llm-switcher 1.2.2 → 1.2.4

package/state.mjs

@@ -12,6 +12,7 @@ import crypto from 'node:crypto';
 import http from 'node:http';
 import { spawn, execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { buildCerts, writeLeaf } from './blindfold/certs.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -1441,26 +1442,78 @@ function writeToolFiles(pairs, shPath, cmdPath) {
 // launcher files are never opened (A13: emptied, never deleted).
 export function emptyToolEnvFiles(tool) {
   const codex = tool === 'codex';
-  withLaunchLock(() => {
+  const codexRouteChanged = withLaunchLock(() => {
+    const before = codex ? readOrEmpty(paths.envCodexSh) : '';
     writeAtomic(codex ? paths.envCodexCmd : paths.envClaudeCmd, '');
     writeAtomic(codex ? paths.envCodexSh : paths.envClaudeSh, '');
+    return before !== '';
   });
+  return { codexRouteChanged, codexDaemon: codexRouteChanged ? restartCodexDaemon([]) : undefined };
 }
 
 // Write the per-tool env files from activeProfiles. settings.json is never touched here: it
 // belongs to the coding tool (R1), and model-catalog.json is no longer written (R9).
 export function applyLaunchState(cfg, port, opts = {}) {
-  return withLaunchLock(() => writeLaunchState(cfg, port, opts));
+  const st = withLaunchLock(() => writeLaunchState(cfg, port, opts));
+  if (st.codexRouteChanged) st.codexDaemon = restartCodexDaemon(st.envCodex);
+  return st;
+}
+
+const LOOPBACK_URL = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?\/?$/i;
+
+/**
+ * The interactive Codex TUI talks to a shared `codex app-server` daemon, and the daemon keeps the
+ * environment it started with. A new route reaches it only through a restart. Only the launch files
+ * that the installed codex shim reads can route that daemon, so any other state dir (tests) is a no-op.
+ */
+export function restartCodexDaemon(pairs, {
+  home = os.homedir(),
+  codexHome = process.env.CODEX_HOME || path.join(home, '.codex'),
+  stateDir = STATE_DIR,
+  baseEnv = process.env,
+  ca = paths.blindfoldCA,
+  spawnFn = spawn
+} = {}) {
+  let shim = '';
+  try { shim = fs.readFileSync(path.join(home, '.llm-switcher', 'bin', 'codex'), 'utf8'); } catch {}
+  if (!shim.includes(`SWITCHER_DIR="${stateDir}"`)) return { restarted: false, reason: 'the codex shim does not read this state dir' };
+  const bin = path.join(codexHome, 'packages', 'app-server-daemon', 'current', 'bin', 'codex');
+  // The socket is a link to the running daemon; it no longer resolves once the daemon stopped.
+  if (!fs.existsSync(bin) || !fs.existsSync(path.join(codexHome, 'app-server-control', 'app-server-control.sock'))) {
+    return { restarted: false, reason: 'no Codex daemon runs' };
+  }
+
+  // Remove only the values this switcher writes (R8); a proxy or CA the user set stays.
+  const env = { ...baseEnv };
+  for (const k of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) if (LOOPBACK_URL.test(env[k] || '')) delete env[k];
+  for (const k of ['NO_PROXY', 'no_proxy']) if (env[k] === '127.0.0.1,localhost') delete env[k];
+  if (env.CODEX_CA_CERTIFICATE === ca) delete env.CODEX_CA_CERTIFICATE;
+  for (const [k, v] of pairs) env[k] = v;
+
+  try {
+    const child = spawnFn(bin, ['app-server', 'daemon', 'restart'], { env, stdio: 'ignore', detached: true });
+    child.on?.('error', () => {});
+    child.unref?.();
+    return { restarted: true };
+  } catch (err) {
+    return { restarted: false, reason: err.message };
+  }
+}
+
+function readOrEmpty(file) {
+  try { return fs.readFileSync(file, 'utf8'); } catch { return ''; }
 }
 
 function writeLaunchState(cfg, port) {
   const st = computeLaunchState(cfg, port);
+  const codexBefore = readOrEmpty(paths.envCodexSh);
 
