@bman654/clodex 2.3.0 → 2.5.0

package/dist/{chunk-W4SVDQCZ.js → chunk-MRO3KE3P.js}

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// src/oauth-account-selection.ts
+var OAUTH_ACCOUNT_ENV = "CLODEX_OAUTH_ACCOUNT";
+
 // src/config.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
@@ -52,9 +55,15 @@ import {
   writeSync
 } from "fs";
 import { dirname as dirname2 } from "path";
+import { isDeepStrictEqual } from "util";
 
 // src/registry/types.ts
 var REGISTRY_SCHEMA_VERSION = 1;
+var REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_SLOTS = 2;
+var REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT = 3;
+var REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES = 4;
+var REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT = 5;
+var OAUTH_ACCOUNT_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
 
 // src/registry/lock.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -393,6 +402,69 @@ function withProviderMutationLock(providerSlot, operation) {
   });
 }
 
+// src/registry/oauth-account-storage.ts
+function getOAuthAccountSlot(provider, name) {
+  const accounts = provider.authAccounts;
+  return accounts && Object.prototype.hasOwnProperty.call(accounts, name) ? accounts[name] : void 0;
+}
+function providerDefaultAuthRef(provider) {
+  return provider.defaultAuthRef ?? provider.authRef;
+}
+function storeActiveOAuthAccount(provider, name, selectedAuthRef) {
+  const previousAuthRef = provider.authRef;
+  const previousDefaultAuthRef = provider.defaultAuthRef;
+  const previousDefaultModelsCache = provider.defaultModelsCache;
+  const previousAccount = provider.activeAuthAccount;
+  if (provider.defaultAuthRef === void 0) {
+    provider.defaultAuthRef = provider.authRef;
+    if (provider.modelsCache) provider.defaultModelsCache = provider.modelsCache;
+  }
+  provider.authRef = selectedAuthRef;
+  provider.activeAuthAccount = name;
+  return previousAuthRef !== provider.authRef || previousDefaultAuthRef !== provider.defaultAuthRef || previousDefaultModelsCache !== provider.defaultModelsCache || previousAccount !== provider.activeAuthAccount;
+}
+function clearActiveOAuthAccount(provider) {
+  const previousAuthRef = provider.authRef;
+  const previousDefaultAuthRef = provider.defaultAuthRef;
+  const previousDefaultModelsCache = provider.defaultModelsCache;
+  const previousAccount = provider.activeAuthAccount;
+  const hasMaterializedSelection = provider.defaultAuthRef !== void 0;
+  provider.authRef = providerDefaultAuthRef(provider);
+  if (hasMaterializedSelection) {
+    if (provider.defaultModelsCache) {
+      provider.modelsCache = provider.defaultModelsCache;
+      provider.refreshedAt = provider.defaultModelsCache.fetchedAt;
+    } else {
+      delete provider.modelsCache;
+      delete provider.refreshedAt;
+    }
+  }
+  delete provider.defaultAuthRef;
+  delete provider.defaultModelsCache;
+  delete provider.activeAuthAccount;
+  return previousAuthRef !== provider.authRef || previousDefaultAuthRef !== provider.defaultAuthRef || previousDefaultModelsCache !== provider.defaultModelsCache || previousAccount !== provider.activeAuthAccount;
+}
+function migrateActiveOAuthAccountStorage(registry) {
+  let changed = false;
+  for (const provider of registry.providers) {
+    const name = provider.activeAuthAccount?.trim();
+    if (provider.authType !== "oauth" || !name || provider.defaultAuthRef !== void 0) continue;
+    const selected = getOAuthAccountSlot(provider, name);
+    if (!selected) continue;
+    provider.defaultAuthRef = provider.authRef;
+    provider.authRef = selected.authRef;
+    if (registry.schemaVersion >= 4 && selected.modelsCache) {
+      provider.modelsCache = selected.modelsCache;
+      provider.refreshedAt = selected.modelsCache.fetchedAt;
+    } else {
+      delete provider.modelsCache;
+      delete provider.refreshedAt;
+    }
+    changed = true;
+  }
+  return changed;
+}
+
 // src/registry/migrate.ts
 function migrateOAuthOpenAiProvider(registry) {
   if (registry.providers.some((p) => p.id === "openai-oauth")) return false;
@@ -409,6 +481,14 @@ function migrateOAuthOpenAiProvider(registry) {
   };
   return true;
 }
+function migrateRegistry(registry) {
+  const renamed = migrateOAuthOpenAiProvider(registry);
+  const materialized = registry.schemaVersion >= REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT && registry.schemaVersion <= REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES ? migrateActiveOAuthAccountStorage(registry) : false;
+  return {
