@rynfar/meridian 1.53.0 → 1.55.0

package/dist/{cli-027as0fx.js → cli-w63v1ftp.js}

@@ -23,6 +23,10 @@ import {
 } from "./cli-xmweegb1.js";
 import {
   CANONICAL_SONNET_MODEL,
+  OAUTH_CLIENT_ID,
+  OAUTH_REDIRECT_URI,
+  OAUTH_TOKEN_URL,
+  createManualOAuthSession,
   env,
   envBool,
   envInt,
@@ -34,12 +38,13 @@ import {
   init_env,
   isClosedControllerError,
   mapModelToClaudeModel,
+  parseAuthorizationCodeInput,
   recordExtendedContextUnavailable,
   resolveClaudeExecutableAsync,
   resolvePassthrough,
   resolveSdkModelDefaults,
   stripExtendedContext
-} from "./cli-vjeftz4z.js";
+} from "./cli-jhm27q0x.js";
 import {
   getSetting
 } from "./cli-340h1chz.js";
@@ -1482,13 +1487,13 @@ __export(exports_sdkFeatures, {
   getAllFeatureConfigs: () => getAllFeatureConfigs
 });
 import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3, renameSync as renameSync3 } from "node:fs";
-import { join as join6 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { join as join7 } from "node:path";
+import { homedir as homedir6 } from "node:os";
 function getConfigPath2() {
-  const dir = join6(homedir5(), ".config", "meridian");
+  const dir = join7(homedir6(), ".config", "meridian");
   if (!existsSync7(dir))
     mkdirSync3(dir, { recursive: true });
-  return join6(dir, "sdk-features.json");
+  return join7(dir, "sdk-features.json");
 }
 function readConfig() {
   const now = Date.now();
@@ -3641,6 +3646,112 @@ var cors = (options) => {
   };
 };
 
+// node_modules/hono/dist/utils/stream.js
+var StreamingApi = class {
+  writer;
+  encoder;
+  writable;
+  abortSubscribers = [];
+  responseReadable;
+  aborted = false;
+  closed = false;
+  constructor(writable, _readable) {
+    this.writable = writable;
+    this.writer = writable.getWriter();
+    this.encoder = new TextEncoder;
+    const reader = _readable.getReader();
+    this.abortSubscribers.push(async () => {
+      await reader.cancel();
+    });
+    this.responseReadable = new ReadableStream({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        done ? controller.close() : controller.enqueue(value);
+      },
+      cancel: () => {
+        this.abort();
+      }
+    });
+  }
+  async write(input) {
+    try {
+      if (typeof input === "string") {
+        input = this.encoder.encode(input);
+      }
+      await this.writer.write(input);
+    } catch {}
+    return this;
+  }
+  async writeln(input) {
+    await this.write(input + `
+`);
+    return this;
+  }
+  sleep(ms) {
+    return new Promise((res) => setTimeout(res, ms));
+  }
+  async close() {
+    try {
+      await this.writer.close();
+    } catch {}
+    this.closed = true;
+  }
+  async pipe(body) {
+    this.writer.releaseLock();
+    await body.pipeTo(this.writable, { preventClose: true });
+    this.writer = this.writable.getWriter();
+  }
+  onAbort(listener) {
+    this.abortSubscribers.push(listener);
+  }
+  abort() {
+    if (!this.aborted) {
+      this.aborted = true;
+      this.abortSubscribers.forEach((subscriber) => subscriber());
+    }
+  }
+};
+
+// node_modules/hono/dist/helper/streaming/utils.js
+var isOldBunVersion = () => {
+  const version = typeof Bun !== "undefined" ? Bun.version : undefined;
+  if (version === undefined) {
+    return false;
+  }
+  const result = version.startsWith("1.1") || version.startsWith("1.0") || version.startsWith("0.");
+  isOldBunVersion = () => result;
+  return result;
+};
+
+// node_modules/hono/dist/helper/streaming/stream.js
+var contextStash = /* @__PURE__ */ new WeakMap;
+var stream = (c, cb, onError) => {
+  const { readable, writable } = new TransformStream;
+  const stream2 = new StreamingApi(writable, readable);
+  if (isOldBunVersion()) {
+    c.req.raw.signal.addEventListener("abort", () => {
+      if (!stream2.closed) {
+        stream2.abort();
+      }
+    });
+  }
+  contextStash.set(stream2.responseReadable, c);
+  (async () => {
+    try {
+      await cb(stream2);
+    } catch (e) {
+      if (e === undefined) {} else if (e instanceof Error && onError) {
