llm-switcher 1.2.2 → 1.2.4

package/tests/codex-daemon.test.mjs

@@ -0,0 +1,92 @@
+// The interactive Codex TUI talks to a shared app-server daemon that keeps the environment it started
+// with. A change of the Codex route must restart it, or the TUI keeps calling the old destination.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// Temporary HOME and state dir before the import, so nothing here can reach the real Codex daemon.
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-codex-daemon-'));
+process.env.HOME = path.join(root, 'home');
+process.env.LLM_SWITCHER_STATE_DIR = path.join(root, 'state');
+delete process.env.CODEX_HOME;
+fs.mkdirSync(process.env.LLM_SWITCHER_STATE_DIR, { recursive: true });
+const { restartCodexDaemon, applyLaunchState, clearLaunchState, emptyToolEnvFiles, STATE_DIR } = await import('../state.mjs');
+test.after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+// A machine where the codex shim routes through `stateDir` and a daemon is running.
+function machine(stateDir) {
+  const home = fs.mkdtempSync(path.join(root, 'm-'));
+  const codexHome = path.join(home, '.codex');
+  const bin = path.join(codexHome, 'packages', 'app-server-daemon', 'current', 'bin', 'codex');
+  fs.mkdirSync(path.dirname(bin), { recursive: true });
+  fs.writeFileSync(bin, '');
+  fs.mkdirSync(path.join(codexHome, 'app-server-control'), { recursive: true });
+  fs.writeFileSync(path.join(codexHome, 'app-server-control', 'app-server-control.sock'), '');
+  fs.mkdirSync(path.join(home, '.llm-switcher', 'bin'), { recursive: true });
+  fs.writeFileSync(path.join(home, '.llm-switcher', 'bin', 'codex'), `#!/usr/bin/env bash\nSWITCHER_DIR="${stateDir}"\n`);
+  const calls = [];
+  const spawnFn = (cmd, args, opts) => { calls.push({ cmd, args, env: opts.env }); return { unref() {}, on() {} }; };
+  return { home, codexHome, bin, calls, spawnFn };
+}
+
+const ROUTE = [['HTTPS_PROXY', 'http://127.0.0.1:3457'], ['https_proxy', 'http://127.0.0.1:3457'],
+  ['NO_PROXY', '127.0.0.1,localhost'], ['no_proxy', '127.0.0.1,localhost'], ['CODEX_CA_CERTIFICATE', '/ca.pem']];
+
+test('a route change restarts the running daemon with the new Codex variables', () => {
+  const m = machine('/switcher/state');
+  const r = restartCodexDaemon(ROUTE, { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv: { PATH: '/bin' } });
+  assert.equal(r.restarted, true);
+  assert.equal(m.calls.length, 1);
+  assert.equal(m.calls[0].cmd, m.bin);
+  assert.deepEqual(m.calls[0].args, ['app-server', 'daemon', 'restart']);
+  assert.equal(m.calls[0].env.HTTPS_PROXY, 'http://127.0.0.1:3457');
+  assert.equal(m.calls[0].env.CODEX_CA_CERTIFICATE, '/ca.pem');
+  assert.equal(m.calls[0].env.PATH, '/bin');
+});
+
+test('switching Codex off restarts the daemon without the switcher variables, and keeps the user\'s own proxy', () => {
+  const m = machine('/switcher/state');
+  const baseEnv = { HTTPS_PROXY: 'http://127.0.0.1:3457', https_proxy: 'http://proxy.corp:8080', CODEX_CA_CERTIFICATE: '/ca.pem', NO_PROXY: '127.0.0.1,localhost' };
+  restartCodexDaemon([], { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv, ca: '/ca.pem' });
+  const env = m.calls[0].env;
+  assert.equal(env.HTTPS_PROXY, undefined, 'the loopback interceptor is removed');
+  assert.equal(env.CODEX_CA_CERTIFICATE, undefined, 'the switcher CA is removed');
+  assert.equal(env.https_proxy, 'http://proxy.corp:8080', 'a proxy the user set is kept');
+});
+
+test('no restart when the codex shim routes through another state dir, or no daemon runs', () => {
+  const other = machine('/another/install');
+  assert.equal(restartCodexDaemon(ROUTE, { home: other.home, codexHome: other.codexHome, stateDir: '/switcher/state', spawnFn: other.spawnFn }).restarted, false);
+  assert.equal(other.calls.length, 0);
+
+  const idle = machine('/switcher/state');
+  fs.rmSync(path.join(idle.codexHome, 'app-server-control', 'app-server-control.sock'));
+  assert.equal(restartCodexDaemon(ROUTE, { home: idle.home, codexHome: idle.codexHome, stateDir: '/switcher/state', spawnFn: idle.spawnFn }).restarted, false);
+  assert.equal(idle.calls.length, 0, 'a daemon that does not run is not started');
+});
+
+test('applyLaunchState reports a Codex route change only when env-codex changes', () => {
+  assert.ok(STATE_DIR.startsWith(root), 'the test writes only its own launch files');
+  const cfg = {
+    port: 3456, blindfold: { port: 3457 }, activeProfiles: { claude: null, codex: 'cx' },
+    profiles: { cx: { name: 'Cx', mode: 'convert', tool: 'codex', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { main: 'm' } } }
+  };
+  assert.equal(applyLaunchState(cfg, 3456).codexRouteChanged, true, 'first activation');
+  assert.equal(applyLaunchState(cfg, 3456).codexRouteChanged, false, 'same route again');
+  assert.equal(applyLaunchState({ ...cfg, activeProfiles: { claude: null, codex: null } }, 3456).codexRouteChanged, true, 'switched off');
+});
+
+test('switch off, for all tools or for Codex alone, also reports the Codex route change', () => {
+  const cfg = {
+    port: 3456, blindfold: { port: 3457 }, activeProfiles: { claude: null, codex: 'cx' },
+    profiles: { cx: { name: 'Cx', mode: 'convert', tool: 'codex', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { main: 'm' } } }
+  };
+  applyLaunchState(cfg, 3456);
+  assert.equal(clearLaunchState(3456).codexRouteChanged, true);
+  assert.equal(clearLaunchState(3456).codexRouteChanged, false, 'already off');
+  applyLaunchState(cfg, 3456);
+  assert.equal(emptyToolEnvFiles('codex').codexRouteChanged, true);
+  assert.equal(emptyToolEnvFiles('claude').codexRouteChanged, false);
+});

