llm-switcher 1.1.11 → 1.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.1.11",
+  "version": "1.2.2",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -7,21 +7,23 @@ import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import { createFrameReader } from './blindfold/wsframe.mjs';
 import {
-  OUT_FORMATS, IN_FORMATS, parseToIR, emitUpstreamBody, createUpstreamNormalizer, createCollector,
+  OUT_FORMATS, parseToIR, emitUpstreamBody, createUpstreamNormalizer, createCollector,
   createThinkTagSplitter, splitThinkTags, healAnthropicPayload, estimateTokens, THINKING_MODES,
   toGeminiSchema, isAntigravityModel,
   createAnthropicStream, createChatStream, createResponsesStream, createVertexStream,
   buildAnthropicMessage, buildChatMessage, buildResponsesMessage, buildVertexMessage
 } from './formats.mjs';
 import {
-  TARGETS, configPath, loadConfig, getConfigLoadError, saveConfig, resolvePort, hasProfile, isValidProfileKey,
+  TOOLS, configPath, loadConfig, getConfigLoadError, saveConfig, resolvePort, hasProfile, isValidProfileKey,
+  getMigrationError, getMigrationCollision,
   getActiveMap, setTargetProfile, activateProfile, deactivateProfile, deactivateAll, deleteProfile,
   isProfileActive, profileAcceptsTarget, applyLaunchState, readLaunchFlags, redactConfig, MASKED_KEY,
   modelForSlot, primaryModel, codexPublicModel, isSafeModelName, parsePort, CODEX_MODEL_SLOTS,
   ensureAdminToken, identityProof, reconcileBlindfold, checkBlindfoldTarget,
-  codexModelEntry, smallestWindows, publicModelWindows, model1MForSlot, computeLaunchState,
-  contractLabSettings
+  codexModelEntry, smallestWindows, publicModelWindows, model1MForSlot,
+  contractLabSettings, STATE_DIR
 } from './state.mjs';
+import { classifyCodexRole, classifyClaudeTier, loadCatalogCache, refreshCatalog, checkVersionAndRefresh } from './catalog.mjs';
 import { createContractLab, createHalfTap, tapClientWrites, capText, capJson, toolVersionFromUA, finishHalf, PROBE_HEADER, TRACE_ID_RE } from './contract.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -198,6 +200,9 @@ async function readJsonBody(req, limit = MAX_API_BODY_SIZE) {
 // ----------------------------------------------------
 // Profile & model resolution
 // ----------------------------------------------------
+// R5: the only two input protocols, each owned by one tool.
+const CLIENT_FORMAT_TOOL = { anthropic: 'claude', responses: 'codex' };
+
 function getActiveProfile(clientFormat, req) {
   const cfg = loadConfig();
   if (!cfg) return { cfg: null, profileKey: null, profile: null };
@@ -214,9 +219,12 @@ function getActiveProfile(clientFormat, req) {
     return { cfg, profileKey: reqProfile, profile: null, error: `Profile "${reqProfile}" requested via x-llm-profile/?profile= does not exist` };
   }
 