+    changed: renamed || materialized,
+    materializedActiveAccount: materialized
+  };
+}
 
 // src/registry/validate.ts
 var PROVIDER_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
@@ -462,7 +542,7 @@ function syncParentDirectory(path) {
     if (fd !== void 0) closeSync2(fd);
   }
 }
-function parseProvider(raw) {
+function parseProvider(raw, diag) {
   if (!raw || typeof raw !== "object") return null;
   const p = raw;
   if (typeof p.id !== "string" || !isValidProviderId(p.id)) return null;
@@ -482,65 +562,161 @@ function parseProvider(raw) {
     api,
     addedAt: p.addedAt
   };
+  if (hasOwn(p, "defaultAuthRef")) {
+    if (typeof p.defaultAuthRef !== "string" || !p.defaultAuthRef) return null;
+    provider.defaultAuthRef = p.defaultAuthRef;
+  }
   if (p.subscriptionFilter === "free") {
     provider.subscriptionFilter = p.subscriptionFilter;
   }
+  if (typeof p.preserveModelPricing === "boolean") {
+    provider.preserveModelPricing = p.preserveModelPricing;
+  }
   if (p.authType === "api" || p.authType === "oauth" || p.authType === "none") {
     provider.authType = p.authType;
   }
+  if (hasOwn(p, "authAccounts")) {
+    const slots = parseAuthAccounts(p.authAccounts);
+    if (slots === null) return null;
+    provider.authAccounts = slots;
+  }
+  if (hasOwn(p, "activeAuthAccount")) {
+    if (!isAccountName(p.activeAuthAccount)) return null;
+    provider.activeAuthAccount = p.activeAuthAccount;
+  }
   if (typeof p.refreshedAt === "string") provider.refreshedAt = p.refreshedAt;
-  if (p.modelsCache && typeof p.modelsCache === "object") {
-    const cache = p.modelsCache;
-    if (typeof cache.fetchedAt === "string" && Array.isArray(cache.models)) {
-      provider.modelsCache = {
-        fetchedAt: cache.fetchedAt,
-        models: cache.models.filter((m) => m && typeof m === "object")
-      };
-    }
+  if (hasOwn(p, "defaultModelsCache")) {
+    const defaultModelsCache = parseModelsCache(p.defaultModelsCache);
+    if (!defaultModelsCache) return null;
+    provider.defaultModelsCache = defaultModelsCache;
+  }
+  const modelsCache = parseModelsCache(p.modelsCache);
+  if (modelsCache) provider.modelsCache = modelsCache;
+  else if (hasOwn(p, "modelsCache")) {
+    diag?.(`Provider registry dropped an invalid model cache for provider "${p.id}".`);
   }
   return provider;
 }
 function hasOwn(record, key) {
   return Object.prototype.hasOwnProperty.call(record, key);
 }
+function isAccountName(raw) {
+  return typeof raw === "string" && OAUTH_ACCOUNT_NAME_RE.test(raw);
+}
+function parseModelsCache(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const cache = raw;
+  if (typeof cache.fetchedAt !== "string" || !Array.isArray(cache.models)) return null;
+  if (cache.models.some((model) => !model || typeof model !== "object" || Array.isArray(model))) {
+    return null;
+  }
+  return {
+    fetchedAt: cache.fetchedAt,
+    models: cache.models
+  };
+}
+function parseAuthAccounts(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const out = {};
+  for (const [name, value] of Object.entries(raw)) {
+    if (!OAUTH_ACCOUNT_NAME_RE.test(name)) return null;
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const slot = value;
+    if (typeof slot.authRef !== "string" || !slot.authRef) return null;
+    if (typeof slot.addedAt !== "string" || !slot.addedAt) return null;
+    const modelsCache = hasOwn(slot, "modelsCache") ? parseModelsCache(slot.modelsCache) : void 0;
+    if (hasOwn(slot, "modelsCache") && !modelsCache) return null;
+    out[name] = {
+      authRef: slot.authRef,
+      addedAt: slot.addedAt,
+      ...modelsCache ? { modelsCache } : {}
+    };
+  }
+  return out;
+}
 function hasValidStrictProviderFields(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
   const provider = raw;
   if (hasOwn(provider, "subscriptionFilter") && provider.subscriptionFilter !== "free") {
     return false;
   }
+  if (hasOwn(provider, "preserveModelPricing") && typeof provider.preserveModelPricing !== "boolean") {
+    return false;
+  }
   if (hasOwn(provider, "authType") && provider.authType !== "api" && provider.authType !== "oauth" && provider.authType !== "none") {
     return false;
   }
   if (hasOwn(provider, "refreshedAt") && typeof provider.refreshedAt !== "string") {
     return false;
   }
+  if (hasOwn(provider, "authAccounts") && parseAuthAccounts(provider.authAccounts) === null) {
+    return false;
+  }
+  if (hasOwn(provider, "activeAuthAccount") && !isAccountName(provider.activeAuthAccount)) {
