@rynfar/meridian 1.41.0 → 1.42.0

package/dist/{cli-swjr844z.js → cli-kvwnarfk.js}

@@ -5,7 +5,7 @@ import {
   resolveProfile,
   restoreActiveProfile,
   setActiveProfile
-} from "./cli-vdp9s10c.js";
+} from "./cli-cx463q74.js";
 import {
   isTrackedPlugin,
   recordError,
@@ -26,9 +26,12 @@ import {
 import {
   claudeLog,
   createPlatformCredentialStore,
+  ensureFreshToken,
   refreshOAuthToken,
+  startBackgroundRefresh,
+  stopBackgroundRefresh,
   withClaudeLogContext
-} from "./cli-0eky480v.js";
+} from "./cli-7k1fcprd.js";
 import {
   __commonJS,
   __esm,
@@ -1178,14 +1181,14 @@ __export(exports_sdkFeatures, {
   getFeaturesForAdapter: () => getFeaturesForAdapter,
   getAllFeatureConfigs: () => getAllFeatureConfigs
 });
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync as renameSync2 } from "node:fs";
-import { join as join6 } from "node:path";
-import { homedir as homedir4 } from "node:os";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync as renameSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
 function getConfigPath() {
-  const dir = join6(homedir4(), ".config", "meridian");
-  if (!existsSync5(dir))
+  const dir = join5(homedir3(), ".config", "meridian");
+  if (!existsSync6(dir))
     mkdirSync2(dir, { recursive: true });
-  return join6(dir, "sdk-features.json");
+  return join5(dir, "sdk-features.json");
 }
 function readConfig() {
   const now = Date.now();
@@ -1193,7 +1196,7 @@ function readConfig() {
     return cachedConfig;
   const path3 = getConfigPath();
   try {
-    if (existsSync5(path3)) {
+    if (existsSync6(path3)) {
       cachedConfig = JSON.parse(readFileSync4(path3, "utf-8"));
     } else {
       cachedConfig = {};
@@ -1283,7 +1286,7 @@ function resetAdapterFeatures(adapterName) {
 var DEFAULT_FEATURES, ADAPTER_DEFAULTS, cachedConfig = null, lastReadTime = 0, CACHE_TTL_MS = 5000, VALID_CLAUDE_MD_VALUES, VALID_THINKING_VALUES;
 var init_sdkFeatures = __esm(() => {
   DEFAULT_FEATURES = {
-    codeSystemPrompt: false,
+    codeSystemPrompt: true,
     clientSystemPrompt: true,
     claudeMd: "off",
     memory: false,
@@ -1296,7 +1299,11 @@ var init_sdkFeatures = __esm(() => {
     sdkDebug: false,
     additionalDirectories: ""
   };
-  ADAPTER_DEFAULTS = {};
+  ADAPTER_DEFAULTS = {
+    passthrough: {
+      codeSystemPrompt: false
+    }
+  };
   VALID_CLAUDE_MD_VALUES = new Set(["off", "project", "full"]);
   VALID_THINKING_VALUES = new Set(["adaptive", "enabled", "disabled"]);
 });
@@ -3703,8 +3710,8 @@ var serve = (options, listeningListener) => {
 };
 
 // src/proxy/server.ts
-import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join6 } from "node:path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
 // src/proxy/rateLimitStore.ts
@@ -3784,8 +3791,8 @@ async function readAccessToken(store) {
   const creds = await store.read();
   return creds?.claudeAiOauth?.accessToken ?? null;
 }
-async function callAnthropic(token, signal) {
-  const res = await fetch(OAUTH_USAGE_URL, {
+async function callAnthropic(token, fetchImpl, signal) {
+  const res = await fetchImpl(OAUTH_USAGE_URL, {
     headers: {
       Authorization: `Bearer ${token}`,
       "anthropic-beta": OAUTH_BETA_HEADER,
@@ -3797,9 +3804,17 @@ async function callAnthropic(token, signal) {
     return { __status: res.status };
   return await res.json();
 }
+var _testOverride = null;
 async function fetchOAuthUsage(opts) {
+  if (_testOverride && !opts?.fetchImpl && !opts?.store) {
+    return _testOverride(opts);
+  }
+  return fetchOAuthUsageImpl(opts);
+}
+async function fetchOAuthUsageImpl(opts) {
   const ttl = opts?.ttlMs ?? CACHE_TTL_MS_DEFAULT;
   const cacheKey2 = opts?.profileId ?? DEFAULT_KEY;
+  const fetchImpl = opts?.fetchImpl ?? globalThis.fetch;
   if (!opts?.force) {
     const cached = cacheByProfile.get(cacheKey2);
