@omnicross/daemon 0.4.4 → 0.4.6

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/bootstrap.ts
-import { accessSync, constants as fsConstants, existsSync as existsSync30, mkdirSync as mkdirSync9 } from "fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync31, mkdirSync as mkdirSync9 } from "fs";
 import { dirname as dirname17 } from "path";
 import { DEFAULT_AUDIT_CONFIG } from "@omnicross/contracts/audit-types";
 import { DEFAULT_BILLING_CONFIG } from "@omnicross/contracts/billing-types";
@@ -196,14 +196,14 @@ async function runKimiDevicePoll(sessionId, deviceCode, deviceId, fingerprint, s
     {
       fingerprint,
       deadlineMs: DEFAULT_KIMI_OAUTH_TTL_MS,
-      sleep: (ms) => new Promise((resolve10, reject) => {
+      sleep: (ms) => new Promise((resolve11, reject) => {
         const onAbort = () => {
           clearTimeout(timer);
           reject(new Error("login: cancelled"));
         };
         const timer = setTimeout(() => {
           signal.removeEventListener("abort", onAbort);
-          resolve10();
+          resolve11();
         }, ms);
         signal.addEventListener("abort", onAbort, { once: true });
       })
@@ -279,14 +279,14 @@ async function runGrokDevicePoll(sessionId, tokenEndpoint, deviceCode, signal, d
     fetchImpl,
     {
       deadlineMs: DEFAULT_GROK_OAUTH_TTL_MS,
-      sleep: (ms) => new Promise((resolve10, reject) => {
+      sleep: (ms) => new Promise((resolve11, reject) => {
         const onAbort = () => {
           clearTimeout(timer);
           reject(new Error("login: cancelled"));
         };
         const timer = setTimeout(() => {
           signal.removeEventListener("abort", onAbort);
-          resolve10();
+          resolve11();
         }, ms);
         signal.addEventListener("abort", onAbort, { once: true });
       })
@@ -364,14 +364,14 @@ async function runCopilotDevicePoll(sessionId, deviceCode, signal, deps, enterpr
     {
       deadlineMs: DEFAULT_COPILOT_OAUTH_TTL_MS,
       ...enterpriseUrl ? { enterpriseUrl } : {},
-      sleep: (ms) => new Promise((resolve10, reject) => {
+      sleep: (ms) => new Promise((resolve11, reject) => {
         const onAbort = () => {
           clearTimeout(timer);
           reject(new Error("login: cancelled"));
         };
         const timer = setTimeout(() => {
           signal.removeEventListener("abort", onAbort);
-          resolve10();
+          resolve11();
         }, ms);
         signal.addEventListener("abort", onAbort, { once: true });
       })
@@ -2764,19 +2764,19 @@ function resetWebhookRuntimeForTests() {
 
 // src/admin/webhookTestApi.ts
 function readJsonBody(req) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       try {
         const raw = Buffer.concat(chunks).toString("utf8");
         const parsed = raw ? JSON.parse(raw) : {};
-        resolve10(parsed && typeof parsed === "object" ? parsed : {});
+        resolve11(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
-        resolve10({});
+        resolve11({});
       }
     });
-    req.on("error", () => resolve10({}));
+    req.on("error", () => resolve11({}));
   });
 }
 async function handleWebhookTest(req, res) {
@@ -2879,13 +2879,771 @@ async function handleRouteLeaseApi(req, res, path2, deps) {
   }
 }
 
+// src/admin/codexSessionManager.ts
+import { homedir } from "os";
+import { basename, join, resolve, win32 } from "path";
+import {
+  copyFile,
+  open,
+  readdir,
+  readFile,
+  rename,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
+import { TextDecoder as TextDecoder2 } from "util";
+var PROVIDER_PROPERTY_NAMES = /* @__PURE__ */ new Set(["model_provider", "model_provider_id"]);
+var FIRST_LINE_LIMIT = 4 * 1024 * 1024;
+var PROVIDER_ID_LIMIT = 256;
+var CodexSessionManagerError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodexSessionManagerError";
+  }
+};
+var CodexSessionManager = class {
+  codexHome;
+  stateDatabasePath;
+  mutationTail = Promise.resolve();
+  constructor(options = {}) {
+    const configuredHome = options.codexHome?.trim() || process.env["CODEX_HOME"]?.trim();
+    this.codexHome = configuredHome || join(homedir(), ".codex");
+    this.stateDatabasePath = options.stateDatabasePath?.trim() || join(this.codexHome, "state_5.sqlite");
+  }
+  async list(projectPath) {
+    const project = await validateProjectPath(projectPath);
+    const [files, state] = await Promise.all([
+      scanSessionFiles(join(this.codexHome, "sessions")),
+      readStateThreads(this.stateDatabasePath)
+    ]);
+    return mergeSessionMetadata(project.displayPath, this.codexHome, files, state);
+  }
+  async preview(input) {
+    const normalized2 = normalizeApplyInput(input);
+    const project = await validateProjectPath(normalized2.projectPath);
+    const [files, state] = await Promise.all([
+      scanSessionFiles(join(this.codexHome, "sessions")),
+      readStateThreads(this.stateDatabasePath)
+    ]);
+    const snapshot = mergeSessionMetadata(project.displayPath, this.codexHome, files, state);
+    const plans = await buildProviderPlans(normalized2, snapshot, state.rows);
+    return {
+      projectPath: project.displayPath,
+      fromProvider: normalized2.fromProvider ?? null,
+      toProvider: normalized2.toProvider,
+      stateDatabase: state.status,
+      sessions: plans,
+      warnings: snapshot.warnings
+    };
+  }
+  async apply(input) {
+    return this.withMutationLock(() => this.applyLocked(input));
+  }
+  async applyLocked(input) {
+    const normalized2 = normalizeApplyInput(input);
+    const project = await validateProjectPath(normalized2.projectPath);
+    const [files, state] = await Promise.all([
+      scanSessionFiles(join(this.codexHome, "sessions")),
+      readStateThreads(this.stateDatabasePath)
+    ]);
+    if (!state.status.available) {
+      throw new CodexSessionManagerError(
+        state.status.reason || `Codex state database is unavailable: ${state.status.path}`
+      );
+    }
+    const snapshot = mergeSessionMetadata(project.displayPath, this.codexHome, files, state);
+    const plans = await buildProviderPlans(normalized2, snapshot, state.rows);
+    const selected = plans.filter((plan) => plan.action !== "no_change");
+    const blocked = selected.filter((plan) => plan.action === "blocked");
+    if (blocked.length > 0) {
+      const details = blocked.map((plan) => `${plan.id}: ${plan.reason || "blocked"}`).join("; ");
+      throw new CodexSessionManagerError(`cannot update selected Codex sessions: ${details}`);
+    }
+    if (selected.length === 0) {
+      return {
+        ok: true,
+        projectPath: project.displayPath,
+        fromProvider: normalized2.fromProvider ?? null,
+        toProvider: normalized2.toProvider,
+        updatedSessions: 0,
+        jsonlFiles: 0,
+        jsonlFields: 0,
+        sqliteRows: 0,
+        backups: []
+      };
+    }
+    const fileChanges = [];
+    for (const plan of selected) {
+      const file = files.get(plan.id);
+      if (!file || file.status !== "ready") {
+        throw new CodexSessionManagerError(
+          `rollout for session '${plan.id}' is unavailable; no files were changed`
+        );
+      }
+      const before = await snapshotFile(file.filePath);
+      const inspection = await inspectAndTransformFile(file.filePath, normalized2.fromProvider, normalized2.toProvider);
+      const after = await snapshotFile(file.filePath);
+      if (!sameFileSnapshot(before, after)) {
+        throw new CodexSessionManagerError(
+          `rollout '${file.filePath}' changed while it was being read; no files were changed`
+        );
+      }
+      if (inspection.changedFields > 0) {
+        fileChanges.push({
+          id: plan.id,
+          filePath: file.filePath,
+          before,
+          transformedText: inspection.transformedText,
+          changedFields: inspection.changedFields
+        });
+      }
+    }
+    const stateRowsById = new Map(state.rows.map((row) => [row.id, row]));
+    const dbChanges = plans.filter((plan) => plan.action === "update").map((plan) => stateRowsById.get(plan.id)).filter((row) => {
+      if (!row) return false;
+      if (normalized2.fromProvider && row.modelProvider !== normalized2.fromProvider) return false;
+      return row.modelProvider !== normalized2.toProvider;
+    });
+    const temporaryFiles = [];
+    const backups = [];
+    let database;
+    let committed = false;
+    try {
+      for (const change of fileChanges) {
+        const tempPath = `${change.filePath}.provider-switch-${randomUUID2()}.tmp`;
+        await writeFile(tempPath, change.transformedText, "utf8");
+        temporaryFiles.push(tempPath);
+      }
+      if (dbChanges.length > 0) {
+        const sqlite = await loadSqlite();
+        database = openDatabase(sqlite, this.stateDatabasePath, false);
+        const databaseBackup = await createDatabaseBackup(sqlite, database, this.stateDatabasePath);
+        backups.push(databaseBackup);
+        database.exec("BEGIN IMMEDIATE");
+        assertDatabaseRowsUnchanged(database, dbChanges);
+      }
+      for (let index = 0; index < fileChanges.length; index += 1) {
+        const change = fileChanges[index];
+        const tempPath = temporaryFiles[index];
+        const current = await snapshotFile(change.filePath);
+        if (!sameFileSnapshot(change.before, current)) {
+          throw new CodexSessionManagerError(
+            `rollout '${change.filePath}' changed before replacement; no files were changed`
+          );
+        }
+        const backupPath = await createUniqueBackupPath(change.filePath);
+        await copyFile(change.filePath, backupPath);
+        backups.push(backupPath);
+        await replaceFileAtomically(tempPath, change.filePath);
+        temporaryFiles[index] = "";
+      }
+      if (database && dbChanges.length > 0) {
+        const update = database.prepare("UPDATE threads SET model_provider = ? WHERE id = ?");
+        for (const row of dbChanges) update.run(normalized2.toProvider, row.id);
+        database.exec("COMMIT");
+        committed = true;
+      } else {
+        committed = true;
+      }
+      return {
+        ok: true,
+        projectPath: project.displayPath,
+        fromProvider: normalized2.fromProvider ?? null,
+        toProvider: normalized2.toProvider,
+        updatedSessions: (/* @__PURE__ */ new Set([...fileChanges.map((change) => change.id), ...dbChanges.map((row) => row.id)])).size,
+        jsonlFiles: fileChanges.length,
+        jsonlFields: fileChanges.reduce((total, change) => total + change.changedFields, 0),
+        sqliteRows: dbChanges.length,
+        backups
+      };
+    } catch (error) {
+      if (database?.isTransaction) {
+        try {
+          database.exec("ROLLBACK");
+        } catch {
+        }
+      }
+      if (!committed) {
+        try {
+          await restoreBackups(backups.filter((path2) => /\.jsonl\.provider-switch-[^/\\]+\.bak$/iu.test(path2)));
+        } catch (restoreError) {
+          const original = error instanceof Error ? error.message : String(error);
+          const restoration = restoreError instanceof Error ? restoreError.message : String(restoreError);
+          throw new CodexSessionManagerError(
+            `${original}; JSONL restoration also failed: ${restoration}`
+          );
+        }
+      }
+      throw error;
+    } finally {
+      if (database?.isOpen) database.close();
+      for (const tempPath of temporaryFiles) {
+        if (!tempPath) continue;
+        await unlinkIfPresent(tempPath);
+      }
+    }
+  }
+  async withMutationLock(operation) {
+    const previous = this.mutationTail;
+    let release;
+    this.mutationTail = new Promise((resolve11) => {
+      release = resolve11;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+};
+function normalizeApplyInput(input) {
+  const projectPath = typeof input.projectPath === "string" ? input.projectPath.trim() : "";
+  const toProvider = typeof input.toProvider === "string" ? input.toProvider.trim() : "";
+  const fromProvider = typeof input.fromProvider === "string" ? input.fromProvider.trim() : void 0;
+  if (!projectPath) throw new CodexSessionManagerError("projectPath must be a non-empty string");
+  validateProviderId(toProvider, "toProvider");
+  if (fromProvider) validateProviderId(fromProvider, "fromProvider");
+  if (!Array.isArray(input.sessionIds) || input.sessionIds.length === 0) {
+    throw new CodexSessionManagerError("sessionIds must contain at least one session id");
+  }
+  const sessionIds = [
+    ...new Set(
+      input.sessionIds.filter((id) => typeof id === "string" && id.trim().length > 0).map((id) => id.trim())
+    )
+  ];
+  if (sessionIds.length === 0) throw new CodexSessionManagerError("sessionIds must contain at least one session id");
+  if (sessionIds.length > 1e4) throw new CodexSessionManagerError("too many sessionIds");
+  return { projectPath, sessionIds, toProvider, ...fromProvider ? { fromProvider } : {} };
+}
+function validateProviderId(value, name) {
+  if (!value) throw new CodexSessionManagerError(`${name} must be a non-empty string`);
+  if (value.length > PROVIDER_ID_LIMIT || /[\u0000-\u001f\u007f]/u.test(value)) {
+    throw new CodexSessionManagerError(`${name} is invalid`);
+  }
+}
+async function validateProjectPath(projectPath) {
+  if (typeof projectPath !== "string" || !projectPath.trim()) {
+    throw new CodexSessionManagerError("projectPath must be a non-empty string");
+  }
+  const displayPath = resolve(projectPath.trim());
+  let info;
+  try {
+    info = await stat(displayPath);
+  } catch {
+    throw new CodexSessionManagerError(`project path does not exist: ${displayPath}`);
+  }
+  if (!info.isDirectory()) throw new CodexSessionManagerError(`project path is not a directory: ${displayPath}`);
+  return { displayPath };
+}
+async function scanSessionFiles(sessionsRoot) {
+  const files = await collectJsonlFiles(sessionsRoot);
+  const records = /* @__PURE__ */ new Map();
+  for (const filePath of files) {
+    let fileStat;
+    try {
+      fileStat = await stat(filePath);
+      const firstLine = await readFirstLine(filePath);
+      const parsed = parseSessionMetadata(firstLine, filePath);
+      if (!parsed.id) continue;
+      const record = {
+        id: parsed.id,
+        filePath,
+        cwd: parsed.cwd,
+        jsonlProvider: parsed.provider,
+        timestamp: parsed.timestamp,
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        status: "ready"
+      };
+      const existing = records.get(record.id);
+      if (!existing || record.mtimeMs > existing.mtimeMs) records.set(record.id, record);
+    } catch {
+      const id = sessionIdFromRolloutPath(filePath);
+      if (!id) continue;
+      let fallbackStat;
+      try {
+        fallbackStat = await stat(filePath);
+      } catch {
+        continue;
+      }
+      const existing = records.get(id);
+      if (!existing || fallbackStat.mtimeMs > existing.mtimeMs) {
+        records.set(id, {
+          id,
+          filePath,
+          cwd: null,
+          jsonlProvider: null,
+          timestamp: null,
+          size: fallbackStat.size,
+          mtimeMs: fallbackStat.mtimeMs,
+          status: "unreadable_rollout"
+        });
+      }
+    }
+  }
+  return records;
+}
+async function collectJsonlFiles(root) {
+  if (!existsSync2(root)) return [];
+  const result = [];
+  const pending = [root];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    let entries;
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const fullPath = join(current, entry.name);
+      if (entry.isDirectory()) pending.push(fullPath);
+      else if (entry.isFile() && entry.name.toLowerCase().endsWith(".jsonl")) result.push(fullPath);
+    }
+  }
+  return result.sort((a, b) => a.localeCompare(b));
+}
+async function readFirstLine(filePath) {
+  const handle = await open(filePath, "r");
+  const chunks = [];
+  let total = 0;
+  try {
+    while (total < FIRST_LINE_LIMIT) {
+      const chunk = Buffer.allocUnsafe(Math.min(128 * 1024, FIRST_LINE_LIMIT - total));
+      const result = await handle.read(chunk, 0, chunk.length, null);
+      if (result.bytesRead === 0) break;
+      const used = chunk.subarray(0, result.bytesRead);
+      const lineEnd = findLineEnd(used);
+      if (lineEnd >= 0) {
+        chunks.push(used.subarray(0, lineEnd));
+        return decodeUtf8(Buffer.concat(chunks));
+      }
+      chunks.push(used);
+      total += result.bytesRead;
+    }
+  } finally {
+    await handle.close();
+  }
+  if (total > 0 && total < FIRST_LINE_LIMIT) return decodeUtf8(Buffer.concat(chunks));
+  throw new CodexSessionManagerError(`session metadata line is too large or incomplete: ${filePath}`);
+}
+function findLineEnd(buffer) {
+  for (let index = 0; index < buffer.length; index += 1) {
+    if (buffer[index] === 10 || buffer[index] === 13) return index;
+  }
+  return -1;
+}
+function parseSessionMetadata(line, filePath) {
+  const value = JSON.parse(line.replace(/^\uFEFF/u, ""));
+  if (!isRecord6(value)) throw new Error("metadata is not an object");
+  const payload = isRecord6(value["payload"]) ? value["payload"] : {};
+  const id = sessionIdFromRolloutPath(filePath) || firstString(payload["session_id"], payload["id"]);
+  return {
+    id,
+    cwd: firstString(payload["cwd"]),
+    provider: firstString(payload["model_provider"]),
+    timestamp: firstString(payload["timestamp"]) || firstString(value["timestamp"])
+  };
+}
+function sessionIdFromRolloutPath(filePath) {
+  const match = basename(filePath).match(/([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\.jsonl$/iu);
+  return match?.[1] ?? null;
+}
+async function readStateThreads(databasePath) {
+  const unavailable = (reason) => ({
+    status: { path: databasePath, available: false, reason },
+    rows: []
+  });
+  if (!existsSync2(databasePath)) return unavailable(`Codex state database not found: ${databasePath}`);
+  let sqlite;
+  try {
+    sqlite = await loadSqlite();
+  } catch (error) {
+    return unavailable(error instanceof Error ? error.message : String(error));
+  }
+  let database;
+  try {
+    database = openDatabase(sqlite, databasePath, true);
+    const columns = new Set(
+      database.prepare("PRAGMA table_info('threads')").all().map((row) => String(row["name"] ?? ""))
+    );
+    for (const required of ["id", "rollout_path", "cwd", "model_provider"]) {
+      if (!columns.has(required)) return unavailable(`state_5.sqlite is missing threads.${required}`);
+    }
+    const selected = ["id", "rollout_path", "cwd", "model_provider", "model", "created_at", "updated_at", "created_at_ms", "updated_at_ms"].filter((column) => columns.has(column));
+    const rows = database.prepare(`SELECT ${selected.join(", ")} FROM threads`).all();
+    return {
+      status: { path: databasePath, available: true },
+      rows: rows.map(toStateThreadRow)
+    };
+  } catch (error) {
+    return unavailable(`could not read Codex state database: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    if (database?.isOpen) database.close();
+  }
+}
+async function loadSqlite() {
+  const specifier = "node:sqlite";
+  try {
+    return await import(specifier);
+  } catch (error) {
+    const cause = error instanceof Error ? error.message : String(error);
+    throw new CodexSessionManagerError(
+      `Codex session SQLite support requires Node.js 22.16 or newer (node:sqlite); this daemon runs ${process.version} (import failed: ${cause})`
+    );
+  }
+}
+function openDatabase(sqlite, databasePath, readOnly) {
+  const database = new sqlite.DatabaseSync(databasePath, { readOnly, timeout: 5e3 });
+  database.exec("PRAGMA busy_timeout = 5000");
+  return database;
+}
+function toStateThreadRow(row) {
+  return {
+    id: String(row["id"] ?? ""),
+    rolloutPath: String(row["rollout_path"] ?? ""),
+    cwd: String(row["cwd"] ?? ""),
+    modelProvider: String(row["model_provider"] ?? ""),
+    model: row["model"] == null ? null : String(row["model"]),
+    createdAt: timestampFromSqlite(row["created_at_ms"] ?? row["created_at"]),
+    updatedAt: timestampFromSqlite(row["updated_at_ms"] ?? row["updated_at"])
+  };
+}
+function timestampFromSqlite(value) {
+  const numeric = typeof value === "bigint" ? Number(value) : typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(numeric) || numeric <= 0) return null;
+  const milliseconds = numeric < 1e11 ? numeric * 1e3 : numeric;
+  const date = new Date(milliseconds);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+function mergeSessionMetadata(projectPath, codexHome, files, state) {
+  const stateRows = new Map(state.rows.map((row) => [row.id, row]));
+  const ids = /* @__PURE__ */ new Set();
+  for (const [id, file] of files) {
+    if (file.cwd && isPathInside(projectPath, file.cwd)) ids.add(id);
+  }
+  for (const row of state.rows) {
+    if (isPathInside(projectPath, row.cwd)) ids.add(row.id);
+  }
+  const sessions2 = [];
+  for (const id of ids) {
+    const file = files.get(id);
+    const row = stateRows.get(id);
+    const cwd = row?.cwd || file?.cwd || projectPath;
+    if (!isPathInside(projectPath, cwd)) continue;
+    const rolloutPath = file?.filePath || row?.rolloutPath || "";
+    const provider = row?.modelProvider || file?.jsonlProvider || null;
+    sessions2.push({
+      id,
+      cwd,
+      rolloutPath,
+      provider,
+      jsonlProvider: file?.jsonlProvider ?? null,
+      model: row?.model ?? null,
+      createdAt: row?.createdAt ?? file?.timestamp ?? null,
+      updatedAt: row?.updatedAt ?? (file ? new Date(file.mtimeMs).toISOString() : null),
+      fileSize: file?.size ?? null,
+      fileModifiedAt: file ? new Date(file.mtimeMs).toISOString() : null,
+      status: file?.status ?? "missing_rollout",
+      inStateDatabase: Boolean(row)
+    });
+  }
+  sessions2.sort((a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "") || a.id.localeCompare(b.id));
+  const warnings = [];
+  if (!state.status.available) warnings.push(state.status.reason || "state database unavailable");
+  return { projectPath, codexHome, stateDatabase: state.status, sessions: sessions2, warnings };
+}
+async function buildProviderPlans(input, snapshot, stateRows) {
+  const byId = new Map(snapshot.sessions.map((session) => [session.id, session]));
+  const stateById = new Map(stateRows.map((row) => [row.id, row]));
+  const plans = [];
+  for (const id of input.sessionIds) {
+    const session = byId.get(id);
+    const row = stateById.get(id);
+    if (!session) {
+      plans.push({
+        id,
+        provider: null,
+        model: null,
+        rolloutPath: "",
+        status: "blocked",
+        providers: [],
+        matchingFields: 0,
+        changedFields: 0,
+        sqliteWillUpdate: false,
+        action: "blocked",
+        reason: "session is not associated with the requested project"
+      });
+      continue;
+    }
+    if (session.status !== "ready") {
+      plans.push({
+        id,
+        provider: session.provider,
+        model: session.model,
+        rolloutPath: session.rolloutPath,
+        status: session.status,
+        providers: [],
+        matchingFields: 0,
+        changedFields: 0,
+        sqliteWillUpdate: false,
+        action: "blocked",
+        reason: "rollout file is missing or unreadable"
+      });
+      continue;
+    }
+    const inspection = await inspectAndTransformFile(session.rolloutPath, input.fromProvider, input.toProvider);
+    const sqliteWillUpdate = Boolean(
+      row && (!input.fromProvider || row.modelProvider === input.fromProvider) && row.modelProvider !== input.toProvider
+    );
+    const changed = inspection.changedFields > 0 || sqliteWillUpdate;
+    plans.push({
+      id,
+      provider: session.provider,
+      model: session.model,
+      rolloutPath: session.rolloutPath,
+      status: "ready",
+      providers: inspection.providers,
+      matchingFields: inspection.matchingFields,
+      changedFields: inspection.changedFields,
+      sqliteWillUpdate,
+      action: changed ? "update" : "no_change"
+    });
+  }
+  return plans;
+}
+async function inspectAndTransformFile(filePath, fromProvider, toProvider) {
+  const bytes = await readFile(filePath);
+  const originalText = decodeUtf8(bytes);
+  const parts = originalText.split(/(\r\n|\n|\r)/u);
+  const providers = /* @__PURE__ */ new Set();
+  let matchingFields = 0;
+  let changedFields = 0;
+  const hasBom = parts[0].startsWith("\uFEFF");
+  for (let index = 0; index < parts.length; index += 2) {
+    const line = parts[index];
+    if (!line.trim()) continue;
+    let value;
+    try {
+      value = JSON.parse(line.replace(index === 0 ? /^\uFEFF/u : /^/u, ""));
+    } catch (error) {
+      throw new CodexSessionManagerError(
+        `invalid JSONL at ${filePath}:${Math.floor(index / 2) + 1}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    const result = replaceStructuredProviderFields(value, fromProvider, toProvider, providers);
+    matchingFields += result.matchingFields;
+    changedFields += result.changedFields;
+    if (result.changedFields > 0) {
+      parts[index] = `${index === 0 && hasBom ? "\uFEFF" : ""}${JSON.stringify(value)}`;
+    }
+  }
+  return {
+    transformedText: parts.join(""),
+    providers: [...providers].sort(),
+    matchingFields,
+    changedFields
+  };
+}
+function replaceStructuredProviderFields(value, fromProvider, toProvider, providers = /* @__PURE__ */ new Set()) {
+  let matchingFields = 0;
+  let changedFields = 0;
+  const visit = (node) => {
+    if (Array.isArray(node)) {
+      for (const child of node) visit(child);
+      return;
+    }
+    if (!isRecord6(node)) return;
+    for (const [key, child] of Object.entries(node)) {
+      if (PROVIDER_PROPERTY_NAMES.has(key) && typeof child === "string") {
+        providers.add(child);
+        if (!fromProvider || child === fromProvider) {
+          matchingFields += 1;
+          if (child !== toProvider) {
+            node[key] = toProvider;
+            changedFields += 1;
+          }
+        }
+      }
+      visit(node[key]);
+    }
+  };
+  visit(value);
+  return { matchingFields, changedFields };
+}
+async function snapshotFile(filePath) {
+  const info = await stat(filePath);
+  return { size: info.size, mtimeMs: info.mtimeMs };
+}
+function sameFileSnapshot(a, b) {
+  return a.size === b.size && a.mtimeMs === b.mtimeMs;
+}
+async function createUniqueBackupPath(filePath) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[.:]/gu, "-");
+  let candidate = `${filePath}.provider-switch-${stamp}.bak`;
+  let suffix = 1;
+  while (existsSync2(candidate)) {
+    candidate = `${filePath}.provider-switch-${stamp}-${suffix}.bak`;
+    suffix += 1;
+  }
+  return candidate;
+}
+async function createDatabaseBackup(sqlite, database, databasePath) {
+  const backupPath = await createUniqueBackupPath(databasePath);
+  if (typeof sqlite.backup !== "function") {
+    throw new CodexSessionManagerError(
+      "Codex session updates require the node:sqlite backup API (Node.js 22.16 or newer)"
+    );
+  }
+  await sqlite.backup(database, backupPath);
+  return backupPath;
+}
+function assertDatabaseRowsUnchanged(database, rows) {
+  const read = database.prepare("SELECT model_provider FROM threads WHERE id = ?");
+  for (const row of rows) {
+    const current = read.get(row.id);
+    if (!current || String(current["model_provider"] ?? "") !== row.modelProvider) {
+      throw new CodexSessionManagerError(
+        `SQLite session '${row.id}' changed while the update was prepared; no files were changed`
+      );
+    }
+  }
+}
+async function replaceFileAtomically(tempPath, targetPath) {
+  try {
+    await rename(tempPath, targetPath);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+    await copyFile(tempPath, targetPath);
+    await unlinkIfPresent(tempPath);
+  }
+}
+async function restoreBackups(backupPaths) {
+  for (const backupPath of backupPaths.reverse()) {
+    if (!existsSync2(backupPath)) continue;
+    const targetPath = backupPath.replace(/\.provider-switch-[^.]+(?:-[0-9]+)?\.bak$/u, "");
+    if (targetPath === backupPath) continue;
+    const tempPath = `${targetPath}.provider-restore-${randomUUID2()}.tmp`;
+    try {
+      await copyFile(backupPath, tempPath);
+      await replaceFileAtomically(tempPath, targetPath);
+    } finally {
+      await unlinkIfPresent(tempPath);
+    }
+  }
+}
+async function unlinkIfPresent(filePath) {
+  try {
+    await unlink(filePath);
+  } catch {
+  }
+}
+function decodeUtf8(bytes) {
+  try {
+    return new TextDecoder2("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new CodexSessionManagerError("Codex session contains invalid UTF-8");
+  }
+}
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function firstString(...values) {
+  for (const value of values) if (typeof value === "string" && value.trim()) return value;
+  return null;
+}
+function normalizeComparablePath(value) {
+  const stripped = value.trim().replace(/^\\\\\?\\/u, "");
+  if (process.platform === "win32") {
+    const normalized2 = win32.normalize(stripped).replace(/[\\/]+$/u, "");
+    return normalized2.toLowerCase();
+  }
+  return stripped.replace(/\/+$/u, "") || "/";
+}
+function isPathInside(projectPath, candidatePath) {
+  const project = normalizeComparablePath(projectPath);
+  const candidate = normalizeComparablePath(candidatePath);
+  if (project === candidate) return true;
+  const separator = process.platform === "win32" ? "\\" : "/";
+  return candidate.startsWith(`${project}${separator}`);
+}
+
+// src/admin/codexSessionApi.ts
+async function handleCodexSessionApi(req, res, path2, manager) {
+  if (!manager) return writeJsonError(res, 501, "Codex session management is not available");
+  try {
+    const method = (req.method ?? "GET").toUpperCase();
+    if (path2 === "/admin/api/codex-sessions" && (method === "GET" || method === "HEAD")) {
+      const projectPath = new URL(req.url ?? "/", "http://localhost").searchParams.get("projectPath") ?? "";
+      return writeJson(res, 200, await manager.list(projectPath));
+    }
+    if (path2 === "/admin/api/codex-sessions/preview" && method === "POST") {
+      const body = await readJsonBody2(req);
+      return writeJson(res, 200, await manager.preview(parseApplyInput(body)));
+    }
+    if (path2 === "/admin/api/codex-sessions/apply" && method === "POST") {
+      const body = await readJsonBody2(req);
+      return writeJson(res, 200, await manager.apply(parseApplyInput(body)));
+    }
+    return writeJsonError(res, 404, "unknown Codex session admin route");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return writeJsonError(res, error instanceof CodexSessionManagerError ? 400 : 500, message);
+  }
+}
+async function readJsonBody2(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  if (chunks.length === 0) return {};
+  try {
+    const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    return isRecord7(value) ? value : {};
+  } catch {
+    throw new CodexSessionManagerError("request body must be a JSON object");
+  }
+}
+function parseApplyInput(body) {
+  const projectPath = body["projectPath"];
+  const sessionIds = body["sessionIds"];
+  const toProvider = body["toProvider"];
+  const fromProvider = body["fromProvider"];
+  if (typeof projectPath !== "string") throw new CodexSessionManagerError("projectPath must be a string");
+  if (!Array.isArray(sessionIds) || !sessionIds.every((value) => typeof value === "string")) {
+    throw new CodexSessionManagerError("sessionIds must be an array of strings");
+  }
+  if (typeof toProvider !== "string") throw new CodexSessionManagerError("toProvider must be a string");
+  if (fromProvider !== void 0 && typeof fromProvider !== "string") {
+    throw new CodexSessionManagerError("fromProvider must be a string when provided");
+  }
+  return {
+    projectPath,
+    sessionIds,
+    toProvider,
+    ...fromProvider === void 0 ? {} : { fromProvider }
+  };
+}
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeJsonError(res, status, message) {
+  writeJson(res, status, { error: { type: "admin_api_error", message } });
+}
+function isRecord7(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
 // src/admin/adminApi.ts
 import http from "http";
 import {
   createNamedKey,
   DEFAULT_IMAGES_SERVER_CONFIG,
   DEFAULT_SEARCH_SERVER_CONFIG as DEFAULT_SEARCH_SERVER_CONFIG2,
-  effectiveOutboundPermissions as effectiveOutboundPermissions2,
+  effectiveOutboundPermissions as effectiveOutboundPermissions3,
   gatewayBindingToEndpointConfig,
   isKindMappedEndpoint,
   loadServerConfig as loadServerConfig3,
@@ -2903,6 +3661,34 @@ import { getSharedAccountHealth } from "@omnicross/core/pipeline/SubscriptionAcc
 import { fetchUpstream as fetchUpstream10 } from "@omnicross/core/pipeline/upstreamFetch";
 import { mergeExtraHeaders } from "@omnicross/core";
 