   // Env files first, the flag last: a flag that says "active" while a file is missing or stale
   // makes the launcher route with the wrong variables. A failed write leaves the flag as it was.
   try {
     writeToolFiles(st.envClaude, paths.envClaudeSh, paths.envClaudeCmd);
     writeToolFiles(st.envCodex, paths.envCodexSh, paths.envCodexCmd);
+    st.codexRouteChanged = readOrEmpty(paths.envCodexSh) !== codexBefore;
     // Recorded on switch on so a shell opened while the gateway ran can still recognize its own
     // stale loopback URL later, after the port changed (R8).
     if (st.active) writeAtomic(paths.gatewayPort, `${port}\n`);
@@ -1476,7 +1529,8 @@ function writeLaunchState(cfg, port) {
 }
 
 export function clearLaunchState(port) {
-  withLaunchLock(() => {
+  const codexRouteChanged = withLaunchLock(() => {
+    const codexBefore = readOrEmpty(paths.envCodexSh);
     writeOrRemove(paths.activeFlag, null);
     // Stubs rather than deletions, and the tool files emptied rather than removed (R8, A13):
     // `switch off claude` must leave an empty claude file behind, and bare `switch off` must
@@ -1486,9 +1540,10 @@ export function clearLaunchState(port) {
     for (const f of [paths.envClaudeCmd, paths.envClaudeSh, paths.envCodexCmd, paths.envCodexSh]) {
       writeAtomic(f, '');
     }
+    return codexBefore !== '';
   });
   // settings.json belongs to the coding tool: the switcher neither reads nor writes it (R1).
-  return { changed: false, removed: [] };
+  return { changed: false, removed: [], codexRouteChanged, codexDaemon: codexRouteChanged ? restartCodexDaemon([]) : undefined };
 }
 
 export function readLaunchFlags() {
@@ -1689,6 +1744,32 @@ export async function stopRecordedBlindfold() {
   return { ok: stopped, ...(stopped ? {} : { error: `the interceptor on port ${prev.port} did not stop` }) };
 }
 
+// A CA that still works is kept when the leaf is rebuilt: Codex already trusts it.
+function caUsable(dir) {
+  try {
+    const ca = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'ca.pem')));
+    return ca.ca && Date.parse(ca.validTo) > Date.now() + 86400000
+      && ca.checkPrivateKey(crypto.createPrivateKey(fs.readFileSync(path.join(dir, 'ca.key'))));
+  } catch {
+    return false;
+  }
+}
+
+/** Builds the certificates when they are missing or unusable, then returns what the preflight
+ * says of them: null when the interceptor can start. */
+export function ensureBlindfoldCerts(desired) {
+  const problem = blindfoldPreflight(desired);
+  if (!problem) return null;
+  const dir = path.dirname(desired.ca);
+  try {
+    if (caUsable(dir)) writeLeaf(dir, INTERCEPT_HOSTS);
+    else buildCerts(dir, INTERCEPT_HOSTS);
+  } catch (err) {
+    return `${problem} Building them failed: ${err.message}`;
+  }
+  return blindfoldPreflight(desired);
+}
+
 /** null when the interceptor can start, otherwise the reason and the command that fixes it. */
 export function blindfoldPreflight(desired) {
   const certDir = path.dirname(desired.ca);
@@ -1756,11 +1837,12 @@ function spawnBlindfold(desired, gatewayPort) {
   return child.pid;
 }
 
-/** null when the interceptor that cfg asks for can run, otherwise the reason. No side effects. */
+/** null when the interceptor that cfg asks for can run, otherwise the reason. Builds missing or
+ * outdated certificates on the way; changes nothing else. */
 export async function checkBlindfoldTarget(cfg, gatewayPort) {
   const desired = computeLaunchState(cfg, gatewayPort).blindfold;
   if (!desired) return null;
-  const problem = blindfoldPreflight(desired);
+  const problem = ensureBlindfoldCerts(desired);
   if (problem) return problem;
   const held = (await probeBlindfold(desired.port)).state;
   if (held === 'foreign') return `Port ${desired.port} is held by another process, not by this switcher's interceptor.`;

