@rynfar/meridian 1.52.0 → 1.54.0

package/dist/{cli-tq3vtp0q.js → cli-mqht6rs9.js}

@@ -23,6 +23,10 @@ import {
 } from "./cli-xmweegb1.js";
 import {
   CANONICAL_SONNET_MODEL,
+  OAUTH_CLIENT_ID,
+  OAUTH_REDIRECT_URI,
+  OAUTH_TOKEN_URL,
+  createManualOAuthSession,
   env,
   envBool,
   envInt,
@@ -34,12 +38,13 @@ import {
   init_env,
   isClosedControllerError,
   mapModelToClaudeModel,
+  parseAuthorizationCodeInput,
   recordExtendedContextUnavailable,
   resolveClaudeExecutableAsync,
   resolvePassthrough,
   resolveSdkModelDefaults,
   stripExtendedContext
-} from "./cli-vjeftz4z.js";
+} from "./cli-jhm27q0x.js";
 import {
   getSetting
 } from "./cli-340h1chz.js";
@@ -1482,13 +1487,13 @@ __export(exports_sdkFeatures, {
   getAllFeatureConfigs: () => getAllFeatureConfigs
 });
 import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, renameSync as renameSync3 } from "node:fs";
-import { join as join6 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { join as join7 } from "node:path";
+import { homedir as homedir6 } from "node:os";
 function getConfigPath2() {
-  const dir = join6(homedir5(), ".config", "meridian");
+  const dir = join7(homedir6(), ".config", "meridian");
   if (!existsSync7(dir))
     mkdirSync3(dir, { recursive: true });
-  return join6(dir, "sdk-features.json");
+  return join7(dir, "sdk-features.json");
 }
 function readConfig() {
   const now = Date.now();
@@ -1534,7 +1539,7 @@ function getExplicitThinking(adapterName) {
   return typeof explicit === "string" && VALID_THINKING_VALUES.has(explicit) ? explicit : undefined;
 }
 function getAllFeatureConfigs() {
-  const adapters = ["opencode", "crush", "forgecode", "pi", "droid", "passthrough", "openai"];
+  const adapters = ["opencode", "crush", "forgecode", "pi", "droid", "passthrough", "openai", "codex"];
   const result = {};
   for (const name of adapters) {
     result[name] = getFeaturesForAdapter(name);
@@ -1612,6 +1617,9 @@ var init_sdkFeatures = __esm(() => {
     },
     cherry: {
       codeSystemPrompt: false
+    },
+    codex: {
+      codeSystemPrompt: false
     }
   };
   VALID_CLAUDE_MD_VALUES = new Set(["off", "project", "full"]);
@@ -3638,6 +3646,112 @@ var cors = (options) => {
   };
 };
 
+// node_modules/hono/dist/utils/stream.js
+var StreamingApi = class {
+  writer;
+  encoder;
+  writable;
+  abortSubscribers = [];
+  responseReadable;
+  aborted = false;
+  closed = false;
+  constructor(writable, _readable) {
+    this.writable = writable;
+    this.writer = writable.getWriter();
+    this.encoder = new TextEncoder;
+    const reader = _readable.getReader();
+    this.abortSubscribers.push(async () => {
+      await reader.cancel();
+    });
+    this.responseReadable = new ReadableStream({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        done ? controller.close() : controller.enqueue(value);
+      },
+      cancel: () => {
+        this.abort();
+      }
+    });
+  }
+  async write(input) {
+    try {
+      if (typeof input === "string") {
+        input = this.encoder.encode(input);
+      }
+      await this.writer.write(input);
+    } catch {}
+    return this;
+  }
+  async writeln(input) {
+    await this.write(input + `
+`);
+    return this;
+  }
+  sleep(ms) {
+    return new Promise((res) => setTimeout(res, ms));
+  }
+  async close() {
+    try {
+      await this.writer.close();
+    } catch {}
+    this.closed = true;
+  }
+  async pipe(body) {
+    this.writer.releaseLock();
+    await body.pipeTo(this.writable, { preventClose: true });
+    this.writer = this.writable.getWriter();
+  }
+  onAbort(listener) {
+    this.abortSubscribers.push(listener);
+  }
+  abort() {
+    if (!this.aborted) {
+      this.aborted = true;
+      this.abortSubscribers.forEach((subscriber) => subscriber());
+    }
+  }
+};
+
+// node_modules/hono/dist/helper/streaming/utils.js
+var isOldBunVersion = () => {
+  const version = typeof Bun !== "undefined" ? Bun.version : undefined;
+  if (version === undefined) {
+    return false;
+  }
+  const result = version.startsWith("1.1") || version.startsWith("1.0") || version.startsWith("0.");
+  isOldBunVersion = () => result;
+  return result;
+};
+
+// node_modules/hono/dist/helper/streaming/stream.js
+var contextStash = /* @__PURE__ */ new WeakMap;
+var stream = (c, cb, onError) => {
+  const { readable, writable } = new TransformStream;
+  const stream2 = new StreamingApi(writable, readable);
+  if (isOldBunVersion()) {
+    c.req.raw.signal.addEventListener("abort", () => {
+      if (!stream2.closed) {
+        stream2.abort();
+      }
+    });
+  }
+  contextStash.set(stream2.responseReadable, c);
+  (async () => {
+    try {
+      await cb(stream2);
+    } catch (e) {
+      if (e === undefined) {} else if (e instanceof Error && onError) {
+        await onError(e, stream2);
+      } else {
+        console.error(e);
+      }
+    } finally {
+      stream2.close();
+    }
+  })();
+  return c.newResponse(stream2.responseReadable);
+};
+
 // node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
 import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
@@ -3918,13 +4032,13 @@ function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromi
     }
   }
 }
-function writeFromReadableStream(stream, writable) {
-  if (stream.locked) {
+function writeFromReadableStream(stream2, writable) {
+  if (stream2.locked) {
     throw new TypeError("ReadableStream is locked.");
   } else if (writable.destroyed) {
     return;
   }
-  return writeFromReadableStreamDefaultReader(stream.getReader(), writable);
+  return writeFromReadableStreamDefaultReader(stream2.getReader(), writable);
 }
 var buildOutgoingHttpHeaders = (headers) => {
   const res = {};
@@ -4189,8 +4303,8 @@ var serve = (options, listeningListener) => {
 };
 