+// src/admin/testEgressIdentity.ts
+import {
+  getOpenCodeGoUserAgent as getOpenCodeGoUserAgent2,
+  OPENCODE_SESSION_HEADER
+} from "@omnicross/core/provider-proxy/identity/openCodeGoHeaders";
+var ADMIN_PROBE_OPENCODE_SESSION = "omnicross-admin-probe";
+function isOpenCodeUpstream(baseUrl) {
+  if (!baseUrl) return false;
+  try {
+    const host = new URL(baseUrl).hostname.toLowerCase();
+    return host === "opencode.ai" || host.endsWith(".opencode.ai");
+  } catch {
+    return false;
+  }
+}
+function hasHeader2(headers, name) {
+  const lower = name.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === lower);
+}
+function applyAdminProbeIdentity(headers, row) {
+  if (!hasHeader2(headers, "user-agent")) {
+    headers["user-agent"] = getOpenCodeGoUserAgent2();
+  }
+  if (isOpenCodeUpstream(row.baseUrl) && !hasHeader2(headers, OPENCODE_SESSION_HEADER)) {
+    headers[OPENCODE_SESSION_HEADER] = ADMIN_PROBE_OPENCODE_SESSION;
+  }
+}
+
 // src/image-generation/imagesConfigValidation.ts
 import { validateImagesServerConfig } from "@omnicross/core/outbound-api";
 
@@ -2910,7 +3696,7 @@ import { validateImagesServerConfig } from "@omnicross/core/outbound-api";
 import { randomBytes } from "crypto";
 import {
   chmodSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync,
   mkdirSync as mkdirSync2,
   realpathSync,
@@ -2918,20 +3704,20 @@ import {
   statSync as statSync2,
   unlinkSync
 } from "fs";
-import { homedir, tmpdir } from "os";
+import { homedir as homedir2, tmpdir } from "os";
 import {
-  basename,
+  basename as basename2,
   dirname as dirname2,
   isAbsolute,
-  join,
+  join as join2,
   parse,
   relative,
-  resolve
+  resolve as resolve2
 } from "path";
 var OPAQUE_NAME = /^(?:file|directory)-[a-f0-9]{32}(?:\.(?:bin|json|tmp))?$/u;
 var MOUNT_MANIFEST_NAME = "catalog.v1.json";
 function normalized(path2) {
-  const canonical = resolve(path2);
+  const canonical = resolve2(path2);
   return process.platform === "win32" ? canonical.toLowerCase() : canonical;
 }
 function samePath(left, right) {
@@ -2942,26 +3728,26 @@ function isSameOrDescendant(candidate, parent) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function assertNoSymlinkComponents(target) {
-  const absolute = resolve(target);
+  const absolute = resolve2(target);
   const filesystemRoot = parse(absolute).root;
   let cursor = filesystemRoot;
   for (const segment of relative(filesystemRoot, absolute).split(/[\\/]+/u).filter(Boolean)) {
-    cursor = join(cursor, segment);
-    if (!existsSync2(cursor)) break;
+    cursor = join2(cursor, segment);
+    if (!existsSync3(cursor)) break;
     if (lstatSync(cursor).isSymbolicLink()) {
       throw new TypeError("image storage paths must not traverse a symbolic link");
     }
   }
 }
 function isInsideDetectedWorktree(target) {
-  let cursor = resolve(target);
-  while (!existsSync2(cursor)) {
+  let cursor = resolve2(target);
+  while (!existsSync3(cursor)) {
     const parent = dirname2(cursor);
     if (parent === cursor) break;
     cursor = parent;
   }
   while (true) {
-    if (existsSync2(join(cursor, ".git"))) return true;
+    if (existsSync3(join2(cursor, ".git"))) return true;
     const parent = dirname2(cursor);
     if (parent === cursor) return false;
     cursor = parent;
@@ -2969,15 +3755,15 @@ function isInsideDetectedWorktree(target) {
 }
 function isBroadRoot(target, options) {
   const filesystemRoot = parse(target).root;
-  const processDirectory = resolve(options.processDirectory ?? process.cwd());
-  const userHome = resolve(options.userHome ?? homedir());
-  const temporaryDirectory = resolve(options.temporaryDirectory ?? tmpdir());
+  const processDirectory = resolve2(options.processDirectory ?? process.cwd());
+  const userHome = resolve2(options.userHome ?? homedir2());
+  const temporaryDirectory = resolve2(options.temporaryDirectory ?? tmpdir());
   return samePath(target, filesystemRoot) || samePath(target, userHome) || samePath(target, temporaryDirectory) || isSameOrDescendant(processDirectory, target) || isSameOrDescendant(userHome, target) || isSameOrDescendant(temporaryDirectory, target);
 }
 function validateImageRootCandidate(candidate, options = {}) {
   const label = options.label ?? "image storage root";
   if (!candidate.trim() || !isAbsolute(candidate)) return [`${label} must be an absolute path`];
-  const target = resolve(candidate);
+  const target = resolve2(candidate);
   const errors = [];
   if (isBroadRoot(target, options)) errors.push(`${label} is too broad`);
   try {
@@ -3015,22 +3801,22 @@ var DaemonImagePathResolver = class {
   #issued = /* @__PURE__ */ new WeakSet();
   constructor(options) {
     if (!isAbsolute(options.configPath)) throw new TypeError("daemon configPath must be absolute");
-    const applicationDataRoot = resolve(dirname2(options.configPath));
+    const applicationDataRoot = resolve2(dirname2(options.configPath));
     const applicationErrors = validateImageRootCandidate(applicationDataRoot, {
       ...options,
       label: "daemon application data root"
     });
     if (applicationErrors.length > 0) throw new TypeError(applicationErrors.join("; "));
-    const imagesRoot = join(applicationDataRoot, "images");
-    const durableRoot = resolve(options.storageRoot ?? join(imagesRoot, "storage"));
+    const imagesRoot = join2(applicationDataRoot, "images");
+    const durableRoot = resolve2(options.storageRoot ?? join2(imagesRoot, "storage"));
     const durableErrors = validateImageRootCandidate(durableRoot, {
       ...options,
       label: "image durable storage root"
     });
     const reservedRoots = [
-      join(imagesRoot, "temporary"),
-      join(imagesRoot, "evidence"),
-      join(imagesRoot, "mount-catalog")
+      join2(imagesRoot, "temporary"),
+      join2(imagesRoot, "evidence"),
+      join2(imagesRoot, "mount-catalog")
     ];
     if (reservedRoots.some((reserved) => isSameOrDescendant(durableRoot, reserved) || isSameOrDescendant(reserved, durableRoot))) {
       durableErrors.push("image durable storage root must not overlap daemon image control roots");
@@ -3039,13 +3825,13 @@ var DaemonImagePathResolver = class {
     const paths = Object.freeze({
       applicationDataRoot,
       imagesRoot,
-      temporaryRoot: join(imagesRoot, "temporary"),
+      temporaryRoot: join2(imagesRoot, "temporary"),
       durableRoot,
-      artifactsRoot: join(durableRoot, "artifacts"),
-      stateRoot: join(durableRoot, "state"),
-      evidenceRoot: join(imagesRoot, "evidence"),
-      mountManifestRoot: join(imagesRoot, "mount-catalog"),
-      mountManifestPath: join(imagesRoot, "mount-catalog", MOUNT_MANIFEST_NAME)
+      artifactsRoot: join2(durableRoot, "artifacts"),
+      stateRoot: join2(durableRoot, "state"),
+      evidenceRoot: join2(imagesRoot, "evidence"),
+      mountManifestRoot: join2(imagesRoot, "mount-catalog"),
+      mountManifestPath: join2(imagesRoot, "mount-catalog", MOUNT_MANIFEST_NAME)
     });
     const rootEntries = [
       ["temporary", paths.temporaryRoot],
@@ -3077,7 +3863,7 @@ var DaemonImagePathResolver = class {
   /** Revalidate immediately before unlinking a resolver-issued file capability. */
   removeFile(target) {
     const path2 = this.verifyDestructiveTarget(target, ["opaque-file", "mount-manifest"]);
-    if (!existsSync2(path2)) return;
+    if (!existsSync3(path2)) return;
     const info = lstatSync(path2);
     if (info.isSymbolicLink() || !info.isFile()) {
       throw new TypeError("refusing to unlink an unverified image file");
@@ -3087,7 +3873,7 @@ var DaemonImagePathResolver = class {
   /** Only empty opaque directories may be removed until the owned-marker layer is composed. */
   removeEmptyDirectory(target) {
     const path2 = this.verifyDestructiveTarget(target, ["opaque-directory"]);
-    if (!existsSync2(path2)) return;
+    if (!existsSync3(path2)) return;
     const info = lstatSync(path2);
     if (info.isSymbolicLink() || !info.isDirectory()) {
       throw new TypeError("refusing to remove an unverified image directory");
@@ -3097,7 +3883,7 @@ var DaemonImagePathResolver = class {
   issue(area, name, kind) {
     const handle = Object.freeze({
       area,
-      absolutePath: join(this.#roots[area].path, name),
+      absolutePath: join2(this.#roots[area].path, name),
       kind
     });
     this.#issued.add(handle);
@@ -3112,11 +3898,11 @@ var DaemonImagePathResolver = class {
     }
     const root = this.#roots[target.area];
     assertRootIdentity(root);
-    const candidate = resolve(target.absolutePath);
+    const candidate = resolve2(target.absolutePath);
     if (!samePath(dirname2(candidate), root.path) || !isSameOrDescendant(candidate, root.path)) {
       throw new TypeError("refusing a destructive operation outside the verified image root");
     }
-    const name = basename(candidate);
+    const name = basename2(candidate);
     const validName = target.kind === "mount-manifest" ? name === MOUNT_MANIFEST_NAME : OPAQUE_NAME.test(name);
     if (!validName) throw new TypeError("refusing a caller-derived image filename");
     assertNoSymlinkComponents(candidate);
@@ -3273,13 +4059,13 @@ function decryptValue(envelope, key) {
 
 // src/secrets/masterKey.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join2 } from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join3 } from "path";
 var MASTER_KEY_ENV = "OMNICROSS_MASTER_KEY";
 var KEY_BYTES2 = 32;
 function defaultMasterKeyPath() {
-  return join2(homedir2(), ".omnicross", "master.key");
+  return join3(homedir3(), ".omnicross", "master.key");
 }
 function decodeEnvKey(raw) {
   const trimmed = raw.trim();
@@ -3321,7 +4107,7 @@ function resolveMasterKey(options = {}) {
     return decodeEnvKey(envRaw);
   }
   const keyFilePath = options.keyFilePath ?? defaultMasterKeyPath();
-  if (existsSync3(keyFilePath)) {
+  if (existsSync4(keyFilePath)) {
     return readKeyFile(keyFilePath);
   }
   return generateKeyFile(keyFilePath);
@@ -3939,29 +4725,29 @@ function resolveEnvKey(rawKey) {
 
 // src/integrations/IntegrationManager.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3, resolve as resolve3 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4, resolve as resolve4 } from "path";
 import {
   createIntegrationKey,
   effectiveOutboundPermissions
 } from "@omnicross/core";
 
