@bman654/clodex 1.2.1 → 1.3.0

package/dist/cli.js

@@ -3,6 +3,7 @@ import {
   ensureLegacyAppHomeMigrated,
   findClaudeBinary,
   getAppHome,
+  getCredentialCleanupPath,
   getInstalledClaudeVersion,
   getLogsPath,
   getProvidersPath,
@@ -24,7 +25,7 @@ import {
   setServerListenMode,
   setServerMaskGatewayIds,
   unregisterServerRuntimeState
-} from "./chunk-3XM6UZWP.js";
+} from "./chunk-ZN5X7YFE.js";
 
 // src/cli.ts
 import pc13 from "picocolors";
@@ -202,7 +203,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "1.2.1",
+  version: "1.3.0",
   publishConfig: {
     access: "public"
   },
@@ -315,7 +316,7 @@ var VERTEX_ANTHROPIC_NPM = "@ai-sdk/google-vertex/anthropic";
 var VERSION = package_default.version;
 
 // src/env.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
 
 // src/credential-helper.ts
 import { spawn } from "child_process";
@@ -563,11 +564,23 @@ function oauthCredentialToKeychainJson(cred) {
   return JSON.stringify(cred);
 }
 function tokensToStoredCredential(tokens, existingRefresh, accountId, providerData) {
+  const access = typeof tokens.access_token === "string" ? tokens.access_token.trim() : "";
+  if (!access) {
+    throw new Error("OAuth token response is missing a valid access token");
+  }
+  if (tokens.expires_in !== void 0 && (typeof tokens.expires_in !== "number" || !Number.isFinite(tokens.expires_in) || tokens.expires_in < 0)) {
+    throw new Error("OAuth token response has an invalid expiration");
+  }
+  const returnedRefresh = typeof tokens.refresh_token === "string" ? tokens.refresh_token.trim() : "";
+  const expires = Date.now() + (tokens.expires_in ?? 3600) * 1e3;
+  if (!Number.isFinite(expires)) {
+    throw new Error("OAuth token response has an invalid expiration");
+  }
   return {
     type: "oauth",
-    access: tokens.access_token,
-    refresh: tokens.refresh_token ?? existingRefresh ?? "",
-    expires: Date.now() + (tokens.expires_in ?? 3600) * 1e3,
+    access,
+    refresh: returnedRefresh || existingRefresh || "",
+    expires,
     ...accountId ? { accountId } : {},
     ...providerData ? { providerData } : {}
   };
@@ -576,7 +589,7 @@ function parseStoredOAuthCredential(raw) {
   if (!raw?.trim().startsWith("{")) return null;
   try {
     const parsed = JSON.parse(raw);
-    if (parsed.type === "oauth" && typeof parsed.access === "string" && typeof parsed.refresh === "string" && typeof parsed.expires === "number") {
+    if (parsed.type === "oauth" && typeof parsed.access === "string" && parsed.access.trim().length > 0 && typeof parsed.refresh === "string" && typeof parsed.expires === "number" && Number.isFinite(parsed.expires) && (parsed.accessRejected === void 0 || parsed.accessRejected === true)) {
       return parsed;
     }
   } catch {
@@ -616,23 +629,45 @@ async function sleepMs(ms) {
 }
 
 // src/oauth/refresh-http.ts
+var OAUTH_REFRESH_TIMEOUT_MS = 3e4;
 async function postOAuthRefresh(url, body, options) {
   const isJson = options.contentType === "json";
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": isJson ? "application/json" : "application/x-www-form-urlencoded",
-      Accept: "application/json",
-      ...options.headers
-    },
-    body: isJson ? JSON.stringify(body) : body.toString()
-  });
-  if (!response.ok) {
-    const detail = options.includeBody ? await response.text().catch(() => "") : "";
-    const status = options.includeStatus ? ` (${response.status})` : "";
-    throw new Error(`${options.errorPrefix}${status}${detail ? `: ${detail}` : ""}`);
+  const abortController = new AbortController();
+  const timeout = setTimeout(() => {
+    abortController.abort(new DOMException(
+      "The operation was aborted due to timeout",
+      "TimeoutError"
+    ));
+  }, OAUTH_REFRESH_TIMEOUT_MS);
+  timeout.unref();
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      signal: abortController.signal,
+      headers: {
+        "Content-Type": isJson ? "application/json" : "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        ...options.headers
+      },
+      body: isJson ? JSON.stringify(body) : body.toString()
+    });
+    if (!response.ok) {
+      let detail = "";
+      if (options.includeBody) {
+        detail = await response.text().catch(() => "");
+      } else {
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+      }
+      const status = options.includeStatus ? ` (${response.status})` : "";
+      throw new Error(`${options.errorPrefix}${status}${detail ? `: ${detail}` : ""}`);
+    }
+    return await response.json();
+  } finally {
+    clearTimeout(timeout);
   }
-  return response.json();
 }
 
 // src/oauth/openai.ts
@@ -769,6 +804,7 @@ import {
 } from "fs";
 import { dirname } from "path";
 var DEFAULT_WAIT_MS = 3e4;
+var DEFAULT_CREDENTIAL_MUTATION_WAIT_MS = 15e4;
 var DEFAULT_RETRY_MS = 25;
 var registryLockContext = new AsyncLocalStorage();
 var RegistryLockLostError = class extends Error {
@@ -1057,9 +1093,11 @@ function getCredentialMutationLockPath(authRef) {
   const digest = createHash2("sha256").update("clodex-credential-mutation\0").update(authRef).digest("hex");
   return `${getProvidersPath()}.credential-${digest}.lock`;
 }
-function withCredentialMutationLock(authRef, operation) {
+function withCredentialMutationLock(authRef, operation, options = {}) {
   return withRegistryWriteLock(operation, {
-    lockPath: getCredentialMutationLockPath(authRef)
+    ...options,
+    lockPath: getCredentialMutationLockPath(authRef),
+    waitMs: options.waitMs ?? DEFAULT_CREDENTIAL_MUTATION_WAIT_MS
   });
 }
 
@@ -1142,6 +1180,11 @@ function oauthProviderIdFromAccount(account) {
   return account.startsWith(prefix) ? account.slice(prefix.length) : null;
 }
 var oauthRefreshInflight = /* @__PURE__ */ new Map();
+var OAUTH_CREDENTIAL_CACHE_MAX_AGE_MS = 3e4;
+var oauthCredentialCache = /* @__PURE__ */ new Map();
+var rejectedEnvCredentialFingerprints = /* @__PURE__ */ new Map();
+var OAUTH_REFRESH_LOCK_WAIT_MS = 15e4;
+var OAUTH_STATE_KEY_SEPARATOR = "\0";
 function parseAuthRef(authRef) {
   if (authRef === "none:anonymous") return { kind: "none" };
   if (authRef.startsWith("keyring:")) {
@@ -1164,6 +1207,26 @@ function readEnvCredential(varName) {
   if (!raw?.trim()) return null;
   return raw.trim().split(/\r?\n/)[0]?.trim() || null;
 }
+function credentialFingerprint(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function usableEnvCredential(source, value, rejectedAccessToken) {
+  if (!value) {
+    rejectedEnvCredentialFingerprints.delete(source);
+    return null;
+  }
+  const fingerprint = credentialFingerprint(value);
+  if (rejectedAccessToken !== void 0 && fingerprint === credentialFingerprint(rejectedAccessToken)) {
+    rejectedEnvCredentialFingerprints.set(source, fingerprint);
+    return null;
+  }
+  const rejectedFingerprint = rejectedEnvCredentialFingerprints.get(source);
+  if (rejectedFingerprint === fingerprint) return null;
+  if (rejectedFingerprint !== void 0) {
+    rejectedEnvCredentialFingerprints.delete(source);
+  }
+  return value;
+}
 function readKeyringAccountFromService(Entry, service, account) {
   const value = new Entry(service, account).getPassword() ?? null;
   if (!value?.startsWith(KEYRING_CHUNK_PREFIX)) return value;
@@ -1263,16 +1326,25 @@ async function deleteStoredCredential(ref, diag) {
     return false;
   }
 }
-async function resolveProviderCredential(providerId, authRef, diag) {
+async function resolveProviderCredential(providerId, authRef, diag, options = {}) {
   const parsed = parseAuthRef(authRef);
   if (parsed?.kind === "none") return null;
-  const namespaced = readEnvCredential(clodexKeyEnvVar(providerId));
+  const namespacedVar = clodexKeyEnvVar(providerId);
+  const namespaced = usableEnvCredential(
+    `provider:${providerId}`,
+    readEnvCredential(namespacedVar),
+    options.rejectedAccessToken
+  );
   if (namespaced) return namespaced;
   if (!parsed) return null;
   if (parsed.kind === "env") {
-    return readEnvCredential(parsed.varName);
+    return usableEnvCredential(
+      `provider:${providerId}:env:${parsed.varName}`,
+      readEnvCredential(parsed.varName),
+      options.rejectedAccessToken
+    );
   }
-  return readProviderSecret(parsed, diag);
+  return readProviderSecret(parsed, diag, options.rejectedAccessToken);
 }
 async function resolveProviderOAuthAccountId(authRef, diag) {
   const parsed = parseAuthRef(authRef);
@@ -1286,7 +1358,7 @@ async function resolveProviderOAuthProviderData(authRef, diag) {
   const raw = await readStoredCredential(parsed, diag);
   return parseStoredOAuthCredential(raw)?.providerData;
 }
-function decodeProviderSecret(raw) {
+function decodeProviderSecret(raw, allowOpaqueJson = false) {
   if (!raw) return null;
   const trimmed = raw.trim();
   if (!trimmed.startsWith("{")) return trimmed;
@@ -1294,59 +1366,138 @@ function decodeProviderSecret(raw) {
   if (oauth) return oauth.access;
   try {
     const parsed = JSON.parse(trimmed);
-    if (parsed.type === "oauth" && typeof parsed.access === "string") return parsed.access;
-    if (parsed.type === "wellknown" && typeof parsed.token === "string") return parsed.token;
+    if (parsed.type === "wellknown") {
+      return typeof parsed.token === "string" && parsed.token.trim() ? parsed.token.trim() : null;
+    }
+    if (allowOpaqueJson && parsed.type === "oauth") {
+      return typeof parsed.access === "string" && parsed.access.trim() ? parsed.access.trim() : null;
+    }
+    return allowOpaqueJson ? raw : null;
   } catch {
+    return null;
+  }
+}
+function oauthCredentialStateKey(providerId, authRef) {
+  return `${providerId}${OAUTH_STATE_KEY_SEPARATOR}${authRef}`;
+}
+function clearOAuthCredentialCache(authRef) {
+  const suffix = `${OAUTH_STATE_KEY_SEPARATOR}${authRef}`;
+  for (const key of oauthCredentialCache.keys()) {
+    if (key.endsWith(suffix)) oauthCredentialCache.delete(key);
   }
-  return trimmed;
 }
-async function refreshOAuthStoredCredential(ref, providerId, diag) {
+function cacheOAuthCredential(stateKey, credential) {
+  oauthCredentialCache.set(stateKey, {
+    access: credential.access,
+    expires: credential.expires,
+    ...credential.accessRejected === true ? { accessRejected: true } : {},
+    checkedAt: Date.now()
+  });
+}
+function cachedOAuthCredentialIsUsable(credential, providerId, rejectedAccessToken) {
+  if (!credential) return false;
+  const age = Date.now() - credential.checkedAt;
+  return age >= 0 && age < OAUTH_CREDENTIAL_CACHE_MAX_AGE_MS && credential.access !== rejectedAccessToken && credential.accessRejected !== true && !oauthCredentialShouldRefresh(credential, providerId);
+}
+async function readOAuthProviderSecret(ref, providerId, diag, rejectedAccessToken) {
   const authRef = storedCredentialAuthRef(ref);
-  const existing = oauthRefreshInflight.get(authRef);
-  if (existing) return existing;
+  const stateKey = oauthCredentialStateKey(providerId, authRef);
+  const existing = oauthRefreshInflight.get(stateKey);
+  if (existing) {
+    const resolved = await existing;
+    if (resolved !== rejectedAccessToken) return resolved;
+    return readOAuthProviderSecret(ref, providerId, diag, rejectedAccessToken);
+  }
+  const cached = oauthCredentialCache.get(stateKey);
+  if (cached && cachedOAuthCredentialIsUsable(cached, providerId, rejectedAccessToken)) {
+    return cached.access;
+  }
+  if (cached?.access === rejectedAccessToken) oauthCredentialCache.delete(stateKey);
   const work = withCredentialMutationLock(authRef, async () => {
-    const currentRaw = await readStoredCredential(ref, diag);
-    if (!currentRaw) return null;
-    const cred = parseStoredOAuthCredential(currentRaw);
-    if (!cred || !oauthCredentialShouldRefresh(cred, providerId)) {
-      return decodeProviderSecret(currentRaw);
-    }
-    try {
-      const refreshed = await refreshStoredOAuthCredential(providerId, cred);
-      const json = oauthCredentialToKeychainJson(refreshed);
+    const latestCached = oauthCredentialCache.get(stateKey);
+    if (latestCached && cachedOAuthCredentialIsUsable(latestCached, providerId, rejectedAccessToken)) {
+      return latestCached.access;
+    }
+    for (let generation = 0; generation < 3; generation += 1) {
+      const raw = await readStoredCredential(ref, diag);
+      if (!raw) return null;
+      const cred = parseStoredOAuthCredential(raw);
+      if (!cred) {
+        const decoded = decodeProviderSecret(raw);
+        return decoded === rejectedAccessToken ? null : decoded;
+      }
+      cacheOAuthCredential(stateKey, cred);
+      const forceRefresh = cred.access === rejectedAccessToken || cred.accessRejected === true;
+      if (!forceRefresh && !oauthCredentialShouldRefresh(cred, providerId)) {
+        return cred.access;
+      }
+      let refreshed;
+      try {
+        refreshed = await refreshStoredOAuthCredential(providerId, cred);
+      } catch (err) {
+        diag?.(err instanceof Error ? err.message : String(err));
+        if (!forceRefresh && cred.access && cred.expires > Date.now()) return cred.access;
+        oauthCredentialCache.delete(stateKey);
+        throw err;
+      }
+      const accessStillRejected = rejectedAccessToken !== void 0 && refreshed.access === rejectedAccessToken || cred.accessRejected === true && refreshed.access === cred.access;
+      const currentRaw = await readStoredCredential(ref, diag);
+      if (currentRaw !== raw) {
+        oauthCredentialCache.delete(stateKey);
+        continue;
+      }
+      const credentialToSave = accessStillRejected ? { ...refreshed, accessRejected: true } : refreshed;
+      const json = oauthCredentialToKeychainJson(credentialToSave);
       const saved = await saveProviderCredential(authRef, json, diag);
-      if (!saved) throw new Error("Could not persist refreshed OAuth credential");
+      if (!saved) {
+        oauthCredentialCache.delete(stateKey);
+        throw new Error("Could not persist refreshed OAuth credential");
+      }
+      if (accessStillRejected) {
+        oauthCredentialCache.delete(stateKey);
+        return null;
+      }
       return refreshed.access;
-    } catch (err) {
-      diag?.(err instanceof Error ? err.message : String(err));
-      if (cred.access && cred.expires > Date.now()) return cred.access;
-      throw err;
     }
+    throw new Error("OAuth credential changed repeatedly while refresh was in progress");
+  }, {
+    waitMs: OAUTH_REFRESH_LOCK_WAIT_MS
   });
-  oauthRefreshInflight.set(authRef, work);
+  oauthRefreshInflight.set(stateKey, work);
   try {
     return await work;
   } finally {
-    oauthRefreshInflight.delete(authRef);
+    if (oauthRefreshInflight.get(stateKey) === work) {
+      oauthRefreshInflight.delete(stateKey);
+    }
   }
 }
-async function readProviderSecret(ref, diag) {
-  const raw = await readStoredCredential(ref, diag);
-  if (!raw) return null;
+async function readProviderSecret(ref, diag, rejectedAccessToken) {
   const oauthProviderId = oauthProviderIdFromAccount(ref.account);
-  if (oauthProviderId && raw.trim().startsWith("{")) {
-    return refreshOAuthStoredCredential(ref, oauthProviderId, diag);
+  if (oauthProviderId) {
+    return readOAuthProviderSecret(ref, oauthProviderId, diag, rejectedAccessToken);
   }
-  return decodeProviderSecret(raw);
+  const raw = await readStoredCredential(ref, diag);
+  const decoded = decodeProviderSecret(raw, true);
+  return decoded === rejectedAccessToken ? null : decoded;
 }
 async function saveProviderCredential(authRef, key, diag) {
   const parsed = parseAuthRef(authRef);
   if (!parsed || parsed.kind === "env" || parsed.kind === "none") return false;
   return withCredentialMutationLock(authRef, async () => {
+    const cacheKey = storedCredentialAuthRef(parsed);
+    clearOAuthCredentialCache(cacheKey);
     const written = await writeStoredCredential(parsed, key, diag);
     if (!written) return false;
     const readBack = await readStoredCredential(parsed, diag);
-    if (readBack === key) return true;
+    if (readBack === key) {
+      const oauth = parseStoredOAuthCredential(key);
+      const oauthProviderId = oauthProviderIdFromAccount(parsed.account);
+      if (oauth && oauthProviderId) {
+        cacheOAuthCredential(oauthCredentialStateKey(oauthProviderId, cacheKey), oauth);
+      }
+      return true;
+    }
     diag?.("credential store read-back verification failed");
     return false;
   });
@@ -1379,7 +1530,10 @@ async function probeProviderCredentialStore(authRef, diag) {
 async function deleteProviderCredential(authRef, diag) {
   const parsed = parseAuthRef(authRef);
   if (!parsed || parsed.kind === "env" || parsed.kind === "none") return false;
-  return withCredentialMutationLock(authRef, () => deleteStoredCredential(parsed, diag));
+  return withCredentialMutationLock(authRef, () => {
+    clearOAuthCredentialCache(storedCredentialAuthRef(parsed));
+    return deleteStoredCredential(parsed, diag);
+  });
 }
 