     if (cached && Date.now() - cached.fetchedAt < ttl)
@@ -3814,7 +3829,7 @@ async function fetchOAuthUsage(opts) {
       const token = await readAccessToken(store);
       if (!token)
         return null;
-      let result = await callAnthropic(token);
+      let result = await callAnthropic(token, fetchImpl);
       if ("__status" in result && result.__status === 401) {
         claudeLog("oauth_usage.token_refresh_attempt", { profile: cacheKey2 });
         const refreshed = await refreshOAuthToken(store);
@@ -3825,7 +3840,7 @@ async function fetchOAuthUsage(opts) {
         const newToken = await readAccessToken(store);
         if (!newToken)
           return null;
-        result = await callAnthropic(newToken);
+        result = await callAnthropic(newToken, fetchImpl);
       }
       if ("__status" in result) {
         claudeLog("oauth_usage.upstream_error", { profile: cacheKey2, status: result.__status });
@@ -3845,6 +3860,17 @@ async function fetchOAuthUsage(opts) {
   return promise;
 }
 
+// src/proxy/cwd.ts
+import { existsSync } from "node:fs";
+function resolveSdkWorkingDirectory(opts) {
+  const exists = opts.exists ?? existsSync;
+  const claimed = opts.envOverride || opts.adapterCwd || opts.fallback;
+  if (exists(claimed)) {
+    return { workingDirectory: claimed, claimedWorkingDirectory: claimed, fellBack: false };
+  }
+  return { workingDirectory: opts.fallback, claimedWorkingDirectory: claimed, fellBack: true };
+}
+
 // src/proxy/types.ts
 var DEFAULT_PROXY_CONFIG = {
   port: 3456,
@@ -8443,7 +8469,7 @@ class MemoryDiagnosticLogStore {
 }
 var diagnosticLog = new MemoryDiagnosticLogStore;
 // src/telemetry/routes.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -8797,7 +8823,7 @@ timer = setInterval(refresh, 5000);
 
 // src/telemetry/routes.ts
 var _iconPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "assets", "icon.svg");
-var _iconSvg = existsSync(_iconPath) ? readFileSync(_iconPath, "utf-8") : null;
+var _iconSvg = existsSync2(_iconPath) ? readFileSync(_iconPath, "utf-8") : null;
 function createTelemetryRoutes() {
   const routes = new Hono2;
   routes.get("/", (c) => {
@@ -9135,7 +9161,13 @@ function classifyError(errMsg) {
 }
 function isExpiredTokenError(errMsg) {
   const lower = errMsg.toLowerCase();
-  return lower.includes("oauth token has expired") || lower.includes("not logged in");
+  if (lower.includes("oauth token has expired") || lower.includes("not logged in"))
+    return true;
+  if (lower.includes("invalid_token") || lower.includes("token_expired"))
+    return true;
+  if (lower.includes("401") && (lower.includes("authentication") || lower.includes("unauthorized") || lower.includes("invalid")))
+    return true;
+  return false;
 }
 function isStaleSessionError(error) {
   if (!(error instanceof Error))
@@ -9230,19 +9262,20 @@ function formatSdkTermination(t, ctx) {
 
 // src/proxy/models.ts
 import { exec as execCallback } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3, statSync } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { join as join2, dirname as dirname2 } from "path";
 import { promisify } from "util";
 var exec = promisify(execCallback);
+var STUB_SIZE_THRESHOLD = 4096;
 var CANONICAL_OPUS_MODEL = "claude-opus-4-7";
 var CANONICAL_SONNET_MODEL = "claude-sonnet-4-6";
 var CANONICAL_HAIKU_MODEL = "claude-haiku-4-5";
-function resolveSdkModelDefaults() {
+function resolveSdkModelDefaults(env2 = process.env) {
   return {
-    ANTHROPIC_DEFAULT_OPUS_MODEL: process.env.MERIDIAN_DEFAULT_OPUS_MODEL ?? CANONICAL_OPUS_MODEL,
-    ANTHROPIC_DEFAULT_SONNET_MODEL: process.env.MERIDIAN_DEFAULT_SONNET_MODEL ?? CANONICAL_SONNET_MODEL,
-    ANTHROPIC_DEFAULT_HAIKU_MODEL: process.env.MERIDIAN_DEFAULT_HAIKU_MODEL ?? CANONICAL_HAIKU_MODEL
