llm-switcher 1.3.1 → 1.3.3

package/switch.mjs

@@ -232,8 +232,8 @@ async function stopProxy(port) {
   };
   // Our own unit needs no identity proof: its manager stops it. That also covers a unit that is
   // still starting (the port is free) and a hung gateway under the unit (the probe is silent).
-  const svc = installedService();
-  const ownUnit = svc && [port, null].includes(servicePort(svc));
+  const svc = serviceForPort(port);
+  const ownUnit = Boolean(svc);
   if (state === 'free') {
     if (!ownUnit) return 'not-running';
     serviceStop(svc);
@@ -271,7 +271,7 @@ async function changePort(newPortStr) {
   // Refuse before anything stops: the old gateway keeps running when the new port is taken.
   const target = await probeGateway(p);
   if (isHeld(target)) refuseForeignPort(p, 'this switcher', target);
-  const svc = installedService();
+  const svc = serviceForPort(oldPort);
   // The unit is rewritten below. It keeps the choice that `service install --no-autoupdate` made.
   const svcText = svc ? serviceText(svc) : null;
   const autoupdate = svcText === null || autoupdateFromServiceText(svcText);
@@ -688,6 +688,13 @@ function servicePort(kind) {
   return text === null ? null : portFromServiceText(text);
 }
 
+// The installed service runs the gateway of the port its definition names. A second instance
+// (LLM_SWITCHER_PORT) must never stop or rewrite it. A definition with no readable port counts.
+function serviceForPort(port) {
+  const svc = installedService();
+  return svc && [port, null].includes(servicePort(svc)) ? svc : null;
+}
+
 function reportBackup(backup) {
   if (backup) console.log(`[Service] The previous definition differed and is kept as ${backup}.`);
 }

