scratch);
+  const existing = new Set(await readdir3(usageDir).catch(() => []));
   const collisions = staged.filter((name) => existing.has(name));
   if (collisions.length > 0) {
     const reason = `refusing to overwrite existing shards in ${usageDir} (${collisions.slice(0, 3).join(", ")}${collisions.length > 3 ? ", \u2026" : ""}); a previous migration may have partially committed \u2014 move or remove them and restart`;
@@ -20286,11 +21314,11 @@ async function migrateLegacyUsageEvents(opts) {
     return { ...IDLE, linesRead, rowsWritten, skipped, reason };
   }
   for (const name of staged) {
-    await rename2(join23(scratch, name), join23(usageDir, name));
+    await rename3(join24(scratch, name), join24(usageDir, name));
   }
   await rm(scratch, { recursive: true, force: true }).catch(() => {
   });
-  await unlink2(eventsPath);
+  await unlink3(eventsPath);
   const days = rollups.size;
   logger?.info("[usage] migration complete; legacy usage-events.jsonl removed", {
     linesRead,
@@ -20311,8 +21339,8 @@ async function closeAll(writers) {
 }
 
 // src/usage/UsagePruneSweeper.ts
-import { unlink as unlink3 } from "fs/promises";
-import { join as join24 } from "path";
+import { unlink as unlink4 } from "fs/promises";
+import { join as join25 } from "path";
 var DAY_MS5 = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS3 = 60 * 6e4;
 var DEFAULT_USAGE_RETENTION_DAYS = 90;
@@ -20393,7 +21421,7 @@ var UsagePruneSweeper = class {
           continue;
         }
         try {
-          await unlink3(join24(this.usageDir, usageShardName(entry.dayKey)));
+          await unlink4(join25(this.usageDir, usageShardName(entry.dayKey)));
           removed += 1;
         } catch (error) {
           this.logger.warn("[usage] retention: could not remove expired shard", {
@@ -20428,8 +21456,8 @@ var UsagePruneSweeper = class {
 };
 
 // src/audit/auditReader.ts
-import { existsSync as existsSync27, readdirSync as readdirSync9 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync9 } from "fs";
+import { join as join26 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
 var OVERSCAN = 256;
@@ -20445,10 +21473,10 @@ function daySources(auditDir) {
     const dateMs = auditFileDateMs(name);
     if (dateMs === null) continue;
     if (AUDIT_DAY_DIR_RE.test(name)) {
-      const path2 = join25(auditDir, name, AUDIT_META_FILE);
-      if (existsSync27(path2)) sources.push({ path: path2, dateMs });
+      const path2 = join26(auditDir, name, AUDIT_META_FILE);
+      if (existsSync28(path2)) sources.push({ path: path2, dateMs });
     } else if (AUDIT_FILE_RE.test(name)) {
-      sources.push({ path: join25(auditDir, name), dateMs });
+      sources.push({ path: join26(auditDir, name), dateMs });
     }
   }
   return sources.sort((a, b) => b.dateMs - a.dateMs);
@@ -20464,7 +21492,7 @@ function toMetaRecord(record) {
   return { ...meta, hasBody: true };
 }
 function readAuditRecords(auditDir, query2 = {}) {
-  if (!existsSync27(auditDir)) return [];
+  if (!existsSync28(auditDir)) return [];
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
@@ -20492,8 +21520,8 @@ function readAuditRecords(auditDir, query2 = {}) {
 }
 