+    return false;
+  }
+  if (hasOwn(provider, "defaultAuthRef") && (typeof provider.defaultAuthRef !== "string" || !provider.defaultAuthRef)) {
+    return false;
+  }
+  if (hasOwn(provider, "defaultModelsCache") && parseModelsCache(provider.defaultModelsCache) === null) {
+    return false;
+  }
   if (hasOwn(provider, "modelsCache")) {
-    const cache = provider.modelsCache;
-    if (!cache || typeof cache !== "object" || Array.isArray(cache)) return false;
-    const fields = cache;
-    if (typeof fields.fetchedAt !== "string" || !Array.isArray(fields.models)) {
-      return false;
-    }
-    if (fields.models.some((model) => !model || typeof model !== "object" || Array.isArray(model))) {
-      return false;
-    }
+    if (parseModelsCache(provider.modelsCache) === null) return false;
   }
   return true;
 }
-function parseRegistry(raw) {
+function hasPresentInvalidAuthType(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const provider = raw;
+  return hasOwn(provider, "authType") && provider.authType !== "api" && provider.authType !== "oauth" && provider.authType !== "none";
+}
+function hasValidSelectionStorage(provider, schemaVersion) {
+  const name = provider.activeAuthAccount?.trim();
+  const hasDefault = provider.defaultAuthRef !== void 0;
+  const hasDefaultCache = provider.defaultModelsCache !== void 0;
+  if (schemaVersion < REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES && Object.values(provider.authAccounts ?? {}).some((account) => account.modelsCache !== void 0)) {
+    return false;
+  }
+  if (name && schemaVersion < REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT) {
+    return false;
+  }
+  if (schemaVersion <= REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES && (hasDefault || hasDefaultCache)) {
+    return false;
+  }
+  if (!name) return !hasDefault && !hasDefaultCache;
+  if (provider.authType !== "oauth") return !hasDefault && !hasDefaultCache;
+  if (schemaVersion <= REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES) {
+    return true;
+  }
+  if (schemaVersion !== REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT) {
+    return true;
+  }
+  const selected = getOAuthAccountSlot(provider, name);
+  return hasDefault && selected !== void 0 && provider.authRef === selected.authRef && isDeepStrictEqual(provider.modelsCache, selected.modelsCache);
+}
+function parseRegistry(raw, diag) {
   const empty = { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
   if (!raw || typeof raw !== "object") return empty;
   const data = raw;
+  const schemaVersion = typeof data.schemaVersion === "number" ? data.schemaVersion : REGISTRY_SCHEMA_VERSION;
   const providers = [];
   if (Array.isArray(data.providers)) {
-    for (const entry of data.providers) {
-      const parsed = parseProvider(entry);
-      if (parsed) providers.push(parsed);
+    for (const [index, entry] of data.providers.entries()) {
+      const parsed = parseProvider(entry, diag);
+      const invalidKnownSelectionAuthType = schemaVersion >= REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT && schemaVersion <= REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT && parsed?.activeAuthAccount !== void 0 && hasPresentInvalidAuthType(entry);
+      const validSelectionStorage = parsed ? hasValidSelectionStorage(parsed, schemaVersion) : false;
+      if (parsed && !invalidKnownSelectionAuthType && validSelectionStorage) {
+        providers.push(parsed);
+      } else {
+        const id = entry && typeof entry === "object" && typeof entry.id === "string" ? ` "${entry.id}"` : ` at index ${index}`;
+        const reason = parsed && !validSelectionStorage ? " because its OAuth account selection storage is inconsistent" : "";
+        diag?.(`Provider registry dropped invalid provider${id}${reason}.`);
+      }
     }
   }
   const registry = {
-    schemaVersion: typeof data.schemaVersion === "number" ? data.schemaVersion : REGISTRY_SCHEMA_VERSION,
+    schemaVersion,
     providers
   };
   if (typeof data.importedAt === "string") registry.importedAt = data.importedAt;
@@ -552,14 +728,15 @@ function parseRegistryStrict(raw) {
     throw new Error("Provider registry must be a JSON object.");
   }
   const data = raw;
-  if (data.schemaVersion !== REGISTRY_SCHEMA_VERSION) {
+  if (data.schemaVersion !== REGISTRY_SCHEMA_VERSION && data.schemaVersion !== REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_SLOTS && data.schemaVersion !== REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT && data.schemaVersion !== REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES && data.schemaVersion !== REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT) {