package/switch.mjs

@@ -8,7 +8,7 @@ import {
   resolvePort, parsePort, findProfileKey, getActiveMap, setTargetProfile, activateProfile, deactivateAll,
   applyLaunchState, clearLaunchState, computeLaunchState,
   modelSlotsForProfile, modelForSlot, model1MForSlot, readAdminToken, adminTokenPath, openLog,
-  probeGateway, probeBlindfold, blindfoldPreflight, stopRecordedBlindfold, writeDashboardLauncher,
+  probeGateway, probeBlindfold, ensureBlindfoldCerts, stopRecordedBlindfold, writeDashboardLauncher,
   contractLabSettings, codexPublicModelsWarning,
   getMigrationError, getMigrationCollision, getLastLoadError,
   casClearToolPointers, emptyToolEnvFiles, syncInterceptorTools
@@ -26,6 +26,12 @@ const proxyScript = path.join(ROOT_DIR, 'proxy.mjs');
 const proxyLogPath = paths.proxyLog;
 const userProfile = os.homedir();
 
+// The version needs no config.json: it must also answer before the first setup.
+if (['version', '--version', '-v'].includes(String(process.argv[2] || '').toLowerCase())) {
+  await showVersion();
+  process.exit(0);
+}
+
 const config = loadConfig();
 if (!config) {
   const err = getConfigLoadError();
@@ -356,10 +362,11 @@ function planSwitch(base, key, cliTarget) {
 
 function refuseBlindfoldProblem(planned, port) {
   const bf = computeLaunchState(planned, port).blindfold;
-  const problem = bf && blindfoldPreflight(bf);
+  // A missing or outdated certificate is built here; only a set that cannot be built stops the switch.
+  const problem = bf && ensureBlindfoldCerts(bf);
   if (!problem) return bf;
   console.error(`[Error] ${problem}`);
-  console.error('        Fix the certificate with: bash blindfold/make-certs.sh - it names all three hosts this switcher routes. Nothing was changed.');
+  console.error('        Nothing was changed.');
   process.exit(1);
 }
 
@@ -415,6 +422,7 @@ async function turnOn(profileName, cliTarget) {
   const savedBytes = fs.readFileSync(configPath);
   const st = applyLaunchState(planned, port);
   reportSettings(st.settings);
+  reportCodexDaemon(st);
   const bf = await requestBlindfoldSync(port);
   if (!bf.ok) {
     console.error(`[Error] ${bf.error}`);
@@ -520,7 +528,7 @@ async function turnOff(targetArg) {
       // The order is fixed by R7b: the CAS write, then this tool's env files, then the active-tools
       // update. If the CAS write cannot land, the env file and the interceptor stay untouched.
       const saved = casOff([target]);
-      emptyToolEnvFiles(target);
+      reportCodexDaemon(emptyToolEnvFiles(target));
       const bf = await syncOrStopBlindfold(port, config);
       if (!bf.ok) {
         console.error(`[Error] ${target} is switched back, but the interceptor is not in line: ${bf.error}`);
@@ -534,6 +542,7 @@ async function turnOff(targetArg) {
     saveConfig(config);
     const st = applyLaunchState(config, port);
     reportSettings(st.settings);
+    reportCodexDaemon(st);
     const bf = await syncOrStopBlindfold(port, config);
     if (!bf.ok) {
       console.error(`[Error] ${target} is switched back, but the blindfold interceptor is not in line: ${bf.error}`);
@@ -581,6 +590,12 @@ function auditActiveClis() {
 function reportSettings(result) {
   if (result?.removed?.length) console.log(`[settings.json] Removed switcher-written values: ${result.removed.join(', ')}`);
   if (result?.error) console.warn(`[settings.json] Not cleaned: ${result.error}`);
+  reportCodexDaemon(result);
+}
+
+// The interactive Codex TUI keeps using its shared daemon, so a new route needs that daemon restarted.
+function reportCodexDaemon(st) {
+  if (st?.codexDaemon?.restarted) console.log('[Codex] Restarted the codex app-server daemon: open Codex sessions reconnect with the new route.');
 }
 
