llm-switcher 1.3.1 → 1.3.2

package/.github/workflows/test.yml

@@ -0,0 +1,31 @@
+# The shims and the blindfold certificates have one code path per platform, and a test for a
+# platform skips itself everywhere else. Only a run on each platform proves all of them.
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    name: Node ${{ matrix.node }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    # A local run takes about 2 minutes. A hang must fail the job, not hold it for 6 hours.
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [22]
+        include:
+          # The lowest version that package.json accepts.
+          - os: ubuntu-latest
+            node: 18
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+      - run: npm test

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog — LLM Switcher
 
+## Release 1.3.2
+
+- **Codex over WebSocket crosses Bifrost:** Codex uses its WebSocket transport by default. The gateway now sends each WebSocket turn to intact `/v1/responses` as one HTTP request with the whole conversation, and sends each event back as one frame. Before, these turns took the convert route. A stream that stops before `response.completed` ends the turn with `response.failed`.
+- **All Codex clients cross Bifrost:** `codex exec` sends `codex_exec/` in its `User-Agent`, not `codex_cli_rs/`. The gateway takes `codex_cli_rs`, `codex_exec`, `codex_vscode` and `codex_sdk_ts` as one client. Before, `codex exec` never crossed Bifrost.
+- **`make-certs.sh` and a Windows path:** The script read a lone argument such as `C:\Users\me\certs` as a host name and ignored it, so it rebuilt the certificates of the checkout instead. A running interceptor then served a leaf from the old CA, and Codex failed with `workspace routing discovery failed`. A backslash now marks a path.
+- **Tests:** `npm test` no longer rebuilds the certificates of the checkout. The suite runs on Linux, macOS and Windows in CI, and on Node 18.
+
 ## Release 1.3.1
 
 - **agy note:** `switch plugin status` now names agy 1.2.14. This release of agy also loads `~/.gemini/antigravity-cli/hooks.json` but does not run its hooks (measured 2026-10-03), so the shim toast is still the notice for agy.

package/README.md

@@ -337,6 +337,10 @@ gateway for its identity proof before it gives agy the variable. If the port doe
 the proof of this install within 3 seconds, the shim removes the variable, prints one line, and agy
 uses its official endpoint.
 
+The shim does this check only when agy starts. If the gateway stops while agy runs (`switch off`, a
+crash, an update), the port is free. Another account on this computer can then take the port and
+receive the token. To close this gap, close agy before you stop the gateway.
+
 ### Blindfold mode (optional)
 
 A base URL override makes Codex print one line on its own `/model` screen:
@@ -480,11 +484,17 @@ Bifrost has no setting. The gateway turns it on for each request when two condit
 | Tool | `bifrost_ua` | Path on intact |
 | --- | --- | --- |
 | Claude Code | `claude-cli/` | `/v1/messages` |
-| Codex (HTTP) | `codex_cli_rs/` | `/v1/responses` |
+| Codex (HTTP and WebSocket) | `codex_cli_rs/` | `/v1/responses` |
 | Antigravity CLI | `antigravity/cli/` | `/v1/v1internal:streamGenerateContent`, `/v1/v1internal:generateContent` |
 
-For agy, intact also writes the project of the chosen account into the request. Codex over its
-WebSocket transport still uses the normal route.
+For agy, intact also writes the project of the chosen account into the request.
+
+Codex names its client in the `User-Agent`: `codex_cli_rs` for the terminal UI, `codex_exec` for
+`codex exec`, `codex_vscode` and `codex_sdk_ts`. The gateway takes all four as the Codex client.
+
+Codex over its WebSocket transport crosses Bifrost too. intact keeps no WebSocket state, so the
+gateway sends each turn to `/v1/responses` as one HTTP request with the whole conversation. Each
+event of the answer goes back to Codex as one WebSocket frame, unchanged.
 
 The gateway keeps the answer from intact for 10 minutes for each model. Only a 2xx answer is kept that long. If intact does not answer, or answers with an error (a 404 too), the gateway uses the normal route. It asks again after 30 seconds (`LLM_SWITCHER_BIFROST_RETRY_MS`), and it prints one line for each series of failures.
 

package/README.vi.md

@@ -337,6 +337,10 @@ agy gửi token này dạng rõ tới `CLOUD_CODE_URL`. Vì vậy shim `agy` h
 trước khi giao biến này cho agy. Nếu cổng không trả lời đúng bằng chứng của bản cài này trong 3 giây,
 shim gỡ biến, in một dòng thông báo, và agy dùng endpoint chính thức.
 