package/tests/gateway.e2e.test.mjs

@@ -265,6 +265,12 @@ after(() => {
   fakeInterceptor?.kill();
   proxy?.kill();
   upstream?.close();
+  // A test that changes the tool set makes the gateway start a real interceptor. It is detached on
+  // purpose, so it outlives the gateway; stop the one the gateway recorded before its state goes.
+  try {
+    const { pid } = JSON.parse(fs.readFileSync(path.join(tmpDir, 'blindfold.json'), 'utf8'));
+    if (Number.isInteger(pid) && pid !== fakeInterceptor?.pid) process.kill(pid);
+  } catch {}
   if (tmpDir) fs.rmSync(tmpDir, { recursive: true, force: true });
 });
 
@@ -659,6 +665,36 @@ test('Security: the admin API refuses a caller without the token and changes not
   }
 });
 
+// The model list carries each model's token limits, as intact and OpenRouter give them, so the
+// 1M context box can be locked for a model known to be smaller.
+test('Browse Models returns the token limits the gateway lists', async () => {
+  const sink = http.createServer((req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ data: [
+      { id: 'big', context_length: 1048576, max_output_tokens: 65536 },
+      { id: 'small', context_length: 200000 },
+      { id: 'or', top_provider: { context_length: 262144, max_completion_tokens: 32768 } },
+      { id: 'in', max_input_tokens: 1000000 },
+      { id: 'bare' }
+    ] }));
+  });
+  await new Promise(r => sink.listen(0, '127.0.0.1', r));
+  try {
+    const r = await post('/api/fetch-models', { baseURL: `http://127.0.0.1:${sink.address().port}` });
+    const data = await r.json();
+    assert.equal(data.ok, true);
+    assert.deepEqual(data.models, ['bare', 'big', 'in', 'or', 'small']);
+    assert.deepEqual(data.limits, {
+      big: { context: 1048576, output: 65536 },
+      small: { context: 200000 },
+      or: { context: 262144, output: 32768 },
+      in: { input: 1000000 }
+    });
+  } finally {
+    sink.close();
+  }
+});
+
 test('Admin API: keys are redacted and invalid switch input is rejected', async () => {
   const status = await (await fetch(url('/api/status'), { headers: withToken('/api/status', {}) })).json();
   assert.ok(!JSON.stringify(status).includes('sk-secret'));