 async function showStatus() {
@@ -848,7 +863,7 @@ async function runDoctor() {
     const p = config.profiles[key];
     if (!p) warn(`[WARN] Target ${t} points to missing profile "${show(key)}".`);
     else if (!p.baseURL || /YOUR-|REPLACE-ME/i.test(`${p.baseURL} ${p.apiKey}`)) warn(`[WARN] Profile "${show(key)}" (${t}) still has placeholder baseURL/apiKey.`);
-    if (p && t === 'responses') {
+    if (p && t === 'codex') {
       const codexWarning = codexPublicModelsWarning(show(key), p);
       if (codexWarning) warn(`[WARN] ${codexWarning}`);
     }
@@ -945,14 +960,14 @@ async function runDoctor() {
   const leafPath = path.join(path.dirname(paths.blindfoldCA), 'leaf.pem');
   if (!fs.existsSync(leafPath)) {
     warn(`[WARN] No interceptor certificate at ${leafPath}: neither tool can be intercepted.`);
-    console.log('        Fix: bash blindfold/make-certs.sh');
+    console.log('        Fix: switch a tool on; the switcher builds the certificate. Or run bash blindfold/make-certs.sh');
   } else {
     try {
       const pem = fs.readFileSync(leafPath, 'utf8');
       const missing = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com'].filter(h => !certCoversHost(pem, h));
       if (missing.length) {
         warn(`[WARN] The interceptor certificate does not cover ${missing.join(', ')}.`);
-        console.log('        Fix: bash blindfold/make-certs.sh   (it names all three hosts this switcher routes)');
+        console.log('        Fix: switch a tool on; the switcher rebuilds the certificate on the same CA. Or run bash blindfold/make-certs.sh');
       } else {
         console.log('[PASS] Interceptor certificate covers api.anthropic.com, api.openai.com and chatgpt.com.');
       }
@@ -1036,13 +1051,22 @@ async function runContractCheck() {
   }
 }
 
+async function showVersion() {
+  const { checkForUpdate } = await import('./version.mjs');
+  const v = await checkForUpdate({ stateDir: STATE_DIR });
+  console.log(`llm-switcher ${v.current}`);
+  if (v.updateAvailable) console.log(`A new version is available: ${v.latest}. Update with: ${v.updateCommand}`);
+  else if (!v.latest) console.log('Could not check the npm registry for a newer version.');
+  else console.log('This is the latest version.');
+}
+
 async function showModels(target) {
-  const { loadCatalogCache, refreshCatalog } = await import('./catalog.mjs');
+  const { syncLocalCatalog, refreshCatalog } = await import('./catalog.mjs');
   if (optionValue('--refresh') || process.argv.includes('--refresh')) {
     console.log('Refreshing models catalog from official endpoints...');
     await refreshCatalog(STATE_DIR);
   }
-  const cache = loadCatalogCache(STATE_DIR);
+  const cache = syncLocalCatalog(STATE_DIR);
   console.log('=== LLM Switcher Discovered Models Catalog ===\n');
   const t = target ? target.toLowerCase() : '';
   if (!t || t === 'claude') {
@@ -1105,6 +1129,7 @@ if (cmd === 'off' || cmd === 'stop') {
   console.log('Usage:');
   console.log('  switch ui                      # Open Web UI dashboard');
   console.log('  switch status                  # Show multi-CLI active status');
+  console.log('  switch version                 # Show the version and check for a newer one');
   console.log('  switch doctor                  # Audit environment, settings & routing');
   console.log('  switch on [profile]            # Start gateway & activate profile for all compatible targets');
   console.log('  switch <profile>               # Activate profile for all compatible targets');