+Shim chỉ kiểm tra việc này lúc agy khởi động. Nếu gateway dừng trong lúc agy đang chạy (`switch off`,
+crash, cập nhật), cổng bị bỏ trống. Khi đó một tài khoản khác trên máy có thể chiếm cổng và nhận token.
+Để không có khoảng hở này, hãy đóng agy trước khi dừng gateway.
+
 ### Chế độ blindfold (tùy chọn)
 
 Khi có override base URL, Codex in một dòng ngay trên màn `/model` của nó:
@@ -475,11 +479,17 @@ Bifrost không có cấu hình. Gateway tự bật Bifrost cho từng request kh
 | Công cụ | `bifrost_ua` | Path trên intact |
 | --- | --- | --- |
 | Claude Code | `claude-cli/` | `/v1/messages` |
-| Codex (HTTP) | `codex_cli_rs/` | `/v1/responses` |
+| Codex (HTTP và WebSocket) | `codex_cli_rs/` | `/v1/responses` |
 | Antigravity CLI | `antigravity/cli/` | `/v1/v1internal:streamGenerateContent`, `/v1/v1internal:generateContent` |
 
-Với agy, intact ghi thêm project của tài khoản được chọn vào request. Codex qua WebSocket vẫn đi
-đường thường.
+Với agy, intact ghi thêm project của tài khoản được chọn vào request.
+
+Codex ghi tên client của nó trong `User-Agent`: `codex_cli_rs` cho giao diện terminal, `codex_exec`
+cho `codex exec`, `codex_vscode` và `codex_sdk_ts`. Gateway coi cả bốn là client Codex.
+
+Codex qua WebSocket cũng đi Bifrost. intact không giữ trạng thái WebSocket, nên gateway gửi mỗi lượt
+tới `/v1/responses` thành một request HTTP chứa toàn bộ hội thoại. Mỗi event của câu trả lời quay về
+Codex thành một frame WebSocket, giữ nguyên.
 
 Gateway giữ câu trả lời của intact 10 phút cho mỗi model. Chỉ câu trả lời 2xx được giữ lâu như vậy. Nếu intact không trả lời, hoặc trả lỗi (kể cả 404), gateway dùng đường thường. Gateway hỏi lại sau 30 giây (`LLM_SWITCHER_BIFROST_RETRY_MS`) và in một dòng cho mỗi chuỗi lỗi.
 

package/blindfold/make-certs.sh

@@ -35,10 +35,11 @@ elif [ -d "$ROOT/.git" ]; then DEFAULT_OUT="$ROOT/blindfold/certs"
 else DEFAULT_OUT="$HOME/.llm-switcher/blindfold/certs"; fi
 # Older commands read `make-certs.sh <host> <out-dir>`. The host list is fixed now, so the host is
 # ignored; two arguments keep those commands working. A lone path-like argument is the directory.
+# A Windows path (C:\...\certs) has no forward slash, so a backslash also marks a path.
 OUT_ARG=""
 if [ "$#" -ge 2 ]; then OUT_ARG="$2"
 elif [ "$#" -eq 1 ]; then
-  case "$1" in */*|.*) OUT_ARG="$1" ;; *) : ;; esac
+  case "$1" in */*|*\\*|.*) OUT_ARG="$1" ;; *) : ;; esac
 fi
 OUT_DIR="${OUT_ARG:-$DEFAULT_OUT}"
 CA_DAYS=3650

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code and Codex, with OpenAI-compatible, Anthropic and Vertex upstreams",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -548,11 +548,17 @@ async function bifrostUAFor(profile, model) {
   return ua;
 }
 
+// Codex names its originator in the User-Agent: codex_cli_rs (TUI), codex_exec (`codex exec`),
+// codex_vscode, codex_sdk_ts. intact names one of them; each one is the same client.
+const BIFROST_UA_FAMILIES = [['codex_cli_rs/', 'codex_exec/', 'codex_vscode/', 'codex_sdk_ts/']];
+
 async function crossesBifrost(req, profile, model) {
   const clientUA = String(req.headers['user-agent'] || '');
   if (!clientUA) return false;
   const ua = await bifrostUAFor(profile, model);
-  return Boolean(ua) && clientUA.startsWith(ua);
+  if (!ua) return false;
+  const family = BIFROST_UA_FAMILIES.find(f => f.includes(ua)) || [ua];
+  return family.some(prefix => clientUA.startsWith(prefix));
 }
 