package/tests/agy-relay.test.mjs

@@ -0,0 +1,316 @@
+// Tests for agy-relay.mjs: agy's Google token reaches a gateway only on a connection where that
+// gateway proved itself with the key of gateway.secret, also when the gateway stops in the middle
+// of an agy session.
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import net from 'node:net';
+import http from 'node:http';
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const RELAY = path.join(ROOT, 'agy-relay.mjs');
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'agyrelay-'));
+after(() => fs.rmSync(TMP, { recursive: true, force: true }));
+
+// The directory of a relay run: admin.token, and gateway.secret unless `secret` is false.
+const TOKEN = 'b'.repeat(64);
+function stateDir(name, { secret = true } = {}) {
+  const dir = path.join(TMP, name);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'admin.token'), TOKEN);
+  if (secret) fs.writeFileSync(path.join(dir, 'gateway.secret'), crypto.randomBytes(32).toString('hex'));
+  return dir;
+}
+const MAIN = stateDir('main');
+const { identityProof } = await import(pathToFileURL(path.join(ROOT, 'state.mjs')).href);
+
+// Stands in for agy: FAKE_CALLS requests with its Google token, then one more once `signal` exists.
+const FAKE_AGY = path.join(TMP, 'fake-agy.mjs');
+fs.writeFileSync(FAKE_AGY, `
+import fs from 'node:fs';
+import http from 'node:http';
+const [, , code, signal] = process.argv;
+const call = () => new Promise((resolve) => {
+  const req = http.request(process.env.CLOUD_CODE_URL + '/v1internal:loadCodeAssist', {
+    method: 'POST', agent: false, headers: { authorization: 'Bearer google-secret', 'content-type': 'application/json' }
+  }, (res) => { let b = ''; res.on('data', d => { b += d; }); res.on('end', () => { console.log('STATUS ' + res.statusCode + ' ' + b); resolve(); }); res.on('error', () => resolve()); });
+  req.on('error', (e) => { console.log('ERROR ' + e.message); resolve(); });
+  req.end('{}');
+});
+console.log('CCU ' + (process.env.CLOUD_CODE_URL || ''));
+if (process.env.CLOUD_CODE_URL) for (let i = 0; i < Number(process.env.FAKE_CALLS || 1); i++) await call();
+if (signal) { while (!fs.existsSync(signal)) await new Promise(r => setTimeout(r, 50)); await call(); }
+process.exit(Number(code) || 0);
+`);
+
+const relayHmac = (key, port, pid, nonce) => crypto.createHmac('sha256', key).update(['relay', port, pid, nonce].join('|')).digest('hex');
+
+// The answer of a gateway fixture to the identity probe. 'real' signs with the raw bytes of the
+// gateway.secret file; every other kind is one way to be wrong.
+function probeAnswer(kind, challenge, port, dir) {
+  const pid = 4242;
+  const secretFile = path.join(dir, 'gateway.secret');
+  const secret = fs.existsSync(secretFile) ? fs.readFileSync(secretFile) : Buffer.from('no-secret');
+  let status = 200;
+  let body = { status: 'ok', proxy: 'llm-switcher', port, pid, proof: identityProof(challenge, { role: 'gateway', port, pid }, TOKEN) };
+  if (kind === 'real' || kind === 'extra') body.relayProof = relayHmac(secret, port, pid, challenge);
+  if (kind === 'squatter') body.relayProof = relayHmac(TOKEN, port, pid, challenge);
+  if (kind === 'replay') Object.assign(body, { relayProof: relayHmac(secret, port, pid, 'stale-nonce'), nonce: 'stale-nonce', challenge: 'stale-nonce' });
+  if (kind === 'status500') { status = 500; body.relayProof = relayHmac(secret, port, pid, challenge); }
+  if (kind === 'oversize') Object.assign(body, { relayProof: relayHmac(secret, port, pid, challenge), pad: 'x'.repeat(70 * 1024) });
+  if (kind === 'empty') body.relayProof = '';
+  if (kind === 'null') body = null;
+  if (kind === 'number') body = 7;
+  if (kind === 'array') body = [];
+  const text = JSON.stringify(body);
+  let out = `HTTP/1.1 ${status} X\r\nContent-Type: application/json\r\nContent-Length: ${Buffer.byteLength(text)}\r\nConnection: keep-alive\r\n\r\n${text}`;
+  if (kind === 'extra') out += 'HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 13\r\n\r\nINJECTED-BODY';
+  return out;
+}
+
+// A raw gateway fixture on `port`. `kinds` is one kind, or one kind per connection in order (the
+// last repeats). It records every challenge and every byte that arrives after its probe answer.
+function gateway(kinds, { port = 0, dir = MAIN } = {}) {
+  const list = [].concat(kinds);
+  const seen = { challenges: [], bytes: '' };
+  let conn = 0;
+  const server = net.createServer((sock) => {
+    const kind = list[Math.min(conn++, list.length - 1)];
+    sock.on('error', () => {});
+    let buf = '';
+    let probed = false;
+    sock.on('data', (d) => {
+      if (kind === 'silent') { seen.bytes += d; return; }
+      if (probed) {
+        seen.bytes += d;
+        buf += d;
+        // 'real' answers each forwarded request once its 2-byte body is in.
+        const end = buf.indexOf('\r\n\r\n');
+        if (kind === 'real' && end >= 0 && buf.length >= end + 6) {
+          buf = '';
+          const answer = '{"answeredBy":"real"}';
+          sock.write(`HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: ${answer.length}\r\nConnection: keep-alive\r\n\r\n${answer}`);
+        }
+        return;
+      }
+      buf += d;
+      const end = buf.indexOf('\r\n\r\n');
+      if (end < 0) return;
+      const head = buf.slice(0, end);
+      const rest = buf.slice(end + 4);
+      buf = '';
+      probed = true;
+      seen.challenges.push((head.match(/challenge=([0-9a-f]+)/) || [])[1] || '');
+      sock.write(probeAnswer(kind, seen.challenges.at(-1), server.address().port, dir));