package/tests/blindfold-e2e.test.mjs

@@ -150,7 +150,7 @@ async function startInterceptor({ port, gatewayPort, config, upstreamPort }) {
   child.stdout.on('data', (d) => output.push(String(d)));
   child.stderr.on('data', (d) => output.push(String(d)));
   const stop = async () => {
-    if (child.exitCode !== null) return;
+    if (child.exitCode !== null || child.signalCode !== null) return;
     child.kill();
     await once(child, 'exit').catch(() => {});
   };
@@ -181,7 +181,7 @@ async function startGateway(t, port, cfgPath) {
   child.stdout.on('data', (d) => { log += d; });
   child.stderr.on('data', (d) => { log += d; });
   const stop = async () => {
-    if (child.exitCode !== null) return;
+    if (child.exitCode !== null || child.signalCode !== null) return;
     child.kill();
     await once(child, 'exit').catch(() => {});
   };

package/tests/blindfold-task5.test.mjs

@@ -113,7 +113,7 @@ async function startInterceptor({ port, gatewayPort, config, activeTools = 'clau
   child.stderr.on('data', (d) => output.push(String(d)));
 
   const stop = async () => {
-    if (child.exitCode !== null) return;
+    if (child.exitCode !== null || child.signalCode !== null) return;
     child.kill();
     await once(child, 'exit').catch(() => {});
   };

package/tests/blindfold.task3.test.mjs

@@ -126,7 +126,7 @@ async function startInterceptor({ port, gatewayPort, config, activeTools = 'clau
   child.stderr.on('data', (d) => output.push(String(d)));
 
   const stop = async () => {
-    if (child.exitCode !== null) return;   // already gone: waiting for 'exit' would never resolve
+    if (child.exitCode !== null || child.signalCode !== null) return;   // already gone: waiting for 'exit' would never resolve
     child.kill();
     await once(child, 'exit').catch(() => {});
   };
@@ -650,7 +650,7 @@ test('R3b: an interceptor from 1.1.11 proves the old way and is replaced, not tr
   `;
   const legacy = spawn(process.execPath, ['--input-type=module', '-e', legacySrc], { stdio: ['ignore', 'pipe', 'pipe'] });
   t.after(async () => {
-    if (legacy.exitCode !== null) return;
+    if (legacy.exitCode !== null || legacy.signalCode !== null) return;
     legacy.kill();
     await once(legacy, 'exit').catch(() => {});
   });

package/tests/blindfold.wire.test.mjs

@@ -53,7 +53,9 @@ async function startInterceptor() {
   const port = await freePort();
   const child = spawn(process.execPath, [path.join(ROOT, 'blindfold', 'blindfold.mjs'),
     '--port', String(port), '--gateway-port', String(gatewayPort), '--certs', certDir,
-    '--capture', captureDir, '--token-file', path.join(dir, 'admin.token')], { stdio: ['ignore', 'pipe', 'pipe'] });
+    '--capture', captureDir, '--token-file', path.join(dir, 'admin.token'),
+    // Since R3 only the paths of an active tool reach the gateway; everything else passes through.
+    '--active-tools', 'codex'], { stdio: ['ignore', 'pipe', 'pipe'] });
   let out = '';
   child.stdout.on('data', d => { out += d; });
   child.stderr.on('data', d => { out += d; });

package/tests/catalog.test.mjs

@@ -14,6 +14,8 @@ import {
   refreshCatalog,
   detectToolVersion,
   checkVersionAndRefresh,
+  readLocalToolModels,
+  syncLocalCatalog,
   BASELINE_MODELS
 } from '../catalog.mjs';
 
@@ -124,24 +126,120 @@ test('detectToolVersion extracts semantic version from various User-Agent string
   assert.equal(detectToolVersion({}), '');
 });
 