 // src/first-run.ts
@@ -1393,6 +1547,7 @@ import {
   closeSync as closeSync2,
   copyFileSync,
   existsSync,
+  fsyncSync as fsyncSync2,
   mkdirSync as mkdirSync2,
   openSync as openSync2,
   readFileSync as readFileSync3,
@@ -1442,9 +1597,18 @@ function ensureSecureAppHome() {
 function writeSecureFile(path, content) {
   ensureSecureAppHome();
   mkdirSync2(dirname2(path), { recursive: true, mode: DIR_MODE });
-  const fd = openSync2(path, "w", FILE_MODE);
+  const fd = openSync2(path, "wx", FILE_MODE);
   try {
-    writeSync(fd, content);
+    const payload = Buffer.from(content);
+    let offset = 0;
+    while (offset < payload.length) {
+      const written = writeSync(fd, payload, offset, payload.length - offset);
+      if (written <= 0) {
+        throw new Error(`Could not complete secure file write: ${path}`);
+      }
+      offset += written;
+    }
+    fsyncSync2(fd);
   } finally {
     closeSync2(fd);
   }
@@ -1453,6 +1617,18 @@ function writeSecureFile(path, content) {
   } catch {
   }
 }
+function syncParentDirectory(path) {
+  let fd;
+  try {
+    fd = openSync2(dirname2(path), "r");
+    fsyncSync2(fd);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+}
 function parseProvider(raw) {
   if (!raw || typeof raw !== "object") return null;
   const p13 = raw;
@@ -1491,6 +1667,34 @@ function parseProvider(raw) {
   }
   return provider;
 }
+function hasOwn(record, key) {
+  return Object.prototype.hasOwnProperty.call(record, key);
+}
+function hasValidStrictProviderFields(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const provider = raw;
+  if (hasOwn(provider, "subscriptionFilter") && provider.subscriptionFilter !== "free") {
+    return false;
+  }
+  if (hasOwn(provider, "authType") && provider.authType !== "api" && provider.authType !== "oauth" && provider.authType !== "none") {
+    return false;
+  }
+  if (hasOwn(provider, "refreshedAt") && typeof provider.refreshedAt !== "string") {
+    return false;
+  }
+  if (hasOwn(provider, "modelsCache")) {
+    const cache = provider.modelsCache;
+    if (!cache || typeof cache !== "object" || Array.isArray(cache)) return false;
+    const fields = cache;
+    if (typeof fields.fetchedAt !== "string" || !Array.isArray(fields.models)) {
+      return false;
+    }
+    if (fields.models.some((model) => !model || typeof model !== "object" || Array.isArray(model))) {
+      return false;
+    }
+  }
+  return true;
+}
 function parseRegistry(raw) {
   const empty = { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
   if (!raw || typeof raw !== "object") return empty;
@@ -1510,6 +1714,27 @@ function parseRegistry(raw) {
   if (typeof data.pricingCacheAt === "string") registry.pricingCacheAt = data.pricingCacheAt;
   return registry;
 }
+function parseRegistryStrict(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Provider registry must be a JSON object.");
+  }
+  const data = raw;
+  if (data.schemaVersion !== REGISTRY_SCHEMA_VERSION) {
+    throw new Error("Provider registry has an unsupported schema version.");
+  }
+  if (!Array.isArray(data.providers)) {
+    throw new Error("Provider registry is missing its providers list.");
+  }
+  for (const entry of data.providers) {
+    if (!parseProvider(entry) || !hasValidStrictProviderFields(entry)) {
+      throw new Error("Provider registry contains an invalid provider entry.");
+    }
+  }
+  return parseRegistry(raw);
+}
+function readRegistryStrict(path) {
+  return parseRegistryStrict(JSON.parse(readFileSync3(path, "utf8")));
+}
 function loadRegistry(path = getProvidersPath()) {
   ensureLegacyAppHomeMigrated();
   if (!existsSync(path)) {
@@ -1523,7 +1748,7 @@ function loadRegistry(path = getProvidersPath()) {
       try {
         withRegistryWriteLockSync(() => {
           if (!existsSync(path)) return;
-          const current = parseRegistry(JSON.parse(readFileSync3(path, "utf8")));
+          const current = readRegistryStrict(path);
           if (migrateOAuthOpenAiProvider(current)) saveRegistry(current, path);
         }, { lockPath: `${path}.lock` });
       } catch {
@@ -1534,6 +1759,15 @@ function loadRegistry(path = getProvidersPath()) {
     return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
   }
 }
+function loadRegistryStrict(path = getProvidersPath()) {
+  ensureLegacyAppHomeMigrated();
+  if (!existsSync(path)) {
+    return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  }
+  const registry = readRegistryStrict(path);
+  migrateOAuthOpenAiProvider(registry);
+  return registry;
+}
 function saveRegistry(registry, path = getProvidersPath()) {
   assertRegistryWriteOwnership(path);
   const payload = `${JSON.stringify(registry, null, 2)}
@@ -1550,6 +1784,7 @@ function saveRegistry(registry, path = getProvidersPath()) {
     writeSecureFile(tmp, payload);
     assertRegistryWriteOwnership(path);
     renameSync(tmp, path);
+    syncParentDirectory(path);
   } finally {
     try {
       unlinkSync2(tmp);
@@ -2308,7 +2543,7 @@ function enrichPricingAsync(onComplete) {
     const fetched = await fetchPricingCache();
     const cache = fetched ?? loadPricingCache();
     const changed = await withRegistryWriteLock(() => {
-      const registry = loadRegistry();
+      const registry = loadRegistryStrict();
       const updated = applyPricingToRegistryProviders(registry, cache);
       if (updated) saveRegistry(registry);
       return updated;
@@ -2731,13 +2966,12 @@ function providersForPicker(providers) {
   return providers.sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base", numeric: true }));
 }
 async function resolveLocalProviderApiKey(provider) {
-  if (provider.authRef === "none:anonymous") return "anonymous";
+  if (provider.authRef === "none:anonymous" || provider.authType === "none") return "";
   const direct = provider.apiKey?.trim();
   if (direct) return direct;
-  if (provider.authType === "none") return "anonymous";
   const template = getTemplateById(provider.id);
   if (template?.apiKeyOptional || template?.anonymousFreeModels) {
-    return "anonymous";
+    return "";
   }
   const reg = loadRegistry().providers.find((p13) => p13.id === provider.id);
   const authRef = provider.authRef ?? reg?.authRef ?? oauthAuthRef(provider.id);
@@ -2796,6 +3030,7 @@ function localProvidersToServerModels(localProviders) {
       npm: model.modelFormat === "openai" ? model.npm || "@ai-sdk/openai-compatible" : model.npm,
       apiBaseUrl: model.apiBaseUrl,
       apiKey: provider.apiKey,
+      authRef: provider.authRef,
       authType: provider.authType,
       oauthAccountId: provider.oauthAccountId,
       contextWindow: model.contextWindow,
@@ -2810,11 +3045,14 @@ function localProvidersToServerModels(localProviders) {
   );
 }
 
+// src/registry/add-template.ts
+import { randomUUID as randomUUID6 } from "crypto";
+
 // src/provider-factory.ts
 import { wrapLanguageModel, extractReasoningMiddleware } from "ai";
 
 // src/oauth/responses-websocket.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 
 // src/outbound-proxy.ts
@@ -2878,6 +3116,27 @@ async function outboundWsProxyAgent(wsUrl) {
 
 // src/upstream-error.ts
 import { APICallError, RetryError } from "ai";
+var DEFAULT_RETRY_AFTER_SECONDS = 5;
+var MAX_RETRY_AFTER_SECONDS = 60;
+function clampRetryAfterSeconds(value) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    return DEFAULT_RETRY_AFTER_SECONDS;
+  }
+  return Math.min(Math.round(value), MAX_RETRY_AFTER_SECONDS);
+}
+function numericRetryAfterSeconds(inner) {
+  const data = inner.data;
+  const fromBody = data?.error?.retry_after_seconds;
+  if (typeof fromBody === "number" && Number.isFinite(fromBody) && fromBody >= 0) return fromBody;
+  const fromHeader = inner.responseHeaders?.["retry-after"];
+  if (typeof fromHeader === "string" && /^\d+$/.test(fromHeader.trim())) return Number(fromHeader.trim());
+  for (const message of [data?.error?.message, inner.message]) {
+    if (typeof message !== "string") continue;
+    const match = /retry after (\d+)s\b/i.exec(message);
+    if (match) return Number(match[1]);
+  }
+  return void 0;
+}
 function sdkUpstreamErrorDetails(err) {
   const retry = RetryError.isInstance(err) ? err : void 0;
   const inner = retry?.lastError ?? err;
@@ -2889,11 +3148,14 @@ function sdkUpstreamErrorDetails(err) {
     } catch {
     }
   }
+  const rawRetryAfter = inner.statusCode === 429 ? numericRetryAfterSeconds(inner) : void 0;
+  const retryAfterSeconds = rawRetryAfter === void 0 ? void 0 : clampRetryAfterSeconds(rawRetryAfter);
   return {
     statusCode: inner.statusCode,
     errorContent: errorContent || inner.message,
     isRetryable: inner.isRetryable,
-    attemptCount: retry?.errors.length ?? 1
+    attemptCount: retry?.errors.length ?? 1,
+    ...retryAfterSeconds !== void 0 ? { retryAfterSeconds } : {}
   };
 }
 function isContextLengthExceededError(err, formattedMessage = "") {
@@ -3058,7 +3320,7 @@ function hasResponsesLiteHeader(headers) {
 }
 function authorizationHeaderFingerprint(headers) {
   const authorization = Object.entries(headers).find(([key]) => key.toLowerCase() === "authorization")?.[1];
-  return authorization ? createHash3("sha256").update(authorization).digest("hex") : "";
+  return authorization ? createHash4("sha256").update(authorization).digest("hex") : "";
 }
 function bodyToString(body) {
   if (body == null) return "";
@@ -3091,13 +3353,13 @@ function responsesWebSocketPromptFingerprint(payload) {
   delete stable.previous_response_id;
   delete stable.stream;
   delete stable.background;
-  return createHash3("sha256").update(canonicalJson(stable)).digest("hex");
+  return createHash4("sha256").update(canonicalJson(stable)).digest("hex");
 }
 function responsesWebSocketPromptFieldHashes(payload) {
   const hashes = {};
   for (const key of Object.keys(payload).sort()) {
     if (key === "input" || key === "previous_response_id" || key === "stream" || key === "background") continue;
-    hashes[key] = createHash3("sha256").update(canonicalJson(payload[key])).digest("hex").slice(0, 12);
+    hashes[key] = createHash4("sha256").update(canonicalJson(payload[key])).digest("hex").slice(0, 12);
   }
   return hashes;
 }
@@ -3133,7 +3395,7 @@ function responsesWebSocketPartitionKey(wsUrl, payload, options = {}, authorizat
     promptCacheKey,
     authorizationFingerprint
   ].join("");
-  return createHash3("sha256").update(material).digest("hex");
+  return createHash4("sha256").update(material).digest("hex");
 }
 function inputArray(payload) {
   return Array.isArray(payload.input) ? payload.input : [];
@@ -3164,7 +3426,7 @@ function conversationItemKind(value) {
   return "object";
 }
 function conversationItemHash(value) {
-  return createHash3("sha256").update(canonicalJson(normalizeToolCallJson(value))).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(canonicalJson(normalizeToolCallJson(value))).digest("hex").slice(0, 16);
 }
 function continuationMismatchDetails(entry, payload) {
   const full = inputArray(payload);
@@ -3230,7 +3492,7 @@ function diagnosticTextFingerprint(field, value) {
   if (typeof value !== "string" || value.length === 0) return {};
   return {
     [`${field}Bytes`]: Buffer.byteLength(value),
-    [`${field}Hash`]: createHash3("sha256").update(value).digest("hex").slice(0, 16)
+    [`${field}Hash`]: createHash4("sha256").update(value).digest("hex").slice(0, 16)
   };
 }
 function responseFailureDetails(event) {
@@ -3265,7 +3527,7 @@ function emitResponseErrorDiagnostic(entry, ctx, details) {
   emitContextDiagnostic(entry, ctx, { event: "ws_response_error", ...details });
 }
 function diagnosticItemIdHash(value) {
-  return typeof value === "string" && value.length > 0 ? createHash3("sha256").update(value).digest("hex").slice(0, 16) : void 0;
+  return typeof value === "string" && value.length > 0 ? createHash4("sha256").update(value).digest("hex").slice(0, 16) : void 0;
 }
 function reasoningPartIndex(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
@@ -3500,7 +3762,7 @@ function deleteEntry(entry, closeSocket = true) {
     }
   }
 }
-function failContext(entry, ctx, message, diagnosticDetails, statusCode) {
+function failContext(entry, ctx, message, diagnosticDetails, statusCode, retryAfterSeconds) {
   if (ctx.closed || entry.current !== ctx) return;
   entry.debug(`fail: ${message}`);
   emitResponseErrorDiagnostic(entry, ctx, {
@@ -3515,12 +3777,64 @@ function failContext(entry, ctx, message, diagnosticDetails, statusCode) {
       type: statusCode === void 0 ? "transport_error" : anthropicErrorType(statusCode),
       code: statusCode === void 0 ? "websocket_transport_error" : String(statusCode),
       message,
-      param: null
+      param: null,
+      ...retryAfterSeconds !== void 0 ? { retry_after_seconds: retryAfterSeconds } : {}
     }
   });
   deleteEntry(entry);
   closeContext(ctx);
 }
+function retryTransportFailure(entry, ctx, diagnosticDetails) {
+  if (ctx.closed || entry.current !== ctx || ctx.retried || ctx.frameCount !== 0 || ctx.emittedModelData) {
+    return false;
+  }
+  ctx.retried = true;
+  ctx.transportRetryPending = true;
+  entry.debug("transport failed before any response frame; retrying once with full context");
+  emitContextDiagnostic(entry, ctx, {
+    event: "ws_transport_retry",
+    outcome: "started",
+    ...diagnosticDetails
+  });
+  deleteEntry(entry);
+  if (ctx.closed) {
+    ctx.transportRetryPending = false;
+    entry.debug("transport retry cancelled before replacement");
+    emitContextDiagnostic(entry, ctx, {
+      event: "ws_transport_retry",
+      outcome: "cancelled"
+    });
+    return true;
+  }
+  resetContextForRetry(ctx);
+  const replacement = ctx.createReplacement();
+  if (ctx.closed) {
+    ctx.transportRetryPending = false;
+    deleteEntry(replacement);
+    replacement.debug("transport retry cancelled while creating replacement");
+    emitContextDiagnostic(replacement, ctx, {
+      event: "ws_transport_retry",
+      outcome: "cancelled"
+    });
+    return true;
+  }
+  dispatchContext(replacement, ctx);
+  return true;
+}
+function handleTransportFailure(entry, ctx, message, diagnosticDetails) {
+  if (retryTransportFailure(entry, ctx, diagnosticDetails)) return;
+  if (ctx.closed || entry.current !== ctx) return;
+  if (ctx.retried && ctx.frameCount === 0 && !ctx.emittedModelData) {
+    ctx.transportRetryPending = false;
+    entry.debug("transport retry exhausted before any response frame");
+    emitContextDiagnostic(entry, ctx, {
+      event: "ws_transport_retry",
+      outcome: "exhausted",
+      ...diagnosticDetails
+    });
+  }
+  failContext(entry, ctx, message, diagnosticDetails);
+}
 function cleanupExpiredConnections(now) {
   const evictions = [];
   for (const entry of connectionEntries()) {
@@ -3568,7 +3882,27 @@ function sendContext(entry, ctx) {
   entry.debug(
     `connection=${entry.debugId} key=${debugKey(entry.key)} sending ${outgoing.length}B payload` + (ctx.continued ? " (continuation)" : "")
   );
-  entry.socket.send(outgoing);
+  try {
+    entry.socket.send(outgoing, (error) => {
+      if (!error) return;
+      handleTransportFailure(entry, ctx, error.message, {
+        source: "socket_send",
+        failureMode: "callback",
+        socketErrorName: boundedDiagnosticIdentifier(error.name),
+        socketErrorCode: boundedDiagnosticIdentifier(error.code),
+        ...diagnosticTextFingerprint("errorMessage", error.message)
+      });
+    });
+  } catch (error) {
+    const failure = error instanceof Error ? error : new Error("WebSocket send failed");
+    handleTransportFailure(entry, ctx, failure.message, {
+      source: "socket_send",
+      failureMode: "synchronous",
+      socketErrorName: boundedDiagnosticIdentifier(failure.name),
+      socketErrorCode: boundedDiagnosticIdentifier(failure.code),
+      ...diagnosticTextFingerprint("errorMessage", failure.message)
+    });
+  }
 }
 function dispatchContext(entry, ctx) {
   const now = entry.options.now();
@@ -3601,6 +3935,14 @@ function handleSocketMessage(entry, data) {
   if (!ctx || ctx.closed) return;
   const text4 = Array.isArray(data) ? Buffer.concat(data).toString("utf8") : data.toString("utf8");
   ctx.frameCount += 1;
+  if (ctx.transportRetryPending) {
+    ctx.transportRetryPending = false;
+    entry.debug("transport retry received its first response frame");
+    emitContextDiagnostic(entry, ctx, {
+      event: "ws_transport_retry",
+      outcome: "recovered"
+    });
+  }
   let event;
   try {
     event = JSON.parse(text4);
@@ -3675,6 +4017,10 @@ function handleSocketMessage(entry, data) {
     closeContext(ctx);
   }
 }
+function numericRetryAfterHeader(value) {
+  const single = Array.isArray(value) ? value[0] : value;
+  return typeof single === "string" && /^\d+$/.test(single.trim()) ? Number(single.trim()) : void 0;
+}
 function createConnection(WebSocket, wsUrl, headers, persistent, key, options, debug, agent) {
   const now = options.now();
   const socket = new WebSocket(wsUrl, agent ? { headers, agent } : { headers });
@@ -3708,24 +4054,39 @@ function createConnection(WebSocket, wsUrl, headers, persistent, key, options, d
     debug(`unexpected-response status=${statusCode}`);
     response.resume();
     const ctx = entry.current;
-    if (ctx && !ctx.closed) {
-      failContext(entry, ctx, `WebSocket upgrade failed (HTTP ${statusCode})`, {
-        source: "unexpected_response",
-        httpStatusCode: statusCode
-      }, statusCode);
-    } else {
+    if (!ctx || ctx.closed) {
       deleteEntry(entry);
+      return;
     }
+    if (statusCode === 403) {
+      const retryAfterSeconds = clampRetryAfterSeconds(
+        numericRetryAfterHeader(response.headers["retry-after"])
+      );
+      failContext(entry, ctx, `OpenAI edge throttled the Responses WebSocket upgrade (HTTP 403); retry after ${retryAfterSeconds}s`, {
+        source: "unexpected_response",
+        httpStatusCode: statusCode,
+        mappedStatusCode: 429,
+        retryAfterSeconds
+      }, 429, retryAfterSeconds);
+      return;
+    }
+    failContext(entry, ctx, `WebSocket upgrade failed (HTTP ${statusCode})`, {
+      source: "unexpected_response",
+      httpStatusCode: statusCode
+    }, statusCode);
   });
   socket.on("message", (data) => handleSocketMessage(entry, data));
   socket.on("error", (error) => {
     const ctx = entry.current;
-    if (ctx) failContext(entry, ctx, error.message, {
-      source: "socket_error",
-      socketErrorName: boundedDiagnosticIdentifier(error.name),
-      socketErrorCode: boundedDiagnosticIdentifier(error.code)
-    });
-    else deleteEntry(entry);
+    if (ctx) {
+      const details = {
+        source: "socket_error",
+        socketErrorName: boundedDiagnosticIdentifier(error.name),
+        socketErrorCode: boundedDiagnosticIdentifier(error.code),
+        ...diagnosticTextFingerprint("errorMessage", error.message)
+      };
+      handleTransportFailure(entry, ctx, error.message, details);
+    } else deleteEntry(entry);
   });
   socket.on("close", (code, reason) => {
     entry.open = false;
@@ -3734,7 +4095,7 @@ function createConnection(WebSocket, wsUrl, headers, persistent, key, options, d
     if (ctx && !ctx.closed) {
       const reasonText = reason?.length ? reason.toString("utf8") : "";
       const suffix = reasonText ? `: ${reasonText}` : "";
-      failContext(entry, ctx, `WebSocket closed (${code})${suffix}`, {
+      handleTransportFailure(entry, ctx, `WebSocket closed (${code})${suffix}`, {
         source: "socket_close",
         closeCode: code,
         ...diagnosticTextFingerprint("closeReason", reasonText)
@@ -3852,7 +4213,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       keyTuple: {
         wsUrl,
         providerId: options.providerId ?? "openai",
-        accountIdHash: options.accountId ? createHash3("sha256").update(options.accountId).digest("hex").slice(0, 16) : "",
+        accountIdHash: options.accountId ? createHash4("sha256").update(options.accountId).digest("hex").slice(0, 16) : "",
         model: typeof payload.model === "string" ? payload.model : void 0,
         effort: typeof payload.reasoning?.effort === "string" ? String(payload.reasoning.effort).trim().toLowerCase() : "",
         promptCacheKey: typeof payload.prompt_cache_key === "string" ? payload.prompt_cache_key : void 0
@@ -3909,6 +4270,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
           frameCount: 0,
           pendingEvents: [],
           emittedModelData: false,
+          transportRetryPending: false,
           outputByIndex: /* @__PURE__ */ new Map(),
           outputIndexByItemId: /* @__PURE__ */ new Map(),
           reasoningPartsByItemId: /* @__PURE__ */ new Map(),
@@ -3919,7 +4281,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
             WebSocket,
             wsUrl,
             headers,
-            Boolean(partitionKey),
+            persistent,
             partitionKey,
             resolvedOptions,
             debug,
@@ -3967,7 +4329,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
 }
 
