llm-switcher 1.4.1 → 1.6.2

package/proxy.mjs

@@ -9,8 +9,8 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { createFrameReader } from './blindfold/wsframe.mjs';
 import {
-  OUT_FORMATS, parseToIR, emitUpstreamBody, createUpstreamNormalizer, createCollector,
-  createThinkTagSplitter, splitThinkTags, healAnthropicPayload, estimateTokens, THINKING_MODES,
+  OUT_FORMATS, parseToIR, emitUpstreamBody, irToAnthropicBody, createUpstreamNormalizer, createCollector,
+  createThinkTagSplitter, splitThinkTags, healAnthropicPayload, estimateTokens, THINKING_MODES, VALID_EFFORTS,
   toGeminiSchema, isAntigravityModel,
   createAnthropicStream, createChatStream, createResponsesStream, createVertexStream,
   buildAnthropicMessage, buildChatMessage, buildResponsesMessage, buildVertexMessage,
@@ -32,6 +32,11 @@ import { classifyCodexRole, classifyClaudeTier, syncLocalCatalog, refreshCatalog
 import { checkForUpdate } from './version.mjs';
 import { applyUpdate } from './update.mjs';
 import { createContractLab, createHalfTap, tapClientWrites, capText, capJson, toolVersionFromUA, finishHalf, PROBE_HEADER, TRACE_ID_RE } from './contract.mjs';
+import {
+  idleCompactPolicy, validateIdleCompactPatch, compactRawHistory, summaryReplacement, IDLE_COMPACT_KEY,
+} from './idlecompact.mjs';
+import { askSummary } from './idlecall.mjs';
+import { IdlePrefixCache, compactCacheKey, policyFingerprint } from './idlecache.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const uiHtmlPath = path.join(__dirname, 'ui.html');
@@ -743,8 +748,102 @@ function cleanSchemaDeep(obj) {
 // 1. Strip disallowed keywords ('encrypted', '$schema', 'cache_control')
 // 2. Fix invalid schema values where a property has a string value "object" instead of a valid schema object
 // 3. For ag/* targets (Gemini behind 9Router): rewrite to the strict Schema subset
-function buildUpstreamRequest(profile, outFormat, ir, mappedModel, req) {
-  const upBody = emitUpstreamBody(outFormat, ir, mappedModel, { thinkingMode: profile.thinkingMode });
+// ---- idle compaction ----
+
+// Persist the gateway's exact-prefix mapping, never the client's native history.
+const idlePrefixCache = new IdlePrefixCache(STATE_DIR, {
+  onDiagnostic: code => console.warn(`[llm-switcher] idle compact: ${code}; forwarding is preserved`),
+});
+
+async function maybeCompactIdle(req, clientFormat, payload, ir, profile, profileKey, bodyBuffer) {
+  const policy = idleCompactPolicy(loadConfig());
+  const wants = policy.enabled && (clientFormat === 'anthropic' ||
+    (clientFormat === 'responses' && policy.codex));
+  if (!wants) return null;
+  const field = clientFormat === 'responses' ? 'input' : 'messages';
+  const history = payload[field];
+  if (!Array.isArray(history)) return null;
+  const key = compactCacheKey(clientFormat, req, payload, ir, profile, profileKey, policy);
+  // Shared opening prompts do not prove a session identity. Anonymous requests stay unchanged.
+  if (!key) return null;
+  const visited = idlePrefixCache.visit(key, history, policy);
+  const rewrite = messages => {
+    const next = { ...payload, [field]: messages };
+    return { payload: next, bodyBuffer: Buffer.from(JSON.stringify(next), 'utf8'), cacheKey: key };
+  };
+  if (visited.idleMs <= policy.idleMs || Buffer.byteLength(JSON.stringify(payload)) < policy.minBytes) {
+    return visited.history ? rewrite(visited.history) : null;
+  }
+  const compacted = compactRawHistory(history, clientFormat, policy);
+  // Reuse one stable prefix throughout a window. A later idle window can compact a larger
+  // original prefix; an unchanged prefix never asks for the same summary twice.
+  if (!compacted || (visited.record?.prefixCount && compacted.prefixCount <= visited.record.prefixCount)) {
+    return visited.history ? rewrite(visited.history) : null;
+  }
+  const record = idlePrefixCache.create(key, history, compacted.prefixCount, compacted.replacement, policy);
+  if (!record) return null; // persistence failed: send the complete original request
+  console.log(`[llm-switcher] idle compact ${key.slice(0, 12)} [${profileKey}]: ` +
+    `${Buffer.byteLength(JSON.stringify(history))} -> ${Buffer.byteLength(JSON.stringify(compacted.history))} bytes; ` +
+    (policy.model ? 'configured summary requested' : 'deterministic prefix cached; no model called'));
+  if (policy.model) {
+    const snapshotPolicy = policyFingerprint(policy);
+    const prefixIR = parseToIR(clientFormat, { ...payload, [field]: history.slice(0, compacted.prefixCount) });
+    const summaryModel = mapModel(policy.model, profile, clientFormat);
+    const summaryFormat = resolveOutFormat(profile, summaryModel);
+    askSummary({ ir: prefixIR, policy, profile, model: summaryModel,
+      build: (prof, model, summaryIR) => buildUpstreamRequest(prof, summaryFormat, summaryIR, model, req),
+      onDiagnostic: ({ code, status }) => console.warn(`[llm-switcher] idle compact ${key.slice(0, 12)}: ${code}${status ? ` (${status})` : ''}`),
+    }).then(summary => {
+      if (!summary) return;
+      const cfg = loadConfig();
+      const livePolicy = idleCompactPolicy(cfg);
+      const liveProfile = cfg?.profiles?.[profileKey];
+      if (policyFingerprint(livePolicy) !== snapshotPolicy || !liveProfile ||
+          compactCacheKey(clientFormat, req, payload, ir, liveProfile, profileKey, livePolicy) !== key) {
+        console.log(`[llm-switcher] idle compact ${key.slice(0, 12)}: summary discarded after configuration change`);
+        return;
+      }
+      const stored = idlePrefixCache.upgrade(key, record.generation, summaryReplacement(compacted, summary), policy);
+      console.log(`[llm-switcher] idle compact ${key.slice(0, 12)}: summary ${stored ? 'cached' : 'discarded after a newer generation or history change'}`);
+    }).catch(() => console.warn(`[llm-switcher] idle compact ${key.slice(0, 12)}: summary-call-failed`));
+  }
+  return rewrite(compacted.history);
+}
+
+function resolveSlot(requestedModel, mappedModel, profile, clientFormat) {
+  if (clientFormat === 'codeassist') return 'main';
+  const clean = String(requestedModel || '').replace(/\[1m\]/gi, '').trim().toLowerCase();
+  if (clientFormat === 'responses') {
+    if (clean.includes('review')) return 'review';
+    if (clean.includes('subagent')) return 'subagent';
+    return 'main';
+  }
+  if (clean.includes('fable')) return 'fable';
+  if (clean.includes('opus')) return 'opus';
+  if (clean.includes('haiku')) return 'haiku';
+  if (clean.includes('sonnet')) return 'sonnet';
+  if (profile?.defaultModels) {
+    for (const [s, m] of Object.entries(profile.defaultModels)) {
+      if (m && (m === mappedModel || m === requestedModel || String(m).toLowerCase() === clean)) return s;
+    }
+  }
+  return 'default';
+}
+
+function resolveThinkingEffort(profile, slot, mappedModel) {
+  if (profile?.modelEfforts && typeof profile.modelEfforts === 'object') {
+    if (slot && profile.modelEfforts[slot]) return profile.modelEfforts[slot];
+    if (mappedModel && profile.modelEfforts[mappedModel]) return profile.modelEfforts[mappedModel];
+  }
+  return profile?.thinkingEffort || 'auto';
+}
+
+function buildUpstreamRequest(profile, outFormat, ir, mappedModel, req, slot = null) {
+  const effort = resolveThinkingEffort(profile, slot, mappedModel);
+  const upBody = emitUpstreamBody(outFormat, ir, mappedModel, {
+    thinkingMode: profile.thinkingMode,
+    thinkingEffort: effort,
+  });
   if (upBody?.tools && Array.isArray(upBody.tools)) {
     upBody.tools = cleanSchemaDeep(upBody.tools);
     if (outFormat === 'openai-chat' && isAntigravityModel(mappedModel)) {
@@ -839,6 +938,22 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
   // Code Assist names streaming in the path (:streamGenerateContent), not in the body.
   if (clientFormat === 'codeassist') ir.stream = Boolean(opts.codeAssistStream);
 