-test('checkVersionAndRefresh records new version and triggers update only on version bumps', async () => {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-bump-test-'));
-  try {
-    // Initial request from version 1.1.0
-    checkVersionAndRefresh('claude', { 'user-agent': 'claude-cli/1.1.0' }, tmp);
-    const cat1 = loadCatalogCache(tmp);
-    assert.equal(cat1.claude.lastSeenVersion, '1.1.0');
-
-    // Repeated request from the same version 1.1.0 -> no change, no duplicate trigger
-    checkVersionAndRefresh('claude', { 'user-agent': 'claude-cli/1.1.0' }, tmp);
-    const cat2 = loadCatalogCache(tmp);
-    assert.equal(cat2.claude.lastSeenVersion, '1.1.0');
-
-    // Tool updates to version 1.2.0 -> version bump detected and saved
-    checkVersionAndRefresh('claude', { 'user-agent': 'claude-cli/1.2.0' }, tmp);
-    const cat3 = loadCatalogCache(tmp);
-    assert.equal(cat3.claude.lastSeenVersion, '1.2.0');
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
+// Local model lists that the tools write themselves, in the formats of Codex and Claude Code.
+function writeToolCaches(root, { codex = ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'], claude = ['claude-opus-5-5', 'claude-sonnet-5-5'] } = {}) {
+  const codexHome = path.join(root, 'codex');
+  const claudeDir = path.join(root, 'claude');
+  fs.mkdirSync(codexHome, { recursive: true });
+  fs.mkdirSync(path.join(claudeDir, 'cache', 'model-catalog'), { recursive: true });
+  if (codex) {
+    fs.writeFileSync(path.join(codexHome, 'models_cache.json'), JSON.stringify({
+      fetched_at: '2026-09-29T01:00:00Z', client_version: '0.158.0',
+      models: codex.map(slug => ({ slug, display_name: slug, context_window: 1000000, visibility: 'list' }))
+    }));
+  }
+  if (claude) {
+    // An older file with another list: the newest fetchedAt wins.
+    fs.writeFileSync(path.join(claudeDir, 'cache', 'model-catalog', 'old.json'), JSON.stringify({
+      version: 2, fetchedAt: 1000, catalog: { surface: 'cc', config: { models: [{ id: 'claude-opus-4-6', name: 'Opus 4.6' }] } }
+    }));
+    fs.writeFileSync(path.join(claudeDir, 'cache', 'model-catalog', 'new.json'), JSON.stringify({
+      version: 2, fetchedAt: 2000, catalog: { surface: 'cc', config: { models: claude.map(id => ({ id, name: id })) } }
+    }));
   }
+  return { codexHome, claudeDir };
+}
+
+function failingFetch(t) {
+  const realFetch = globalThis.fetch;
+  let calls = 0;
+  globalThis.fetch = async () => { calls++; return new Response('{}', { status: 401 }); };
+  t.after(() => { globalThis.fetch = realFetch; });
+  return () => calls;
+}
+
+test('readLocalToolModels reads the model lists that Codex and Claude Code keep on disk', (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-local-models-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const sources = writeToolCaches(root);
+
+  const codex = readLocalToolModels('codex', sources);
+  assert.deepEqual(codex.models.map(m => [m.id, m.role]), [['gpt-5.6-sol', 'main'], ['gpt-5.6-terra', 'review'], ['gpt-5.6-luna', 'subagent']]);
+  assert.equal(codex.version, '0.158.0');
+
+  const claude = readLocalToolModels('claude', sources);
+  assert.deepEqual(claude.models.map(m => [m.id, m.tier]), [['claude-opus-5-5', 'opus'], ['claude-sonnet-5-5', 'sonnet']]);
+
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-no-models-'));
+  t.after(() => fs.rmSync(empty, { recursive: true, force: true }));
+  assert.equal(readLocalToolModels('codex', { codexHome: empty, claudeDir: empty }), null);
+  assert.equal(readLocalToolModels('claude', { codexHome: empty, claudeDir: empty }), null);
+});
+
+test('refreshCatalog takes the local lists and drops the built-in names', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-refresh-local-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const sources = writeToolCaches(root);