 // src/oauth/claude-identity.ts
-import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID4 } from "crypto";
 var CLAUDE_CODE_CLI_VERSION = "2.1.195";
 var CLAUDE_CODE_USER_AGENT = `claude-cli/${CLAUDE_CODE_CLI_VERSION} (external, cli)`;
 var CLAUDE_CODE_ENTRYPOINT = process.env.CLAUDE_CODE_ENTRYPOINT ?? "cli";
@@ -3982,7 +4344,7 @@ function getOrCreateSessionId(seed) {
   return id;
 }
 function uuidFromHash(input) {
-  const h = createHash4("sha256").update(input).digest("hex");
+  const h = createHash5("sha256").update(input).digest("hex");
   return [
     h.slice(0, 8),
     h.slice(8, 12),
@@ -3996,7 +4358,7 @@ var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function resolveCliUserID(providerData, seed) {
   const v = providerData?.cliUserID;
   if (typeof v === "string" && HEX64_RE.test(v)) return v;
-  return createHash4("sha256").update(`cliUserID:${seed}`).digest("hex");
+  return createHash5("sha256").update(`cliUserID:${seed}`).digest("hex");
 }
 function resolveAccountUUID(providerData, seed) {
   const v = providerData?.accountUUID;
@@ -4080,6 +4442,12 @@ function injectClaudeIdentity(body, providerData, seed) {
   return { sessionId, userId };
 }
 
+// src/credential-headers.ts
+var CREDENTIAL_BEARING_HEADER = /(?:^|[-_])(?:authorization|api[-_]?key|cookie|token|secret|credential)(?:$|[-_])/i;
+function isCredentialBearingHeader(name) {
+  return CREDENTIAL_BEARING_HEADER.test(name);
+}
+
 // src/provider-factory.ts
 var RESPONSES_ONLY_PREFIXES = [
   "gpt-5-codex",
@@ -4089,6 +4457,15 @@ var RESPONSES_ONLY_PREFIXES = [
   "o4"
 ];
 var factoryCache = /* @__PURE__ */ new Map();
+var fetchWithoutCredentialHeaders = (input, init) => {
+  const headers = new Headers(
+    init?.headers ?? (input instanceof Request ? input.headers : void 0)
+  );
+  for (const name of [...headers.keys()]) {
+    if (isCredentialBearingHeader(name)) headers.delete(name);
+  }
+  return fetch(input, { ...init, headers });
+};
 function modelPrefersResponsesApi(modelId) {
   const lower = modelId.toLowerCase();
   if (RESPONSES_ONLY_PREFIXES.some((prefix) => lower === prefix || lower.startsWith(`${prefix}-`))) {
@@ -4153,6 +4530,7 @@ async function createLanguageModel(spec) {
       apiKey,
       baseURL: "https://chatgpt.com/backend-api/codex",
       headers: {
+        ...spec.headers,
         ...accountId ? { "ChatGPT-Account-Id": accountId } : {},
         originator: "clodex",
         // Responses-Lite models (backend prefer_websockets/use_responses_lite,
@@ -4170,7 +4548,11 @@ async function createLanguageModel(spec) {
           onDiagnostic: spec.onWebSocketDiagnostic
         })
       } : {}
-    } : { apiKey };
+    } : spec.authType === "none" ? {
+      apiKey: "",
+      ...spec.headers ? { headers: spec.headers } : {},
+      fetch: fetchWithoutCredentialHeaders
+    } : { apiKey, ...spec.headers ? { headers: spec.headers } : {} };
     const openai = createOpenAI(oauthOptions);
     return useResponsesEndpoint ? openai.responses(modelId) : openai.chat(modelId);
   }
@@ -4190,7 +4572,7 @@ async function createLanguageModel(spec) {
           ).sessionId
         }
       } : {}
-    } : { apiKey };
+    } : spec.authType === "none" ? { apiKey: "", fetch: fetchWithoutCredentialHeaders } : { apiKey };
     if (spec.headers) {
       anthropicOptions.headers = { ...anthropicOptions.headers, ...spec.headers };
     }
@@ -4206,7 +4588,8 @@ async function createLanguageModel(spec) {
     const options = {
       name: spec.providerId ?? "openai-compatible",
       baseURL: baseURL ?? "",
-      ...apiKey.trim() ? { apiKey } : {},
+      ...spec.authType !== "none" && apiKey.trim() ? { apiKey } : {},
+      ...spec.authType === "none" ? { fetch: fetchWithoutCredentialHeaders } : {},
       ...spec.headers ? { headers: spec.headers } : {}
     };
     model = createOpenAICompatible({
@@ -4215,7 +4598,8 @@ async function createLanguageModel(spec) {
   } else {
     const create = await loadSdkProviderFactory(npm);
     const provider = create({
-      apiKey,
+      apiKey: spec.authType === "none" ? "" : apiKey,
+      ...spec.authType === "none" ? { fetch: fetchWithoutCredentialHeaders } : {},
       ...baseURL ? { baseURL } : {},
       ...spec.headers ? { headers: spec.headers } : {}
     });
@@ -4696,20 +5080,331 @@ function thinkingProviderOptions(npm) {
   return void 0;
 }
 