 // src/proxy/server.ts
-import { homedir as homedir6 } from "node:os";
-import { join as join7 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
 // src/proxy/rateLimitStore.ts
@@ -4539,7 +4653,7 @@ function createRequestContext(params) {
 }
 // src/proxy/server.ts
 import { exec as execCallback } from "child_process";
-import { promisify as promisify2 } from "util";
+import { promisify as promisify3 } from "util";
 import { randomUUID } from "crypto";
 
 // src/proxy/passthroughTools.ts
@@ -10271,6 +10385,217 @@ function formatSdkTermination(t, ctx) {
   return `sdk_termination ${parts.join(" ")}`;
 }
 
+// src/proxy/design.ts
+import { homedir as homedir3 } from "node:os";
+import { join as join3, dirname as dirname3 } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+var DESIGN_SCOPES = ["user:design:read", "user:design:write"];
+var DESIGN_UPSTREAM_ORIGIN = "https://api.anthropic.com";
+var EXPIRY_SKEW_MS = 60000;
+var LOGIN_SESSION_TTL_MS = 10 * 60 * 1000;
+function defaultDesignTokenPath() {
+  return process.env.MERIDIAN_DESIGN_TOKEN_PATH || join3(homedir3(), ".config", "meridian", "design-token.json");
+}
+function createFileDesignTokenStore(path = defaultDesignTokenPath()) {
+  return {
+    async read() {
+      try {
+        const raw2 = await readFile(path, "utf-8");
+        const data = JSON.parse(raw2);
+        if (typeof data.accessToken === "string" && typeof data.expiresAt === "number") {
+          return data;
+        }
+        return null;
+      } catch {
+        return null;
+      }
+    },
+    async write(data) {
+      await mkdir(dirname3(path), { recursive: true });
+      await writeFile(path, JSON.stringify(data), { mode: 384 });
+    }
+  };
+}
+function isDesignTokenFresh(data, now = Date.now()) {
+  return data.expiresAt > now + EXPIRY_SKEW_MS;
+}
+async function getDesignAccessToken(opts) {
+  const now = opts.now ?? Date.now();
+  const fetchFn = opts.fetchFn ?? fetch;
+  const data = await opts.store.read();
+  if (!data)
+    return null;
+  if (isDesignTokenFresh(data, now))
+    return data.accessToken;
+  if (!data.refreshToken)
+    return null;
+  let response;
+  try {
+    response = await fetchFn(OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "refresh_token",
+        client_id: OAUTH_CLIENT_ID,
+        refresh_token: data.refreshToken
+      }),
+      signal: AbortSignal.timeout(30000)
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok)
+    return null;
+  let tokenData;
+  try {
+    tokenData = await response.json();
+  } catch {
+    return null;
+  }
+  if (!tokenData.access_token)
+    return null;
+  const refreshed = {
+    accessToken: tokenData.access_token,
+    refreshToken: tokenData.refresh_token ?? data.refreshToken,
+    expiresAt: tokenData.expires_at ?? now + (tokenData.expires_in ?? 8 * 60 * 60) * 1000,
+    scopes: tokenData.scope?.split(" ").filter(Boolean) ?? data.scopes
+  };
+  await opts.store.write(refreshed);
+  return refreshed.accessToken;
+}
+async function resolveDesignAuthHeaders(opts) {
+  if (opts.designToken)
+    return { Authorization: `Bearer ${opts.designToken}` };
+  const { profile } = opts;
+  if (profile.type === "api" && profile.env.ANTHROPIC_API_KEY) {
+    return { "x-api-key": profile.env.ANTHROPIC_API_KEY };
+  }
+  if (profile.type === "oauth-token" && profile.env.CLAUDE_CODE_OAUTH_TOKEN) {
+    return { Authorization: `Bearer ${profile.env.CLAUDE_CODE_OAUTH_TOKEN}` };
+  }
+  if (opts.credentialStore) {
+    if (opts.ensureFresh)
+      await opts.ensureFresh(opts.credentialStore).catch(() => {});
+    const creds = await opts.credentialStore.read();
+    const token = creds?.claudeAiOauth?.accessToken;
+    if (token)
+      return { Authorization: `Bearer ${token}` };
+  }
+  return {};
+}
+function buildDesignForwardHeaders(getHeader, authHeaders) {
+  const headers = {
+    "anthropic-version": getHeader("anthropic-version") || "2023-06-01",
+    "accept-encoding": "identity",
+    ...authHeaders
+  };
+  for (const name of ["content-type", "anthropic-beta", "mcp-session-id"]) {
+    const value = getHeader(name);
+    if (value)
+      headers[name] = value;
+  }
+  return headers;
+}
+var HOP_BY_HOP = new Set([
+  "transfer-encoding",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "upgrade"
+]);
+function filterUpstreamResponseHeaders(headers) {
+  const out = {};
+  for (const [key, value] of headers) {
+    if (!HOP_BY_HOP.has(key.toLowerCase()))
+      out[key] = value;
+  }
+  return out;
+}
+function isDesignAuthFailure(status) {
+  return status === 401 || status === 404;
+}
+function createDesignLogin(deps) {
+  const createSession = deps.createSession ?? createManualOAuthSession;
+  const fetchFn = deps.fetchFn ?? fetch;
+  const now = deps.now ?? Date.now;
+  const sessions = new Map;
+  const startRaw = () => {
+    for (const [state, session2] of sessions) {
+      if (session2.expiresAt < now())
+        sessions.delete(state);
+    }
+    const session = createSession(DESIGN_SCOPES);
+    sessions.set(session.state, { codeVerifier: session.codeVerifier, expiresAt: now() + LOGIN_SESSION_TTL_MS });
+    return { authorizeUrl: session.authorizeUrl, state: session.state };
+  };
+  return {
+    startRaw,
+    start() {
+      const { authorizeUrl } = startRaw();
+      return {
+        authorizeUrl,
+        instructions: 'Open the URL in your browser. After authorizing, POST the code to /design-login with body { "code": "<paste-code-here>" }'
+      };
+    },
+    async exchange(rawBody) {
+      const body = rawBody && typeof rawBody === "object" ? rawBody : {};
+      const parsed = body.code ? parseAuthorizationCodeInput(body.code) : null;
+      if (!parsed) {
+        return { status: 400, body: { type: "error", error: { type: "invalid_request", message: "Missing or invalid 'code' field." } } };
+      }
+      const stateKey = parsed.state ?? body.state;
+      const stored = stateKey ? sessions.get(stateKey) : undefined;
+      if (!stateKey || !stored || stored.expiresAt < now()) {
+        return {
+          status: 400,
+          body: { type: "error", error: { type: "session_expired", message: "OAuth session expired or not found. Call GET /design-login to start a new session." } }
+        };
+      }
+      sessions.delete(stateKey);
+      let response;
+      try {
+        response = await fetchFn(OAUTH_TOKEN_URL, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            grant_type: "authorization_code",
+            client_id: OAUTH_CLIENT_ID,
+            code: parsed.code,
+            redirect_uri: OAUTH_REDIRECT_URI,
+            code_verifier: stored.codeVerifier,
+            state: stateKey
+          }),
+          signal: AbortSignal.timeout(30000)
+        });
+      } catch (err) {
+        return { status: 502, body: { type: "error", error: { type: "upstream_error", message: err instanceof Error ? err.message : String(err) } } };
+      }
+      if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        return {
+          status: 502,
+          body: { type: "error", error: { type: "token_exchange_failed", message: `Token exchange failed (${response.status}): ${text.slice(0, 200)}` } }
+        };
+      }
+      const tokenData = await response.json();
+      if (!tokenData.access_token) {
+        return { status: 502, body: { type: "error", error: { type: "token_exchange_failed", message: "Token response missing access_token." } } };
+      }
+      const expiresAt = tokenData.expires_at ?? now() + (tokenData.expires_in ?? 8 * 60 * 60) * 1000;
+      const scopes = tokenData.scope?.split(" ").filter(Boolean) ?? DESIGN_SCOPES;
+      try {
+        await deps.store.write({ accessToken: tokenData.access_token, refreshToken: tokenData.refresh_token, expiresAt, scopes });
+      } catch (err) {
+        return { status: 500, body: { type: "error", error: { type: "storage_error", message: `Failed to store design token: ${err instanceof Error ? err.message : String(err)}` } } };
+      }
+      return { status: 200, body: { success: true, scopes } };
+    }
+  };
+}
+
 // src/proxy/openai.ts
 function extractOpenAiContent(content) {
   if (typeof content === "string")
@@ -10738,6 +11063,331 @@ function buildModelList(isMaxSubscription, now = Math.floor(Date.now() / 1000))
   ];
 }
 