+  // Compaction rewrites the request itself, not just the intermediate form: when the client and
+  // the provider speak the same shape this gateway forwards the client's own bytes, so a change
+  // made only to the parsed form would shorten nothing that leaves the building.
+  const shrunk = await maybeCompactIdle(req, clientFormat, payload, ir, profile, profileKey, bodyBuffer);
+  if (shrunk) {
+    try {
+      const compactedIR = parseToIR(clientFormat, shrunk.payload);
+      payload = shrunk.payload;
+      bodyBuffer = shrunk.bodyBuffer;
+      ir = compactedIR;
+    } catch {
+      idlePrefixCache.remove(shrunk.cacheKey);
+      console.warn('[llm-switcher] idle compact: cache-reparse-failed; forwarding original request');
+    }
+  }
+
   const reqStartTime = Date.now();
   const requestPreview = previewOf(ir);
   const requestedModel = ir.model || payload.model || '';
@@ -912,7 +1027,8 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
       return;
     }
 
-    const { url, headers, upBody } = buildUpstreamRequest(profile, outFormat, ir, mappedModel, req);
+    const slot = resolveSlot(requestedModel, mappedModel, profile, clientFormat);
+    const { url, headers, upBody } = buildUpstreamRequest(profile, outFormat, ir, mappedModel, req, slot);
     if (traceId) headers['x-intact-trace'] = traceId;
     debugLog(`[${profileKey}] ${clientFormat} -> ${outFormat} ${url} ::`, JSON.stringify(upBody).slice(0, 500));
 