+    ANTHROPIC_DEFAULT_OPUS_MODEL: env2.MERIDIAN_DEFAULT_OPUS_MODEL ?? CANONICAL_OPUS_MODEL,
+    ANTHROPIC_DEFAULT_SONNET_MODEL: env2.MERIDIAN_DEFAULT_SONNET_MODEL ?? CANONICAL_SONNET_MODEL,
+    ANTHROPIC_DEFAULT_HAIKU_MODEL: env2.MERIDIAN_DEFAULT_HAIKU_MODEL ?? CANONICAL_HAIKU_MODEL
   };
 }
 var AUTH_STATUS_CACHE_TTL_MS = 60000;
@@ -9372,42 +9405,112 @@ async function getClaudeAuthStatusAsync(profileId, envOverrides) {
       cachedAuthStatusPromise = null;
   }
 }
-var cachedClaudePath = null;
+var cachedClaudeInfo = null;
 var cachedClaudePathPromise = null;
+var DEFAULT_DEPS = {
+  existsSync: existsSync3,
+  statSync: (p) => statSync(p),
+  exec,
+  resolvePackage: (specifier) => fileURLToPath2(import.meta.resolve(specifier)),
+  envGet: (name) => process.env[name],
+  platform: process.platform,
+  arch: process.arch,
+  isBun: typeof process.versions.bun !== "undefined"
+};
+function tryEnvOverride(deps) {
+  const explicit = deps.envGet("MERIDIAN_CLAUDE_PATH");
+  if (!explicit)
+    return null;
+  return deps.existsSync(explicit) ? explicit : null;
+}
+function tryBundledBinary(deps) {
+  try {
+    const pkgPath = deps.resolvePackage("@anthropic-ai/claude-code/package.json");
+    const bundled = join2(dirname2(pkgPath), "bin", "claude.exe");
+    if (!deps.existsSync(bundled))
+      return null;
+    const size = deps.statSync(bundled).size;
+    if (size <= STUB_SIZE_THRESHOLD)
+      return null;
+    return bundled;
+  } catch {
+    return null;
+  }
+}
+function tryPlatformPackage(deps) {
+  const binName = deps.platform === "win32" ? "claude.exe" : "claude";
+  const candidates = [`@anthropic-ai/claude-code-${deps.platform}-${deps.arch}`];
+  if (deps.platform === "linux") {
+    candidates.push(`@anthropic-ai/claude-code-${deps.platform}-${deps.arch}-musl`);
+  }
+  for (const pkg of candidates) {
+    try {
+      const pkgJson = deps.resolvePackage(`${pkg}/package.json`);
+      const candidate = join2(dirname2(pkgJson), binName);
+      if (deps.existsSync(candidate))
+        return candidate;
+    } catch {}
+  }
+  return null;
+}
+async function tryPathLookup(deps) {
+  const cmd = deps.platform === "win32" ? "where claude" : "which claude";
+  try {
+    const { stdout } = await deps.exec(cmd);
+    const candidates = stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    for (const candidate of candidates) {
+      if (deps.platform === "win32" && candidate.startsWith("/"))
+        continue;
+      if (deps.existsSync(candidate))
+        return candidate;
+    }
+  } catch {}
+  return null;
+}
+function tryLegacySdkCliJs(deps) {
+  if (!deps.isBun)
+    return null;
+  try {
+    const sdkPath = deps.resolvePackage("@anthropic-ai/claude-agent-sdk");
+    const cliJs = join2(dirname2(sdkPath), "cli.js");
+    return deps.existsSync(cliJs) ? cliJs : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveClaudeExecutableWithSource(deps = DEFAULT_DEPS) {
+  const env2 = tryEnvOverride(deps);
+  if (env2)
+    return { path: env2, source: "env" };
+  const bundled = tryBundledBinary(deps);
+  if (bundled)
+    return { path: bundled, source: "bundled" };
+  const platformPkg = tryPlatformPackage(deps);
+  if (platformPkg)
+    return { path: platformPkg, source: "platform-package" };
+  const pathLookup = await tryPathLookup(deps);
+  if (pathLookup)
+    return { path: pathLookup, source: "path-lookup" };
+  const legacy = tryLegacySdkCliJs(deps);
+  if (legacy)
+    return { path: legacy, source: "legacy-cli-js" };
+  return null;
+}
+function getResolvedClaudeExecutableInfo() {
+  return cachedClaudeInfo;
+}
 async function resolveClaudeExecutableAsync() {
-  if (cachedClaudePath)
-    return cachedClaudePath;
+  if (cachedClaudeInfo)
+    return cachedClaudeInfo.path;
   if (cachedClaudePathPromise)
     return cachedClaudePathPromise;