 // Every client header except its own credentials, the switcher's control headers and hop-by-hop.
@@ -1848,6 +1854,88 @@ function geminiSafeTools(tools) {
   });
 }
 
+// Bifrost on the WS transport. intact speaks HTTP and keeps no WS state, so the turn goes to
+// /responses as one streamed request with the whole conversation, and each SSE event goes back to
+// Codex as one text frame, unchanged.
+async function wsBifrostTurn({ socket, payload, req, ac, history, input, profile, profileKey, mappedModel }) {
+  const started = Date.now();
+  const log = (extra) => logInspection({
+    clientFormat: 'responses-ws', outFormat: 'bifrost', profile: profileKey, model: mappedModel, stream: true,
+    requestPreview: '(bifrost)', duration: Date.now() - started, tokens: { prompt: 0, completion: 0 }, ...extra
+  });
+  const headers = bifrostHeaders(req, profile);
+  for (const h of Object.keys(headers)) if (h === 'upgrade' || h.startsWith('sec-websocket-')) delete headers[h];
+  headers['content-type'] = 'application/json';
+  headers.accept = 'text/event-stream';
+  // `type` names the WS frame (response.create); it is not a field of a Responses request.
+  const { type: _type, ...body } = payload;
+
+  let upstreamRes;
+  try {
+    upstreamRes = await fetch(bifrostURL(profile, 'responses', req), {
+      method: 'POST', headers, body: JSON.stringify({ ...body, model: mappedModel, stream: true }), signal: ac.signal
+    });
+  } catch (err) {
+    if (ac.signal.aborted) return log({ status: 499, error: 'client disconnected' });
+    sendWsFailed(socket, mappedModel, `Bifrost forward error: ${err.cause?.message || err.message}`, 502);
+    return log({ status: 502, error: err.message });
+  }
+  if (!upstreamRes.ok) {
+    const errText = await upstreamRes.text().catch(() => '');
+    sendWsFailed(socket, mappedModel, extractUpstreamMessage(errText) || `Upstream HTTP ${upstreamRes.status}`, upstreamRes.status);
+    return log({ status: upstreamRes.status, error: errText.slice(0, 300) });
+  }
+
+  let completed = null;
+  // With store:false the backend sends response.completed with an empty output; the items of the
+  // turn come only in response.output_item.done, and the next turn must replay them.
+  const items = [];
+  let ended = false; // a response.completed or response.failed reached Codex
+  let streamError = null;
+  const decoder = new TextDecoder();
+  let pending = '';
+  const reader = upstreamRes.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      pending += decoder.decode(value, { stream: true }).replace(/\r\n/g, '\n');
+      let cut;
+      while ((cut = pending.indexOf('\n\n')) >= 0) {
+        const data = pending.slice(0, cut).split('\n').filter(l => l.startsWith('data:')).map(l => l.slice(5).trimStart()).join('\n');
+        pending = pending.slice(cut + 2);
+        if (!data || data === '[DONE]') continue;
+        let event;
+        try { event = JSON.parse(data); } catch { continue; }
+        if (event.type === 'response.output_item.done' && event.item) items.push(event.item);
+        if (event.type === 'response.completed') completed = event.response;
+        if (event.type === 'response.completed' || event.type === 'response.failed') ended = true;
+        if (!socket.writable) continue;
+        socket.write(encodeWsFrame(data));
+        await drained(socket, ac.signal);
+      }
+    }
+  } catch (err) {
+    if (!ac.signal.aborted) streamError = `stream interrupted: ${err.cause?.message || err.message}`;
+  }
+  if (ac.signal.aborted) return log({ status: 499, error: 'client disconnected mid-stream' });
+  // Codex ends a turn only on a terminal event: a stream cut before one must still end the turn.
+  if (!ended) {
+    streamError ||= 'the Bifrost stream ended before response.completed';
+    sendWsFailed(socket, mappedModel, streamError, 502);
+  }
+  if (completed) {
+    const output = Array.isArray(completed.output) && completed.output.length ? completed.output : items;
+    rememberWsTurn(history, { ...completed, output }, input);
+  }
+  const usage = completed?.usage || {};
+  log({
+    status: streamError ? 502 : 200,
+    tokens: { prompt: usage.input_tokens || 0, completion: usage.output_tokens || 0 },
+    ...(streamError ? { error: streamError } : {})
+  });
+}
+
 // One turn of the Codex WS transport. The socket loop runs turns one at a time and owns `ac`.
 async function handleWsResponseCreate(socket, payload, req, ac, history = null) {
   const clientFormat = 'responses';
@@ -1877,6 +1965,11 @@ async function handleWsResponseCreate(socket, payload, req, ac, history = null)
   const { previous_response_id: _prev, ...rest } = payload;
   payload = { ...rest, input };
 