-// src/trace-log.ts
+// src/registry/credential-cleanup-journal.ts
+import { randomUUID as randomUUID5 } from "crypto";
 import {
-  chmodSync as chmodSync4,
+  closeSync as closeSync3,
   existsSync as existsSync4,
+  fstatSync as fstatSync2,
+  fsyncSync as fsyncSync3,
+  lstatSync,
   mkdirSync as mkdirSync5,
+  openSync as openSync3,
   readFileSync as readFileSync6,
+  renameSync as renameSync2,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync4
 } from "fs";
-import { createHash as createHash5 } from "crypto";
-import { join as join4 } from "path";
-import pc2 from "picocolors";
+import { dirname as dirname5 } from "path";
+var JOURNAL_SCHEMA_VERSION = 1;
 var DIR_MODE2 = 448;
 var FILE_MODE4 = 384;
+var MAX_JOURNAL_BYTES = 1024 * 1024;
+var MAX_PENDING_CREDENTIAL_DELETES = 1024;
+var MAX_CREDENTIAL_REF_BYTES = 4096;
+var CREDENTIAL_INSTANCE_SEPARATOR = "::credential::";
+var CREDENTIAL_INSTANCE_PATTERN = /^v1:[0-9a-f]{32}$/;
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function emptyJournal() {
+  return {
+    schemaVersion: JOURNAL_SCHEMA_VERSION,
+    pendingCredentialDeletes: []
+  };
+}
+function isStoredCredentialRef(value) {
+  const parsed = parseAuthRef(value);
+  return (parsed?.kind === "keyring" || parsed?.kind === "helper") && isManagedCredentialAccount(parsed.account);
+}
+function credentialAccountBase(account) {
+  const separatorIndex = account.lastIndexOf(CREDENTIAL_INSTANCE_SEPARATOR);
+  if (separatorIndex === -1) return account;
+  if (separatorIndex === 0 || account.indexOf(CREDENTIAL_INSTANCE_SEPARATOR) !== separatorIndex || !CREDENTIAL_INSTANCE_PATTERN.test(
+    account.slice(separatorIndex + CREDENTIAL_INSTANCE_SEPARATOR.length)
+  )) {
+    return null;
+  }
+  return account.slice(0, separatorIndex);
+}
+function isManagedCredentialAccount(account) {
+  const base = credentialAccountBase(account);
+  if (!base) return false;
+  const oauth = /^oauth:provider:(.+)$/.exec(base);
+  if (oauth) return isValidProviderId(oauth[1]);
+  const provider = /^provider:([^:]+)(?::(.+))?$/.exec(base);
+  if (!provider || !isValidProviderId(provider[1])) return false;
+  const suffix = provider[2];
+  if (!suffix) return true;
+  if (UUID_PATTERN.test(suffix)) return true;
+  return suffix.startsWith("replacement:") && UUID_PATTERN.test(suffix.slice("replacement:".length));
+}
+function normalizePendingCredentialDeletes(raw) {
+  if (raw.length > MAX_PENDING_CREDENTIAL_DELETES) {
+    throw new Error("Credential cleanup journal contains too many pending entries.");
+  }
+  const pending = [];
+  for (const [index, value] of raw.entries()) {
+    if (typeof value !== "string" || Buffer.byteLength(value) > MAX_CREDENTIAL_REF_BYTES || !isStoredCredentialRef(value)) {
+      throw new Error(`Credential cleanup journal has an invalid entry at index ${index}.`);
+    }
+    if (!pending.includes(value)) pending.push(value);
+  }
+  return pending;
+}
+function parseJournal(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Credential cleanup journal must be a JSON object.");
+  }
+  const data = raw;
+  if (data.schemaVersion !== JOURNAL_SCHEMA_VERSION) {
+    throw new Error("Unsupported credential cleanup journal schema.");
+  }
+  if (!Array.isArray(data.pendingCredentialDeletes)) {
+    throw new Error("Credential cleanup journal is missing its pending list.");
+  }
+  return {
+    schemaVersion: JOURNAL_SCHEMA_VERSION,
+    pendingCredentialDeletes: normalizePendingCredentialDeletes(
+      data.pendingCredentialDeletes
+    )
+  };
+}
+function readJournalUnlocked(path) {
+  if (!existsSync4(path)) return emptyJournal();
+  let fd;
+  try {
+    const before = lstatSync(path);
+    if (before.isSymbolicLink() || !before.isFile()) {
+      throw new Error("Credential cleanup journal must be a regular file.");
+    }
+    fd = openSync3(path, "r");
+    const opened = fstatSync2(fd);
+    if (before.dev !== opened.dev || before.ino !== opened.ino) {
+      throw new Error("Credential cleanup journal changed while opening.");
+    }
+    if (typeof process.getuid === "function") {
+      if (opened.uid !== process.getuid()) {
+        throw new Error("Credential cleanup journal is owned by another user.");
+      }
+      if ((opened.mode & 63) !== 0) {
+        throw new Error("Credential cleanup journal permissions are too broad.");
+      }
+    }
+    if (opened.size > MAX_JOURNAL_BYTES) {
+      throw new Error("Credential cleanup journal is too large.");
+    }
+    return parseJournal(JSON.parse(readFileSync6(fd, "utf8")));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Could not read credential cleanup journal: ${message}`);
+  } finally {
+    if (fd !== void 0) closeSync3(fd);
+  }
+}
+function syncParentDirectory2(path) {
+  let fd;
+  try {
+    fd = openSync3(dirname5(path), "r");
+    fsyncSync3(fd);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
+  } finally {
+    if (fd !== void 0) closeSync3(fd);
+  }
+}
+function writeJournalUnlocked(journal, path) {
+  assertRegistryWriteOwnership(path);
+  ensureSecureAppHome();
+  mkdirSync5(dirname5(path), { recursive: true, mode: DIR_MODE2 });
+  const tmp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
+  let fd;
+  try {
+    fd = openSync3(tmp, "wx", FILE_MODE4);
+    writeFileSync4(fd, `${JSON.stringify(journal, null, 2)}
+`);
+    fsyncSync3(fd);
+    closeSync3(fd);
+    fd = void 0;
+    assertRegistryWriteOwnership(path);
+    renameSync2(tmp, path);
+    syncParentDirectory2(path);
+  } finally {
+    if (fd !== void 0) closeSync3(fd);
+    try {
+      unlinkSync3(tmp);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+function journalLockPath(path) {
+  return `${path}.lock`;
+}
+async function loadPendingCredentialDeletes(path = getCredentialCleanupPath()) {
+  ensureLegacyAppHomeMigrated();
+  return withRegistryWriteLock(
+    () => [...readJournalUnlocked(path).pendingCredentialDeletes],
+    { lockPath: journalLockPath(path) }
+  );
+}
+async function updatePendingCredentialDeletes(update, path = getCredentialCleanupPath()) {
+  ensureLegacyAppHomeMigrated();
+  return withRegistryWriteLock(() => {
+    const journal = readJournalUnlocked(path);
+    const before = [...journal.pendingCredentialDeletes];
+    const after = normalizePendingCredentialDeletes(update(before));
+    if (after.length !== before.length || after.some((value, index) => value !== before[index])) {
+      writeJournalUnlocked(
+        {
+          schemaVersion: JOURNAL_SCHEMA_VERSION,
+          pendingCredentialDeletes: after
+        },
+        path
+      );
+    }
+    return { before, after };
+  }, { lockPath: journalLockPath(path) });
+}
+async function queueCredentialDelete(authRef) {
+  if (!isStoredCredentialRef(authRef)) return false;
+  const result = await updatePendingCredentialDeletes((pending) => pending.includes(authRef) ? pending : [...pending, authRef]);
+  return result.after.includes(authRef);
+}
+async function cancelCredentialDelete(authRef) {
+  const result = await updatePendingCredentialDeletes((pending) => pending.filter((candidate) => candidate !== authRef));
+  return result.before.includes(authRef) && !result.after.includes(authRef);
+}
+
+// src/registry/credential-lifecycle.ts
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function appendError(errors, context, error) {
+  errors.push(`${context}: ${errorMessage(error)}`);
+}
+function credentialIsReferenced(registry, authRef) {
+  return registry.providers.some((provider) => provider.authRef === authRef);
+}
+async function journalCredentialWrite(authRef) {
+  if (!await queueCredentialDelete(authRef)) {
+    throw new Error("Credential reference is not managed by Clodex.");
+  }
+}
+async function reconcilePendingCredentialDelete(authRef) {
+  if (!isStoredCredentialRef(authRef)) {
+    try {
+      await cancelCredentialDelete(authRef);
+      return { deleted: false, cleared: true };
+    } catch (error) {
+      return {
+        deleted: false,
+        cleared: false,
+        persistenceError: errorMessage(error)
+      };
+    }
+  }
+  try {
+    return await withCredentialMutationLock(authRef, async () => {
+      try {
+        const clearedReferencedMarker = await withRegistryWriteLock(async () => {
+          if (!credentialIsReferenced(loadRegistryStrict(), authRef)) return false;
+          await cancelCredentialDelete(authRef);
+          return true;
+        });
+        if (clearedReferencedMarker) {
+          return { deleted: false, cleared: true };
+        }
+      } catch (error) {
+        return {
+          deleted: false,
+          cleared: false,
+          persistenceError: errorMessage(error)
+        };
+      }
+      let deleted = false;
+      try {
+        deleted = await deleteProviderCredential(authRef);
+      } catch {
+        deleted = false;
+      }
+      if (!deleted) return { deleted: false, cleared: false };
+      try {
+        await cancelCredentialDelete(authRef);
+        return { deleted: true, cleared: true };
+      } catch (error) {
+        return {
+          deleted: true,
+          cleared: false,
+          persistenceError: errorMessage(error)
+        };
+      }
+    });
+  } catch (error) {
+    return {
+      deleted: false,
+      cleared: false,
+      persistenceError: errorMessage(error)
+    };
+  }
+}
+async function reconcilePendingCredentialDeletes() {
+  let queued;
+  try {
+    queued = await loadPendingCredentialDeletes();
+  } catch (error) {
+    return {
+      deleted: [],
+      pending: [],
+      persistenceError: `Could not read pending credential cleanup: ${errorMessage(error)}`
+    };
+  }
+  const knownPending = new Set(queued);
+  const deleted = [];
+  const errors = [];
+  for (const authRef of queued) {
+    let result;
+    try {
+      result = await reconcilePendingCredentialDelete(authRef);
+    } catch (error) {
+      result = {
+        deleted: false,
+        cleared: false,
+        persistenceError: errorMessage(error)
+      };
+    }
+    if (result.deleted) deleted.push(authRef);
+    if (result.cleared) knownPending.delete(authRef);
+    if (result.persistenceError) {
+      appendError(errors, `Cleanup for ${authRef}`, result.persistenceError);
+    }
+  }
+  let pending = [...knownPending];
+  try {
+    pending = await loadPendingCredentialDeletes();
+  } catch (error) {
+    appendError(errors, "Could not confirm pending credential cleanup", error);
+  }
+  return {
+    deleted,
+    pending,
+    ...errors.length > 0 ? { persistenceError: errors.join("; ") } : {}
+  };
+}
+
+// src/trace-log.ts
+import {
+  chmodSync as chmodSync4,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { createHash as createHash6 } from "crypto";
+import { join as join4 } from "path";
+import pc2 from "picocolors";
+var DIR_MODE3 = 448;
+var FILE_MODE5 = 384;
 var CLAUDE_DEBUG_LOG = "claude-debug.log";
 var PROXY_DEBUG_LOG = "proxy-debug.log";
 var PROVIDER_DEBUG_LOG = "provider-debug.log";
@@ -4723,9 +5418,9 @@ function safeClaudeSessionId(value) {
 }
 function ensureLogsDir() {
   const dir = getLogsPath();
-  mkdirSync5(dir, { recursive: true, mode: DIR_MODE2 });
+  mkdirSync6(dir, { recursive: true, mode: DIR_MODE3 });
   try {
-    chmodSync4(dir, DIR_MODE2);
+    chmodSync4(dir, DIR_MODE3);
   } catch {
   }
   return dir;
@@ -4748,9 +5443,9 @@ function getInferenceRequestLogPath() {
 }
 function getSessionLogPath(label = "session", extension = "log") {
   const dir = join4(ensureLogsDir(), INFERENCE_SESSION_DIR);
-  mkdirSync5(dir, { recursive: true, mode: DIR_MODE2 });
+  mkdirSync6(dir, { recursive: true, mode: DIR_MODE3 });
   try {
-    chmodSync4(dir, DIR_MODE2);
+    chmodSync4(dir, DIR_MODE3);
   } catch {
   }
   const safeLabel = label.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "proxy";
@@ -4822,7 +5517,6 @@ function getLatestMessagePreview(messages, system) {
   return compactLogValue(preview, REQUEST_PREVIEW_MAX + 20);
 }
 var REDACTED_DIAGNOSTIC_HEADER = "[REDACTED]";
-var SENSITIVE_DIAGNOSTIC_HEADER = /(?:^|[-_])(?:authorization|api[-_]?key|cookie|token|secret|credential)(?:$|[-_])/i;
 var CONVERSATION_BODY_FIELDS = /* @__PURE__ */ new Set(["system", "messages", "tools"]);
 function canonicalDiagnosticValue(value) {
   if (Array.isArray(value)) return value.map(canonicalDiagnosticValue);
@@ -4832,7 +5526,7 @@ function canonicalDiagnosticValue(value) {
   );
 }
 function diagnosticHash(value) {
-  return createHash5("sha256").update(JSON.stringify(canonicalDiagnosticValue(value)) ?? "undefined").digest("hex").slice(0, 16);
+  return createHash6("sha256").update(JSON.stringify(canonicalDiagnosticValue(value)) ?? "undefined").digest("hex").slice(0, 16);
 }
 function diagnosticBytes(value) {
   return Buffer.byteLength(JSON.stringify(value) ?? "");
@@ -4841,7 +5535,7 @@ function sanitizeDiagnosticHeaders(headers) {
   const out = {};
   for (const [name, value] of Object.entries(headers).sort(([left], [right]) => left.localeCompare(right))) {
     if (value === void 0) continue;
-    out[name.toLowerCase()] = SENSITIVE_DIAGNOSTIC_HEADER.test(name) ? REDACTED_DIAGNOSTIC_HEADER : value;
+    out[name.toLowerCase()] = isCredentialBearingHeader(name) ? REDACTED_DIAGNOSTIC_HEADER : value;
   }
   return out;
 }
@@ -5011,9 +5705,9 @@ function makeTraceLogger(logPath) {
 }
 function resetTraceLog(path) {
   ensureLogsDir();
-  if (existsSync4(path)) {
+  if (existsSync5(path)) {
     try {
-      unlinkSync3(path);
+      unlinkSync4(path);
     } catch {
     }
   }
@@ -5043,15 +5737,15 @@ function writeSecureLogLine(path, line) {
   ensureLogsDir();
   const redacted = redactTraceLine(line);
   try {
-    writeFileSync4(path, `${redacted}
-`, { flag: "a", mode: FILE_MODE4 });
-    chmodSync4(path, FILE_MODE4);
+    writeFileSync5(path, `${redacted}
+`, { flag: "a", mode: FILE_MODE5 });
+    chmodSync4(path, FILE_MODE5);
   } catch {
   }
 }
 function printTraceLog(debugLogPath) {
-  if (!existsSync4(debugLogPath)) return;
-  const raw = readFileSync6(debugLogPath, "utf8");
+  if (!existsSync5(debugLogPath)) return;
+  const raw = readFileSync7(debugLogPath, "utf8");
   const log12 = redactTraceLog(raw);
   const errorLines = log12.split("\n").filter(
     (l) => l.includes("error") || l.includes("Error") || l.includes('"type":"error"') || l.includes("status") || l.includes("resolveModel failed") || l.includes("resolveModel fallback")
@@ -5289,19 +5983,22 @@ async function addProviderFromTemplate(template, apiKey, opts) {
   if (!trimmedKey && !template.apiKeyOptional) {
     return { added: false, error: "API key cannot be empty." };
   }
-  const existingError = await withRegistryWriteLock(() => {
-    const registry = loadRegistry();
+  const existingState = await withRegistryWriteLock(() => {
+    const registry = loadRegistryStrict();
     const existing = registry.providers.find((p13) => p13.id === template.id);
     if (existing && !opts?.replaceExisting) {
       return {
-        added: false,
-        error: `${template.name} is already configured.`,
-        hint: `Remove it first with: clodex providers remove ${template.id}`
+        existing: false,
+        error: {
+          added: false,
+          error: `${template.name} is already configured.`,
+          hint: `Remove it first with: clodex providers remove ${template.id}`
+        }
       };
     }
-    return null;
+    return { existing: existing !== void 0, error: null };
   });
-  if (existingError) return existingError;
+  if (existingState.error) return existingState.error;
   const fetched = await fetchTemplateModels(template, trimmedKey, opts?.baseUrl);
   if (fetched.error || fetched.models.length === 0) {
     return {
@@ -5325,9 +6022,11 @@ async function addProviderFromTemplate(template, apiKey, opts) {
     buildPricingIndex(pricingCache),
     platform
   );
-  const authRef = trimmedKey ? credentialAuthRef(`provider:${template.id}`) : "none:anonymous";
-  const commitProvider = () => withRegistryWriteLock(() => {
-    const registry = loadRegistry();
+  const authRef = trimmedKey ? credentialAuthRef(
+    existingState.existing ? `provider:${template.id}:replacement:${randomUUID6()}` : `provider:${template.id}`
+  ) : "none:anonymous";
+  const commitProvider = () => withRegistryWriteLock(async () => {
+    const registry = loadRegistryStrict();
     const existing = registry.providers.find((p13) => p13.id === template.id);
     if (existing && !opts?.replaceExisting) {
       return {
@@ -5362,12 +6061,28 @@ async function addProviderFromTemplate(template, apiKey, opts) {
     } else {
       registry.providers.push(entry);
     }
+    if (existing?.authRef && existing.authRef !== authRef) {
+      await queueCredentialDelete(existing.authRef);
+    }
     saveRegistry(registry);
-    return { added: true, provider: entry, modelCount: pricedModels.length };
+    let credentialCleanupPending = false;
+    if (trimmedKey) {
+      try {
+        await cancelCredentialDelete(authRef);
+      } catch {
+        credentialCleanupPending = true;
+      }
+    }
+    return {
+      added: true,
+      provider: entry,
+      modelCount: pricedModels.length,
+      ...credentialCleanupPending ? { credentialCleanupPending: true } : {}
+    };
   });
   const result = trimmedKey ? await withCredentialMutationLock(authRef, async () => {
-    const commitError = await withRegistryWriteLock(() => {
-      const registry = loadRegistry();
+    const prepareError = await withRegistryWriteLock(() => {
+      const registry = loadRegistryStrict();
       const existing = registry.providers.find((p13) => p13.id === template.id);
       if (existing && !opts?.replaceExisting) {
         return {
@@ -5378,7 +6093,8 @@ async function addProviderFromTemplate(template, apiKey, opts) {
       }
       return null;
     });
-    if (commitError) return commitError;
+    if (prepareError) return prepareError;
+    await journalCredentialWrite(authRef);
     const saved = await saveProviderCredential(authRef, trimmedKey);
     if (!saved) {
       return {
@@ -5389,17 +6105,30 @@ async function addProviderFromTemplate(template, apiKey, opts) {
     }
     return commitProvider();
   }) : await commitProvider();
+  if (result.added) {
+    try {
+      const cleanup = await reconcilePendingCredentialDeletes();
+      result.credentialCleanupPending = cleanup.pending.length > 0 || cleanup.persistenceError !== void 0;
+    } catch {
+      result.credentialCleanupPending = true;
+    }
+  } else {
+    try {
+      const cleanup = await reconcilePendingCredentialDeletes();
+      result.credentialCleanupPending = cleanup.pending.length > 0 || cleanup.persistenceError !== void 0;
+    } catch {
+      result.credentialCleanupPending = true;
+    }
+  }
+  result.credentialCleanupReconciled = true;
   if (result.added) enrichPricingAsync();
   return result;
 }
 
 // src/registry/crud.ts
-function credentialStillReferenced(authRef, remaining) {
-  return remaining.some((p13) => p13.authRef === authRef);
-}
 async function removeProviderFromRegistry(id, opts) {
-  const removal = await withRegistryWriteLock(() => {
-    const registry = loadRegistry();
+  const removal = await withRegistryWriteLock(async () => {
+    const registry = loadRegistryStrict();
     const index = registry.providers.findIndex((p13) => p13.id === id);
     if (index < 0) {
       return {
@@ -5409,10 +6138,11 @@ async function removeProviderFromRegistry(id, opts) {
           credentialDeleted: false,
           error: `Provider not found: ${id}`
         },
-        authRefToDelete: null
+        authRef: null
       };
     }
     const [removedProvider] = registry.providers.splice(index, 1);
+    const cleanupQueued = opts?.deleteCredential !== false ? await queueCredentialDelete(removedProvider.authRef) : false;
     saveRegistry(registry);
     return {
       result: {
@@ -5421,30 +6151,24 @@ async function removeProviderFromRegistry(id, opts) {
         name: removedProvider.name,
         credentialDeleted: false
       },
-      authRefToDelete: opts?.deleteCredential !== false && !credentialStillReferenced(removedProvider.authRef, registry.providers) ? removedProvider.authRef : null
+      authRef: cleanupQueued ? removedProvider.authRef : null
     };
   });
-  const authRefToDelete = removal.authRefToDelete;
-  if (authRefToDelete) {
-    await withCredentialMutationLock(authRefToDelete, async () => {
-      const referencedAgain = await withRegistryWriteLock(() => credentialStillReferenced(
-        authRefToDelete,
-        loadRegistry().providers
-      ));
-      if (referencedAgain) return;
-      removal.result.credentialDeleted = await deleteProviderCredential(
-        authRefToDelete
-      );
-      if (!removal.result.credentialDeleted) {
-        removal.result.error = `Provider ${removal.result.name ?? id} was removed, but credential cleanup failed for ${authRefToDelete}. The credential remains in the configured store and must be removed manually.`;
-      }
-    });
+  if (removal.authRef) {
+    try {
+      const cleanup = await reconcilePendingCredentialDeletes();
+      removal.result.credentialDeleted = cleanup.deleted.includes(removal.authRef);
+      removal.result.credentialCleanupPending = cleanup.pending.includes(removal.authRef) || cleanup.persistenceError !== void 0;
+    } catch {
+      removal.result.credentialCleanupPending = true;
+    }
+    removal.result.credentialCleanupReconciled = true;
   }
   return removal.result;
 }
 function toggleProviderEnabled(id) {
   return withRegistryWriteLockSync(() => {
-    const registry = loadRegistry();
+    const registry = loadRegistryStrict();
     const provider = registry.providers.find((p13) => p13.id === id);
     if (!provider) return { toggled: false, error: `Provider not found: ${id}` };
     provider.enabled = !provider.enabled;
@@ -5457,7 +6181,7 @@ function toggleProviderEnabled(id) {
 import { isDeepStrictEqual } from "util";
 