+      if (rest) seen.bytes += rest;
+    });
+  });
+  return new Promise((resolve) => server.listen(port, '127.0.0.1', () => resolve({ server, seen, port: server.address().port })));
+}
+
+function runRelay(gatewayUrl, args = [], { env = {}, dir = MAIN } = {}) {
+  const child = spawn(process.execPath, [RELAY, gatewayUrl, process.execPath, FAKE_AGY, ...args], {
+    env: { ...process.env, LLM_SWITCHER_CONFIG: path.join(dir, 'config.json'), CLOUD_CODE_URL: gatewayUrl, ...env }
+  });
+  let out = '', err = '';
+  child.stdout.on('data', d => { out += d; });
+  child.stderr.on('data', d => { err += d; });
+  const done = new Promise((resolve) => {
+    const timer = setTimeout(() => child.kill(), 30000);
+    child.on('close', (code) => { clearTimeout(timer); resolve({ code, out, err }); });
+  });
+  return { child, done, out: () => out };
+}
+
+const statuses = (out) => out.split('\n').filter(l => l.startsWith('STATUS')).map(l => Number(l.split(' ')[1]));
+const ccuPort = (out) => Number((out.match(/CCU http:\/\/127\.0\.0\.1:(\d+)/) || [])[1]);
+
+test('agy talks to its own relay port, and the relay forwards to a gateway that proved itself with gateway.secret', async (t) => {
+  const g = await gateway('real');
+  t.after(() => g.server.close());
+  const { code, out } = await runRelay(`http://127.0.0.1:${g.port}`).done;
+  assert.equal(code, 0);
+  assert.ok(ccuPort(out) > 0 && ccuPort(out) !== g.port, `agy gets the relay port, not the gateway port: ${out}`);
+  assert.match(out, /STATUS 200 .*"answeredBy":"real"/);
+  assert.match(g.seen.bytes, /Bearer google-secret/);
+});
+
+// Every way a listener on the gateway port can be wrong: agy gets a 502, and its token never leaves.
+for (const kind of ['squatter', 'replay', 'extra', 'status500', 'oversize', 'old']) {
+  test(`a gateway that answers the probe as '${kind}' gets a 502 and never receives the token`, async (t) => {
+    const g = await gateway(kind);
+    t.after(() => g.server.close());
+    const { code, out } = await runRelay(`http://127.0.0.1:${g.port}`).done;
+    assert.equal(code, 0);
+    assert.deepEqual(statuses(out), [502], out);
+    assert.doesNotMatch(g.seen.bytes, /google-secret/);
+    assert.doesNotMatch(out, /INJECTED-BODY/, 'bytes after the probe answer never reach agy');
+    if (kind === 'old') assert.match(out, /switch off.*switch on/, 'an old gateway gets the restart hint');
+  });
+}
+
+test('a silent listener only ever sees the probe, never the token', async (t) => {
+  const g = await gateway('silent');
+  t.after(() => g.server.close());
+  const { out } = await runRelay(`http://127.0.0.1:${g.port}`).done;
+  assert.deepEqual(statuses(out), [502]);
+  assert.match(g.seen.bytes, /^GET \/health\?challenge=/);
+  assert.doesNotMatch(g.seen.bytes, /google-secret/);
+});
+
+test('one relay sends a fresh challenge on every connection', async (t) => {
+  const g = await gateway('replay');
+  t.after(() => g.server.close());
+  await runRelay(`http://127.0.0.1:${g.port}`, [], { env: { FAKE_CALLS: '2' } }).done;
+  assert.equal(g.seen.challenges.length, 2);
+  assert.notEqual(g.seen.challenges[0], g.seen.challenges[1]);
+  assert.match(g.seen.challenges[0], /^[0-9a-f]{32}$/);
+});
+
+test('without gateway.secret the relay trusts no proof, not even one keyed by admin.token', async (t) => {
+  const dir = stateDir('nosecret', { secret: false });
+  for (const kind of ['empty', 'squatter']) {
+    const g = await gateway(kind, { dir });
+    t.after(() => g.server.close());
+    const { out } = await runRelay(`http://127.0.0.1:${g.port}`, [], { dir }).done;
+    assert.deepEqual(statuses(out), [502], `${kind}: ${out}`);
+    assert.doesNotMatch(g.seen.bytes, /google-secret/, kind);
+  }
+});
+
+test('an answer that is not an object gets a 502, and the relay keeps serving agy', async (t) => {
+  const g = await gateway(['null', 'number', 'array', 'real']);
+  t.after(() => g.server.close());
+  const { code, out } = await runRelay(`http://127.0.0.1:${g.port}`, [], { env: { FAKE_CALLS: '4' } }).done;
+  assert.equal(code, 0);
+  assert.deepEqual(statuses(out), [502, 502, 502, 200], out);
+});
+
+test('a gateway replaced in the middle of an agy session never receives the token', async (t) => {
+  const real = await gateway('real');
+  const port = real.port;
+  const signal = path.join(TMP, 'go-swap');
+  const run = runRelay(`http://127.0.0.1:${port}`, ['0', signal]);
+  for (let i = 0; i < 200 && !/STATUS/.test(run.out()); i++) await new Promise(r => setTimeout(r, 50));
+  assert.match(run.out(), /STATUS 200 /, 'the first request went through the real gateway');
+  // The gateway stops, and a process that holds admin.token takes its port.
+  await new Promise(r => real.server.close(r));
+  const squatter = await gateway('squatter', { port });
+  t.after(() => squatter.server.close());
+  fs.writeFileSync(signal, '');
+  const { out } = await run.done;
+  assert.deepEqual(statuses(out), [200, 502]);
+  assert.doesNotMatch(squatter.seen.bytes, /google-secret/);
+});
+
+test('the relay works against the real proxy.mjs and the proof it computes', async (t) => {
+  const dir = stateDir('realproxy', { secret: false });
+  fs.rmSync(path.join(dir, 'admin.token'));
+  const mock = http.createServer((req, res) => { req.resume(); res.end('{"answeredBy":"code-assist-mock"}'); });
+  await new Promise(r => mock.listen(0, '127.0.0.1', r));
+  t.after(() => mock.close());
+  const port = await new Promise(r => { const s = net.createServer().listen(0, '127.0.0.1', () => { const p = s.address().port; s.close(() => r(p)); }); });