 // src/integrations/codexAuthHelper.ts
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 function currentProcessCodexAuthHelper(configPath, masterKeyFilePath) {
   const entrypoint = process.argv[1];
   if (!entrypoint) throw new Error("cannot configure Codex auth helper without a daemon CLI entrypoint");
   return {
     command: process.execPath,
     args: [
-      resolve2(entrypoint),
+      resolve3(entrypoint),
       "integrations",
       "token",
       "codex",
       "--config",
-      resolve2(configPath),
-      ...masterKeyFilePath ? ["--master-key-file", resolve2(masterKeyFilePath)] : []
+      resolve3(configPath),
+      ...masterKeyFilePath ? ["--master-key-file", resolve3(masterKeyFilePath)] : []
     ]
   };
 }
@@ -3969,7 +4755,7 @@ function currentProcessCodexAuthHelper(configPath, masterKeyFilePath) {
 // src/integrations/IntegrationStateStore.ts
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync4,
   renameSync as renameSync2,
@@ -3986,7 +4772,7 @@ var IntegrationStateStore = class {
   path;
   box;
   load() {
-    if (!existsSync4(this.path)) return { ...EMPTY_STATE, clients: {} };
+    if (!existsSync5(this.path)) return { ...EMPTY_STATE, clients: {} };
     let raw;
     try {
       raw = JSON.parse(readFileSync4(this.path, "utf8"));
@@ -4092,7 +4878,7 @@ function atomicWrite(path2, content) {
     }
     throw error;
   } finally {
-    if (existsSync4(path2)) {
+    if (existsSync5(path2)) {
       try {
         chmodSync3(path2, 384);
       } catch {
@@ -4277,7 +5063,7 @@ var IntegrationManager = class {
   constructor(options) {
     this.options = options;
     assertLoopbackGatewayUrl(options.gatewayBaseUrl);
-    this.homeDir = options.homeDir ?? homedir3();
+    this.homeDir = options.homeDir ?? homedir4();
     this.codexAuthHelper = options.codexAuthHelper ?? currentProcessCodexAuthHelper(options.configPath);
   }
   options;
@@ -4291,7 +5077,7 @@ var IntegrationManager = class {
   async plan(client, configPath = this.defaultConfigPath(client)) {
     const state = this.options.stateStore.load();
     const record = state.clients[client];
-    const target = record?.configPath ?? resolve3(configPath);
+    const target = record?.configPath ?? resolve4(configPath);
     const status = await this.statusFor(client, state, await this.options.keyDb.outboundApiKeysList());
     const changes = client === "codex" ? ["model_provider", "model_providers.omnicross", "model_providers.omnicross.auth"] : ["env.ANTHROPIC_BASE_URL", "env.ANTHROPIC_AUTH_TOKEN", "env.ANTHROPIC_API_KEY"];
     if (!record) {
@@ -4307,7 +5093,7 @@ var IntegrationManager = class {
     return { client, configPath: target, action: "repair", canApply: true, changes, warnings };
   }
   async install(client, configPath = this.defaultConfigPath(client)) {
-    const target = resolve3(configPath);
+    const target = resolve4(configPath);
     const state = this.options.stateStore.load();
     const previousState = cloneState(state);
     const existingRecord = state.clients[client];
@@ -4514,6 +5300,33 @@ var IntegrationManager = class {
     }
     return details.secret;
   }
+  /**
+   * Resolve ONE access key's plaintext by id — the `--key-id` variant the
+   * command-auth helper serves for key-scoped Codex launches (each terminal
+   * picks its own gateway key, so concurrent sessions can route to different
+   * upstreams through their keys' bindings). Enforces the SAME usability
+   * contract as the client-bound path: existing, enabled, not revoked,
+   * revealable, and holding the codex-required endpoint permissions.
+   */
+  async getKeyToken(keyId) {
+    const rows = await this.options.keyDb.outboundApiKeysList();
+    const row = rows.find((candidate) => candidate.id === keyId);
+    if (!row) {
+      throw new IntegrationConflictError(`access key '${keyId}' does not exist`);
+    }
+    const secret = await this.options.keyDb.outboundApiKeysReveal(keyId);
+    if (!row.enabled || row.revokedAt !== null || !secret) {
+      throw new IntegrationConflictError(
+        `access key '${keyId}' is disabled, revoked, or not revealable`
+      );
+    }
+    if (!hasRequiredPermissions(row, "codex")) {
+      throw new IntegrationConflictError(
+        `access key '${keyId}' lacks the responses+images endpoint permissions Codex requires`
+      );
+    }
+    return secret;
+  }
   /** Compatibility alias for callers predating per-client bindings. */
   async getGatewayToken(client = "codex") {
     return this.getIntegrationToken(client);
@@ -4654,7 +5467,7 @@ var IntegrationManager = class {
     }
   }
   defaultConfigPath(client) {
-    return client === "codex" ? join3(this.homeDir, ".codex", "config.toml") : join3(this.homeDir, ".claude", "settings.json");
+    return client === "codex" ? join4(this.homeDir, ".codex", "config.toml") : join4(this.homeDir, ".claude", "settings.json");
   }
   renderInstalled(client, base, secret) {
     if (client === "claude") {
@@ -4697,7 +5510,7 @@ function cloneState(state) {
   };
 }
 function readOptional(path2) {
-  return existsSync5(path2) ? readFileSync5(path2, "utf8") : null;
+  return existsSync6(path2) ? readFileSync5(path2, "utf8") : null;
 }
 function sha256(value) {
   return createHash("sha256").update(value, "utf8").digest("hex");
@@ -4757,7 +5570,7 @@ function writeOptional(path2, content) {
     atomicWrite(path2, content);
     return;
   }
-  if (existsSync5(path2)) unlinkSync3(path2);
+  if (existsSync6(path2)) unlinkSync3(path2);
 }
 async function bestEffortRevoke(db, keyId) {
   try {
@@ -5074,7 +5887,7 @@ import { SUBSCRIPTION_MODEL_CATALOG } from "@omnicross/contracts/subscription-mo
 import { ANTIGRAVITY_CODE_ASSIST_ENDPOINT as ANTIGRAVITY_CODE_ASSIST_ENDPOINT2 } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
 import { fetchUpstream as fetchUpstream9 } from "@omnicross/core/pipeline/upstreamFetch";
 import { getAntigravityUserAgent as getAntigravityUserAgent2 } from "@omnicross/core/transformer/transformers/antigravityIdentity";
-function isRecord6(value) {
+function isRecord8(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function optionalString(value) {
@@ -5087,13 +5900,13 @@ function optionalBoolean(value) {
   return typeof value === "boolean" ? value : void 0;
 }
 function parseAntigravityAvailableModels(payload) {
-  if (!isRecord6(payload)) return [];
+  if (!isRecord8(payload)) return [];
   const models = payload["models"];
-  if (!isRecord6(models)) return [];
+  if (!isRecord8(models)) return [];
   const out = [];
   for (const [id, raw] of Object.entries(models)) {
     if (ANTIGRAVITY_DISCOVERY_DENYLIST.has(id)) continue;
-    if (!isRecord6(raw)) continue;
+    if (!isRecord8(raw)) continue;
     if (raw["isInternal"] === true) continue;
     out.push({
       id,
@@ -5154,7 +5967,7 @@ async function fetchAntigravityAvailableModels(accessToken, fetchImpl = (url, in
   }
   if (!response.ok) return null;
   const payload = await response.json().catch(() => null);
-  if (!isRecord6(payload) || !isRecord6(payload["models"])) return null;
+  if (!isRecord8(payload) || !isRecord8(payload["models"])) return null;
   return parseAntigravityAvailableModels(payload);
 }
 async function handleAntigravityModelsRoute(deps) {
@@ -5510,21 +6323,26 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 
 // src/admin/cliLaunch.ts
 import { exec, spawn } from "child_process";
-import { randomUUID as randomUUID2 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync6, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmodSync as chmodSync4, existsSync as existsSync7, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 import { createServer } from "net";
 import { tmpdir as tmpdir2 } from "os";
-import { delimiter, join as join4 } from "path";
+import { delimiter, join as join5 } from "path";
 import {
   buildChatCliLaunchConfig,
   buildClaudeCliLaunchConfig,
   buildCodexLaunchConfig,
-  buildGeminiCliLaunchConfig
+  buildGeminiCliLaunchConfig,
+  CODEX_PROXY_PROVIDER_NAME
 } from "@omnicross/cli-launcher";
 import {
   ROUTE_LEASE_REQUEST_SCHEMA,
   RouteLeaseError as RouteLeaseError2
 } from "@omnicross/core/provider-proxy";
+import {
+  candidateGatewayBindings,
+  effectiveOutboundPermissions as effectiveOutboundPermissions2
+} from "@omnicross/core/outbound-api";
 
 // src/routeLeaseRenewal.ts
 var TERMINAL_LEASE_TTL_SECONDS = 600;
@@ -5571,8 +6389,8 @@ function isLaunchCliId(id) {
 function probeDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = join4(seg, candidate);
-    if (existsSync6(full)) return full;
+    const full = join5(seg, candidate);
+    if (existsSync7(full)) return full;
   }
   return null;
 }
@@ -5605,6 +6423,75 @@ function resolveLaunchTarget(providers, requested) {
 function firstModel(p) {
   return p.models?.[0] ?? p.modelConfigs?.[0]?.id;
 }
+var CMD_METACHAR_RE = /[&|<>^%]/;
+var KEY_SCOPED_CODEX_PERMISSIONS = ["responses", "images"];
+function buildKeyScopedCodexArgs(input) {
+  let root = input.gatewayBaseUrl;
+  while (root.endsWith("/")) root = root.slice(0, -1);
+  const name = CODEX_PROXY_PROVIDER_NAME;
+  const helperArgs = [...input.authHelper.args, "--key-id", input.keyId];
+  return [
+    "-c",
+    `model_provider="${name}"`,
+    "-c",
+    `model_providers.${name}.name="OmniCross Local Gateway"`,
+    "-c",
+    `model_providers.${name}.base_url="${root}/v1"`,
+    "-c",
+    `model_providers.${name}.wire_api="responses"`,
+    "-c",
+    `model_providers.${name}.supports_websockets=false`,
+    "-c",
+    `model_providers.${name}.http_headers={"X-OpenAI-Actor-Authorization"="omnicross"}`,
+    "-c",
+    `model_providers.${name}.auth.command=${JSON.stringify(input.authHelper.command)}`,
+    "-c",
+    `model_providers.${name}.auth.args=${JSON.stringify(helperArgs)}`,
+    "-c",
+    `model_providers.${name}.auth.refresh_interval_ms=0`,
+    "-c",
+    `model_providers.${name}.auth.timeout_ms=5000`,
+    "-c",
+    "disable_response_storage=true"
+  ];
+}
+async function preflightKeyScopedLaunch(deps, keyId) {
+  if (!deps.gatewayRunning) {
+    return {
+      ok: false,
+      status: 409,
+      message: "the outbound gateway is not running \u2014 key-scoped launches route through it"
+    };
+  }
+  const rows = await deps.keyDb.outboundApiKeysList();
+  const row = rows.find((candidate) => candidate.id === keyId);
+  if (!row) return { ok: false, status: 404, message: `access key '${keyId}' does not exist` };
+  if (!row.enabled || row.revokedAt !== null) {
+    return { ok: false, status: 400, message: `access key '${row.name}' is disabled or revoked` };
+  }
+  const secret = await deps.keyDb.outboundApiKeysReveal(keyId);
+  if (!secret) {
+    return { ok: false, status: 400, message: `access key '${row.name}' is not revealable` };
+  }
+  const allowed = effectiveOutboundPermissions2(row.allowedEndpoints);
+  for (const permission of KEY_SCOPED_CODEX_PERMISSIONS) {
+    if (!allowed.includes(permission)) {
+      return {
+        ok: false,
+        status: 400,
+        message: `access key '${row.name}' lacks the '${permission}' endpoint permission Codex requires`
+      };
+    }
+  }
+  if (candidateGatewayBindings(deps.bindings, keyId, "responses").length === 0) {
+    return {
+      ok: false,
+      status: 400,
+      message: `access key '${row.name}' has no enabled responses route \u2014 bind it to a downstream route on the API Service page first`
+    };
+  }
+  return { ok: true, keyName: row.name };
+}
 async function buildLaunchEnv(cli, llmConfig, target) {
   const common = {
     llmConfig,
@@ -5676,10 +6563,10 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
   const runLine = [command, ...extraArgs].map(shq).join(" ");
   const script = `${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
   if (platform === "darwin") {
-    const launchDir = mkdtempSync(join4(tmpdir2(), "omnicross-terminal-"));
-    const commandFile = join4(launchDir, "launch.command");
-    const bootstrapFile = join4(launchDir, "bootstrap.cjs");
-    const socketPath = macIpc.socketPath ?? join4(launchDir, "descriptor.sock");
+    const launchDir = mkdtempSync(join5(tmpdir2(), "omnicross-terminal-"));
+    const commandFile = join5(launchDir, "launch.command");
+    const bootstrapFile = join5(launchDir, "bootstrap.cjs");
+    const socketPath = macIpc.socketPath ?? join5(launchDir, "descriptor.sock");
     const openerEnv = { ...process.env };
     for (const key of Object.keys(env)) delete openerEnv[key];
     let claimed = false;
@@ -5808,10 +6695,10 @@ function resetCliSessions() {
 function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
-var defaultCommandRunner = (command) => new Promise((resolve10) => {
+var defaultCommandRunner = (command) => new Promise((resolve11) => {
   exec(command, { timeout: 18e4 }, (err9, _stdout, stderr) => {
-    if (err9) resolve10({ ok: false, error: stderr.trim() || err9.message });
-    else resolve10({ ok: true });
+    if (err9) resolve11({ ok: false, error: stderr.trim() || err9.message });
+    else resolve11({ ok: true });
   });
 });
 async function handleCliInstall(cli, runner = defaultCommandRunner) {
@@ -5850,44 +6737,84 @@ async function handleCliLaunch(cli, body, ctx) {
   if (!isCliInstalled(meta.command, platform, probe)) {
     return { status: 400, body: errBody(`"${meta.command}" is not installed (not found on PATH)`) };
   }
+  const keyId = typeof body["keyId"] === "string" && body["keyId"].trim() ? body["keyId"].trim() : void 0;
   let target;
-  try {
-    target = resolveLaunchTarget(ctx.providers, {
-      providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
-      model: typeof body["model"] === "string" ? body["model"] : void 0
-    });
-  } catch (err9) {
-    return { status: 400, body: errBody(err9 instanceof Error ? err9.message : "no launch target") };
-  }
-  const id = randomUUID2();
+  let keyLaunch;
+  const id = randomUUID3();
   let leaseId2;
   let launch;
-  try {
-    if ((cli === "claude" || cli === "codex") && ctx.routeLeaseManager) {
-      const outcome = await ctx.routeLeaseManager.createFromRequest({
-        schemaVersion: ROUTE_LEASE_REQUEST_SCHEMA,
-        consumer: "omnicross-terminal",
-        runtime: cli,
-        upstream: { kind: "provider", providerId: target.providerId },
-        model: target.model,
-        execution: { sessionId: id }
-      }, `omnicross-terminal:${id}`);
-      leaseId2 = outcome.result.leaseId;
-      const stopRenewal = startTerminalLeaseRenewal(ctx.routeLeaseManager, leaseId2);
-      launch = {
-        env: outcome.result.launch.env,
-        extraArgs: outcome.result.launch.extraArgs,
-        onSessionEnd: () => {
-          stopRenewal();
-          ctx.routeLeaseManager?.release(outcome.result.leaseId);
-        }
-      };
-    } else {
-      launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
+  if (keyId) {
+    if (cli !== "codex") {
+      return { status: 400, body: errBody("key-scoped launch is only supported for codex") };
+    }
+    const deps = ctx.keyScoped;
+    if (!deps) {
+      return { status: 501, body: errBody("key-scoped launch is not available in this build") };
+    }
+    const preflight = await preflightKeyScopedLaunch(deps, keyId);
+    if (!preflight.ok) return { status: preflight.status, body: errBody(preflight.message) };
+    if (platform === "win32") {
+      const unsafe = [deps.codexAuthHelper.command, ...deps.codexAuthHelper.args].filter((value) => CMD_METACHAR_RE.test(value));
+      if (unsafe.length > 0) {
+        return {
+          status: 400,
+          body: errBody(
+            "the Codex auth-helper path contains cmd.exe metacharacters and cannot be passed through a Windows terminal launch"
+          )
+        };
+      }
+    }
+    keyLaunch = { keyId, keyName: preflight.keyName };
+    launch = {
+      env: {},
+      extraArgs: buildKeyScopedCodexArgs({
+        gatewayBaseUrl: deps.gatewayBaseUrl,
+        authHelper: deps.codexAuthHelper,
+        keyId
+      }),
+      // No route or lease exists to release — the gateway key outlives the
+      // terminal and its bindings route every request.
+      onSessionEnd: () => {
+      }
+    };
+  } else {
+    let resolved;
+    try {
+      resolved = resolveLaunchTarget(ctx.providers, {
+        providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
+        model: typeof body["model"] === "string" ? body["model"] : void 0
+      });
+    } catch (err9) {
+      return { status: 400, body: errBody(err9 instanceof Error ? err9.message : "no launch target") };
+    }
+    target = resolved;
+    try {
+      if ((cli === "claude" || cli === "codex") && ctx.routeLeaseManager) {
+        const outcome = await ctx.routeLeaseManager.createFromRequest({
+          schemaVersion: ROUTE_LEASE_REQUEST_SCHEMA,
+          consumer: "omnicross-terminal",
+          runtime: cli,
+          upstream: { kind: "provider", providerId: resolved.providerId },
+          model: resolved.model,
+          execution: { sessionId: id }
+        }, `omnicross-terminal:${id}`);
+        leaseId2 = outcome.result.leaseId;
+        const stopRenewal = startTerminalLeaseRenewal(ctx.routeLeaseManager, leaseId2);
+        launch = {
+          env: outcome.result.launch.env,
+          extraArgs: outcome.result.launch.extraArgs,
+          onSessionEnd: () => {
+            stopRenewal();
+            ctx.routeLeaseManager?.release(outcome.result.leaseId);
+          }
+        };
+      } else {
+        launch = await buildLaunchEnv(cli, ctx.llmConfig, resolved);
+      }
+    } catch (err9) {
+      const status = err9 instanceof RouteLeaseError2 ? err9.status : 400;
+      return { status, body: errBody(err9 instanceof Error ? err9.message : "failed to build launch env") };
     }
-  } catch (err9) {
-    const status = err9 instanceof RouteLeaseError2 ? err9.status : 400;
-    return { status, body: errBody(err9 instanceof Error ? err9.message : "failed to build launch env") };
   }
   const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
   const opener = ctx.opener ?? defaultTerminalOpener;
@@ -5926,15 +6853,19 @@ async function handleCliLaunch(cli, body, ctx) {
   sessions.set(id, {
     id,
     cli,
-    providerId: target.providerId,
-    model: target.model,
+    providerId: target?.providerId ?? "",
+    model: target?.model ?? "",
+    ...keyLaunch ? { keyId: keyLaunch.keyId, keyName: keyLaunch.keyName } : {},
     ...leaseId2 ? { leaseId: leaseId2 } : {},
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     onSessionEnd
   });
   published = true;
   if (ended) sessions.delete(id);
-  return { status: 200, body: { sessionId: id, providerId: target.providerId, model: target.model } };
+  return {
+    status: 200,
+    body: keyLaunch ? { sessionId: id, keyId: keyLaunch.keyId, keyName: keyLaunch.keyName } : { sessionId: id, providerId: target?.providerId, model: target?.model }
+  };
 }
 
 // src/admin/auditConfigBody.ts
@@ -6254,17 +7185,17 @@ function sanitizeResultField(value, cap) {
   const text = typeof value === "string" ? value : value === null || value === void 0 ? "" : String(value);
   return text.replace(/[\u0000-\u001f\u007f]/gu, "").slice(0, cap);
 }
-function writeJson(res, status, body) {
+function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeErr(res, status, message) {
-  writeJson(res, status, { error: { type: "admin_api_error", message } });
+  writeJson2(res, status, { error: { type: "admin_api_error", message } });
 }
 var SEARCH_MAX_BODY_BYTES = 64 * 1024;
 var SearchBodyTooLargeError = class extends Error {
 };
-async function readJsonBody2(req) {
+async function readJsonBody3(req) {
   const chunks = [];
   let bytes = 0;
   for await (const chunk of req) {
@@ -6284,7 +7215,7 @@ async function readJsonBody2(req) {
 }
 async function readBodyOrReject(req, res) {
   try {
-    return await readJsonBody2(req);
+    return await readJsonBody3(req);
   } catch (error) {
     if (error instanceof SearchBodyTooLargeError) {
       writeErr(res, 400, error.message);
@@ -6342,7 +7273,7 @@ async function handleSearchDiagnostics(res, deps) {
     },
     applySemantics: { codex: "immediate", rest: "restart" }
   };
-  return writeJson(res, 200, { diagnostics: snapshot });
+  return writeJson2(res, 200, { diagnostics: snapshot });
 }
 function persistedSearchContributions(search, fetchImpl) {
   if (fetchImpl) {
@@ -6388,11 +7319,11 @@ async function handleSearchTest(req, res, deps) {
       checkedAt
     );
     const response = { diagnostic, resultCount: results.length };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   } catch (error) {
     const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   }
 }
 async function handleSearchQuery(req, res, deps) {
@@ -6455,18 +7386,18 @@ async function handleSearchQuery(req, res, deps) {
       resultCount: sanitized.length,
       results: sanitized
     };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   } catch (error) {
     const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
-    return writeJson(res, 200, { result: response });
+    return writeJson2(res, 200, { result: response });
   }
 }
 
 // src/admin/searchAdminView.ts
 var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
 var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
-function isRecord7(value) {
+function isRecord9(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function redactSearchServerConfig(search) {
@@ -6516,13 +7447,13 @@ function resolveSecretField(entry, field, stored) {
   else delete entry[field];
 }
 function preserveSearchSecrets(incoming, current) {
-  if (!isRecord7(incoming)) return incoming;
+  if (!isRecord9(incoming)) return incoming;
   const section = { ...incoming };
   const providersValue = section["providers"];
-  if (!isRecord7(providersValue)) return section;
+  if (!isRecord9(providersValue)) return section;
   const providers = {};
   for (const [id, entryValue] of Object.entries(providersValue)) {
-    if (!isRecord7(entryValue)) {
+    if (!isRecord9(entryValue)) {
       providers[id] = entryValue;
       continue;
     }
@@ -6600,7 +7531,8 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord8(value) {
+var EFFORT_MAX_LENGTH = 32;
+function isRecord10(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -6620,7 +7552,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord8(entry)) {
+    if (!isRecord10(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -6649,12 +7581,18 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord8(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord10(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
+      } else if (entry.modelMappings.some(
+        (mapping) => mapping.effort !== void 0 && (typeof mapping.effort !== "string" || mapping.effort.trim() === "" || mapping.effort.trim().length > EFFORT_MAX_LENGTH)
+      )) {
+        errors.push(
+          `${path2}.modelMappings effort must be a non-empty string of at most ${EFFORT_MAX_LENGTH} characters`
+        );
       }
     }
-    if (!isRecord8(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord10(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -6669,7 +7607,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord8(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord10(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -6695,23 +7633,23 @@ import {
   toVoucherInfo,
   voucherCodePrefix
 } from "@omnicross/core/outbound-api";
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeErr2(res, status, message) {
-  writeJson2(res, status, { error: { type: "voucher_error", message } });
+  writeJson3(res, status, { error: { type: "voucher_error", message } });
 }
-function readJsonBody3(req) {
-  return new Promise((resolve10, reject) => {
+function readJsonBody4(req) {
+  return new Promise((resolve11, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
-      if (!raw.trim()) return resolve10({});
+      if (!raw.trim()) return resolve11({});
       try {
         const parsed = JSON.parse(raw);
-        resolve10(parsed && typeof parsed === "object" ? parsed : {});
+        resolve11(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
         reject(new Error("invalid-json"));
       }
@@ -6761,13 +7699,13 @@ async function handleVoucher(req, res, method, rest, deps) {
   if (!voucherDb) return writeErr2(res, 501, "Voucher feature is not available");
   if (method === "GET" && rest.length === 0) {
     const rows = await voucherDb.voucherList();
-    return writeJson2(res, 200, { vouchers: rows.map(toVoucherInfo) });
+    return writeJson3(res, 200, { vouchers: rows.map(toVoucherInfo) });
   }
   if (method === "POST" && rest.length === 0) {
     if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     let body;
     try {
-      body = await readJsonBody3(req);
+      body = await readJsonBody4(req);
     } catch {
       return writeErr2(res, 400, "Invalid JSON in request body");
     }
@@ -6780,7 +7718,7 @@ async function handleVoucher(req, res, method, rest, deps) {
       codePrefix: voucherCodePrefix(code),
       ...parsed.input
     });
-    return writeJson2(res, 201, {
+    return writeJson3(res, 201, {
       id: created.id,
       codePrefix: created.codePrefix,
       type: created.type,
@@ -6793,7 +7731,7 @@ async function handleVoucher(req, res, method, rest, deps) {
   if (method === "POST" && id && rest[1] === "revoke") {
     if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     const ok = await voucherDb.voucherRevokeCas(id, Date.now());
-    return writeJson2(res, ok ? 200 : 409, { ok });
+    return writeJson3(res, ok ? 200 : 409, { ok });
   }
   return writeErr2(res, 405, `method ${method} not allowed on voucher`);
 }
@@ -6970,7 +7908,7 @@ import {
 } from "@omnicross/core/outbound-api";
 