+// src/proxy/openaiResponses.ts
+function partsToText(content) {
+  if (typeof content === "string")
+    return content;
+  return content.filter((p) => typeof p.text === "string").map((p) => p.text).join("");
+}
+function mapToolChoice(tc) {
+  if (tc === "auto")
+    return { type: "auto" };
+  if (tc === "required")
+    return { type: "any" };
+  if (tc && typeof tc === "object") {
+    const o = tc;
+    if (o.type === "function" && o.name)
+      return { type: "tool", name: o.name };
+    if (o.type === "auto")
+      return { type: "auto" };
+    if (o.type === "any" || o.type === "required")
+      return { type: "any" };
+  }
+  return;
+}
+function translateResponsesToAnthropic(body) {
+  if (body.input === undefined || body.input === null)
+    return null;
+  const items = typeof body.input === "string" ? [{ type: "message", role: "user", content: [{ type: "input_text", text: body.input }] }] : body.input;
+  const systemParts = [];
+  if (body.instructions)
+    systemParts.push(body.instructions);
+  const messages = [];
+  const pushBlock = (role, block) => {
+    const last = messages[messages.length - 1];
+    if (last && last.role === role && Array.isArray(last.content)) {
+      last.content.push(block);
+    } else {
+      messages.push({ role, content: [block] });
+    }
+  };
+  for (const item of items) {
+    switch (item.type) {
+      case "message": {
+        const msg = item;
+        if (msg.role === "developer" || msg.role === "system") {
+          const t = partsToText(msg.content);
+          if (t)
+            systemParts.push(t);
+          break;
+        }
+        const text = partsToText(msg.content);
+        if (text)
+          pushBlock(msg.role === "assistant" ? "assistant" : "user", { type: "text", text });
+        break;
+      }
+      case "function_call": {
+        const fc = item;
+        let input = {};
+        try {
+          input = fc.arguments ? JSON.parse(fc.arguments) : {};
+        } catch {
+          input = {};
+        }
+        pushBlock("assistant", { type: "tool_use", id: fc.call_id, name: fc.name, input });
+        break;
+      }
+      case "function_call_output": {
+        const fo = item;
+        pushBlock("user", { type: "tool_result", tool_use_id: fo.call_id, content: fo.output });
+        break;
+      }
+      case "reasoning":
+        break;
+      default:
+        break;
+    }
+  }
+  const result = {
+    model: typeof body.model === "string" ? body.model : "",
+    messages,
+    max_tokens: body.max_output_tokens ?? 8192,
+    stream: body.stream ?? false
+  };
+  if (systemParts.length > 0)
+    result.system = systemParts.join(`
+
+`);
+  if (Array.isArray(body.tools) && body.tools.length > 0) {
+    result.tools = body.tools.filter((t) => t.type === "function").map((t) => ({
+      name: t.name,
+      description: t.description ?? "",
+      input_schema: t.parameters ?? { type: "object", properties: {} }
+    }));
+  }
+  const tc = mapToolChoice(body.tool_choice);
+  if (tc)
+    result.tool_choice = tc;
+  if (body.temperature !== undefined)
+    result.temperature = body.temperature;
+  if (body.top_p !== undefined)
+    result.top_p = body.top_p;
+  if (body.reasoning?.effort !== undefined)
+    result.reasoning_effort = body.reasoning.effort;
+  return result;
+}
+function reasoningRequested(body) {
+  if (body.reasoning && typeof body.reasoning === "object")
+    return true;
+  const include = body.include;
+  return Array.isArray(include) && include.some((v) => typeof v === "string" && v.startsWith("reasoning"));
+}
+function mapUsage(usage) {
+  const input = usage?.input_tokens ?? 0;
+  const output = usage?.output_tokens ?? 0;
+  return { input_tokens: input, output_tokens: output, total_tokens: input + output };
+}
+function translateAnthropicToResponses(res, ctx) {
+  const output = [];
+  const textParts = [];
+  for (const block of res.content ?? []) {
+    if (block.type === "text" && typeof block.text === "string") {
+      textParts.push({ type: "output_text", text: block.text, annotations: [] });
+    } else if (block.type === "tool_use") {
+      output.push({
+        type: "function_call",
+        id: `fc_${block.id}`,
+        call_id: block.id,
+        name: block.name,
+        arguments: JSON.stringify(block.input ?? {}),
+        status: "completed"
+      });
+    }
+  }
+  if (textParts.length > 0) {
+    output.unshift({
+      type: "message",
+      id: `msg_${ctx.responseId}`,
+      status: "completed",
+      role: "assistant",
+      content: textParts
+    });
+  }
+  if (ctx.reasoningRequested) {
+    output.unshift({
+      type: "reasoning",
+      id: `rs_${ctx.responseId}`,
+      summary: [],
+      encrypted_content: null,
+      status: "completed"
+    });
+  }
+  return {
+    id: ctx.responseId,
+    object: "response",
+    created_at: ctx.created,
+    model: ctx.model,
+    status: "completed",
+    output,
+    usage: mapUsage(res.usage),
+    parallel_tool_calls: true,
+    tool_choice: "auto",
+    tools: []
+  };
+}
+function createResponsesSseTranslator(ctx) {
+  let seq = 0;
+  let outputIndex = 0;
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let createdEmitted = false;
+  const blocks = new Map;
+  const finalOutput = [];
+  const emit = (event, data) => ({
+    event,
+    data: { type: event, ...data, sequence_number: seq++ }
+  });
+  const responseEnvelope = (status, extra = {}) => ({
+    id: ctx.responseId,
+    object: "response",
+    created_at: ctx.created,
+    model: ctx.model,
+    status,
+    ...extra
+  });
+  return (event) => {
+    const out = [];
+    switch (event.type) {
+      case "message_start": {
+        inputTokens = event.message?.usage?.input_tokens ?? 0;
+        if (!createdEmitted) {
+          createdEmitted = true;
+          out.push(emit("response.created", { response: responseEnvelope("in_progress", { output: [] }) }));