   cachedClaudePathPromise = (async () => {
-    const runningUnderBun = typeof process.versions.bun !== "undefined";
-    try {
-      const pkgPath = fileURLToPath2(import.meta.resolve("@anthropic-ai/claude-code/package.json"));
-      const bundledBinary = join2(dirname2(pkgPath), "bin", "claude.exe");
-      if (existsSync2(bundledBinary)) {
-        cachedClaudePath = bundledBinary;
-        return bundledBinary;
-      }
-    } catch {}
-    try {
-      const { stdout } = await exec("which claude");
-      const claudePath = stdout.trim();
-      if (claudePath && existsSync2(claudePath)) {
-        cachedClaudePath = claudePath;
-        return claudePath;
-      }
-    } catch {}
-    if (runningUnderBun) {
-      try {
-        const sdkPath = fileURLToPath2(import.meta.resolve("@anthropic-ai/claude-agent-sdk"));
-        const sdkCliJs = join2(dirname2(sdkPath), "cli.js");
-        if (existsSync2(sdkCliJs)) {
-          cachedClaudePath = sdkCliJs;
-          return sdkCliJs;
-        }
-      } catch {}
+    const resolved = await resolveClaudeExecutableWithSource();
+    if (resolved) {
+      cachedClaudeInfo = resolved;
+      return resolved.path;
     }
-    throw new Error("Could not find Claude Code executable. Install via: npm install -g @anthropic-ai/claude-code");
+    throw new Error("Could not find Claude Code executable. Install via: npm install -g @anthropic-ai/claude-code, " + "or set MERIDIAN_CLAUDE_PATH=/path/to/claude to point at an existing binary.");
   })();
   try {
     return await cachedClaudePathPromise;
@@ -10285,6 +10388,10 @@ var DROID_ALLOWED_MCP_TOOLS = [
   `mcp__${DROID_MCP_SERVER_NAME}__glob`,
   `mcp__${DROID_MCP_SERVER_NAME}__grep`
 ];
+function resolveDroidPassthrough() {
+  const envVal = process.env.MERIDIAN_PASSTHROUGH ?? process.env.CLAUDE_PROXY_PASSTHROUGH;
+  return envVal === "1" || envVal === "true" || envVal === "yes";
+}
 var droidTransforms = [
   {
     name: "droid-core",
@@ -10296,7 +10403,7 @@ var droidTransforms = [
         incompatibleTools: CLAUDE_CODE_ONLY_TOOLS,
         allowedMcpTools: DROID_ALLOWED_MCP_TOOLS,
         sdkAgents: {},
-        passthrough: false,
+        passthrough: resolveDroidPassthrough(),
         leaksCwdViaSystemReminder: true
       };
     }
@@ -10367,7 +10474,8 @@ var droidAdapter = {
     return "";
   },
   usesPassthrough() {
-    return false;
+    const envVal = process.env.MERIDIAN_PASSTHROUGH ?? process.env.CLAUDE_PROXY_PASSTHROUGH;
+    return envVal === "1" || envVal === "true" || envVal === "yes";
   }
 };
 
@@ -10929,10 +11037,6 @@ function detectAdapter(c) {
   return defaultAdapter;
 }
 
-// src/proxy/query.ts
-import { join as join3 } from "node:path";
-import { homedir as homedir2 } from "node:os";
-
 // src/mcpTools.ts
 import { createSdkMcpServer as createSdkMcpServer2, tool } from "@anthropic-ai/claude-agent-sdk";
 import * as fs from "node:fs/promises";
@@ -16625,6 +16729,15 @@ function createOpencodeMcpServer() {
 }
 
 // src/proxy/query.ts
+function stripConfigDir(env2) {
+  if (!("CLAUDE_CONFIG_DIR" in env2))
+    return env2;
+  if (env2.CLAUDE_CODE_OAUTH_TOKEN)
+    return env2;
+  const out = { ...env2 };
+  delete out.CLAUDE_CONFIG_DIR;
+  return out;
+}
 function computePassthroughMaxTurns(resumeSessionId, hasDeferredTools, advisorModel) {
   const hasResume = !!resumeSessionId;
   const base = hasResume && hasDeferredTools ? 4 : 3;
@@ -16729,10 +16842,9 @@ function buildQueryOptions(ctx) {
       } : {},
       ...onStderr ? { stderr: onStderr } : {},
       env: {
-        ...cleanEnv,
+        ...sharedMemory ? stripConfigDir(cleanEnv) : cleanEnv,
         ENABLE_TOOL_SEARCH: hasDeferredTools ? "true" : "false",
         ...passthrough ? { ENABLE_CLAUDEAI_MCP_SERVERS: "false" } : {},