 // src/registry/custom-endpoint.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // src/registry/url-security.ts
 import { lookup } from "dns/promises";
@@ -5984,7 +6708,7 @@ function providerDiscoveryInputsMatch(current, started) {
   return current.authRef === started.authRef && current.authType === started.authType && current.templateId === started.templateId && isDeepStrictEqual(current.api, started.api);
 }
 async function refreshProviderModels(providerId, apiKey, registry) {
-  const workingRegistry = registry ?? loadRegistry();
+  const workingRegistry = registry ?? loadRegistryStrict();
   const provider = workingRegistry.providers.find((p13) => p13.id === providerId);
   if (!provider) {
     return { id: providerId, name: providerId, ok: false, reason: "Provider not found." };
@@ -6076,7 +6800,7 @@ async function refreshProviderModels(providerId, apiKey, registry) {
     const platform = pricingPlatformForProvider(provider.templateId, provider.id);
     const enriched = enrichModelsWithPricing(models, buildPricingIndex(pricingCache), platform);
     await withRegistryWriteLock(() => {
-      const currentRegistry = loadRegistry();
+      const currentRegistry = loadRegistryStrict();
       const currentProvider = currentRegistry.providers.find((candidate) => candidate.id === providerId);
       if (!currentProvider) throw new Error("Provider was removed while models were refreshing.");
       if (currentProvider.authRef !== provider.authRef) {
@@ -6108,7 +6832,7 @@ async function refreshProviderModels(providerId, apiKey, registry) {
 }
 async function refreshAllProviderModels(resolveKey) {
   const refreshed = [];
-  const registry = loadRegistry();
+  const registry = loadRegistryStrict();
   const enabledProviders = registry.providers.filter((p13) => p13.enabled);
   for (const provider of enabledProviders) {
     const key = await resolveRefreshCredential(provider, resolveKey);
@@ -6154,41 +6878,83 @@ function oauthDisplayName(registryId, fallbackName) {
   if (registryId === "openai-oauth") return "OpenAI (ChatGPT)";
   return fallbackName;
 }
-async function upsertOAuthProvider(providerId, cred, authRef) {
-  return withRegistryWriteLock(() => {
+async function persistOAuthProvider(providerId, cred, authRef) {
+  const registryProvider = await withCredentialMutationLock(authRef, async () => {
     const registryId = toOAuthRegistryId(providerId);
     const templateId = providerId.replace(/-oauth$/, "") || providerId;
-    const registry = loadRegistry();
-    const template = getTemplateById(templateId);
-    let entry = registry.providers.find((pr) => pr.id === registryId);
-    if (!entry) {
-      if (!template) {
+    await withRegistryWriteLock(() => {
+      const registry = loadRegistryStrict();
+      const previousEntry = registry.providers.find((provider) => provider.id === registryId);
+      if (!previousEntry && !getTemplateById(templateId)) {
         throw new Error(`Provider "${providerId}" is not in your registry and has no template`);
       }
-      const displayName = oauthDisplayName(registryId, template.name);
-      entry = {
-        id: registryId,
-        templateId,
-        name: displayName,
-        enabled: true,
-        authRef,
-        authType: "oauth",
-        api: {
-          npm: template.npm,
-          url: template.defaultBaseUrl ?? "",
-          ...template.headers ? { headers: template.headers } : {}
-        },
-        addedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-    } else {
-      entry = { ...entry, authType: "oauth", authRef, templateId };
+    });
+    await journalCredentialWrite(authRef);
+    let diagMsg = "";
+    const saved = await saveProviderCredential(
+      authRef,
+      oauthCredentialToKeychainJson(cred),
+      (msg) => {
+        diagMsg = msg;
+      }
+    );
+    if (!saved) {
+      throw new Error(`Could not save OAuth tokens to the credential store${diagMsg ? ` \u2014 ${diagMsg}` : " \u2014 check access and try again"}`);
     }
-    const idx = registry.providers.findIndex((pr) => pr.id === registryId);
-    if (idx >= 0) registry.providers[idx] = entry;
-    else registry.providers.push(entry);
-    saveRegistry(registry);
-    return entry;
+    const committed = await withRegistryWriteLock(async () => {
+      const registry = loadRegistryStrict();
+      const template = getTemplateById(templateId);
+      const previousEntry = registry.providers.find((provider) => provider.id === registryId);
+      if (!previousEntry && !template) {
+        throw new Error(`Provider "${providerId}" is not in your registry and has no template`);
+      }
+      let entry;
+      if (!previousEntry) {
+        if (!template) throw new Error(`Provider "${providerId}" has no template`);
+        const displayName = oauthDisplayName(registryId, template.name);
+        entry = {
+          id: registryId,
+          templateId,
+          name: displayName,
+          enabled: true,
+          authRef,
+          authType: "oauth",
+          api: {
+            npm: template.npm,
+            url: template.defaultBaseUrl ?? "",
+            ...template.headers ? { headers: template.headers } : {}
+          },
+          addedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+      } else {
+        entry = { ...previousEntry, authType: "oauth", authRef, templateId };
+      }
+      const idx = registry.providers.findIndex((provider) => provider.id === registryId);
+      if (idx >= 0) registry.providers[idx] = entry;
+      else registry.providers.push(entry);
+      if (previousEntry?.authRef && previousEntry.authRef !== authRef) {
+        await queueCredentialDelete(previousEntry.authRef);
+      }
+      saveRegistry(registry);
+      try {
+        await cancelCredentialDelete(authRef);
+      } catch {
+      }
+      return entry;
+    });
+    return committed;
   });
+  let credentialCleanupPending = true;
+  try {
+    const cleanup = await reconcilePendingCredentialDeletes();
+    credentialCleanupPending = cleanup.pending.length > 0 || cleanup.persistenceError !== void 0;
+  } catch {
+    credentialCleanupPending = true;
+  }
+  return {
+    registryProvider,
+    credentialCleanupPending
+  };
 }
 async function authenticateProvider(providerId, _options = {}) {
   const registryId = toOAuthRegistryId(providerId);
@@ -6206,26 +6972,7 @@ async function authenticateProvider(providerId, _options = {}) {
     );
   }
   const cred = await runNativeDeviceCode(providerId);
-  const persisted = await withCredentialMutationLock(authRef, async () => {
-    let nativeDiagMsg = "";
-    const saved = await saveProviderCredential(
-      authRef,
-      oauthCredentialToKeychainJson(cred),
-      (msg) => {
-        nativeDiagMsg = msg;
-      }
-    );
-    const registryProvider2 = await upsertOAuthProvider(
-      providerId,
-      cred,
-      authRef
-    );
-    return { saved, nativeDiagMsg, registryProvider: registryProvider2 };
-  });
-  if (!persisted.saved) {
-    p2.log.warn(`Could not save OAuth tokens to the credential store \u2014 ${persisted.nativeDiagMsg || "session may not persist."}`);
-  }
-  const { registryProvider } = persisted;
+  const persisted = await persistOAuthProvider(providerId, cred, authRef);
   const refreshSpinner = p2.spinner();
   refreshSpinner.start("Refreshing model list...");
   try {
@@ -6234,7 +6981,12 @@ async function authenticateProvider(providerId, _options = {}) {
   } catch {
     refreshSpinner.stop("Could not refresh models \u2014 run clodex providers refresh-models later");
   }
-  return { providerId: registryId, credential: cred, registryProvider };
+  return {
+    providerId: registryId,
+    credential: cred,
+    registryProvider: persisted.registryProvider,
+    credentialCleanupPending: persisted.credentialCleanupPending
+  };
 }
 function providerAuthHelpText() {
   return `${pc3.bold("clodex providers auth")} \u2014 sign in with OAuth
@@ -6544,6 +7296,39 @@ async function pickLocalModel(provider, conflicts, prefs) {
 }
 
 // src/providers-command.ts
+var CREDENTIAL_CLEANUP_PENDING_MESSAGE = "Credential cleanup is pending and will be retried by the next provider command.";
+function reportCredentialCleanup(pending, state, reconciled = false) {
+  if (state) {
+    state.reconciled ||= reconciled;
+    state.pending ||= pending;
+    return;
+  }
+  if (pending) {
+    p4.log.warn(CREDENTIAL_CLEANUP_PENDING_MESSAGE);
+  }
+}
+async function reconcileCredentialCleanup() {
+  try {
+    const cleanup = await reconcilePendingCredentialDeletes();
+    return cleanup.pending.length > 0 || cleanup.persistenceError !== void 0;
+  } catch {
+    return true;
+  }
+}
+async function runWithCredentialCleanup(run) {
+  const state = {
+    reconciled: false,
+    pending: false
+  };
+  try {
+    return await run(state);
+  } finally {
+    if (!state.reconciled) {
+      state.pending = await reconcileCredentialCleanup();
+    }
+    reportCredentialCleanup(state.pending);
+  }
+}
 function parseProvidersArgs(args) {
   if (args.length === 0) return { subcommand: "hub", showHelp: false };
   const [first, ...rest] = args;
@@ -6607,10 +7392,11 @@ ${pc5.bold("Subcommands:")}
 function providerLabel(name, modelCount, enabled) {
   return `${fmtEnabledStar(enabled)} ${fmtProvider(name)} ${pc5.dim(`(${modelCount} model${modelCount === 1 ? "" : "s"})`)}`;
 }
-async function runProvidersAuth(providerId, method) {
+async function runProvidersAuthWithCleanupState(providerId, method, cleanupState) {
   try {
     const result = await authenticateProvider(providerId, { method });
     p4.log.success(`Signed in to ${result.registryProvider.name} \u2014 credential saved to the credential store.`);
+    reportCredentialCleanup(result.credentialCleanupPending, cleanupState, true);
     return 0;
   } catch (err) {
     if (err instanceof Error && err.message === "Cancelled") {
@@ -6621,6 +7407,9 @@ async function runProvidersAuth(providerId, method) {
     return 1;
   }
 }
+async function runProvidersAuth(providerId, method) {
+  return runProvidersAuthWithCleanupState(providerId, method);
+}
 async function runProvidersRefreshModels(providerId) {
   const resolveKey = async (provider) => resolveProviderCredential(provider.id, provider.authRef);
   if (providerId) {
@@ -6698,7 +7487,7 @@ async function runProvidersList() {
   console.log("");
   return 0;
 }
-async function runTemplateAddFlow() {
+async function runTemplateAddFlow(cleanupState) {
   const registry = loadRegistry();
   const configuredIds = registry.providers.map((p13) => p13.id);
   const template = listAddableTemplates(configuredIds).find((t) => t.id === "openai") ?? getTemplateById("openai");
@@ -6724,6 +7513,11 @@ async function runTemplateAddFlow() {
   spinner5.start(`Testing connection to ${template.name}...`);
   const result = await addProviderFromTemplate(template, apiKey);
   spinner5.stop("");
+  reportCredentialCleanup(
+    result.credentialCleanupPending === true,
+    cleanupState,
+    result.credentialCleanupReconciled === true
+  );
   if (!result.added) {
     p4.log.error(result.error ?? "Could not add provider.");
     if (result.hint) p4.log.info(result.hint);
@@ -6732,7 +7526,7 @@ async function runTemplateAddFlow() {
   logConnected(template.name, result.modelCount ?? 0);
   return 0;
 }
-async function runProvidersAdd() {
+async function runProvidersAddWithCleanupState(cleanupState) {
   const choice = await p4.select({
     message: "Add a provider",
     options: [
@@ -6752,11 +7546,16 @@ async function runProvidersAdd() {
     p4.cancel("Cancelled.");
     return 0;
   }
-  if (choice === "oauth") return runProvidersAuth("openai");
-  if (choice === "apikey") return runTemplateAddFlow();
+  if (choice === "oauth") {
+    return runProvidersAuthWithCleanupState("openai", void 0, cleanupState);
+  }
+  if (choice === "apikey") return runTemplateAddFlow(cleanupState);
   return 0;
 }
-async function runProvidersRemove(id, interactive = false) {
+async function runProvidersAdd() {
+  return runProvidersAddWithCleanupState();
+}
+async function runProvidersRemoveWithCleanupState(id, interactive = false, cleanupState) {
   const registry = loadRegistry();
   const provider = registry.providers.find((pr) => pr.id === id);
   if (!provider) {
@@ -6774,6 +7573,11 @@ async function runProvidersRemove(id, interactive = false) {
     }
   }
   const result = await removeProviderFromRegistry(id);
+  reportCredentialCleanup(
+    result.credentialCleanupPending === true,
+    cleanupState,
+    result.credentialCleanupReconciled === true
+  );
   if (!result.removed) {
     p4.log.error(result.error ?? `Could not remove ${id}`);
     return 1;
@@ -6788,6 +7592,9 @@ async function runProvidersRemove(id, interactive = false) {
   }
   return 0;
 }
+async function runProvidersRemove(id, interactive = false) {
+  return runProvidersRemoveWithCleanupState(id, interactive);
+}
 function providerHubChoiceValue(entry) {
   return `provider:${entry.id}`;
 }
@@ -6921,16 +7728,24 @@ async function runProvidersCommand(args) {
     console.log(providersHelpText());
     return 0;
   }
+  const reconcilesDuringMutation = parsed.subcommand === "add" || parsed.subcommand === "remove" || parsed.subcommand === "auth" && !parsed.showHelp && parsed.removeId !== void 0;
+  if (!reconcilesDuringMutation) {
+    reportCredentialCleanup(await reconcileCredentialCleanup());
+  }
   if (parsed.subcommand === "list") return runProvidersList();
-  if (parsed.subcommand === "add") return runProvidersAdd();
-  if (parsed.subcommand === "remove" && parsed.removeId) return runProvidersRemove(parsed.removeId);
+  if (parsed.subcommand === "add") {
+    return runWithCredentialCleanup((state) => runProvidersAddWithCleanupState(state));
+  }
+  if (parsed.subcommand === "remove" && parsed.removeId) {
+    return runWithCredentialCleanup((state) => runProvidersRemoveWithCleanupState(parsed.removeId, false, state));
+  }
   if (parsed.subcommand === "refresh-models") return runProvidersRefreshModels(parsed.removeId);
   if (parsed.subcommand === "auth") {
     if (parsed.showHelp || !parsed.removeId) {
       console.log(providerAuthHelpText());
       return 0;
     }
-    return runProvidersAuth(parsed.removeId, parsed.authMethod);
+    return runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(parsed.removeId, parsed.authMethod, state));
   }
   relayIntro("Your OpenAI providers");
   return runProvidersHub();
@@ -6971,7 +7786,7 @@ async function runFirstRunWizard(_trace = false) {
 
 // src/proxy.ts
 import { createServer } from "http";
-import { appendFileSync, openSync as openSync3, writeSync as writeSync2, closeSync as closeSync3 } from "fs";
+import { appendFileSync, openSync as openSync4, writeSync as writeSync2, closeSync as closeSync4 } from "fs";
 
 // src/http-utils.ts
 import * as zlib from "zlib";
@@ -7048,6 +7863,12 @@ function localModelToRoute(lp, model) {
     baseURL: model.apiBaseUrl,
     providerId: lp.id,
     authType: lp.authType,
+    refreshToken: lp.authType === "oauth" && lp.authRef ? (rejectedAccessToken) => rejectedAccessToken === void 0 ? resolveProviderCredential(lp.id, lp.authRef) : resolveProviderCredential(
+      lp.id,
+      lp.authRef,
+      void 0,
+      { rejectedAccessToken }
+    ) : void 0,
     oauthAccountId: lp.oauthAccountId,
     providerData: lp.providerData,
     headers: lp.headers,
@@ -7138,7 +7959,7 @@ function buildHttpProxyRoutes(providers, favorites, modelAliases = [], max = MAX
       continue;
     }
     const route = localModelToRoute(provider, model);
-    if (!route || !route.apiKey.trim()) {
+    if (!route || !route.apiKey.trim() && route.authType !== "none") {
       unavailable.push(favorite);
       continue;
     }
@@ -7319,13 +8140,21 @@ function extractBearerToken(value) {
 // src/upstream-forward.ts
 function anthropicUpstreamHeaders(apiKey, stream = false, inboundBeta, authType, claudeCodeSessionId, extraHeaders) {
   const key = sanitizeCredential(apiKey) ?? apiKey.trim();
-  const isOAuth = authType === "oauth";
+  const resolvedAuthType = authType ?? "api";
+  const isOAuth = resolvedAuthType === "oauth";
+  const forwardedExtraHeaders = resolvedAuthType === "none" ? Object.fromEntries(
+    Object.entries(extraHeaders ?? {}).filter(
+      ([name]) => !isCredentialBearingHeader(name)
+    )
+  ) : extraHeaders;
   const headers = {
-    ...extraHeaders,
+    ...forwardedExtraHeaders,
     "Content-Type": "application/json",
     "anthropic-version": "2023-06-01",
-    Authorization: `Bearer ${key}`,
-    ...isOAuth ? {} : { "x-api-key": key },
+    ...resolvedAuthType === "none" ? {} : {
+      Authorization: `Bearer ${key}`,
+      ...isOAuth ? {} : { "x-api-key": key }
+    },
     ...isOAuth ? { "User-Agent": CLAUDE_CODE_USER_AGENT, "x-app": "cli" } : {},
     ...isOAuth && claudeCodeSessionId ? { "X-Claude-Code-Session-Id": claudeCodeSessionId } : {},
     ...stream ? { Accept: "text/event-stream" } : {}
@@ -7341,14 +8170,29 @@ var UpstreamUnreachableError = class extends Error {
     this.name = "UpstreamUnreachableError";
   }
 };
+async function resolveOAuthRetryReplacement(enabled, status, attempt, headersSent, apiKey, refreshToken) {
+  if (!enabled || status !== 401 || attempt !== 0 || headersSent || !refreshToken) {
+    return null;
+  }
+  const replacement = await refreshToken(apiKey).catch(() => null);
+  return replacement && replacement !== apiKey ? replacement : null;
+}
 async function fetchWithOAuthRetry(apiKey, request3, refreshToken) {
   let response = await request3(apiKey);
-  if (response.status !== 401 || !refreshToken) {
+  const refreshed = await resolveOAuthRetryReplacement(
+    true,
+    response.status,
+    0,
+    false,
+    apiKey,
+    refreshToken
+  );
+  if (!refreshed) {
     return { response, apiKey, refreshed: false };
   }
-  const refreshed = await refreshToken().catch(() => null);
-  if (!refreshed || refreshed === apiKey) {
-    return { response, apiKey, refreshed: false };
+  try {
+    await response.body?.cancel?.();
+  } catch {
   }
   response = await request3(refreshed);
   return { response, apiKey: refreshed, refreshed: true };
@@ -7413,10 +8257,10 @@ async function relayAnthropicMessages(res, messagesUrl, body, apiKey, clientWant
 }
 
