llm-switcher 1.2.2 → 1.2.3

package/tests/catalog.test.mjs

@@ -14,6 +14,8 @@ import {
   refreshCatalog,
   detectToolVersion,
   checkVersionAndRefresh,
+  readLocalToolModels,
+  syncLocalCatalog,
   BASELINE_MODELS
 } from '../catalog.mjs';
 
@@ -124,24 +126,120 @@ test('detectToolVersion extracts semantic version from various User-Agent string
   assert.equal(detectToolVersion({}), '');
 });
 
-test('checkVersionAndRefresh records new version and triggers update only on version bumps', async () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-bump-test-'));
-  try {
-    // Initial request from version 1.1.0
-    checkVersionAndRefresh('claude', { 'user-agent': 'claude-cli/1.1.0' }, tmp);
-    const cat1 = loadCatalogCache(tmp);
-    assert.equal(cat1.claude.lastSeenVersion, '1.1.0');
-
-    // Repeated request from the same version 1.1.0 -> no change, no duplicate trigger
-    checkVersionAndRefresh('claude', { 'user-agent': 'claude-cli/1.1.0' }, tmp);
-    const cat2 = loadCatalogCache(tmp);
-    assert.equal(cat2.claude.lastSeenVersion, '1.1.0');
-
-    // Tool updates to version 1.2.0 -> version bump detected and saved
-    checkVersionAndRefresh('claude', { 'user-agent': 'claude-cli/1.2.0' }, tmp);
-    const cat3 = loadCatalogCache(tmp);
-    assert.equal(cat3.claude.lastSeenVersion, '1.2.0');
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
+// Local model lists that the tools write themselves, in the formats of Codex and Claude Code.
+function writeToolCaches(root, { codex = ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'], claude = ['claude-opus-5-5', 'claude-sonnet-5-5'] } = {}) {
+  const codexHome = path.join(root, 'codex');
+  const claudeDir = path.join(root, 'claude');
+  fs.mkdirSync(codexHome, { recursive: true });
+  fs.mkdirSync(path.join(claudeDir, 'cache', 'model-catalog'), { recursive: true });
+  if (codex) {
+    fs.writeFileSync(path.join(codexHome, 'models_cache.json'), JSON.stringify({
+      fetched_at: '2026-09-29T01:00:00Z', client_version: '0.158.0',
+      models: codex.map(slug => ({ slug, display_name: slug, context_window: 1000000, visibility: 'list' }))
+    }));
+  }
+  if (claude) {
+    // An older file with another list: the newest fetchedAt wins.
+    fs.writeFileSync(path.join(claudeDir, 'cache', 'model-catalog', 'old.json'), JSON.stringify({
+      version: 2, fetchedAt: 1000, catalog: { surface: 'cc', config: { models: [{ id: 'claude-opus-4-6', name: 'Opus 4.6' }] } }
+    }));
+    fs.writeFileSync(path.join(claudeDir, 'cache', 'model-catalog', 'new.json'), JSON.stringify({
+      version: 2, fetchedAt: 2000, catalog: { surface: 'cc', config: { models: claude.map(id => ({ id, name: id })) } }
+    }));
   }
+  return { codexHome, claudeDir };
+}
+
+function failingFetch(t) {
+  const realFetch = globalThis.fetch;
+  let calls = 0;
+  globalThis.fetch = async () => { calls++; return new Response('{}', { status: 401 }); };
+  t.after(() => { globalThis.fetch = realFetch; });
+  return () => calls;
+}
+
+test('readLocalToolModels reads the model lists that Codex and Claude Code keep on disk', (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-local-models-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const sources = writeToolCaches(root);
+
+  const codex = readLocalToolModels('codex', sources);
+  assert.deepEqual(codex.models.map(m => [m.id, m.role]), [['gpt-5.6-sol', 'main'], ['gpt-5.6-terra', 'review'], ['gpt-5.6-luna', 'subagent']]);
+  assert.equal(codex.version, '0.158.0');
+
+  const claude = readLocalToolModels('claude', sources);
+  assert.deepEqual(claude.models.map(m => [m.id, m.tier]), [['claude-opus-5-5', 'opus'], ['claude-sonnet-5-5', 'sonnet']]);
+
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-no-models-'));
+  t.after(() => fs.rmSync(empty, { recursive: true, force: true }));
+  assert.equal(readLocalToolModels('codex', { codexHome: empty, claudeDir: empty }), null);