+  const bifrostModel = mapModel(payload.model || '', profile, clientFormat);
+  if (await crossesBifrost(req, profile, bifrostModel)) {
+    return wsBifrostTurn({ socket, payload, req, ac, history, input, profile, profileKey, mappedModel: bifrostModel });
+  }
+
   let ir;
   try {
     ir = parseToIR('responses', payload);

package/tests/agy.e2e.test.mjs

@@ -9,6 +9,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { openResponsesWs } from './ws-client.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const AGY_UA = 'antigravity/cli/1.2.14 (aidev_client; os_type=windows; arch=amd64; cl=990662481; auth_method=consumer)';
@@ -70,6 +71,16 @@ function startUpstream() {
           { choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] }
         ]);
       }
+      if (req.method === 'GET' && req.url.startsWith('/cbroken/v1/models/')) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        return res.end(JSON.stringify({ bifrost_ua: 'codex_cli_rs/' }));
+      }
+      if (req.url.startsWith('/cbroken/v1/responses')) {
+        // The first event, then the connection dies: no response.completed ever comes.
+        res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+        res.write(`event: response.created\ndata: ${JSON.stringify({ type: 'response.created', response: { id: 'resp_cut', status: 'in_progress' } })}\n\n`);
+        return setTimeout(() => res.socket.destroy(), 50);
+      }
       if (req.method === 'GET' && req.url.startsWith('/broken/v1/models/')) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         return res.end(JSON.stringify({ bifrost_ua: 'antigravity/cli/' }));
@@ -127,8 +138,19 @@ function startUpstream() {
         ]);
       }
       if (req.url.startsWith('/intact/v1/responses')) {
+        // A Responses stream as the Codex account on intact sends it; each turn gets its own id.
+        // With store:false the real backend sends response.completed with an empty output: the
+        // items come only in response.output_item.done (measured 2026-10-03).
+        const id = `resp_${received.length}`;
+        const item = { type: 'message', id: `msg_${id}`, role: 'assistant', content: [{ type: 'output_text', text: 'codex pool' }] };
+        const events = [
+          { type: 'response.created', response: { id, status: 'in_progress' } },
+          { type: 'response.output_text.delta', delta: 'codex pool' },
+          { type: 'response.output_item.done', output_index: 0, item },
+          { type: 'response.completed', response: { id, status: 'completed', output: [], usage: { input_tokens: 5, output_tokens: 1 } } }
+        ];
         res.writeHead(200, { 'Content-Type': 'text/event-stream' });
-        res.write(`event: response.completed\ndata: ${JSON.stringify({ type: 'response.completed', response: { id: 'r1', usage: { input_tokens: 5, output_tokens: 1 } } })}\n\n`);
+        for (const e of events) res.write(`event: ${e.type}\ndata: ${JSON.stringify(e)}\n\n`);
         return res.end();
       }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
@@ -170,6 +192,7 @@ before(async () => {
       agyf: { name: 'agy flaky lookup', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/flaky/v1`, apiKey: 'sk-flaky', defaultModels: { main: 'antigravity/*' } },
       agynf: { name: 'agy lookup 404', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/nf/v1`, apiKey: 'sk-nf', defaultModels: { main: 'antigravity/*' } },
       agyg: { name: 'agy broken stream', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/broken/v1`, apiKey: 'sk-broken', defaultModels: { main: 'antigravity/*' } },
+      cdxcut: { name: 'codex cut stream', mode: 'convert', tool: 'codex', outFormat: 'openai-chat', baseURL: `${base}/cbroken/v1`, apiKey: 'sk-cut', defaultModels: { main: 'codex/gpt-5.5' } },
       cdx: { name: 'codex on intact', mode: 'convert', tool: 'codex', outFormat: 'openai-chat', baseURL: `${base}/intact/v1`, apiKey: 'sk-intact', defaultModels: { main: 'codex/gpt-5.5' } }
     }
   };
@@ -237,6 +260,19 @@ const envelope = (over = {}) => ({
   },
   ...over
 });
+// Whether the gateway ended its answer as a whole one. Read from the HTTP framing, because fetch in
+// Node 18 takes a chunked body that a closed socket cut short as complete.
+function answerIsComplete(target, { method = 'POST', headers = {}, body = '' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(target, { method, headers: { ...headers, 'content-length': Buffer.byteLength(body) } }, (res) => {
+      res.on('error', () => {});
+      res.on('close', () => resolve({ status: res.statusCode, complete: res.complete }));
+      res.resume();
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
 const lastTo = (prefix) => [...received].reverse().find(r => r.url.startsWith(prefix));
 const dataLines = (text) => text.split('\n').filter(l => l.startsWith('data:')).map(l => JSON.parse(l.slice(5)));
 
