llm-switcher 1.1.11 → 1.2.2

package/catalog.mjs

@@ -0,0 +1,246 @@
+// ============================================================
+// catalog.mjs — dynamic model catalog discovery and slot mapping (Claude Code & Codex)
+//
+// Automatically fetches official model lists from Anthropic / OpenAI or custom
+// upstream endpoints to ensure mapping tables never go stale when providers release
+// new model variants (e.g. gpt-6-sol, claude-opus-5-5).
+// ============================================================
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const OFFICIAL_MODEL_URLS = {
+  claude: 'https://api.anthropic.com/v1/models',
+  codex: 'https://api.openai.com/v1/models'
+};
+
+export const BASELINE_MODELS = {
+  claude: {
+    opus: ['claude-opus-5-5', 'claude-opus-4-6', 'claude-3-opus-20240229'],
+    sonnet: ['claude-sonnet-4', 'claude-3-7-sonnet-20250219', 'claude-3-5-sonnet-20241022'],
+    haiku: ['claude-haiku-4', 'claude-3-5-haiku-20241022'],
+    fable: ['claude-fable-4']
+  },
+  codex: {
+    main: ['gpt-6-sol', 'gpt-5.6-sol', 'gpt-5.2', 'o3', 'gpt-4o'],
+    review: ['gpt-6-terra', 'gpt-5.6-terra', 'o3-mini'],
+    subagent: ['gpt-6-luna', 'gpt-5.6-luna', 'gpt-5.3-codex', 'gpt-5.2-codex']
+  }
+};
+
+/** Classifies a Claude model name into its corresponding tier slot */
+export function classifyClaudeTier(modelId) {
+  const m = String(modelId || '').toLowerCase();
+  if (m.includes('fable')) return 'fable';
+  if (m.includes('opus')) return 'opus';
+  if (m.includes('haiku')) return 'haiku';
+  return 'sonnet';
+}
+
+/** Classifies a Codex model name into its corresponding role slot */
+export function classifyCodexRole(modelId) {
+  const m = String(modelId || '').toLowerCase();
+  if (m.includes('terra') || m.includes('review')) return 'review';
+  if (m.includes('luna') || m.includes('subagent')) return 'subagent';
+  return 'main';
+}
+
+function catalogCachePath(stateDir) {
+  return path.join(stateDir, 'catalog-cache.json');
+}
+
+/** Loads cached catalog from disk, falling back to built-in baseline models */
+export function loadCatalogCache(stateDir) {
+  const p = catalogCachePath(stateDir);
+  try {
+    if (fs.existsSync(p)) {
+      const data = JSON.parse(fs.readFileSync(p, 'utf8'));
+      if (data && typeof data === 'object') return data;
+    }
+  } catch {}
+  return {
+    updatedAt: 0,
+    claude: {
+      models: Object.entries(BASELINE_MODELS.claude).flatMap(([tier, ids]) => ids.map(id => ({ id, tier })))
+    },
+    codex: {
+      models: Object.entries(BASELINE_MODELS.codex).flatMap(([role, ids]) => ids.map(id => ({ id, role })))
+    }
+  };
+}
+
+/** Atomically writes the model catalog cache to disk */
+export function saveCatalogCache(stateDir, catalog) {
+  const p = catalogCachePath(stateDir);
+  const tmp = `${p}.${process.pid}.tmp`;
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(catalog, null, 2), 'utf8');
+    fs.renameSync(tmp, p);
+    return true;
+  } catch {
+    try { fs.rmSync(tmp, { force: true }); } catch {}
+    return false;
+  }
+}
+
+/**
+ * Fetches the latest models for a tool from its official endpoint or a custom URL.
+ * Never throws: falls back safely to baseline models if offline or unreachable.
+ */
+export async function fetchToolModels(tool, { url, apiKey, timeout = 3000 } = {}) {
+  const targetUrl = url || OFFICIAL_MODEL_URLS[tool];
+  if (!targetUrl) return { ok: false, error: `Unknown tool: ${tool}`, models: [] };
+
+  const headers = {
+    'user-agent': 'llm-switcher/catalog',
+    'accept': 'application/json'
+  };
+  if (tool === 'claude') {
+    headers['anthropic-version'] = '2023-06-01';
+    if (apiKey) headers['x-api-key'] = apiKey;
+  } else if (apiKey) {
+    headers['authorization'] = `Bearer ${apiKey}`;
+  }
+
+  try {
+    const res = await fetch(targetUrl, {
+      method: 'GET',
+      headers,
+      signal: AbortSignal.timeout(timeout)
+    });
+    if (!res.ok) {
+      return { ok: false, status: res.status, error: `HTTP ${res.status}`, models: [] };
+    }
+    const json = await res.json();
+    const rawList = Array.isArray(json.data) ? json.data : Array.isArray(json.models) ? json.models : [];
+
+    if (tool === 'claude') {
+      const models = rawList
+        .filter(m => m && (m.id || typeof m === 'string'))
+        .map(m => {
+          const id = typeof m === 'string' ? m : m.id;
+          return { id, display_name: m.display_name || id, tier: classifyClaudeTier(id) };
+        });