 // src/audit/AuditWriter.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync28, mkdirSync as mkdirSync7, statSync as statSync8 } from "fs";
-import { join as join26 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync29, mkdirSync as mkdirSync7, statSync as statSync8 } from "fs";
+import { join as join27 } from "path";
 var AuditWriter = class {
   constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
     this.auditDir = auditDir;
@@ -20533,7 +21561,7 @@ var AuditWriter = class {
    */
   appendNow(record) {
     const dayDir = auditDayDirName(record.ts);
-    const dayPath = this.ensureDir(join26(this.auditDir, dayDir));
+    const dayPath = this.ensureDir(join27(this.auditDir, dayDir));
     this.appendMeta(dayPath, record);
     this.appendBody(dayPath, dayDir, record);
   }
@@ -20548,9 +21576,9 @@ var AuditWriter = class {
   /** Write the body-free metadata line + refresh the exact-count sidecar. */
   appendMeta(dayPath, record) {
     const { requestBody: _req, responseBody: _res, ...meta } = record;
-    const file = join26(dayPath, AUDIT_META_FILE);
+    const file = join27(dayPath, AUDIT_META_FILE);
     const line = JSON.stringify(meta) + "\n";
-    const bytesBefore = existsSync28(file) ? statSync8(file).size : 0;
+    const bytesBefore = existsSync29(file) ? statSync8(file).size : 0;
     appendFileSync2(file, line, "utf8");
     try {
       updateAuditStatsAfterAppend(
@@ -20582,8 +21610,8 @@ var AuditWriter = class {
     try {
       const line = encodeBodyEntry(record, sessionKey, dayDir, this.bases);
       if (line === null) return;
-      const bodiesPath = this.ensureDir(join26(dayPath, AUDIT_BODIES_DIR));
-      appendFileSync2(join26(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
+      const bodiesPath = this.ensureDir(join27(dayPath, AUDIT_BODIES_DIR));
+      appendFileSync2(join27(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
     } catch (error) {
       this.bases.forget(sessionKey);
       this.logger.warn("[AuditWriter] failed to append audit body shard", {
@@ -20597,7 +21625,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync8 } from "fs";
 import { createHmac as createHmac5 } from "crypto";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 import { fetchUpstream as fetchUpstream14 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -20668,7 +21696,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join27(this.billingDir, billingFileName(event.ts));
+    const file = join28(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -20718,7 +21746,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join27(this.billingDir, deliveredFileName(event.ts));
+      const file = join28(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -20734,11 +21762,11 @@ var BillingPublisher = class {
 };
 
 // src/billing/billingReader.ts
-import { existsSync as existsSync29, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "fs";
+import { join as join29 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!existsSync29(billingDir)) return view;
+  if (!existsSync30(billingDir)) return view;
   let files;
   try {
     files = readdirSync10(billingDir);
@@ -20772,7 +21800,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync22(join28(dir, file), "utf8");
+    raw = readFileSync22(join29(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -21579,6 +22607,7 @@ function buildDaemon(config, paths) {
   });
   const auditDir = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
+  const codexSessionManager = new CodexSessionManager();
   const adminServer = new AdminServer({
     configPath: paths.configPath,
     llmConfig,
@@ -21676,6 +22705,10 @@ function buildDaemon(config, paths) {
     cliTerminalOpener: paths.cliTerminalOpener,
     cliPathProbe: paths.cliPathProbe,
     cliCommandRunner: paths.cliCommandRunner,
+    // One helper invocation shared by the integration install and KEY-SCOPED
+    // launches (the latter append `--key-id` per spawn) — same entrypoint, same
+    // config/master-key resolution, so the two paths can never drift.
+    codexAuthHelper: currentProcessCodexAuthHelper(paths.configPath, paths.masterKeyFilePath),
     integrationManagerFactory: () => {
       const live = outboundApiServer.getStatus();
       const port = live.port || decryptedConfig.server?.port || DEFAULT_OUTBOUND_PORT;
@@ -21720,7 +22753,8 @@ function buildDaemon(config, paths) {
     auditCompactor: () => compactAllClosedAuditDays(auditDir),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
-    billingStatusReader: () => readBillingStatus(billingDir)
+    billingStatusReader: () => readBillingStatus(billingDir),
+    codexSessionManager
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
@@ -21786,6 +22820,7 @@ function buildDaemon(config, paths) {
     pricingEngine,
     pricingRefreshScheduler,
     usageRecorder,
+    codexSessionManager,
     adminServer,
     tokenRefreshScheduler,
     accountHealthSweeper,
@@ -21801,7 +22836,7 @@ function buildDaemon(config, paths) {
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!existsSync30(tokensPath)) return true;
+    if (!existsSync31(tokensPath)) return true;
     accessSync(tokensPath, fsConstants.R_OK);
     return true;
   } catch {
@@ -22340,7 +23375,7 @@ async function runImportCcr(argv) {
 }
 