+  fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ port, activeProfiles: { claude: null, codex: null, agy: null }, profiles: {} }));
+  const proxy = spawn(process.execPath, [path.join(ROOT, 'proxy.mjs'), '--port', String(port)], {
+    env: { ...process.env, LLM_SWITCHER_CONFIG: path.join(dir, 'config.json'), LLM_SWITCHER_STATE_DIR: dir, CLAUDE_CONFIG_DIR: path.join(dir, 'claude'), LLM_SWITCHER_PORT: '', LLM_SWITCHER_CODE_ASSIST_URL: `http://127.0.0.1:${mock.address().port}` },
+    stdio: 'ignore'
+  });
+  t.after(() => proxy.kill());
+  for (let i = 0; i < 50; i++) {
+    try { if ((await fetch(`http://127.0.0.1:${port}/health`)).ok) break; } catch {}
+    await new Promise(r => setTimeout(r, 100));
+  }
+  assert.ok(fs.existsSync(path.join(dir, 'gateway.secret')), 'the gateway made its secret at startup');
+  const { out } = await runRelay(`http://127.0.0.1:${port}`, [], { dir }).done;
+  assert.match(out, /STATUS 200 .*code-assist-mock/, out);
+});
+
+test('the relay exits with the exit code of agy', async (t) => {
+  const g = await gateway('real');
+  t.after(() => g.server.close());
+  const { code } = await runRelay(`http://127.0.0.1:${g.port}`, ['7']).done;
+  assert.equal(code, 7);
+});
+
+test('a gateway address that is not 127.0.0.1 with a port leaves agy on its official endpoint', async () => {
+  for (const bad of ['http://localhost:3456', 'http://127.0.0.1', 'https://127.0.0.1:3456', 'not a url']) {
+    const { code, out, err } = await runRelay(bad).done;
+    assert.equal(code, 0, bad);
+    assert.match(out, /^CCU $/m, `${bad}: agy gets no CLOUD_CODE_URL`);
+    assert.match(err, /official endpoint/, bad);
+  }
+});
+
+// An argv string cannot hold NUL on any platform: Node refuses it before a process exists, so it
+// can reach neither the relay nor agy. The relay's own NUL guard only backs this up.
+test('an argument with a NUL character cannot start a process at all', () => {
+  assert.throws(() => spawn(process.execPath, [RELAY, 'http://127.0.0.1:9', process.execPath, FAKE_AGY, 'a\0b']), { code: 'ERR_INVALID_ARG_VALUE' });
+});
+
+// ---- A .cmd agy on Windows: every argument arrives byte-identical through cmd.exe ----------------
+
+const WIN = process.platform === 'win32';
+function cmdFixture(name) {
+  const dir = path.join(TMP, name);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'argv.js'), `require('fs').writeFileSync(require('path').join(process.cwd(), 'argv.json'), JSON.stringify(process.argv.slice(2)));\n`);
+  fs.writeFileSync(path.join(dir, 'agy.cmd'), '@node "%~dp0argv.js" %*\r\n');
+  return dir;
+}
+function runCmdRelay(dir, args) {
+  const child = spawn(process.execPath, [RELAY, 'http://127.0.0.1', path.join(dir, 'agy.cmd'), ...args], {
+    cwd: dir, env: { ...process.env, LLM_SWITCHER_CONFIG: path.join(MAIN, 'config.json') }
+  });
+  let err = '';
+  child.stderr.on('data', d => { err += d; });
+  return new Promise((resolve) => child.on('close', (code) => resolve({ code, err })));
+}
+
+test('a .cmd agy receives every argument byte-identical, and cmd.exe runs nothing else', { skip: !WIN && 'cmd.exe only' }, async () => {
+  const dir = cmdFixture('cmdargs');
+  const args = ['%PATH%', '%PATH:a=%', '%CMDCMDLINE:~-1%&echo PWNED>marker', 'C:\\temp\\', 'a"b', 'a\\"b', 'say "hi there"',
+    '50% off', 'x&y', 'a|b', 'a^b', '<x>', '(x)', '!PATH!', 'héllo wörld', ''];
+  const { code, err } = await runCmdRelay(dir, args);
+  assert.equal(code, 0, err);
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(dir, 'argv.json'), 'utf8')), args);
+  assert.equal(fs.existsSync(path.join(dir, 'marker')), false, 'no second command ran');
+});
+
+test('a .cmd agy in a directory with % in its name still starts', { skip: !WIN && 'cmd.exe only' }, async () => {
+  const dir = cmdFixture('50%off');
+  const { code, err } = await runCmdRelay(dir, ['ok']);
+  assert.equal(code, 0, err);
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(dir, 'argv.json'), 'utf8')), ['ok']);
+});
+
+test('a .cmd agy gets no line break and no command line over the cmd.exe limit', { skip: !WIN && 'cmd.exe only' }, async () => {
+  for (const [name, args, hint] of [['crlf-n', ['a\nb'], /line break/], ['crlf-r', ['a\rb'], /line break/], ['toolong', ['x'.repeat(8200)], /8191/]]) {
+    const dir = cmdFixture(name);
+    const { code, err } = await runCmdRelay(dir, args);
+    assert.notEqual(code, 0, name);
+    assert.match(err, hint, name);
+    assert.match(err, /stdin/, name);
+    assert.equal(fs.existsSync(path.join(dir, 'argv.json')), false, `${name}: the fixture never ran`);
+  }
+  const dir = cmdFixture('long-ok');
+  const long = 'y'.repeat(4000);
+  const { code, err } = await runCmdRelay(dir, [long]);
+  assert.equal(code, 0, err);
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(dir, 'argv.json'), 'utf8')), [long]);
+});
+
+test('an .exe agy gets a line break in an argument unchanged', async (t) => {
+  const dir = path.join(TMP, 'exe-newline');
+  fs.mkdirSync(dir, { recursive: true });
+  const script = path.join(dir, 'argv.mjs');
+  fs.writeFileSync(script, `import fs from 'node:fs'; fs.writeFileSync(${JSON.stringify(path.join(dir, 'argv.json'))}, JSON.stringify(process.argv.slice(2)));\n`);
+  const child = spawn(process.execPath, [RELAY, 'http://127.0.0.1', process.execPath, script, 'a\nb'], { env: { ...process.env, LLM_SWITCHER_CONFIG: path.join(MAIN, 'config.json') } });
+  const code = await new Promise(r => child.on('close', r));
+  assert.equal(code, 0);
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(dir, 'argv.json'), 'utf8')), ['a\nb']);
+});