 // src/proxy.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 
 // src/sdk-adapter.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { streamText, generateText, tool, jsonSchema } from "ai";
 
 // src/proxy-shared.ts
@@ -7580,7 +8424,7 @@ function extractClaudeSessionId(body, headerFallback) {
   return validClaudeSessionId(headerFallback);
 }
 function claudeSessionPromptCacheKey(sessionId) {
-  return "relay-session-" + createHash6("sha256").update(sessionId).digest("hex").slice(0, 32);
+  return "relay-session-" + createHash7("sha256").update(sessionId).digest("hex").slice(0, 32);
 }
 function anthropicEffortFromRequest(body) {
   const effort = body.output_config?.effort;
@@ -7590,7 +8434,7 @@ function anthropicEffortFromRequest(body) {
 function openAiPromptCacheKey(system, tools) {
   const toolSig = (tools ?? []).map((t) => `${t.name}
${t.description ?? ""}
${JSON.stringify(t.input_schema ?? {})}`).join("");
   const material = `${system ?? ""}\0${toolSig}`;
-  return "relay-" + createHash6("sha256").update(material).digest("hex").slice(0, 32);
+  return "relay-" + createHash7("sha256").update(material).digest("hex").slice(0, 32);
 }
 function supportsOpenAiPromptCacheBreakpoints(modelId) {
   const match = modelId.toLowerCase().match(/^gpt-(\d+)(?:\.(\d+))?(?:-|$)/);
@@ -8297,6 +9141,77 @@ function anthropicPromptTooLongMessage(body, contextWindow) {
   return `prompt is too long: ${promptTokens} tokens > ${maximum} maximum`;
 }
 
+// src/listener-ready.ts
+import { connect } from "net";
+import { setTimeout as delay } from "timers/promises";
+var LISTENER_READY_TIMEOUT_MS = 1e3;
+var LISTENER_READY_RETRY_MS = 5;
+function connectHost(address) {
+  if (address === "0.0.0.0") return "127.0.0.1";
+  if (address === "::") return "::1";
+  return address;
+}
+function tcpListenerUrlHost(address) {
+  const host = connectHost(address);
+  return host.includes(":") ? `[${host}]` : host;
+}
+function probeTcpListener(host, port, timeoutMs) {
+  return new Promise((resolve2) => {
+    const socket = connect({ host, port });
+    let settled = false;
+    const finish = (ready) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve2(ready);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.setTimeout(timeoutMs, () => finish(false));
+  });
+}
+async function closeAfterReadinessFailure(server) {
+  if (!server.listening) return;
+  await new Promise((resolve2) => server.close(() => resolve2()));
+}
+async function listenTcpServer(server, port, host) {
+  await new Promise((resolve2, reject) => {
+    const cleanup = () => server.off("error", onError);
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    server.once("error", onError);
+    try {
+      server.listen(port, host, () => {
+        cleanup();
+        resolve2();
+      });
+    } catch (error) {
+      cleanup();
+      reject(error);
+    }
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    await closeAfterReadinessFailure(server);
+    throw new Error("TCP server did not bind to a network address");
+  }
+  const probeHost = connectHost(address.address);
+  const deadline = Date.now() + LISTENER_READY_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const remaining = deadline - Date.now();
+    if (await probeTcpListener(probeHost, address.port, Math.min(remaining, 50))) {
+      return address;
+    }
+    await delay(Math.min(LISTENER_READY_RETRY_MS, Math.max(1, deadline - Date.now())));
+  }
+  await closeAfterReadinessFailure(server);
+  throw new Error(
+    `TCP listener did not become reachable within ${LISTENER_READY_TIMEOUT_MS}ms: ${probeHost}:${address.port}`
+  );
+}
+
 // src/proxy.ts
 var STREAM_KEEPALIVE_INTERVAL_MS = 2e4;
 var STREAM_KEEPALIVE_PING = 'event: ping\ndata: {"type":"ping"}\n\n';
@@ -8382,12 +9297,12 @@ function createTranslationLifecycle(logPath, requestId, modelId, provider) {
 function appendSecureLog(logPath, line) {
   const redacted = redactTraceLine(line);
   try {
-    const fd = openSync3(logPath, "a", 384);
+    const fd = openSync4(logPath, "a", 384);
     try {
       writeSync2(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
   } catch {
     try {
@@ -8426,11 +9341,11 @@ function lookupRoute(byAlias, id) {
   }
   return void 0;
 }
-function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPath, debugLogPath, webSocketDiagnosticsLogPath, modelAliases) {
-  const proxyToken = randomUUID6();
+async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPath, debugLogPath, webSocketDiagnosticsLogPath, modelAliases) {
+  const proxyToken = randomUUID8();
   silenceSdkWarnings();
   if (routes.length === 0) {
-    return Promise.reject(new Error("Proxy catalog requires at least one route"));
+    throw new Error("Proxy catalog requires at least one route");
   }
   const byAlias = new Map(routes.map((r) => [r.aliasId, r]));
   for (const alias of modelAliases ?? []) {
@@ -8505,21 +9420,36 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
       const relayRequestIdRaw = req.headers["x-relay-request-id"];
       const relayRequestId = Array.isArray(relayRequestIdRaw) ? relayRequestIdRaw[0] : relayRequestIdRaw;
       const route = lookupRoute(byAlias, originalModel) ?? defaultRoute;
-      const apiKey = route.apiKey;
+      if (messagesEndpoint === "count_tokens" && route.modelFormat !== "anthropic") {
+        const inputTokens = estimateAnthropicInputTokens(anthropicBody);
+        plog(() => `token-count: local estimate model=${originalModel} input_tokens=${inputTokens}`);
+        res.setHeader("x-relay-token-count-source", "local-estimate");
+        sendJson(res, 200, { input_tokens: inputTokens });
+        return;
+      }
+      let apiKey = route.apiKey;
+      if (route.authType === "oauth" && route.refreshToken) {
+        try {
+          const current = await route.refreshToken();
+          if (!current) throw new Error("credential is missing");
+          apiKey = current;
+          route.apiKey = current;
+        } catch (err) {
+          plog(
+            () => `oauth credential unavailable: ${err instanceof Error ? err.message : String(err)}`
+          );
+          anthropicError(res, 401, "OAuth credential is unavailable");
+          return;
+        }
+      }
       const upstreamUrl = route.upstreamUrl;
+      const routeAuthType = route.authType ?? "api";
       plog(
-        () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${apiKey ? `len:${apiKey.length}` : "MISSING"}`
+        () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${routeAuthType === "none" ? "none" : apiKey ? `len:${apiKey.length}` : "MISSING"}`
       );
       const usesSdkAdapter = isSdkMigratedNpm(route.npm);
       if (messagesEndpoint === "count_tokens") {
-        if (route.modelFormat !== "anthropic") {
-          const inputTokens = estimateAnthropicInputTokens(anthropicBody);
-          plog(() => `token-count: local estimate model=${originalModel} input_tokens=${inputTokens}`);
-          res.setHeader("x-relay-token-count-source", "local-estimate");
-          sendJson(res, 200, { input_tokens: inputTokens });
-          return;
-        }
-        if (!apiKey) {
+        if (!apiKey && routeAuthType !== "none") {
           anthropicError(res, 401, "Missing API key");
           return;
         }
@@ -8527,11 +9457,11 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         const inboundBeta = Array.isArray(betaHeaderRaw) ? betaHeaderRaw.join(",") : betaHeaderRaw;
         const forwardBody = { ...anthropicBody, model: route.realModelId };
         const targetUrl = `${upstreamUrl}/v1/messages/count_tokens`;
-        const isOAuth = route.authType === "oauth";
+        const isOAuth = routeAuthType === "oauth";
         try {
           await relayAnthropicMessages(res, targetUrl, forwardBody, apiKey, false, {
             inboundBeta,
-            authType: isOAuth ? "oauth" : "api",
+            authType: routeAuthType,
             log: (message) => plog(message),
             extraHeaders: route.headers,
             refreshToken: route.refreshToken,
@@ -8548,7 +9478,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         }
         return;
       }
-      if (!apiKey && !usesSdkAdapter) {
+      if (!apiKey && routeAuthType !== "none" && !usesSdkAdapter) {
         anthropicError(res, 401, "Missing API key");
         return;
       }
@@ -8557,7 +9487,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         const inboundBeta = Array.isArray(betaHeaderRaw) ? betaHeaderRaw.join(",") : betaHeaderRaw;
         const forwardBody = { ...anthropicBody, model: route.realModelId };
         const targetUrl = `${upstreamUrl}/v1/messages`;
-        const isOAuth = route.authType === "oauth";
+        const isOAuth = routeAuthType === "oauth";
         let effectiveBeta = inboundBeta;
         let claudeCodeSessionId;
         if (isOAuth) {
@@ -8574,7 +9504,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         try {
           await relayAnthropicMessages(res, targetUrl, forwardBody, apiKey, clientWantsStream, {
             inboundBeta: effectiveBeta,
-            authType: isOAuth ? "oauth" : "api",
+            authType: routeAuthType,
             log: (message) => plog(message),
             claudeCodeSessionId,
             extraHeaders: route.headers,
@@ -8607,7 +9537,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
           originalModel,
           route.providerId ?? route.aliasId.split(":")[1] ?? "unknown"
         );
-        try {
+        const runSdkRequest = async () => {
           const claudeSessionIdHeader = Array.isArray(req.headers["x-claude-code-session-id"]) ? req.headers["x-claude-code-session-id"][0] : req.headers["x-claude-code-session-id"];
           const claudeSessionId = extractClaudeSessionId(anthropicBody, claudeSessionIdHeader);
           const params = translateRequest(anthropicBody, route.npm, {
@@ -8713,18 +9643,35 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
             translationLifecycle?.complete();
             sendJson(res, 200, anthropicResponse);
           }
-        } catch (err) {
+        };
+        let sdkAttempt = 0;
+        const handleSdkError = async (err) => {
           if (clientAbort.signal.aborted) {
             translationLifecycle?.cancel();
-            return;
+            return "cancelled";
+          }
+          const message = formatUpstreamError(err);
+          const details = sdkUpstreamErrorDetails(err);
+          const upstreamStatus = details?.statusCode ?? upstreamHttpStatus(err, message);
+          const replacement = await resolveOAuthRetryReplacement(
+            openAiOAuth,
+            upstreamStatus,
+            sdkAttempt,
+            res.headersSent,
+            apiKey,
+            route.refreshToken
+          );
+          if (replacement) {
+            apiKey = replacement;
+            route.apiKey = replacement;
+            sdkAttempt += 1;
+            plog(() => "sdk oauth credential replaced after 401; retrying once");
+            return "retry";
           }
           translationLifecycle?.fail(
             err instanceof Error ? err.name : "UpstreamError",
             sdkTranslationErrorSignature(err)
           );
-          const message = formatUpstreamError(err);
-          const details = sdkUpstreamErrorDetails(err);
-          const upstreamStatus = details?.statusCode ?? upstreamHttpStatus(err, message);
           const contextLengthExceeded = upstreamStatus === 400 && isContextLengthExceededError(err, message);
           const clientMessage = contextLengthExceeded ? anthropicPromptTooLongMessage(
             anthropicBody,
@@ -8744,11 +9691,14 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
             });
           }
           if (!res.headersSent) {
+            if (details?.retryAfterSeconds !== void 0) {
+              res.setHeader("retry-after", String(details.retryAfterSeconds));
+            }
             anthropicError(
               res,
               upstreamStatus === 500 ? 502 : upstreamStatus,
               clientMessage,
-              contextLengthExceeded ? relayRequestId ?? randomUUID6() : void 0
+              contextLengthExceeded ? relayRequestId ?? randomUUID8() : void 0
             );
           } else {
             const errorType = anthropicErrorType(upstreamStatus);
@@ -8756,12 +9706,24 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
 data: ${JSON.stringify({
               type: "error",
               error: { type: errorType, message: clientMessage },
-              ...contextLengthExceeded ? { request_id: relayRequestId ?? randomUUID6() } : {}
+              ...contextLengthExceeded ? { request_id: relayRequestId ?? randomUUID8() } : {}
             })}
 
 `);
             res.end();
           }
+          return "done";
+        };
+        for (; ; ) {
+          try {
+            await runSdkRequest();
+            break;
+          } catch (err) {
+            const outcome = await handleSdkError(err);
+            if (outcome === "retry") continue;
+            if (outcome === "cancelled") return;
+            break;
+          }
         }
         return;
       }
@@ -8770,26 +9732,26 @@ data: ${JSON.stringify({
     }
     anthropicError(res, 404, `Unknown endpoint: ${req.method} ${req.url}`);
   });
-  return new Promise((resolve2, reject) => {
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      if (!addr || typeof addr === "string") {
-        reject(new Error("Failed to bind proxy"));
-        return;
-      }
-      plog(() => `started on port ${addr.port}, catalog=${routes.length} model(s), default=${defaultRoute.aliasId}`);
-      resolve2({
-        port: addr.port,
-        token: proxyToken,
-        close: () => {
-          process.off("unhandledRejection", onRejection);
-          process.off("uncaughtException", onException);
-          server.close();
-        }
-      });
-    });
-  });
+  let address;
+  try {
+    address = await listenTcpServer(server, 0, "127.0.0.1");
+  } catch (error) {
+    process.off("unhandledRejection", onRejection);
+    process.off("uncaughtException", onException);
+    throw error;
+  }
+  plog(
+    () => `started on port ${address.port}, catalog=${routes.length} model(s), default=${defaultRoute.aliasId}`
+  );
+  return {
+    port: address.port,
+    token: proxyToken,
+    close: () => {
+      process.off("unhandledRejection", onRejection);
+      process.off("uncaughtException", onException);
+      server.close();
+    }
+  };
 }
 function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk, apiKey) {
   const bareModelId = stripOneMContextSuffix(modelId);
@@ -8812,7 +9774,8 @@ function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk,
     reasoning: sdk?.reasoning,
     interleavedReasoningField: sdk?.interleavedReasoningField,
     useResponsesLite: sdk?.useResponsesLite,
-    preferWebSockets: sdk?.preferWebSockets
+    preferWebSockets: sdk?.preferWebSockets,
+    headers: sdk?.headers
   }], clientModelId, debug);
 }
 