@@ -1140,6 +1256,15 @@ function validateProfileInput(p) {
   if (p.outFormat && !OUT_FORMATS.includes(p.outFormat)) return `Invalid outFormat "${p.outFormat}"`;
   if (p.mode && !VALID_MODES.includes(p.mode)) return `Invalid mode "${p.mode}"`;
   if (p.thinkingMode && !THINKING_MODES.includes(p.thinkingMode)) return `Invalid thinkingMode "${p.thinkingMode}"`;
+  if (p.thinkingEffort && !VALID_EFFORTS.includes(p.thinkingEffort)) return `Invalid thinkingEffort "${p.thinkingEffort}"`;
+  if (p.modelEfforts !== undefined) {
+    if (!p.modelEfforts || typeof p.modelEfforts !== 'object' || Array.isArray(p.modelEfforts)) {
+      return 'modelEfforts must be an object';
+    }
+    for (const [slot, eff] of Object.entries(p.modelEfforts)) {
+      if (eff && !VALID_EFFORTS.includes(eff)) return `Invalid modelEfforts.${slot} value "${eff}"`;
+    }
+  }
   if (p.baseURL !== undefined) {
     try {
       const u = new URL(p.baseURL);
@@ -1575,6 +1700,30 @@ async function routeApi(req, res, method, pathname) {
     return sendJson(res, 200, syncLocalCatalog(STATE_DIR));
   }
 
+  // Idle compaction. The settings live under one key so the dashboard and `switch compact`
+  // write the same place, and the same defaults, instead of two views that can disagree.
+  if (method === 'GET' && pathname === '/api/idle-compact') {
+    return sendJson(res, 200, { idleCompact: idleCompactPolicy(loadConfig()) });
+  }
+  if (method === 'POST' && pathname === '/api/idle-compact') {
+    let patch;
+    try {
+      patch = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8'));
+    } catch (err) {
+      return sendJson(res, err.status || 400, { error: err.message });
+    }
+    const invalid = validateIdleCompactPatch(patch);
+    if (invalid) return sendJson(res, 400, { error: invalid });
+    const cfg = loadConfig() || {};
+    cfg[IDLE_COMPACT_KEY] = { ...(cfg[IDLE_COMPACT_KEY] || {}), ...patch };
+    try {
+      saveConfig(cfg);
+    } catch (err) {
+      return sendJson(res, 500, { error: err.message });
+    }
+    return sendJson(res, 200, { idleCompact: idleCompactPolicy(loadConfig()) });
+  }
+
   if (method !== 'POST') {
     req.resume();
     return sendJson(res, 404, { error: `Not found: ${method} ${pathname}` });
@@ -1716,9 +1865,12 @@ async function routeConfigApi(res, method, pathname, body) {
       return sendJson(res, 400, { error: 'The stored API key is sent only to the baseURL and endpoints it was saved with. Enter the key again to use a new URL.' });
     }
     merged.apiKey = keepsKey ? (existing.apiKey || '') : String(profile.apiKey || '');
-    for (const k of ['outFormat', 'optimizerURL', 'thinkingMode']) {
+    for (const k of ['outFormat', 'optimizerURL', 'thinkingMode', 'thinkingEffort']) {
       if (Object.hasOwn(profile, k) && !profile[k]) delete merged[k];
     }
+    if (Object.hasOwn(profile, 'modelEfforts')) {
+      merged.modelEfforts = profile.modelEfforts || {};
+    }
     // The merge above keeps a key the payload does not mention, so a retired one has to be dropped
     // here: the window comes from the model's own list now, and a flag left in config.json would
     // be read by nothing while still telling the next reader that the window is a choice.
@@ -2036,7 +2188,8 @@ async function handleWsResponseCreate(socket, payload, req, ac, history = null)
 
   let answered = false; // set only after a complete answer; the half upload depends on it
   try {
-    const { url, headers, upBody } = buildUpstreamRequest(profile, outFormat, ir, mappedModel, req);
+    const slot = resolveSlot(requestedModel, mappedModel, profile, clientFormat);
+    const { url, headers, upBody } = buildUpstreamRequest(profile, outFormat, ir, mappedModel, req, slot);
     if (traceId) headers['x-intact-trace'] = traceId;
     debugLog(`[${profileKey}:ws] ${clientFormat} -> ${outFormat} ${url} ::`, JSON.stringify(upBody).slice(0, 300));
 