+          out.push(emit("response.in_progress", { response: responseEnvelope("in_progress", { output: [] }) }));
+          if (ctx.reasoningRequested) {
+            const oi = outputIndex++;
+            const itemId = `rs_${ctx.responseId}`;
+            const item = { type: "reasoning", id: itemId, summary: [], encrypted_content: null, status: "completed" };
+            out.push(emit("response.output_item.added", { output_index: oi, item: { ...item, status: "in_progress" } }));
+            finalOutput.push(item);
+            out.push(emit("response.output_item.done", { output_index: oi, item }));
+          }
+        }
+        break;
+      }
+      case "content_block_start": {
+        const idx = event.index ?? 0;
+        const cb = event.content_block ?? {};
+        if (cb.type === "text") {
+          const oi = outputIndex++;
+          const itemId = `msg_${ctx.responseId}_${oi}`;
+          blocks.set(idx, { kind: "text", outputIndex: oi, itemId, text: "", args: "" });
+          out.push(emit("response.output_item.added", {
+            output_index: oi,
+            item: { type: "message", id: itemId, status: "in_progress", role: "assistant", content: [] }
+          }));
+          out.push(emit("response.content_part.added", {
+            item_id: itemId,
+            output_index: oi,
+            content_index: 0,
+            part: { type: "output_text", text: "", annotations: [] }
+          }));
+        } else if (cb.type === "tool_use") {
+          const oi = outputIndex++;
+          const itemId = `fc_${cb.id}`;
+          blocks.set(idx, { kind: "tool", outputIndex: oi, itemId, text: "", args: "", callId: cb.id, name: cb.name });
+          out.push(emit("response.output_item.added", {
+            output_index: oi,
+            item: { type: "function_call", id: itemId, call_id: cb.id, name: cb.name, arguments: "", status: "in_progress" }
+          }));
+        } else {
+          blocks.set(idx, { kind: "skip", outputIndex: -1, itemId: "", text: "", args: "" });
+        }
+        break;
+      }
+      case "content_block_delta": {
+        const idx = event.index ?? 0;
+        const st = blocks.get(idx);
+        if (!st || st.kind === "skip")
+          break;
+        if (st.kind === "text" && event.delta?.type === "text_delta" && typeof event.delta.text === "string") {
+          st.text += event.delta.text;
+          out.push(emit("response.output_text.delta", {
+            item_id: st.itemId,
+            output_index: st.outputIndex,
+            content_index: 0,
+            delta: event.delta.text
+          }));
+        } else if (st.kind === "tool" && event.delta?.type === "input_json_delta" && typeof event.delta.partial_json === "string") {
+          st.args += event.delta.partial_json;
+          out.push(emit("response.function_call_arguments.delta", {
+            item_id: st.itemId,
+            output_index: st.outputIndex,
+            delta: event.delta.partial_json
+          }));
+        }
+        break;
+      }
+      case "content_block_stop": {
+        const idx = event.index ?? 0;
+        const st = blocks.get(idx);
+        if (!st || st.kind === "skip")
+          break;
+        if (st.kind === "text") {
+          out.push(emit("response.output_text.done", {
+            item_id: st.itemId,
+            output_index: st.outputIndex,
+            content_index: 0,
+            text: st.text
+          }));
+          out.push(emit("response.content_part.done", {
+            item_id: st.itemId,
+            output_index: st.outputIndex,
+            content_index: 0,
+            part: { type: "output_text", text: st.text, annotations: [] }
+          }));
+          const item = {
+            type: "message",
+            id: st.itemId,
+            status: "completed",
+            role: "assistant",
+            content: [{ type: "output_text", text: st.text, annotations: [] }]
+          };
+          finalOutput.push(item);
+          out.push(emit("response.output_item.done", { output_index: st.outputIndex, item }));
+        } else if (st.kind === "tool") {
+          out.push(emit("response.function_call_arguments.done", {
+            item_id: st.itemId,
+            output_index: st.outputIndex,
+            arguments: st.args
+          }));
+          const item = {
+            type: "function_call",
+            id: st.itemId,
+            call_id: st.callId,
+            name: st.name,
+            arguments: st.args,
+            status: "completed"
+          };
+          finalOutput.push(item);
+          out.push(emit("response.output_item.done", { output_index: st.outputIndex, item }));
+        }
+        break;
+      }
+      case "message_delta": {
+        if (typeof event.usage?.output_tokens === "number")
+          outputTokens = event.usage.output_tokens;
+        break;
+      }
+      case "message_stop": {
+        out.push(emit("response.completed", {
+          response: responseEnvelope("completed", {
+            output: finalOutput,
+            usage: { input_tokens: inputTokens, output_tokens: outputTokens, total_tokens: inputTokens + outputTokens },
+            parallel_tool_calls: true,
+            tool_choice: "auto",
+            tools: []
+          })
+        }));
+        break;
+      }
+      default:
+        break;
+    }
+    return out;
+  };
+}
+
 // src/proxy/messages.ts
 function stripCacheControlForHashing(obj) {
   if (!obj || typeof obj !== "object")
@@ -11136,7 +11786,7 @@ init_env();
 var openCodeTransforms = [
   {
     name: "opencode-core",
-    adapters: ["opencode", "openai"],
+    adapters: ["opencode", "openai", "codex"],
     onRequest(ctx) {
       const body = ctx.body;
       const blockedTools = BLOCKED_BUILTIN_TOOLS;
@@ -11940,6 +12590,15 @@ var openAiAdapter = {
   name: "openai"
 };
 