@@ -383,16 +419,16 @@ test('a Code Assist host that never answers gives a 504 after the idle timeout',
 
 test('an upstream that stops in the middle of a body ends the answer to agy with an error', async () => {
   const started = Date.now();
-  const r = await fetch(url('/v1internal:breakMidway'), { method: 'POST', headers: agyHeaders(), body: '{}' });
-  await assert.rejects(r.text());
+  const r = await answerIsComplete(url('/v1internal:breakMidway'), { headers: agyHeaders(), body: '{}' });
+  assert.equal(r.complete, false);
   assert.ok(Date.now() - started < 10000);
 });
 
 test('an upstream that stalls after its headers is cut by the idle timeout', async () => {
   const port = await startGateway({ LLM_SWITCHER_CODE_ASSIST_URL: `${base}/google`, LLM_SWITCHER_CODE_ASSIST_TIMEOUT_MS: '1000' });
   const started = Date.now();
-  const r = await fetch(`http://127.0.0.1:${port}/v1internal:stallMidway`, { method: 'POST', headers: agyHeaders(), body: '{}' });
-  await assert.rejects(r.text());
+  const r = await answerIsComplete(`http://127.0.0.1:${port}/v1internal:stallMidway`, { headers: agyHeaders(), body: '{}' });
+  assert.equal(r.complete, false);
   assert.ok(Date.now() - started < 5000, `took ${Date.now() - started} ms`);
 });
 
@@ -515,9 +551,76 @@ test('an agent turn that names a profile that does not exist gets a 400, never G
 });
 