package/tests/lifecycle.test.mjs

@@ -54,16 +54,16 @@ function envFor(ws) {
   return { ...process.env, HOME: path.join(ws.dir, 'home'), USERPROFILE: path.join(ws.dir, 'home'), LLM_SWITCHER_CONFIG: ws.cfgPath, LLM_SWITCHER_STATE_DIR: ws.dir, LLM_SWITCHER_BLINDFOLD_CERTS: ws.certDir, CLAUDE_CONFIG_DIR: ws.claudeDir, LLM_SWITCHER_PORT: '', PORT: '' };
 }
 
-function writeConfig(ws, gwPort, bfPort, activeResponses = null) {
+// The 1.2 schema: one pointer per tool and one interceptor port for the whole config. A file in the
+// older schema is migrated on load, which rewrites it and breaks every "changes nothing" assertion.
+function writeConfig(ws, gwPort, bfPort, activeCodex = null) {
   fs.writeFileSync(ws.cfgPath, JSON.stringify({
     port: gwPort,
-    activeProfiles: { anthropic: null, responses: activeResponses, 'openai-chat': null, vertex: null },
+    blindfold: { port: bfPort },
+    activeProfiles: { claude: null, codex: activeCodex },
     profiles: {
-      plain: { name: 'Plain', mode: 'convert', inFormat: 'auto', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { opus: 'o' } },
-      bf: {
-        name: 'Blindfold', mode: 'convert', inFormat: 'responses', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k',
-        defaultModels: { main: 'm' }, blindfold: true, blindfoldPort: bfPort
-      }
+      plain: { name: 'Plain', mode: 'convert', tool: 'claude', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { opus: 'o' } },
+      bf: { name: 'Blindfold', mode: 'convert', tool: 'codex', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { main: 'm' } }
     }
   }, null, 2), { mode: 0o600 });
 }
@@ -121,7 +121,7 @@ test('the gateway proves its identity to a fresh challenge; a replayed /health i
     const body = await (await fetch(`http://127.0.0.1:${gwPort}/health?challenge=abc`)).json();
     // The proof binds the role, the port it answers on and its pid, so it cannot be relayed or edited.
     assert.equal(body.port, gwPort);
-    assert.equal(body.proof, crypto.createHmac('sha256', token(ws)).update(['gateway', gwPort, body.pid, '', '', '', 'abc'].join('|')).digest('hex'));
+    assert.equal(body.proof, crypto.createHmac('sha256', token(ws)).update(['gateway', gwPort, body.pid, '', '', 'abc'].join('|')).digest('hex'));
     assert.equal(await probe(ws, `s.probeGateway(${gwPort})`), 'ours');
     assert.equal(await probe(ws, `s.probeGateway(${replayPort})`), 'foreign');
     assert.equal(await probe(ws, `s.probeGateway(${await freePort()})`), 'free');
@@ -167,40 +167,53 @@ test('switch on refuses a foreign gateway port and changes nothing', { skip: !PO
   }
 });
 