package/shim.mjs

@@ -96,6 +96,24 @@ if [ -O "$SWITCHER_DIR" ] && [ -O "$SWITCHER_DIR/${envFile}" ] && [ -f "$SWITCHE
 else
   TOOL_ACTIVE=0
 fi
+# Codex builds its TLS client from this at startup and cannot start at all without reading it, so a
+# CA that is not on disk takes Codex down instead of routing it. The shim cannot build the file, but
+# it can refuse to hand over a path that is already dead, which leaves Codex on the system roots.
+if [ -n "\${CODEX_CA_CERTIFICATE:-}" ]; then
+  if [ ! -e "\${CODEX_CA_CERTIFICATE}" ]; then
+    printf '[llm-switcher] %s missing; Codex uses the system roots.\\n' "\${CODEX_CA_CERTIFICATE}" >&2
+    unset CODEX_CA_CERTIFICATE
+  elif [ -d "\${CODEX_CA_CERTIFICATE}" ] || [ ! -f "\${CODEX_CA_CERTIFICATE}" ]; then
+    printf '[llm-switcher] %s nonregular; Codex uses the system roots.\\n' "\${CODEX_CA_CERTIFICATE}" >&2
+    unset CODEX_CA_CERTIFICATE
+  elif [ ! -r "\${CODEX_CA_CERTIFICATE}" ]; then
+    printf '[llm-switcher] %s unreadable; Codex uses the system roots.\\n' "\${CODEX_CA_CERTIFICATE}" >&2
+    unset CODEX_CA_CERTIFICATE
+  elif [ ! -s "\${CODEX_CA_CERTIFICATE}" ]; then
+    printf '[llm-switcher] %s empty; Codex uses the system roots.\\n' "\${CODEX_CA_CERTIFICATE}" >&2
+    unset CODEX_CA_CERTIFICATE
+  fi
+fi
 ${name !== 'agy' ? '' : `
 # The gateway proves itself before agy's token goes to it; any doubt keeps agy on its official endpoint.
 if [ "$TOOL_ACTIVE" = "1" ] && ! node "${GATEWAY_CHECK}" "\${CLOUD_CODE_URL:-}" >/dev/null 2>&1; then
@@ -243,6 +261,17 @@ if exist "%SWITCHER_DIR%\\active.flag" if exist "%SWITCHER_DIR%\\${envFile}" (
   for %%A in ("%SWITCHER_DIR%\\${envFile}") do if %%~zA GTR 0 set "TOOL_ACTIVE=1"
 )
 if "%TOOL_ACTIVE%"=="1" call "%SWITCHER_DIR%\\${envFile}"
+if defined CODEX_CA_CERTIFICATE (
+  if not exist "%CODEX_CA_CERTIFICATE%" (
+    echo [llm-switcher] %CODEX_CA_CERTIFICATE% missing; Codex uses the system roots. 1>&2
+    set "CODEX_CA_CERTIFICATE="
+  ) else (
+    for %%A in ("%CODEX_CA_CERTIFICATE%") do if %%~zA EQU 0 (
+      echo [llm-switcher] %CODEX_CA_CERTIFICATE% empty; Codex uses the system roots. 1>&2
+      set "CODEX_CA_CERTIFICATE="
+    )
+  )
+)
 ${name !== 'agy' ? '' : `
 REM The gateway proves itself before agy's token goes to it; any doubt keeps agy on its official endpoint.
 if "%TOOL_ACTIVE%"=="1" call :CHECK_GATEWAY

package/state.mjs

@@ -1366,7 +1366,18 @@ export function computeLaunchState(cfg, port) {
   // NODE_EXTRA_CA_CERTS is deliberately absent from env-claude: the shim decides it at launch,
   // because only then does it know whether the user brought a CA of their own (R2).
   if (claude) state.envClaude = proxyPairs();
-  if (codex) state.envCodex = [...proxyPairs(), ['CODEX_CA_CERTIFICATE', paths.blindfoldCA]];
+  // Codex builds its TLS client from CODEX_CA_CERTIFICATE the moment it starts, and a path it cannot
+  // read is fatal: it dies before its first request, and its long-lived daemon then fails its own
+  // update with "Failed to read CA certificate file". So the CA is only offered when it is really
+  // usable. A missing or invalid one drops the switcher's proxy pairs as well, which leaves Codex
+  // on the system roots talking directly to its official endpoint instead of breaking TLS.
+  if (codex) {
+    if (usableCACertificate(paths.blindfoldCA)) {
+      state.envCodex = [...proxyPairs(), ['CODEX_CA_CERTIFICATE', paths.blindfoldCA]];
+    } else {
+      state.envCodex = [];
+    }
+  }
   // agy reaches the gateway directly over plain http: no proxy and no CA (Go on Windows reads only
   // the system store). Remote control keeps its own host, so it never crosses the switcher.
   if (agy) state.envAgy = [['CLOUD_CODE_URL', `http://127.0.0.1:${port}`]];
@@ -1488,6 +1499,29 @@ export function applyLaunchState(cfg, port, opts = {}) {
   return st;
 }
 
+export function usableCACertificate(file) {
+  if (typeof file !== 'string' || !file.trim()) return false;
+  try {
+    const stat = fs.statSync(file);
+    if (!stat.isFile() || stat.size === 0 || stat.size > 4 * 1024 * 1024) return false;
+    fs.accessSync(file, fs.constants.R_OK);
+    const text = fs.readFileSync(file, 'utf8');
+    const opens = text.match(/-----BEGIN CERTIFICATE-----/g) || [];
+    const blocks = text.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) || [];
+    if (opens.length === 0 || opens.length !== blocks.length) return false;
+    return blocks.every(pem => {
+      try {
+        new crypto.X509Certificate(pem);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
+
 const LOOPBACK_URL = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?\/?$/i;
 