     throw new Error("Provider registry has an unsupported schema version.");
   }
   if (!Array.isArray(data.providers)) {
     throw new Error("Provider registry is missing its providers list.");
   }
   for (const entry of data.providers) {
-    if (!parseProvider(entry) || !hasValidStrictProviderFields(entry)) {
+    const provider = parseProvider(entry);
+    if (!provider || !hasValidStrictProviderFields(entry) || !hasValidSelectionStorage(provider, data.schemaVersion)) {
       throw new Error("Provider registry contains an invalid provider entry.");
     }
   }
@@ -568,27 +745,185 @@ function parseRegistryStrict(raw) {
 function readRegistryStrict(path) {
   return parseRegistryStrict(JSON.parse(readFileSync2(path, "utf8")));
 }
-function loadRegistry(path = getProvidersPath()) {
+var RegistryMigrationValidationError = class extends Error {
+  constructor(registryPath, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(detail, { cause });
+    this.registryPath = registryPath;
+    this.name = "RegistryMigrationValidationError";
+  }
+  registryPath;
+};
+var RegistryMigrationReadError = class extends Error {
+  constructor(registryPath, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(detail, { cause });
+    this.registryPath = registryPath;
+    this.name = "RegistryMigrationReadError";
+  }
+  registryPath;
+};
+var RegistrySaveValidationError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "RegistrySaveValidationError";
+  }
+};
+var RegistryPersistenceError = class extends Error {
+  constructor(registryPath, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(detail, { cause });
+    this.registryPath = registryPath;
+    this.name = "RegistryPersistenceError";
+  }
+  registryPath;
+};
+var RegistryDurabilityCheckError = class extends Error {
+  constructor(registryPath, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(detail, { cause });
+    this.registryPath = registryPath;
+    this.name = "RegistryDurabilityCheckError";
+  }
+  registryPath;
+};
+function selectedAccountFilesystemError(path, cause, action) {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new Error(
+    `Could not safely persist the selected OAuth account before launch. Could not ${action} the provider registry at ${path}: ${detail} Check filesystem permissions, storage health, and free disk space, then retry.`,
+    { cause }
+  );
+}
+function hasMaterializedActiveAccount(registry) {
+  return registry.schemaVersion === REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT && registry.providers.some((provider) => provider.defaultAuthRef !== void 0);
+}
+function loadRegistry(path = getProvidersPath(), diag) {
   if (!existsSync(path)) {
     return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
   }
+  let registry;
   try {
     const raw = JSON.parse(readFileSync2(path, "utf8"));
-    const registry = parseRegistry(raw);
-    const migrated = migrateOAuthOpenAiProvider(registry);
-    if (migrated) {
-      try {
-        withRegistryWriteLockSync(() => {
-          if (!existsSync(path)) return;
-          const current = readRegistryStrict(path);
-          if (migrateOAuthOpenAiProvider(current)) saveRegistry(current, path);
-        }, { lockPath: `${path}.lock` });
-      } catch {
+    registry = parseRegistry(raw, diag);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    diag?.(`Could not read the provider registry at ${path}; treating it as empty: ${detail}`);
+    return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  }
+  const migration = migrateRegistry(registry);
+  if (!migration.changed) {
+    try {
+      syncParentDirectory(path);
+    } catch (error) {
+      if (hasMaterializedActiveAccount(registry)) {
+        throw selectedAccountFilesystemError(path, error, "durably sync");
       }
+      const detail = error instanceof Error ? error.message : String(error);
+      diag?.(`Could not durably sync the unchanged provider registry at ${path}; continuing read-only: ${detail}`);
     }
     return registry;
-  } catch {
-    return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  }
+  let winner = registry;
+  let materializedActiveAccount = migration.materializedActiveAccount;
+  try {
+    withRegistryWriteLockSync(() => {
+      if (!existsSync(path)) {
+        if (materializedActiveAccount) {
+          throw new Error("the provider registry disappeared during migration");