-test('switch codex <blindfold profile> refuses missing certificates, a missing leaf.key and a foreign interceptor port, changing nothing', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
+// A missing or outdated certificate set is built before anything else is checked, so turning a
+// Codex profile on never stops at the certificates. A squatter on the interceptor port keeps the
+// switch refused here, which shows the build ran first and that nothing else changed.
+test('switch codex <blindfold profile> builds missing certificates and a missing leaf.key, and refuses a foreign interceptor port, changing nothing else', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
   const cases = [];
+  const squatter = net.createServer(s => s.end('HTTP/1.1 200 OK\r\n\r\nnot the switcher'));
+  const bfPort = await new Promise(r => squatter.listen(0, '127.0.0.1', () => r(squatter.address().port)));
   try {
     // 1. no certificates at all
     const a = makeWorkspace(); cases.push(a);
-    writeConfig(a, await freePort(), await freePort());
     // 2. leaf.key missing
     const b = makeWorkspace({ certs: true }); cases.push(b);
     fs.rmSync(path.join(b.certDir, 'leaf.key'));
-    writeConfig(b, await freePort(), await freePort());
-    // 3. valid certificates, but another process holds the interceptor port
+    const caBefore = fs.readFileSync(path.join(b.certDir, 'ca.pem'), 'utf8');
+    // 3. valid certificates
     const c = makeWorkspace({ certs: true }); cases.push(c);
-    const squatter = net.createServer(s => s.end('HTTP/1.1 200 OK\r\n\r\nnot the switcher'));
-    const bfPort = await new Promise(r => squatter.listen(0, '127.0.0.1', () => r(squatter.address().port)));
-    writeConfig(c, await freePort(), bfPort);
-    try {
-      for (const [ws, why] of [[a, /missing/], [b, /leaf\.key is missing/], [c, /held by another process/]]) {
-        const before = fs.readFileSync(ws.cfgPath);
-        const launch = snapshotLaunchFiles(ws.dir);
-        const r = await runSwitch(ws, ['codex', 'bf']);
-        assert.notEqual(r.status, 0, r.stdout);
-        assert.match(r.stderr, why);
-        assert.deepEqual(fs.readFileSync(ws.cfgPath), before, 'config.json is byte-identical');
-        assert.ok(!fs.existsSync(path.join(ws.dir, 'blindfold.json')));
-        assert.deepEqual(snapshotLaunchFiles(ws.dir), launch, 'no launcher file changed');
-      }
-    } finally {
-      squatter.close();
+    for (const ws of cases) writeConfig(ws, await freePort(), bfPort);
+    for (const ws of cases) {
+      const before = fs.readFileSync(ws.cfgPath);
+      const launch = snapshotLaunchFiles(ws.dir);
+      const r = await runSwitch(ws, ['codex', 'bf']);
+      assert.notEqual(r.status, 0, r.stdout);
+      assert.match(r.stderr, /held by another process/);
+      assert.doesNotMatch(r.stderr, /missing/);
+      assert.equal(await probe(ws, `s.blindfoldPreflight({ ca: ${JSON.stringify(path.join(ws.certDir, 'ca.pem'))} })`), null, 'the certificates are usable now');
+      assert.deepEqual(fs.readFileSync(ws.cfgPath), before, 'config.json is byte-identical');
+      assert.ok(!fs.existsSync(path.join(ws.dir, 'blindfold.json')));
+      assert.deepEqual(snapshotLaunchFiles(ws.dir), launch, 'no launcher file changed');
     }
+    assert.equal(fs.readFileSync(path.join(b.certDir, 'ca.pem'), 'utf8'), caBefore, 'a working CA is kept: Codex already trusts it');
   } finally {
+    squatter.close();
     for (const ws of cases) fs.rmSync(ws.dir, { recursive: true, force: true });
   }
 });
 