 // src/ports/account-multi.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var PROVIDER_KEYS = {
   claude: { block: "claude", accounts: "claudeAccounts", active: "activeClaudeAccountId" },
   codex: { block: "codex", accounts: "codexAccounts", active: "activeCodexAccountId" },
@@ -7044,7 +7982,7 @@ function migrateLazily(config) {
 }
 function addAccount(config, p, tokens, label) {
   const accounts = [...getAccounts(config, p)];
-  const id = randomUUID3();
+  const id = randomUUID4();
   accounts.push({
     id,
     label: label ?? `Account ${accounts.length + 1}`,
@@ -7733,22 +8671,22 @@ async function handlePricingResolveConflicts(body, deps) {
 }
 
 // src/admin/accountAllowanceApi.ts
-function writeJson3(res, status, body) {
+function writeJson4(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeError2(res, status, message) {
-  writeJson3(res, status, { error: { type: "account_allowance_error", message } });
+  writeJson4(res, status, { error: { type: "account_allowance_error", message } });
 }
 function readJson2(req) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
     req.on("end", () => {
       try {
         const text = Buffer.concat(chunks).toString("utf8");
         const parsed = text ? JSON.parse(text) : {};
-        resolve10(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
+        resolve11(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
       } catch (error) {
         reject(error);
       }
@@ -7771,7 +8709,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (!service.getSchedulingStatus) {
       return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
-    return writeJson3(res, 200, { scheduling: service.getSchedulingStatus() });
+    return writeJson4(res, 200, { scheduling: service.getSchedulingStatus() });
   }
   if (method === "GET") {
     const params = query(req);
@@ -7782,7 +8720,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     }
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
-    return writeJson3(res, 200, { allowances });
+    return writeJson4(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
     const body = await readJson2(req);
@@ -7798,7 +8736,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Codex account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "kimi") {
       if (!service.refreshKimi) {
@@ -7808,7 +8746,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Kimi account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "opencodego") {
       if (!service.refreshOpenCodeGo) {
@@ -7818,7 +8756,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `OpenCodeGo account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "copilot") {
       if (!service.refreshCopilot) {
@@ -7828,7 +8766,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Copilot account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "grok") {
       if (!service.refreshGrok) {
@@ -7838,7 +8776,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Grok account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "antigravity") {
       if (!service.refreshAntigravity) {
@@ -7848,7 +8786,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Antigravity account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     if (requestedProvider === "gemini") {
       if (!service.refreshGemini) {
@@ -7858,13 +8796,13 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       if (accountId && allowances2.length === 0) {
         return writeError2(res, 404, `Gemini account '${accountId}' not found`);
       }
-      return writeJson3(res, 200, { allowances: allowances2 });
+      return writeJson4(res, 200, { allowances: allowances2 });
     }
     const allowances = await service.refreshClaude(accountId);
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
-    return writeJson3(res, 200, { allowances });
+    return writeJson4(res, 200, { allowances });
   }
   return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
@@ -7876,14 +8814,14 @@ import {
 } from "@omnicross/core/pipeline/AccountRouteActivity";
 import { getSharedOverloadCounter } from "@omnicross/core/pipeline/ServerOverloadCounter";
 function readBody(req) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve10(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve11(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
-async function readJsonBody4(req) {
+async function readJsonBody5(req) {
   const raw = await readBody(req);
   if (!raw.trim()) return {};
   try {
@@ -7893,12 +8831,12 @@ async function readJsonBody4(req) {
     return {};
   }
 }
-function writeJson4(res, status, body) {
+function writeJson5(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeJsonError(res, status, message) {
-  writeJson4(res, status, { error: { type: "admin_api_error", message } });
+function writeJsonError2(res, status, message) {
+  writeJson5(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -7919,7 +8857,7 @@ function toKeyInfo(row) {
     lastUsedAt: row.lastUsedAt,
     revoked: row.revokedAt !== null,
     kind: row.kind,
-    allowedEndpoints: [...effectiveOutboundPermissions2(row.allowedEndpoints)],
+    allowedEndpoints: [...effectiveOutboundPermissions3(row.allowedEndpoints)],
     legacyPermissions: row.allowedEndpoints === void 0,
     loopbackOnly: row.loopbackOnly,
     maxConcurrency: row.maxConcurrency,
@@ -7937,7 +8875,12 @@ function toKeyInfo(row) {
     // Per-key model restriction (#6) — secret-free scalars the UI pre-fills.
     enableModelRestriction: row.enableModelRestriction,
     restrictionMode: row.restrictionMode,
-    restrictedModels: row.restrictedModels
+    restrictedModels: row.restrictedModels,
+    // Direct upstream passthrough target (key→upstream binding) — references
+    // only, never a credential. Absent = the key is served by the downstream
+    // routes. `boundUpstreamProviderId` is the legacy first-cut shape.
+    boundUpstream: row.boundUpstream,
+    boundUpstreamProviderId: row.boundUpstreamProviderId
   };
 }
 function toProviderView(row) {
@@ -8031,10 +8974,10 @@ async function handleAdminApi(req, res, path2, deps) {
       case "pricing":
         return await handlePricing(req, res, method, rest, deps);
       default:
-        return writeJsonError(res, 404, `unknown admin resource '${resource}'`);
+        return writeJsonError2(res, 404, `unknown admin resource '${resource}'`);
     }
   } catch (err9) {
-    writeJsonError(res, 500, err9 instanceof Error ? err9.message : String(err9));
+    writeJsonError2(res, 500, err9 instanceof Error ? err9.message : String(err9));
   }
 }
 function requestQuery(req) {
@@ -8043,35 +8986,35 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson4(res, result.status, result.body);
+  writeJson5(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on usage`);
   return writeResult(res, await handleUsageGet(rest[0], requestQuery(req), deps));
 }
 async function handleDashboardRoute(res, method, deps) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson4(res, result.status, result.body);
+  return writeJson5(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
     if (method === "GET") return writeResult(res, await handlePricingList(deps));
     if (method === "PUT") {
-      return writeResult(res, await handlePricingUpsert(await readJsonBody4(req), deps));
+      return writeResult(res, await handlePricingUpsert(await readJsonBody5(req), deps));
     }
     if (method === "DELETE") {
       return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
     }
-    return writeJsonError(res, 405, `method ${method} not allowed on pricing`);
+    return writeJsonError2(res, 405, `method ${method} not allowed on pricing`);
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "fetch-latest") {
     return writeResult(res, await handlePricingFetchLatest(deps));
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
-    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody4(req), deps));
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody5(req), deps));
   }
-  return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
+  return writeJsonError2(res, 404, `unknown pricing route '${rest.join("/")}'`);
 }
 function migrationDeps(deps) {
   return {
@@ -8082,16 +9025,16 @@ function migrationDeps(deps) {
   };
 }
 async function handleMigrationExport(req, res, method, deps) {
-  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
-  const body = await readJsonBody4(req);
+  if (method !== "POST") return writeJsonError2(res, 405, `method ${method} not allowed on export`);
+  const body = await readJsonBody5(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson4(res, result.status, result.body);
+  return writeJson5(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
-  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
-  const body = await readJsonBody4(req);
+  if (method !== "POST") return writeJsonError2(res, 405, `method ${method} not allowed on import`);
+  const body = await readJsonBody5(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson4(res, result.status, result.body);
+  return writeJson5(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -8124,52 +9067,52 @@ async function handleProviders(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
-    if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson4(res, 200, { apiKey: row.apiKey ?? "" });
+    if (!row) return writeJsonError2(res, 404, `provider '${rest[0]}' not found`);
+    return writeJson5(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson4(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson5(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const provider = parseProviderInput(body, void 0);
-    if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
+    if (!provider) return writeJsonError2(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
     if (cfg.providers.some((p) => p.id === provider.id)) {
-      return writeJsonError(res, 409, `provider '${provider.id}' already exists`);
+      return writeJsonError2(res, 409, `provider '${provider.id}' already exists`);
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson4(res, 201, { provider: toProviderView(provider) });
+    return writeJson5(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   if (method === "PUT") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const existing = cfg.providers[idx];
     const updated = parseProviderInput(body, existing);
-    if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
+    if (!updated) return writeJsonError2(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson4(res, 200, { provider: toProviderView(updated) });
+    return writeJson5(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson4(res, 200, { ok: true });
+    return writeJson5(res, 200, { ok: true });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on providers`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on providers`);
 }
 function persistProviders(cfg, deps) {
   saveConfig(deps.configPath, cfg);
   deps.llmConfig.reload(cfg);
 }
 async function handleProviderReorder(req, res, cfg, deps) {
-  const body = await readJsonBody4(req);
+  const body = await readJsonBody5(req);
   const rawOrder = body["order"];
   if (!Array.isArray(rawOrder)) {
-    return writeJsonError(res, 400, "reorder requires { order: string[] }");
+    return writeJsonError2(res, 400, "reorder requires { order: string[] }");
   }
   const order = rawOrder.filter((x) => typeof x === "string");
   const byId = new Map(cfg.providers.map((p) => [p.id, p]));
@@ -8190,17 +9133,17 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson4(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson5(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 function expandRowExtraHeaders(row) {
   return mergeExtraHeaders({}, row.extraHeaders);
 }
 async function handleDiscoverModels(res, id, cfg) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
   if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
-    return writeJson4(res, 200, { models: [], unsupportedFormat: true });
+    return writeJson5(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -8209,6 +9152,7 @@ async function handleDiscoverModels(res, id, cfg) {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
     Object.assign(headers, expandRowExtraHeaders(row));
+    applyAdminProbeIdentity(headers, row);
     const response = await fetchUpstream10(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
@@ -8218,32 +9162,32 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson4(res, 200, { models });
+    return writeJson5(res, 200, { models });
   } catch (err9) {
     const message = err9 instanceof Error ? err9.message : String(err9);
-    return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson5(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody4(req);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
+  const body = await readJsonBody5(req);
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
-  if (!model) return writeJsonError(res, 400, "test requires a { model } string");
+  if (!model) return writeJsonError2(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson4(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson5(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson4(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson5(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
   let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
@@ -8267,6 +9211,7 @@ async function handleTestModel(req, res, id, cfg) {
     };
   }
   Object.assign(headers, expandRowExtraHeaders(row));
+  applyAdminProbeIdentity(headers, row);
   const startedAt = Date.now();
   try {
     const response = await fetchUpstream10(
@@ -8283,9 +9228,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson4(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson5(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -8293,7 +9238,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err9) {
     const message = err9 instanceof Error ? err9.message : String(err9);
-    return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson5(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -8330,9 +9275,9 @@ function toPoolKeyView(row, cooldown, deps) {
   });
 }
 async function handleProviderKeys(res, id, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
   const views = toPoolKeyView(row, cooldown, deps);
   if (deps.providerKeyQuota) {
@@ -8344,19 +9289,19 @@ async function handleProviderKeys(res, id, cfg, deps) {
       if (settled.status === "fulfilled" && settled.value) view.quota = settled.value;
     });
   }
-  return writeJson4(res, 200, { keys: views });
+  return writeJson5(res, 200, { keys: views });
 }
 async function handleProviderKeyQuotaRefresh(res, id, keyId, cfg, deps) {
-  if (!deps.providerKeyQuota) return writeJsonError(res, 501, "provider key quota is not available");
-  if (!id || !keyId) return writeJsonError(res, 400, "provider id and key id required in path");
+  if (!deps.providerKeyQuota) return writeJsonError2(res, 501, "provider key quota is not available");
+  if (!id || !keyId) return writeJsonError2(res, 400, "provider id and key id required in path");
   const row = cfg.providers.find((p) => p.id === id);
-  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (!row) return writeJsonError2(res, 404, `provider '${id}' not found`);
   try {
     const quota = await deps.providerKeyQuota.quotaFor(row, keyId, { force: true });
-    if (!quota) return writeJsonError(res, 404, `no quota endpoint for key '${keyId}'`);
-    return writeJson4(res, 200, { quota });
+    if (!quota) return writeJsonError2(res, 404, `no quota endpoint for key '${keyId}'`);
+    return writeJson5(res, 200, { quota });
   } catch {
-    return writeJsonError(res, 502, "quota refresh failed");
+    return writeJsonError2(res, 502, "quota refresh failed");
   }
 }
 function parsePoolKeyInput(body, existing) {
@@ -8373,12 +9318,12 @@ function parsePoolKeyInput(body, existing) {
   return out;
 }
 async function handleAddProviderKey(req, res, id, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody4(req);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
+  const body = await readJsonBody5(req);
   const parsed = parsePoolKeyInput(body);
-  if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
+  if (!parsed.apiKey) return writeJsonError2(res, 400, "add requires a non-empty apiKey");
   const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
   const entry = { id: keyId, apiKey: parsed.apiKey };
   if (parsed.label !== void 0) entry.label = parsed.label;
@@ -8388,17 +9333,17 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
-  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError2(res, 400, "key id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
-  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody4(req);
+  if (keyIdx < 0) return writeJsonError2(res, 404, `pool key '${keyId}' not found`);
+  const body = await readJsonBody5(req);
   const existing = row.apiKeys[keyIdx];
   const parsed = parsePoolKeyInput(body, existing);
   const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
@@ -8408,35 +9353,35 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
-  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError2(res, 400, "key id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
-  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
+  if (keyIdx < 0) return writeJsonError2(res, 404, `pool key '${keyId}' not found`);
   row.apiKeys.splice(keyIdx, 1);
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
-  if (!id) return writeJsonError(res, 400, "provider id required in path");
-  if (!keyId) return writeJsonError(res, 400, "key id required in path");
+  if (!id) return writeJsonError2(res, 400, "provider id required in path");
+  if (!keyId) return writeJsonError2(res, 400, "key id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
-  if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
+  if (idx < 0) return writeJsonError2(res, 404, `provider '${id}' not found`);
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
-  if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody4(req);
+  if (keyIdx < 0) return writeJsonError2(res, 404, `pool key '${keyId}' not found`);
+  const body = await readJsonBody5(req);
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson5(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -8608,7 +9553,7 @@ function parseProviderInput(body, existing) {
   };
 }
 function handlePresets(res, method) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on presets`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on presets`);
   const { mappable, excluded } = listMappablePresets();
   const presets = mappable.map((p) => ({
     id: p.id,
@@ -8627,13 +9572,13 @@ function handlePresets(res, method) {
     // row (the write gateway re-validates via the shared allowlist).
     extraHeaders: p.extraHeaders
   }));
-  return writeJson4(res, 200, { presets, excluded });
+  return writeJson5(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson4(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson5(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -8645,13 +9590,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson4(res, 200, { keys });
+    return writeJson5(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
     const created = await createNamedKey(deps.keyDb, name);
-    return writeJson4(res, 201, {
+    return writeJson5(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -8662,10 +9607,10 @@ async function handleKeys(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal") {
     const revealed = await deps.keyDb.outboundApiKeysReveal(rest[0]);
-    if (revealed !== null) return writeJson4(res, 200, { key: revealed });
+    if (revealed !== null) return writeJson5(res, 200, { key: revealed });
     const exists = (await deps.keyDb.outboundApiKeysList()).some((r) => r.id === rest[0]);
-    if (!exists) return writeJsonError(res, 404, `key '${rest[0]}' not found`);
-    return writeJsonError(
+    if (!exists) return writeJsonError2(res, 404, `key '${rest[0]}' not found`);
+    return writeJsonError2(
       res,
       409,
       `key '${rest[0]}' is not revealable (created before revealable key storage)`
@@ -8675,55 +9620,55 @@ async function handleKeys(req, res, method, rest, deps) {
   const action = rest[1];
   if (method === "POST" && id && action === "revoke") {
     const bound = await integrationKeyRequirement(deps, id);
-    if (bound) return writeJsonError(res, 409, bound);
+    if (bound) return writeJsonError2(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson4(res, ok ? 200 : 404, { ok });
+    return writeJson5(res, ok ? 200 : 404, { ok });
   }
   if (method === "DELETE" && id && !action) {
     const bound = await integrationKeyRequirement(deps, id);
-    if (bound) return writeJsonError(res, 409, bound);
+    if (bound) return writeJsonError2(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysDelete(id);
-    return writeJson4(res, ok ? 200 : 404, { ok });
+    return writeJson5(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const enabled = body["enabled"] === true;
     if (!enabled) {
       const bound = await integrationKeyRequirement(deps, id);
-      if (bound) return writeJsonError(res, 409, bound);
+      if (bound) return writeJsonError2(res, 409, bound);
     }
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson4(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson5(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "permissions") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "permissions")) {
-      return writeJsonError(res, 400, "body must contain only permissions");
+      return writeJsonError2(res, 400, "body must contain only permissions");
     }
     let permissions;
     try {
       permissions = validateOutboundPermissions(body["permissions"]);
     } catch {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         400,
         "permissions must be an array of unique chat, responses, messages, gemini, or images values"
       );
     }
     const before = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-    if (!before) return writeJson4(res, 404, { ok: false });
-    if (before.revokedAt !== null) return writeJson4(res, 409, { ok: false });
+    if (!before) return writeJson5(res, 404, { ok: false });
+    if (before.revokedAt !== null) return writeJson5(res, 409, { ok: false });
     const required = await integrationKeyRequirement(deps, id, permissions);
-    if (required) return writeJsonError(res, 409, required);
+    if (required) return writeJsonError2(res, 409, required);
     const ok = await deps.keyDb.outboundApiKeysSetPermissions(id, permissions);
     if (!ok) {
       const current = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-      return writeJson4(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
+      return writeJson5(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
     }
-    return writeJson4(res, 200, { ok: true, allowedEndpoints: permissions });
+    return writeJson5(res, 200, { ok: true, allowedEndpoints: permissions });
   }
   if (method === "POST" && id && action === "max-concurrency") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const raw = body["maxConcurrency"];
     let value;
     if (raw === null) {
@@ -8731,23 +9676,73 @@ async function handleKeys(req, res, method, rest, deps) {
     } else if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 1e3) {
       value = raw;
     } else {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         400,
         "maxConcurrency must be an integer 1..1000 or null"
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson4(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson5(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+  }
+  if (method === "POST" && id && action === "upstream") {
+    const body = await readJsonBody5(req);
+    let raw;
+    if (Object.prototype.hasOwnProperty.call(body, "target")) {
+      raw = body["target"];
+    } else if (Object.prototype.hasOwnProperty.call(body, "providerId")) {
+      const legacy = body["providerId"];
+      raw = legacy === null || legacy === void 0 ? null : { kind: "provider", providerId: legacy };
+    } else {
+      return writeJsonError2(res, 400, "body must contain target (or the legacy providerId)");
+    }
+    if (raw === null || raw === void 0) {
+      const ok2 = await deps.keyDb.outboundApiKeysSetUpstream(id, null);
+      return writeJson5(res, ok2 ? 200 : 404, { ok: ok2, target: null });
+    }
+    if (typeof raw !== "object" || Array.isArray(raw)) {
+      return writeJsonError2(res, 400, "target must be an object or null");
+    }
+    const t = raw;
+    const kind = t["kind"];
+    const providerId = typeof t["providerId"] === "string" ? t["providerId"].trim() : "";
+    if (!providerId) {
+      return writeJsonError2(res, 400, "target.providerId is required");
+    }
+    if (kind === "provider") {
+      const cfg = loadConfig(deps.configPath);
+      if (!cfg.providers.some((p) => p.id === providerId)) {
+        return writeJsonError2(res, 404, `provider '${providerId}' not found`);
+      }
+    } else if (kind === "account" || kind === "account-group" || kind === "account-pool") {
+      if (providerId !== "claude" && providerId !== "kimi") {
+        return writeJsonError2(
+          res,
+          400,
+          `subscription provider '${providerId}' cannot be direct-bound: its upstream wire differs from the client wire (translation required \u2014 use a downstream route); only claude and kimi subscriptions speak the same Anthropic Messages wire as the client`
+        );
+      }
+      if (kind === "account" && typeof t["accountId"] !== "string") {
+        return writeJsonError2(res, 400, "target.accountId is required for kind account");
+      }
+      if (kind === "account-group" && typeof t["group"] !== "string") {
+        return writeJsonError2(res, 400, "target.group is required for kind account-group");
+      }
+    } else {
+      return writeJsonError2(res, 400, "target.kind must be provider, account, account-group, or account-pool");
+    }
+    const target = raw;
+    const ok = await deps.keyDb.outboundApiKeysSetUpstream(id, target);
+    return writeJson5(res, ok ? 200 : 404, { ok, target });
   }
   if (method === "POST" && id && action === "policy") {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const parsed = parseKeyPolicyBody(body);
-    if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
+    if (!parsed.ok) return writeJsonError2(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson4(res, ok ? 200 : 404, { ok });
+    return writeJson5(res, ok ? 200 : 404, { ok });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on keys`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on keys`);
 }
 function validateQueueSegments(patch) {
   const errors = [];
@@ -8911,17 +9906,17 @@ async function handleServer(req, res, method, deps) {
         search: redactSearchServerConfig(config.search)
       };
     }
-    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(server) });
+    return writeJson5(res, 200, { server: projectImagesConfigForAdmin(server) });
   }
   if (method === "PUT") {
-    const patch = await readJsonBody4(req);
+    const patch = await readJsonBody5(req);
     const queueErrors = validateQueueSegments(patch);
     if (queueErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
     }
     const allowanceErrors = validateAllowanceSchedulingSegment(patch);
     if (allowanceErrors.length > 0) {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         400,
         `invalid allowance scheduling config: ${allowanceErrors.join("; ")}`
@@ -8929,19 +9924,19 @@ async function handleServer(req, res, method, deps) {
     }
     const bindingErrors = validateGatewayBindingsSegment(patch);
     if (bindingErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid gateway bindings: ${bindingErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid gateway bindings: ${bindingErrors.join("; ")}`);
     }
     const webhookErrors = validateWebhookSegment(patch);
     if (webhookErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
     }
     const auditErrors = validateAuditSegment(patch);
     if (auditErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid audit config: ${auditErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid audit config: ${auditErrors.join("; ")}`);
     }
     const billingErrors = validateBillingSegment(patch);
     if (billingErrors.length > 0) {
-      return writeJsonError(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
+      return writeJsonError2(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
     }
     const current = await loadServerConfig3(deps.settingsStore);
     let effectivePatch = patch;
@@ -8960,7 +9955,7 @@ async function handleServer(req, res, method, deps) {
         remoteResolverAvailable: deps.imageRemoteResolverAvailable
       });
       if (imageErrors.length > 0) {
-        return writeJsonError(res, 400, `invalid Images config: ${imageErrors.join("; ")}`);
+        return writeJsonError2(res, 400, `invalid Images config: ${imageErrors.join("; ")}`);
       }
       effectivePatch = { ...effectivePatch, images };
     }
@@ -8971,7 +9966,7 @@ async function handleServer(req, res, method, deps) {
       );
       const searchErrors = validateSearchServerConfig(searchPatch);
       if (searchErrors.length > 0) {
-        return writeJsonError(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
+        return writeJsonError2(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
       }
       effectivePatch = {
         ...effectivePatch,
@@ -9013,7 +10008,7 @@ async function handleServer(req, res, method, deps) {
       });
     } catch (error) {
       if (error instanceof ServerConfigTransactionError) {
-        return writeJsonError(res, 500, error.message);
+        return writeJsonError2(res, 500, error.message);
       }
       throw error;
     }
@@ -9034,24 +10029,27 @@ async function handleServer(req, res, method, deps) {
       ...merged,
       search: redactSearchServerConfig(merged.search)
     } : merged;
-    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
+    return writeJson5(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on server`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on server`);
 }
 async function handleAccounts(req, res, method, rest, deps) {
   if (rest[0] === "route-activity" && rest.length === 1) {
     if (method !== "GET") {
-      return writeJsonError(res, 405, `method ${method} not allowed on account route activity`);
+      return writeJsonError2(res, 405, `method ${method} not allowed on account route activity`);
     }
     const query2 = requestQuery(req);
     const parsedLimit = Number(query2.get("limit") ?? "100");
+    const kindParam = query2.get("credentialKind");
+    const credentialKind = kindParam === "subscription-account" || kindParam === "provider-key" ? kindParam : void 0;
     const records = getSharedAccountRouteActivity().list({
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0,
       sessionKey: query2.get("sessionKey") ?? void 0,
+      credentialKind,
       limit: Number.isFinite(parsedLimit) ? parsedLimit : 100
     });
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       available: true,
       records,
       capacity: ACCOUNT_ROUTE_ACTIVITY_LIMIT,
@@ -9060,14 +10058,14 @@ async function handleAccounts(req, res, method, rest, deps) {
   }
   if (rest[0] === "overload-counters" && rest.length === 1) {
     if (method !== "GET") {
-      return writeJsonError(res, 405, `method ${method} not allowed on overload counters`);
+      return writeJsonError2(res, 405, `method ${method} not allowed on overload counters`);
     }
     const query2 = requestQuery(req);
     const entries = getSharedOverloadCounter().list({
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0
     });
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       available: true,
       entries,
       collectedAt: Date.now()
@@ -9086,21 +10084,21 @@ async function handleAccounts(req, res, method, rest, deps) {
     const result = await handleAntigravityModelsRoute({
       resolveAntigravityAccessToken: deps.resolveAntigravityAccessToken ?? (async () => null)
     });
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 0) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson4(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson5(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const parsed = validateAccountBatchBody(body);
-    if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
+    if (!parsed) return writeJsonError2(res, 400, "invalid account batch request");
     const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
     if (!result.ok) {
-      return writeJsonError(
+      return writeJsonError2(
         res,
         404,
         `account '${result.missing.accountId}' not found for provider '${result.missing.providerId}'`
@@ -9111,23 +10109,23 @@ async function handleAccounts(req, res, method, rest, deps) {
         deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
       }
     }
-    return writeJson4(res, 200, { ok: true, affected: result.affected });
+    return writeJson5(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && (rest[0] === "codex" || rest[0] === "kimi" || rest[0] === "grok" || rest[0] === "copilot" || rest[0] === "antigravity") && rest[1] === "oauth" && rest[3] === "status") {
     const result = rest[0] === "codex" ? handleCodexOAuthStatus(rest[2], deps) : rest[0] === "kimi" ? handleKimiOAuthStatus(rest[2], deps) : rest[0] === "grok" ? handleGrokOAuthStatus(rest[2], deps) : rest[0] === "copilot" ? handleCopilotOAuthStatus(rest[2], deps) : handleAntigravityOAuthStatus(rest[2], deps);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "DELETE" && (rest[0] === "codex" || rest[0] === "kimi" || rest[0] === "grok" || rest[0] === "copilot" || rest[0] === "antigravity") && rest[1] === "oauth" && rest[2]) {
     const result = rest[0] === "codex" ? handleCodexOAuthCancel(rest[2], deps) : rest[0] === "kimi" ? handleKimiOAuthCancel(rest[2], deps) : rest[0] === "grok" ? handleGrokOAuthCancel(rest[2], deps) : rest[0] === "copilot" ? handleCopilotOAuthCancel(rest[2], deps) : handleAntigravityOAuthCancel(rest[2], deps);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
     const providerId = asSubscriptionProviderId(rest[0]);
-    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    if (!providerId) return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     const accountId = rest[1];
     const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
-      return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJsonError2(res, 404, `account '${accountId}' not found`);
     }
     const health2 = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
     const allowance = deps.accountAllowanceService?.getSchedulingStatus?.()?.history.filter((entry) => entry.providerId === providerId && entry.accountId === accountId).map((entry) => ({
@@ -9141,88 +10139,88 @@ async function handleAccounts(req, res, method, rest, deps) {
       resumeAt: entry.resumeAt
     })) ?? [];
     const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
-    return writeJson4(res, 200, { diagnostics });
+    return writeJson5(res, 200, { diagnostics });
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "events") {
     const providerId = asSubscriptionProviderId(rest[0]);
-    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    if (!providerId) return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     const accountId = rest[1];
     const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
-      return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJsonError2(res, 404, `account '${accountId}' not found`);
     }
     const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
     const diagnostics = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
-    return writeJson4(res, 200, { events: snapshot?.records ?? [], diagnostics });
+    return writeJson5(res, 200, { events: snapshot?.records ?? [], diagnostics });
   }
   if (method === "PATCH" && rest.length === 2) {
     const providerId = asSubscriptionProviderId(rest[0]);
-    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
-    const body = await readJsonBody4(req);
+    if (!providerId) return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const body = await readJsonBody5(req);
     const patch = validateAccountMetadataPatch(body);
-    if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
+    if (!patch) return writeJsonError2(res, 400, "invalid account metadata patch");
     const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
-    if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
-    return writeJson4(res, 200, { ok: true });
+    if (!result.ok) return writeJsonError2(res, 404, `account '${rest[1]}' not found`);
+    return writeJson5(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) {
-      return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       if (providerId === "codex") {
         const result2 = handleCodexOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "kimi") {
         const result2 = await handleKimiOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "grok") {
         const result2 = await handleGrokOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "copilot") {
-        const body2 = await readJsonBody4(req);
+        const body2 = await readJsonBody5(req);
         const result2 = await handleCopilotOAuthStart(deps, body2["enterpriseUrl"]);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       if (providerId === "antigravity") {
         const result2 = handleAntigravityOAuthStart(deps);
-        return writeJson4(res, result2.status, result2.body);
+        return writeJson5(res, result2.status, result2.body);
       }
       const result = handleOAuthStart(providerId, deps);
-      return writeJson4(res, result.status, result.body);
+      return writeJson5(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson4(res, result.status, result.body);
+      return writeJson5(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const block = validateTokenBody(providerId, body2);
       if (!block) {
-        return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
+        return writeJsonError2(res, 400, `malformed token body for provider '${providerId}'`);
       }
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson4(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson5(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
-        return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
+        return writeJsonError2(res, 400, `provider '${providerId}' has no external CLI store`);
       }
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
       if (!result.ok) {
-        return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
+        return writeJsonError2(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         ok: true,
         account: status2 ?? void 0,
         nativeCredentialMode: result.nativeCredentialMode,
@@ -9232,22 +10230,22 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "refresh") {
       if (providerId === "opencodego") {
-        return writeJsonError(res, 400, "opencodego credentials are not refreshable");
+        return writeJsonError2(res, 400, "opencodego credentials are not refreshable");
       }
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson4(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson5(res, 200, { ok, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest.length === 3 && rest[2] === "test") {
       const accountId = rest[1];
-      if (!deps.accountProbeService) return writeJsonError(res, 501, "account probe service unavailable");
+      if (!deps.accountProbeService) return writeJsonError2(res, 501, "account probe service unavailable");
       const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
       if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
-        return writeJsonError(res, 404, `account '${accountId}' not found`);
+        return writeJsonError2(res, 404, `account '${accountId}' not found`);
       }
       const result = await deps.accountProbeService.testAccountConnection(providerId, accountId);
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         ok: result.ok,
         marked: result.marked,
         tier: result.tier,
@@ -9256,176 +10254,189 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const raw = body2["priority"];
       const priority = typeof raw === "number" ? raw : Number(raw);
       if (!Number.isFinite(priority)) {
-        return writeJsonError(res, 400, "priority must be a finite number");
+        return writeJsonError2(res, 400, "priority must be a finite number");
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const rawProxy = body2["proxy"];
       let proxy;
       if (rawProxy !== null && rawProxy !== void 0) {
         proxy = normalizeProxyConfig(rawProxy);
-        if (!proxy) return writeJsonError(res, 400, "invalid proxy config");
+        if (!proxy) return writeJsonError2(res, 400, "invalid proxy config");
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const parsed = validateSupportedModelsBody(body2["supportedModels"]);
-      if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
+      if (!parsed.ok) return writeJsonError2(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
-      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${accountId}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
-      const body2 = await readJsonBody4(req);
+      const body2 = await readJsonBody5(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
-      if (!id) return writeJsonError(res, 400, "active switch requires { id }");
+      if (!id) return writeJsonError2(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
-      if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson4(res, 200, { ok: true });
+      if (!result.ok) return writeJsonError2(res, 404, `account '${id}' not found`);
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
-      if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      if (!result.removed) return writeJsonError2(res, 404, `account '${accountId}' not found`);
       deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
-      return writeJson4(res, 200, { ok: true });
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
       deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
-      return writeJson4(res, 200, { ok: true });
+      return writeJson5(res, 200, { ok: true });
     }
     if (method === "DELETE") {
-      return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
+      return writeJsonError2(res, 405, "method DELETE not allowed on this accounts path");
     }
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const config = validateTokenBody(providerId, body);
     if (!config) {
-      return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
+      return writeJsonError2(res, 400, `malformed token body for provider '${providerId}'`);
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson4(res, 200, status ? { account: status } : { ok: true });
+    return writeJson5(res, 200, status ? { account: status } : { ok: true });
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
-      return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
-      return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown cli '${cli ?? ""}'`);
     }
-    const body = await readJsonBody4(req);
+    const body = await readJsonBody5(req);
     const providers = loadConfig(deps.configPath).providers ?? [];
+    const codexAuthHelper = deps.codexAuthHelper;
+    const keyScoped = codexAuthHelper ? await (async () => {
+      const gateway = deps.outboundApiServer.getStatus();
+      const serverConfig = await loadServerConfig3(deps.settingsStore);
+      return {
+        keyDb: deps.keyDb,
+        bindings: serverConfig.bindings ?? [],
+        gatewayRunning: gateway.running,
+        gatewayBaseUrl: gateway.loopbackUrl ?? `http://127.0.0.1:${gateway.port}`,
+        codexAuthHelper
+      };
+    })() : void 0;
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
       providers,
       routeLeaseManager: deps.routeLeaseManager,
+      keyScoped,
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson4(res, result.status, result.body);
+    return writeJson5(res, result.status, result.body);
   }
-  return writeJsonError(res, 405, `method ${method} not allowed on cli`);
+  return writeJsonError2(res, 405, `method ${method} not allowed on cli`);
 }
 async function handleIntegrations(req, res, method, rest, deps) {
   const factory = deps.integrationManagerFactory;
-  if (!factory) return writeJsonError(res, 501, "native CLI integration is not available");
+  if (!factory) return writeJsonError2(res, 501, "native CLI integration is not available");
   const manager = factory();
   try {
     if (method === "GET" && rest.length === 0) {
-      return writeJson4(res, 200, {
+      return writeJson5(res, 200, {
         integrations: await manager.listStatus(),
         gateway: deps.outboundApiServer.getStatus()
       });
     }
     if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
       await manager.rotateGatewayKey();
-      return writeJson4(res, 200, { ok: true, integrations: await manager.listStatus() });
+      return writeJson5(res, 200, { ok: true, integrations: await manager.listStatus() });
     }
     const client = rest[0];
     if (!isIntegrationClient(client)) {
-      return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
+      return writeJsonError2(res, 400, `unknown integration client '${client ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "key") {
-      const body = await readJsonBody4(req);
+      const body = await readJsonBody5(req);
       if (Object.keys(body).length !== 1 || typeof body.keyId !== "string" || !body.keyId.trim()) {
-        return writeJsonError(res, 400, "body must contain a non-empty keyId string");
+        return writeJsonError2(res, 400, "body must contain a non-empty keyId string");
       }
       const status = await manager.bindIntegrationKey(client, body.keyId.trim());
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "plan") {
-      const body = await readJsonBody4(req);
+      const body = await readJsonBody5(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
-        return writeJsonError(res, 400, "configPath must be a string");
+        return writeJsonError2(res, 400, "configPath must be a string");
       }
       const plan = await manager.plan(client, configPath);
-      return writeJson4(res, 200, { plan });
+      return writeJson5(res, 200, { plan });
     }
     if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
-      const body = await readJsonBody4(req);
+      const body = await readJsonBody5(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
-        return writeJsonError(res, 400, "configPath must be a string");
+        return writeJsonError2(res, 400, "configPath must be a string");
       }
       const status = await manager.install(client, configPath);
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "repair") {
       const status = await manager.repair(client);
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
     if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
       const status = await manager.remove(client);
-      return writeJson4(res, 200, { integration: status });
+      return writeJson5(res, 200, { integration: status });
     }
-    return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
+    return writeJsonError2(res, 405, `method ${method} not allowed on integrations`);
   } catch (error) {
     if (error instanceof IntegrationConflictError) {
-      return writeJsonError(res, 409, error.message);
+      return writeJsonError2(res, 409, error.message);
     }
     throw error;
   }
@@ -9568,7 +10579,7 @@ function imageProviderEvidence(images, capabilities) {
 async function handleImagesVerifyLive(req, res, deps) {
   const verifier = deps.imageLiveVerifier;
   if (!verifier) {
-    return writeJsonError(res, 501, "Images live verification is not available");
+    return writeJsonError2(res, 501, "Images live verification is not available");
   }
   const serverConfig = await loadServerConfig3(deps.settingsStore);
   const images = serverConfig.images ?? DEFAULT_IMAGES_SERVER_CONFIG;
@@ -9577,7 +10588,7 @@ async function handleImagesVerifyLive(req, res, deps) {
   req.on("close", () => controller.abort());
   const result = await verifier.verifyLive(images, controller.signal);
   const antigravityRouted = Object.values(images.models).includes("antigravity-subscription");
-  return writeJson4(res, 200, {
+  return writeJson5(res, 200, {
     ...result,
     ...antigravityRouted ? { antigravityDeferred: true } : {}
   });
@@ -9585,18 +10596,18 @@ async function handleImagesVerifyLive(req, res, deps) {
 async function handleImages(req, res, method, rest, deps) {
   if (rest.length === 1 && rest[0] === "verify-live") {
     if (method !== "POST") {
-      return writeJsonError(res, 405, `method ${method} not allowed on Images verify-live`);
+      return writeJsonError2(res, 405, `method ${method} not allowed on Images verify-live`);
     }
     return handleImagesVerifyLive(req, res, deps);
   }
   if (rest.length !== 1 || rest[0] !== "capabilities") {
-    return writeJsonError(res, 404, "unknown Images admin resource");
+    return writeJsonError2(res, 404, "unknown Images admin resource");
   }
   if (method !== "GET") {
-    return writeJsonError(res, 405, `method ${method} not allowed on Images capabilities`);
+    return writeJsonError2(res, 405, `method ${method} not allowed on Images capabilities`);
   }
   const reader = deps.imageRuntimeStatus;
-  if (!reader) return writeJsonError(res, 501, "Images runtime status is not available");
+  if (!reader) return writeJsonError2(res, 501, "Images runtime status is not available");
   const serverConfig = await loadServerConfig3(deps.settingsStore);
   const images = serverConfig.images ?? DEFAULT_IMAGES_SERVER_CONFIG;
   const lifecycle = reader.status();
@@ -9617,7 +10628,7 @@ async function handleImages(req, res, method, rest, deps) {
     httpLeases: safeStatusCount(generation.httpLeases),
     hostedLeases: safeStatusCount(generation.hostedLeases)
   }));
-  return writeJson4(res, 200, {
+  return writeJson5(res, 200, {
     configured: {
       enabled: images.enabled,
       provider: images.models[images.defaultModel] ?? "codex-subscription",
@@ -9644,7 +10655,7 @@ async function handleImages(req, res, method, rest, deps) {
   });
 }
 async function handleStatus(res, method, deps) {
-  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
+  if (method !== "GET") return writeJsonError2(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
   const serverConfig = await loadServerConfig3(deps.settingsStore);
   const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
@@ -9684,14 +10695,14 @@ async function handleStatus(res, method, deps) {
   })() : void 0;
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson4(res, 200, {
+    return writeJson5(res, 200, {
       ...status,
       endpoints,
       queueStatus,
       ...imageRuntime ? { imageRuntime } : {}
     });
   }
-  return writeJson4(res, 200, {
+  return writeJson5(res, 200, {
     ...status,
     endpoints,
     ...imageRuntime ? { imageRuntime } : {}
@@ -9714,23 +10725,23 @@ function resolvePlaygroundPath(endpoint, body) {
   }
 }
 async function handlePlayground(req, res, method, deps) {
-  if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
-  const body = await readJsonBody4(req);
+  if (method !== "POST") return writeJsonError2(res, 405, `method ${method} not allowed on playground`);
+  const body = await readJsonBody5(req);
   const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
   const key = typeof body["key"] === "string" ? body["key"] : "";
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
-  if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord9(payload) ? payload : {});
-  if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
+  if (!status.running || !status.port) return writeJsonError2(res, 503, "outbound server not running");
+  const path2 = resolvePlaygroundPath(endpoint, isRecord11(payload) ? payload : {});
+  if (!path2) return writeJsonError2(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord9(v) {
+function isRecord11(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const upstream = http.request(
       {
         host: "127.0.0.1",
@@ -9751,14 +10762,14 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
         proxRes.on("data", (chunk) => res.write(chunk));
         proxRes.on("end", () => {
           res.end();
-          resolve10();
+          resolve11();
         });
       }
     );
     upstream.on("error", (err9) => {
-      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err9.message}`);
+      if (!res.headersSent) writeJsonError2(res, 502, `playground proxy failed: ${err9.message}`);
       else res.end();
-      resolve10();
+      resolve11();
     });
     upstream.write(body);
     upstream.end();
@@ -9766,8 +10777,8 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 }
 