package/tests/agy.e2e.test.mjs

@@ -9,6 +9,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { openResponsesWs } from './ws-client.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const AGY_UA = 'antigravity/cli/1.2.14 (aidev_client; os_type=windows; arch=amd64; cl=990662481; auth_method=consumer)';
@@ -70,6 +71,16 @@ function startUpstream() {
           { choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] }
         ]);
       }
+      if (req.method === 'GET' && req.url.startsWith('/cbroken/v1/models/')) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        return res.end(JSON.stringify({ bifrost_ua: 'codex_cli_rs/' }));
+      }
+      if (req.url.startsWith('/cbroken/v1/responses')) {
+        // The first event, then the connection dies: no response.completed ever comes.
+        res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+        res.write(`event: response.created\ndata: ${JSON.stringify({ type: 'response.created', response: { id: 'resp_cut', status: 'in_progress' } })}\n\n`);
+        return setTimeout(() => res.socket.destroy(), 50);
+      }
       if (req.method === 'GET' && req.url.startsWith('/broken/v1/models/')) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         return res.end(JSON.stringify({ bifrost_ua: 'antigravity/cli/' }));
@@ -127,8 +138,19 @@ function startUpstream() {
         ]);
       }
       if (req.url.startsWith('/intact/v1/responses')) {
+        // A Responses stream as the Codex account on intact sends it; each turn gets its own id.
+        // With store:false the real backend sends response.completed with an empty output: the
+        // items come only in response.output_item.done (measured 2026-10-03).
+        const id = `resp_${received.length}`;
+        const item = { type: 'message', id: `msg_${id}`, role: 'assistant', content: [{ type: 'output_text', text: 'codex pool' }] };
+        const events = [
+          { type: 'response.created', response: { id, status: 'in_progress' } },
+          { type: 'response.output_text.delta', delta: 'codex pool' },
+          { type: 'response.output_item.done', output_index: 0, item },
+          { type: 'response.completed', response: { id, status: 'completed', output: [], usage: { input_tokens: 5, output_tokens: 1 } } }
+        ];
         res.writeHead(200, { 'Content-Type': 'text/event-stream' });
-        res.write(`event: response.completed\ndata: ${JSON.stringify({ type: 'response.completed', response: { id: 'r1', usage: { input_tokens: 5, output_tokens: 1 } } })}\n\n`);
+        for (const e of events) res.write(`event: ${e.type}\ndata: ${JSON.stringify(e)}\n\n`);
         return res.end();
       }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
@@ -170,6 +192,7 @@ before(async () => {
       agyf: { name: 'agy flaky lookup', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/flaky/v1`, apiKey: 'sk-flaky', defaultModels: { main: 'antigravity/*' } },
       agynf: { name: 'agy lookup 404', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/nf/v1`, apiKey: 'sk-nf', defaultModels: { main: 'antigravity/*' } },
       agyg: { name: 'agy broken stream', mode: 'convert', tool: 'agy', outFormat: 'openai-chat', baseURL: `${base}/broken/v1`, apiKey: 'sk-broken', defaultModels: { main: 'antigravity/*' } },
+      cdxcut: { name: 'codex cut stream', mode: 'convert', tool: 'codex', outFormat: 'openai-chat', baseURL: `${base}/cbroken/v1`, apiKey: 'sk-cut', defaultModels: { main: 'codex/gpt-5.5' } },
       cdx: { name: 'codex on intact', mode: 'convert', tool: 'codex', outFormat: 'openai-chat', baseURL: `${base}/intact/v1`, apiKey: 'sk-intact', defaultModels: { main: 'codex/gpt-5.5' } }
     }
   };
@@ -237,6 +260,19 @@ const envelope = (over = {}) => ({
   },
   ...over
 });
+// Whether the gateway ended its answer as a whole one. Read from the HTTP framing, because fetch in
+// Node 18 takes a chunked body that a closed socket cut short as complete.
+function answerIsComplete(target, { method = 'POST', headers = {}, body = '' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(target, { method, headers: { ...headers, 'content-length': Buffer.byteLength(body) } }, (res) => {
+      res.on('error', () => {});
+      res.on('close', () => resolve({ status: res.statusCode, complete: res.complete }));
+      res.resume();
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
 const lastTo = (prefix) => [...received].reverse().find(r => r.url.startsWith(prefix));
 const dataLines = (text) => text.split('\n').filter(l => l.startsWith('data:')).map(l => JSON.parse(l.slice(5)));
 