-        ...sharedMemory ? { CLAUDE_CONFIG_DIR: join3(homedir2(), ".claude") } : {},
         ...process.getuid?.() === 0 ? { IS_SANDBOX: "1" } : {}
       },
       ...Object.keys(sdkAgents).length > 0 ? { agents: sdkAgents } : {},
@@ -16766,8 +16878,9 @@ function getAdapterTransforms(adapterName) {
 }
 
 // src/proxy/plugins/loader.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
-import { join as join4, isAbsolute as isAbsolute2, extname } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, existsSync as existsSync4 } from "fs";
+import { join as join3, isAbsolute as isAbsolute2, extname } from "path";
+import { pathToFileURL } from "url";
 
 // src/proxy/plugins/validation.ts
 var KNOWN_ADAPTERS = ["opencode", "crush", "droid", "pi", "forgecode", "passthrough"];
@@ -16807,7 +16920,7 @@ function validateTransform(exported) {
 // src/proxy/plugins/loader.ts
 var loadCounter = 0;
 function parsePluginConfig(configPath) {
-  if (!existsSync3(configPath))
+  if (!existsSync4(configPath))
     return [];
   try {
     const raw2 = readFileSync2(configPath, "utf-8");
@@ -16820,7 +16933,7 @@ function parsePluginConfig(configPath) {
 async function loadPlugins(pluginDir, configPath) {
   resetAllPluginStats();
   const config = configPath ? parsePluginConfig(configPath) : [];
-  const pluginDirExists = existsSync3(pluginDir);
+  const pluginDirExists = existsSync4(pluginDir);
   let filenames = [];
   if (pluginDirExists) {
     try {
@@ -16851,7 +16964,7 @@ async function loadPlugins(pluginDir, configPath) {
   const loaded = [];
   const seenNames = new Set;
   for (const { filename, entry } of ordered) {
-    const filePath = isAbsolute2(filename) ? filename : join4(pluginDir, filename);
+    const filePath = isAbsolute2(filename) ? filename : join3(pluginDir, filename);
     if (entry && !entry.enabled) {
       loaded.push({
         name: filename,
@@ -16864,7 +16977,8 @@ async function loadPlugins(pluginDir, configPath) {
     }
     try {
       const cacheBuster = `?t=${Date.now()}-${++loadCounter}`;
-      const mod = await import(filePath + cacheBuster);
+      const specifier = process.platform === "win32" ? pathToFileURL(filePath).href + cacheBuster : filePath + cacheBuster;
+      const mod = await import(specifier);
       const exported = mod.default ?? mod;
       const transforms = Array.isArray(exported) ? exported : [exported];
       for (const item of transforms) {
@@ -17222,17 +17336,17 @@ function verifyLineage(cached, messages, cacheKey2, cache) {
 // src/proxy/sessionStore.ts
 import {
   closeSync,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   mkdirSync,
   openSync,
   readFileSync as readFileSync3,
   renameSync,
-  statSync,
+  statSync as statSync2,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
 var DEFAULT_MAX_STORED_SESSIONS = 1e4;
 var STALE_LOCK_THRESHOLD_MS = 30000;
 function getMaxStoredSessions() {
@@ -17256,7 +17370,7 @@ function acquireLock(lockPath) {
       return false;
     }
     try {
-      const stat = statSync(lockPath);
+      const stat = statSync2(lockPath);
       if (Date.now() - stat.mtimeMs > STALE_LOCK_THRESHOLD_MS) {
         unlinkSync(lockPath);
         const fd = openSync(lockPath, "wx");
@@ -17280,17 +17394,17 @@ var sessionDirOverride = null;
 var skipLocking = false;
 function getStorePath() {
   const dir = sessionDirOverride || process.env.MERIDIAN_SESSION_DIR || process.env.CLAUDE_PROXY_SESSION_DIR || getDefaultCacheDir();
-  if (!existsSync4(dir)) {
+  if (!existsSync5(dir)) {
     mkdirSync(dir, { recursive: true });
   }
-  return join5(dir, "sessions.json");
+  return join4(dir, "sessions.json");
 }
 function getDefaultCacheDir() {
-  const newDir = join5(homedir3(), ".cache", "meridian");
-  const oldDir = join5(homedir3(), ".cache", "opencode-claude-max-proxy");
-  if (existsSync4(newDir))