+      return { ok: true, models };
+    }
+
+    if (tool === 'codex') {
+      const models = rawList
+        .filter(m => m && (m.id || typeof m === 'string'))
+        .map(m => {
+          const id = typeof m === 'string' ? m : m.id;
+          return { id, role: classifyCodexRole(id) };
+        })
+        .filter(m => /^(gpt|o\d|codex)/i.test(m.id));
+      return { ok: true, models };
+    }
+
+    return { ok: true, models: rawList };
+  } catch (err) {
+    return { ok: false, error: err.message, models: [] };
+  }
+}
+
+/**
+ * Refreshes the local catalog cache with models from both official endpoints
+ * and saves to the state directory.
+ */
+export async function refreshCatalog(stateDir, { claudeKey, codexKey } = {}) {
+  const cache = loadCatalogCache(stateDir);
+
+  const [claudeRes, codexRes] = await Promise.all([
+    fetchToolModels('claude', { apiKey: claudeKey }),
+    fetchToolModels('codex', { apiKey: codexKey })
+  ]);
+
+  if (claudeRes.ok && claudeRes.models.length > 0) {
+    const existing = new Set(claudeRes.models.map(m => m.id));
+    // Keep any baseline models that might be absent from the API
+    for (const [tier, ids] of Object.entries(BASELINE_MODELS.claude)) {
+      for (const id of ids) {
+        if (!existing.has(id)) claudeRes.models.push({ id, tier });
+      }
+    }
+    cache.claude = { models: claudeRes.models };
+  }
+
+  if (codexRes.ok && codexRes.models.length > 0) {
+    const existing = new Set(codexRes.models.map(m => m.id));
+    for (const [role, ids] of Object.entries(BASELINE_MODELS.codex)) {
+      for (const id of ids) {
+        if (!existing.has(id)) codexRes.models.push({ id, role });
+      }
+    }
+    cache.codex = { models: codexRes.models };
+  }
+
+  cache.updatedAt = Date.now();
+  saveCatalogCache(stateDir, cache);
+  return cache;
+}
+
+/** Extracts tool version string from client User-Agent or headers */
+export function detectToolVersion(headers = {}, expectedTool) {
+  const ua = headers['user-agent'] || headers['User-Agent'] || '';
+  const first = String(ua || '').split(' ')[0];
+  const slash = first.indexOf('/');
+  if (slash >= 0) {
+    const prefix = first.slice(0, slash).toLowerCase();
+    if (prefix.includes('claude') || prefix.includes('codex') || (expectedTool && prefix.includes(expectedTool))) {
+      const version = first.slice(slash + 1);
+      if (/^\d{1,5}\.\d{1,5}/.test(version)) return version;
+    }
+  }
+  const m = /(?:claude(?:-cli|-code)?|codex(?:-cli)?)[/v\s]+([0-9]+\.[0-9]+(?:\.[0-9]+)?)/i.exec(ua);
+  return m ? m[1] : '';
+}
+
+const refreshingTools = new Set();
+
+/**
+ * Version-triggered auto-poll:
+ * When a request arrives with a new tool version not yet seen in cache,
+ * immediately records the new version and kicks off an asynchronous background refresh.
+ * Subsequent requests with the same version do zero network calls.
+ */
+export function checkVersionAndRefresh(tool, headers, stateDir, apiKey) {
+  const version = detectToolVersion(headers, tool);
+  if (!version) return;
+
+  const cache = loadCatalogCache(stateDir);
+  const toolEntry = cache[tool] || {};
+  const lastVersion = toolEntry.lastSeenVersion || '';
+
+  if (version !== lastVersion) {
+    toolEntry.lastSeenVersion = version;
+    cache[tool] = toolEntry;
+    saveCatalogCache(stateDir, cache);
+
+    if (!refreshingTools.has(tool)) {
+      refreshingTools.add(tool);
+      fetchToolModels(tool, { apiKey })
+        .then(res => {
+          if (res.ok && res.models.length > 0) {
+            const fresh = loadCatalogCache(stateDir);
+            const existing = new Set(res.models.map(m => m.id));
+            const baseline = BASELINE_MODELS[tool] || {};
+            for (const [, ids] of Object.entries(baseline)) {
+              for (const id of ids) {
+                if (!existing.has(id)) {
+                  res.models.push({ id, ...(tool === 'claude' ? { tier: classifyClaudeTier(id) } : { role: classifyCodexRole(id) }) });
+                }
+              }
+            }
+            fresh[tool] = { lastSeenVersion: version, models: res.models };
+            fresh.updatedAt = Date.now();
+            saveCatalogCache(stateDir, fresh);
+            console.log(`[llm-switcher:catalog] Detected ${tool} version update to ${version} -> refreshed model catalog (${res.models.length} models)`);
+          }
+        })
+        .catch(() => {})
+        .finally(() => {
+          refreshingTools.delete(tool);
+        });
+    }
+  }
+}