 test('a Bifrost stream that breaks ends the answer to agy with an error, not a clean end', async () => {
-  const r = await fetch(url('/v1internal:streamGenerateContent?alt=sse'), { method: 'POST', headers: agyHeaders({ 'x-llm-profile': 'agyg' }), body: JSON.stringify(envelope()) });
+  const r = await answerIsComplete(url('/v1internal:streamGenerateContent?alt=sse'), { headers: agyHeaders({ 'x-llm-profile': 'agyg' }), body: JSON.stringify(envelope()) });
   assert.equal(r.status, 200);
-  await assert.rejects(r.text());
+  assert.equal(r.complete, false);
+});
+
+test('Codex on the WebSocket transport crosses Bifrost too, and its turn history reaches intact', async () => {
+  const ws = await openResponsesWs(proxyPort, { 'User-Agent': CODEX_UA, 'x-llm-profile': 'cdx', Authorization: 'Bearer chatgpt-user-token' });
+  try {
+    assert.match(ws.reply, /^HTTP\/1\.1 101/);
+    const before = received.length;
+    const turn1 = [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: 'hi' }] }];
+    ws.send({ type: 'response.create', model: 'gpt-5.5', instructions: 'x', input: turn1, store: false });
+    const done = async (n) => {
+      for (let i = 0; i < 100 && ws.messages.filter(m => m.type === 'response.completed').length < n; i++) await new Promise(r => setTimeout(r, 30));
+      return ws.messages.filter(m => m.type === 'response.completed')[n - 1];
+    };
+    const first = await done(1);
+    assert.ok(first, `no response.completed: ${JSON.stringify(ws.messages).slice(0, 300)}`);
+    assert.ok(ws.messages.some(m => m.type === 'response.output_text.delta' && m.delta === 'codex pool'), 'the events of intact reach Codex');
+
+    const up1 = received.slice(before).find(x => x.url.startsWith('/intact/v1/responses'));
+    assert.ok(up1, 'the WS turn must reach intact /responses, not the convert route');
+    assert.equal(up1.method, 'POST');
+    assert.equal(up1.headers['x-api-key'], 'sk-intact');
+    assert.equal(up1.headers.authorization, undefined, 'the ChatGPT token never reaches intact');
+    assert.equal(up1.headers['user-agent'], CODEX_UA);
+    for (const h of ['upgrade', 'sec-websocket-key', 'sec-websocket-version', 'x-llm-profile']) assert.equal(up1.headers[h], undefined, `${h} is a WebSocket or switcher header`);
+    assert.equal(up1.body.model, 'codex/gpt-5.5');
+    assert.equal(up1.body.stream, true);
+    assert.equal(up1.body.type, undefined, 'the WS frame type is not part of a Responses request');
+    assert.deepEqual(up1.body.input, turn1);
+
+    // Turn 2 names turn 1; intact has no WS state, so it gets the whole conversation.
+    const turn2 = [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: 'again' }] }];
+    ws.send({ type: 'response.create', model: 'gpt-5.5', previous_response_id: first.response.id, input: turn2, store: false });
+    assert.ok(await done(2), 'no second response.completed');
+    const up2 = received.slice(before).filter(x => x.url.startsWith('/intact/v1/responses'))[1];
+    const answer1 = ws.messages.find(m => m.type === 'response.output_item.done').item;
+    assert.deepEqual(up2.body.input, [...turn1, answer1, ...turn2], 'the answer of turn 1 is replayed, though response.completed had no output');
+    assert.equal(up2.body.previous_response_id, undefined);
+
+    const token = fs.readFileSync(path.join(tmpDir, 'admin.token'), 'utf8').trim();
+    const { logs } = await (await fetch(url('/api/logs'), { headers: { 'x-llm-switcher-token': token } })).json();
+    const entry = logs.find(l => l.clientFormat === 'responses-ws' && l.outFormat === 'bifrost');
+    assert.ok(entry, 'the inspector names the WS Bifrost route');
+    assert.deepEqual(entry.tokens, { prompt: 5, completion: 1 });
+  } finally {
+    ws.close();
+  }
+});
+
+test('codex exec (originator codex_exec) crosses Bifrost like the Codex TUI', async () => {
+  const before = received.length;
+  const body = { model: 'gpt-5.5', instructions: 'x', input: [{ role: 'user', content: [{ type: 'input_text', text: 'hi' }] }], stream: true, store: false };
+  const r = await fetch(url('/v1/responses'), { method: 'POST', headers: { 'content-type': 'application/json', 'user-agent': 'codex_exec/0.160.0 (Windows 10.0.26300; x86_64) unknown', 'x-llm-profile': 'cdx' }, body: JSON.stringify(body) });
+  await r.text();
+  assert.ok(received.slice(before).some(x => x.url.startsWith('/intact/v1/responses')), 'codex_exec must reach intact /responses');
+  assert.equal(received.slice(before).some(x => x.url.startsWith('/intact/v1/chat/completions')), false, 'not the convert route');
+});
+
+test('a Codex WS Bifrost stream cut before its end still ends the turn with response.failed', async () => {
+  const ws = await openResponsesWs(proxyPort, { 'User-Agent': CODEX_UA, 'x-llm-profile': 'cdxcut' });
+  try {
+    ws.send({ type: 'response.create', model: 'gpt-5.5', input: [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: 'hi' }] }] });
+    for (let i = 0; i < 150 && !ws.messages.some(m => m.type === 'response.failed'); i++) await new Promise(r => setTimeout(r, 30));
+    assert.ok(ws.messages.some(m => m.type === 'response.created' && m.response.id === 'resp_cut'), 'the events before the cut reach Codex');
+    assert.ok(ws.messages.some(m => m.type === 'response.failed'), `no terminal event: ${JSON.stringify(ws.messages).slice(0, 300)}`);
+  } finally {
+    ws.close();
+  }
 });
 