-  // Look up the active profile by CLI target (clientFormat: anthropic | responses | openai-chat | vertex).
-  // Deleted profile / disabled target counts as OFF, never silently fall through to another profile (different API key!).
-  const key = clientFormat ? getActiveMap(cfg)[clientFormat] : (cfg.activeProfile || null);
+  // R4: resolve by TOOL, not by the protocol the request arrived in. Only two client formats
+  // exist anymore — anthropic is Claude Code's, responses is Codex's — and each has exactly one
+  // pointer, activeProfiles.claude and activeProfiles.codex. A deleted profile or a disabled tool
+  // counts as OFF and never falls through to the other tool's profile (different API key!).
+  const key = clientFormat ? getActiveMap(cfg)[CLIENT_FORMAT_TOOL[clientFormat]] ?? null
+    : (cfg.activeProfile || null);
   if (!key || !hasProfile(cfg, key)) return { cfg, profileKey: key || null, profile: null };
   return { cfg, profileKey: key, profile: cfg.profiles[key] };
 }
@@ -266,12 +274,12 @@ function mapModel(requestedModel, profile, clientFormat) {
     // retired gpt-5.3-codex) have no credentials behind 9Router -> fail closed to the main slot
     // instead of passing through to an upstream 404. Provider-prefixed names (ag/..., cf/...)
     // are preserved by the early return above.
-    if (/^(gpt|o\d|codex)([-/]|$)/i.test(clean)) return modelForSlot(profile, 'main') || clean;
+    if (/^(gpt|o\d|codex)([-/]|$)/i.test(clean)) {
+      const autoRole = classifyCodexRole(clean);
+      return (autoRole !== 'main' ? modelForSlot(profile, autoRole) : null) || modelForSlot(profile, 'main') || clean;
+    }
     return clean || requestedModel;
   }
-  if (clientFormat === 'openai-chat' || clientFormat === 'vertex') {
-    if (m === 'default' || m === 'main' || !clean) return modelForSlot(profile, 'default') || clean;
-  }
   if (m.includes('fable')) return modelForSlot(profile, 'fable') || clean;
   if (m.includes('opus')) return modelForSlot(profile, 'opus') || clean;
   if (m.includes('haiku')) return modelForSlot(profile, 'haiku') || clean;
@@ -974,7 +982,15 @@ function validateProfileInput(p) {
   for (const k of ['name', 'baseURL', 'optimizerURL']) {
     if (typeof p[k] === 'string' && CONTROL_CHARS.test(p[k])) return `${k} must not contain control characters`;
   }
-  if (p.inFormat && p.inFormat !== 'auto' && !IN_FORMATS.includes(p.inFormat)) return `Invalid inFormat "${p.inFormat}"`;
+  // R6 / R7(c): a profile declares exactly one tool. An old-format field must never be written back.
+  if (p.inFormat !== undefined) return 'inFormat is not supported; use "tool": "claude" or "tool": "codex"';
+  if (p.blindfold !== undefined) return 'blindfold per-profile setting is deprecated';
+  if (p.blindfoldPort !== undefined) return 'blindfoldPort per-profile setting is deprecated';
+  if (p.blindfoldHost !== undefined) return 'blindfoldHost per-profile setting is deprecated';
+  if (p.blindfoldPrefix !== undefined) return 'blindfoldPrefix per-profile setting is deprecated';
+  if (p.tool !== undefined && p.tool !== null && !TOOLS.includes(p.tool)) {
+    return `Invalid tool "${p.tool}". Valid: ${TOOLS.join(', ')}`;
+  }
   if (p.outFormat && !OUT_FORMATS.includes(p.outFormat)) return `Invalid outFormat "${p.outFormat}"`;
   if (p.mode && !VALID_MODES.includes(p.mode)) return `Invalid mode "${p.mode}"`;
   if (p.thinkingMode && !THINKING_MODES.includes(p.thinkingMode)) return `Invalid thinkingMode "${p.thinkingMode}"`;
@@ -1002,15 +1018,6 @@ function validateProfileInput(p) {
       if (name !== '' && !isSafeModelName(name)) return `Invalid codexRoles.${slot} value "${name}"`;
     }
   }
-  if (p.blindfoldPort !== undefined && p.blindfoldPort !== '' && !parsePort(p.blindfoldPort)) {
-    return `Invalid blindfoldPort "${p.blindfoldPort}"`;
-  }
-  if (p.blindfoldHost !== undefined && p.blindfoldHost !== '' && !/^[A-Za-z0-9.-]{1,253}$/.test(p.blindfoldHost)) {
-    return `Invalid blindfoldHost "${p.blindfoldHost}"`;
-  }
-  if (p.blindfoldPrefix !== undefined && p.blindfoldPrefix !== '' && !/^\/[A-Za-z0-9._~/-]{0,200}$/.test(p.blindfoldPrefix)) {
-    return `Invalid blindfoldPrefix "${p.blindfoldPrefix}"`;
-  }
   return null;
 }
 
@@ -1080,7 +1087,9 @@ async function fetchModels(body, cfg) {
 
 // Vertex/Gemini: /v1beta/models/{m}:{action} (Gemini API) and
 // /v1/projects/{p}/locations/{l}/publishers/{pub}/models/{m}:{action} (Vertex AI SDK).
-const VERTEX_ROUTE = /^\/(?:v1|v1beta|v1beta1)\/(?:projects\/[^/]+\/locations\/[^/]+\/publishers\/[^/]+\/)?models\/([^/:]+):(generateContent|streamGenerateContent)$/;
+// R4/Codex: model mapping for the responses input only. Claude Code's mapping is the tier
+// substring chain at the bottom of mapModel. No alias (`main`, `opus[1m]`) ever leaves this
+// function: the `[1m]` suffix is stripped before anything is looked up.
 
 // ----------------------------------------------------
 // Router
@@ -1100,11 +1109,32 @@ async function route(req, res) {
     res.writeHead(204, {
       'Access-Control-Allow-Origin': req.headers.origin || `http://127.0.0.1:${PORT}`,
       'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-      'Access-Control-Allow-Headers': 'Content-Type, Authorization'
+      'Access-Control-Allow-Headers': 'Content-Type, Authorization, x-llm-switcher-token'
     });
     return res.end();
   }
 
+  // Serve static tool icons (cached, immutable, strictly image/png and image/svg+xml)
+  if (method === 'GET' && pathname.startsWith('/icons/')) {
+    const iconName = path.basename(pathname);
+    if (!/\.(png|svg)$/i.test(iconName)) {
+      res.writeHead(404, { 'Content-Type': 'text/plain' });
+      return res.end('Icon not found');
+    }
+    const iconPath = path.join(__dirname, 'icons', iconName);
+    if (fs.existsSync(iconPath)) {
+      const ext = path.extname(iconName).toLowerCase();
+      const contentType = ext === '.svg' ? 'image/svg+xml' : 'image/png';
+      res.writeHead(200, {
+        'Content-Type': contentType,
+        'Cache-Control': 'public, max-age=604800, immutable'
+      });
+      return fs.createReadStream(iconPath).pipe(res);
+    }
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    return res.end('Icon not found');
+  }
+
   // Serve Web UI (no-cache: always serve the latest version after file edits)
   if (method === 'GET' && (pathname === '/' || pathname === '/ui')) {
     if (fs.existsSync(uiHtmlPath)) {
@@ -1123,7 +1153,7 @@ async function route(req, res) {
 