+test('the gateway check builds a missing certificate set instead of refusing the change', { skip: !POSIX && 'posix' }, async () => {
+  const ws = makeWorkspace();
+  try {
+    writeConfig(ws, await freePort(), await freePort(), 'bf');
+    assert.equal(await probe(ws, `s.checkBlindfoldTarget(s.loadConfig(), s.loadConfig().port)`), null);
+    for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(ws.certDir, f)), f);
+  } finally {
+    fs.rmSync(ws.dir, { recursive: true, force: true });
+  }
+});
+
 test('the gateway owns the interceptor: dashboard changes, a lost interceptor and a gateway restart are reconciled', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
   const ws = makeWorkspace({ certs: true });
   const gwPort = await freePort();
@@ -210,18 +223,21 @@ test('the gateway owns the interceptor: dashboard changes, a lost interceptor an
   let gw = await startGateway(ws, gwPort);
   const bfState = () => probe(ws, `s.probeBlindfold(${bfPort})`);
   try {
-    // 1. the dashboard turns blindfold on for the Codex target
-    const on = await api(ws, gwPort, '/api/switch', { target: 'responses', profile: 'bf' });
+    // 1. the dashboard turns Codex on
+    const on = await api(ws, gwPort, '/api/switch', { target: 'codex', profile: 'bf' });
     assert.equal(on.success, true, JSON.stringify(on));
     let st = await waitFor(async () => { const s = await bfState(); return s.state === 'ours' && s; });
     assert.equal(st.gatewayPort, gwPort);
-    assert.equal(st.prefix, '/backend-api/codex');
+    assert.equal(st.activeTools, 'codex');
 
-    // 2. the dashboard changes the prefix: the interceptor is respawned with it
-    const saved = await api(ws, gwPort, '/api/save-profile', { key: 'bf', profile: { blindfoldPrefix: '/backend-api/codex2' } });
-    assert.notEqual(saved.success, false, JSON.stringify(saved));
-    st = await waitFor(async () => { const s = await bfState(); return s.prefix === '/backend-api/codex2' && s; });
-    assert.equal(st.prefix, '/backend-api/codex2');
+    // 2. the dashboard turns Claude on as well: the running interceptor takes the new tool set in place
+    const both = await api(ws, gwPort, '/api/switch', { target: 'claude', profile: 'plain' });
+    assert.notEqual(both.success, false, JSON.stringify(both));
+    st = await waitFor(async () => { const s = await bfState(); return s.activeTools === 'claude,codex' && s; });
+    assert.equal(st.activeTools, 'claude,codex');
+    await api(ws, gwPort, '/api/switch', { target: 'claude', profile: null });
+    st = await waitFor(async () => { const s = await bfState(); return s.activeTools === 'codex' && s; });
+    assert.equal(st.activeTools, 'codex');
 
     // 3. the interceptor dies; a sync brings it back
     process.kill(st.pid, 'SIGTERM');
@@ -238,31 +254,30 @@ test('the gateway owns the interceptor: dashboard changes, a lost interceptor an
     st = await waitFor(async () => { const s = await bfState(); return s.state === 'ours' && s; });
     assert.equal(st.gatewayPort, gwPort, 'the gateway starts the interceptor at boot');
 
-    // 5. a foreign process on the new interceptor port: the caller sees the failure
+    // 5. config.json names an interceptor port that a foreign process holds: a dashboard change fails
     const squatter = net.createServer(s => s.end());
     const squatPort = await new Promise(r => squatter.listen(0, '127.0.0.1', () => r(squatter.address().port)));
+    const good = fs.readFileSync(ws.cfgPath);
     try {
+      fs.writeFileSync(ws.cfgPath, JSON.stringify({ ...JSON.parse(good), blindfold: { port: squatPort } }, null, 2), { mode: 0o600 });
+      const edited = fs.readFileSync(ws.cfgPath);
       const badRes = await fetch(`http://127.0.0.1:${gwPort}/api/save-profile`, {
         method: 'POST', headers: { 'Content-Type': 'application/json', 'x-llm-switcher-token': token(ws) },
-        body: JSON.stringify({ key: 'bf', profile: { blindfoldPort: squatPort } })
+        body: JSON.stringify({ key: 'bf', profile: { name: 'Renamed' } })
       });
       assert.equal(badRes.status, 502, 'a failure is not answered with 200');
       const bad = await badRes.json();
       assert.equal(bad.success, false);
       assert.match(bad.error, /held by another process/);
-      const onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8')).profiles.bf.blindfoldPort;
-      assert.equal(onDisk, bfPort, 'a refused change is not saved, so HTTPS_PROXY never points at the squatter');
+      assert.deepEqual(fs.readFileSync(ws.cfgPath), edited, 'a refused change is not saved');
       assert.equal((await bfState()).state, 'ours', 'the working interceptor stays up');
-      const status = await fetch(`http://127.0.0.1:${gwPort}/api/status`, { headers: { 'x-llm-switcher-token': token(ws) } }).then(r => r.json());
-      assert.equal(status.config.profiles.bf.blindfoldPort, bfPort, 'the gateway does not keep the refused change in memory');
     } finally {
       squatter.close();
+      fs.writeFileSync(ws.cfgPath, good, { mode: 0o600 });
     }
 