 // src/admin/uiStatic.ts
-import { existsSync as existsSync7, statSync as statSync3 } from "fs";
-import { readFile } from "fs/promises";
+import { existsSync as existsSync8, statSync as statSync3 } from "fs";
+import { readFile as readFile2 } from "fs/promises";
 import { createRequire } from "module";
 import path from "path";
 var CONTENT_TYPES = {
@@ -9789,13 +10800,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return existsSync7(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
+    return existsSync8(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
   }
   try {
     const req = createRequire(typeof __filename !== "undefined" ? __filename : import.meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
     const dist = path.join(path.dirname(pkgJson), "dist");
-    return existsSync7(path.join(dist, "index.html")) ? dist : null;
+    return existsSync8(path.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -9844,7 +10855,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     return true;
   }
   let target = filePath;
-  if (!existsSync7(target) || statSync3(target).isDirectory()) {
+  if (!existsSync8(target) || statSync3(target).isDirectory()) {
     if (path.extname(rel) === "") {
       target = path.join(uiDist, "index.html");
     } else {
@@ -9853,7 +10864,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
       return true;
     }
   }
-  const body = await readFile(target);
+  const body = await readFile2(target);
   const type = CONTENT_TYPES[path.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
@@ -9861,7 +10872,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.4.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.4.6" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -9900,14 +10911,14 @@ var AdminServer = class {
   }
   /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
   listen(bindAddr, port) {
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve11, reject) => {
       const server = http2.createServer((req, res) => {
         this.onRequest(req, res);
       });
       const onError = (err9) => {
         if (err9.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
-          this.listen(bindAddr, 0).then(resolve10, reject);
+          this.listen(bindAddr, 0).then(resolve11, reject);
           return;
         }
         reject(err9);
@@ -9919,7 +10930,7 @@ var AdminServer = class {
           server.removeListener("error", onError);
           server.on("error", (e) => this.deps.logger.error("[AdminServer] server error", e));
           this.server = server;
-          resolve10(addr.port);
+          resolve11(addr.port);
         } else {
           reject(new Error("Failed to get admin server address"));
         }
@@ -9993,6 +11004,10 @@ var AdminServer = class {
       await handleRouteLeaseApi(req, res, path2, this.deps);
       return;
     }
+    if (path2 === "/admin/api/codex-sessions" || path2 === "/admin/api/codex-sessions/preview" || path2 === "/admin/api/codex-sessions/apply") {
+      await handleCodexSessionApi(req, res, path2, this.deps.codexSessionManager);
+      return;
+    }
     if (path2.startsWith("/admin/api/")) {
       await handleAdminApi(req, res, path2, this.deps);
       return;
@@ -10016,8 +11031,8 @@ var AdminServer = class {
     if (!server) return;
     this.server = null;
     this.boundPort = 0;
-    return new Promise((resolve10) => {
-      server.close(() => resolve10());
+    return new Promise((resolve11) => {
+      server.close(() => resolve11());
     });
   }
   /** A live status snapshot. */
@@ -10156,7 +11171,7 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
   const port = binding.port ?? LOOPBACK_PORT;
   const callbackPath = binding.path ?? CALLBACK_PATH;
   const label = binding.label ?? "codex";
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
       if (settled) return;
@@ -10188,7 +11203,7 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       }
       res.writeHead(200, HTML_HEADERS);
       res.end(pageHtml("Login complete."));
-      finish(server, () => resolve10(code));
+      finish(server, () => resolve11(code));
     });
     const abort = () => finish(server, () => reject(new Error("login: cancelled")));
     if (signal?.aborted) {
@@ -10317,7 +11332,7 @@ function secondsUntil9(instant, now) {
   if (!instant) return void 0;
   return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
 }
-function isRecord10(value) {
+function isRecord12(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function detectProviderKeyQuotaAdapter(baseUrl) {
@@ -10384,17 +11399,17 @@ function zaiWindowIdLabel(durationMs) {
   return { id: "quota", label: "Quota" };
 }
 function parseZaiQuotaPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const data = isRecord10(payload["data"]) ? payload["data"] : payload;
+  if (!isRecord12(payload)) return null;
+  const data = isRecord12(payload["data"]) ? payload["data"] : payload;
   if (payload["success"] === false) return null;
   const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
   const byWindow = /* @__PURE__ */ new Map();
   for (const raw of limits) {
-    if (!isRecord10(raw)) continue;
+    if (!isRecord12(raw)) continue;
     const item = raw;
     if (item.type === void 0) continue;
     const details = raw["usageDetails"];
-    if (Array.isArray(details) && details.some((d) => isRecord10(d) && d["modelCode"] === "zread")) {
+    if (Array.isArray(details) && details.some((d) => isRecord12(d) && d["modelCode"] === "zread")) {
       continue;
     }
     const durationMs = zaiWindowDurationMs(item);
@@ -10427,7 +11442,7 @@ function parseZaiQuotaPayload(payload, now) {
 var MINIMAX_STATUS_EXHAUSTED = 2;
 var MINIMAX_SHARED_BUCKET = "general";
 function parseMiniMaxBucket(value) {
-  if (!isRecord10(value)) return null;
+  if (!isRecord12(value)) return null;
   const modelName = typeof value["model_name"] === "string" ? value["model_name"].trim() : "";
   if (!modelName) return null;
   const instant = (v) => {
@@ -10459,9 +11474,9 @@ function minimaxWindow(id, label, windowMinutes, resetsAtMs, remainingPercent, s
   };
 }
 function parseMiniMaxTokenPlanPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
+  if (!isRecord12(payload)) return null;
   const baseResp = payload["base_resp"];
-  if (!isRecord10(baseResp) || baseResp["status_code"] !== 0) return null;
+  if (!isRecord12(baseResp) || baseResp["status_code"] !== 0) return null;
   const buckets = Array.isArray(payload["model_remains"]) ? payload["model_remains"] : [];
   let general = null;
   for (const raw of buckets) {
@@ -10494,11 +11509,11 @@ function parseMiniMaxTokenPlanPayload(payload, now) {
   ];
 }
 function parseUmansUsagePayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const limits = isRecord10(payload["limits"]) ? payload["limits"] : void 0;
-  const requests = limits && isRecord10(limits["requests"]) ? limits["requests"] : void 0;
-  const usage = isRecord10(payload["usage"]) ? payload["usage"] : void 0;
-  const window = isRecord10(payload["window"]) ? payload["window"] : void 0;
+  if (!isRecord12(payload)) return null;
+  const limits = isRecord12(payload["limits"]) ? payload["limits"] : void 0;
+  const requests = limits && isRecord12(limits["requests"]) ? limits["requests"] : void 0;
+  const usage = isRecord12(payload["usage"]) ? payload["usage"] : void 0;
+  const window = isRecord12(payload["window"]) ? payload["window"] : void 0;
   const hardCap = finiteNumber5(requests?.["hard_cap"]);
   const softLimit = finiteNumber5(requests?.["limit"]);
   const requestsInWindow = finiteNumber5(usage?.["requests_in_window"]);
@@ -10525,9 +11540,9 @@ function parseUmansUsagePayload(payload, now) {
   ];
 }
 function parseSyntheticQuotasPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const fiveHour = isRecord10(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
-  const weekly = isRecord10(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
+  if (!isRecord12(payload)) return null;
+  const fiveHour = isRecord12(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
+  const weekly = isRecord12(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
   const windows = [];
   if (fiveHour) {
     const max = finiteNumber5(fiveHour["max"]);
@@ -10568,12 +11583,12 @@ var CLINE_WINDOW_CONFIG = {
   monthly: { id: "thirty-day", label: "30 days", minutes: 30 * 24 * 60 }
 };
 function parseClinePassUsageLimitsPayload(payload, now) {
-  if (!isRecord10(payload)) return null;
-  const data = isRecord10(payload["data"]) ? payload["data"] : payload;
+  if (!isRecord12(payload)) return null;
+  const data = isRecord12(payload["data"]) ? payload["data"] : payload;
   const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
   const windows = [];
   for (const raw of limits) {
-    if (!isRecord10(raw)) continue;
+    if (!isRecord12(raw)) continue;
     const config = CLINE_WINDOW_CONFIG[typeof raw["type"] === "string" ? raw["type"] : ""];
     if (!config) continue;
     const usedPercent = finitePercent4(raw["percentUsed"]);
@@ -10726,36 +11741,36 @@ var ProviderKeyQuotaService = class {
 };
 