   // Health check
   if (method === 'GET' && pathname === '/health') {
-    const { profileKey, profile } = getFirstActiveProfile(TARGETS, req);
+    const { profileKey, profile } = getFirstActiveProfile(['responses', 'anthropic'], req);
     // ?challenge=<nonce> lets the CLI tell this gateway from a process that replays a /health body.
     const challenge = parsedUrl.searchParams.get('challenge');
     return sendJson(res, 200, {
@@ -1151,6 +1181,7 @@ async function route(req, res) {
   // advertised: Codex sends them in-request and mapModel resolves them server-side.
   // Without publicModels, fall back to the deduplicated mapped upstream IDs.
   if (method === 'GET' && (pathname === '/v1/models' || pathname === '/models')) {
+    checkVersionAndRefresh(req.headers['anthropic-version'] ? 'claude' : 'codex', req.headers, STATE_DIR);
     const { ids, windows } = servedModels(req);
     const created = Math.floor(Date.now() / 1000);
     return sendJson(res, 200, {
@@ -1183,9 +1214,7 @@ async function route(req, res) {
     return handleCountTokens(req, res, buf);
   }
 
-  // Client endpoints, one per input protocol (auto-detected by path).
   let clientFormat = null;
-  const vmatch = method === 'POST' ? pathname.match(VERTEX_ROUTE) : null;
 
   // Codex CLI sends GET /v1/responses (and /v1/responses/{id}) to fetch model
   // metadata and retrieve previous responses.  The gateway is stateless, so
@@ -1206,18 +1235,18 @@ async function route(req, res) {
 
   if (method === 'POST') {
     if (pathname === '/v1/messages' || pathname === '/messages') clientFormat = 'anthropic';
-    else if (pathname === '/v1/chat/completions' || pathname === '/chat/completions') clientFormat = 'openai-chat';
     else if (pathname === '/v1/responses' || pathname === '/responses') clientFormat = 'responses';
-    else if (vmatch) clientFormat = 'vertex';
   }
   if (clientFormat) {
+    if (clientFormat === 'anthropic') checkVersionAndRefresh('claude', req.headers, STATE_DIR);
+    else if (clientFormat === 'responses') checkVersionAndRefresh('codex', req.headers, STATE_DIR);
     let buf;
     try {
       buf = await readBody(req, MAX_BODY_SIZE);
     } catch (err) {
       return sendClientError(res, clientFormat, err.status || 400, err.message);
     }
-    const opts = vmatch ? { vertexModel: decodeURIComponent(vmatch[1]), vertexStream: vmatch[2] === 'streamGenerateContent' } : {};
+    const opts = {};
     return handleConvert(clientFormat, req, res, buf, opts);
   }
 
@@ -1228,7 +1257,7 @@ async function route(req, res) {
 // The names /v1/models serves, and the window of each. Official names when the profile publishes
 // them, otherwise the mapped upstream IDs; each window follows model1M of its slot.
 function servedModels(req) {
-  const { profile } = getFirstActiveProfile(['responses', 'openai-chat', 'anthropic', 'vertex'], req);
+  const { profile } = getFirstActiveProfile(['responses', 'anthropic'], req);
   if (Array.isArray(profile?.publicModels) && profile.publicModels.length) {
     return { ids: [...new Set(profile.publicModels.filter(Boolean))], windows: publicModelWindows(profile) };
   }
@@ -1247,9 +1276,8 @@ async function routeApi(req, res, method, pathname) {
       activeProfile: cfg.activeProfile || null,
       activeProfiles,
       revision: configRevision(cfg),
-      claude1MTiers: computeLaunchState(cfg, PORT).claude1MTiers,
       ...readLaunchFlags(),
-      claudeBaseURL: activeProfiles.anthropic ? `http://127.0.0.1:${PORT} (injected via launcher)` : '(none / official)',
+      claudeBaseURL: activeProfiles.claude ? `http://127.0.0.1:${PORT} (injected via launcher)` : '(none / official)',
       config: redactConfig(cfg)
     });
   }
@@ -1259,6 +1287,11 @@ async function routeApi(req, res, method, pathname) {
     return sendJson(res, 200, { logs: requestLogs.slice().reverse() });
   }
 
+  // GET /api/catalog (Dynamic Model Discovery)
+  if (method === 'GET' && pathname === '/api/catalog') {
+    return sendJson(res, 200, loadCatalogCache(STATE_DIR));
+  }
+
   if (method !== 'POST') {
     req.resume();
     return sendJson(res, 404, { error: `Not found: ${method} ${pathname}` });
@@ -1271,6 +1304,19 @@ async function routeApi(req, res, method, pathname) {
     return sendJson(res, err.status || 400, { error: err.message });
   }
 
+  // POST /api/catalog/refresh
+  if (method === 'POST' && pathname === '/api/catalog/refresh') {
+    const active = getActiveMap(requireConfig(res) || {});
+    const cfg = requireConfig(res) || {};
+    const claudeProfile = active.claude ? cfg.profiles?.[active.claude] : null;
+    const codexProfile = active.codex ? cfg.profiles?.[active.codex] : null;
+    const updated = await refreshCatalog(STATE_DIR, {
+      claudeKey: claudeProfile?.apiKey,
+      codexKey: codexProfile?.apiKey
+    });
+    return sendJson(res, 200, { success: true, catalog: updated });
+  }
+
   // POST /api/logs/clear
   if (pathname === '/api/logs/clear') {
     requestLogs.length = 0;
@@ -1292,6 +1338,12 @@ async function routeConfigApi(res, method, pathname, body) {
   }
 