+// src/proxy/adapters/codex.ts
+var codexAdapter = {
+  ...openCodeAdapter,
+  name: "codex",
+  usesPassthrough() {
+    return true;
+  }
+};
+
 // src/proxy/adapters/cherry.ts
 var CHERRY_WEB_TOOLS = ["WebSearch", "WebFetch"];
 var isWebTool = (t) => CHERRY_WEB_TOOLS.includes(t);
@@ -11970,9 +12629,9 @@ var cherryAdapter = {
 
 // src/proxy/adapterInstances.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import { homedir as homedir3 } from "node:os";
-var CONFIG_FILE = join3(homedir3(), ".config", "meridian", "adapter-instances.json");
+import { join as join4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+var CONFIG_FILE = join4(homedir4(), ".config", "meridian", "adapter-instances.json");
 function parseAdapterInstances(raw2) {
   if (!raw2)
     return {};
@@ -12061,7 +12720,8 @@ var ADAPTER_MAP = {
   claudecode: claudeCodeAdapter,
   cherry: cherryAdapter,
   cherrystudio: cherryAdapter,
-  openai: openAiAdapter
+  openai: openAiAdapter,
+  codex: codexAdapter
 };
 var envDefault = process.env.MERIDIAN_DEFAULT_AGENT || "";
 if (envDefault && !ADAPTER_MAP[envDefault]) {
@@ -12140,7 +12800,7 @@ import { createSdkMcpServer as createSdkMcpServer2, tool } from "@anthropic-ai/c
 import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
 import { exec } from "node:child_process";
-import { promisify } from "node:util";
+import { promisify as promisify2 } from "node:util";
 
 // node_modules/@isaacs/balanced-match/dist/esm/index.js
 var balanced = (a, b, str) => {
@@ -17661,7 +18321,7 @@ function globIterate(pattern, options = {}) {
   return new Glob(pattern, options).iterate();
 }
 var streamSync = globStreamSync;
-var stream = Object.assign(globStream, { sync: globStreamSync });
+var stream2 = Object.assign(globStream, { sync: globStreamSync });
 var iterateSync = globIterateSync;
 var iterate = Object.assign(globIterate, {
   sync: globIterateSync
@@ -17675,7 +18335,7 @@ var glob = Object.assign(glob_, {
   globSync,
   sync,
   globStream,
-  stream,
+  stream: stream2,
   globStreamSync,
   streamSync,
   globIterate,
@@ -17689,9 +18349,35 @@ var glob = Object.assign(glob_, {
 });
 glob.glob = glob;
 