+        }
+        return;
+      }
+      let serialized;
+      try {
+        serialized = readFileSync2(path, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT") {
+          throw new Error("the provider registry disappeared during migration", { cause: error });
+        }
+        throw new RegistryMigrationReadError(path, error);
+      }
+      let raw;
+      try {
+        raw = JSON.parse(serialized);
+      } catch (error) {
+        throw new RegistryMigrationValidationError(path, error);
+      }
+      const lenientCurrent = parseRegistry(raw);
+      const lenientMigration = migrateRegistry(lenientCurrent);
+      winner = lenientCurrent;
+      materializedActiveAccount = lenientMigration.materializedActiveAccount || hasMaterializedActiveAccount(lenientCurrent);
+      let current;
+      try {
+        current = parseRegistryStrict(raw);
+      } catch (error) {
+        throw new RegistryMigrationValidationError(path, error);
+      }
+      const currentMigration = migrateRegistry(current);
+      winner = current;
+      materializedActiveAccount = currentMigration.materializedActiveAccount || hasMaterializedActiveAccount(current);
+      if (currentMigration.changed) {
+        try {
+          saveRegistry(current, path);
+        } catch (error) {
+          if (error instanceof RegistrySaveValidationError) {
+            throw new RegistryMigrationValidationError(path, error);
+          }
+          throw error;
+        }
+      } else {
+        try {
+          syncParentDirectory(path);
+        } catch (error) {
+          throw new RegistryDurabilityCheckError(path, error);
+        }
+      }
+    }, { lockPath: `${path}.lock` });
+    return winner;
+  } catch (error) {
+    if (error instanceof RegistryDurabilityCheckError) {
+      if (materializedActiveAccount) {
+        throw selectedAccountFilesystemError(
+          error.registryPath,
+          error,
+          "durably sync"
+        );
+      }
+      throw new Error(
+        `Could not durably sync the provider registry at ${error.registryPath}: ${error.message} Check filesystem permissions, storage health, and free disk space, then retry.`,
+        { cause: error }
+      );
+    }
+    if (materializedActiveAccount) {
+      if (error instanceof RegistryMigrationValidationError) {
+        throw new Error(
+          `Could not safely persist the selected OAuth account before launch. The provider registry at ${error.registryPath} is invalid: ${error.message} Repair it or restore ${error.registryPath}.bak, then retry.`,
+          { cause: error }
+        );
+      }
+      if (error instanceof RegistryMigrationReadError) {
+        throw selectedAccountFilesystemError(
+          error.registryPath,
+          error,
+          "read"
+        );
+      }
+      if (error instanceof RegistryPersistenceError) {
+        throw selectedAccountFilesystemError(
+          error.registryPath,
+          error,
+          "durably write"
+        );
+      }
+      if (error && typeof error === "object" && typeof error.code === "string") {
+        throw selectedAccountFilesystemError(path, error, "access the lock for");
+      }
+      const detail = error instanceof Error ? ` ${error.message}` : "";
+      throw new Error(
+        `Could not safely persist the selected OAuth account before launch.${detail} Stop other Clodex processes and retry.`,
+        { cause: error }
+      );
+    }
+    return winner;
   }
 }
 function loadRegistryStrict(path = getProvidersPath()) {
@@ -596,12 +931,43 @@ function loadRegistryStrict(path = getProvidersPath()) {
     return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
   }
   const registry = readRegistryStrict(path);
-  migrateOAuthOpenAiProvider(registry);
+  migrateRegistry(registry);
   return registry;
 }
 function saveRegistry(registry, path = getProvidersPath()) {
   assertRegistryWriteOwnership(path);
-  const payload = `${JSON.stringify(registry, null, 2)}
+  if (registry.schemaVersion >= REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT && registry.schemaVersion <= REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES) {
+    migrateActiveOAuthAccountStorage(registry);
+  }
+  for (const provider of registry.providers) {
+    if (!hasValidSelectionStorage(
+      provider,
+      REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT
+    )) {
+      throw new RegistrySaveValidationError(
+        "Provider registry contains invalid OAuth account selection storage."