 /**
@@ -1516,8 +1550,20 @@ export function restartCodexDaemon(pairs, {
   const env = { ...baseEnv };
   for (const k of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) if (LOOPBACK_URL.test(env[k] || '')) delete env[k];
   for (const k of ['NO_PROXY', 'no_proxy']) if (env[k] === '127.0.0.1,localhost') delete env[k];
-  if (env.CODEX_CA_CERTIFICATE === ca) delete env.CODEX_CA_CERTIFICATE;
+  // The daemon keeps the environment it started with, so a CA it cannot read outlives the switcher
+  // writing it: the daemon comes back up unable to build a TLS client and fails its own update with
+  // "Failed to read CA certificate file". The check has to come after the route is applied, because a
+  // dead CA can arrive in the route as well as in the environment it was already carrying.
   for (const [k, v] of pairs) env[k] = v;
+  if (!usableCACertificate(env.CODEX_CA_CERTIFICATE)) {
+    delete env.CODEX_CA_CERTIFICATE;
+    for (const k of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) {
+      if (LOOPBACK_URL.test(env[k] || '')) delete env[k];
+    }
+    for (const k of ['NO_PROXY', 'no_proxy']) {
+      if (env[k] === '127.0.0.1,localhost') delete env[k];
+    }
+  }
 
   try {
     const child = spawnFn(bin, ['app-server', 'daemon', 'restart'], { env, stdio: 'ignore', detached: true });

package/switch.mjs

@@ -13,6 +13,7 @@ import {
   getMigrationError, getMigrationCollision, getLastLoadError,
   casClearToolPointers, emptyToolEnvFiles, syncInterceptorTools
 } from './state.mjs';
+import { idleCompactPolicy, validateIdleCompactPatch } from './idlecompact.mjs';
 import { runProbe, runCheck } from './contract.mjs';
 import { installPlugin, uninstallPlugin, pluginStatus, PLUGIN_NAME } from './plugin.mjs';
 import {
@@ -845,6 +846,64 @@ async function managePlugin(action = 'status') {
   }
 }
 
+// Idle compaction: a conversation that comes back after a pause has lost the provider's prompt
+// cache, so its history is paid for at full price. This turns that on and says what it will do.
+async function manageCompact(action = 'status', arg = '') {
+  const cfg = loadConfig() || {};
+  const policy = idleCompactPolicy(cfg);
+  const key = 'idleCompact';
+  const set = (patch) => {
+    const invalid = validateIdleCompactPatch(patch);
+    if (invalid) { console.error(`[Error] ${invalid}`); process.exit(1); }
+    cfg[key] = { ...(cfg[key] || {}), ...patch };
+    saveConfig(cfg);
+  };
+  const act = (action || 'status').toLowerCase();
+  const show = () => {
+    const p = idleCompactPolicy(loadConfig() || {});
+    console.log('Idle compaction (gateway prefix cache)');
+    console.log(`  Codex opt-in:   ${p.codex ? 'yes' : 'no'}`);
+    console.log(`  Enabled:        ${p.enabled ? 'yes' : 'no'}`);
+    console.log(`  Idle over:      ${p.idleMinutes} minutes`);
+    console.log(`  Context over:   ${Math.round(p.minBytes / 1024)} KB`);
+    console.log(`  Keep recent:    ${p.keepRecent} messages`);
+    console.log(`  Summary model:  ${p.model || '(none set)'}`);
+    if (!p.enabled) console.log('\n  Turn it on with: switch compact on');
+    else if (!p.model) console.log('\n  No summary model: requests still go out shortened, and no model is called at all.');
+  };
+
+  if (act === 'on' || act === 'enable') {
+    set({ enabled: true });
+    console.log('[OK] Idle compaction is on.');
+    show();
+  } else if (act === 'off' || act === 'disable') {
+    set({ enabled: false });
+    console.log('[OK] Idle compaction is off.');
+  } else if (act === 'model') {
+    const m = String(arg || '').trim();
+    if (!m) { console.log(`Summary model is currently: ${policy.model || '(none set)'}`); return; }
+    if (m === 'none' || m === 'default') { set({ model: '' }); console.log('[OK] No summary model: no model is called.'); return; }
+    set({ model: m });
+    console.log(`[OK] Summaries will be written by: ${m}`);
+  } else if (act === 'codex') {
+    if (!['on', 'off'].includes(arg)) { console.log(`Codex prefix cache: ${policy.codex ? 'on' : 'off'} (switch compact codex on|off)`); return; }
+    set({ codex: arg === 'on' });
+    console.log(`[OK] Codex wire prefix cache is ${arg}; client history stays unchanged.`);
+  } else if (act === 'idle') {
+    const n = Number(arg);
+    if (!Number.isFinite(n) || n <= 0) { console.error('Usage: switch compact idle <minutes>'); process.exit(1); }
+    set({ idleMinutes: n });
+    console.log(`[OK] Compact a conversation idle over ${n} minutes.`);
+  } else if (act === 'min') {
+    const n = Number(arg);
+    if (!Number.isFinite(n) || n <= 0) { console.error('Usage: switch compact min <KB>'); process.exit(1); }
+    set({ minBytes: Math.floor(n) * 1024 });
+    console.log(`[OK] Compact a conversation over ${Math.floor(n)} KB.`);
+  } else {
+    show();
+  }
+}
+
 async function manageShim(action = 'status') {
   const act = (action || 'status').toLowerCase();
 