-// src/mcpTools.ts
-var execAsync = promisify(exec);
+// src/grepTool.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
 var getCwd = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();
+async function runGrepTool(args) {
+  try {
+    const searchPath = args.path || getCwd();
+    const includePattern = args.include || "*";
+    const grepArgs = ["-rn", `--include=${includePattern}`, args.pattern, searchPath];
+    const { stdout } = await execFileAsync("grep", grepArgs, { maxBuffer: 10 * 1024 * 1024 });
+    return {
+      content: [{ type: "text", text: stdout || "(no matches)" }]
+    };
+  } catch (error) {
+    const grepError = error;
+    if (grepError.code === 1) {
+      return { content: [{ type: "text", text: grepError.stdout || "(no matches)" }] };
+    }
+    return {
+      content: [{ type: "text", text: `Error: ${error instanceof Error ? error.message : String(error)}` }],
+      isError: true
+    };
+  }
+}
+
+// src/mcpTools.ts
+var execAsync = promisify2(exec);
+var getCwd2 = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();
 function createOpencodeMcpServer() {
   return createSdkMcpServer2({
     name: "opencode",
@@ -17702,7 +18388,7 @@ function createOpencodeMcpServer() {
         encoding: exports_external.string().optional().describe("File encoding, defaults to utf-8")
       }, async (args) => {
         try {
-          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd(), args.path);
+          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd2(), args.path);
           const content = await fs.readFile(filePath, args.encoding || "utf-8");
           return {
             content: [{ type: "text", text: content }]
@@ -17719,7 +18405,7 @@ function createOpencodeMcpServer() {
         content: exports_external.string().describe("Content to write")
       }, async (args) => {
         try {
-          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd(), args.path);
+          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd2(), args.path);
           await fs.mkdir(path2.dirname(filePath), { recursive: true });
           await fs.writeFile(filePath, args.content, "utf-8");
           return {
@@ -17738,7 +18424,7 @@ function createOpencodeMcpServer() {
         newString: exports_external.string().describe("The replacement text")
       }, async (args) => {
         try {
-          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd(), args.path);
+          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd2(), args.path);
           const content = await fs.readFile(filePath, "utf-8");
           if (!content.includes(args.oldString)) {
             return {
@@ -17764,7 +18450,7 @@ function createOpencodeMcpServer() {
       }, async (args) => {
         try {
           const options = {
-            cwd: args.cwd || getCwd(),
+            cwd: args.cwd || getCwd2(),
             timeout: 120000
           };
           const { stdout, stderr } = await execAsync(args.command, options);
@@ -17787,7 +18473,7 @@ function createOpencodeMcpServer() {
       }, async (args) => {
         try {
           const files = await glob(args.pattern, {
-            cwd: args.cwd || getCwd(),
+            cwd: args.cwd || getCwd2(),
             nodir: true,
             ignore: ["**/node_modules/**", "**/.git/**"]
           });
@@ -17806,22 +18492,7 @@ function createOpencodeMcpServer() {
         pattern: exports_external.string().describe("Regex pattern to search for"),
         path: exports_external.string().optional().describe("Directory or file to search in"),
         include: exports_external.string().optional().describe("File pattern to include, e.g., *.ts")
-      }, async (args) => {
-        try {
-          const searchPath = args.path || getCwd();
-          const includePattern = args.include || "*";
-          let cmd = `grep -rn --include="${includePattern}" "${args.pattern}" "${searchPath}" 2>/dev/null || true`;
-          const { stdout } = await execAsync(cmd, { maxBuffer: 10 * 1024 * 1024 });
-          return {
-            content: [{ type: "text", text: stdout || "(no matches)" }]
-          };
-        } catch (error) {
-          return {
-            content: [{ type: "text", text: `Error: ${error instanceof Error ? error.message : String(error)}` }],
-            isError: true
-          };
-        }
-      })
+      }, runGrepTool)
     ]
   });
 }
@@ -17881,7 +18552,7 @@ function buildQueryOptions(ctx, abortController) {
     systemContext,
     claudeExecutable,
     passthrough,
-    stream: stream2,
+    stream: stream3,
     sdkAgents,
     passthroughMcp,
     cleanEnv,
@@ -17923,7 +18594,7 @@ function buildQueryOptions(ctx, abortController) {
       model,
       pathToClaudeCodeExecutable: claudeExecutable,
       ...abortController ? { abortController } : {},
-      ...stream2 ? { includePartialMessages: true } : {},
+      ...stream3 ? { includePartialMessages: true } : {},
       permissionMode: "bypassPermissions",
       allowDangerouslySkipPermissions: true,
       ...resolveSystemPrompt(systemContext, passthrough, settingSources, codeSystemPrompt, clientSystemPrompt, cwdNote),
@@ -18034,6 +18705,17 @@ var cherryTransforms = [
   }
 ];
 
+// src/proxy/transforms/codex.ts
+var codexTransforms = [
+  {
+    name: "codex-force-passthrough",
+    adapters: ["codex"],
+    onRequest(ctx) {
+      return { ...ctx, passthrough: true };
+    }
+  }
+];
+
 // src/proxy/transforms/registry.ts
 var ADAPTER_TRANSFORMS = {
   opencode: openCodeTransforms,
@@ -18043,7 +18725,8 @@ var ADAPTER_TRANSFORMS = {
   forgecode: forgeCodeTransforms,
   passthrough: passthroughTransforms,
   cherry: cherryTransforms,
-  openai: openCodeTransforms
+  openai: openCodeTransforms,
+  codex: [...openCodeTransforms, ...codexTransforms]
 };
 function getAdapterTransforms(adapterName) {
   return ADAPTER_TRANSFORMS[adapterName] ?? [];
@@ -18051,7 +18734,7 @@ function getAdapterTransforms(adapterName) {
 
 // src/proxy/plugins/loader.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
-import { join as join4, isAbsolute as isAbsolute2, extname } from "path";
+import { join as join5, isAbsolute as isAbsolute2, extname } from "path";
 import { pathToFileURL } from "url";
 
 // src/proxy/plugins/validation.ts
@@ -18136,7 +18819,7 @@ async function loadPlugins(pluginDir, configPath) {
   const loaded = [];
   const seenNames = new Set;
   for (const { filename, entry } of ordered) {
-    const filePath = isAbsolute2(filename) ? filename : join4(pluginDir, filename);
+    const filePath = isAbsolute2(filename) ? filename : join5(pluginDir, filename);
     if (entry && !entry.enabled) {
       loaded.push({
         name: filename,
@@ -18518,8 +19201,8 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join6 } from "node:path";
 var DEFAULT_MAX_STORED_SESSIONS = 1e4;
 var STALE_LOCK_THRESHOLD_MS = 30000;
 function getMaxStoredSessions() {
@@ -18570,11 +19253,11 @@ function getStorePath() {
   if (!existsSync6(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
-  return join5(dir, "sessions.json");
+  return join6(dir, "sessions.json");
 }
 function getDefaultCacheDir() {
-  const newDir = join5(homedir4(), ".cache", "meridian");
-  const oldDir = join5(homedir4(), ".cache", "opencode-claude-max-proxy");
+  const newDir = join6(homedir5(), ".cache", "meridian");
+  const oldDir = join6(homedir5(), ".cache", "opencode-claude-max-proxy");
   if (existsSync6(newDir))
     return newDir;
   if (existsSync6(oldDir)) {
@@ -18914,7 +19597,7 @@ function storeSession(sessionId, messages, claudeSessionId, workingDirectory, sd
 }
 