     // 6. turning the Codex target off stops the interceptor
-    await api(ws, gwPort, '/api/save-profile', { key: 'bf', profile: { blindfoldPort: bfPort } });
-    await waitFor(async () => (await bfState()).state === 'ours');
-    await api(ws, gwPort, '/api/switch', { target: 'responses', profile: null });
+    await api(ws, gwPort, '/api/switch', { target: 'codex', profile: null });
     assert.equal(await waitFor(async () => (await bfState()).state === 'free'), true);
   } finally {
     try { const s = await bfState(); if (s.state === 'ours') process.kill(s.pid, 'SIGTERM'); } catch {}
@@ -276,32 +291,50 @@ test('the gateway owns the interceptor: dashboard changes, a lost interceptor an
 test('concurrent admin changes: a refused change never reaches disk, and no accepted change is lost', { skip: !HAS_OPENSSL && 'posix + openssl' }, async () => {
   const ws = makeWorkspace({ certs: true });
   const gwPort = await freePort();
-  const bfPort = await freePort();
-  writeConfig(ws, gwPort, bfPort, 'bf');
-  const launch = snapshotLaunchFiles(ws.dir);
-  const gw = await startGateway(ws, gwPort);
+  let bfPort;
   // A squatter that accepts and never answers keeps the identity probe waiting.
   const silent = net.createServer(() => {});
   const silentPort = await new Promise(r => silent.listen(0, '127.0.0.1', () => r(silent.address().port)));
+  writeConfig(ws, gwPort, silentPort);
+  const launch = snapshotLaunchFiles(ws.dir);
+  const gw = await startGateway(ws, gwPort);
   try {
-    await waitFor(async () => (await probe(ws, `s.probeBlindfold(${bfPort})`)).state === 'ours');
-    const post = (body) => fetch(`http://127.0.0.1:${gwPort}/api/save-profile`, {
+    const post = (p, body) => fetch(`http://127.0.0.1:${gwPort}${p}`, {
       method: 'POST', headers: { 'Content-Type': 'application/json', 'x-llm-switcher-token': token(ws) }, body: JSON.stringify(body)
     });
-    const refused = post({ key: 'bf', profile: { blindfoldPort: silentPort } });
+    // Turning Codex on waits for the silent port and is refused; the rename that arrives meanwhile is kept.
+    const refused = post('/api/switch', { target: 'codex', profile: 'bf' });
     await new Promise(r => setTimeout(r, 300));
-    const other = post({ key: 'plain', profile: { name: 'Renamed' } });
+    const other = post('/api/save-profile', { key: 'plain', profile: { name: 'Renamed' } });
     const [a, b] = await Promise.all([refused, other]);
     assert.equal(a.status, 502);
     assert.equal(b.status, 200);
-    const onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8'));
-    assert.equal(onDisk.profiles.bf.blindfoldPort, bfPort, 'the refused port is not saved by the other request');
+    let onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8'));
+    assert.equal(onDisk.activeProfiles.codex, null, 'the refused switch is not saved by the other request');
     assert.equal(onDisk.profiles.plain.name, 'Renamed');
 