   // POST /api/switch  { target?, profile? | null, deactivate? }
+  // R7: a migration collision means config.json is in a shape this build refuses to rewrite.
+  // Every route that writes it answers the same way, and the bytes on disk stay as they are.
+  if (getMigrationCollision() && ['/api/switch', '/api/toggle', '/api/save-profile', '/api/delete-profile'].includes(pathname)) {
+    return sendJson(res, 409, { error: 'Migration collision', clashingKeys: getMigrationCollision().clashingKeys });
+  }
+
   if (pathname === '/api/switch') {
     let err = null;
     if (body.deactivate) {
@@ -1313,7 +1365,7 @@ async function routeConfigApi(res, method, pathname, body) {
     const map = getActiveMap(cfg);
     let err = null;
     if (body.target) {
-      if (!TARGETS.includes(body.target)) return sendJson(res, 400, { error: `Unknown target "${body.target}"` });
+      if (!TOOLS.includes(body.target)) return sendJson(res, 400, { error: `Unknown target "${body.target}"` });
       let key = null;
       if (body.enabled) {
         const candidates = [map[body.target], cfg.activeProfile, ...Object.keys(cfg.profiles)];
@@ -1361,7 +1413,7 @@ async function routeConfigApi(res, method, pathname, body) {
     const map = getActiveMap(cfg);
     cfg.activeProfiles = map;
     let unassigned = false;
-    for (const t of TARGETS) {
+    for (const t of TOOLS) {
       if (map[t] === key && !profileAcceptsTarget(merged, t)) {
         map[t] = null;
         unassigned = true;
@@ -1369,7 +1421,16 @@ async function routeConfigApi(res, method, pathname, body) {
     }
 
     // Profile is active (or was just unassigned from a target) -> refresh 1M flags / env files.
-    const applied = isProfileActive(cfg, key) || unassigned ? await commit(cfg, baseRevision) : (saveConfig(cfg), { revision: configRevision(cfg) });
+    let applied;
+    try {
+      applied = isProfileActive(cfg, key) || unassigned ? await commit(cfg, baseRevision) : (saveConfig(cfg), { revision: configRevision(cfg) });
+    } catch (err) {
+      // saveConfig refuses while a migration collision or migration error blocks writes (R7).
+      if (getMigrationError() || getMigrationCollision()) {
+        return sendJson(res, 409, { error: err.message });
+      }
+      throw err;
+    }
     return sendJson(res, applied.status || (applied.success === false ? 502 : 200), { success: true, ...applied });
   }
 
@@ -1677,6 +1738,8 @@ server.on('upgrade', (req, socket) => {
     return;
   }
 
+  checkVersionAndRefresh('codex', req.headers, STATE_DIR);
+
   const key = req.headers['sec-websocket-key'];
   if (!key) {
     socket.destroy();
@@ -1788,12 +1851,26 @@ server.on('error', (err) => {
 if (!loadConfig()) {
   console.warn(`[llm-switcher:WARN] Could not load ${configPath}: ${getConfigLoadError()?.message}. Copy config.example.json to config.json.`);
 }
+// R7: a migration that could not complete blocks every write. Say so at startup instead of
+// failing later, on the first save, with an error nobody connects back to this.
+if (getMigrationError()) {
+  console.error(`[llm-switcher:ERROR] ${getMigrationError().message}`);
+}
+if (getMigrationCollision()) {
+  console.error(`[llm-switcher:ERROR] Configuration migration collision: ${JSON.stringify(getMigrationCollision().clashingKeys)}. Fix config.json; it is not being rewritten.`);
+}
 
 server.listen(PORT, '127.0.0.1', () => {
   // A service start or a restart on a new port finds env-codex.* already pointing at the interceptor.
   const cfg = loadConfig();
-  if (cfg && !getConfigLoadError()) serialized(() => reconcile(cfg));
+  if (getMigrationCollision()) {
+    console.error('[llm-switcher] Skipping reconcile: a configuration migration collision blocks writes.');
+  } else if (cfg && !getConfigLoadError()) {
+    serialized(() => reconcile(cfg));
+  }
   console.log(`[llm-switcher] Server running on http://127.0.0.1:${PORT}`);
   console.log(`[llm-switcher] Web UI available at: http://127.0.0.1:${PORT}/ui`);
-  console.log(`[llm-switcher] Endpoints: /v1/messages (anthropic) | /v1/chat/completions (openai) | /v1/responses (codex) | /v1beta/models/* (vertex)`);
+  console.log(`[llm-switcher] Endpoints: /v1/messages (Claude Code) | /v1/responses (Codex)`);
+  // Asynchronously discover latest tool models in the background without blocking startup
+  refreshCatalog(STATE_DIR).catch(() => {});
 });

package/shim.mjs

@@ -26,33 +26,121 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { paths, STATE_DIR } from './state.mjs';
 
 export const SHIM_DIR = path.join(os.homedir(), '.llm-switcher', 'bin');
 