 // src/commands/integrations.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 import { parseArgs as parseArgs4 } from "util";
 async function runIntegrations(argv) {
   const { values, positionals } = parseArgs4({
@@ -22349,7 +23384,8 @@ async function runIntegrations(argv) {
       config: { type: "string", short: "c" },
       "gateway-base-url": { type: "string" },
       target: { type: "string" },
-      "master-key-file": { type: "string" }
+      "master-key-file": { type: "string" },
+      "key-id": { type: "string" }
     },
     allowPositionals: true
   });
@@ -22362,7 +23398,7 @@ async function runIntegrations(argv) {
   const savedUrl = saved.clients.codex?.gatewayBaseUrl ?? saved.clients.claude?.gatewayBaseUrl;
   const gatewayBaseUrl = values["gateway-base-url"] ?? savedUrl ?? "http://127.0.0.1:8765";
   const manager = new IntegrationManager({
-    configPath: resolve10(values.config),
+    configPath: resolve11(values.config),
     gatewayBaseUrl,
     keyDb: new JsonOutboundKeyDb(defaultKeysPath(values.config), secretBox3),
     stateStore: store,
@@ -22370,7 +23406,9 @@ async function runIntegrations(argv) {
   });
   if (action === "token") {
     if (client !== "codex") throw new Error("integrations token: expected client 'codex'");
-    process.stdout.write(`${await manager.getIntegrationToken(client)}
+    const keyId = values["key-id"];
+    const token = keyId ? await manager.getKeyToken(keyId) : await manager.getIntegrationToken(client);
+    process.stdout.write(`${token}
 `);
     return;
   }
@@ -22456,9 +23494,9 @@ async function keysRevoke(db, id) {
 
 // src/commands/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { randomUUID as randomUUID6 } from "crypto";
-import { existsSync as existsSync31 } from "fs";
-import { delimiter as delimiter2, join as join29 } from "path";
+import { randomUUID as randomUUID7 } from "crypto";
+import { existsSync as existsSync32 } from "fs";
+import { delimiter as delimiter2, join as join30 } from "path";
 import { parseArgs as parseArgs6 } from "util";
 import {
   buildChatCliLaunchConfig as buildChatCliLaunchConfig2,
@@ -22504,8 +23542,8 @@ function buildCliSpawnPlan(opts) {
 function resolveInPathDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean);
   for (const seg of segments) {
-    const full = join29(seg, candidate);
-    if (existsSync31(full)) return full;
+    const full = join30(seg, candidate);
+    if (existsSync32(full)) return full;
   }
   return null;
 }
@@ -22585,7 +23623,7 @@ async function runLaunch(argv, deps) {
 }
 async function buildLaunchConfig(cli, daemon, opts) {
   if (cli === "claude" || cli === "codex") {
-    const internalId = randomUUID6();
+    const internalId = randomUUID7();
     const outcome = await daemon.routeLeaseManager.createFromRequest({
       schemaVersion: ROUTE_LEASE_REQUEST_SCHEMA2,
       consumer: "omnicross-terminal",
@@ -22643,7 +23681,7 @@ async function shutdownLaunchDaemon(daemon) {
   daemon.pricingRefreshScheduler.dispose();
 }
 function spawnCliInherit(plan) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const child = spawn2(plan.command, plan.args, {
       stdio: "inherit",
       env: plan.env,
@@ -22677,7 +23715,7 @@ function spawnCliInherit(plan) {
     });
     child.on("exit", (code, signal) => {
       detach();
-      resolve11(code ?? (signal ? 1 : 0));
+      resolve12(code ?? (signal ? 1 : 0));
     });
   });
 }
@@ -23045,30 +24083,30 @@ function buildOpenBrowserCommand(platform, url) {
   return { command: "xdg-open", args: [url] };
 }
 function openBrowser(url) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     try {
       const { command, args } = buildOpenBrowserCommand(process.platform, url);
       const child = spawn3(command, args, { stdio: "ignore", detached: true });
-      child.on("error", () => resolve11(false));
+      child.on("error", () => resolve12(false));
       child.unref();
-      resolve11(true);
+      resolve12(true);
     } catch {
-      resolve11(false);
+      resolve12(false);
     }
   });
 }
 function promptPaste(prompt) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve11(answer);
+      resolve12(answer);
     });
   });
 }
 