@@ -1247,6 +1306,8 @@ if (cmd === 'off' || cmd === 'stop') {
   await runDoctor();
 } else if (cmd === 'service' || cmd === 'daemon') {
   await manageService(subArg.toLowerCase() || 'status');
+} else if (cmd === 'compact') {
+  await manageCompact(subArg.toLowerCase() || 'status', positionalArgs()[2] || '');
 } else if (cmd === 'shim' || cmd === 'shims') {
   await manageShim(subArg.toLowerCase() || 'status');
 } else if (cmd === 'plugin' || cmd === 'plugins') {

package/tests/certs.test.mjs

@@ -60,7 +60,13 @@ test('openssl verifies the leaf, and the name constraints refuse a leaf for anot
   // A leaked ca.key signs for any name; a client that obeys the constraints must refuse it.
   const evil = path.join(dir, 'evil.pem');
   fs.writeFileSync(evil, signLeaf(dir, ['evil.example']).cert);
-  assert.throws(() => execFileSync('openssl', ['verify', '-CAfile', path.join(dir, 'ca.pem'), evil], { stdio: 'pipe' }), /permitted subtree violation/);
+  assert.throws(() => {
+    try {
+      execFileSync('openssl', ['verify', '-CAfile', path.join(dir, 'ca.pem'), evil], { stdio: 'pipe' });
+    } catch (err) {
+      throw new Error([err.stdout?.toString() || '', err.stderr?.toString() || '', err.message].join(' '));
+    }
+  }, /permitted subtree violation/);
 });
 
 test('ensureBlindfoldCerts builds a missing set, rebuilds a missing leaf on the same CA, and leaves a good set alone', (t) => {

package/tests/codex-daemon.test.mjs

@@ -6,15 +6,21 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+import { buildCerts } from '../blindfold/certs.mjs';
+
 // Temporary HOME and state dir before the import, so nothing here can reach the real Codex daemon.
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-codex-daemon-'));
 process.env.HOME = path.join(root, 'home');
 process.env.LLM_SWITCHER_STATE_DIR = path.join(root, 'state');
 delete process.env.CODEX_HOME;
 fs.mkdirSync(process.env.LLM_SWITCHER_STATE_DIR, { recursive: true });
-const { restartCodexDaemon, applyLaunchState, clearLaunchState, emptyToolEnvFiles, STATE_DIR } = await import('../state.mjs');
+const { restartCodexDaemon, applyLaunchState, clearLaunchState, emptyToolEnvFiles, computeLaunchState, STATE_DIR, INTERCEPT_HOSTS, usableCACertificate } = await import('../state.mjs');
 test.after(() => fs.rmSync(root, { recursive: true, force: true }));
 
+const certsDir = path.join(root, 'certs');
+buildCerts(certsDir, INTERCEPT_HOSTS);
+const validCA = path.join(certsDir, 'ca.pem');
+
 // A machine where the codex shim routes through `stateDir` and a daemon is running.
 function machine(stateDir) {
   const home = fs.mkdtempSync(path.join(root, 'm-'));
@@ -32,7 +38,7 @@ function machine(stateDir) {
 }
 
 const ROUTE = [['HTTPS_PROXY', 'http://127.0.0.1:3457'], ['https_proxy', 'http://127.0.0.1:3457'],
-  ['NO_PROXY', '127.0.0.1,localhost'], ['no_proxy', '127.0.0.1,localhost'], ['CODEX_CA_CERTIFICATE', '/ca.pem']];
+  ['NO_PROXY', '127.0.0.1,localhost'], ['no_proxy', '127.0.0.1,localhost'], ['CODEX_CA_CERTIFICATE', validCA]];
 
 test('a route change restarts the running daemon with the new Codex variables', () => {
   const m = machine('/switcher/state');
@@ -42,10 +48,58 @@ test('a route change restarts the running daemon with the new Codex variables',
   assert.equal(m.calls[0].cmd, m.bin);
   assert.deepEqual(m.calls[0].args, ['app-server', 'daemon', 'restart']);
   assert.equal(m.calls[0].env.HTTPS_PROXY, 'http://127.0.0.1:3457');
-  assert.equal(m.calls[0].env.CODEX_CA_CERTIFICATE, '/ca.pem');
   assert.equal(m.calls[0].env.PATH, '/bin');
 });
 