-// Local model catalog: generated by applyLaunchState from the active profile's
-// publicModels, so it holds official OpenAI slugs only. It gives Codex the metadata
-// for the names it requests (otherwise the CLI falls back to full-context mode) and
-// it is what the /model picker renders — the picker never calls /v1/models.
-// Forward slashes for the TOML value. The Windows `if exist` test uses the native path instead.
-export const CODE_X_CATALOG_PATH = paths.codexCatalog.replace(/\\/g, '/');
+// The shims hand the CA work to Node: reading files, comparing content and renaming atomically
+// has no place in a shell script, and none at all in cmd.exe. It is a FILE rather than
+// `node -e`, so neither cmd.exe quoting nor URL encoding can corrupt it: pathToFileURL turns a
+// space in the checkout into %20, which cmd.exe then reads as the (undefined) argument %2.
+const STATE_HELPER = path.join(path.dirname(fileURLToPath(import.meta.url)), 'ensure-ca-bundle.mjs');
 
 // CLIs to wrap. `claude` is the most important case (--resume), codex included for completeness.
 export const SHIMMED = ['claude', 'codex'];
 
-const POSIX_TEMPLATE = (name) => `#!/usr/bin/env bash
+// One tool, one env file. Sourcing the shared one is how one tool used to capture the other.
+const envFileOf = (name) => (name === 'codex' ? 'env-codex.sh' : 'env-claude.sh');
+
+const POSIX_TEMPLATE = (name) => {
+  const envFile = envFileOf(name);
+  const caBlock = name === 'codex' ? '' : `
+# R2: one bundle holds the user's own CA and the switcher CA, so trusting the interceptor never
+# costs a certificate the user already had. Decided here, at launch, because only now is it known
+# whether the user brought one — and never while this tool is off.
+if [ "$TOOL_ACTIVE" = "1" ]; then
+  if [ -z "$INHERITED_CA" ]; then
+    if [ -f "$SWITCHER_DIR/blindfold/certs/ca.pem" ]; then
+      export NODE_EXTRA_CA_CERTS="$SWITCHER_DIR/blindfold/certs/ca.pem"
+    else
+      echo "[llm-switcher] $SWITCHER_DIR/blindfold/certs/ca.pem not found; NODE_EXTRA_CA_CERTS kept as inherited." >&2
+    fi
+  else
+    CA_BUNDLE="$(node "$STATE_HELPER" "$INHERITED_CA" "$SWITCHER_DIR/blindfold/certs/ca.pem" "$SWITCHER_DIR")" || CA_BUNDLE=""
+    if [ -n "$CA_BUNDLE" ] && [ -f "$CA_BUNDLE" ]; then
+      export NODE_EXTRA_CA_CERTS="$CA_BUNDLE"
+    fi
+  fi
+fi`;
+  return `#!/usr/bin/env bash
 # Auto-generated by LLM Switcher — DO NOT EDIT.
-# Load the gateway env then run the real "${name}", even when the shell hasn't sourced env.sh
-# (e.g.: claude --resume reopening an old session in a clean terminal).
+# Hand THIS tool its own gateway env, scrub what an older switcher left behind, then run the real
+# "${name}", from any shell — including one that never sourced anything (claude --resume).
 SWITCHER_DIR="${STATE_DIR}"
+STATE_HELPER="${STATE_HELPER}"
 SHIM_DIR="\${BASH_SOURCE%/*}"
 
-# Only load env when the gateway is on; when off, let the CLI run as-is. The shim runs what env.sh says,
-# so the directory and the file must belong to this account: another one could have created them.
-if [ -O "$SWITCHER_DIR" ] && [ -O "$SWITCHER_DIR/env.sh" ] && [ -f "$SWITCHER_DIR/active.flag" ]; then
-  . "$SWITCHER_DIR/env.sh"
+# Captured BEFORE the tool's env file is sourced: the CA decision must see the value this shell
+# already had, not one this run is about to write.
+INHERITED_CA="\${NODE_EXTRA_CA_CERTS:-}"
+
+# Only this tool's own file, only while the gateway is on, and only files this account owns:
+# another account could have created the directory or the file. Non-empty means the tool runs;
+# an empty file means it is off, and then nothing is sourced at all.
+if [ -O "$SWITCHER_DIR" ] && [ -O "$SWITCHER_DIR/${envFile}" ] && [ -f "$SWITCHER_DIR/active.flag" ] && [ -s "$SWITCHER_DIR/${envFile}" ]; then
+  . "$SWITCHER_DIR/${envFile}"
+  TOOL_ACTIVE=1
+else
+  TOOL_ACTIVE=0
+fi
+
+# R8: a variable is removed ONLY when its value is one an older switcher wrote. The user's own
+# proxy, base URL, model or LLM_SWITCHER_* setting is theirs and is kept.
+GW_PORT="$( { [ -O "$SWITCHER_DIR/gateway.port" ] && tr -d '[:space:]' < "$SWITCHER_DIR/gateway.port"; } 2>/dev/null )"
+case "$GW_PORT" in ''|*[!0-9]*) GW_PORT=3456 ;; esac
+PORTS="$GW_PORT 3456"
+[ -n "$LLM_SWITCHER_PORT" ] && PORTS="$PORTS $LLM_SWITCHER_PORT"
+
+# Every loopback shape the switcher ever wrote: host, optional /v1, optional trailing slash.
+SWITCHER_URLS=""
+for _p in $PORTS; do
+  for _h in 127.0.0.1 localhost '[::1]'; do
+    SWITCHER_URLS="$SWITCHER_URLS $_h:$_p $_h:$_p/ $_h:$_p/v1 $_h:$_p/v1/"
+  done
+done
+
+_u="\${ANTHROPIC_BASE_URL:-}"
+if [ -n "$_u" ]; then
+  case " $SWITCHER_URLS " in
+    *" \${_u#http://} "*) unset ANTHROPIC_BASE_URL ;;
+  esac
+fi
+_u="\${OPENAI_BASE_URL:-}"
+if [ -n "$_u" ]; then
+  case " $SWITCHER_URLS " in
+    *" \${_u#http://} "*) unset OPENAI_BASE_URL ;;
+  esac
 fi
 