 // src/commands/paths.ts
-import { dirname as dirname5, join as join5 } from "path";
+import { dirname as dirname5, join as join6 } from "path";
 function defaultVouchersPath(configPath) {
-  return join5(dirname5(configPath), "vouchers.json");
+  return join6(dirname5(configPath), "vouchers.json");
 }
 function defaultIntegrationsPath(configPath) {
-  return join5(dirname5(configPath), "integrations.json");
+  return join6(dirname5(configPath), "integrations.json");
 }
 function defaultPricingPath(configPath) {
-  return join5(dirname5(configPath), "pricing.json");
+  return join6(dirname5(configPath), "pricing.json");
 }
 function defaultPricingRefreshStatePath(configPath) {
-  return join5(dirname5(configPath), "pricing-refresh.json");
+  return join6(dirname5(configPath), "pricing-refresh.json");
 }
 function defaultAccountAllowancePath(configPath) {
-  return join5(dirname5(configPath), "allowance-cache.json");
+  return join6(dirname5(configPath), "allowance-cache.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return join5(dirname5(configPath), "usage-events.jsonl");
+  return join6(dirname5(configPath), "usage-events.jsonl");
 }
 function defaultLogDir(configPath) {
-  return join5(dirname5(configPath), "logs");
+  return join6(dirname5(configPath), "logs");
 }
 function defaultDaemonLogPath(configPath) {
-  return join5(defaultLogDir(configPath), "daemon.log");
+  return join6(defaultLogDir(configPath), "daemon.log");
 }
 function defaultAuditDir(configPath) {
-  return join5(dirname5(configPath), "audit");
+  return join6(dirname5(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return join5(dirname5(configPath), "billing");
+  return join6(dirname5(configPath), "billing");
 }
 
 // src/image-generation/ImageDoctorService.ts
@@ -10775,7 +11790,7 @@ import { createHmac as createHmac2, randomBytes as randomBytes5 } from "crypto";
 import {
   chmodSync as chmodSync6,
   closeSync as closeSync2,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync3,
   openSync as openSync2,
@@ -10784,7 +11799,7 @@ import {
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename2, dirname as dirname6, join as join7, resolve as resolve4 } from "path";
+import { basename as basename3, dirname as dirname6, join as join8, resolve as resolve5 } from "path";
 import { IMAGE_SERVER_HARD_CEILINGS } from "@omnicross/core/outbound-api";
 
 // src/image-generation/imageTenantHmac.ts
@@ -10793,7 +11808,7 @@ import {
   chmodSync as chmodSync5,
   closeSync,
   constants,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   fstatSync,
   fsyncSync,
   lstatSync as lstatSync2,
@@ -10801,7 +11816,7 @@ import {
   readFileSync as readFileSync6,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var TENANT_SALT_NAME = "tenant-hmac-salt.v1.bin";
 var TENANT_KEY_PATTERN = /^[a-f0-9]{64}$/u;
 var REFERENCE_DOMAIN = Buffer.from("omnicross:image-reference:tenant:v1\0", "utf8");
@@ -10819,8 +11834,8 @@ function deriveImageTenantHmac(salt, purpose, tenantId) {
 }
 function loadOrCreateImageTenantHmacSalt(paths, random) {
   const root = paths.verifiedRoot("mountManifest");
-  const path2 = join6(root, TENANT_SALT_NAME);
-  if (!existsSync8(path2)) {
+  const path2 = join7(root, TENANT_SALT_NAME);
+  if (!existsSync9(path2)) {
     const salt = random(32);
     if (salt.byteLength !== 32) throw new TypeError("image tenant HMAC salt generator returned invalid bytes");
     let fd2;
@@ -10925,8 +11940,8 @@ function validateObservation(value) {
   }
 }
 function samePath2(left, right) {
-  const a = resolve4(left);
-  const b = resolve4(right);
+  const a = resolve5(left);
+  const b = resolve5(right);
   return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 }
 function capabilityValues(entry) {
@@ -10988,7 +12003,7 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
     this.#replaceManifest = options.replaceManifest ?? ((target, contents) => {
       this.#atomicReplace(target, contents);
     });
-    if (existsSync9(this.#manifestPath())) this.#load();
+    if (existsSync10(this.#manifestPath())) this.#load();
   }
   createSource(ttlMs) {
     return new FileCodexImageCapabilityEvidenceSource({ owner: this, ttlMs });
@@ -11100,7 +12115,7 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
     return Math.min(entry.expiresAt, entry.verifiedAt + ttlMs);
   }
   #manifestPath() {
-    return join7(this.#paths.verifiedRoot("evidence"), MANIFEST_NAME);
+    return join8(this.#paths.verifiedRoot("evidence"), MANIFEST_NAME);
   }
   #serialized(entries, revision) {
     const manifest = {
@@ -11145,15 +12160,15 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
     this.#entries = entries;
   }
   #refresh() {
-    if (!existsSync9(this.#manifestPath())) return;
+    if (!existsSync10(this.#manifestPath())) return;
     this.#load();
   }
   #atomicReplace(targetPath, contents) {
     const root = this.#paths.verifiedRoot("evidence");
-    if (!samePath2(dirname6(resolve4(targetPath)), root) || basename2(targetPath) !== MANIFEST_NAME) {
+    if (!samePath2(dirname6(resolve5(targetPath)), root) || basename3(targetPath) !== MANIFEST_NAME) {
       throw new TypeError("Codex image evidence manifest target is invalid");
     }
-    const temporaryPath = join7(
+    const temporaryPath = join8(
       root,
       `.codex-image-evidence.${process.pid}.${this.#random(8).toString("hex")}.tmp`
     );
@@ -11173,7 +12188,7 @@ var FileCodexImageCapabilityEvidenceManifestOwner = class {
         } catch {
         }
       }
-      if (existsSync9(temporaryPath)) {
+      if (existsSync10(temporaryPath)) {
         try {
           unlinkSync4(temporaryPath);
         } catch {
@@ -11765,11 +12780,11 @@ var DaemonImageExecutionScheduler = class {
         retrySafety: "before_acceptance"
       });
     }
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve11, reject) => {
       const waiter = {
         tenantKey,
         signal: request.signal,
-        resolve: resolve10,
+        resolve: resolve11,
         reject,
         onAbort: () => void 0,
         settled: false
@@ -11932,7 +12947,7 @@ import {
   ImageGenerationError as ImageGenerationError3,
   ImageRequestResourceScope
 } from "@omnicross/core/image-generation";
-import { dirname as dirname7, resolve as resolve5 } from "path";
+import { dirname as dirname7, resolve as resolve6 } from "path";
 function capacityExceeded() {
   throw new ImageGenerationError3("image_too_large");
 }
@@ -12017,10 +13032,10 @@ var DaemonImageActiveScopeRegistry = class {
   #temporaryRoot;
   #active = /* @__PURE__ */ new Set();
   constructor(paths) {
-    this.#temporaryRoot = resolve5(paths.paths.temporaryRoot);
+    this.#temporaryRoot = resolve6(paths.paths.temporaryRoot);
   }
   register(privateDirectory) {
-    const normalized2 = resolve5(privateDirectory);
+    const normalized2 = resolve6(privateDirectory);
     if (dirname7(normalized2) !== this.#temporaryRoot || this.#active.has(normalized2)) {
       throw new TypeError("image temporary scope directory is invalid or already active");
     }
@@ -12033,7 +13048,7 @@ var DaemonImageActiveScopeRegistry = class {
     };
   }
   isActive(privateDirectory) {
-    return this.#active.has(resolve5(privateDirectory));
+    return this.#active.has(resolve6(privateDirectory));
   }
   status() {
     return Object.freeze({ activeDirectories: this.#active.size });
@@ -12327,14 +13342,14 @@ function createImageRuntimeGeneration(options) {
 
 // src/image-generation/ImageStartupReconciler.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   lstatSync as lstatSync7,
   readFileSync as readFileSync11,
   readdirSync as readdirSync3,
   rmdirSync as rmdirSync2,
   unlinkSync as unlinkSync8
 } from "fs";
-import { basename as basename6, dirname as dirname11, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve9 } from "path";
+import { basename as basename7, dirname as dirname11, isAbsolute as isAbsolute3, relative as relative2, resolve as resolve10 } from "path";
 import {
   IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT,
   IMAGE_REQUEST_DIRECTORY_MARKER_NAME
@@ -12344,7 +13359,7 @@ import {
 import { randomBytes as randomBytes9 } from "crypto";
 import {
   closeSync as closeSync5,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   fsyncSync as fsyncSync5,
   lstatSync as lstatSync6,
   openSync as openSync5,
@@ -12354,7 +13369,7 @@ import {
   unlinkSync as unlinkSync7,
   writeFileSync as writeFileSync10
 } from "fs";
-import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute2, join as join10, resolve as resolve8 } from "path";
+import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute2, join as join11, resolve as resolve9 } from "path";
 import { ImageGenerationError as ImageGenerationError7 } from "@omnicross/core/image-generation";
 