package/classifier.mjs

@@ -0,0 +1,238 @@
+/**
+ * Jev-powered Semantic Classifier & Router for llm-switcher
+ * Evaluates prompt complexity using TypeSafe System One (Jev) models
+ * and maps intent to optimal model tier (haiku, sonnet, opus).
+ */
+
+export const DEFAULT_JEV_URL = 'https://api.typesafe.ai/v1/systemone';
+export const DEFAULT_JEV_MODEL = 'jev-latest';
+export const OPENROUTER_JEV_URL = 'https://openrouter.ai/api/alpha/decisions';
+export const OPENROUTER_JEV_MODEL = 'typesafe/jev-1.13';
+
+export const TIER_CRITERIA = {
+  haiku: 'Mechanical task, template fill, single fact lookup, extraction, binary decision, short formatting',
+  sonnet: 'Multi-step coding, refactor, search across files, general programming, document drafting',
+  opus: 'Architecture design, security analysis, deep reasoning, race conditions, migration plans, complex synthesis',
+};
+
+/**
+ * Fast synchronous heuristic fallback when offline or no API key is set.
+ */
+export function heuristicClassify(prompt = '') {
+  const text = String(prompt || '').toLowerCase();
+
+  // Heavy reasoning or safety critical indicators -> opus
+  const opusKeywords = [
+    'architecture', 'security audit', 'race condition', 'deadlock', 'concurrency',
+    'threat model', 'penetration', 'migration plan', 'adversarial', 'formal verification'
+  ];
+  if (opusKeywords.some((kw) => text.includes(kw))) {
+    return 'opus';
+  }
+
+  // Trivial or mechanical indicators -> haiku
+  const haikuKeywords = [
+    'translate', 'format json', 'extract', 'regex', 'rename', 'single word',
+    'yes or no', 'spell check', 'fix typo', 'convert to csv'
+  ];
+  if (text.length < 120 && haikuKeywords.some((kw) => text.includes(kw))) {
+    return 'haiku';
+  }
+
+  // Default balanced tier
+  return 'sonnet';
+}
+
+/**
+ * Resolves Jev API key from environment.
+ */
+export function findJevKey(env = process.env) {
+  if (typeof env?.TYPESAFE_API_KEY === 'string' && env.TYPESAFE_API_KEY.trim().length > 0) {
+    return { key: env.TYPESAFE_API_KEY.trim(), source: 'typesafe' };
+  }
+  if (typeof env?.JEV_API_KEY === 'string' && env.JEV_API_KEY.trim().length > 0) {
+    return { key: env.JEV_API_KEY.trim(), source: 'openrouter' };
+  }
+  return null;
+}
+
+/**
+ * Classifies prompt into optimal model tier using TypeSafe Jev.
+ * Falls back safely to heuristic on missing key, timeout, or network error.
+ */
+export async function classifyPrompt({
+  prompt,
+  apiKey,
+  url,
+  model,
+  timeoutMs = 5000,
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const fallbackTier = heuristicClassify(prompt);
+
+  const keyInfo = apiKey ? { key: apiKey, source: 'custom' } : findJevKey(env);
+  if (!keyInfo) {
+    return {
+      tier: fallbackTier,
+      confidence: 0.5,
+      source: 'heuristic',
+      reason: 'no-key',
+    };
+  }
+
+  const endpointUrl = url || (keyInfo.source === 'openrouter' ? OPENROUTER_JEV_URL : DEFAULT_JEV_URL);
+  const modelName = model || (keyInfo.source === 'openrouter' ? OPENROUTER_JEV_MODEL : DEFAULT_JEV_MODEL);
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const payload = {
+      state: String(prompt || ''),
+      model: modelName,
+      questions: {
+        recommended_tier: {
+          type: 'choice',
+          instructions: 'Determine the optimal model tier for this task according to complexity and reasoning depth required.',
+          criteria: TIER_CRITERIA,
+        },
+      },
+    };
+
+    const res = await fetchImpl(endpointUrl, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${keyInfo.key}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    });
+