+  assert.equal(readLocalToolModels('claude', { codexHome: empty, claudeDir: empty }), null);
+});
+
+test('refreshCatalog takes the local lists and drops the built-in names', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-refresh-local-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const sources = writeToolCaches(root);
+  const calls = failingFetch(t);
+
+  const cache = await refreshCatalog(root, { sources });
+  assert.deepEqual(cache.codex.models.map(m => m.id), ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna']);
+  assert.deepEqual(cache.claude.models.map(m => m.id), ['claude-opus-5-5', 'claude-sonnet-5-5']);
+  assert.equal(calls(), 0, 'a local list needs no network call');
+});
+
+test('checkVersionAndRefresh records a version only after the catalog for it is refreshed', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-bump-test-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  failingFetch(t);
+
+  // No local list and a failing official list: nothing is refreshed, so the version stays unseen.
+  const none = { codexHome: path.join(root, 'none'), claudeDir: path.join(root, 'none') };
+  checkVersionAndRefresh('codex', { 'user-agent': 'codex_cli_rs/0.158.0 (Mac OS)' }, root, undefined, none);
+  await new Promise(r => setTimeout(r, 50));
+  assert.equal(loadCatalogCache(root).codex.lastSeenVersion, undefined, 'a failed refresh is tried again');
+
+  // Codex wrote its list: the next request refreshes and records the version.
+  const sources = writeToolCaches(root, { codex: ['gpt-5.7-sol'] });
+  checkVersionAndRefresh('codex', { 'user-agent': 'codex_cli_rs/0.158.0 (Mac OS)' }, root, undefined, sources);
+  await new Promise(r => setTimeout(r, 50));
+  const after = loadCatalogCache(root);
+  assert.equal(after.codex.lastSeenVersion, '0.158.0');
+  assert.deepEqual(after.codex.models.map(m => m.id), ['gpt-5.7-sol']);
+});
+
+// A profile key belongs to that profile's baseURL. The official model lists may see it only when
+// the profile itself points at the official host.
+test('refreshCatalog sends a profile key only to the host of that profile', async (t) => {
+  const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-catalog-keys-'));
+  const realFetch = globalThis.fetch;
+  const sent = [];
+  globalThis.fetch = async (url, init = {}) => {
+    const h = init.headers || {};
+    sent.push({ host: new URL(url).host, auth: h.authorization || h['x-api-key'] || '' });
+    return new Response('{}', { status: 401 });
+  };
+  t.after(() => { globalThis.fetch = realFetch; fs.rmSync(stateDir, { recursive: true, force: true }); });
+
+  await refreshCatalog(stateDir, {
+    claudeProfile: { baseURL: 'https://gateway.example/v1', apiKey: 'sk-third-party' },
+    codexProfile: { baseURL: 'https://api.openai.com/v1', apiKey: 'sk-openai' },
+    sources: { codexHome: stateDir, claudeDir: stateDir }
+  });
+  assert.deepEqual(sent.find(s => s.host === 'api.anthropic.com').auth, '', 'a third-party key never reaches Anthropic');
+  assert.deepEqual(sent.find(s => s.host === 'api.openai.com').auth, 'Bearer sk-openai', 'an OpenAI profile key reaches OpenAI');
+});
+
+// Codex can update and rewrite its list without one request through the gateway.
+test('syncLocalCatalog picks up a list that a tool rewrote, with no network call', (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-sync-local-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const calls = failingFetch(t);
+  assert.deepEqual(loadCatalogCache(root).codex.models.map(m => m.id).includes('gpt-6-sol'), true, 'starts from the built-in list');
+
+  const sources = writeToolCaches(root, { codex: ['gpt-5.7-sol', 'gpt-5.7-luna'] });
+  const synced = syncLocalCatalog(root, sources);
+  assert.deepEqual(synced.codex.models.map(m => m.id), ['gpt-5.7-sol', 'gpt-5.7-luna']);
+  assert.deepEqual(loadCatalogCache(root).codex.models.map(m => m.id), ['gpt-5.7-sol', 'gpt-5.7-luna'], 'saved to disk');
+  assert.equal(calls(), 0);
 });