 // src/image-generation/FileImageReferenceStore.ts
@@ -12363,7 +13378,7 @@ import {
   closeSync as closeSync3,
   constants as constants2,
   createReadStream,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   fstatSync as fstatSync2,
   fsyncSync as fsyncSync3,
   lstatSync as lstatSync4,
@@ -12375,8 +13390,8 @@ import {
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync8
 } from "fs";
-import { open } from "fs/promises";
-import { basename as basename3, dirname as dirname8, join as join8, resolve as resolve6 } from "path";
+import { open as open2 } from "fs/promises";
+import { basename as basename4, dirname as dirname8, join as join9, resolve as resolve7 } from "path";
 import { Readable } from "stream";
 import {
   ImageGenerationError as ImageGenerationError5
@@ -12402,8 +13417,8 @@ function safeInteger(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
 function samePath3(left, right) {
-  const normalizedLeft = resolve6(left);
-  const normalizedRight = resolve6(right);
+  const normalizedLeft = resolve7(left);
+  const normalizedRight = resolve7(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 function validEntry2(value) {
@@ -12705,7 +13720,7 @@ var FileImageReferenceStore = class {
         const ownedArtifact = ARTIFACT_FILE.test(name);
         const incomplete = /^artifact-[a-f0-9]{32}\.tmp$/u.test(name);
         if ((!ownedArtifact || referenced.has(name)) && !incomplete) continue;
-        const path2 = resolve6(root, name);
+        const path2 = resolve7(root, name);
         let info;
         try {
           info = lstatSync4(path2);
@@ -12856,10 +13871,10 @@ var FileImageReferenceStore = class {
   async writeArtifact(asset, limits) {
     const root = this.#paths.verifiedRoot("artifacts");
     const suffix = this.#random(16).toString("hex");
-    const tempPath = join8(root, `artifact-${suffix}.tmp`);
+    const tempPath = join9(root, `artifact-${suffix}.tmp`);
     const fileName = `artifact-${suffix}.bin`;
-    const finalPath = join8(root, fileName);
-    const handle = await open(tempPath, "wx", 384);
+    const finalPath = join9(root, fileName);
+    const handle = await open2(tempPath, "wx", 384);
     let reader;
     let observed = 0;
     let writeFailure;
@@ -12908,8 +13923,8 @@ var FileImageReferenceStore = class {
   artifactPath(fileName) {
     if (!ARTIFACT_FILE.test(fileName)) throw new TypeError("invalid image artifact filename");
     const root = this.#paths.verifiedRoot("artifacts");
-    const path2 = resolve6(root, fileName);
-    if (!samePath3(dirname8(path2), root) || basename3(path2) !== fileName) {
+    const path2 = resolve7(root, fileName);
+    if (!samePath3(dirname8(path2), root) || basename4(path2) !== fileName) {
       throw new TypeError("image artifact escaped its root");
     }
     return path2;
@@ -12932,12 +13947,12 @@ var FileImageReferenceStore = class {
   }
   safeUnlinkArtifactPath(path2) {
     const root = this.#paths.verifiedRoot("artifacts");
-    const target = resolve6(path2);
-    const name = basename3(target);
+    const target = resolve7(path2);
+    const name = basename4(target);
     if (!samePath3(dirname8(target), root) || !/^artifact-[a-f0-9]{32}\.(?:bin|tmp)$/u.test(name)) {
       throw new TypeError("refusing to unlink an unverified image artifact");
     }
-    if (!existsSync10(target)) return;
+    if (!existsSync11(target)) return;
     const info = lstatSync4(target);
     if (info.isSymbolicLink() || !info.isFile()) throw new TypeError("refusing to unlink an unverified image artifact");
     unlinkSync5(target);
@@ -12959,7 +13974,7 @@ var FileImageReferenceStore = class {
     });
   }
   manifestPath() {
-    return join8(this.#paths.verifiedRoot("state"), MANIFEST_NAME2);
+    return join9(this.#paths.verifiedRoot("state"), MANIFEST_NAME2);
   }
   persist(entries, tombstones) {
     const manifest = {
@@ -12975,10 +13990,10 @@ var FileImageReferenceStore = class {
   }
   atomicReplace(targetPath, contents) {
     const root = this.#paths.verifiedRoot("state");
-    if (!samePath3(dirname8(resolve6(targetPath)), root) || basename3(targetPath) !== MANIFEST_NAME2) {
+    if (!samePath3(dirname8(resolve7(targetPath)), root) || basename4(targetPath) !== MANIFEST_NAME2) {
       throw new TypeError("invalid image reference manifest target");
     }
-    const temporaryPath = join8(root, `.references.${process.pid}.${this.#random(8).toString("hex")}.tmp`);
+    const temporaryPath = join9(root, `.references.${process.pid}.${this.#random(8).toString("hex")}.tmp`);
     let fd;
     try {
       fd = openSync3(temporaryPath, "wx", 384);
@@ -12994,7 +14009,7 @@ var FileImageReferenceStore = class {
         } catch {
         }
       }
-      if (existsSync10(temporaryPath)) {
+      if (existsSync11(temporaryPath)) {
         try {
           unlinkSync5(temporaryPath);
         } catch {
@@ -13004,7 +14019,7 @@ var FileImageReferenceStore = class {
   }
   loadManifest() {
     const path2 = this.manifestPath();
-    if (!existsSync10(path2)) return;
+    if (!existsSync11(path2)) return;
     const info = lstatSync4(path2);
     if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_MANIFEST_BYTES2) {
       throw new TypeError("image reference manifest is invalid");
@@ -13053,7 +14068,7 @@ var FileImageReferenceStore = class {
 import { randomBytes as randomBytes8 } from "crypto";
 import {
   closeSync as closeSync4,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   fsyncSync as fsyncSync4,
   lstatSync as lstatSync5,
   openSync as openSync4,
@@ -13062,7 +14077,7 @@ import {
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync9
 } from "fs";
-import { basename as basename4, dirname as dirname9, join as join9, resolve as resolve7 } from "path";
+import { basename as basename5, dirname as dirname9, join as join10, resolve as resolve8 } from "path";
 import { ImageGenerationError as ImageGenerationError6 } from "@omnicross/core/image-generation";
 var MANIFEST_VERSION3 = 1;
 var MANIFEST_NAME3 = "responses-image-state.v1.json";
@@ -13115,8 +14130,8 @@ function validPendingReferenceDelete(value) {
   return exactKeys2(row, ["callId", "referenceTenantKey", "referenceId", "expiresAt"]) && typeof row.callId === "string" && CALL_ID_PATTERN.test(row.callId) && isImageTenantHmac(row.referenceTenantKey) && typeof row.referenceId === "string" && REFERENCE_ID_PATTERN.test(row.referenceId) && safeTimestamp2(row.expiresAt);
 }
 function samePath4(left, right) {
-  const normalizedLeft = resolve7(left);
-  const normalizedRight = resolve7(right);
+  const normalizedLeft = resolve8(left);
+  const normalizedRight = resolve8(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 function sameBinding(left, right) {
@@ -13599,7 +14614,7 @@ var FileResponsesImageStateStore = class {
     });
   }
   manifestPath() {
-    return join9(this.#paths.verifiedRoot("state"), MANIFEST_NAME3);
+    return join10(this.#paths.verifiedRoot("state"), MANIFEST_NAME3);
   }
   persist(calls, responses, tombstones, pendingReferenceDeletes) {
     const manifest = {
@@ -13619,10 +14634,10 @@ var FileResponsesImageStateStore = class {
   }
   atomicReplace(targetPath, contents) {
     const root = this.#paths.verifiedRoot("state");
-    if (!samePath4(dirname9(resolve7(targetPath)), root) || basename4(targetPath) !== MANIFEST_NAME3) {
+    if (!samePath4(dirname9(resolve8(targetPath)), root) || basename5(targetPath) !== MANIFEST_NAME3) {
       throw new TypeError("invalid responses image state manifest target");
     }
-    const temporaryPath = join9(
+    const temporaryPath = join10(
       root,
       `.responses-image-state.${process.pid}.${this.#random(8).toString("hex")}.tmp`
     );
@@ -13641,7 +14656,7 @@ var FileResponsesImageStateStore = class {
         } catch {
         }
       }
-      if (existsSync11(temporaryPath)) {
+      if (existsSync12(temporaryPath)) {
         try {
           unlinkSync6(temporaryPath);
         } catch {
@@ -13651,7 +14666,7 @@ var FileResponsesImageStateStore = class {
   }
   loadManifest() {
     const path2 = this.manifestPath();
-    if (!existsSync11(path2)) return;
+    if (!existsSync12(path2)) return;
     const info = lstatSync5(path2);
     if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_MANIFEST_BYTES3) {
       throw new TypeError("responses image state manifest is invalid");
@@ -13745,8 +14760,8 @@ function validMount(value) {
   return exactKeys3(row, ["id", "durableRoot", "createdAt"]) && typeof row.id === "string" && MOUNT_ID_PATTERN.test(row.id) && typeof row.durableRoot === "string" && isAbsolute2(row.durableRoot) && safeInteger2(row.createdAt);
 }
 function samePath5(left, right) {
-  const normalizedLeft = resolve8(left);
-  const normalizedRight = resolve8(right);
+  const normalizedLeft = resolve9(left);
+  const normalizedRight = resolve9(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 var ImageStorageMountCatalog = class {
@@ -13774,7 +14789,7 @@ var ImageStorageMountCatalog = class {
     this.#catalogResolver = this.createResolver(options.activeStorageRoot);
     this.#reconcileCorruptManifests = options.reconcileCorruptManifests ?? false;
     this.#replaceCatalog = options.replaceCatalog ?? ((target, contents) => this.atomicReplace(target, contents));
-    if (existsSync12(this.catalogPath())) {
+    if (existsSync13(this.catalogPath())) {
       try {
         this.loadCatalog();
       } catch (error) {
@@ -14026,15 +15041,15 @@ var ImageStorageMountCatalog = class {
   }
   quarantineManifest(resolver, area, name, label) {
     const root = resolver.verifiedRoot(area);
-    const source = join10(root, name);
-    if (!existsSync12(source)) throw new TypeError("corrupt image manifest is missing");
+    const source = join11(root, name);
+    if (!existsSync13(source)) throw new TypeError("corrupt image manifest is missing");
     const info = lstatSync6(source);
     if (info.isSymbolicLink() || !info.isFile()) {
       throw new TypeError("refusing to quarantine an unverified image manifest");
     }
     for (let attempt = 0; attempt < 8; attempt += 1) {
-      const target = join10(root, `.corrupt-${label}-${this.#random(8).toString("hex")}.json`);
-      if (existsSync12(target)) continue;
+      const target = join11(root, `.corrupt-${label}-${this.#random(8).toString("hex")}.json`);
+      if (existsSync13(target)) continue;
       resolver.verifiedRoot(area);
       renameSync6(source, target);
       this.#corruptManifestsQuarantined += 1;
@@ -14079,10 +15094,10 @@ var ImageStorageMountCatalog = class {
   }
   atomicReplace(targetPath, contents) {
     const root = this.#catalogResolver.verifiedRoot("mountManifest");
-    if (!samePath5(dirname10(resolve8(targetPath)), root) || basename5(targetPath) !== CATALOG_NAME) {
+    if (!samePath5(dirname10(resolve9(targetPath)), root) || basename6(targetPath) !== CATALOG_NAME) {
       throw new TypeError("invalid image storage mount catalog target");
     }
-    const temporaryPath = join10(
+    const temporaryPath = join11(
       root,
       `.catalog.${process.pid}.${this.#random(8).toString("hex")}.tmp`
     );
@@ -14101,7 +15116,7 @@ var ImageStorageMountCatalog = class {
         } catch {
         }
       }
-      if (existsSync12(temporaryPath)) {
+      if (existsSync13(temporaryPath)) {
         try {
           unlinkSync7(temporaryPath);
         } catch {
@@ -14323,12 +15338,12 @@ function positiveInteger4(value, name) {
   return value;
 }
 function samePath6(left, right) {
-  const normalizedLeft = resolve9(left);
-  const normalizedRight = resolve9(right);
+  const normalizedLeft = resolve10(left);
+  const normalizedRight = resolve10(right);
   return process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight;
 }
 function isDirectChild(path2, root) {
-  const target = resolve9(path2);
+  const target = resolve10(path2);
   const rel = relative2(root, target);
   return !samePath6(target, root) && !isAbsolute3(rel) && !rel.startsWith("..") && samePath6(dirname11(target), root);
 }
@@ -14450,8 +15465,8 @@ var ImageStartupReconciler = class {
     let removed = 0;
     let invalid = 0;
     for (const name of readdirSync3(root).filter((value) => pattern.test(value)).slice(0, limit)) {
-      const path2 = resolve9(root, name);
-      if (!isDirectChild(path2, root) || basename6(path2) !== name) {
+      const path2 = resolve10(root, name);
+      if (!isDirectChild(path2, root) || basename7(path2) !== name) {
         invalid += 1;
         continue;
       }
@@ -14473,7 +15488,7 @@ var ImageStartupReconciler = class {
     let invalid = 0;
     let active = 0;
     for (const name of readdirSync3(root).slice(0, this.#maxTemporaryDirectoriesPerPass)) {
-      const path2 = resolve9(root, name);
+      const path2 = resolve10(root, name);
       if (!OWNED_TEMPORARY_DIRECTORY.test(name) || !isDirectChild(path2, root)) {
         foreign += 1;
         continue;
@@ -14488,8 +15503,8 @@ var ImageStartupReconciler = class {
         active += 1;
         continue;
       }
-      const markerPath = resolve9(path2, IMAGE_REQUEST_DIRECTORY_MARKER_NAME);
-      if (!isDirectChild(markerPath, path2) || !existsSync13(markerPath)) {
+      const markerPath = resolve10(path2, IMAGE_REQUEST_DIRECTORY_MARKER_NAME);
+      if (!isDirectChild(markerPath, path2) || !existsSync14(markerPath)) {
         foreign += 1;
         continue;
       }
@@ -14521,7 +15536,7 @@ var ImageStartupReconciler = class {
       throw new TypeError("refusing to remove an unsupported temporary descendant");
     }
     for (const name of readdirSync3(path2)) {
-      this.removeTreeWithoutFollowingSymlinks(resolve9(path2, name), path2);
+      this.removeTreeWithoutFollowingSymlinks(resolve10(path2, name), path2);
     }
     rmdirSync2(path2);
   }
@@ -14990,8 +16005,8 @@ function createHostedImageContributionFactory(manager) {
 function deferredRecord(generation, phase) {
   let resolveDisposed;
   let rejectDisposed;
-  const disposed = new Promise((resolve10, reject) => {
-    resolveDisposed = resolve10;
+  const disposed = new Promise((resolve11, reject) => {
+    resolveDisposed = resolve11;
     rejectDisposed = reject;
   });
   void disposed.catch(() => void 0);
@@ -15570,7 +16585,7 @@ function toLLMProvider(row) {
 // src/ports/ConfigurableLogger.ts
 import {
   createWriteStream,
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   renameSync as renameSync7,
   statSync as statSync4,
   unlinkSync as unlinkSync9
@@ -15622,7 +16637,7 @@ var ConfigurableLogger = class {
     this.fileStream = null;
     this.rotateQueue = [];
     if (!stream) return Promise.resolve();
-    return new Promise((resolve10) => stream.end(() => resolve10()));
+    return new Promise((resolve11) => stream.end(() => resolve11()));
   }
   emit(level, message, error, meta) {
     if (LEVEL_ORDER[level] > this.threshold) return;
@@ -15704,12 +16719,12 @@ var ConfigurableLogger = class {
   /** `<file>.N` unlinked, `<file>.k` → `<file>.k+1`, `<file>` → `<file>.1`. */
   shiftGenerations(path2) {
     const oldest = `${path2}.${this.maxFiles}`;
-    if (existsSync14(oldest)) unlinkSync9(oldest);
+    if (existsSync15(oldest)) unlinkSync9(oldest);
     for (let i = this.maxFiles - 1; i >= 1; i--) {
       const from = `${path2}.${i}`;
-      if (existsSync14(from)) renameSync7(from, `${path2}.${i + 1}`);
+      if (existsSync15(from)) renameSync7(from, `${path2}.${i + 1}`);
     }
-    if (existsSync14(path2)) renameSync7(path2, `${path2}.1`);
+    if (existsSync15(path2)) renameSync7(path2, `${path2}.1`);
   }
   /**
    * Lazily open the append-only file stream; disable the sink on any error. The
@@ -15720,7 +16735,7 @@ var ConfigurableLogger = class {
     if (this.fileDisabled || !this.filePath) return null;
     if (this.fileStream) return this.fileStream;
     try {
-      this.fileBytes = existsSync14(this.filePath) ? statSync4(this.filePath).size : 0;
+      this.fileBytes = existsSync15(this.filePath) ? statSync4(this.filePath).size : 0;
       const stream = createWriteStream(this.filePath, { flags: "a" });
       stream.on("error", () => {
         this.fileDisabled = true;
@@ -15793,7 +16808,7 @@ function safeStringify(value) {
 import { randomBytes as randomBytes10 } from "crypto";
 import {
   closeSync as closeSync6,
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   fsyncSync as fsyncSync6,
   openSync as openSync6,
   readFileSync as readFileSync12,
@@ -15801,12 +16816,12 @@ import {
   unlinkSync as unlinkSync10,
   writeFileSync as writeFileSync11
 } from "fs";
-import { basename as basename7, dirname as dirname12, join as join11 } from "path";
+import { basename as basename8, dirname as dirname12, join as join12 } from "path";
 import { OUTBOUND_API_SERVER_CONFIG_KEY } from "@omnicross/core/outbound-api";
 function atomicReplaceDocument(targetPath, contents) {
-  const tempPath = join11(
+  const tempPath = join12(
     dirname12(targetPath),
-    `.${basename7(targetPath)}.${process.pid}.${randomBytes10(8).toString("hex")}.tmp`
+    `.${basename8(targetPath)}.${process.pid}.${randomBytes10(8).toString("hex")}.tmp`
   );
   let fd;
   try {
@@ -15823,7 +16838,7 @@ function atomicReplaceDocument(targetPath, contents) {
       } catch {
       }
     }
-    if (existsSync15(tempPath)) {
+    if (existsSync16(tempPath)) {
       try {
         unlinkSync10(tempPath);
       } catch {
@@ -15866,13 +16881,13 @@ var JsonApiServerSettingsStore = class {
   }
   /** Capture the exact prior document for an admin transaction rollback. */
   captureDocumentSnapshot() {
-    if (!existsSync15(this.configPath)) return { existed: false };
+    if (!existsSync16(this.configPath)) return { existed: false };
     return { existed: true, bytes: readFileSync12(this.configPath) };
   }
   /** Restore exact prior bytes (including unrelated fields and encrypted secrets). */
   restoreDocumentSnapshot(snapshot) {
     if (!snapshot.existed) {
-      if (existsSync15(this.configPath)) unlinkSync10(this.configPath);
+      if (existsSync16(this.configPath)) unlinkSync10(this.configPath);
       return;
     }
     if (!snapshot.bytes) throw new TypeError("settings snapshot is missing prior bytes");
@@ -15909,13 +16924,13 @@ var JsonApiServerSettingsStore = class {
 };
 
 // src/ports/JsonlUsageEventStore.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync5 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/usage/usageFiles.ts
-import { readdir } from "fs/promises";
-import { dirname as dirname13, join as join12 } from "path";
+import { readdir as readdir2 } from "fs/promises";
+import { dirname as dirname13, join as join13 } from "path";
 var USAGE_DIR_NAME = "usage";
 var USAGE_SHARD_RE = /^usage-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
 var USAGE_ROLLUP_RE = /^usage-(\d{4})-(\d{2})-(\d{2})\.rollup\.json$/;
@@ -15932,7 +16947,7 @@ function usageRollupName(dayKey) {
   return `usage-${dayKey}.rollup.json`;
 }
 function usageDirFor(eventsPath) {
-  return join12(dirname13(eventsPath), USAGE_DIR_NAME);
+  return join13(dirname13(eventsPath), USAGE_DIR_NAME);
 }
 function dayKeyStartTs(dayKey) {
   const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(dayKey);
@@ -15953,7 +16968,7 @@ function dayKeyEndTs(dayKey) {
 async function listUsageDays(usageDir) {
   let names;
   try {
-    names = await readdir(usageDir);
+    names = await readdir2(usageDir);
   } catch {
     return [];
   }
@@ -16193,12 +17208,12 @@ function isUsageDayRollup(parsed) {
 }
 
 // src/usage/usageRollupStore.ts
-import { mkdir, readFile as readFile2, rename, unlink, writeFile } from "fs/promises";
-import { join as join14 } from "path";
+import { mkdir, readFile as readFile3, rename as rename2, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
+import { join as join15 } from "path";
 
 // src/usage/usageShardCache.ts
-import { open as open2 } from "fs/promises";
-import { join as join13 } from "path";
+import { open as open3 } from "fs/promises";
+import { join as join14 } from "path";
 
 // src/usage/usageRow.ts
 var NUMERIC_FIELDS = [
@@ -16258,10 +17273,10 @@ var NEWLINE = 10;
 var READ_CHUNK_BYTES = 8 * 1024 * 1024;
 var DEFAULT_MAX_RESIDENT_DAYS = 3;
 async function streamShardRows(usageDir, dayKey, onRow) {
-  const path2 = join13(usageDir, usageShardName(dayKey));
+  const path2 = join14(usageDir, usageShardName(dayKey));
   let handle;
   try {
-    handle = await open2(path2, "r");
+    handle = await open3(path2, "r");
   } catch {
     return;
   }
@@ -16291,7 +17306,7 @@ async function streamShardRows(usageDir, dayKey, onRow) {
 async function shardSize(usageDir, dayKey) {
   let handle;
   try {
-    handle = await open2(join13(usageDir, usageShardName(dayKey)), "r");
+    handle = await open3(join14(usageDir, usageShardName(dayKey)), "r");
   } catch {
     return null;
   }
@@ -16347,10 +17362,10 @@ var UsageShardCache = class {
     } else {
       this.touch(dayKey);
     }
-    const path2 = join13(this.usageDir, usageShardName(dayKey));
+    const path2 = join14(this.usageDir, usageShardName(dayKey));
     let handle;
     try {
-      handle = await open2(path2, "r");
+      handle = await open3(path2, "r");
     } catch {
       return entry;
     }
@@ -16469,7 +17484,7 @@ var UsageRollupStore = class {
   }
   async readSidecar(dayKey) {
     try {
-      const raw = await readFile2(join14(this.usageDir, usageRollupName(dayKey)), "utf8");
+      const raw = await readFile3(join15(this.usageDir, usageRollupName(dayKey)), "utf8");
       const parsed = JSON.parse(raw);
       return isUsageDayRollup(parsed) && parsed.date === dayKey ? parsed : null;
     } catch {
@@ -16477,14 +17492,14 @@ var UsageRollupStore = class {
     }
   }
   async writeSidecar(dayKey, rollup) {
-    const target = join14(this.usageDir, usageRollupName(dayKey));
+    const target = join15(this.usageDir, usageRollupName(dayKey));
     const temp = `${target}.tmp`;
     try {
       await mkdir(this.usageDir, { recursive: true });
-      await writeFile(temp, JSON.stringify(rollup), "utf8");
-      await rename(temp, target);
+      await writeFile2(temp, JSON.stringify(rollup), "utf8");
+      await rename2(temp, target);
     } catch {
-      await unlink(temp).catch(() => {
+      await unlink2(temp).catch(() => {
       });
     }
   }
@@ -16559,13 +17574,13 @@ var JsonlUsageEventStore = class {
   async insert(input) {
     const row = {
       ...input,
-      id: randomUUID4(),
+      id: randomUUID5(),
       ts: input.ts ?? Date.now()
     };
     const dayKey = usageDayKey(row.ts);
     this.ensureDir();
     const line = JSON.stringify(row) + "\n";
-    appendFileSync(join15(this.usageDir, usageShardName(dayKey)), line, "utf8");
+    appendFileSync(join16(this.usageDir, usageShardName(dayKey)), line, "utf8");
     if (dayKey !== this.lastAppendDay) {
       this.rollups.invalidate(dayKey);
       this.lastAppendDay = dayKey;
@@ -16940,7 +17955,7 @@ function bucketLabel(bucketStartTs, bucket) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
-import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync13 } from "fs";
 import {
   validateOutboundPermissions as validateOutboundPermissions3
 } from "@omnicross/core";
@@ -16949,18 +17964,18 @@ import {
 import { randomBytes as randomBytes11 } from "crypto";
 import {
   closeSync as closeSync7,
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   fsyncSync as fsyncSync7,
   openSync as openSync7,
   renameSync as renameSync9,
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync12
 } from "fs";
-import { basename as basename8, dirname as dirname14, join as join16 } from "path";
+import { basename as basename9, dirname as dirname14, join as join17 } from "path";
 function atomicReplaceUtf8(targetPath, contents) {
-  const tempPath = join16(
+  const tempPath = join17(
     dirname14(targetPath),
-    `.${basename8(targetPath)}.${process.pid}.${randomBytes11(8).toString("hex")}.tmp`
+    `.${basename9(targetPath)}.${process.pid}.${randomBytes11(8).toString("hex")}.tmp`
   );
   let fd;
   try {
@@ -16977,7 +17992,7 @@ function atomicReplaceUtf8(targetPath, contents) {
       } catch {
       }
     }
-    if (existsSync16(tempPath)) {
+    if (existsSync17(tempPath)) {
       try {
         unlinkSync11(tempPath);
       } catch {
@@ -17088,6 +18103,19 @@ var JsonOutboundKeyDb = class {
       return true;
     });
   }
+  async outboundApiKeysSetUpstream(id, target) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      if (target === null) {
+        delete row.boundUpstream;
+        delete row.boundUpstreamProviderId;
+      } else {
+        row.boundUpstream = target;
+        delete row.boundUpstreamProviderId;
+      }
+      return true;
+    });
+  }
   async outboundApiKeysSetPolicy(id, policy) {
     return this.mutateRow(id, (row) => {
       if (row.revokedAt !== null) return false;
@@ -17130,7 +18158,7 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync17(this.keysPath)) return [];
+    if (!existsSync18(this.keysPath)) return [];
     try {
       const parsed = JSON.parse(readFileSync13(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
@@ -17149,8 +18177,8 @@ function applyPolicyField(row, field, value) {
 }
 
 // src/ports/JsonPricingStore.ts
-import { existsSync as existsSync18, readFileSync as readFileSync14, renameSync as renameSync10, rmSync as rmSync3, writeFileSync as writeFileSync13 } from "fs";
-import { randomUUID as randomUUID5 } from "crypto";
+import { existsSync as existsSync19, readFileSync as readFileSync14, renameSync as renameSync10, rmSync as rmSync3, writeFileSync as writeFileSync13 } from "fs";
+import { randomUUID as randomUUID6 } from "crypto";
 var JsonPricingStore = class {
   constructor(pricingPath) {
     this.pricingPath = pricingPath;
@@ -17164,7 +18192,7 @@ var JsonPricingStore = class {
    * otherwise unusable pricing table after a crash or manual file edit.
    */
   hasUsableSnapshot() {
-    if (!existsSync18(this.pricingPath)) return false;
+    if (!existsSync19(this.pricingPath)) return false;
     try {
       const parsed = JSON.parse(readFileSync14(this.pricingPath, "utf8"));
       return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
@@ -17279,7 +18307,7 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync18(this.pricingPath)) return [];
+    if (!existsSync19(this.pricingPath)) return [];
     try {
       const parsed = JSON.parse(readFileSync14(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
@@ -17288,7 +18316,7 @@ var JsonPricingStore = class {
     }
   }
   writeRows(rows) {
-    const temporaryPath = `${this.pricingPath}.${process.pid}.${randomUUID5()}.tmp`;
+    const temporaryPath = `${this.pricingPath}.${process.pid}.${randomUUID6()}.tmp`;
     try {
       writeFileSync13(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
         encoding: "utf8",
@@ -17311,7 +18339,7 @@ function isUsablePricingRow(value) {
 }
 
 // src/pricing/PricingRefreshScheduler.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15, renameSync as renameSync11, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync15, renameSync as renameSync11, writeFileSync as writeFileSync14 } from "fs";
 var EMPTY_STATE2 = {
   lastAttemptAt: null,
   lastSuccessAt: null,
@@ -17349,7 +18377,7 @@ var PricingRefreshScheduler = class {
     this.timer = null;
   }
   getState() {
-    if (!existsSync19(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    if (!existsSync20(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
     try {
       const value = JSON.parse(readFileSync15(this.statePath, "utf8"));
       return {
@@ -17414,7 +18442,7 @@ function finiteOrNull(value) {
 }
 
 // src/ports/JsonVoucherDb.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -17492,7 +18520,7 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync20(this.vouchersPath)) return [];
+    if (!existsSync21(this.vouchersPath)) return [];
     try {
       const parsed = JSON.parse(readFileSync16(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
@@ -17506,7 +18534,7 @@ var JsonVoucherDb = class {
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync6, readFileSync as readFileSync18, renameSync as renameSync12 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync6, readFileSync as readFileSync18, renameSync as renameSync12 } from "fs";
 import { dirname as dirname15 } from "path";
 import { getAntigravityProjectResolver as getAntigravityProjectResolver2 } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
 import { getSharedAccountHealth as getSharedAccountHealth2 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
@@ -17564,11 +18592,11 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join17 } from "path";
-function externalStorePath(provider, home = homedir4()) {
-  return provider === "claude" ? join17(home, ".claude", ".credentials.json") : join17(home, ".codex", "auth.json");
+import { existsSync as existsSync22, readFileSync as readFileSync17 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join18 } from "path";
+function externalStorePath(provider, home = homedir5()) {
+  return provider === "claude" ? join18(home, ".claude", ".credentials.json") : join18(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -17615,9 +18643,9 @@ function parseCodexTokensEnvelope(raw) {
   }
   return parsed;
 }
-function readExternalCliCredentials(provider, home = homedir4()) {
+function readExternalCliCredentials(provider, home = homedir5()) {
   const path2 = externalStorePath(provider, home);
-  if (!existsSync21(path2)) return null;
+  if (!existsSync22(path2)) return null;
   let raw;
   try {
     const parsed = JSON.parse(readFileSync17(path2, "utf8"));
@@ -18424,7 +19452,7 @@ var JsonSubscriptionCredentialStore = class {
    * its parse try.
    */
   readConfig() {
-    if (!existsSync22(this.tokensPath)) return { updatedAt: "" };
+    if (!existsSync23(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
       const raw = JSON.parse(readFileSync18(this.tokensPath, "utf8"));
@@ -19001,14 +20029,14 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-import { createReadStream as createReadStream3, createWriteStream as createWriteStream2, existsSync as existsSync25, readdirSync as readdirSync6, rmSync as rmSync4, unlinkSync as unlinkSync13 } from "fs";
-import { join as join20 } from "path";
+import { createReadStream as createReadStream3, createWriteStream as createWriteStream2, existsSync as existsSync26, readdirSync as readdirSync6, rmSync as rmSync4, unlinkSync as unlinkSync13 } from "fs";
+import { join as join21 } from "path";
 import { pipeline } from "stream/promises";
 import { createGzip } from "zlib";
 
 // src/audit/auditDictionary.ts
-import { existsSync as existsSync23, readdirSync as readdirSync4, readFileSync as readFileSync19, renameSync as renameSync13, unlinkSync as unlinkSync12, writeFileSync as writeFileSync16 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync4, readFileSync as readFileSync19, renameSync as renameSync13, unlinkSync as unlinkSync12, writeFileSync as writeFileSync16 } from "fs";
+import { join as join19 } from "path";
 