+      );
+    }
+  }
+  const hasMaterializedSelector = registry.providers.some(
+    (provider) => provider.defaultAuthRef !== void 0
+  );
+  const hasAccountModelCaches = registry.providers.some((provider) => Object.values(provider.authAccounts ?? {}).some((account) => account.modelsCache !== void 0));
+  const hasSelector = registry.providers.some((provider) => provider.activeAuthAccount !== void 0);
+  const hasSlots = registry.providers.some(
+    (provider) => provider.authAccounts && Object.keys(provider.authAccounts).length > 0
+  );
+  const schemaVersion = hasMaterializedSelector ? REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT : hasAccountModelCaches ? REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_MODEL_CACHES : hasSelector ? REGISTRY_SCHEMA_VERSION_WITH_ACTIVE_ACCOUNT : hasSlots ? REGISTRY_SCHEMA_VERSION_WITH_ACCOUNT_SLOTS : REGISTRY_SCHEMA_VERSION;
+  const serializedRegistry = { ...registry, schemaVersion };
+  try {
+    parseRegistryStrict(JSON.parse(JSON.stringify(serializedRegistry)));
+  } catch (error) {
+    throw new RegistrySaveValidationError(
+      error instanceof Error ? error.message : String(error),
+      { cause: error }
+    );
+  }
+  const payload = `${JSON.stringify(serializedRegistry, null, 2)}
 `;
   const backup = `${path}.bak`;
   if (existsSync(path)) {
@@ -616,11 +982,16 @@ function saveRegistry(registry, path = getProvidersPath()) {
     assertRegistryWriteOwnership(path);
     renameSync(tmp, path);
     syncParentDirectory(path);
+  } catch (error) {
+    if (error instanceof RegistryLockLostError) throw error;
+    throw new RegistryPersistenceError(path, error);
   } finally {
     try {
       unlinkSync2(tmp);
     } catch (err) {
-      if (err.code !== "ENOENT") throw err;
+      if (err.code !== "ENOENT") {
+        throw new RegistryPersistenceError(path, err);
+      }
     }
   }
 }
@@ -822,9 +1193,9 @@ function setServerListenMode(listenMode) {
   });
 }
 
-// src/launch.ts
-import { execFileSync as execFileSync2, execSync, spawn } from "child_process";
-import { existsSync as existsSync3, appendFileSync } from "fs";
+// src/claude-binary.ts
+import { execFileSync as execFileSync2, execSync } from "child_process";
+import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join3 } from "path";
 
@@ -850,7 +1221,7 @@ function findBinaryOnPath(name, fallbackPaths, options = {}) {
   return null;
 }
 
-// src/launch.ts
+// src/claude-binary.ts
 var isWindows = process.platform === "win32";
 var FALLBACK_PATHS = isWindows ? [
   join3(process.env["APPDATA"] ?? homedir2(), "npm", "claude.cmd"),
@@ -894,57 +1265,6 @@ function getInstalledClaudeVersion() {
   if (!claudePath) return FALLBACK_CLAUDE_VERSION;
   return getClaudeVersionForBinary(claudePath) ?? FALLBACK_CLAUDE_VERSION;
 }
-function buildClaudeArgs(model, extraArgs) {
-  return model ? ["--model", model, ...extraArgs] : [...extraArgs];
-}
-function launchClaude(env, model, extraArgs) {
-  return new Promise((resolve) => {
-    const claudePath = findClaudeBinary();
-    const args = buildClaudeArgs(model, extraArgs);
-    const debugFileIdx = extraArgs.indexOf("--debug-file");