package/tests/codex-daemon.test.mjs

@@ -0,0 +1,92 @@
+// The interactive Codex TUI talks to a shared app-server daemon that keeps the environment it started
+// with. A change of the Codex route must restart it, or the TUI keeps calling the old destination.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// Temporary HOME and state dir before the import, so nothing here can reach the real Codex daemon.
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-codex-daemon-'));
+process.env.HOME = path.join(root, 'home');
+process.env.LLM_SWITCHER_STATE_DIR = path.join(root, 'state');
+delete process.env.CODEX_HOME;
+fs.mkdirSync(process.env.LLM_SWITCHER_STATE_DIR, { recursive: true });
+const { restartCodexDaemon, applyLaunchState, clearLaunchState, emptyToolEnvFiles, STATE_DIR } = await import('../state.mjs');
+test.after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+// A machine where the codex shim routes through `stateDir` and a daemon is running.
+function machine(stateDir) {
+  const home = fs.mkdtempSync(path.join(root, 'm-'));
+  const codexHome = path.join(home, '.codex');
+  const bin = path.join(codexHome, 'packages', 'app-server-daemon', 'current', 'bin', 'codex');
+  fs.mkdirSync(path.dirname(bin), { recursive: true });
+  fs.writeFileSync(bin, '');
+  fs.mkdirSync(path.join(codexHome, 'app-server-control'), { recursive: true });
+  fs.writeFileSync(path.join(codexHome, 'app-server-control', 'app-server-control.sock'), '');
+  fs.mkdirSync(path.join(home, '.llm-switcher', 'bin'), { recursive: true });
+  fs.writeFileSync(path.join(home, '.llm-switcher', 'bin', 'codex'), `#!/usr/bin/env bash\nSWITCHER_DIR="${stateDir}"\n`);
+  const calls = [];
+  const spawnFn = (cmd, args, opts) => { calls.push({ cmd, args, env: opts.env }); return { unref() {}, on() {} }; };
+  return { home, codexHome, bin, calls, spawnFn };
+}
+
+const ROUTE = [['HTTPS_PROXY', 'http://127.0.0.1:3457'], ['https_proxy', 'http://127.0.0.1:3457'],
+  ['NO_PROXY', '127.0.0.1,localhost'], ['no_proxy', '127.0.0.1,localhost'], ['CODEX_CA_CERTIFICATE', '/ca.pem']];
+
+test('a route change restarts the running daemon with the new Codex variables', () => {
+  const m = machine('/switcher/state');
+  const r = restartCodexDaemon(ROUTE, { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv: { PATH: '/bin' } });
+  assert.equal(r.restarted, true);
+  assert.equal(m.calls.length, 1);
+  assert.equal(m.calls[0].cmd, m.bin);
+  assert.deepEqual(m.calls[0].args, ['app-server', 'daemon', 'restart']);
+  assert.equal(m.calls[0].env.HTTPS_PROXY, 'http://127.0.0.1:3457');
+  assert.equal(m.calls[0].env.CODEX_CA_CERTIFICATE, '/ca.pem');
+  assert.equal(m.calls[0].env.PATH, '/bin');
+});
+
+test('switching Codex off restarts the daemon without the switcher variables, and keeps the user\'s own proxy', () => {
+  const m = machine('/switcher/state');
+  const baseEnv = { HTTPS_PROXY: 'http://127.0.0.1:3457', https_proxy: 'http://proxy.corp:8080', CODEX_CA_CERTIFICATE: '/ca.pem', NO_PROXY: '127.0.0.1,localhost' };