+# The suffix the old switcher forced on every tier. Nothing else matches: the user's own
+# ANTHROPIC_MODEL=opus, or a real model id, is theirs.
+case "\${ANTHROPIC_MODEL:-}" in
+  opus\\[1m\\]|sonnet\\[1m\\]|haiku\\[1m\\]|fable\\[1m\\]) unset ANTHROPIC_MODEL ;;
+esac
+tier_is_stale() {
+  [ -n "$1" ] || return 1
+  case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')" in
+    "$2"\\[1m\\]) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+if tier_is_stale "$ANTHROPIC_DEFAULT_OPUS_MODEL" opus; then unset ANTHROPIC_DEFAULT_OPUS_MODEL; fi
+if tier_is_stale "$ANTHROPIC_DEFAULT_SONNET_MODEL" sonnet; then unset ANTHROPIC_DEFAULT_SONNET_MODEL; fi
+if tier_is_stale "$ANTHROPIC_DEFAULT_HAIKU_MODEL" haiku; then unset ANTHROPIC_DEFAULT_HAIKU_MODEL; fi
+if tier_is_stale "$ANTHROPIC_DEFAULT_FABLE_MODEL" fable; then unset ANTHROPIC_DEFAULT_FABLE_MODEL; fi
+
+[ "\${CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT:-}" = "1" ] && unset CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT
+[ "\${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-}" = "900000" ] && unset CLAUDE_CODE_AUTO_COMPACT_WINDOW
+[ "\${OPENAI_MAX_CONTEXT_TOKENS:-}" = "1000000" ] && unset OPENAI_MAX_CONTEXT_TOKENS
+
+# LLM_SWITCHER_CODEX_* was always a shim input, never the user's. Every OTHER LLM_SWITCHER_*
+# name is a user setting and is kept.
+for _v in $(compgen -v LLM_SWITCHER_CODEX_ 2>/dev/null); do
+  unset "$_v"
+done
+${caBlock}
+
 # Find the real binary: drop the shim directory from PATH so it doesn't call itself.
 CLEAN_PATH=""
 IFS=':'
@@ -72,65 +160,120 @@ if [ -z "$REAL" ]; then
   exit 127
 fi
 
-${name === 'codex' ? `# Codex-only variables (blindfold proxy + CA). The claude shim must not load these.
-if [ -O "$SWITCHER_DIR" ] && [ -O "$SWITCHER_DIR/env-codex.sh" ] && [ -f "$SWITCHER_DIR/active.flag" ]; then
-  . "$SWITCHER_DIR/env-codex.sh"
-fi
-
-CODEX_SWITCHER_ARGS=()
-if [ -n "\${LLM_SWITCHER_CODEX_BASE_URL:-}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "openai_base_url=\${LLM_SWITCHER_CODEX_BASE_URL}")
-fi
-if [ -O "${CODE_X_CATALOG_PATH}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "model_catalog_json=${CODE_X_CATALOG_PATH}")
-fi
-if [ -n "\${LLM_SWITCHER_CODEX_MAIN_MODEL:-}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "model=\\"\${LLM_SWITCHER_CODEX_MAIN_MODEL}\\"")
-fi
-if [ -n "\${LLM_SWITCHER_CODEX_REVIEW_MODEL:-}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "review_model=\\"\${LLM_SWITCHER_CODEX_REVIEW_MODEL}\\"")
-fi
-if [ -n "\${LLM_SWITCHER_CODEX_SUBAGENT_MODEL:-}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "agents.default_subagent_model=\\"\${LLM_SWITCHER_CODEX_SUBAGENT_MODEL}\\"")
-fi
-if [ -n "\${LLM_SWITCHER_CODEX_CONTEXT_WINDOW:-}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "model_context_window=\${LLM_SWITCHER_CODEX_CONTEXT_WINDOW}")
-fi
-if [ -n "\${LLM_SWITCHER_CODEX_AUTO_COMPACT_LIMIT:-}" ]; then
-  CODEX_SWITCHER_ARGS+=(--config "model_auto_compact_token_limit=\${LLM_SWITCHER_CODEX_AUTO_COMPACT_LIMIT}")
-fi
-
-exec "$REAL" "\${CODEX_SWITCHER_ARGS[@]}" "$@"` : `exec "$REAL" "$@"`}
+# No override of any kind: the tool keeps its own configuration and its own model names (F3, R1).
+exec "$REAL" "$@"
 `;
+};
 