+    clearTimeout(timer);
+
+    if (!res.ok) {
+      return {
+        tier: fallbackTier,
+        confidence: 0.5,
+        source: 'heuristic',
+        reason: `http-${res.status}`,
+      };
+    }
+
+    const data = await res.json();
+    const ans = data?.answers?.recommended_tier;
+    if (!ans || typeof ans.choice !== 'string') {
+      return {
+        tier: fallbackTier,
+        confidence: 0.5,
+        source: 'heuristic',
+        reason: 'bad-response',
+      };
+    }
+
+    const tier = ['haiku', 'sonnet', 'opus'].includes(ans.choice) ? ans.choice : fallbackTier;
+    const confidence = typeof ans.confidence === 'number' ? Number(ans.confidence.toFixed(3)) : 0.8;
+
+    return {
+      tier,
+      confidence,
+      distribution: ans.distribution || null,
+      source: 'jev',
+      model: data.model || modelName,
+    };
+  } catch (err) {
+    clearTimeout(timer);
+    const reason = err?.name === 'AbortError' ? 'timeout' : 'network';
+    return {
+      tier: fallbackTier,
+      confidence: 0.5,
+      source: 'heuristic',
+      reason,
+    };
+  }
+}
+
+/**
+ * Checks semantic equivalence between candidate text and cached target using Jev Noul.
+ * Optional gate: returns false immediately if Jev is not configured or unavailable.
+ */
+export async function checkSemanticEquivalence({
+  candidate,
+  target,
+  apiKey,
+  url,
+  model,
+  timeoutMs = 3000,
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  if (!candidate || !target) return { equivalent: false, confidence: 0, reason: 'empty-input' };
+  if (candidate.trim() === target.trim()) {
+    return { equivalent: true, confidence: 1.0, reason: 'exact-match' };
+  }
+
+  const keyInfo = apiKey ? { key: apiKey, source: 'custom' } : findJevKey(env);
+  if (!keyInfo) {
+    return { equivalent: false, confidence: 0, reason: 'no-key-fallback-bypass' };
+  }
+
+  const endpointUrl = url || (keyInfo.source === 'openrouter' ? OPENROUTER_JEV_URL : DEFAULT_JEV_URL);
+  const modelName = model || (keyInfo.source === 'openrouter' ? OPENROUTER_JEV_MODEL : DEFAULT_JEV_MODEL);
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const payload = {
+      state: `REQUEST_A:\n${candidate}\n\nREQUEST_B:\n${target}`,
+      model: modelName,
+      questions: {
+        is_equivalent: {
+          type: 'noul',
+          instructions: 'Do REQUEST_A and REQUEST_B ask for the exact same semantic task or answer, such that the response to B fully satisfies A?',
+        },
+      },
+    };
+
+    const res = await fetchImpl(endpointUrl, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${keyInfo.key}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    });
+
+    clearTimeout(timer);
+    if (!res.ok) {
+      return { equivalent: false, confidence: 0, reason: `http-${res.status}` };
+    }
+
+    const data = await res.json();
+    const ans = data?.answers?.is_equivalent;
+    if (ans == null) {
+      return { equivalent: false, confidence: 0, reason: 'bad-response' };
+    }
+
+    // Noul returns either probability number directly or object with probability
+    const prob = typeof ans === 'number' ? ans : (typeof ans?.probability === 'number' ? ans.probability : 0);
+    const equivalent = prob >= 0.85;
+
+    return {
+      equivalent,
+      confidence: Number(prob.toFixed(3)),
+      reason: equivalent ? 'jev-confirmed' : 'below-threshold',
+      model: data.model || modelName,
+    };
+  } catch (err) {
+    clearTimeout(timer);
+    return {
+      equivalent: false,
+      confidence: 0,
+      reason: err?.name === 'AbortError' ? 'timeout' : 'network-error',
+    };
+  }
+}