+        await onError(e, stream2);
+      } else {
+        console.error(e);
+      }
+    } finally {
+      stream2.close();
+    }
+  })();
+  return c.newResponse(stream2.responseReadable);
+};
+
 // node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
 import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
@@ -3921,13 +4032,13 @@ function writeFromReadableStreamDefaultReader(reader, writable, currentReadPromi
     }
   }
 }
-function writeFromReadableStream(stream, writable) {
-  if (stream.locked) {
+function writeFromReadableStream(stream2, writable) {
+  if (stream2.locked) {
     throw new TypeError("ReadableStream is locked.");
   } else if (writable.destroyed) {
     return;
   }
-  return writeFromReadableStreamDefaultReader(stream.getReader(), writable);
+  return writeFromReadableStreamDefaultReader(stream2.getReader(), writable);
 }
 var buildOutgoingHttpHeaders = (headers) => {
   const res = {};
@@ -4192,8 +4303,8 @@ var serve = (options, listeningListener) => {
 };
 
 // src/proxy/server.ts
-import { homedir as homedir6 } from "node:os";
-import { join as join7 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
 // src/proxy/rateLimitStore.ts
@@ -4542,7 +4653,7 @@ function createRequestContext(params) {
 }
 // src/proxy/server.ts
 import { exec as execCallback } from "child_process";
-import { promisify as promisify2 } from "util";
+import { promisify as promisify3 } from "util";
 import { randomUUID } from "crypto";
 
 // src/proxy/passthroughTools.ts
@@ -9877,7 +9988,7 @@ function introSection(h){
   meta.push('port '+location.port);
   return '<div class="intro">'
     +'<h2>Harness Claude, your way.</h2>'
-    +'<p>Meridian bridges any Anthropic-API agent to your Claude subscription — point the agent’s <code>ANTHROPIC_BASE_URL</code> at <code>http://'+esc(location.host)+'</code> and every request routes through the active account below. Setup guides for each agent live in the <a href="https://github.com/rynfar/meridian#readme">README</a>.</p>'
+    +'<p>Meridian bridges any Anthropic-API agent to your Claude subscription — point the agent’s <code>ANTHROPIC_BASE_URL</code> at <code>http://'+esc(location.host)+'</code> and every request routes through the active account below. Setup guides for each agent live in the <a href="https://github.com/rynfar/meridian/blob/main/docs/agents.md">Agent Setup guide</a>.</p>'
     +'<div class="intro-meta">'+meta.join(' · ')+'</div>'
     +'</div>';
 }
@@ -10274,6 +10385,217 @@ function formatSdkTermination(t, ctx) {
   return `sdk_termination ${parts.join(" ")}`;
 }
 
+// src/proxy/design.ts
+import { homedir as homedir3 } from "node:os";
+import { join as join3, dirname as dirname3 } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+var DESIGN_SCOPES = ["user:design:read", "user:design:write"];
+var DESIGN_UPSTREAM_ORIGIN = "https://api.anthropic.com";
+var EXPIRY_SKEW_MS = 60000;
+var LOGIN_SESSION_TTL_MS = 10 * 60 * 1000;
+function defaultDesignTokenPath() {
+  return process.env.MERIDIAN_DESIGN_TOKEN_PATH || join3(homedir3(), ".config", "meridian", "design-token.json");
+}
+function createFileDesignTokenStore(path = defaultDesignTokenPath()) {
+  return {
+    async read() {
+      try {
+        const raw2 = await readFile(path, "utf-8");
+        const data = JSON.parse(raw2);
+        if (typeof data.accessToken === "string" && typeof data.expiresAt === "number") {
+          return data;
+        }
+        return null;
+      } catch {
+        return null;
+      }
+    },
+    async write(data) {
+      await mkdir(dirname3(path), { recursive: true });
+      await writeFile(path, JSON.stringify(data), { mode: 384 });
+    }
+  };
+}
+function isDesignTokenFresh(data, now = Date.now()) {
+  return data.expiresAt > now + EXPIRY_SKEW_MS;
+}
+async function getDesignAccessToken(opts) {
+  const now = opts.now ?? Date.now();
+  const fetchFn = opts.fetchFn ?? fetch;
+  const data = await opts.store.read();
+  if (!data)
+    return null;