@@ -8953,7 +9916,7 @@ async function askSaveServerPassword() {
 
 // src/server/router.ts
 import { createServer as createServer2 } from "http";
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 
 // src/openai-adapter.ts
 import { tool as tool2, jsonSchema as jsonSchema2, streamText as streamText2, generateText as generateText2 } from "ai";
@@ -9155,6 +10118,30 @@ function auditInference(options, entry) {
 function inferenceProvider(model) {
   return model.providerId ?? String(model.sourceBackend);
 }
+async function resolveModelApiKey(model, fallback, rejectedAccessToken) {
+  if (model.authType === "oauth" && model.providerId && model.authRef) {
+    let current;
+    try {
+      current = rejectedAccessToken === void 0 ? await resolveProviderCredential(model.providerId, model.authRef) : await resolveProviderCredential(
+        model.providerId,
+        model.authRef,
+        void 0,
+        { rejectedAccessToken }
+      );
+    } catch (cause) {
+      throw new Error(
+        `OAuth credential is unavailable for ${model.providerId}`,
+        { cause }
+      );
+    }
+    if (!current) {
+      throw new Error(`OAuth credential is unavailable for ${model.providerId}`);
+    }
+    model.apiKey = current;
+    return current;
+  }
+  return model.apiKey ?? fallback;
+}
 function auditSdkError(options, requestedModelId, model, err, message) {
   const details = sdkUpstreamErrorDetails(err);
   const statusCode = details?.statusCode ?? upstreamHttpStatus(err, message);
@@ -9169,7 +10156,7 @@ function auditSdkError(options, requestedModelId, model, err, message) {
       attemptCount: details?.attemptCount
     });
   }
-  return statusCode;
+  return { statusCode, retryAfterSeconds: details?.retryAfterSeconds };
 }
 function openAiEffort(body) {
   if (typeof body.reasoning_effort === "string" && body.reasoning_effort.trim()) {
@@ -9188,21 +10175,11 @@ async function startServer(options) {
   const server = createServer2((req, res) => {
     void routeRequest(req, res, options, languageModelCache, plog);
   });
-  await new Promise((resolve2, reject) => {
-    server.once("error", reject);
-    server.listen(options.port, options.host, () => {
-      server.off("error", reject);
-      resolve2();
-    });
-  });
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    throw new Error("Server did not bind to a TCP port");
-  }
+  const address = await listenTcpServer(server, options.port, options.host);
   return {
     host: options.host,
     port: address.port,
-    url: `http://${options.host}:${address.port}`,
+    url: `http://${tcpListenerUrlHost(address.address)}:${address.port}`,
     server,
     inferenceLogPath: options.inferenceLogPath,
     close: () => new Promise((resolve2, reject) => {
@@ -9223,7 +10200,16 @@ async function routeRequest(req, res, options, modelCache, plog) {
       return;
     }
     if (req.method === "GET" && pathname === "/models") {
-      sendJson(res, 200, { models: options.catalog.list().map(({ apiKey: _apiKey, headers: _headers, ...rest }) => rest) });
+      sendJson(res, 200, {
+        models: options.catalog.list().map(({
+          apiKey: _apiKey,
+          authRef: _authRef,
+          headers: _headers,
+          oauthAccountId: _oauthAccountId,
+          providerData: _providerData,
+          ...rest
+        }) => rest)
+      });
       return;
     }
     if (req.method === "GET" && pathname === "/anthropic/v1/models") {
@@ -9258,7 +10244,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     plog(`model not found: ${body.model}`);
     return;
   }
-  const requestId = randomUUID7();
+  const requestId = randomUUID9();
   const claudeSessionIdHeader = Array.isArray(req.headers["x-claude-code-session-id"]) ? req.headers["x-claude-code-session-id"][0] : req.headers["x-claude-code-session-id"];
   const claudeSessionId = extractClaudeSessionId(body, claudeSessionIdHeader);
   if (options.webSocketDiagnosticsLogPath) {
@@ -9282,12 +10268,21 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       return;
     }
     const messagesUrl = `${model.baseUrl}/v1/messages`;
-    const apiKey = model.apiKey ?? options.apiKey;
+    let apiKey;
+    try {
+      apiKey = await resolveModelApiKey(model, options.apiKey);
+    } catch (err) {
+      sendJson(res, 401, {
+        error: { message: err instanceof Error ? err.message : String(err) }
+      });
+      return;
+    }
     const betaHeaderRaw = req.headers["anthropic-beta"];
     const inboundBeta = Array.isArray(betaHeaderRaw) ? betaHeaderRaw.join(",") : betaHeaderRaw;
     const clientWantsStream = Boolean(body.stream);
     const forwardBody = { ...body, model: upstreamModelId(model) };
-    const isOAuth = model.authType === "oauth";
+    const authType = model.authType ?? "api";
+    const isOAuth = authType === "oauth";
     auditInference(options, {
       requestId,
       modelId: body.model,
@@ -9306,11 +10301,15 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       claudeCodeSessionId = identity.sessionId;
       effectiveBeta = selectBetaFlags(forwardBody, upstreamModelId(model), inboundBeta);
     }
-    const refreshToken = isOAuth && model.providerId ? () => resolveProviderCredential(model.providerId, oauthAuthRef(model.providerId)) : void 0;
+    const refreshToken = isOAuth && model.providerId && model.authRef ? (rejectedAccessToken) => resolveModelApiKey(
+      model,
+      options.apiKey,
+      rejectedAccessToken
+    ) : void 0;
     plog(() => `anthropic-passthrough \u2192 ${messagesUrl} oauth=${isOAuth} stream=${clientWantsStream}`);
     await relayAnthropicMessages(res, messagesUrl, forwardBody, apiKey, clientWantsStream, {
       inboundBeta: effectiveBeta,
-      authType: isOAuth ? "oauth" : "api",
+      authType,
       log: (message) => plog(message),
       claudeCodeSessionId,
       extraHeaders: model.headers,
@@ -9334,7 +10333,15 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       sendJson(res, 400, { error: { message: `No SDK provider for model: ${model.id}` } });
       return;
     }
-    const apiKey = model.apiKey ?? options.apiKey;
+    let apiKey;
+    try {
+      apiKey = await resolveModelApiKey(model, options.apiKey);
+    } catch (err) {
+      sendJson(res, 401, {
+        error: { message: err instanceof Error ? err.message : String(err) }
+      });
+      return;
+    }
     auditInference(options, {
       requestId,
       modelId: body.model,
@@ -9344,14 +10351,6 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       route: "translated",
       requestPreview: getLatestMessagePreview(body.messages, body.system)
     });
-    const languageModel = await getOrInitLanguageModel(
-      modelCache,
-      model,
-      model.npm,
-      model.apiBaseUrl,
-      apiKey,
-      options.webSocketDiagnosticsLogPath
-    );
     const npmMaxTools = maxToolsForNpm(model.npm);
     const toolCount = Array.isArray(body.tools) ? body.tools.length : 0;
     if (npmMaxTools !== void 0 && toolCount > npmMaxTools) {
@@ -9375,63 +10374,93 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     const clientWantsStream = Boolean(body.stream);
     const responseModelId = getResponseModelId(body.model, model, options);
     plog(() => `sdk npm=${model.npm} upstream=${upstreamModelId(model)} responseModel=${responseModelId} stream=${clientWantsStream}`);
-    try {
-      if (clientWantsStream) {
-        const writeStreamChunk = (chunk) => {
-          if (!res.headersSent) {
-            res.writeHead(200, {
-              "Content-Type": "text/event-stream",
-              "Cache-Control": "no-cache",
-              "Connection": "keep-alive"
-            });
-          }
-          res.write(chunk);
-        };
-        await withResponsesWebSocketDiagnosticContext(
-          { requestId, claudeSessionId },
-          () => streamAnthropicResponse(languageModel, params, responseModelId, writeStreamChunk, void 0, {
-            initialInputTokens: estimateAnthropicInputTokens(body)
-          })
-        );
-        if (!res.headersSent) writeStreamChunk("");
-        res.end();
-      } else {
-        const anthropicResponse = await withResponsesWebSocketDiagnosticContext(
-          { requestId, claudeSessionId },
-          () => generateAnthropicResponse(languageModel, params, responseModelId, { forceStream: openAiOAuth })
+    let sdkAttempt = 0;
+    for (; ; ) {
+      try {
+        const languageModel = await getOrInitLanguageModel(
+          modelCache,
+          model,
+          model.npm,
+          model.apiBaseUrl,
+          apiKey,
+          options.webSocketDiagnosticsLogPath
         );
-        sendJson(res, 200, anthropicResponse);
-      }
-    } catch (err) {
-      const message = formatUpstreamError(err);
-      const status = auditSdkError(options, body.model, model, err, message);
-      const contextLengthExceeded = status === 400 && isContextLengthExceededError(err, message);
-      const clientMessage = contextLengthExceeded ? anthropicPromptTooLongMessage(
-        body,
-        resolveContextWindow(upstreamModelId(model), model.contextWindow)
-      ) : message;
-      plog(`sdk error npm=${model.npm} upstream=${upstreamModelId(model)}: ${message}`);
-      if (!res.headersSent) {
-        if (contextLengthExceeded) {
-          sendJson(res, 400, {
-            type: "error",
-            error: { type: "invalid_request_error", message: clientMessage },
-            request_id: requestId
-          });
+        if (clientWantsStream) {
+          const writeStreamChunk = (chunk) => {
+            if (!res.headersSent) {
+              res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache",
+                "Connection": "keep-alive"
+              });
+            }
+            res.write(chunk);
+          };
+          await withResponsesWebSocketDiagnosticContext(
+            { requestId, claudeSessionId },
+            () => streamAnthropicResponse(languageModel, params, responseModelId, writeStreamChunk, void 0, {
+              initialInputTokens: estimateAnthropicInputTokens(body)
+            })
+          );
+          if (!res.headersSent) writeStreamChunk("");
+          res.end();
         } else {
-          sendJson(res, status === 500 ? 502 : status, { error: { message: clientMessage } });
+          const anthropicResponse = await withResponsesWebSocketDiagnosticContext(
+            { requestId, claudeSessionId },
+            () => generateAnthropicResponse(languageModel, params, responseModelId, { forceStream: openAiOAuth })
+          );
+          sendJson(res, 200, anthropicResponse);
         }
-      } else {
-        const errorType = anthropicErrorType(status);
-        res.write(`event: error
+        break;
+      } catch (err) {
+        const message = formatUpstreamError(err);
+        const details = sdkUpstreamErrorDetails(err);
+        const candidateStatus = details?.statusCode ?? upstreamHttpStatus(err, message);
+        const replacement = await resolveOAuthRetryReplacement(
+          openAiOAuth,
+          candidateStatus,
+          sdkAttempt,
+          res.headersSent,
+          apiKey,
+          (rejectedAccessToken) => resolveModelApiKey(model, options.apiKey, rejectedAccessToken)
+        );
+        if (replacement) {
+          apiKey = replacement;
+          sdkAttempt += 1;
+          plog("sdk oauth credential replaced after 401; retrying once");
+          continue;
+        }
+        const { statusCode: status, retryAfterSeconds } = auditSdkError(options, body.model, model, err, message);
+        const contextLengthExceeded = status === 400 && isContextLengthExceededError(err, message);
+        const clientMessage = contextLengthExceeded ? anthropicPromptTooLongMessage(
+          body,
+          resolveContextWindow(upstreamModelId(model), model.contextWindow)
+        ) : message;
+        plog(`sdk error npm=${model.npm} upstream=${upstreamModelId(model)}: ${message}`);
+        if (!res.headersSent) {
+          if (contextLengthExceeded) {
+            sendJson(res, 400, {
+              type: "error",
+              error: { type: "invalid_request_error", message: clientMessage },
+              request_id: requestId
+            });
+          } else {
+            if (retryAfterSeconds !== void 0) res.setHeader("retry-after", String(retryAfterSeconds));
+            sendJson(res, status === 500 ? 502 : status, { error: { message: clientMessage } });
+          }
+        } else {
+          const errorType = anthropicErrorType(status);
+          res.write(`event: error
 data: ${JSON.stringify({
-          type: "error",
-          error: { type: errorType, message: clientMessage },
-          ...contextLengthExceeded ? { request_id: requestId } : {}
-        })}
+            type: "error",
+            error: { type: errorType, message: clientMessage },
+            ...contextLengthExceeded ? { request_id: requestId } : {}
+          })}
 
 `);
-        res.end();
+          res.end();
+        }
+        break;
       }
     }
     return;
@@ -9456,7 +10485,15 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
       return;
     }
     const completionsUrl = model.completionsUrl;
-    const apiKey2 = model.apiKey ?? options.apiKey;
+    let apiKey2;
+    try {
+      apiKey2 = await resolveModelApiKey(model, options.apiKey);
+    } catch (err) {
+      sendJson(res, 401, {
+        error: { message: err instanceof Error ? err.message : String(err) }
+      });
+      return;
+    }
     const forwardBody = body.model === upstreamModelId(model) ? body : { ...body, model: upstreamModelId(model) };
     auditInference(options, {
       modelId: body.model,
@@ -9465,7 +10502,19 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
       route: "passthrough",
       requestPreview: getLatestMessagePreview(body.messages, body.system)
     });
+    const isOAuth = model.authType === "oauth";
+    const refreshToken = isOAuth && model.providerId && model.authRef ? (rejectedAccessToken) => resolveModelApiKey(
+      model,
+      options.apiKey,
+      rejectedAccessToken
+    ) : void 0;
     await relayAnthropicMessages(res, completionsUrl, forwardBody, apiKey2, Boolean(body.stream), {
+      authType: model.authType ?? "api",
+      extraHeaders: model.headers,
+      refreshToken,
+      onTokenRefreshed: (refreshed) => {
+        model.apiKey = refreshed;
+      },
       onUpstreamError: options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
         modelId: body.model,
         provider: inferenceProvider(model),
@@ -9481,7 +10530,15 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
     sendJson(res, 400, { error: { message: `No SDK provider for model: ${model.id}` } });
     return;
   }
-  const apiKey = model.apiKey ?? options.apiKey;
+  let apiKey;
+  try {
+    apiKey = await resolveModelApiKey(model, options.apiKey);
+  } catch (err) {
+    sendJson(res, 401, {
+      error: { message: err instanceof Error ? err.message : String(err) }
+    });
+    return;
+  }
   auditInference(options, {
     modelId: body.model,
     effort: openAiEffort(body),
@@ -9490,42 +10547,70 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
     requestPreview: getLatestMessagePreview(body.messages, body.system)
   });
   const baseURL = model.modelFormat === "anthropic" ? model.baseUrl : model.apiBaseUrl;
-  const languageModel = await getOrInitLanguageModel(modelCache, model, npm, baseURL, apiKey);
   const openAiOAuth = npm === "@ai-sdk/openai" && model.authType === "oauth";
   const params = translateOpenAiRequest(body, { openAiOAuth });
   const clientWantsStream = Boolean(body.stream);
   const responseModelId = getResponseModelId(body.model, model, options);
   plog(() => `sdk-openai npm=${npm} upstream=${upstreamModelId(model)} responseModel=${responseModelId} stream=${clientWantsStream}`);
-  try {
-    if (clientWantsStream) {
-      const writeStreamChunk = (chunk) => {
-        if (!res.headersSent) {
-          res.writeHead(200, {
-            "Content-Type": "text/event-stream",
-            "Cache-Control": "no-cache",
-            "Connection": "keep-alive"
-          });
-        }
-        res.write(chunk);
-      };
-      await streamOpenAiResponse(languageModel, params, responseModelId, writeStreamChunk);
-      if (!res.headersSent) writeStreamChunk("");
-      res.end();
-    } else {
-      const response = await generateOpenAiResponse(languageModel, params, responseModelId, { forceStream: openAiOAuth });
-      sendJson(res, 200, response);
-    }
-  } catch (err) {
-    const message = formatUpstreamError(err);
-    const status = auditSdkError(options, body.model, model, err, message);
-    plog(`sdk error npm=${model.npm} upstream=${upstreamModelId(model)}: ${message}`);
-    if (!res.headersSent) {
-      sendJson(res, status === 500 ? 502 : status, { error: { message } });
-    } else {
-      res.write(`data: ${JSON.stringify({ error: { message, type: "upstream_error", code: status } })}
+  let sdkAttempt = 0;
+  for (; ; ) {
+    try {
+      const languageModel = await getOrInitLanguageModel(
+        modelCache,
+        model,
+        npm,
+        baseURL,
+        apiKey
+      );
+      if (clientWantsStream) {
+        const writeStreamChunk = (chunk) => {
+          if (!res.headersSent) {
+            res.writeHead(200, {
+              "Content-Type": "text/event-stream",
+              "Cache-Control": "no-cache",
+              "Connection": "keep-alive"
+            });
+          }
+          res.write(chunk);
+        };
+        await streamOpenAiResponse(languageModel, params, responseModelId, writeStreamChunk);
+        if (!res.headersSent) writeStreamChunk("");
+        res.end();
+      } else {
+        const response = await generateOpenAiResponse(languageModel, params, responseModelId, { forceStream: openAiOAuth });
+        sendJson(res, 200, response);
+      }
+      break;
+    } catch (err) {
+      const message = formatUpstreamError(err);
+      const details = sdkUpstreamErrorDetails(err);
+      const candidateStatus = details?.statusCode ?? upstreamHttpStatus(err, message);
+      const replacement = await resolveOAuthRetryReplacement(
+        openAiOAuth,
+        candidateStatus,
+        sdkAttempt,
+        res.headersSent,
+        apiKey,
+        (rejectedAccessToken) => resolveModelApiKey(model, options.apiKey, rejectedAccessToken)
+      );
+      if (replacement) {
+        apiKey = replacement;
+        sdkAttempt += 1;
+        plog("sdk oauth credential replaced after 401; retrying once");
+        continue;
+      }
+      const { statusCode: status, retryAfterSeconds } = auditSdkError(options, body.model, model, err, message);
+      plog(`sdk error npm=${model.npm} upstream=${upstreamModelId(model)}: ${message}`);
+      if (!res.headersSent) {
+        if (retryAfterSeconds !== void 0) res.setHeader("retry-after", String(retryAfterSeconds));
+        sendJson(res, status === 500 ? 502 : status, { error: { message } });
+      } else {
+        res.write(`data: ${JSON.stringify({ error: { message, type: "upstream_error", code: status } })}
 
 `);
-      res.end();
+        res.end();
+      }
+      break;
     }
   }
 }
@@ -9549,9 +10634,9 @@ async function getOrInitLanguageModel(modelCache, model, npm, baseURL, apiKey, w
     npm,
     baseURL ?? ""
   ].join("");
-  let languageModel = modelCache.get(cacheKey);
-  if (!languageModel) {
-    languageModel = await createLanguageModel({
+  let cached = modelCache.get(cacheKey);
+  if (!cached || cached.apiKey !== apiKey) {
+    const languageModel = await createLanguageModel({
       npm,
       modelId: upstreamModelId(model),
       apiKey,
@@ -9564,9 +10649,10 @@ async function getOrInitLanguageModel(modelCache, model, npm, baseURL, apiKey, w
       preferWebSockets: model.preferWebSockets,
       onWebSocketDiagnostic: webSocketDiagnosticsLogPath ? (event) => writeWebSocketDiagnosticLog(webSocketDiagnosticsLogPath, event) : void 0
     });
-    modelCache.set(cacheKey, languageModel);
+    cached = { apiKey, languageModel };
+    modelCache.set(cacheKey, cached);
   }
-  return languageModel;
+  return cached.languageModel;
 }
 function getResponseModelId(bodyModel, model, options) {
   if (typeof bodyModel === "string" && options.aliasNames?.has(bodyModel)) return bodyModel;
@@ -9709,14 +10795,14 @@ import * as p8 from "@clack/prompts";
 import * as http from "http";
 import * as https from "https";
 import * as net from "net";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { URL as URL2 } from "url";
 import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
 