 test('with agy switched off, its agent turns go back to Google', async (t) => {

package/tests/cdp.mjs

@@ -41,16 +41,31 @@ export async function launchBrowser() {
     '--headless=new', '--remote-debugging-port=0', `--user-data-dir=${dir}`,
     '--no-first-run', '--no-default-browser-check', '--disable-extensions', '--disable-gpu',
     '--disable-background-networking', '--window-size=1280,900',
-    ...(process.getuid?.() === 0 ? ['--no-sandbox'] : []),
+    // macOS: no keychain prompt, which would block a headless run with no one to answer it.
+    '--use-mock-keychain', '--password-store=basic',
+    // Ubuntu 24.04 blocks the user namespaces the Chrome sandbox needs. The page is a local test.
+    ...(process.platform === 'linux' || process.getuid?.() === 0 ? ['--no-sandbox'] : []),
     'about:blank'
   ];
-  const child = spawn(findChromium(), args, { stdio: 'ignore', env: { ...process.env, HOME: dir } });
+  const child = spawn(findChromium(), args, { stdio: ['ignore', 'ignore', 'pipe'], env: { ...process.env, HOME: dir } });
+  // The tail of what Chromium printed: the only clue when it starts on a machine no one can watch.
+  let stderr = '';
+  child.stderr.on('data', (d) => { stderr = (stderr + d).slice(-4000); });
+  let exited = null;
+  child.once('exit', (code, signal) => { exited = signal || code; });
   let port = 0;
-  for (let i = 0; i < 150 && !port; i++) {
+  for (let i = 0; i < 300 && !port && exited === null; i++) {
     try { port = Number(fs.readFileSync(path.join(dir, 'DevToolsActivePort'), 'utf8').split('\n')[0]) || 0; } catch { /* not written yet */ }
     if (!port) await sleep(100);
   }
-  if (!port) { child.kill(); throw new Error('Chromium did not open a debugging port'); }
+  if (!port) {
+    // SIGKILL and a wait: a Chromium left running holds this test process open.
+    if (exited === null) {
+      child.kill('SIGKILL');
+      await new Promise(r => { child.once('exit', r); setTimeout(r, 3000); });
+    }
+    throw new Error(`Chromium did not open a debugging port (exit: ${exited ?? 'killed'})\n${stderr}`);
+  }
 
   const pages = [];
   return {
@@ -65,7 +80,8 @@ export async function launchBrowser() {
       for (const p of pages) p.close();
       child.kill();
       await new Promise(r => { child.once('exit', r); setTimeout(r, 2000); });
-      fs.rmSync(dir, { recursive: true, force: true });
+      // On Windows a Chromium child process can hold a cache file for a moment after the exit (EBUSY).
+      fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     }
   };
 }

package/tests/dashboard.e2e.test.mjs

@@ -23,8 +23,12 @@ describe('dashboard, driven in a real browser', { skip: skipReason() }, () => {
   });
 
   after(async () => {
-    await browser?.close();
-    await fx?.stop();
+    // The gateway must stop even when the browser cleanup throws, or it holds this process open.
+    try {
+      await browser?.close();
+    } finally {
+      await fx?.stop();
+    }
   });
 
   beforeEach(async () => {

package/tests/gateway.e2e.test.mjs

@@ -1149,6 +1149,8 @@ test('Direct passthrough waits for a slow client instead of buffering the whole
     req.on('error', reject);
     req.end(JSON.stringify({ model: 'claude-opus-4-6', max_tokens: 10, stream: true, messages: [{ role: 'user', content: 'DIRECT_BIG' }] }));
   });
+  // The end callback of the mock can run after the client's 'end' under load: 0 means not recorded yet.
+  assert.ok(await until(() => bigState.finishedAt, 2000), 'the upstream never finished');
   assert.ok(bigState.finishedAt >= resumedAt, `upstream finished ${resumedAt - bigState.finishedAt} ms before the client read anything`);
 });
 