package/config.example.json

@@ -1,19 +1,19 @@
 {
   "port": 3456,
-  "activeProfile": "9router",
   "activeProfiles": {
-    "anthropic": "9router",
-    "responses": "example-codex-vertex",
-    "openai-chat": "9router",
-    "vertex": "example-codex-vertex"
+    "claude": "claude-default",
+    "codex": "codex-default"
+  },
+  "blindfold": {
+    "port": 3457
   },
   "profiles": {
-    "9router": {
-      "name": "9Router",
+    "claude-default": {
+      "name": "Claude default (Claude client -> router)",
       "mode": "convert",
-      "inFormat": "auto",
+      "tool": "claude",
       "outFormat": "openai-chat",
-      "baseURL": "https://YOUR-9ROUTER-HOST/v1",
+      "baseURL": "https://YOUR-ROUTER-HOST/v1",
       "apiKey": "sk-REPLACE-ME",
       "defaultModels": {
         "opus": "ag/claude-opus-4-6-thinking",
@@ -28,30 +28,10 @@
         "fable": true
       }
     },
-    "example-direct": {
-      "name": "Example Native Anthropic (Direct Forward)",
-      "mode": "direct",
-      "inFormat": "auto",
-      "outFormat": "anthropic",
-      "baseURL": "https://api.anthropic.com/v1",
-      "apiKey": "sk-ant-REPLACE-ME",
-      "defaultModels": {
-        "opus": "claude-opus-4-7",
-        "sonnet": "claude-sonnet-4-6",
-        "haiku": "claude-haiku-4-5-20251001",
-        "fable": "claude-haiku-4-5-20251001"
-      },
-      "model1M": {
-        "opus": false,
-        "sonnet": false,
-        "haiku": false,
-        "fable": false
-      }
-    },
-    "example-codex-vertex": {
-      "name": "Example Codex client -> Vertex upstream",
+    "codex-default": {
+      "name": "Codex default (Codex client -> Vertex upstream)",
       "mode": "convert",
-      "inFormat": "responses",
+      "tool": "codex",
       "outFormat": "vertex",
       "baseURL": "https://YOUR-VERTEX-GATEWAY/v1",
       "apiKey": "REPLACE-ME",
@@ -61,8 +41,6 @@
         "review": "gpt-5.6-terra",
         "subagent": "gpt-5.6-luna"
       },
-      "blindfold": false,
-      "blindfoldPort": 3457,
       "defaultModels": {
         "main": "gemini-3.8-flash",
         "review": "gemini-3.7-flash-medium",

package/docs/codex-blindfold.md

@@ -28,18 +28,25 @@ Blindfold mode does that. Codex keeps its official endpoint. The switcher interc
 
 Codex reads the `HTTPS_PROXY` variable. In blindfold mode the switcher points that variable at `blindfold/blindfold.mjs`. Codex then sends `CONNECT chatgpt.com:443` to that process.
 