 // src/http-proxy/ca.ts
 import { randomBytes } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname5, join as join5, resolve } from "path";
+import { chmodSync as chmodSync5, existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join5, resolve } from "path";
 import forge from "node-forge";
 var CERT_DIR = "http-proxy";
 var CA_CERT_FILE = "clodex-ca.pem";
@@ -9742,15 +10828,15 @@ function certPaths() {
   };
 }
 function writePrivate(path, value) {
-  writeFileSync5(path, value, { encoding: "utf8", mode: 384 });
+  writeFileSync6(path, value, { encoding: "utf8", mode: 384 });
   chmodSync5(path, 384);
 }
 function writePublic(path, value) {
-  writeFileSync5(path, value, { encoding: "utf8", mode: 420 });
+  writeFileSync6(path, value, { encoding: "utf8", mode: 420 });
   chmodSync5(path, 420);
 }
 function generateCertificates(paths) {
-  mkdirSync6(paths.dir, { recursive: true, mode: 448 });
+  mkdirSync7(paths.dir, { recursive: true, mode: 448 });
   chmodSync5(paths.dir, 448);
   const caKeys = forge.pki.rsa.generateKeyPair(2048);
   const caCert = forge.pki.createCertificate();
@@ -9791,8 +10877,8 @@ function generateCertificates(paths) {
 }
 function storedCertificatesAreCurrent(paths) {
   try {
-    const ca = forge.pki.certificateFromPem(readFileSync7(paths.caCert, "utf8"));
-    const server = forge.pki.certificateFromPem(readFileSync7(paths.serverCert, "utf8"));
+    const ca = forge.pki.certificateFromPem(readFileSync8(paths.caCert, "utf8"));
+    const server = forge.pki.certificateFromPem(readFileSync8(paths.serverCert, "utf8"));
     const now = Date.now();
     const renewalBuffer = 7 * 24 * 60 * 60 * 1e3;
     return ca.validity.notBefore.getTime() <= now && ca.validity.notAfter.getTime() > now + renewalBuffer && server.validity.notBefore.getTime() <= now && server.validity.notAfter.getTime() > now + renewalBuffer && ca.verify(ca) && ca.verify(server);
@@ -9803,23 +10889,23 @@ function storedCertificatesAreCurrent(paths) {
 function ensureHttpProxyCertificates() {
   const paths = certPaths();
   const required = [paths.caCert, paths.caKey, paths.serverCert, paths.serverKey, paths.version];
-  const current = required.every(existsSync5) && readFileSync7(paths.version, "utf8") === CERT_VERSION && storedCertificatesAreCurrent(paths);
+  const current = required.every(existsSync6) && readFileSync8(paths.version, "utf8") === CERT_VERSION && storedCertificatesAreCurrent(paths);
   if (!current) generateCertificates(paths);
   return {
     caCertPath: paths.caCert,
-    caCert: readFileSync7(paths.caCert, "utf8"),
-    serverCert: readFileSync7(paths.serverCert, "utf8"),
-    serverKey: readFileSync7(paths.serverKey, "utf8")
+    caCert: readFileSync8(paths.caCert, "utf8"),
+    serverCert: readFileSync8(paths.serverCert, "utf8"),
+    serverKey: readFileSync8(paths.serverKey, "utf8")
   };
 }
 function ensureHttpProxyCaBundle(relayCaCertPath, additionalCaCertPath) {
   if (!additionalCaCertPath?.trim()) return relayCaCertPath;
   try {
     if (resolve(additionalCaCertPath) === resolve(relayCaCertPath)) return relayCaCertPath;
-    const relayCa = readFileSync7(relayCaCertPath, "utf8").trimEnd();
-    const additionalCa = readFileSync7(additionalCaCertPath, "utf8").trim();
+    const relayCa = readFileSync8(relayCaCertPath, "utf8").trimEnd();
+    const additionalCa = readFileSync8(additionalCaCertPath, "utf8").trim();
     if (!additionalCa) return relayCaCertPath;
-    const combinedPath = join5(dirname5(relayCaCertPath), "combined-ca.pem");
+    const combinedPath = join5(dirname6(relayCaCertPath), "combined-ca.pem");
     writePublic(combinedPath, `${relayCa}
 ${additionalCa}
 `);
@@ -10373,7 +11459,7 @@ async function startHttpProxy(options) {
     }
     const messagesEndpoint = anthropicMessagesEndpoint(req.url);
     if (req.method === "POST" && messagesEndpoint) {
-      const requestId = randomUUID8();
+      const requestId = randomUUID10();
       let parsed = null;
       let route;
       try {
@@ -10501,23 +11587,17 @@ async function startHttpProxy(options) {
       clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n", () => clientSocket.destroy());
     });
   });
+  let address;
   try {
-    await new Promise((resolve2, reject) => {
-      proxyServer.once("error", reject);
-      proxyServer.listen(options.port ?? 0, options.host ?? "127.0.0.1", () => {
-        proxyServer.off("error", reject);
-        resolve2();
-      });
-    });
+    address = await listenTcpServer(
+      proxyServer,
+      options.port ?? 0,
+      options.host ?? "127.0.0.1"
+    );
   } catch (err) {
     adapter?.close();
     throw err;
   }
-  const address = proxyServer.address();
-  if (!address || typeof address === "string") {
-    adapter?.close();
-    throw new Error("HTTP proxy did not bind to a TCP port");
-  }
   return {
     host: options.host ?? "127.0.0.1",
     port: address.port,
@@ -10627,12 +11707,13 @@ function waitForShutdown() {
 }
 async function runHttpProxyServerCommand(debug = false, webSocketDiagnostics = false, port, noDiscovery = false) {
   const webSocketDiagnosticsLogPath = webSocketDiagnostics ? getSessionLogPath("server-websocket-diagnostics", "jsonl") : void 0;
+  const inferenceLogPath = getInferenceRequestLogPath();
   let started;
   try {
     started = await startConfiguredHttpProxy(
       port ?? DEFAULT_SERVER_PORT,
       debug,
-      getInferenceRequestLogPath(),
+      inferenceLogPath,
       void 0,
       webSocketDiagnosticsLogPath
     );
@@ -10641,6 +11722,13 @@ async function runHttpProxyServerCommand(debug = false, webSocketDiagnostics = f
     return 1;
   }
   const { handle, loaded } = started;
+  writeProxyLifecycleLog(inferenceLogPath, {
+    event: "proxy_started",
+    pid: process.pid,
+    parentPid: process.ppid,
+    host: handle.host,
+    port: handle.port
+  });
   console.log("");
   console.log(pc9.bold(pc9.green("clodex proxy-mode server running")));
   console.log(`  HTTPS_PROXY=http://127.0.0.1:${handle.port}`);
@@ -10668,8 +11756,23 @@ async function runHttpProxyServerCommand(debug = false, webSocketDiagnostics = f
     });
   }
   await waitForShutdown();
+  writeProxyLifecycleLog(inferenceLogPath, {
+    event: "proxy_stopping",
+    pid: process.pid,
+    parentPid: process.ppid,
+    host: handle.host,
+    port: handle.port,
+    reason: "shutdown signal received"
+  });
   if (!noDiscovery) unregisterServerRuntimeState();
   await handle.close();
+  writeProxyLifecycleLog(inferenceLogPath, {
+    event: "proxy_stopped",
+    pid: process.pid,
+    parentPid: process.ppid,
+    host: handle.host,
+    port: handle.port
+  });
   return 0;
 }
 
@@ -11282,17 +12385,17 @@ function planLaunchWizard(opts) {
 }
 
 // src/patcher.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync8,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync9,
   statSync as statSync4,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync6,
-  openSync as openSync4,
-  closeSync as closeSync4,
+  unlinkSync as unlinkSync5,
+  writeFileSync as writeFileSync7,
+  openSync as openSync5,
+  closeSync as closeSync5,
   realpathSync
 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -11489,7 +12592,7 @@ function getPatchLockPath() {
 }
 function readPatchManifest(path = getPatchManifestPath()) {
   try {
-    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    const parsed = JSON.parse(readFileSync9(path, "utf8"));
     if (parsed && typeof parsed.binaryPath === "string" && typeof parsed.configHash === "string") {
       return parsed;
     }
@@ -11498,8 +12601,8 @@ function readPatchManifest(path = getPatchManifestPath()) {
   return null;
 }
 function writePatchManifest(manifest, path = getPatchManifestPath()) {
-  mkdirSync7(getAppHome(), { recursive: true, mode: 448 });
-  writeFileSync6(path, `${JSON.stringify(manifest, null, 2)}
+  mkdirSync8(getAppHome(), { recursive: true, mode: 448 });
+  writeFileSync7(path, `${JSON.stringify(manifest, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 function buildPatchModelConfig(favorites, aliases, modelMetaFor) {
@@ -11527,7 +12630,7 @@ function computePatchConfigHash(config) {
     const entry = config[key];
     return [key, entry.alias ?? null, entry.context ?? null, entry.display ?? null];
   });
-  return createHash7("sha256").update(JSON.stringify(canonical)).digest("hex");
+  return createHash8("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 function buildDesiredPatchConfig() {
   const prefs = loadPreferences();
@@ -11570,30 +12673,30 @@ function pidIsAlive(pid) {
 function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   const now = opts.now ?? Date.now();
   const isAlive = opts.isAlive ?? pidIsAlive;
-  mkdirSync7(join6(lockPath, ".."), { recursive: true, mode: 448 });
+  mkdirSync8(join6(lockPath, ".."), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = openSync4(lockPath, "wx");
+      const fd = openSync5(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
-      writeFileSync6(fd, JSON.stringify(content));
-      closeSync4(fd);
+      writeFileSync7(fd, JSON.stringify(content));
+      closeSync5(fd);
       return () => {
         try {
-          unlinkSync4(lockPath);
+          unlinkSync5(lockPath);
         } catch {
         }
       };
     } catch {
       let stale = false;
       try {
-        const existing = JSON.parse(readFileSync8(lockPath, "utf8"));
+        const existing = JSON.parse(readFileSync9(lockPath, "utf8"));
         stale = !existing.pid || !isAlive(existing.pid) || typeof existing.startedAt === "number" && now - existing.startedAt > PATCH_LOCK_STALE_MS;
       } catch {
         stale = true;
       }
       if (!stale) return null;
       try {
-        unlinkSync4(lockPath);
+        unlinkSync5(lockPath);
       } catch {
       }
     }
@@ -11601,12 +12704,12 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   return null;
 }
 function sha256File(path) {
-  return createHash7("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash8("sha256").update(readFileSync9(path)).digest("hex");
 }
 function resolveClaudeBinaryForPatch() {
   const envOverride = process.env["TWEAKCC_CC_INSTALLATION_PATH"];
   const nativeSymlink = join6(homedir2(), ".local", "bin", "claude");
-  const source = envOverride?.trim() || (existsSync6(nativeSymlink) ? nativeSymlink : null) || findClaudeBinary();
+  const source = envOverride?.trim() || (existsSync7(nativeSymlink) ? nativeSymlink : null) || findClaudeBinary();
   if (!source) return null;
   let resolved;
   try {
@@ -11641,13 +12744,13 @@ function summarizePatchResults(results) {
 }
 async function applyPatch(binaryPath, version, desired, configHash, opts) {
   const backup = pristineBackupPath(version, binaryPath);
-  mkdirSync7(backupDir(), { recursive: true });
+  mkdirSync8(backupDir(), { recursive: true });
   if (opts.restoreFirst) {
-    if (!existsSync6(backup)) {
+    if (!existsSync7(backup)) {
       return { ok: false, message: `Cannot re-patch: pristine backup missing at ${backup}. Reinstall claude, then run clodex patch.` };
     }
     copyFileSync2(backup, binaryPath);
-  } else if (!existsSync6(backup)) {
+  } else if (!existsSync7(backup)) {
     copyFileSync2(binaryPath, backup);
   }
   copyFileSync2(backup, join6(backupDir(), "native-binary.backup"));
@@ -11703,14 +12806,14 @@ async function runPatchCommand(opts = {}) {
   const { binaryPath, version } = resolved;
   if (opts.restore) {
     const manifest2 = readPatchManifest();
-    const backup = manifest2?.backupPath && existsSync6(manifest2.backupPath) ? manifest2.backupPath : pristineBackupPath(version, binaryPath);
-    if (!existsSync6(backup)) {
+    const backup = manifest2?.backupPath && existsSync7(manifest2.backupPath) ? manifest2.backupPath : pristineBackupPath(version, binaryPath);
+    if (!existsSync7(backup)) {
       p11.log.error(`No pristine backup found for claude ${version} (${backup}).`);
       return 1;
     }
     copyFileSync2(backup, binaryPath);
     try {
-      unlinkSync4(getPatchManifestPath());
+      unlinkSync5(getPatchManifestPath());
     } catch {
     }
     p11.log.success(`Restored pristine claude ${version} from ${backup}.`);
@@ -11743,7 +12846,7 @@ async function runPatchCommand(opts = {}) {
   }
   try {
     const backup = pristineBackupPath(version, binaryPath);
-    const restoreFirst = existsSync6(backup) && sha256File(backup) !== sha256File(binaryPath);
+    const restoreFirst = existsSync7(backup) && sha256File(backup) !== sha256File(binaryPath);
     if (restoreFirst) {
       p11.log.info("Binary differs from its pristine backup \u2014 restoring it before patching fresh.");
     }
@@ -12836,7 +13939,8 @@ Error: ${launchPlan.error}
     return 0;
   }
   const launchApiKey = await resolveLocalProviderApiKey(activeProvider);
-  if (!launchApiKey?.trim()) {
+  const anonymousProvider = activeProvider.authType === "none";
+  if (!anonymousProvider && !launchApiKey?.trim()) {
     p12.log.error(
       `No credential found for ${activeProvider.name}. Add a key or sign in with clodex providers.`
     );
@@ -12845,7 +13949,8 @@ Error: ${launchPlan.error}
   let proxyHandle = null;
   let childEnv;
   const isOAuthAnthropic = selectedModel.modelFormat === "anthropic" && activeProvider.authType === "oauth";
-  if (isOAuthAnthropic) {
+  const usesAnthropicProxy = selectedModel.modelFormat === "anthropic" && (isOAuthAnthropic || anonymousProvider);
+  if (usesAnthropicProxy) {
     try {
       proxyHandle = await startProxy(
         selectedModel.baseUrl ?? "https://api.anthropic.com",
@@ -12854,16 +13959,17 @@ Error: ${launchPlan.error}
         selectedModel.contextWindow,
         {
           providerId: activeProvider.id,
-          authType: "oauth",
+          authType: activeProvider.authType,
           oauthAccountId: activeProvider.oauthAccountId,
           providerData: activeProvider.providerData,
-          modelFormat: "anthropic"
+          modelFormat: "anthropic",
+          headers: activeProvider.headers
         },
-        launchApiKey
+        launchApiKey ?? ""
       );
-      if (!isAgentStdoutMode()) p12.log.info(`OAuth proxy started on port ${proxyHandle.port}`);
+      if (!isAgentStdoutMode()) p12.log.info(`Anthropic proxy started on port ${proxyHandle.port}`);
     } catch (err) {
-      p12.log.error(`Failed to start OAuth proxy: ${err instanceof Error ? err.message : String(err)}`);
+      p12.log.error(`Failed to start Anthropic proxy: ${err instanceof Error ? err.message : String(err)}`);
       return 1;
     }
     childEnv = buildChildEnv(
@@ -12877,7 +13983,7 @@ Error: ${launchPlan.error}
     childEnv = buildChildEnv(
       selectedModel.baseUrl,
       selectedModel.id,
-      launchApiKey,
+      launchApiKey ?? "",
       void 0,
       selectedModel.contextWindow
     );
@@ -12899,9 +14005,10 @@ Error: ${launchPlan.error}
           reasoning: selectedModel.reasoning,
           interleavedReasoningField: selectedModel.interleavedReasoningField,
           useResponsesLite: selectedModel.useResponsesLite,
-          preferWebSockets: selectedModel.preferWebSockets
+          preferWebSockets: selectedModel.preferWebSockets,
+          headers: activeProvider.headers
         },
-        launchApiKey
+        launchApiKey ?? ""
       );
       if (!isAgentStdoutMode()) {
         p12.log.info(
@@ -12920,7 +14027,7 @@ Error: ${launchPlan.error}
       selectedModel.contextWindow
     );
   }
-  if (selectedModel.modelFormat === "anthropic" && !isOAuthAnthropic) {
+  if (selectedModel.modelFormat === "anthropic" && !usesAnthropicProxy) {
     childEnv["CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS"] = "1";
   }
   const debugLogPath = prepareClaudeTraceLog();