-    const debugLogPath = debugFileIdx !== -1 && extraArgs[debugFileIdx + 1] ? extraArgs[debugFileIdx + 1] : void 0;
-    const originalStdoutWrite = process.stdout.write;
-    const originalStderrWrite = process.stderr.write;
-    const muteWrite = (chunk, encoding, callback) => {
-      if (typeof encoding === "function") {
-        callback = encoding;
-      }
-      if (debugLogPath) {
-        try {
-          const str = typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk);
-          appendFileSync(debugLogPath, `[parent] ${str}`);
-        } catch {
-        }
-      }
-      if (callback) callback();
-      return true;
-    };
-    process.stdout.write = muteWrite;
-    process.stderr.write = muteWrite;
-    const restore = () => {
-      process.stdout.write = originalStdoutWrite;
-      process.stderr.write = originalStderrWrite;
-    };
-    const child = spawn(claudePath, args, {
-      stdio: "inherit",
-      env,
-      shell: isWindows
-    });
-    const forward = (signal) => {
-      child.kill(signal);
-    };
-    process.once("SIGINT", () => forward("SIGINT"));
-    process.once("SIGTERM", () => forward("SIGTERM"));
-    child.on("exit", (code) => {
-      restore();
-      resolve(code ?? 0);
-    });
-    child.on("error", (err) => {
-      restore();
-      resolve(1);
-    });
-  });
-}
 
 // src/listener-ready.ts
 import { connect } from "net";
@@ -1223,8 +1543,84 @@ function orderWrapperServerCandidates(records) {
   });
 }
 
+// src/network-env.ts
+var PROXY_ENV_VARS = [
+  "HTTPS_PROXY",
+  "HTTP_PROXY",
+  "https_proxy",
+  "http_proxy"
+];
+var CHILD_NETWORK_ENV_VARS = [
+  ...PROXY_ENV_VARS,
+  "NO_PROXY",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS"
+];
+var NETWORK_ENV_CONTRACT_VAR = "CLAUDE_CODE_CLODEX_NETWORK_ENV";
+var childNetworkEnvVarSet = new Set(CHILD_NETWORK_ENV_VARS);
+function networkEnvValue(env, name) {
+  return typeof env[name] === "string" ? env[name] : null;
+}
+function isNetworkValueRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && Object.entries(value).every(([key, entry]) => childNetworkEnvVarSet.has(key) && (typeof entry === "string" || entry === null)));
+}
+function parseNetworkEnvContract(value) {
+  if (value === void 0) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+    const candidate = parsed;
+    const original = candidate.original;
+    const injected = candidate.injected;
+    if (candidate.version !== 1 || !isNetworkValueRecord(original) || !isNetworkValueRecord(injected)) {
+      return void 0;
+    }
+    if (!Object.keys(original).every((key) => key in injected) || !Object.keys(injected).every((key) => key in original)) {
+      return void 0;
+    }
+    return { version: 1, original, injected };
+  } catch {
+    return void 0;
+  }
+}
+function setNetworkEnvValue(env, name, value) {
+  if (value === null) delete env[name];
+  else env[name] = value;
+}
+function networkEnvBaseline(baseEnv) {
+  const env = { ...baseEnv };
+  const contract = parseNetworkEnvContract(baseEnv[NETWORK_ENV_CONTRACT_VAR]);
+  delete env[NETWORK_ENV_CONTRACT_VAR];
+  if (!contract) return env;
+  for (const name of CHILD_NETWORK_ENV_VARS) {
+    if (!(name in contract.original) || !(name in contract.injected)) continue;