@@ -383,16 +419,16 @@ test('a Code Assist host that never answers gives a 504 after the idle timeout',
 
 test('an upstream that stops in the middle of a body ends the answer to agy with an error', async () => {
   const started = Date.now();
-  const r = await fetch(url('/v1internal:breakMidway'), { method: 'POST', headers: agyHeaders(), body: '{}' });
-  await assert.rejects(r.text());
+  const r = await answerIsComplete(url('/v1internal:breakMidway'), { headers: agyHeaders(), body: '{}' });
+  assert.equal(r.complete, false);
   assert.ok(Date.now() - started < 10000);
 });
 
 test('an upstream that stalls after its headers is cut by the idle timeout', async () => {
   const port = await startGateway({ LLM_SWITCHER_CODE_ASSIST_URL: `${base}/google`, LLM_SWITCHER_CODE_ASSIST_TIMEOUT_MS: '1000' });
   const started = Date.now();
-  const r = await fetch(`http://127.0.0.1:${port}/v1internal:stallMidway`, { method: 'POST', headers: agyHeaders(), body: '{}' });
-  await assert.rejects(r.text());
+  const r = await answerIsComplete(`http://127.0.0.1:${port}/v1internal:stallMidway`, { headers: agyHeaders(), body: '{}' });
+  assert.equal(r.complete, false);
   assert.ok(Date.now() - started < 5000, `took ${Date.now() - started} ms`);
 });
 
@@ -515,9 +551,90 @@ test('an agent turn that names a profile that does not exist gets a 400, never G
 });
 