-The process answers the CONNECT itself. It ends the TLS session with a leaf certificate for the target host, and it forwards the Codex API calls to the gateway. Three rules decide where each request goes:
+The process answers the CONNECT itself. It ends the TLS session with a leaf certificate for the target host. One interceptor serves both tools: what each request reaches is decided by the host of the CONNECT request and by its path, and by nothing else.
 
-| Request | Destination |
+| CONNECT host | Destination |
 | --- | --- |
-| Target host, path under `/backend-api/codex/` | The local gateway |
-| Target host, any other path | The real host, over a new TLS session |
+| `api.anthropic.com`, path `/v1/messages` or under it | The local gateway, path unchanged |
+| `api.anthropic.com`, any other path | `api.anthropic.com`, over a new TLS session |
+| `api.openai.com`, path `/v1/responses` or `/v1/models` (or under them) | The local gateway, path unchanged |
+| `api.openai.com`, any other path | `api.openai.com`, over a new TLS session |
+| `chatgpt.com`, path `/backend-api/codex/` or under it | The local gateway, `/backend-api/codex` rewritten to `/v1` |
+| `chatgpt.com`, any other path | `chatgpt.com`, over a new TLS session |
 | Another public host | A raw tunnel. The process never reads the bytes. |
 | A local or private address | Refused. |
 
+There is no `--host` and no `--prefix` any more: this table is the routing, and it cannot be
+changed from a profile or from the command line.
+
 The routing decision reads the **normalized** path, not the text the client sent. Node hands over the request target exactly as written, but the gateway resolves it with `new URL(...)`. A raw-text test would therefore accept a string that the gateway later reads as a different path: `/backend-api/codex/%2e%2e/api/logs` becomes `/api/logs`, which is the gateway's admin API. The decision also requires a segment boundary, so `/backend-api/codex-usage` stays with the host it belongs to.
 
-Sign-in, token refresh and the usage page keep working, because they do not use the Codex API path.
+Sign-in, token refresh and the usage page keep working, because they do not use a path in the table. A request whose `Host` header names a different host than its CONNECT target gets `421 Misdirected Request` and opens no upstream connection.
 
 ## Why no system change is necessary
 
@@ -81,14 +88,17 @@ CAUTION: Do not build these certificates with `New-SelfSignedCertificate` in Pow
 
 ### 2. Turn on blindfold mode in the profile
 
-Add two keys to the Codex profile in `config.json`:
+Add the interceptor port at the top level of `config.json`, next to `port`:
 
 ```json
-"blindfold": true,
-"blindfoldPort": 3457
+"blindfold": { "port": 3457 }
 ```
 
-`blindfoldPort` is optional. The default is 3457.
+`blindfold.port` is optional. The default is 3457, and it must differ from the gateway port
+in `port`. There is no per-profile `blindfold`, `blindfoldPort`, `blindfoldHost` or
+`blindfoldPrefix` any more: the interceptor runs whenever at least one tool is active, and
+what it routes is the fixed host table in [`cross-platform.md`](cross-platform.md), not a
+profile setting.
 
 ### 3. Activate the profile
 
@@ -98,7 +108,7 @@ switch codex <your-profile>
 
 This one command starts the gateway and writes the environment files. The gateway then starts the interceptor on the configured port. `switch off` stops both and removes the generated files.
 
-The gateway owns the interceptor. It brings the interceptor in line with `config.json` when it starts, after every change in the dashboard, and after every `switch` command. A service start, a `switch port`, and a change of host, prefix or port in the dashboard therefore never leave `HTTPS_PROXY` pointing at a port where nothing listens. When blindfold mode is turned off for the Codex target, the gateway stops the interceptor, and a running Codex session must be restarted.
+The gateway owns the interceptor. It brings the interceptor in line with `config.json` when it starts, after every change in the dashboard, and after every `switch` command. A service start, a `switch port`, and a change of port in the dashboard therefore never leave `HTTPS_PROXY` pointing at a port where nothing listens. When blindfold mode is turned off for the Codex target, the gateway stops the interceptor, and a running Codex session must be restarted.
 