+  if (isDesignTokenFresh(data, now))
+    return data.accessToken;
+  if (!data.refreshToken)
+    return null;
+  let response;
+  try {
+    response = await fetchFn(OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "refresh_token",
+        client_id: OAUTH_CLIENT_ID,
+        refresh_token: data.refreshToken
+      }),
+      signal: AbortSignal.timeout(30000)
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok)
+    return null;
+  let tokenData;
+  try {
+    tokenData = await response.json();
+  } catch {
+    return null;
+  }
+  if (!tokenData.access_token)
+    return null;
+  const refreshed = {
+    accessToken: tokenData.access_token,
+    refreshToken: tokenData.refresh_token ?? data.refreshToken,
+    expiresAt: tokenData.expires_at ?? now + (tokenData.expires_in ?? 8 * 60 * 60) * 1000,
+    scopes: tokenData.scope?.split(" ").filter(Boolean) ?? data.scopes
+  };
+  await opts.store.write(refreshed);
+  return refreshed.accessToken;
+}
+async function resolveDesignAuthHeaders(opts) {
+  if (opts.designToken)
+    return { Authorization: `Bearer ${opts.designToken}` };
+  const { profile } = opts;
+  if (profile.type === "api" && profile.env.ANTHROPIC_API_KEY) {
+    return { "x-api-key": profile.env.ANTHROPIC_API_KEY };
+  }
+  if (profile.type === "oauth-token" && profile.env.CLAUDE_CODE_OAUTH_TOKEN) {
+    return { Authorization: `Bearer ${profile.env.CLAUDE_CODE_OAUTH_TOKEN}` };
+  }
+  if (opts.credentialStore) {
+    if (opts.ensureFresh)
+      await opts.ensureFresh(opts.credentialStore).catch(() => {});
+    const creds = await opts.credentialStore.read();
+    const token = creds?.claudeAiOauth?.accessToken;
+    if (token)
+      return { Authorization: `Bearer ${token}` };
+  }
+  return {};
+}
+function buildDesignForwardHeaders(getHeader, authHeaders) {
+  const headers = {
+    "anthropic-version": getHeader("anthropic-version") || "2023-06-01",
+    "accept-encoding": "identity",
+    ...authHeaders
+  };
+  for (const name of ["content-type", "anthropic-beta", "mcp-session-id"]) {
+    const value = getHeader(name);
+    if (value)
+      headers[name] = value;
+  }
+  return headers;
+}
+var HOP_BY_HOP = new Set([
+  "transfer-encoding",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "upgrade"
+]);
+function filterUpstreamResponseHeaders(headers) {
+  const out = {};
+  for (const [key, value] of headers) {
+    if (!HOP_BY_HOP.has(key.toLowerCase()))
+      out[key] = value;
+  }
+  return out;
+}
+function isDesignAuthFailure(status) {
+  return status === 401 || status === 404;
+}
+function createDesignLogin(deps) {
+  const createSession = deps.createSession ?? createManualOAuthSession;
+  const fetchFn = deps.fetchFn ?? fetch;
+  const now = deps.now ?? Date.now;
+  const sessions = new Map;
+  const startRaw = () => {
+    for (const [state, session2] of sessions) {
+      if (session2.expiresAt < now())
+        sessions.delete(state);
+    }
+    const session = createSession(DESIGN_SCOPES);
+    sessions.set(session.state, { codeVerifier: session.codeVerifier, expiresAt: now() + LOGIN_SESSION_TTL_MS });
+    return { authorizeUrl: session.authorizeUrl, state: session.state };
+  };
+  return {
+    startRaw,
+    start() {
+      const { authorizeUrl } = startRaw();
+      return {
+        authorizeUrl,
+        instructions: 'Open the URL in your browser. After authorizing, POST the code to /design-login with body { "code": "<paste-code-here>" }'
+      };
+    },
+    async exchange(rawBody) {
+      const body = rawBody && typeof rawBody === "object" ? rawBody : {};
+      const parsed = body.code ? parseAuthorizationCodeInput(body.code) : null;
+      if (!parsed) {
+        return { status: 400, body: { type: "error", error: { type: "invalid_request", message: "Missing or invalid 'code' field." } } };
+      }
+      const stateKey = parsed.state ?? body.state;
+      const stored = stateKey ? sessions.get(stateKey) : undefined;
+      if (!stateKey || !stored || stored.expiresAt < now()) {