+    // A usable interceptor port, and Codex on, for the second half. Other test files run at the
+    // same time and can bind a port between freePort() and the gateway's check; the gateway then
+    // rightly refuses it, so a refusal for a taken port picks another one.
+    let on;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      bfPort = await freePort();
+      onDisk.blindfold = { port: bfPort };
+      fs.writeFileSync(ws.cfgPath, JSON.stringify(onDisk, null, 2), { mode: 0o600 });
+      on = await post('/api/switch', { target: 'codex', profile: 'bf' });
+      if (on.status === 200) break;
+      const why = await on.clone().text();
+      if (!/held by another process|does not answer/.test(why)) break;
+      onDisk = JSON.parse(fs.readFileSync(ws.cfgPath, 'utf8'));
+    }
+    assert.equal(on.status, 200, await on.text());
+    await waitFor(async () => (await probe(ws, `s.probeBlindfold(${bfPort})`)).state === 'ours');
+    const postProfile = (body) => post('/api/save-profile', body);
+
     // Two accepted changes to the active profile: the one that saves last keeps the other.
     const [c, d] = await Promise.all([
-      post({ key: 'bf', profile: { name: 'First' } }),
-      post({ key: 'bf', profile: { defaultModels: { main: 'm2' } } })
+      postProfile({ key: 'bf', profile: { name: 'First' } }),
+      postProfile({ key: 'bf', profile: { defaultModels: { main: 'm2' } } })
     ]);
     assert.equal(c.status, 200);
     assert.equal(d.status, 200);

package/tests/make-certs.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HAS_OPENSSL = process.platform !== 'win32' && fs.existsSync('/usr/bin/openssl');
+
+// LibreSSL names the -CAcreateserial file after the CA path cut at its first dot, so a
+// directory such as /Users/first.last sent the serial file to /Users/first.srl.
+test('make-certs.sh builds the certificates under a path that contains a dot', { skip: !HAS_OPENSSL && 'posix + openssl' }, (t) => {
+  // The first dot of the whole path is in `first.last`, so a stray serial file lands in `dir` as first.srl.
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmswcerts'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const out = path.join(dir, 'first.last', 'certs');
+  execFileSync('bash', [path.join(ROOT, 'blindfold', 'make-certs.sh'), out], { stdio: 'pipe' });
+  for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(out, f)), `${f} is missing`);
+  assert.deepEqual(fs.readdirSync(dir), ['first.last'], 'no serial file outside the output directory');
+});

package/tests/real-user-sim.test.mjs

@@ -130,6 +130,8 @@ before(async () => {
   proxyPort = await freePort();
   blindfoldPort = await freePort();
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-sim-'));
+  // Blindfold mode needs a CA. Without its own directory the gateway reads the certificates of the checkout.
+  execFileSync('bash', [path.join(ROOT, 'blindfold', 'make-certs.sh'), path.join(tmpDir, 'certs')], { stdio: 'ignore' });
 
   const base = `http://127.0.0.1:${upstreamPort}`;
   const models = { opus: 'up-opus', sonnet: 'up-sonnet', haiku: 'up-haiku', fable: 'up-fable' };
@@ -150,6 +152,7 @@ before(async () => {
       ...process.env,
       LLM_SWITCHER_CONFIG: path.join(tmpDir, 'config.json'),
       LLM_SWITCHER_STATE_DIR: tmpDir,
+      LLM_SWITCHER_BLINDFOLD_CERTS: path.join(tmpDir, 'certs'),
       CLAUDE_CONFIG_DIR: path.join(tmpDir, 'claude'),
       LLM_SWITCHER_PORT: ''
     },