+  const calls = failingFetch(t);
+
+  const cache = await refreshCatalog(root, { sources });
+  assert.deepEqual(cache.codex.models.map(m => m.id), ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna']);
+  assert.deepEqual(cache.claude.models.map(m => m.id), ['claude-opus-5-5', 'claude-sonnet-5-5']);
+  assert.equal(calls(), 0, 'a local list needs no network call');
+});
+
+test('checkVersionAndRefresh records a version only after the catalog for it is refreshed', async (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-bump-test-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  failingFetch(t);
+
+  // No local list and a failing official list: nothing is refreshed, so the version stays unseen.
+  const none = { codexHome: path.join(root, 'none'), claudeDir: path.join(root, 'none') };
+  checkVersionAndRefresh('codex', { 'user-agent': 'codex_cli_rs/0.158.0 (Mac OS)' }, root, undefined, none);
+  await new Promise(r => setTimeout(r, 50));
+  assert.equal(loadCatalogCache(root).codex.lastSeenVersion, undefined, 'a failed refresh is tried again');
+
+  // Codex wrote its list: the next request refreshes and records the version.
+  const sources = writeToolCaches(root, { codex: ['gpt-5.7-sol'] });
+  checkVersionAndRefresh('codex', { 'user-agent': 'codex_cli_rs/0.158.0 (Mac OS)' }, root, undefined, sources);
+  await new Promise(r => setTimeout(r, 50));
+  const after = loadCatalogCache(root);
+  assert.equal(after.codex.lastSeenVersion, '0.158.0');
+  assert.deepEqual(after.codex.models.map(m => m.id), ['gpt-5.7-sol']);
+});
+
+// A profile key belongs to that profile's baseURL. The official model lists may see it only when
+// the profile itself points at the official host.
+test('refreshCatalog sends a profile key only to the host of that profile', async (t) => {
+  const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-catalog-keys-'));
+  const realFetch = globalThis.fetch;
+  const sent = [];
+  globalThis.fetch = async (url, init = {}) => {
+    const h = init.headers || {};
+    sent.push({ host: new URL(url).host, auth: h.authorization || h['x-api-key'] || '' });
+    return new Response('{}', { status: 401 });
+  };
+  t.after(() => { globalThis.fetch = realFetch; fs.rmSync(stateDir, { recursive: true, force: true }); });
+
+  await refreshCatalog(stateDir, {
+    claudeProfile: { baseURL: 'https://gateway.example/v1', apiKey: 'sk-third-party' },
+    codexProfile: { baseURL: 'https://api.openai.com/v1', apiKey: 'sk-openai' },
+    sources: { codexHome: stateDir, claudeDir: stateDir }
+  });
+  assert.deepEqual(sent.find(s => s.host === 'api.anthropic.com').auth, '', 'a third-party key never reaches Anthropic');
+  assert.deepEqual(sent.find(s => s.host === 'api.openai.com').auth, 'Bearer sk-openai', 'an OpenAI profile key reaches OpenAI');
+});
+
+// Codex can update and rewrite its list without one request through the gateway.
+test('syncLocalCatalog picks up a list that a tool rewrote, with no network call', (t) => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-sync-local-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const calls = failingFetch(t);
+  assert.deepEqual(loadCatalogCache(root).codex.models.map(m => m.id).includes('gpt-6-sol'), true, 'starts from the built-in list');
+
+  const sources = writeToolCaches(root, { codex: ['gpt-5.7-sol', 'gpt-5.7-luna'] });
+  const synced = syncLocalCatalog(root, sources);
+  assert.deepEqual(synced.codex.models.map(m => m.id), ['gpt-5.7-sol', 'gpt-5.7-luna']);
+  assert.deepEqual(loadCatalogCache(root).codex.models.map(m => m.id), ['gpt-5.7-sol', 'gpt-5.7-luna'], 'saved to disk');
+  assert.equal(calls(), 0);
 });