+        return {
+          status: 400,
+          body: { type: "error", error: { type: "session_expired", message: "OAuth session expired or not found. Call GET /design-login to start a new session." } }
+        };
+      }
+      sessions.delete(stateKey);
+      let response;
+      try {
+        response = await fetchFn(OAUTH_TOKEN_URL, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            grant_type: "authorization_code",
+            client_id: OAUTH_CLIENT_ID,
+            code: parsed.code,
+            redirect_uri: OAUTH_REDIRECT_URI,
+            code_verifier: stored.codeVerifier,
+            state: stateKey
+          }),
+          signal: AbortSignal.timeout(30000)
+        });
+      } catch (err) {
+        return { status: 502, body: { type: "error", error: { type: "upstream_error", message: err instanceof Error ? err.message : String(err) } } };
+      }
+      if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        return {
+          status: 502,
+          body: { type: "error", error: { type: "token_exchange_failed", message: `Token exchange failed (${response.status}): ${text.slice(0, 200)}` } }
+        };
+      }
+      const tokenData = await response.json();
+      if (!tokenData.access_token) {
+        return { status: 502, body: { type: "error", error: { type: "token_exchange_failed", message: "Token response missing access_token." } } };
+      }
+      const expiresAt = tokenData.expires_at ?? now() + (tokenData.expires_in ?? 8 * 60 * 60) * 1000;
+      const scopes = tokenData.scope?.split(" ").filter(Boolean) ?? DESIGN_SCOPES;
+      try {
+        await deps.store.write({ accessToken: tokenData.access_token, refreshToken: tokenData.refresh_token, expiresAt, scopes });
+      } catch (err) {
+        return { status: 500, body: { type: "error", error: { type: "storage_error", message: `Failed to store design token: ${err instanceof Error ? err.message : String(err)}` } } };
+      }
+      return { status: 200, body: { success: true, scopes } };
+    }
+  };
+}
+
 // src/proxy/openai.ts
 function extractOpenAiContent(content) {
   if (typeof content === "string")
@@ -12008,8 +12330,8 @@ function extractPiCwd(body) {
 }
 var piAdapter = {
   name: "pi",
-  getSessionId(_c) {
-    return;
+  getSessionId(c) {
+    return c.req.header("x-session-affinity");
   },
   extractWorkingDirectory(body) {
     return extractPiCwd(body);
@@ -12274,6 +12596,9 @@ var codexAdapter = {
   name: "codex",
   usesPassthrough() {
     return true;
+  },
+  getSessionId(c) {
+    return c.req.header("x-codex-session");
   }
 };
 
@@ -12307,9 +12632,9 @@ var cherryAdapter = {
 
 // src/proxy/adapterInstances.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import { homedir as homedir3 } from "node:os";
-var CONFIG_FILE = join3(homedir3(), ".config", "meridian", "adapter-instances.json");
+import { join as join4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+var CONFIG_FILE = join4(homedir4(), ".config", "meridian", "adapter-instances.json");
 function parseAdapterInstances(raw2) {
   if (!raw2)
     return {};
@@ -12478,7 +12803,7 @@ import { createSdkMcpServer as createSdkMcpServer2, tool } from "@anthropic-ai/c
 import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
 import { exec } from "node:child_process";
-import { promisify } from "node:util";
+import { promisify as promisify2 } from "node:util";
 
 // node_modules/@isaacs/balanced-match/dist/esm/index.js
 var balanced = (a, b, str) => {
@@ -17999,7 +18324,7 @@ function globIterate(pattern, options = {}) {
   return new Glob(pattern, options).iterate();
 }
 var streamSync = globStreamSync;
-var stream = Object.assign(globStream, { sync: globStreamSync });
+var stream2 = Object.assign(globStream, { sync: globStreamSync });
 var iterateSync = globIterateSync;
 var iterate = Object.assign(globIterate, {
   sync: globIterateSync
@@ -18013,7 +18338,7 @@ var glob = Object.assign(glob_, {
   globSync,
   sync,
   globStream,
-  stream,