+    if (networkEnvValue(baseEnv, name) !== contract.injected[name]) continue;
+    setNetworkEnvValue(env, name, contract.original[name] ?? null);
+  }
+  return env;
+}
+function recordNetworkEnvMutation(baseline, injectedEnv) {
+  const original = {};
+  const injected = {};
+  for (const name of CHILD_NETWORK_ENV_VARS) {
+    const before = networkEnvValue(baseline, name);
+    const after = networkEnvValue(injectedEnv, name);
+    if (before === after) continue;
+    original[name] = before;
+    injected[name] = after;
+  }
+  if (Object.keys(original).length === 0) {
+    delete injectedEnv[NETWORK_ENV_CONTRACT_VAR];
+    return;
+  }
+  injectedEnv[NETWORK_ENV_CONTRACT_VAR] = JSON.stringify({
+    version: 1,
+    original,
+    injected
+  });
+}
+
 // src/wrapper-env.ts
-var PROXY_ENV_VARS = ["HTTPS_PROXY", "HTTP_PROXY", "https_proxy", "http_proxy"];
 var REQUIRE_SERVER_ENV = "CLODEX_REQUIRE_SERVER";
 function removeAnthropicProxyBypass(env) {
   const noProxyValues = [env["NO_PROXY"], env["no_proxy"]].filter((value) => value !== void 0);
@@ -1250,27 +1646,33 @@ function wrapperRequiresServer(env) {
   return env[REQUIRE_SERVER_ENV] === "1";
 }
 function computeWrapperEnv(baseEnv, state) {
-  const env = { ...baseEnv };
-  if (!state) return env;
+  if (!state) return { ...baseEnv };
+  const baseline = networkEnvBaseline(baseEnv);
+  const env = { ...baseline };
   if (state.mode === "proxy") {
     const proxyUrl = `http://127.0.0.1:${state.port}`;
     delete env["ANTHROPIC_BASE_URL"];
     for (const name of PROXY_ENV_VARS) env[name] = proxyUrl;
     if (state.caPath) env["NODE_EXTRA_CA_CERTS"] = state.caPath;
     removeAnthropicProxyBypass(env);
+    recordNetworkEnvMutation(baseline, env);
     return env;
   }
   for (const name of PROXY_ENV_VARS) delete env[name];
   env["ANTHROPIC_BASE_URL"] = `http://127.0.0.1:${state.port}/anthropic`;
   env["ANTHROPIC_API_KEY"] = LOCAL_GATEWAY_API_KEY;
+  recordNetworkEnvMutation(baseline, env);
   return env;
 }
 
 export {
+  OAUTH_ACCOUNT_ENV,
   getAppHome,
   getLocalPatchesPath,
   getCredentialCleanupPath,
   getLogsPath,
+  REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT,
+  OAUTH_ACCOUNT_NAME_RE,
   assertRegistryWriteOwnership,
   withRegistryWriteLock,
   withRegistryWriteLockSync,
@@ -1278,6 +1680,10 @@ export {
   getCredentialStateRoot,
   withCredentialMutationLock,
   withProviderMutationLock,
+  getOAuthAccountSlot,
+  providerDefaultAuthRef,
+  storeActiveOAuthAccount,
+  clearActiveOAuthAccount,
   isValidProviderId,
   ensureSecureAppHome,
   loadRegistry,
@@ -1300,7 +1706,6 @@ export {
   findClaudeBinary,
   getClaudeVersionForBinary,
   getInstalledClaudeVersion,
-  launchClaude,
   tcpListenerUrlHost,
   waitForTcpListenerCandidate,
   listenTcpServer,
@@ -1309,8 +1714,12 @@ export {
   unregisterServerRuntimeState,
   readLiveServerRuntimeStates,
   orderWrapperServerCandidates,
+  CHILD_NETWORK_ENV_VARS,
+  NETWORK_ENV_CONTRACT_VAR,
+  networkEnvBaseline,
+  recordNetworkEnvMutation,
   removeAnthropicProxyBypass,
   wrapperRequiresServer,
   computeWrapperEnv
 };
-//# sourceMappingURL=chunk-W4SVDQCZ.js.map
+//# sourceMappingURL=chunk-MRO3KE3P.js.map