+  restartCodexDaemon([], { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv, ca: '/ca.pem' });
+  const env = m.calls[0].env;
+  assert.equal(env.HTTPS_PROXY, undefined, 'the loopback interceptor is removed');
+  assert.equal(env.CODEX_CA_CERTIFICATE, undefined, 'the switcher CA is removed');
+  assert.equal(env.https_proxy, 'http://proxy.corp:8080', 'a proxy the user set is kept');
+});
+
+test('no restart when the codex shim routes through another state dir, or no daemon runs', () => {
+  const other = machine('/another/install');
+  assert.equal(restartCodexDaemon(ROUTE, { home: other.home, codexHome: other.codexHome, stateDir: '/switcher/state', spawnFn: other.spawnFn }).restarted, false);
+  assert.equal(other.calls.length, 0);
+
+  const idle = machine('/switcher/state');
+  fs.rmSync(path.join(idle.codexHome, 'app-server-control', 'app-server-control.sock'));
+  assert.equal(restartCodexDaemon(ROUTE, { home: idle.home, codexHome: idle.codexHome, stateDir: '/switcher/state', spawnFn: idle.spawnFn }).restarted, false);
+  assert.equal(idle.calls.length, 0, 'a daemon that does not run is not started');
+});
+
+test('applyLaunchState reports a Codex route change only when env-codex changes', () => {
+  assert.ok(STATE_DIR.startsWith(root), 'the test writes only its own launch files');
+  const cfg = {
+    port: 3456, blindfold: { port: 3457 }, activeProfiles: { claude: null, codex: 'cx' },
+    profiles: { cx: { name: 'Cx', mode: 'convert', tool: 'codex', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { main: 'm' } } }
+  };
+  assert.equal(applyLaunchState(cfg, 3456).codexRouteChanged, true, 'first activation');
+  assert.equal(applyLaunchState(cfg, 3456).codexRouteChanged, false, 'same route again');
+  assert.equal(applyLaunchState({ ...cfg, activeProfiles: { claude: null, codex: null } }, 3456).codexRouteChanged, true, 'switched off');
+});
+
+test('switch off, for all tools or for Codex alone, also reports the Codex route change', () => {
+  const cfg = {
+    port: 3456, blindfold: { port: 3457 }, activeProfiles: { claude: null, codex: 'cx' },
+    profiles: { cx: { name: 'Cx', mode: 'convert', tool: 'codex', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { main: 'm' } } }
+  };
+  applyLaunchState(cfg, 3456);
+  assert.equal(clearLaunchState(3456).codexRouteChanged, true);
+  assert.equal(clearLaunchState(3456).codexRouteChanged, false, 'already off');
+  applyLaunchState(cfg, 3456);
+  assert.equal(emptyToolEnvFiles('codex').codexRouteChanged, true);
+  assert.equal(emptyToolEnvFiles('claude').codexRouteChanged, false);
+});

package/tests/lifecycle.test.mjs

@@ -54,16 +54,16 @@ function envFor(ws) {
   return { ...process.env, HOME: path.join(ws.dir, 'home'), USERPROFILE: path.join(ws.dir, 'home'), LLM_SWITCHER_CONFIG: ws.cfgPath, LLM_SWITCHER_STATE_DIR: ws.dir, LLM_SWITCHER_BLINDFOLD_CERTS: ws.certDir, CLAUDE_CONFIG_DIR: ws.claudeDir, LLM_SWITCHER_PORT: '', PORT: '' };
 }
 