+// Codex reads this path when it builds its TLS client and cannot start without it, and its daemon
+// keeps the environment it started with. A path that is not on disk therefore does not route Codex,
+// it takes Codex down, and the daemon then fails its own update with "Failed to read CA certificate
+// file" -- which is what a caller sees as a daemon error while using Codex.
+test('a CA that is not on disk is never handed to Codex', () => {
+  const m = machine('/switcher/state');
+  const deadRoute = [...ROUTE.filter(([k]) => k !== 'CODEX_CA_CERTIFICATE'), ['CODEX_CA_CERTIFICATE', '/nonexistent/ca.pem']];
+  restartCodexDaemon(deadRoute, { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv: { PATH: '/bin' } });
+  assert.equal(m.calls[0].env.CODEX_CA_CERTIFICATE, undefined,
+    'a CA the switcher never built must not reach the daemon');
+});
+
+test('a CA that is on disk is passed through, so the interceptor still works', () => {
+  const m = machine('/switcher/state');
+  const certsDir = path.join(m.home, 'certs');
+  buildCerts(certsDir, INTERCEPT_HOSTS);
+  const ca = path.join(certsDir, 'ca.pem');
+  restartCodexDaemon([...ROUTE.filter(([k]) => k !== 'CODEX_CA_CERTIFICATE'), ['CODEX_CA_CERTIFICATE', ca]],
+    { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv: { PATH: '/bin' }, ca });
+  assert.equal(m.calls[0].env.CODEX_CA_CERTIFICATE, ca, 'a CA that exists is the whole point of the route');
+});
+
+test('directories, empty, garbage, and unreadable files are dropped with proxy pairs', () => {
+  const m = machine('/switcher/state');
+  const dir = path.join(m.home, 'certs-dir');
+  fs.mkdirSync(dir, { recursive: true });
+  const empty = path.join(m.home, 'empty.pem');
+  fs.writeFileSync(empty, '');
+  const garbage = path.join(m.home, 'garbage.pem');
+  fs.writeFileSync(garbage, '-----BEGIN CERTIFICATE-----\nnot a valid cert\n-----END CERTIFICATE-----\n');
+
+  for (const bad of [dir, empty, garbage]) {
+    restartCodexDaemon([...ROUTE.filter(([k]) => k !== 'CODEX_CA_CERTIFICATE'), ['CODEX_CA_CERTIFICATE', bad]],
+      { home: m.home, codexHome: m.codexHome, stateDir: '/switcher/state', spawnFn: m.spawnFn, baseEnv: { PATH: '/bin' } });
+    const env = m.calls[m.calls.length - 1].env;
+    assert.equal(env.CODEX_CA_CERTIFICATE, undefined);
+    assert.equal(env.HTTPS_PROXY, undefined);
+  }
+});
+
+// The route a restart hands over is the last word: the pairs win, so a CA in them reaches the daemon
+// whatever the environment already held. This is the path that ends in a dead daemon.
+test('the route written into env-codex carries the CA only when it exists', () => {
+  const st = computeLaunchState({ activeProfiles: { codex: 'p' }, profiles: { p: { tool: 'codex', baseURL: 'http://x/v1', apiKey: 'k' } } }, 3456);
+  const withCa = st.envCodex.find(([k]) => k === 'CODEX_CA_CERTIFICATE');
+  assert.ok(!withCa || fs.existsSync(withCa[1]),
+    `env-codex points Codex at ${withCa ? withCa[1] : 'nothing'}; a missing CA stops Codex entirely`);
+});
+
 test('switching Codex off restarts the daemon without the switcher variables, and keeps the user\'s own proxy', () => {
   const m = machine('/switcher/state');
   const baseEnv = { HTTPS_PROXY: 'http://127.0.0.1:3457', https_proxy: 'http://proxy.corp:8080', CODEX_CA_CERTIFICATE: '/ca.pem', NO_PROXY: '127.0.0.1,localhost' };

package/tests/compact-cli.test.mjs

@@ -0,0 +1,34 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+test('compact CLI disables summary without fallback, exposes Codex opt-in, and rejects invalid bounds', t => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-compact-cli-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const config = path.join(dir, 'config.json');
+  fs.writeFileSync(config, JSON.stringify({ activeProfiles: {}, profiles: {},
+    idleCompact: { enabled: true, model: 'expensive-official' } }));
+  const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+  const run = (...args) => spawnSync(process.execPath, [path.join(root, 'switch.mjs'), 'compact', ...args], {
+    env: { ...process.env, LLM_SWITCHER_CONFIG: config, LLM_SWITCHER_STATE_DIR: dir,
+      LLM_SWITCHER_REGISTRY_URL: 'http://127.0.0.1:9/' }, encoding: 'utf8', timeout: 5000,
+  });
+  const disabled = run('model', 'default'); assert.equal(disabled.status, 0, disabled.stderr);
+  assert.match(disabled.stdout, /no model is called/);
+  assert.doesNotMatch(disabled.stdout, /own model/);
+  assert.equal(JSON.parse(fs.readFileSync(config)).idleCompact.model, '');
+  const codex = run('codex', 'on'); assert.equal(codex.status, 0, codex.stderr);
+  assert.match(codex.stdout, /wire prefix cache is on/);
+  assert.equal(JSON.parse(fs.readFileSync(config)).idleCompact.codex, true);
+  const before = fs.readFileSync(config);
+  for (const args of [['idle', '1441'], ['idle', '0'], ['min', '7']]) {
+    const invalid = run(...args); assert.equal(invalid.status, 1);
+    assert.deepEqual(fs.readFileSync(config), before);
+  }
+  const status = run('status'); assert.equal(status.status, 0);
+  assert.match(status.stdout, /gateway prefix cache/); assert.match(status.stdout, /Codex opt-in:\s+yes/);
+});