 // src/audit/auditBodyStore.ts
 var ANCHOR_EVERY = 64;
@@ -19264,10 +20292,10 @@ function chooseDictionary(anchors) {
 }
 var EMPTY = { shards: 0, anchors: 0, savedBytes: 0 };
 function compactAuditDay(dayPath) {
-  const bodiesPath = join18(dayPath, AUDIT_BODIES_DIR);
-  if (!existsSync23(bodiesPath)) return EMPTY;
-  const dictPath = join18(bodiesPath, AUDIT_DICT_FILE);
-  if (existsSync23(dictPath) || existsSync23(`${dictPath}.gz`)) return EMPTY;
+  const bodiesPath = join19(dayPath, AUDIT_BODIES_DIR);
+  if (!existsSync24(bodiesPath)) return EMPTY;
+  const dictPath = join19(bodiesPath, AUDIT_DICT_FILE);
+  if (existsSync24(dictPath) || existsSync24(`${dictPath}.gz`)) return EMPTY;
   const shardFiles = plainShards(bodiesPath);
   if (shardFiles.length < 2) return EMPTY;
   const loaded = /* @__PURE__ */ new Map();
@@ -19275,7 +20303,7 @@ function compactAuditDay(dayPath) {
   for (const file of shardFiles) {
     let entries;
     try {
-      entries = parseEntries(readFileSync19(join18(bodiesPath, file), "utf8"));
+      entries = parseEntries(readFileSync19(join19(bodiesPath, file), "utf8"));
     } catch {
       continue;
     }
@@ -19309,14 +20337,14 @@ function compactAuditDay(dayPath) {
       };
     });
     if (!changed) continue;
-    const target = join18(bodiesPath, file);
+    const target = join19(bodiesPath, file);
     const temp = `${target}.compacting`;
     try {
       writeFileSync16(temp, rewritten.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf8");
       renameSync13(temp, target);
     } catch {
       try {
-        if (existsSync23(temp)) unlinkSync12(temp);
+        if (existsSync24(temp)) unlinkSync12(temp);
       } catch {
       }
       continue;
@@ -19335,7 +20363,7 @@ function compactAuditDay(dayPath) {
 }
 function compactAllClosedAuditDays(auditDir, now = Date.now) {
   const run = { days: 0, shards: 0, savedBytes: 0 };
-  if (!existsSync23(auditDir)) return run;
+  if (!existsSync24(auditDir)) return run;
   const today = auditDayDirName(now());
   let names;
   try {
@@ -19346,7 +20374,7 @@ function compactAllClosedAuditDays(auditDir, now = Date.now) {
   for (const name of names) {
     if (name === today) continue;
     try {
-      const result = compactAuditDay(join18(auditDir, name));
+      const result = compactAuditDay(join19(auditDir, name));
       if (result.shards === 0) continue;
       run.days += 1;
       run.shards += result.shards;
@@ -19360,13 +20388,13 @@ function compactAllClosedAuditDays(auditDir, now = Date.now) {
 // src/audit/auditStats.ts
 import {
   createReadStream as createReadStream2,
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   readFileSync as readFileSync20,
   readdirSync as readdirSync5,
   statSync as statSync5,
   writeFileSync as writeFileSync17
 } from "fs";
-import { basename as basename9, dirname as dirname16, join as join19 } from "path";
+import { basename as basename10, dirname as dirname16, join as join20 } from "path";
 var SIDECAR_VERSION = 1;
 var META_PREFIX_BYTES = 64 * 1024;
 var READ_CHUNK_BYTES2 = 4 * 1024 * 1024;
@@ -19374,7 +20402,7 @@ function auditStatsFileName(auditFile) {
   return auditFile.replace(/\.jsonl$/, ".stats.json");
 }
 function readPersisted(path2) {
-  if (!existsSync24(path2)) return null;
+  if (!existsSync25(path2)) return null;
   try {
     const value = JSON.parse(readFileSync20(path2, "utf8"));
     if (value.version !== SIDECAR_VERSION || !Number.isSafeInteger(value.auditBytes) || (value.auditBytes ?? -1) < 0 || !Number.isSafeInteger(value.requestCount) || (value.requestCount ?? -1) < 0 || !Number.isSafeInteger(value.errorCount) || (value.errorCount ?? -1) < 0 || (value.errorCount ?? 0) > (value.requestCount ?? -1) || typeof value.complete !== "boolean" || value.minTs !== null && !Number.isFinite(value.minTs) || value.maxTs !== null && !Number.isFinite(value.maxTs)) {
@@ -19386,7 +20414,7 @@ function readPersisted(path2) {
   }
 }
 function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfter, record) {
-  const statsPath = join19(dirname16(auditPath), auditStatsFileName(basename9(auditPath)));
+  const statsPath = join20(dirname16(auditPath), auditStatsFileName(basename10(auditPath)));
   const previous = auditBytesBefore === 0 ? {
     version: SIDECAR_VERSION,
     auditBytes: 0,
@@ -19517,20 +20545,20 @@ function mergePersistedStats(previous, appended) {
   };
 }
 async function readAuditStats(auditDir, query2 = {}) {
-  if (!existsSync24(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
+  if (!existsSync25(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   let sources;
   try {
     sources = readdirSync5(auditDir).filter((name) => fileOverlaps(name, from, to)).sort().map(
       (name) => AUDIT_DAY_DIR_RE.test(name) ? {
-        auditPath: join19(auditDir, name, AUDIT_META_FILE),
-        statsPath: join19(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
+        auditPath: join20(auditDir, name, AUDIT_META_FILE),
+        statsPath: join20(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
       } : {
-        auditPath: join19(auditDir, name),
-        statsPath: join19(auditDir, auditStatsFileName(name))
+        auditPath: join20(auditDir, name),
+        statsPath: join20(auditDir, auditStatsFileName(name))
       }
-    ).filter((source) => existsSync24(source.auditPath));
+    ).filter((source) => existsSync25(source.auditPath));
   } catch {
     return { requestCount: 0, errorCount: 0, complete: false };
   }
@@ -19628,7 +20656,7 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!existsSync25(this.auditDir)) return 0;
+      if (!existsSync26(this.auditDir)) return 0;
       const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS4;
       let removed = 0;
       for (const name of readdirSync6(this.auditDir)) {
@@ -19636,11 +20664,11 @@ var AuditPruneSweeper = class {
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
           if (isAuditDayDir(name)) {
-            rmSync4(join20(this.auditDir, name), { recursive: true, force: true });
+            rmSync4(join21(this.auditDir, name), { recursive: true, force: true });
           } else {
-            unlinkSync13(join20(this.auditDir, name));
-            const statsPath = join20(this.auditDir, auditStatsFileName(name));
-            if (existsSync25(statsPath)) unlinkSync13(statsPath);
+            unlinkSync13(join21(this.auditDir, name));
+            const statsPath = join21(this.auditDir, auditStatsFileName(name));
+            if (existsSync26(statsPath)) unlinkSync13(statsPath);
           }
           removed += 1;
         } catch (error) {
@@ -19670,14 +20698,14 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.archiving) return 0;
     this.archiving = true;
     try {
-      if (!existsSync25(this.auditDir)) return 0;
+      if (!existsSync26(this.auditDir)) return 0;
       const today = this.todayMidnight();
       let compressed = 0;
       for (const name of readdirSync6(this.auditDir)) {
         if (compressed >= ARCHIVE_BATCH) break;
         const dateMs = auditFileDateMs(name);
         if (dateMs === null || dateMs >= today || !isAuditDayDir(name)) continue;
-        const dayPath = join20(this.auditDir, name);
+        const dayPath = join21(this.auditDir, name);
         try {
           const compaction = compactAuditDay(dayPath);
           if (compaction.shards > 0) {
@@ -19695,7 +20723,7 @@ var AuditPruneSweeper = class {
           });
         }
         compressed += await this.archiveDay(
-          join20(dayPath, AUDIT_BODIES_DIR),
+          join21(dayPath, AUDIT_BODIES_DIR),
           ARCHIVE_BATCH - compressed
         );
       }
@@ -19721,10 +20749,10 @@ var AuditPruneSweeper = class {
     let compressed = 0;
     for (const shard of shards) {
       if (compressed >= budget) break;
-      const source = join20(bodiesPath, shard);
+      const source = join21(bodiesPath, shard);
       const target = `${source}.gz`;
       try {
-        if (existsSync25(target)) {
+        if (existsSync26(target)) {
           unlinkSync13(source);
           continue;
         }
@@ -19733,7 +20761,7 @@ var AuditPruneSweeper = class {
         compressed += 1;
       } catch (error) {
         try {
-          if (existsSync25(target)) unlinkSync13(target);
+          if (existsSync26(target)) unlinkSync13(target);
         } catch {
         }
         this.logger.warn("[AuditPruneSweeper] failed to archive audit body shard", {
@@ -19748,8 +20776,8 @@ var AuditPruneSweeper = class {
 
 // src/usage/usageMigrate.ts
 import { createReadStream as createReadStream4 } from "fs";
-import { mkdir as mkdir2, open as open3, readdir as readdir2, rename as rename2, rm, stat, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
-import { join as join21 } from "path";
+import { mkdir as mkdir2, open as open4, readdir as readdir3, rename as rename3, rm, stat as stat2, unlink as unlink3, writeFile as writeFile3 } from "fs/promises";
+import { join as join22 } from "path";
 import { createInterface } from "readline";
 var FLUSH_BYTES = 4 * 1024 * 1024;
 async function writeLine(writer2, line) {
@@ -19773,14 +20801,14 @@ var IDLE = {
 };
 async function migrateLegacyUsageEvents(opts) {
   const { eventsPath, usageDir, logger } = opts;
-  const legacy = await stat(eventsPath).catch(() => null);
+  const legacy = await stat2(eventsPath).catch(() => null);
   if (!legacy || !legacy.isFile()) return IDLE;
   if (legacy.size === 0) {
-    await unlink2(eventsPath).catch(() => {
+    await unlink3(eventsPath).catch(() => {
     });
     return { ...IDLE, migrated: true };
   }
-  const scratch = join21(usageDir, USAGE_MIGRATING_DIR);
+  const scratch = join22(usageDir, USAGE_MIGRATING_DIR);
   logger?.info("[usage] migrating legacy usage-events.jsonl into day shards", {
     bytes: legacy.size
   });
@@ -19809,7 +20837,7 @@ async function migrateLegacyUsageEvents(opts) {
       let writer2 = writers.get(dayKey);
       if (!writer2) {
         writer2 = {
-          handle: await open3(join21(scratch, usageShardName(dayKey)), "a"),
+          handle: await open4(join22(scratch, usageShardName(dayKey)), "a"),
           buffer: [],
           bytes: 0
         };
@@ -19839,17 +20867,17 @@ async function migrateLegacyUsageEvents(opts) {
   const today = usageDayKey(opts.now ?? Date.now());
   for (const [dayKey, acc] of rollups) {
     if (dayKey === today) continue;
-    const size = await stat(join21(scratch, usageShardName(dayKey))).then((s) => s.size).catch(() => null);
+    const size = await stat2(join22(scratch, usageShardName(dayKey))).then((s) => s.size).catch(() => null);
     if (size === null) continue;
-    await writeFile2(
-      join21(scratch, usageRollupName(dayKey)),
+    await writeFile3(
+      join22(scratch, usageRollupName(dayKey)),
       JSON.stringify(acc.finish(dayKey, size)),
       "utf8"
     );
   }
   await mkdir2(usageDir, { recursive: true });
-  const staged = await readdir2(scratch);
-  const existing = new Set(await readdir2(usageDir).catch(() => []));
+  const staged = await readdir3(scratch);
+  const existing = new Set(await readdir3(usageDir).catch(() => []));
   const collisions = staged.filter((name) => existing.has(name));
   if (collisions.length > 0) {
     const reason = `refusing to overwrite existing shards in ${usageDir} (${collisions.slice(0, 3).join(", ")}${collisions.length > 3 ? ", \u2026" : ""}); a previous migration may have partially committed \u2014 move or remove them and restart`;
@@ -19859,11 +20887,11 @@ async function migrateLegacyUsageEvents(opts) {
     return { ...IDLE, linesRead, rowsWritten, skipped, reason };
   }
   for (const name of staged) {
-    await rename2(join21(scratch, name), join21(usageDir, name));
+    await rename3(join22(scratch, name), join22(usageDir, name));
   }
   await rm(scratch, { recursive: true, force: true }).catch(() => {
   });
-  await unlink2(eventsPath);
+  await unlink3(eventsPath);
   const days = rollups.size;
   logger?.info("[usage] migration complete; legacy usage-events.jsonl removed", {
     linesRead,
@@ -19884,8 +20912,8 @@ async function closeAll(writers) {
 }
 
 // src/usage/UsagePruneSweeper.ts
-import { unlink as unlink3 } from "fs/promises";
-import { join as join22 } from "path";
+import { unlink as unlink4 } from "fs/promises";
+import { join as join23 } from "path";
 var DAY_MS5 = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS3 = 60 * 6e4;
 var DEFAULT_USAGE_RETENTION_DAYS = 90;
@@ -19966,7 +20994,7 @@ var UsagePruneSweeper = class {
           continue;
         }
         try {
-          await unlink3(join22(this.usageDir, usageShardName(entry.dayKey)));
+          await unlink4(join23(this.usageDir, usageShardName(entry.dayKey)));
           removed += 1;
         } catch (error) {
           this.logger.warn("[usage] retention: could not remove expired shard", {
@@ -20001,8 +21029,8 @@ var UsagePruneSweeper = class {
 };
 
 // src/audit/auditBodyReader.ts
-import { existsSync as existsSync26, readdirSync as readdirSync7, readFileSync as readFileSync21, statSync as statSync7 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync7, readFileSync as readFileSync21, statSync as statSync7 } from "fs";
+import { join as join24 } from "path";
 import { gunzipSync } from "zlib";
 
 // src/audit/auditJsonl.ts
@@ -20065,7 +21093,7 @@ function forEachLineFromTail(path2, onLine) {
 function candidateDays(auditDir, ts) {
   if (typeof ts === "number" && Number.isFinite(ts)) {
     const named = auditDayDirName(ts);
-    if (existsSync26(join23(auditDir, named))) return [named];
+    if (existsSync27(join24(auditDir, named))) return [named];
   }
   try {
     return readdirSync7(auditDir).filter(isAuditDayDir).sort().reverse();
@@ -20074,11 +21102,11 @@ function candidateDays(auditDir, ts) {
   }
 }
 function readShard(auditDir, day, sessionKey) {
-  const base = join23(auditDir, day, AUDIT_BODIES_DIR, auditBodyFileName(sessionKey));
+  const base = join24(auditDir, day, AUDIT_BODIES_DIR, auditBodyFileName(sessionKey));
   try {
-    if (existsSync26(base)) return readFileSync21(base, "utf8");
+    if (existsSync27(base)) return readFileSync21(base, "utf8");
     const gz = `${base}.gz`;
-    if (existsSync26(gz)) return gunzipSync(readFileSync21(gz)).toString("utf8");
+    if (existsSync27(gz)) return gunzipSync(readFileSync21(gz)).toString("utf8");
   } catch {
     return null;
   }
@@ -20108,11 +21136,11 @@ function withDictionary(auditDir, day, entries) {
     }
   }
   if (!needed) return entries;
-  const base = join23(auditDir, day, AUDIT_BODIES_DIR, AUDIT_DICT_FILE);
+  const base = join24(auditDir, day, AUDIT_BODIES_DIR, AUDIT_DICT_FILE);
   let raw = null;
   try {
-    if (existsSync26(base)) raw = readFileSync21(base, "utf8");
-    else if (existsSync26(`${base}.gz`)) raw = gunzipSync(readFileSync21(`${base}.gz`)).toString("utf8");
+    if (existsSync27(base)) raw = readFileSync21(base, "utf8");
+    else if (existsSync27(`${base}.gz`)) raw = gunzipSync(readFileSync21(`${base}.gz`)).toString("utf8");
   } catch {
     return entries;
   }
@@ -20145,7 +21173,7 @@ function reconstructRequest(entries, entry) {
 }
 function readAuditBody(auditDir, query2) {
   if (!isSafeSessionKey(query2.sessionKey) || !query2.id) return {};
-  if (!existsSync26(auditDir)) return {};
+  if (!existsSync27(auditDir)) return {};
   for (const day of candidateDays(auditDir, query2.ts)) {
     const raw = readShard(auditDir, day, query2.sessionKey);
     if (raw === null) continue;
@@ -20170,7 +21198,7 @@ function readLegacyInlineBody(auditDir, id) {
   const needle = JSON.stringify(id);
   let found = {};
   for (const name of names) {
-    forEachLineFromTail(join23(auditDir, name), (line) => {
+    forEachLineFromTail(join24(auditDir, name), (line) => {
       if (!line.includes(needle)) return false;
       let parsed;
       try {
@@ -20192,8 +21220,8 @@ function readLegacyInlineBody(auditDir, id) {
 }
 
 // src/audit/auditReader.ts
-import { existsSync as existsSync27, readdirSync as readdirSync8 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync8 } from "fs";
+import { join as join25 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
 var OVERSCAN = 256;
@@ -20209,10 +21237,10 @@ function daySources(auditDir) {
     const dateMs = auditFileDateMs(name);
     if (dateMs === null) continue;
     if (AUDIT_DAY_DIR_RE.test(name)) {
-      const path2 = join24(auditDir, name, AUDIT_META_FILE);
-      if (existsSync27(path2)) sources.push({ path: path2, dateMs });
+      const path2 = join25(auditDir, name, AUDIT_META_FILE);
+      if (existsSync28(path2)) sources.push({ path: path2, dateMs });
     } else if (AUDIT_FILE_RE.test(name)) {
-      sources.push({ path: join24(auditDir, name), dateMs });
+      sources.push({ path: join25(auditDir, name), dateMs });
     }
   }
   return sources.sort((a, b) => b.dateMs - a.dateMs);
@@ -20228,7 +21256,7 @@ function toMetaRecord(record) {
   return { ...meta, hasBody: true };
 }
 function readAuditRecords(auditDir, query2 = {}) {
-  if (!existsSync27(auditDir)) return [];
+  if (!existsSync28(auditDir)) return [];
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
@@ -20256,8 +21284,8 @@ function readAuditRecords(auditDir, query2 = {}) {
 }
 
 // src/audit/AuditWriter.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync28, mkdirSync as mkdirSync7, statSync as statSync8 } from "fs";
-import { join as join25 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync29, mkdirSync as mkdirSync7, statSync as statSync8 } from "fs";
+import { join as join26 } from "path";
 var AuditWriter = class {
   constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
     this.auditDir = auditDir;
@@ -20297,7 +21325,7 @@ var AuditWriter = class {
    */
   appendNow(record) {
     const dayDir = auditDayDirName(record.ts);
-    const dayPath = this.ensureDir(join25(this.auditDir, dayDir));
+    const dayPath = this.ensureDir(join26(this.auditDir, dayDir));
     this.appendMeta(dayPath, record);
     this.appendBody(dayPath, dayDir, record);
   }
@@ -20312,9 +21340,9 @@ var AuditWriter = class {
   /** Write the body-free metadata line + refresh the exact-count sidecar. */
   appendMeta(dayPath, record) {
     const { requestBody: _req, responseBody: _res, ...meta } = record;
-    const file = join25(dayPath, AUDIT_META_FILE);
+    const file = join26(dayPath, AUDIT_META_FILE);
     const line = JSON.stringify(meta) + "\n";
-    const bytesBefore = existsSync28(file) ? statSync8(file).size : 0;
+    const bytesBefore = existsSync29(file) ? statSync8(file).size : 0;
     appendFileSync2(file, line, "utf8");
     try {
       updateAuditStatsAfterAppend(
@@ -20346,8 +21374,8 @@ var AuditWriter = class {
     try {
       const line = encodeBodyEntry(record, sessionKey, dayDir, this.bases);
       if (line === null) return;
-      const bodiesPath = this.ensureDir(join25(dayPath, AUDIT_BODIES_DIR));
-      appendFileSync2(join25(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
+      const bodiesPath = this.ensureDir(join26(dayPath, AUDIT_BODIES_DIR));
+      appendFileSync2(join26(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
     } catch (error) {
       this.bases.forget(sessionKey);
       this.logger.warn("[AuditWriter] failed to append audit body shard", {
@@ -20361,7 +21389,7 @@ var AuditWriter = class {
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync8 } from "fs";
 import { createHmac as createHmac5 } from "crypto";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 import { fetchUpstream as fetchUpstream14 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -20432,7 +21460,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join26(this.billingDir, billingFileName(event.ts));
+    const file = join27(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -20482,7 +21510,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join26(this.billingDir, deliveredFileName(event.ts));
+      const file = join27(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -20498,11 +21526,11 @@ var BillingPublisher = class {
 };
 
 // src/billing/billingReader.ts
-import { existsSync as existsSync29, readdirSync as readdirSync9, readFileSync as readFileSync22 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync9, readFileSync as readFileSync22 } from "fs";
+import { join as join28 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!existsSync29(billingDir)) return view;
+  if (!existsSync30(billingDir)) return view;
   let files;
   try {
     files = readdirSync9(billingDir);
@@ -20536,7 +21564,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync22(join27(dir, file), "utf8");
+    raw = readFileSync22(join28(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -21348,6 +22376,7 @@ function buildDaemon(config, paths) {
   });
   const auditDir = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
+  const codexSessionManager = new CodexSessionManager();
   const adminServer = new AdminServer({
     configPath: paths.configPath,
     llmConfig,
@@ -21445,6 +22474,10 @@ function buildDaemon(config, paths) {
     cliTerminalOpener: paths.cliTerminalOpener,
     cliPathProbe: paths.cliPathProbe,
     cliCommandRunner: paths.cliCommandRunner,
+    // One helper invocation shared by the integration install and KEY-SCOPED
+    // launches (the latter append `--key-id` per spawn) — same entrypoint, same
+    // config/master-key resolution, so the two paths can never drift.
+    codexAuthHelper: currentProcessCodexAuthHelper(paths.configPath, paths.masterKeyFilePath),
     integrationManagerFactory: () => {
       const live = outboundApiServer.getStatus();
       const port = live.port || decryptedConfig.server?.port || DEFAULT_OUTBOUND_PORT;
@@ -21489,7 +22522,8 @@ function buildDaemon(config, paths) {
     auditCompactor: () => compactAllClosedAuditDays(auditDir),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
-    billingStatusReader: () => readBillingStatus(billingDir)
+    billingStatusReader: () => readBillingStatus(billingDir),
+    codexSessionManager
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
@@ -21555,6 +22589,7 @@ function buildDaemon(config, paths) {
     pricingEngine,
     pricingRefreshScheduler,
     usageRecorder,
+    codexSessionManager,
     adminServer,
     tokenRefreshScheduler,
     accountHealthSweeper,
@@ -21590,7 +22625,7 @@ function resetDaemonSingletonsForTests() {
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!existsSync30(tokensPath)) return true;
+    if (!existsSync31(tokensPath)) return true;
     accessSync(tokensPath, fsConstants.R_OK);
     return true;
   } catch {
@@ -21695,6 +22730,8 @@ function mapCcrToOmnicross(ccr) {
 }
 export {
   AdminServer,
+  CodexSessionManager,
+  CodexSessionManagerError,
   ConfigFileProviderConfigSource,
   ConfigurableLogger,
   ConsoleLogger,
@@ -21714,6 +22751,7 @@ export {
   loadConfig,
   mapCcrToOmnicross,
   parseCcrConfig,
+  replaceStructuredProviderFields,
   resetDaemonSingletonsForTests,
   resolveAdminConfig,
   saveConfig,