 test('a Bifrost stream that breaks ends the answer to agy with an error, not a clean end', async () => {
-  const r = await fetch(url('/v1internal:streamGenerateContent?alt=sse'), { method: 'POST', headers: agyHeaders({ 'x-llm-profile': 'agyg' }), body: JSON.stringify(envelope()) });
+  const r = await answerIsComplete(url('/v1internal:streamGenerateContent?alt=sse'), { headers: agyHeaders({ 'x-llm-profile': 'agyg' }), body: JSON.stringify(envelope()) });
   assert.equal(r.status, 200);
-  await assert.rejects(r.text());
+  assert.equal(r.complete, false);
+});
+
+test('Codex on the WebSocket transport crosses Bifrost too, and its turn history reaches intact', async () => {
+  const ws = await openResponsesWs(proxyPort, { 'User-Agent': CODEX_UA, 'x-llm-profile': 'cdx', Authorization: 'Bearer chatgpt-user-token' });
+  try {
+    assert.match(ws.reply, /^HTTP\/1\.1 101/);
+    const before = received.length;
+    const turn1 = [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: 'hi' }] }];
+    ws.send({ type: 'response.create', model: 'gpt-5.5', instructions: 'x', input: turn1, store: false });
+    const done = async (n) => {
+      for (let i = 0; i < 100 && ws.messages.filter(m => m.type === 'response.completed').length < n; i++) await new Promise(r => setTimeout(r, 30));
+      return ws.messages.filter(m => m.type === 'response.completed')[n - 1];
+    };
+    const first = await done(1);
+    assert.ok(first, `no response.completed: ${JSON.stringify(ws.messages).slice(0, 300)}`);
+    assert.ok(ws.messages.some(m => m.type === 'response.output_text.delta' && m.delta === 'codex pool'), 'the events of intact reach Codex');
+
+    const up1 = received.slice(before).find(x => x.url.startsWith('/intact/v1/responses'));
+    assert.ok(up1, 'the WS turn must reach intact /responses, not the convert route');
+    assert.equal(up1.method, 'POST');
+    assert.equal(up1.headers['x-api-key'], 'sk-intact');
+    assert.equal(up1.headers.authorization, undefined, 'the ChatGPT token never reaches intact');
+    assert.equal(up1.headers['user-agent'], CODEX_UA);
+    for (const h of ['upgrade', 'sec-websocket-key', 'sec-websocket-version', 'x-llm-profile']) assert.equal(up1.headers[h], undefined, `${h} is a WebSocket or switcher header`);
+    assert.equal(up1.body.model, 'codex/gpt-5.5');
+    assert.equal(up1.body.stream, true);
+    assert.equal(up1.body.type, undefined, 'the WS frame type is not part of a Responses request');
+    assert.deepEqual(up1.body.input, turn1);
+
+    // Turn 2 names turn 1; intact has no WS state, so it gets the whole conversation.
+    const turn2 = [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: 'again' }] }];
+    ws.send({ type: 'response.create', model: 'gpt-5.5', previous_response_id: first.response.id, input: turn2, store: false });
+    assert.ok(await done(2), 'no second response.completed');
+    const up2 = received.slice(before).filter(x => x.url.startsWith('/intact/v1/responses'))[1];
+    const answer1 = ws.messages.find(m => m.type === 'response.output_item.done').item;
+    assert.deepEqual(up2.body.input, [...turn1, answer1, ...turn2], 'the answer of turn 1 is replayed, though response.completed had no output');
+    assert.equal(up2.body.previous_response_id, undefined);
+
+    const token = fs.readFileSync(path.join(tmpDir, 'admin.token'), 'utf8').trim();
+    const { logs } = await (await fetch(url('/api/logs'), { headers: { 'x-llm-switcher-token': token } })).json();
+    const entry = logs.find(l => l.clientFormat === 'responses-ws' && l.outFormat === 'bifrost');
+    assert.ok(entry, 'the inspector names the WS Bifrost route');
+    assert.deepEqual(entry.tokens, { prompt: 5, completion: 1 });
+  } finally {
+    ws.close();
+  }
+});
+
+test('codex exec (originator codex_exec) crosses Bifrost like the Codex TUI', async () => {
+  const before = received.length;
+  const body = { model: 'gpt-5.5', instructions: 'x', input: [{ role: 'user', content: [{ type: 'input_text', text: 'hi' }] }], stream: true, store: false };
+  const r = await fetch(url('/v1/responses'), { method: 'POST', headers: { 'content-type': 'application/json', 'user-agent': 'codex_exec/0.160.0 (Windows 10.0.26300; x86_64) unknown', 'x-llm-profile': 'cdx' }, body: JSON.stringify(body) });
+  await r.text();
+  assert.ok(received.slice(before).some(x => x.url.startsWith('/intact/v1/responses')), 'codex_exec must reach intact /responses');
+  assert.equal(received.slice(before).some(x => x.url.startsWith('/intact/v1/chat/completions')), false, 'not the convert route');
+});
+
+test('a Codex WS Bifrost stream cut before its end still ends the turn with response.failed', async () => {
+  const ws = await openResponsesWs(proxyPort, { 'User-Agent': CODEX_UA, 'x-llm-profile': 'cdxcut' });
+  try {
+    ws.send({ type: 'response.create', model: 'gpt-5.5', input: [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: 'hi' }] }] });
+    for (let i = 0; i < 150 && !ws.messages.some(m => m.type === 'response.failed'); i++) await new Promise(r => setTimeout(r, 30));
+    assert.ok(ws.messages.some(m => m.type === 'response.created' && m.response.id === 'resp_cut'), 'the events before the cut reach Codex');
+    assert.ok(ws.messages.some(m => m.type === 'response.failed'), `no terminal event: ${JSON.stringify(ws.messages).slice(0, 300)}`);
+  } finally {
+    ws.close();
+  }
+});
+
+test('no page or answer of the gateway carries the relay key', async () => {
+  const secret = fs.readFileSync(path.join(tmpDir, 'gateway.secret'), 'utf8').trim();
+  assert.match(secret, /^[0-9a-f]{64}$/, 'the gateway made its key at startup');
+  const token = fs.readFileSync(path.join(tmpDir, 'admin.token'), 'utf8').trim();
+  for (const p of ['/', '/ui', '/health?challenge=x', '/api/status']) {
+    const r = await fetch(url(p), { headers: { 'x-llm-switcher-token': token } });
+    assert.equal(r.status, 200, p);
+    const all = JSON.stringify([...r.headers]) + await r.text();
+    assert.equal(all.includes(secret), false, `${p} carries the relay key`);
+  }
+  const health = await (await fetch(url('/health?challenge=n9'))).json();
+  assert.match(health.relayProof, /^[0-9a-f]{64}$/, 'the gateway answers a relay proof');
 });
 