 // src/proxy/server.ts
-var exec2 = promisify2(execCallback);
+var exec2 = promisify3(execCallback);
 var claudeExecutable = "";
 var UPSTREAM_IDLE_MS = 90000;
 function credentialStoreForProfile(profile) {
@@ -19144,8 +19827,8 @@ function createProxyServer(config = {}) {
         pendingSessionStores.delete(key);
     };
   };
-  const pluginDir = finalConfig.pluginDir ?? join7(homedir6(), ".config", "meridian", "plugins");
-  const pluginConfigPath = finalConfig.pluginConfigPath ?? join7(homedir6(), ".config", "meridian", "plugins.json");
+  const pluginDir = finalConfig.pluginDir ?? join8(homedir7(), ".config", "meridian", "plugins");
+  const pluginConfigPath = finalConfig.pluginConfigPath ?? join8(homedir7(), ".config", "meridian", "plugins.json");
   let loadedPlugins = [];
   let pluginTransforms = [];
   const app = new Hono2;
@@ -19161,6 +19844,7 @@ function createProxyServer(config = {}) {
   app.use("/plugins", requireAuth);
   app.use("/settings/*", requireAuth);
   app.use("/settings", requireAuth);
+  app.use("/design-login", requireAuth);
   app.use("/auth/*", requireAuth);
   app.get("/", (c) => {
     const accept = c.req.header("accept") || "";
@@ -19169,7 +19853,7 @@ function createProxyServer(config = {}) {
         status: "ok",
         service: "meridian",
         format: "anthropic",
-        endpoints: ["/v1/messages", "/messages", "/v1/chat/completions", "/v1/models", "/telemetry", "/metrics", "/health"]
+        endpoints: ["/v1/messages", "/messages", "/v1/chat/completions", "/v1/responses", "/v1/models", "/v1/design/*", "/design-login", "/telemetry", "/metrics", "/health"]
       });
     }
     return c.html(landingHtml);
@@ -19282,7 +19966,7 @@ function createProxyServer(config = {}) {
           stream: body.stream ?? false,
           workingDirectory
         }), adapterBase);
-        const stream2 = pipelineCtx.prefersStreaming !== undefined ? pipelineCtx.prefersStreaming : body.stream ?? false;
+        const stream3 = pipelineCtx.prefersStreaming !== undefined ? pipelineCtx.prefersStreaming : body.stream ?? false;
         const effortHeader = c.req.header("x-opencode-effort");
         const thinkingHeader = c.req.header("x-opencode-thinking");
         const taskBudgetHeader = c.req.header("x-opencode-task-budget");
@@ -19357,7 +20041,7 @@ function createProxyServer(config = {}) {
         const lineageType = lineageResult.type === "diverged" && !cachedSession ? "new" : lineageResult.type;
         const msgCount = Array.isArray(body.messages) ? body.messages.length : 0;
         const toolCount = body.tools?.length ?? 0;
-        const requestLogLine = `${requestMeta.requestId} adapter=${adapter.name}${requestSource ? ` source=${requestSource}` : ""}${profile.id !== "default" ? ` profile=${profile.id}${routingMode === "sticky" ? "(sticky)" : ""}` : ""} model=${model} stream=${stream2} tools=${toolCount} lineage=${lineageType} session=${resumeSessionId?.slice(0, 8) || "new"}${isUndo && undoRollbackUuid ? ` rollback=${undoRollbackUuid.slice(0, 8)}` : ""}${agentMode ? ` agent=${agentMode}` : ""} active=${activeSessions}/${MAX_CONCURRENT_SESSIONS} msgCount=${msgCount}`;
+        const requestLogLine = `${requestMeta.requestId} adapter=${adapter.name}${requestSource ? ` source=${requestSource}` : ""}${profile.id !== "default" ? ` profile=${profile.id}${routingMode === "sticky" ? "(sticky)" : ""}` : ""} model=${model} stream=${stream3} tools=${toolCount} lineage=${lineageType} session=${resumeSessionId?.slice(0, 8) || "new"}${isUndo && undoRollbackUuid ? ` rollback=${undoRollbackUuid.slice(0, 8)}` : ""}${agentMode ? ` agent=${agentMode}` : ""} active=${activeSessions}/${MAX_CONCURRENT_SESSIONS} msgCount=${msgCount}`;
         plog(`[PROXY] ${requestLogLine} msgs=${msgSummary}`);
         diagnosticLog2.session(`${requestLogLine}`, requestMeta.requestId);
         if (lineageResult.type === "diverged" && profileSessionId && !isIndependentSession) {
@@ -19371,7 +20055,7 @@ function createProxyServer(config = {}) {
         }
         claudeLog("request.received", {
           model,
-          stream: stream2,
+          stream: stream3,
           queueWaitMs: requestMeta.queueStartedAt - requestMeta.queueEnteredAt,
           messageCount: Array.isArray(body.messages) ? body.messages.length : 0,
           hasSystemPrompt: Boolean(body.system)
@@ -19610,7 +20294,7 @@ function createProxyServer(config = {}) {
           stderrLines.push(data.trimEnd());
           claudeLog("subprocess.stderr", { line: data.trimEnd() });
         };
-        if (!stream2) {
+        if (!stream3) {
           const contentBlocks = [];
           let assistantMessages = 0;
           let hasStructuredOutput = false;
@@ -21534,6 +22218,107 @@ data: ${JSON.stringify({
       }
     });
   });
+  app.post("/v1/responses", async (c) => {
+    const rawBody = await c.req.json();
+    const anthropicBody = translateResponsesToAnthropic(rawBody);
+    if (!anthropicBody) {
+      return c.json({ error: { type: "invalid_request_error", message: "input: Field required", code: null } }, 400);
+    }
+    if (!anthropicBody.model) {
+      return c.json({ error: { type: "invalid_request_error", message: "model: Field required", code: null } }, 400);
+    }
+    const internalHeaders = {
+      "Content-Type": "application/json",
+      "x-meridian-agent": "codex"
+    };
+    const xApiKey = c.req.header("x-api-key");
+    if (xApiKey)
+      internalHeaders["x-api-key"] = xApiKey;
+    const authz = c.req.header("authorization");
+    if (authz)
+      internalHeaders["authorization"] = authz;
+    const xProfile = c.req.header("x-meridian-profile");