-function writeConfig(ws, gwPort, bfPort, activeResponses = null) {
+// The 1.2 schema: one pointer per tool and one interceptor port for the whole config. A file in the
+// older schema is migrated on load, which rewrites it and breaks every "changes nothing" assertion.
+function writeConfig(ws, gwPort, bfPort, activeCodex = null) {
   fs.writeFileSync(ws.cfgPath, JSON.stringify({
     port: gwPort,
-    activeProfiles: { anthropic: null, responses: activeResponses, 'openai-chat': null, vertex: null },
+    blindfold: { port: bfPort },
+    activeProfiles: { claude: null, codex: activeCodex },
     profiles: {
-      plain: { name: 'Plain', mode: 'convert', inFormat: 'auto', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { opus: 'o' } },
-      bf: {
-        name: 'Blindfold', mode: 'convert', inFormat: 'responses', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k',
-        defaultModels: { main: 'm' }, blindfold: true, blindfoldPort: bfPort
-      }
+      plain: { name: 'Plain', mode: 'convert', tool: 'claude', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { opus: 'o' } },
+      bf: { name: 'Blindfold', mode: 'convert', tool: 'codex', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { main: 'm' } }
     }
   }, null, 2), { mode: 0o600 });
 }
@@ -121,7 +121,7 @@ test('the gateway proves its identity to a fresh challenge; a replayed /health i
     const body = await (await fetch(`http://127.0.0.1:${gwPort}/health?challenge=abc`)).json();
     // The proof binds the role, the port it answers on and its pid, so it cannot be relayed or edited.
     assert.equal(body.port, gwPort);
-    assert.equal(body.proof, crypto.createHmac('sha256', token(ws)).update(['gateway', gwPort, body.pid, '', '', '', 'abc'].join('|')).digest('hex'));
+    assert.equal(body.proof, crypto.createHmac('sha256', token(ws)).update(['gateway', gwPort, body.pid, '', '', 'abc'].join('|')).digest('hex'));
     assert.equal(await probe(ws, `s.probeGateway(${gwPort})`), 'ours');
     assert.equal(await probe(ws, `s.probeGateway(${replayPort})`), 'foreign');
     assert.equal(await probe(ws, `s.probeGateway(${await freePort()})`), 'free');
@@ -210,18 +210,21 @@ test('the gateway owns the interceptor: dashboard changes, a lost interceptor an
   let gw = await startGateway(ws, gwPort);
   const bfState = () => probe(ws, `s.probeBlindfold(${bfPort})`);
   try {
-    // 1. the dashboard turns blindfold on for the Codex target
-    const on = await api(ws, gwPort, '/api/switch', { target: 'responses', profile: 'bf' });
+    // 1. the dashboard turns Codex on
+    const on = await api(ws, gwPort, '/api/switch', { target: 'codex', profile: 'bf' });
     assert.equal(on.success, true, JSON.stringify(on));
     let st = await waitFor(async () => { const s = await bfState(); return s.state === 'ours' && s; });
     assert.equal(st.gatewayPort, gwPort);
-    assert.equal(st.prefix, '/backend-api/codex');
+    assert.equal(st.activeTools, 'codex');
 
-    // 2. the dashboard changes the prefix: the interceptor is respawned with it
-    const saved = await api(ws, gwPort, '/api/save-profile', { key: 'bf', profile: { blindfoldPrefix: '/backend-api/codex2' } });
-    assert.notEqual(saved.success, false, JSON.stringify(saved));
-    st = await waitFor(async () => { const s = await bfState(); return s.prefix === '/backend-api/codex2' && s; });
-    assert.equal(st.prefix, '/backend-api/codex2');
+    // 2. the dashboard turns Claude on as well: the running interceptor takes the new tool set in place
+    const both = await api(ws, gwPort, '/api/switch', { target: 'claude', profile: 'plain' });
+    assert.notEqual(both.success, false, JSON.stringify(both));
+    st = await waitFor(async () => { const s = await bfState(); return s.activeTools === 'claude,codex' && s; });
+    assert.equal(st.activeTools, 'claude,codex');
+    await api(ws, gwPort, '/api/switch', { target: 'claude', profile: null });
+    st = await waitFor(async () => { const s = await bfState(); return s.activeTools === 'codex' && s; });
+    assert.equal(st.activeTools, 'codex');
 