package/tests/shim.test.mjs

@@ -31,7 +31,11 @@ if (process.platform !== 'win32') {
     fs.chmodSync(path.join(RENDER_DIR, name), 0o755);
   }
 }
+// Only node, never the directory it lives in: an npm install puts the real claude and codex next to it.
+const NODE_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'shimnode-'));
+if (process.platform !== 'win32') fs.symlinkSync(process.execPath, path.join(NODE_DIR, 'node'));
 test.after(() => {
+  fs.rmSync(NODE_DIR, { recursive: true, force: true });
   fs.rmSync(RENDER_DIR, { recursive: true, force: true });
   fs.rmSync(STATE, { recursive: true, force: true });
 });
@@ -47,7 +51,7 @@ function runShim(name, args, { active, fakeDir, extraPath = '', env = {}, files
     fs.writeFileSync(path.join(STATE, `env-${name}.sh`), "export HTTPS_PROXY='http://127.0.0.1:3457'\n");
   }
   for (const [f, content] of Object.entries(files)) fs.writeFileSync(path.join(STATE, f), content);
-  const PATH_ = [RENDER_DIR, fakeDir, extraPath || '/usr/bin:/bin', path.dirname(process.execPath)]
+  const PATH_ = [RENDER_DIR, fakeDir, extraPath || '/usr/bin:/bin', NODE_DIR]
     .filter(Boolean).join(path.delimiter);
   return execFileSync(path.join(RENDER_DIR, name), args, {
     encoding: 'utf8', env: { ...process.env, ...env, PATH: PATH_ }, timeout: 15000
@@ -156,8 +160,8 @@ test('A2: codex shim passes no config override', () => {
 test('codex shim wires only the interceptor proxy and passes its arguments through', (t) => {
   if (process.platform === 'win32') return t.skip('posix only');
   const out = runShim('codex', ['exec', 'hi'], {
-    fakeDir: makeArgvBin('codex'),
-    files: { 'active.flag': 'active' }
+    active: true,
+    fakeDir: makeArgvBin('codex')
   }).split('\n');
   assert.equal(out[0], 'HTTPS_PROXY=http://127.0.0.1:3457', 'the interceptor is the only wiring');
   assert.deepEqual(out.slice(1), ['exec', 'hi'], 'arguments must be preserved');
@@ -171,6 +175,7 @@ test('Claude shim never loads the Codex-only file or passes Codex overrides', (t
   // env-codex.sh carries a deliberately different port: if the claude shim ever sourced it,
   // that value would show up instead of the claude one.
   const out = runShim('claude', ['--resume'], {
+    active: true,
     fakeDir: makeArgvBin('claude'),
     files: { 'env-codex.sh': "export HTTPS_PROXY='http://127.0.0.1:9999'\n" }
   }).split('\n');

package/tests/state.test.mjs

@@ -653,13 +653,18 @@ test('isSafeModelName refuses TOML date-times with T and Z', () => {
 test('an empty launch lock is held, not taken over', async (t) => {
   const { dir, env } = tmpDirs(t);
   const lock = path.join(dir, '.launch.lock');
+  const started = path.join(dir, 'writer.started');
   fs.writeFileSync(lock, '');
-  setTimeout(() => fs.rmSync(lock, { force: true }), 400);
-  const waited = await new Promise((resolve, reject) => {
+  const done = new Promise((resolve, reject) => {
     execFileCb(process.execPath, ['--input-type=module', '-e',
-      `const s = await import(${JSON.stringify(pathToFileURL(path.join(ROOT_DIR, 'state.mjs')).href)}); const t0 = Date.now(); s.applyLaunchState(s.loadConfig(), 4000); console.log(Date.now() - t0);`],
+      `const s = await import(${JSON.stringify(pathToFileURL(path.join(ROOT_DIR, 'state.mjs')).href)}); (await import('node:fs')).writeFileSync(${JSON.stringify(started)}, ''); const t0 = Date.now(); s.applyLaunchState(s.loadConfig(), 4000); console.log(Date.now() - t0);`],
     { env: { ...process.env, LLM_SWITCHER_PORT: '', ...env }, encoding: 'utf8' }, (err, out) => (err ? reject(err) : resolve(Number(out.trim()))));
   });
+  // The 400 ms count from the writer's start: a slow start under a loaded suite must not find the
+  // lock already gone.
+  for (let i = 0; i < 1000 && !fs.existsSync(started); i++) await new Promise(r => setTimeout(r, 10));
+  setTimeout(() => fs.rmSync(lock, { force: true }), 400);
+  const waited = await done;
   // Taken over at once, the write would take a few ms.
   assert.ok(waited >= 100 && waited < 4000, `the writer waited ${waited} ms`);
   assert.equal(fs.existsSync(lock), false);