-const WINDOWS_TEMPLATE = (name) => `@echo off
+const WINDOWS_TEMPLATE = (name) => {
+  const envFile = envFileOf(name).replace(/\.sh$/, '.cmd');
+  const caBlock = name === 'codex' ? '' : `
+REM R2: one bundle holds the user's own CA and the switcher CA, so trusting the interceptor
+REM never costs a certificate the user already had. Decided here, at launch, because only now
+REM is it known whether the user brought one - and never while this tool is off.
+if not "%TOOL_ACTIVE%"=="1" goto :CA_DONE
+if defined INHERITED_CA goto :CA_BUNDLE
+if exist "%SWITCHER_DIR%\\blindfold\\certs\\ca.pem" set "NODE_EXTRA_CA_CERTS=%SWITCHER_DIR%\\blindfold\\certs\\ca.pem"
+if not exist "%SWITCHER_DIR%\\blindfold\\certs\\ca.pem" echo [llm-switcher] %SWITCHER_DIR%\\blindfold\\certs\\ca.pem not found; NODE_EXTRA_CA_CERTS kept as inherited. 1>&2
+goto :CA_DONE
+:CA_BUNDLE
+set "CA_BUNDLE="
+for /f "delims=" %%B in ('node "%STATE_HELPER%" "%INHERITED_CA%" "%SWITCHER_DIR%\\blindfold\\certs\\ca.pem" "%SWITCHER_DIR%" 2^>nul') do set "CA_BUNDLE=%%B"
+if not defined CA_BUNDLE goto :CA_DONE
+if not exist "%CA_BUNDLE%" goto :CA_DONE
+set "NODE_EXTRA_CA_CERTS=%CA_BUNDLE%"
+:CA_DONE`;
+  return `@echo off
 REM Auto-generated by LLM Switcher - DO NOT EDIT.
+setlocal
 set "SWITCHER_DIR=${STATE_DIR}"
-if exist "%SWITCHER_DIR%\\active.flag" if exist "%SWITCHER_DIR%\\env.cmd" call "%SWITCHER_DIR%\\env.cmd"
-${name === 'codex' ? `REM Codex-only variables (blindfold proxy + CA). The claude shim must not load these.
-if exist "%SWITCHER_DIR%\\active.flag" if exist "%SWITCHER_DIR%\\env-codex.cmd" call "%SWITCHER_DIR%\\env-codex.cmd"
-set "CODEX_SWITCHER_ARGS="
-if defined LLM_SWITCHER_CODEX_BASE_URL set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config openai_base_url=%LLM_SWITCHER_CODEX_BASE_URL%"
-if exist "%SWITCHER_DIR%\\model-catalog.json" set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config model_catalog_json=${CODE_X_CATALOG_PATH}"
-if defined LLM_SWITCHER_CODEX_MAIN_MODEL set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config model=%LLM_SWITCHER_CODEX_MAIN_MODEL%"
-if defined LLM_SWITCHER_CODEX_REVIEW_MODEL set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config review_model=%LLM_SWITCHER_CODEX_REVIEW_MODEL%"
-if defined LLM_SWITCHER_CODEX_SUBAGENT_MODEL set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config agents.default_subagent_model=%LLM_SWITCHER_CODEX_SUBAGENT_MODEL%"
-if defined LLM_SWITCHER_CODEX_CONTEXT_WINDOW set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config model_context_window=%LLM_SWITCHER_CODEX_CONTEXT_WINDOW%"
-if defined LLM_SWITCHER_CODEX_AUTO_COMPACT_LIMIT set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config model_auto_compact_token_limit=%LLM_SWITCHER_CODEX_AUTO_COMPACT_LIMIT%"` : ''}
+${name === 'codex' ? '' : `set "STATE_HELPER=${STATE_HELPER}"
+
+REM Captured BEFORE the tool's env file runs: the CA decision must see the value this shell
+REM already had, not one this run is about to write.
+set "INHERITED_CA=%NODE_EXTRA_CA_CERTS%"
+`}
+
+REM Only this tool's own file, only while the gateway is on, and only a non-empty one: an empty
+REM file means this tool is off. The shared env.cmd is never called (F5).
+set "TOOL_ACTIVE=0"
+if exist "%SWITCHER_DIR%\\active.flag" if exist "%SWITCHER_DIR%\\${envFile}" (
+  for %%A in ("%SWITCHER_DIR%\\${envFile}") do if %%~zA GTR 0 set "TOOL_ACTIVE=1"
+)
+if "%TOOL_ACTIVE%"=="1" call "%SWITCHER_DIR%\\${envFile}"
+
+REM R8: a variable is removed ONLY when its value is one an older switcher wrote. The user's own
+REM proxy, base URL, model or LLM_SWITCHER_* setting is theirs and is kept.
+set "_GWPORT="
+if exist "%SWITCHER_DIR%\\gateway.port" for /f "usebackq delims=" %%P in ("%SWITCHER_DIR%\\gateway.port") do set "_GWPORT=%%P"