     // 3. the interceptor dies; a sync brings it back
     process.kill(st.pid, 'SIGTERM');
@@ -238,31 +241,30 @@ test('the gateway owns the interceptor: dashboard changes, a lost interceptor an
     st = await waitFor(async () => { const s = await bfState(); return s.state === 'ours' && s; });
     assert.equal(st.gatewayPort, gwPort, 'the gateway starts the interceptor at boot');
 
-    // 5. a foreign process on the new interceptor port: the caller sees the failure
+    // 5. config.json names an interceptor port that a foreign process holds: a dashboard change fails
     const squatter = net.createServer(s => s.end());
     const squatPort = await new Promise(r => squatter.listen(0, '127.0.0.1', () => r(squatter.address().port)));
+    const good = fs.readFileSync(ws.cfgPath);
     try {
+      fs.writeFileSync(ws.cfgPath, JSON.stringify({ ...JSON.parse(good), blindfold: { port: squatPort } }, null, 2), { mode: 0o600 });
+      const edited = fs.readFileSync(ws.cfgPath);
       const badRes = await fetch(`http://127.0.0.1:${gwPort}/api/save-profile`, {
         method: 'POST', headers: { 'Content-Type': 'application/json', 'x-llm-switcher-token': token(ws) },
-        body: JSON.stringify({ key: 'bf', profile: { blindfoldPort: squatPort } })
+        body: JSON.stringify({ key: 'bf', profile: { name: 'Renamed' } })
       });
       assert.equal(badRes.status, 502, 'a failure is not answered with 200');
       const bad = await badRes.json();
       assert.equal(bad.success, false);
       assert.match(bad.error, /held by another process/);
-      const onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8')).profiles.bf.blindfoldPort;
-      assert.equal(onDisk, bfPort, 'a refused change is not saved, so HTTPS_PROXY never points at the squatter');
+      assert.deepEqual(fs.readFileSync(ws.cfgPath), edited, 'a refused change is not saved');
       assert.equal((await bfState()).state, 'ours', 'the working interceptor stays up');
-      const status = await fetch(`http://127.0.0.1:${gwPort}/api/status`, { headers: { 'x-llm-switcher-token': token(ws) } }).then(r => r.json());
-      assert.equal(status.config.profiles.bf.blindfoldPort, bfPort, 'the gateway does not keep the refused change in memory');
     } finally {
       squatter.close();
+      fs.writeFileSync(ws.cfgPath, good, { mode: 0o600 });
     }
 