 `switch` refuses the activation and writes no file in these cases:
 
@@ -155,13 +165,14 @@ re-originated to the real host. A compressed body is decoded first, because a
 client asks for `gzip` and the bytes on the wire are not readable text. The
 forwarded response keeps its original bytes; only the copy in the file is decoded.
 
-To record a different tool, point the proxy at that tool's host and give it a
-prefix that no path can match, so every request is re-originated and recorded:
+Both tools are recorded by the same process, because one interceptor holds the whole
+table. To capture into a directory of your own, pass `--capture` to a second interceptor
+on a port of its own:
 
 ```bash
-bash blindfold/make-certs.sh api.anthropic.com ~/.llm-switcher/anthropic/certs
-node blindfold/blindfold.mjs --host api.anthropic.com --prefix /no-gateway \
-  --port 3458 --certs ~/.llm-switcher/anthropic/certs --capture ~/.llm-switcher/anthropic/captures
+bash blindfold/make-certs.sh
+node blindfold/blindfold.mjs --port 3458 --gateway-port 3456 \
+  --certs blindfold/certs --capture ~/.llm-switcher/captures
 ```
 
 Use directories that you own. `make-certs.sh` and `--capture` refuse a directory that another
@@ -201,13 +212,13 @@ The switcher writes `LLM_SWITCHER_CODEX_BASE_URL` again, the gateway stops the i
 
 Read this section before you turn blindfold mode on.
 
-**The CA is trusted for every host that Codex contacts.** `CODEX_CA_CERTIFICATE` adds this authority to the trust store that Codex uses for all of its HTTPS calls. A CA that `make-certs.sh` builds now carries a name constraint: it can sign only for the target host and its subdomains. A client that obeys name constraints refuses any other certificate from this CA. OpenSSL, rustls and the macOS and Windows verifiers obey them. A CA that an older version built has no constraint. Anybody who can read its `ca.key` can forge a certificate for any host. Run `make-certs.sh` again to replace it, and keep `blindfold/certs/` private in both cases.
+**The CA is trusted for every host that Codex contacts.** `CODEX_CA_CERTIFICATE` adds this authority to the trust store that Codex uses for all of its HTTPS calls. A CA that `make-certs.sh` builds now carries name constraints: it can sign only for `api.anthropic.com`, `api.openai.com` and `chatgpt.com`. A client that obeys name constraints refuses any other certificate from this CA. OpenSSL, rustls and the macOS and Windows verifiers obey them. A CA that an older version built has no constraint. Anybody who can read its `ca.key` can forge a certificate for any host. Run `make-certs.sh` again to replace it, and keep `blindfold/certs/` private in both cases.
 
 **All traffic to the intercepted host is decrypted by this process.** That includes sign-in and token refresh, because the CONNECT for the whole host is terminated locally. Requests outside the Codex API path are re-originated to the real host over a new TLS session; they are forwarded, not tunneled. The `--verbose` flag prints the method and path of every such request.
 
 **Directory permissions are weaker on Windows.** `make-certs.sh` calls `chmod` on the certificate directory, and that call does nothing under Git Bash for Windows. On that platform the keys are protected only by the account that owns the directory.
 
-**Only one host is intercepted.** If your Codex uses API key authentication instead of ChatGPT authentication, the host is `api.openai.com`. Build the leaf for that host, and start the process with `--host api.openai.com --prefix /v1`.
+**Exactly three hosts are intercepted.** The leaf names `api.anthropic.com`, `api.openai.com` and `chatgpt.com`, so a Codex that signs in with an API key instead of a ChatGPT account reaches the gateway on `api.openai.com` with no reconfiguration. Any other host is tunneled without being read.
 
 **The interceptor is a proxy.** It binds to loopback, so a remote machine cannot use it, but every process on this machine can. It refuses a CONNECT to a local or private address, so it cannot be used to reach a service that listens only on this machine. The interceptor resolves the name first and checks every address in the answer, so a spelling such as `2130706433` or a name that resolves to `127.0.0.1` is also refused. It then connects to the address that it checked. It prints each refused target once, without `--verbose`. A VPN or split DNS can resolve a public name to a private address, and that message shows the cause.