+  const newDir = join4(homedir2(), ".cache", "meridian");
+  const oldDir = join4(homedir2(), ".cache", "opencode-claude-max-proxy");
+  if (existsSync5(newDir))
     return newDir;
-  if (existsSync4(oldDir)) {
+  if (existsSync5(oldDir)) {
     try {
       const { symlinkSync } = __require("fs");
       symlinkSync(oldDir, newDir);
@@ -17303,7 +17417,7 @@ function getDefaultCacheDir() {
 }
 function readStore() {
   const path3 = getStorePath();
-  if (!existsSync4(path3))
+  if (!existsSync5(path3))
     return {};
   try {
     const data = readFileSync3(path3, "utf-8");
@@ -17805,8 +17919,8 @@ function createProxyServer(config = {}) {
   const sessionDiscoveredTools = new Map;
   const sessionToolCache = new Map;
   const sessionMcpCache = new LRUMap(getMaxSessionsLimit());
-  const pluginDir = finalConfig.pluginDir ?? join7(homedir5(), ".config", "meridian", "plugins");
-  const pluginConfigPath = finalConfig.pluginConfigPath ?? join7(homedir5(), ".config", "meridian", "plugins.json");
+  const pluginDir = finalConfig.pluginDir ?? join6(homedir4(), ".config", "meridian", "plugins");
+  const pluginConfigPath = finalConfig.pluginConfigPath ?? join6(homedir4(), ".config", "meridian", "plugins.json");
   let loadedPlugins = [];
   let pluginTransforms = [];
   const app = new Hono2;
@@ -17820,6 +17934,8 @@ function createProxyServer(config = {}) {
   app.use("/profiles", requireAuth);
   app.use("/plugins/*", requireAuth);
   app.use("/plugins", requireAuth);
+  app.use("/settings/*", requireAuth);
+  app.use("/settings", requireAuth);
   app.use("/auth/*", requireAuth);
   app.get("/", (c) => {
     const accept = c.req.header("accept") || "";
@@ -17872,18 +17988,33 @@ function createProxyServer(config = {}) {
         if (!Array.isArray(body.messages)) {
           return c.json({ type: "error", error: { type: "invalid_request_error", message: "messages: Field required" } }, 400);
         }
+        if (body.messages.length === 0) {
+          return c.json({ type: "error", error: { type: "invalid_request_error", message: "messages: Cannot be empty — at least one message is required" } }, 400);
+        }
         const profile = resolveProfile(finalConfig.profiles, finalConfig.defaultProfile, c.req.header("x-meridian-profile") || undefined);
         const authStatus = await getClaudeAuthStatusAsync(profile.id !== "default" ? profile.id : undefined, Object.keys(profile.env).length > 0 ? profile.env : undefined);
         const agentMode = c.req.header("x-opencode-agent-mode") ?? null;
         const requestSource = c.req.header("x-meridian-source")?.slice(0, 64) || undefined;
         let model = mapModelToClaudeModel(body.model || "sonnet", authStatus?.subscriptionType, agentMode);
-        const workingDirectory = (process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR) || adapter.extractWorkingDirectory(body) || process.cwd();
-        const clientWorkingDirectory = adapter.extractClientWorkingDirectory?.(body) || workingDirectory;
+        const cwdResolution = resolveSdkWorkingDirectory({
+          envOverride: process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR,
+          adapterCwd: adapter.extractWorkingDirectory(body),
+          fallback: process.cwd()
+        });
+        const workingDirectory = cwdResolution.workingDirectory;
+        if (cwdResolution.fellBack) {
+          claudeLog("cwd_fallback", {
+            claimed: cwdResolution.claimedWorkingDirectory,
+            usedInstead: workingDirectory
+          });
+        }
+        const clientWorkingDirectory = adapter.extractClientWorkingDirectory?.(body) || cwdResolution.claimedWorkingDirectory;
         const {
-          CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS,
           ANTHROPIC_API_KEY: _dropApiKey,