     // 6. turning the Codex target off stops the interceptor
-    await api(ws, gwPort, '/api/save-profile', { key: 'bf', profile: { blindfoldPort: bfPort } });
-    await waitFor(async () => (await bfState()).state === 'ours');
-    await api(ws, gwPort, '/api/switch', { target: 'responses', profile: null });
+    await api(ws, gwPort, '/api/switch', { target: 'codex', profile: null });
     assert.equal(await waitFor(async () => (await bfState()).state === 'free'), true);
   } finally {
     try { const s = await bfState(); if (s.state === 'ours') process.kill(s.pid, 'SIGTERM'); } catch {}
@@ -276,32 +278,42 @@ test('the gateway owns the interceptor: dashboard changes, a lost interceptor an
 test('concurrent admin changes: a refused change never reaches disk, and no accepted change is lost', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
   const ws = makeWorkspace({ certs: true });
   const gwPort = await freePort();
-  const bfPort = await freePort();
-  writeConfig(ws, gwPort, bfPort, 'bf');
-  const launch = snapshotLaunchFiles(ws.dir);
-  const gw = await startGateway(ws, gwPort);
+  let bfPort;
   // A squatter that accepts and never answers keeps the identity probe waiting.
   const silent = net.createServer(() => {});
   const silentPort = await new Promise(r => silent.listen(0, '127.0.0.1', () => r(silent.address().port)));
+  writeConfig(ws, gwPort, silentPort);
+  const launch = snapshotLaunchFiles(ws.dir);
+  const gw = await startGateway(ws, gwPort);
   try {
-    await waitFor(async () => (await probe(ws, `s.probeBlindfold(${bfPort})`)).state === 'ours');
-    const post = (body) => fetch(`http://127.0.0.1:${gwPort}/api/save-profile`, {
+    const post = (p, body) => fetch(`http://127.0.0.1:${gwPort}${p}`, {
       method: 'POST', headers: { 'Content-Type': 'application/json', 'x-llm-switcher-token': token(ws) }, body: JSON.stringify(body)
     });
-    const refused = post({ key: 'bf', profile: { blindfoldPort: silentPort } });
+    // Turning Codex on waits for the silent port and is refused; the rename that arrives meanwhile is kept.
+    const refused = post('/api/switch', { target: 'codex', profile: 'bf' });
     await new Promise(r => setTimeout(r, 300));
-    const other = post({ key: 'plain', profile: { name: 'Renamed' } });
+    const other = post('/api/save-profile', { key: 'plain', profile: { name: 'Renamed' } });
     const [a, b] = await Promise.all([refused, other]);
     assert.equal(a.status, 502);
     assert.equal(b.status, 200);
-    const onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8'));
-    assert.equal(onDisk.profiles.bf.blindfoldPort, bfPort, 'the refused port is not saved by the other request');
+    let onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8'));
+    assert.equal(onDisk.activeProfiles.codex, null, 'the refused switch is not saved by the other request');
     assert.equal(onDisk.profiles.plain.name, 'Renamed');
 
+    // A usable interceptor port, and Codex on, for the second half. Chosen only now: other test files
+    // run at the same time, and a port picked seconds earlier can be taken in between.
+    bfPort = await freePort();
+    onDisk.blindfold = { port: bfPort };
+    fs.writeFileSync(ws.cfgPath, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
+    const on = await post('/api/switch', { target: 'codex', profile: 'bf' });
+    assert.equal(on.status, 200, await on.text());
+    await waitFor(async () => (await probe(ws, `s.probeBlindfold(${bfPort})`)).state === 'ours');
+    const postProfile = (body) => post('/api/save-profile', body);
+
     // Two accepted changes to the active profile: the one that saves last keeps the other.
     const [c, d] = await Promise.all([
-      post({ key: 'bf', profile: { name: 'First' } }),
-      post({ key: 'bf', profile: { defaultModels: { main: 'm2' } } })
+      postProfile({ key: 'bf', profile: { name: 'First' } }),
+      postProfile({ key: 'bf', profile: { defaultModels: { main: 'm2' } } })
     ]);
     assert.equal(c.status, 200);
     assert.equal(d.status, 200);

package/tests/make-certs.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HAS_OPENSSL = process.platform !== 'win32' && fs.existsSync('/usr/bin/openssl');
+
+// LibreSSL names the -CAcreateserial file after the CA path cut at its first dot, so a
+// directory such as /Users/first.last sent the serial file to /Users/first.srl.
+test('make-certs.sh builds the certificates under a path that contains a dot', { skip: !HAS_OPENSSL && 'posix + openssl' }, (t) => {
+  // The first dot of the whole path is in `first.last`, so a stray serial file lands in `dir` as first.srl.
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmswcerts'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const out = path.join(dir, 'first.last', 'certs');
+  execFileSync('bash', [path.join(ROOT, 'blindfold', 'make-certs.sh'), out], { stdio: 'pipe' });
+  for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(out, f)), `${f} is missing`);
+  assert.deepEqual(fs.readdirSync(dir), ['first.last'], 'no serial file outside the output directory');
+});