+  stream: stream2,
   globStreamSync,
   streamSync,
   globIterate,
@@ -18027,9 +18352,35 @@ var glob = Object.assign(glob_, {
 });
 glob.glob = glob;
 
-// src/mcpTools.ts
-var execAsync = promisify(exec);
+// src/grepTool.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
 var getCwd = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();
+async function runGrepTool(args) {
+  try {
+    const searchPath = args.path || getCwd();
+    const includePattern = args.include || "*";
+    const grepArgs = ["-rn", `--include=${includePattern}`, args.pattern, searchPath];
+    const { stdout } = await execFileAsync("grep", grepArgs, { maxBuffer: 10 * 1024 * 1024 });
+    return {
+      content: [{ type: "text", text: stdout || "(no matches)" }]
+    };
+  } catch (error) {
+    const grepError = error;
+    if (grepError.code === 1) {
+      return { content: [{ type: "text", text: grepError.stdout || "(no matches)" }] };
+    }
+    return {
+      content: [{ type: "text", text: `Error: ${error instanceof Error ? error.message : String(error)}` }],
+      isError: true
+    };
+  }
+}
+
+// src/mcpTools.ts
+var execAsync = promisify2(exec);
+var getCwd2 = () => process.env.MERIDIAN_WORKDIR ?? process.env.CLAUDE_PROXY_WORKDIR ?? process.cwd();
 function createOpencodeMcpServer() {
   return createSdkMcpServer2({
     name: "opencode",
@@ -18040,7 +18391,7 @@ function createOpencodeMcpServer() {
         encoding: exports_external.string().optional().describe("File encoding, defaults to utf-8")
       }, async (args) => {
         try {
-          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd(), args.path);
+          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd2(), args.path);
           const content = await fs.readFile(filePath, args.encoding || "utf-8");
           return {
             content: [{ type: "text", text: content }]
@@ -18057,7 +18408,7 @@ function createOpencodeMcpServer() {
         content: exports_external.string().describe("Content to write")
       }, async (args) => {
         try {
-          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd(), args.path);
+          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd2(), args.path);
           await fs.mkdir(path2.dirname(filePath), { recursive: true });
           await fs.writeFile(filePath, args.content, "utf-8");
           return {
@@ -18076,7 +18427,7 @@ function createOpencodeMcpServer() {
         newString: exports_external.string().describe("The replacement text")
       }, async (args) => {
         try {
-          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd(), args.path);
+          const filePath = path2.isAbsolute(args.path) ? args.path : path2.resolve(getCwd2(), args.path);
           const content = await fs.readFile(filePath, "utf-8");
           if (!content.includes(args.oldString)) {
             return {
@@ -18102,7 +18453,7 @@ function createOpencodeMcpServer() {
       }, async (args) => {
         try {
           const options = {
-            cwd: args.cwd || getCwd(),
+            cwd: args.cwd || getCwd2(),
             timeout: 120000
           };
           const { stdout, stderr } = await execAsync(args.command, options);
@@ -18125,7 +18476,7 @@ function createOpencodeMcpServer() {
       }, async (args) => {
         try {
           const files = await glob(args.pattern, {
-            cwd: args.cwd || getCwd(),
+            cwd: args.cwd || getCwd2(),
             nodir: true,
             ignore: ["**/node_modules/**", "**/.git/**"]
           });
@@ -18144,22 +18495,7 @@ function createOpencodeMcpServer() {
         pattern: exports_external.string().describe("Regex pattern to search for"),
         path: exports_external.string().optional().describe("Directory or file to search in"),
         include: exports_external.string().optional().describe("File pattern to include, e.g., *.ts")
-      }, async (args) => {
-        try {
-          const searchPath = args.path || getCwd();