           ANTHROPIC_BASE_URL: _dropBaseUrl,
           ANTHROPIC_AUTH_TOKEN: _dropAuthToken,
+          CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS,
+          CLAUDE_CODE_USE_POWERSHELL_TOOL: _dropUsePowershell,
           ...cleanEnv
         } = process.env;
         const sdkModelDefaults = resolveSdkModelDefaults();
@@ -18142,7 +18273,7 @@ function createProxyServer(config = {}) {
           const upstreamStartAt = Date.now();
           let firstChunkAt;
           let currentSessionId;
-          const sdkUuidMap = cachedSession?.sdkMessageUuids ? [...cachedSession.sdkMessageUuids] : new Array(allMessages.length - 1).fill(null);
+          const sdkUuidMap = cachedSession?.sdkMessageUuids ? [...cachedSession.sdkMessageUuids] : [];
           while (sdkUuidMap.length < allMessages.length)
             sdkUuidMap.push(null);
           claudeLog("upstream.start", { mode: "non_stream", model });
@@ -18156,6 +18287,7 @@ function createProxyServer(config = {}) {
             const RATE_LIMIT_BASE_DELAY_MS = 1000;
             const response = async function* () {
               let rateLimitRetries = 0;
+              await ensureFreshToken().catch(() => {});
               let tokenRefreshed = false;
               while (true) {
                 let didYieldContent = false;
@@ -18187,7 +18319,7 @@ function createProxyServer(config = {}) {
                     taskBudget,
                     betas,
                     settingSources,
-                    codeSystemPrompt: sdkFeatures.codeSystemPrompt ? true : undefined,
+                    codeSystemPrompt: sdkFeatures.codeSystemPrompt,
                     clientSystemPrompt: sdkFeatures.clientSystemPrompt === false ? false : undefined,
                     memory: sdkFeatures.memory,
                     dreaming: sdkFeatures.dreaming,
@@ -18249,7 +18381,7 @@ function createProxyServer(config = {}) {
                       taskBudget,
                       betas,
                       settingSources,
-                      codeSystemPrompt: sdkFeatures.codeSystemPrompt ? true : undefined,
+                      codeSystemPrompt: sdkFeatures.codeSystemPrompt,
                       clientSystemPrompt: sdkFeatures.clientSystemPrompt === false ? false : undefined,
                       memory: sdkFeatures.memory,
                       dreaming: sdkFeatures.dreaming,
@@ -18360,6 +18492,12 @@ function createProxyServer(config = {}) {
                   lastStopReason = message.message.stop_reason;
                 }
               }
+              if (message.type === "result") {
+                const resultUsage = message.usage;
+                if (resultUsage) {
+                  lastUsage = { ...lastUsage, ...resultUsage };
+                }
+              }
             }
             claudeLog("upstream.completed", {
               mode: "non_stream",
@@ -18539,7 +18677,7 @@ Subprocess stderr: ${stderrOutput}`;
                 throw error;
               }
             };
-            const sdkUuidMap = cachedSession?.sdkMessageUuids ? [...cachedSession.sdkMessageUuids] : new Array(allMessages.length - 1).fill(null);
+            const sdkUuidMap = cachedSession?.sdkMessageUuids ? [...cachedSession.sdkMessageUuids] : [];
             while (sdkUuidMap.length < allMessages.length)
               sdkUuidMap.push(null);
             let messageStartEmitted = false;
@@ -18551,6 +18689,7 @@ Subprocess stderr: ${stderrOutput}`;
               const RATE_LIMIT_BASE_DELAY_MS = 1000;
               const response = async function* () {
                 let rateLimitRetries = 0;
+                await ensureFreshToken().catch(() => {});
                 let tokenRefreshed = false;
                 while (true) {
                   let didYieldClientEvent = false;
@@ -18582,7 +18721,7 @@ Subprocess stderr: ${stderrOutput}`;