 // src/commands/providers.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { parseArgs as parseArgs8 } from "util";
 async function runProviders(argv) {
   const { values, positionals } = parseArgs8({
@@ -23190,7 +24228,7 @@ function providersAddKey(configPath, providerId, opts) {
   const cfg = loadConfig(configPath);
   const row = cfg.providers.find((p) => p.id === providerId);
   if (!row) throw new Error(`providers add-key: unknown provider '${providerId}'`);
-  const entry = { id: randomUUID7(), apiKey: opts.key };
+  const entry = { id: randomUUID8(), apiKey: opts.key };
   if (opts.label) entry.label = opts.label;
   if (opts.weight !== void 0) {
     const w = Number(opts.weight);
@@ -23218,7 +24256,7 @@ function providersRmKey(configPath, providerId, keyId) {
 }
 
 // src/commands/secrets.ts
-import { existsSync as existsSync32, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync24 } from "fs";
 import { parseArgs as parseArgs9 } from "util";
 async function runSecrets(argv) {
   const { values, positionals } = parseArgs9({
@@ -23291,12 +24329,12 @@ function secretsStatus(args) {
     reportField("admin.token", cfg.admin.token);
   }
   const tokensPath = defaultTokensPath(args.config);
-  if (existsSync32(tokensPath)) {
+  if (existsSync33(tokensPath)) {
     console.info(`Secret status for ${tokensPath}:`);
     reportTokenFields(tokensPath);
   }
   const integrationsPath = defaultIntegrationsPath(args.config);
-  if (existsSync32(integrationsPath)) {
+  if (existsSync33(integrationsPath)) {
     const state = readRawJson(integrationsPath);
     const key = state.gatewayKey;
     if (key && typeof key === "object" && !Array.isArray(key)) {
@@ -23350,8 +24388,8 @@ async function secretsRotate(args) {
   const integrationsPath = defaultIntegrationsPath(args.config);
   try {
     cfg = loadConfig(args.config);
-    if (existsSync32(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
-    if (existsSync32(integrationsPath)) {
+    if (existsSync33(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
+    if (existsSync33(integrationsPath)) {
       integrationsPlain = new IntegrationStateStore(integrationsPath, oldBox).load();
     }
   } finally {
@@ -23386,7 +24424,7 @@ function secretsDecrypt(args) {
   let tokensPlain = null;
   try {
     cfg = loadConfig(args.config);
-    if (existsSync32(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
+    if (existsSync33(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
   } finally {
     setSecretBox(null);
   }
@@ -23417,13 +24455,13 @@ function readRawJson(path2) {
 }
 function encryptTokensFileInPlace(configPath, box) {
   const tokensPath = defaultTokensPath(configPath);
-  if (!existsSync32(tokensPath)) return;
+  if (!existsSync33(tokensPath)) return;
   const plain = decryptTokensFile(tokensPath, box);
   writeTokensEncrypted(tokensPath, plain, box);
 }
 function rewriteIntegrationState(configPath, readBox, writeBox) {
   const path2 = defaultIntegrationsPath(configPath);
-  if (!existsSync32(path2)) return;
+  if (!existsSync33(path2)) return;
   const state = new IntegrationStateStore(path2, readBox).load();
   new IntegrationStateStore(path2, writeBox).save(state);
 }
@@ -23463,7 +24501,7 @@ function walkTokens(raw, fn) {
   return next;
 }
 function tokensSuffix(configPath) {
-  return existsSync32(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
+  return existsSync33(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
 }
 
 // src/commands/start.ts
@@ -23599,7 +24637,7 @@ async function runStart(argv) {
 // src/commands/ui.ts
 async function runUi(argv, deps) {
   const start = deps?.start ?? runStart;
-  const open4 = deps?.openBrowser ?? openBrowser;
+  const open5 = deps?.openBrowser ?? openBrowser;
   const noOpen = argv.includes("--no-open");
   const startArgv = argv.filter((a) => a !== "--no-open");
   if (!resolveUiDist()) {
@@ -23615,7 +24653,7 @@ async function runUi(argv, deps) {
   const uiUrl = `${dashboardUrl}/ui/`;
   console.info(`Control Panel: ${uiUrl}`);
   if (noOpen) return;
-  const launched = await open4(uiUrl).catch(() => false);
+  const launched = await open5(uiUrl).catch(() => false);
   if (!launched) {
     console.info("(Could not open a browser automatically \u2014 open the URL above manually.)");
   }