package/tests/certs.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import tls from 'node:tls';
+import { execFileSync } from 'node:child_process';
+import { buildCerts, signLeaf } from '../blindfold/certs.mjs';
+import { blindfoldPreflight, ensureBlindfoldCerts, INTERCEPT_HOSTS } from '../state.mjs';
+
+const HAS_OPENSSL = (() => { try { execFileSync('openssl', ['version'], { stdio: 'ignore' }); return true; } catch { return false; } })();
+
+function tmp(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-certs-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return path.join(dir, 'certs');
+}
+
+const desiredFor = (dir) => ({ ca: path.join(dir, 'ca.pem') });
+
+test('buildCerts writes a CA and a leaf that the preflight accepts, private to the owner', (t) => {
+  const dir = tmp(t);
+  buildCerts(dir, INTERCEPT_HOSTS);
+  for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) {
+    assert.ok(fs.existsSync(path.join(dir, f)), f);
+    if (process.platform !== 'win32') assert.equal(fs.statSync(path.join(dir, f)).mode & 0o777, 0o600, f);
+  }
+  if (process.platform !== 'win32') assert.equal(fs.statSync(dir).mode & 0o777, 0o700);
+  assert.equal(blindfoldPreflight(desiredFor(dir)), null);
+  const ca = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'ca.pem')));
+  assert.equal(ca.ca, true);
+  const leaf = new crypto.X509Certificate(fs.readFileSync(path.join(dir, 'leaf.pem')));
+  assert.equal(leaf.ca, false);
+  for (const h of INTERCEPT_HOSTS) assert.equal(leaf.checkHost(h), h);
+});
+
+test('a TLS client that trusts only the CA completes a handshake for every host', async (t) => {
+  const dir = tmp(t);
+  buildCerts(dir, INTERCEPT_HOSTS);
+  const server = tls.createServer({ key: fs.readFileSync(path.join(dir, 'leaf.key')), cert: fs.readFileSync(path.join(dir, 'leaf.pem')) }, s => s.end('ok'));
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  t.after(() => server.close());
+  for (const host of INTERCEPT_HOSTS) {
+    const got = await new Promise((resolve, reject) => {
+      const s = tls.connect({ port: server.address().port, host: '127.0.0.1', servername: host, ca: fs.readFileSync(path.join(dir, 'ca.pem')) }, () => {
+        s.once('data', d => { resolve(String(d)); s.end(); });
+      });
+      s.on('error', reject);
+    });
+    assert.equal(got, 'ok', host);
+  }
+});
+
+test('openssl verifies the leaf, and the name constraints refuse a leaf for another host', { skip: !HAS_OPENSSL && 'openssl' }, (t) => {
+  const dir = tmp(t);
+  buildCerts(dir, INTERCEPT_HOSTS);
+  const out = execFileSync('openssl', ['verify', '-CAfile', path.join(dir, 'ca.pem'), path.join(dir, 'leaf.pem')], { encoding: 'utf8' });
+  assert.match(out, /OK/);
+  // A leaked ca.key signs for any name; a client that obeys the constraints must refuse it.
+  const evil = path.join(dir, 'evil.pem');
+  fs.writeFileSync(evil, signLeaf(dir, ['evil.example']).cert);
+  assert.throws(() => execFileSync('openssl', ['verify', '-CAfile', path.join(dir, 'ca.pem'), evil], { stdio: 'pipe' }), /permitted subtree violation/);
+});
+
+test('ensureBlindfoldCerts builds a missing set, rebuilds a missing leaf on the same CA, and leaves a good set alone', (t) => {
+  const dir = tmp(t);
+  assert.match(blindfoldPreflight(desiredFor(dir)), /ca\.pem is missing/);
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  const ca = fs.readFileSync(path.join(dir, 'ca.pem'), 'utf8');
+  const leaf = fs.readFileSync(path.join(dir, 'leaf.pem'), 'utf8');
+
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  assert.equal(fs.readFileSync(path.join(dir, 'leaf.pem'), 'utf8'), leaf, 'a good set is not rebuilt');
+
+  fs.rmSync(path.join(dir, 'leaf.pem'));
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  assert.equal(fs.readFileSync(path.join(dir, 'ca.pem'), 'utf8'), ca, 'the CA Codex already trusts is kept');
+  assert.notEqual(fs.readFileSync(path.join(dir, 'leaf.pem'), 'utf8'), leaf);
+
+  // A leaf from an older version covers one host only.
+  fs.writeFileSync(path.join(dir, 'leaf.pem'), signLeaf(dir, ['api.openai.com']).cert);
+  assert.match(blindfoldPreflight(desiredFor(dir)), /does not cover/);
+  assert.equal(ensureBlindfoldCerts(desiredFor(dir)), null);
+  assert.equal(fs.readFileSync(path.join(dir, 'ca.pem'), 'utf8'), ca);
+});