                       taskBudget,
                       betas,
                       settingSources,
-                      codeSystemPrompt: sdkFeatures.codeSystemPrompt ? true : undefined,
+                      codeSystemPrompt: sdkFeatures.codeSystemPrompt,
                       clientSystemPrompt: sdkFeatures.clientSystemPrompt === false ? false : undefined,
                       memory: sdkFeatures.memory,
                       dreaming: sdkFeatures.dreaming,
@@ -18644,7 +18783,7 @@ Subprocess stderr: ${stderrOutput}`;
                         taskBudget,
                         betas,
                         settingSources,
-                        codeSystemPrompt: sdkFeatures.codeSystemPrompt ? true : undefined,
+                        codeSystemPrompt: sdkFeatures.codeSystemPrompt,
                         clientSystemPrompt: sdkFeatures.clientSystemPrompt === false ? false : undefined,
                         memory: sdkFeatures.memory,
                         dreaming: sdkFeatures.dreaming,
@@ -19368,6 +19507,7 @@ data: ${JSON.stringify({
           auth: { loggedIn: false }
         }, 503);
       }
+      const claudeExecutableInfo = getResolvedClaudeExecutableInfo();
       return c.json({
         status: "healthy",
         version: serverVersion,
@@ -19377,6 +19517,7 @@ data: ${JSON.stringify({
           subscriptionType: auth.subscriptionType
         },
         mode: envBool("PASSTHROUGH") ? "passthrough" : "internal",
+        ...claudeExecutableInfo ? { claudeExecutable: claudeExecutableInfo } : {},
         plugin: { opencode: checkPluginConfigured() ? "configured" : "not-configured" }
       });
     } catch {
@@ -19489,9 +19630,16 @@ data: ${JSON.stringify({
     if (!anthropicBody) {
       return c.json({ type: "error", error: { type: "invalid_request_error", message: "messages: Field required" } }, 400);
     }
+    const internalHeaders = { "Content-Type": "application/json" };
+    const xApiKey = c.req.header("x-api-key");
+    if (xApiKey)
+      internalHeaders["x-api-key"] = xApiKey;
+    const authz = c.req.header("authorization");
+    if (authz)
+      internalHeaders["authorization"] = authz;
     const internalReq = new Request("http://internal/v1/messages", {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: internalHeaders,
       body: JSON.stringify(anthropicBody)
     });
     const internalRes = await app.fetch(internalReq);
@@ -19770,6 +19918,10 @@ async function startProxyServer(config = {}) {
       console.log(`Telemetry dashboard: http://${finalConfig.host}:${info.port}/telemetry`);
       const pins = resolveSdkModelDefaults();
       console.log(`Model pins: opus=${pins.ANTHROPIC_DEFAULT_OPUS_MODEL} sonnet=${pins.ANTHROPIC_DEFAULT_SONNET_MODEL} haiku=${pins.ANTHROPIC_DEFAULT_HAIKU_MODEL}`);
+      const claudeInfo = getResolvedClaudeExecutableInfo();
+      if (claudeInfo) {
+        console.log(`Claude executable: ${claudeInfo.path} (resolved via ${claudeInfo.source})`);
+      }
       console.log(`
 Point any Anthropic-compatible tool at this endpoint:`);
       console.log(`  ANTHROPIC_API_KEY=x ANTHROPIC_BASE_URL=http://${finalConfig.host}:${info.port}`);
@@ -19791,6 +19943,7 @@ Or use a different port:`);
       console.error(`  MERIDIAN_PORT=4567 meridian`);
     }
   });
+  startBackgroundRefresh();
   let authKeepaliveInterval;
   const effectiveProfiles = getEffectiveProfiles(finalConfig.profiles);
   if (effectiveProfiles.length > 0) {
@@ -19814,6 +19967,7 @@ Or use a different port:`);
     async close() {
       if (authKeepaliveInterval)
         clearInterval(authKeepaliveInterval);
+      stopBackgroundRefresh();
       await new Promise((resolve3, reject) => {
         server.close((err) => err ? reject(err) : resolve3());
       });