package/tests/real-user-sim.test.mjs

@@ -130,6 +130,8 @@ before(async () => {
   proxyPort = await freePort();
   blindfoldPort = await freePort();
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-sim-'));
+  // Blindfold mode needs a CA. Without its own directory the gateway reads the certificates of the checkout.
+  execFileSync('bash', [path.join(ROOT, 'blindfold', 'make-certs.sh'), path.join(tmpDir, 'certs')], { stdio: 'ignore' });
 
   const base = `http://127.0.0.1:${upstreamPort}`;
   const models = { opus: 'up-opus', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' };
@@ -150,6 +152,7 @@ before(async () => {
       ...process.env,
       LLM_SWITCHER_CONFIG: path.join(tmpDir, 'config.json'),
       LLM_SWITCHER_STATE_DIR: tmpDir,
+      LLM_SWITCHER_BLINDFOLD_CERTS: path.join(tmpDir, 'certs'),
       CLAUDE_CONFIG_DIR: path.join(tmpDir, 'claude'),
       LLM_SWITCHER_PORT: ''
     },

package/tests/shim.test.mjs

@@ -31,7 +31,11 @@ if (process.platform !== 'win32') {
     fs.chmodSync(path.join(RENDER_DIR, name), 0o755);
   }
 }
+// Only node, never the directory it lives in: an npm install puts the real claude and codex next to it.
+const NODE_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'shimnode-'));
+if (process.platform !== 'win32') fs.symlinkSync(process.execPath, path.join(NODE_DIR, 'node'));
 test.after(() => {
+  fs.rmSync(NODE_DIR, { recursive: true, force: true });
   fs.rmSync(RENDER_DIR, { recursive: true, force: true });
   fs.rmSync(STATE, { recursive: true, force: true });
 });
@@ -47,7 +51,7 @@ function runShim(name, args, { active, fakeDir, extraPath = '', env = {}, files
     fs.writeFileSync(path.join(STATE, `env-${name}.sh`), "export HTTPS_PROXY='http://127.0.0.1:3457'\n");
   }
   for (const [f, content] of Object.entries(files)) fs.writeFileSync(path.join(STATE, f), content);
-  const PATH_ = [RENDER_DIR, fakeDir, extraPath || '/usr/bin:/bin', path.dirname(process.execPath)]
+  const PATH_ = [RENDER_DIR, fakeDir, extraPath || '/usr/bin:/bin', NODE_DIR]
     .filter(Boolean).join(path.delimiter);
   return execFileSync(path.join(RENDER_DIR, name), args, {
     encoding: 'utf8', env: { ...process.env, ...env, PATH: PATH_ }, timeout: 15000
@@ -156,8 +160,8 @@ test('A2: codex shim passes no config override', () => {
 test('codex shim wires only the interceptor proxy and passes its arguments through', (t) => {
   if (process.platform === 'win32') return t.skip('posix only');
   const out = runShim('codex', ['exec', 'hi'], {
-    fakeDir: makeArgvBin('codex'),
-    files: { 'active.flag': 'active' }
+    active: true,
+    fakeDir: makeArgvBin('codex')
   }).split('\n');
   assert.equal(out[0], 'HTTPS_PROXY=http://127.0.0.1:3457', 'the interceptor is the only wiring');
   assert.deepEqual(out.slice(1), ['exec', 'hi'], 'arguments must be preserved');
@@ -171,6 +175,7 @@ test('Claude shim never loads the Codex-only file or passes Codex overrides', (t
   // env-codex.sh carries a deliberately different port: if the claude shim ever sourced it,
   // that value would show up instead of the claude one.
   const out = runShim('claude', ['--resume'], {
+    active: true,
     fakeDir: makeArgvBin('claude'),
     files: { 'env-codex.sh': "export HTTPS_PROXY='http://127.0.0.1:9999'\n" }
   }).split('\n');