 test('with agy switched off, its agent turns go back to Google', async (t) => {

package/tests/agy.unit.test.mjs

@@ -68,6 +68,9 @@ test('the agy shim reads only its own files, takes no CA, and scrubs a stale gat
   assert.match(posix, /if \[ "\$TOOL_ACTIVE" != "1" \] && \[ -n "\$_u" \]; then/);
   assert.match(shim.renderShim('claude', 'win32'), /NODE_EXTRA_CA_CERTS/, 'Claude keeps its CA block');
   assert.equal(shim.routeEvidence('agy', ' CLOUD_CODE_URL=http://127.0.0.1:3456 PATH=x'), true);
+  assert.match(win, /agy-relay\.mjs" "%CLOUD_CODE_URL%"/, 'a routed agy runs behind its relay');
+  assert.match(posix, /exec node "[^"]*agy-relay\.mjs" "\$GATEWAY_URL" "\$REAL" "\$@"/);
+  assert.doesNotMatch(shim.renderShim('codex', 'win32'), /agy-relay/);
 });
 
 test('the agy hook is merged into hooks.json, unquoted, and removed without touching other hooks', () => {

package/tests/cdp.mjs

@@ -41,16 +41,38 @@ export async function launchBrowser() {
     '--headless=new', '--remote-debugging-port=0', `--user-data-dir=${dir}`,
     '--no-first-run', '--no-default-browser-check', '--disable-extensions', '--disable-gpu',
     '--disable-background-networking', '--window-size=1280,900',
-    ...(process.getuid?.() === 0 ? ['--no-sandbox'] : []),
+    // macOS: no keychain prompt, which would block a headless run with no one to answer it.
+    '--use-mock-keychain', '--password-store=basic',
+    // Ubuntu 24.04 blocks the user namespaces the Chrome sandbox needs. The page is a local test.
+    ...(process.platform === 'linux' || process.getuid?.() === 0 ? ['--no-sandbox'] : []),
     'about:blank'
   ];
-  const child = spawn(findChromium(), args, { stdio: 'ignore', env: { ...process.env, HOME: dir } });
+  // POSIX: a process group of its own, so close() can stop the renderers and helpers too.
+  const child = spawn(findChromium(), args, { stdio: ['ignore', 'ignore', 'pipe'], env: { ...process.env, HOME: dir }, detached: process.platform !== 'win32' });
+  const stop = (signal) => {
+    try {
+      if (process.platform !== 'win32') process.kill(-child.pid, signal);
+      else child.kill(signal);
+    } catch { /* already gone */ }
+  };
+  // The tail of what Chromium printed: the only clue when it starts on a machine no one can watch.
+  let stderr = '';
+  child.stderr.on('data', (d) => { stderr = (stderr + d).slice(-4000); });
+  let exited = null;
+  child.once('exit', (code, signal) => { exited = signal || code; });
   let port = 0;
-  for (let i = 0; i < 150 && !port; i++) {
+  for (let i = 0; i < 300 && !port && exited === null; i++) {
     try { port = Number(fs.readFileSync(path.join(dir, 'DevToolsActivePort'), 'utf8').split('\n')[0]) || 0; } catch { /* not written yet */ }
     if (!port) await sleep(100);
   }
-  if (!port) { child.kill(); throw new Error('Chromium did not open a debugging port'); }
+  if (!port) {
+    // SIGKILL and a wait: a Chromium left running holds this test process open.
+    if (exited === null) {
+      stop('SIGKILL');
+      await new Promise(r => { child.once('exit', r); setTimeout(r, 3000); });
+    }
+    throw new Error(`Chromium did not open a debugging port (exit: ${exited ?? 'killed'})\n${stderr}`);
+  }
 
   const pages = [];
   return {
@@ -63,9 +85,12 @@ export async function launchBrowser() {
     },
     async close() {
       for (const p of pages) p.close();
-      child.kill();
+      // The whole group: a helper that outlives the main process keeps writing into the profile.
+      stop('SIGTERM');
       await new Promise(r => { child.once('exit', r); setTimeout(r, 2000); });
-      fs.rmSync(dir, { recursive: true, force: true });
+      stop('SIGKILL');
+      // On Windows a Chromium child process can hold a cache file for a moment after the exit (EBUSY).
+      fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 });
     }
   };
 }

package/tests/dashboard.e2e.test.mjs

@@ -23,8 +23,12 @@ describe('dashboard, driven in a real browser', { skip: skipReason() }, () => {
   });
 
   after(async () => {
-    await browser?.close();
-    await fx?.stop();
+    // The gateway must stop even when the browser cleanup throws, or it holds this process open.
+    try {
+      await browser?.close();
+    } finally {
+      await fx?.stop();
+    }
   });
 
   beforeEach(async () => {