+    if (xProfile)
+      internalHeaders["x-meridian-profile"] = xProfile;
+    const internalReq = new Request("http://internal/v1/messages", {
+      method: "POST",
+      headers: internalHeaders,
+      body: JSON.stringify(anthropicBody)
+    });
+    const internalRes = await app.fetch(internalReq);
+    if (!internalRes.ok) {
+      const errBody = await internalRes.text();
+      return c.json({ error: { type: "upstream_error", message: errBody, code: null } }, internalRes.status);
+    }
+    const responseId = `resp_${randomUUID().replace(/-/g, "")}`;
+    const created = Math.floor(Date.now() / 1000);
+    const model = typeof rawBody.model === "string" && rawBody.model ? rawBody.model : CANONICAL_SONNET_MODEL;
+    const ctx = { responseId, model, created, reasoningRequested: reasoningRequested(rawBody) };
+    if (!anthropicBody.stream) {
+      const anthropicRes = await internalRes.json();
+      return c.json(translateAnthropicToResponses(anthropicRes, ctx));
+    }
+    const encoder = new TextEncoder;
+    const readable = new ReadableStream({
+      async start(controller) {
+        const reader = internalRes.body?.getReader();
+        if (!reader) {
+          controller.close();
+          return;
+        }
+        const decoder = new TextDecoder;
+        let buffer = "";
+        const translate = createResponsesSseTranslator(ctx);
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+              break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split(`
+`);
+            buffer = lines.pop() ?? "";
+            for (const line of lines) {
+              if (!line.startsWith("data: "))
+                continue;
+              const dataStr = line.slice(6).trim();
+              if (!dataStr)
+                continue;
+              let event;
+              try {
+                event = JSON.parse(dataStr);
+              } catch {
+                continue;
+              }
+              if (typeof event.type !== "string")
+                continue;
+              for (const emission of translate(event)) {
+                controller.enqueue(encoder.encode(`event: ${emission.event}
+data: ${JSON.stringify(emission.data)}
+
+`));
+              }
+            }
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          controller.enqueue(encoder.encode(`event: response.failed
+data: ${JSON.stringify({ response: { id: responseId, status: "failed", error: { message } } })}
+
+`));
+        } finally {
+          controller.close();
+        }
+      }
+    });
+    return new Response(readable, {
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      }
+    });
+  });
   app.get("/v1/models", async (c) => {
     const authStatus = await getClaudeAuthStatusAsync();
     const isMax = authStatus?.subscriptionType === "max";
@@ -21696,6 +22481,65 @@ data: ${JSON.stringify({
       } : {}
     });
   });
+  const designTokenStore = createFileDesignTokenStore();
+  const designLogin = createDesignLogin({ store: designTokenStore });
+  app.get("/design-login", (c) => c.json(designLogin.start()));
+  app.post("/design-login", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ type: "error", error: { type: "invalid_request", message: "Request body must be JSON with a 'code' field." } }, 400);
+    }
+    const result = await designLogin.exchange(body);
+    if (result.status === 200)
+      plog(`[PROXY] Design token stored via /design-login`);
+    return new Response(JSON.stringify(result.body), {
+      status: result.status,
+      headers: { "content-type": "application/json" }
+    });
+  });
+  app.get("/v1/design/*", (c) => {
+    c.status(200);
+    c.header("content-type", "text/event-stream");
+    c.header("cache-control", "no-cache");
+    return stream(c, async (s) => {
+      while (!s.aborted) {
+        await s.write(`: keepalive
+
+`);
+        await s.sleep(15000);
+      }
+    });
+  });
+  app.post("/v1/design/*", async (c) => {
+    const profile = resolveProfile(finalConfig.profiles, finalConfig.defaultProfile, c.req.header("x-meridian-profile") || undefined);
+    const url = new URL(c.req.url);
+    const upstreamUrl = `${DESIGN_UPSTREAM_ORIGIN}${url.pathname}${url.search}`;
+    const designToken = await getDesignAccessToken({ store: designTokenStore });
+    const authHeaders = await resolveDesignAuthHeaders({
+      designToken,
+      profile,
+      credentialStore: credentialStoreForProfile(profile),
+      ensureFresh: ensureFreshToken
+    });
+    const body = await c.req.arrayBuffer();
+    const forwardHeaders = buildDesignForwardHeaders((name) => c.req.header(name), authHeaders);
+    let upstreamRes;
+    try {
+      upstreamRes = await fetch(upstreamUrl, { method: "POST", headers: forwardHeaders, body });
+    } catch (err) {
+      return c.json({ type: "error", error: { type: "upstream_error", message: err instanceof Error ? err.message : String(err) } }, 502);
+    }
+    if (isDesignAuthFailure(upstreamRes.status)) {
+      return c.json({ type: "error", error: { type: "auth_error", message: "Unauthorized. Run /design-login to authorize Claude Design (adds user:design:read/write scopes)." } }, 401);
+    }
+    plog(`[PROXY] DESIGN upstream=${upstreamRes.status}`);
+    return new Response(upstreamRes.body, {
+      status: upstreamRes.status,
+      headers: filterUpstreamResponseHeaders(upstreamRes.headers.entries())
+    });
+  });
   app.all("*", (c) => {
     plog(`[PROXY] UNHANDLED ${c.req.method} ${c.req.url}`);
     return c.json({ error: { type: "not_found", message: `Endpoint not supported: ${c.req.method} ${new URL(c.req.url).pathname}` } }, 404);