+if not defined _GWPORT set "_GWPORT=3456"
+if defined ANTHROPIC_BASE_URL call :SCRUB_URL ANTHROPIC_BASE_URL "%ANTHROPIC_BASE_URL%"
+if defined OPENAI_BASE_URL call :SCRUB_URL OPENAI_BASE_URL "%OPENAI_BASE_URL%"
+if /i "%ANTHROPIC_MODEL%"=="opus[1m]" set "ANTHROPIC_MODEL="
+if /i "%ANTHROPIC_MODEL%"=="sonnet[1m]" set "ANTHROPIC_MODEL="
+if /i "%ANTHROPIC_MODEL%"=="haiku[1m]" set "ANTHROPIC_MODEL="
+if /i "%ANTHROPIC_MODEL%"=="fable[1m]" set "ANTHROPIC_MODEL="
+if defined ANTHROPIC_DEFAULT_OPUS_MODEL call :SCRUB_TIER ANTHROPIC_DEFAULT_OPUS_MODEL "%ANTHROPIC_DEFAULT_OPUS_MODEL%" opus
+if defined ANTHROPIC_DEFAULT_SONNET_MODEL call :SCRUB_TIER ANTHROPIC_DEFAULT_SONNET_MODEL "%ANTHROPIC_DEFAULT_SONNET_MODEL%" sonnet
+if defined ANTHROPIC_DEFAULT_HAIKU_MODEL call :SCRUB_TIER ANTHROPIC_DEFAULT_HAIKU_MODEL "%ANTHROPIC_DEFAULT_HAIKU_MODEL%" haiku
+if defined ANTHROPIC_DEFAULT_FABLE_MODEL call :SCRUB_TIER ANTHROPIC_DEFAULT_FABLE_MODEL "%ANTHROPIC_DEFAULT_FABLE_MODEL%" fable
+if "%CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT%"=="1" set "CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT="
+if "%CLAUDE_CODE_AUTO_COMPACT_WINDOW%"=="900000" set "CLAUDE_CODE_AUTO_COMPACT_WINDOW="
+if "%OPENAI_MAX_CONTEXT_TOKENS%"=="1000000" set "OPENAI_MAX_CONTEXT_TOKENS="
+for /f "tokens=1 delims==" %%V in ('set LLM_SWITCHER_CODEX_ 2^>nul ^| findstr /b /c:"LLM_SWITCHER_CODEX_"') do set "%%V="
+${caBlock}
+
+REM Find the real binary: drop this shim's own directory so it never calls itself.
 for /f "delims=" %%i in ('where ${name}.cmd 2^>nul ^| findstr /v /i "\\.llm-switcher\\\\bin"') do (
-  call "%%i" ${name === 'codex' ? '%CODEX_SWITCHER_ARGS% ' : ''}%*
+  call "%%i" %*
   exit /b
 )
 for /f "delims=" %%i in ('where ${name}.exe 2^>nul ^| findstr /v /i "\\.llm-switcher\\\\bin"') do (
-  call "%%i" ${name === 'codex' ? '%CODEX_SWITCHER_ARGS% ' : ''}%*
+  call "%%i" %*
   exit /b
 )
 echo [llm-switcher] cannot find the real '${name}' on PATH.>&2
 exit /b 127
+
+REM ---- R8 subroutines ----------------------------------------------------
+
+REM %1 = variable name, %2 = its value. Unsets %1 only for a loopback gateway URL on a port this
+REM switcher has used: the recorded one, the default 3456, or LLM_SWITCHER_PORT.
+:SCRUB_URL
+set "_T=%~2"
+if /i "%_T:~0,7%"=="http://" set "_T=%_T:~7%"
+set "_R="
+if /i "%_T:~0,10%"=="127.0.0.1:" set "_R=%_T:~10%"
+if /i "%_T:~0,10%"=="localhost:" set "_R=%_T:~10%"
+if /i "%_T:~0,6%"=="[::1]:" set "_R=%_T:~6%"
+if not defined _R goto :eof
+if /i "%_R:~-4%"=="/v1/" set "_R=%_R:~0,-4%"
+if /i "%_R:~-3%"=="/v1" set "_R=%_R:~0,-3%"
+if "%_R:~-1%"=="/" set "_R=%_R:~0,-1%"
+if not defined _R goto :eof
+if not "%_R%"=="" for /f "delims=0123456789" %%X in ("%_R%") do goto :eof
+if "%_R%"=="%_GWPORT%" goto :DROP_URL
+if "%_R%"=="3456" goto :DROP_URL
+if defined LLM_SWITCHER_PORT if "%_R%"=="%LLM_SWITCHER_PORT%" goto :DROP_URL
+goto :eof
+:DROP_URL
+set "%~1="
+goto :eof
+
+REM %1 = variable name, %2 = its value, %3 = the lowercase tier it must still match. A value of
+REM another tier (ANTHROPIC_DEFAULT_OPUS_MODEL=sonnet[1m]) is not the switcher's and is kept.
+:SCRUB_TIER
+if /i "%~2"=="%~3[1m]" set "%~1="
+goto :eof
 `;
+};
 
 export function renderShim(name, platform = process.platform) {
-  return platform === 'win32' ? WINDOWS_TEMPLATE(name) : POSIX_TEMPLATE(name);
+  if (platform !== 'win32') return POSIX_TEMPLATE(name);
+  // cmd.exe finds a subroutine by scanning line starts, and on a file written with bare LF
+  // it drifts: a label near the end is reported as "cannot find the batch label". CRLF is
+  // what every .cmd on disk already is, and it is what cmd.exe expects.
+  return WINDOWS_TEMPLATE(name).replace(/\r?\n/g, '\r\n');
 }
 
 function shimPath(name) {