package/tests/make-certs.test.mjs

@@ -20,3 +20,17 @@ test('make-certs.sh builds the certificates under a path that contains a dot', {
   for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(out, f)), `${f} is missing`);
   assert.deepEqual(fs.readdirSync(dir), ['first.last'], 'no serial file outside the output directory');
 });
+
+// A Windows path has no forward slash. The script took `C:\...\certs` for the host of the old
+// two-argument form, ignored it, and rebuilt the default certificates of the checkout instead.
+test('make-certs.sh writes to a Windows path given as its only argument', { skip: process.platform !== 'win32' && 'a Windows path' }, (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmswcerts-win-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const out = path.join(dir, 'certs');
+  // Where the script falls back to: a decoy, so a failing run never touches the real certificates.
+  const decoy = path.join(dir, 'decoy');
+  execFileSync('bash', [path.join(ROOT, 'blindfold', 'make-certs.sh'), out], { stdio: 'pipe', env: { ...process.env, LLM_SWITCHER_BLINDFOLD_CERTS: decoy } });
+  assert.match(out, /^[A-Za-z]:\\/, 'the argument is a native Windows path');
+  for (const f of ['ca.pem', 'ca.key', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(out, f)), `${f} is missing in ${out}`);
+  assert.equal(fs.existsSync(decoy), false, 'nothing is written to the default directory');
+});

package/tests/update.e2e.test.mjs

@@ -192,6 +192,12 @@ test('the dashboard Update now button installs the release and reloads on the ne
   await page.goto(fx.dashboardUrl);
   await page.waitFor(`!document.getElementById('update-notice').hidden`, 'the update notice');
   await page.click('#update-now');
-  await page.waitFor(`document.getElementById('app-version')?.textContent === 'v9.9.12'`, 'the reloaded dashboard on the new version', 30000);
+  try {
+    await page.waitFor(`document.getElementById('app-version')?.textContent === 'v9.9.12'`, 'the reloaded dashboard on the new version', 30000);
+  } catch (err) {
+    // A CI runner cannot be watched: put what the gateway and the page saw into the failure.
+    err.message += `\ngateway log:\n${fx.log()}\npage problems: ${JSON.stringify(page.problems)}`;
+    throw err;
+  }
   assert.equal(await page.evaluate(`document.getElementById('update-notice').hidden`), true);
 });

package/tests/ws-client.mjs

@@ -0,0 +1,46 @@
+// A raw WebSocket client for the gateway tests. It sends the handshake headers Codex sends (a
+// User-Agent, a profile header), which the WebSocket of Node cannot set.
+import net from 'node:net';
+import crypto from 'node:crypto';
+import { createFrameReader } from '../blindfold/wsframe.mjs';
+
+// One masked client frame, as RFC 6455 requires from a client.
+export function clientFrame(opcode, payload) {
+  const data = Buffer.from(payload);
+  const len = data.length;
+  const head = len < 126 ? Buffer.from([0x80 | opcode, 0x80 | len])
+    : len < 65536 ? Buffer.from([0x80 | opcode, 0x80 | 126, len >> 8, len & 0xff])
+      : Buffer.concat([Buffer.from([0x80 | opcode, 0x80 | 127]), (() => { const b = Buffer.alloc(8); b.writeBigUInt64BE(BigInt(len)); return b; })()]);
+  const mask = crypto.randomBytes(4);
+  return Buffer.concat([head, mask, Buffer.from(data.map((b, i) => b ^ mask[i & 3]))]);
+}
+
+// Opens /v1/responses on the gateway. `messages` collects every JSON text frame the gateway sends.
+export function openResponsesWs(port, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const socket = net.connect(port, '127.0.0.1');
+    const extra = Object.entries(headers).map(([k, v]) => `${k}: ${v}\r\n`).join('');
+    socket.write(`GET /v1/responses HTTP/1.1\r\nHost: 127.0.0.1:${port}\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: ${crypto.randomBytes(16).toString('base64')}\r\n${extra}\r\n`);
+    let head = Buffer.alloc(0);
+    const read = createFrameReader();
+    const messages = [];
+    const onData = (chunk) => {
+      head = Buffer.concat([head, chunk]);
+      const end = head.indexOf('\r\n\r\n');
+      if (end < 0) return;
+      socket.off('data', onData);
+      const collect = (c) => { for (const f of read(c)) if (f.type === 'text') messages.push(JSON.parse(f.payload.toString())); };
+      socket.on('data', collect);
+      const rest = head.subarray(end + 4);
+      if (rest.length) collect(rest);
+      resolve({
+        reply: head.subarray(0, end).toString(),
+        messages,
+        send: (obj) => socket.write(clientFrame(1, JSON.stringify(obj))),
+        close: () => socket.destroy()
+      });
+    };
+    socket.on('data', onData);
+    socket.on('error', reject);
+  });
+}