package/tests/dashboard.e2e.test.mjs

@@ -594,7 +594,13 @@ describe('dashboard, driven in a real browser', { skip: skipReason() }, () => {
     const view = () => page.evaluate(`[...document.querySelectorAll('.view-panel')].filter(p => p.style.display !== 'none').map(p => p.id)`);
 
     it('opens each page from the sidebar and follows the back button', async () => {
-      for (const [nav, id, title] of [['models', 'view-models', 'Dynamic Model Catalog'], ['logs', 'view-logs', 'Request Inspector'], ['doctor', 'view-doctor', 'System Health & Doctor'], ['routes', 'view-routes', 'Routes & Profiles']]) {
+      for (const [nav, id, title] of [
+        ['compact', 'view-compact', 'Idle Compaction'],
+        ['models', 'view-models', 'Dynamic Model Catalog'],
+        ['logs', 'view-logs', 'Request Inspector'],
+        ['doctor', 'view-doctor', 'System Health & Doctor'],
+        ['routes', 'view-routes', 'Routes & Profiles']
+      ]) {
         await act(() => page.click(`#sideNav a[data-nav="${nav}"]`));
         assert.deepEqual(await view(), [id], `${nav}: wrong page`);
         assert.equal(await page.text('#page-title'), title);

package/tests/formats.test.mjs

@@ -12,7 +12,7 @@ import {
   createChatStream, buildChatMessage, chatFinish, anthropicStopReason,
   smartText, smartReasoning, sanitizeJsonSchema, normalizeUpstream, buildVertexMessage,
   createCodeAssistStream,
-  budgetToEffort, effortToBudget, normalizeEffort, capEffort, EFFORT_LEVELS
+  budgetToEffort, effortToBudget, normalizeEffort, capEffort, mapEquivalentEffort, EFFORT_LEVELS
 } from '../formats.mjs';
 import { assertValidAnthropicEvents } from './helpers.mjs';
 
@@ -1010,3 +1010,46 @@ test('a level becomes the budget each API speaks, and Gemini gets one it accepts
   // Anthropic keeps the budget it was given, only under max_tokens as its own rule requires.
   assert.equal(irToAnthropicBody(anthropicToIR({ model: 'm', max_tokens: 200000, messages: [{ role: 'user', content: 'hi' }], thinking: { type: 'enabled', budget_tokens: 100000 } }), 'm').thinking.budget_tokens, 100000);
 });
+
+test('mapEquivalentEffort maps to nearest supported level when target lacks exact match', () => {
+  const strict = ['low', 'medium', 'high'];
+  assert.equal(mapEquivalentEffort('ultra', strict), 'high');
+  assert.equal(mapEquivalentEffort('max', strict), 'high');
+  assert.equal(mapEquivalentEffort('xhigh', strict), 'high');
+  assert.equal(mapEquivalentEffort('high', strict), 'high');
+  assert.equal(mapEquivalentEffort('medium', strict), 'medium');
+  assert.equal(mapEquivalentEffort('low', strict), 'low');
+  assert.equal(mapEquivalentEffort('minimal', strict), 'low');
+
+  // Gap in target levels: ['low', 'max']
+  assert.equal(mapEquivalentEffort('xhigh', ['low', 'max']), 'max');
+  assert.equal(mapEquivalentEffort('medium', ['low', 'max']), 'low');
+
+  // Intact synonyms: extra-low -> minimal
+  assert.equal(mapEquivalentEffort('extra-low', ['minimal', 'medium', 'high']), 'minimal');
+});
+
+test('thinkingEffort profile option overrides client effort across all upstreams', () => {
+  const clientIR = responsesToIR({ model: 'gpt-5', max_output_tokens: 16000, reasoning: { effort: 'low' }, input: [{ role: 'user', content: 'solve' }] });
+
+  // 1. Force 'high' on OpenAI Chat
+  const chatBody = emitUpstreamBody('openai-chat', clientIR, 'gpt-5', { thinkingEffort: 'high' });
+  assert.equal(chatBody.reasoning_effort, 'high');
+
+  // 2. Force 'high' on Anthropic
+  const anthropicBody = emitUpstreamBody('anthropic', clientIR, 'claude-3-7-sonnet', { thinkingEffort: 'high' });
+  assert.equal(anthropicBody.output_config?.effort, 'high');
+  assert.equal(anthropicBody.thinking?.budget_tokens, 8000);
+
+  // 3. Force 'high' on Vertex (Gemini)
+  const vertexBody = emitUpstreamBody('vertex', clientIR, 'gemini-2.5-pro', { thinkingEffort: 'high' });
+  assert.equal(vertexBody.generationConfig?.thinkingConfig?.thinkingBudget, 8000);
+
+  // 4. Force 'xhigh' on strict native OpenAI caps to 'high'
+  const nativeChat = emitUpstreamBody('openai-chat', clientIR, 'gpt-5', { thinkingMode: 'native', thinkingEffort: 'xhigh' });
+  assert.equal(nativeChat.reasoning_effort, 'high');
+
+  // 5. 'auto' inherits client's original effort ('low')
+  const autoChat = emitUpstreamBody('openai-chat', clientIR, 'gpt-5', { thinkingEffort: 'auto' });
+  assert.equal(autoChat.reasoning_effort, 'low');
+});