-          const includePattern = args.include || "*";
-          let cmd = `grep -rn --include="${includePattern}" "${args.pattern}" "${searchPath}" 2>/dev/null || true`;
-          const { stdout } = await execAsync(cmd, { maxBuffer: 10 * 1024 * 1024 });
-          return {
-            content: [{ type: "text", text: stdout || "(no matches)" }]
-          };
-        } catch (error) {
-          return {
-            content: [{ type: "text", text: `Error: ${error instanceof Error ? error.message : String(error)}` }],
-            isError: true
-          };
-        }
-      })
+      }, runGrepTool)
     ]
   });
 }
@@ -18219,7 +18555,7 @@ function buildQueryOptions(ctx, abortController) {
     systemContext,
     claudeExecutable,
     passthrough,
-    stream: stream2,
+    stream: stream3,
     sdkAgents,
     passthroughMcp,
     cleanEnv,
@@ -18261,7 +18597,7 @@ function buildQueryOptions(ctx, abortController) {
       model,
       pathToClaudeCodeExecutable: claudeExecutable,
       ...abortController ? { abortController } : {},
-      ...stream2 ? { includePartialMessages: true } : {},
+      ...stream3 ? { includePartialMessages: true } : {},
       permissionMode: "bypassPermissions",
       allowDangerouslySkipPermissions: true,
       ...resolveSystemPrompt(systemContext, passthrough, settingSources, codeSystemPrompt, clientSystemPrompt, cwdNote),
@@ -18401,7 +18737,7 @@ function getAdapterTransforms(adapterName) {
 
 // src/proxy/plugins/loader.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
-import { join as join4, isAbsolute as isAbsolute2, extname } from "path";
+import { join as join5, isAbsolute as isAbsolute2, extname } from "path";
 import { pathToFileURL } from "url";
 
 // src/proxy/plugins/validation.ts
@@ -18486,7 +18822,7 @@ async function loadPlugins(pluginDir, configPath) {
   const loaded = [];
   const seenNames = new Set;
   for (const { filename, entry } of ordered) {
-    const filePath = isAbsolute2(filename) ? filename : join4(pluginDir, filename);
+    const filePath = isAbsolute2(filename) ? filename : join5(pluginDir, filename);
     if (entry && !entry.enabled) {
       loaded.push({
         name: filename,
@@ -18868,8 +19204,8 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join6 } from "node:path";
 var DEFAULT_MAX_STORED_SESSIONS = 1e4;
 var STALE_LOCK_THRESHOLD_MS = 30000;
 function getMaxStoredSessions() {
@@ -18920,11 +19256,11 @@ function getStorePath() {
   if (!existsSync6(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
-  return join5(dir, "sessions.json");
+  return join6(dir, "sessions.json");
 }
 function getDefaultCacheDir() {
-  const newDir = join5(homedir4(), ".cache", "meridian");
-  const oldDir = join5(homedir4(), ".cache", "opencode-claude-max-proxy");
+  const newDir = join6(homedir5(), ".cache", "meridian");
+  const oldDir = join6(homedir5(), ".cache", "opencode-claude-max-proxy");
   if (existsSync6(newDir))
     return newDir;
   if (existsSync6(oldDir)) {
@@ -19264,7 +19600,7 @@ function storeSession(sessionId, messages, claudeSessionId, workingDirectory, sd
 }
 
 // src/proxy/server.ts
-var exec2 = promisify2(execCallback);
+var exec2 = promisify3(execCallback);
 var claudeExecutable = "";
 var UPSTREAM_IDLE_MS = 90000;
 function credentialStoreForProfile(profile) {
@@ -19494,8 +19830,8 @@ function createProxyServer(config = {}) {
         pendingSessionStores.delete(key);
     };
   };
-  const pluginDir = finalConfig.pluginDir ?? join7(homedir6(), ".config", "meridian", "plugins");
-  const pluginConfigPath = finalConfig.pluginConfigPath ?? join7(homedir6(), ".config", "meridian", "plugins.json");
+  const pluginDir = finalConfig.pluginDir ?? join8(homedir7(), ".config", "meridian", "plugins");
+  const pluginConfigPath = finalConfig.pluginConfigPath ?? join8(homedir7(), ".config", "meridian", "plugins.json");
   let loadedPlugins = [];
   let pluginTransforms = [];
   const app = new Hono2;
@@ -19511,6 +19847,7 @@ function createProxyServer(config = {}) {
   app.use("/plugins", requireAuth);
   app.use("/settings/*", requireAuth);
   app.use("/settings", requireAuth);
+  app.use("/design-login", requireAuth);
   app.use("/auth/*", requireAuth);
   app.get("/", (c) => {
     const accept = c.req.header("accept") || "";
@@ -19519,7 +19856,7 @@ function createProxyServer(config = {}) {
         status: "ok",
         service: "meridian",
         format: "anthropic",
-        endpoints: ["/v1/messages", "/messages", "/v1/chat/completions", "/v1/responses", "/v1/models", "/telemetry", "/metrics", "/health"]
+        endpoints: ["/v1/messages", "/messages", "/v1/chat/completions", "/v1/responses", "/v1/models", "/v1/design/*", "/design-login", "/telemetry", "/metrics", "/health"]
       });
     }
     return c.html(landingHtml);
@@ -19632,7 +19969,7 @@ function createProxyServer(config = {}) {
           stream: body.stream ?? false,
           workingDirectory
         }), adapterBase);
-        const stream2 = pipelineCtx.prefersStreaming !== undefined ? pipelineCtx.prefersStreaming : body.stream ?? false;
+        const stream3 = pipelineCtx.prefersStreaming !== undefined ? pipelineCtx.prefersStreaming : body.stream ?? false;
         const effortHeader = c.req.header("x-opencode-effort");
         const thinkingHeader = c.req.header("x-opencode-thinking");
         const taskBudgetHeader = c.req.header("x-opencode-task-budget");
@@ -19679,7 +20016,7 @@ function createProxyServer(config = {}) {
         const lastMessage = Array.isArray(body.messages) ? body.messages[body.messages.length - 1] : undefined;
         const lastIsToolResult = Array.isArray(lastMessage?.content) && lastMessage.content.some((b) => b?.type === "tool_result");
         const isClientDrivenLoop = adapterBase !== "claude-code" && !agentSessionId && lastIsToolResult;
-        const isIndependentSession = requestSource?.startsWith("fork-") || requestSource?.startsWith("subagent-") || isClientDrivenLoop || false;
+        const isIndependentSession = !agentSessionId && (requestSource?.startsWith("fork-") || requestSource?.startsWith("subagent-")) || isClientDrivenLoop || false;
         if (!isIndependentSession && profileSessionId) {
           const pendingStore = pendingSessionStores.get(profileSessionId);
           if (pendingStore) {
@@ -19707,7 +20044,7 @@ function createProxyServer(config = {}) {
         const lineageType = lineageResult.type === "diverged" && !cachedSession ? "new" : lineageResult.type;
         const msgCount = Array.isArray(body.messages) ? body.messages.length : 0;
         const toolCount = body.tools?.length ?? 0;
-        const requestLogLine = `${requestMeta.requestId} adapter=${adapter.name}${requestSource ? ` source=${requestSource}` : ""}${profile.id !== "default" ? ` profile=${profile.id}${routingMode === "sticky" ? "(sticky)" : ""}` : ""} model=${model} stream=${stream2} tools=${toolCount} lineage=${lineageType} session=${resumeSessionId?.slice(0, 8) || "new"}${isUndo && undoRollbackUuid ? ` rollback=${undoRollbackUuid.slice(0, 8)}` : ""}${agentMode ? ` agent=${agentMode}` : ""} active=${activeSessions}/${MAX_CONCURRENT_SESSIONS} msgCount=${msgCount}`;
+        const requestLogLine = `${requestMeta.requestId} adapter=${adapter.name}${requestSource ? ` source=${requestSource}` : ""}${profile.id !== "default" ? ` profile=${profile.id}${routingMode === "sticky" ? "(sticky)" : ""}` : ""} model=${model} stream=${stream3} tools=${toolCount} lineage=${lineageType} session=${resumeSessionId?.slice(0, 8) || "new"}${isUndo && undoRollbackUuid ? ` rollback=${undoRollbackUuid.slice(0, 8)}` : ""}${agentMode ? ` agent=${agentMode}` : ""} active=${activeSessions}/${MAX_CONCURRENT_SESSIONS} msgCount=${msgCount}`;
         plog(`[PROXY] ${requestLogLine} msgs=${msgSummary}`);
         diagnosticLog2.session(`${requestLogLine}`, requestMeta.requestId);
         if (lineageResult.type === "diverged" && profileSessionId && !isIndependentSession) {
@@ -19721,7 +20058,7 @@ function createProxyServer(config = {}) {
         }
         claudeLog("request.received", {
           model,
-          stream: stream2,
+          stream: stream3,
           queueWaitMs: requestMeta.queueStartedAt - requestMeta.queueEnteredAt,
           messageCount: Array.isArray(body.messages) ? body.messages.length : 0,
           hasSystemPrompt: Boolean(body.system)
@@ -19960,7 +20297,7 @@ function createProxyServer(config = {}) {
           stderrLines.push(data.trimEnd());
           claudeLog("subprocess.stderr", { line: data.trimEnd() });
         };
-        if (!stream2) {
+        if (!stream3) {
           const contentBlocks = [];
           let assistantMessages = 0;
           let hasStructuredOutput = false;
@@ -21897,6 +22234,10 @@ data: ${JSON.stringify({
       "Content-Type": "application/json",
       "x-meridian-agent": "codex"
     };
+    const promptCacheKey = rawBody.prompt_cache_key;
+    if (typeof promptCacheKey === "string" && promptCacheKey.length > 0) {
+      internalHeaders["x-codex-session"] = promptCacheKey;
+    }
     const xApiKey = c.req.header("x-api-key");
     if (xApiKey)
       internalHeaders["x-api-key"] = xApiKey;
@@ -22147,6 +22488,65 @@ data: ${JSON.stringify({ response: { id: responseId, status: "failed", error: {
       } : {}
     });
   });
+  const designTokenStore = createFileDesignTokenStore();
+  const designLogin = createDesignLogin({ store: designTokenStore });
+  app.get("/design-login", (c) => c.json(designLogin.start()));
+  app.post("/design-login", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ type: "error", error: { type: "invalid_request", message: "Request body must be JSON with a 'code' field." } }, 400);
+    }
+    const result = await designLogin.exchange(body);
+    if (result.status === 200)
+      plog(`[PROXY] Design token stored via /design-login`);
+    return new Response(JSON.stringify(result.body), {
+      status: result.status,
+      headers: { "content-type": "application/json" }
+    });
+  });
+  app.get("/v1/design/*", (c) => {
+    c.status(200);
+    c.header("content-type", "text/event-stream");
+    c.header("cache-control", "no-cache");
+    return stream(c, async (s) => {
+      while (!s.aborted) {
+        await s.write(`: keepalive
+
+`);
+        await s.sleep(15000);
+      }
+    });
+  });
+  app.post("/v1/design/*", async (c) => {
+    const profile = resolveProfile(finalConfig.profiles, finalConfig.defaultProfile, c.req.header("x-meridian-profile") || undefined);
+    const url = new URL(c.req.url);
+    const upstreamUrl = `${DESIGN_UPSTREAM_ORIGIN}${url.pathname}${url.search}`;
+    const designToken = await getDesignAccessToken({ store: designTokenStore });
+    const authHeaders = await resolveDesignAuthHeaders({
+      designToken,
+      profile,
+      credentialStore: credentialStoreForProfile(profile),
+      ensureFresh: ensureFreshToken
+    });
+    const body = await c.req.arrayBuffer();
+    const forwardHeaders = buildDesignForwardHeaders((name) => c.req.header(name), authHeaders);
+    let upstreamRes;
+    try {
+      upstreamRes = await fetch(upstreamUrl, { method: "POST", headers: forwardHeaders, body });
+    } catch (err) {
+      return c.json({ type: "error", error: { type: "upstream_error", message: err instanceof Error ? err.message : String(err) } }, 502);
+    }
+    if (isDesignAuthFailure(upstreamRes.status)) {
+      return c.json({ type: "error", error: { type: "auth_error", message: "Unauthorized. Run /design-login to authorize Claude Design (adds user:design:read/write scopes)." } }, 401);
+    }
+    plog(`[PROXY] DESIGN upstream=${upstreamRes.status}`);
+    return new Response(upstreamRes.body, {
+      status: upstreamRes.status,
+      headers: filterUpstreamResponseHeaders(upstreamRes.headers.entries())
+    });
+  });
   app.all("*", (c) => {
     plog(`[PROXY] UNHANDLED ${c.req.method} ${c.req.url}`);
     return c.json({ error: { type: "not_found", message: `Endpoint not supported: ${c.req.method} ${new URL(c.req.url).pathname}` } }, 404);