@bman654/clodex 2.4.0 → 2.5.0

package/dist/cli.js

@@ -1,6 +1,12 @@
 #!/usr/bin/env node
 import {
+  CHILD_NETWORK_ENV_VARS,
+  NETWORK_ENV_CONTRACT_VAR,
+  OAUTH_ACCOUNT_ENV,
+  OAUTH_ACCOUNT_NAME_RE,
+  REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT,
   assertRegistryWriteOwnership,
+  clearActiveOAuthAccount,
   ensureSecureAppHome,
   findClaudeBinary,
   getAppHome,
@@ -11,6 +17,7 @@ import {
   getInstalledClaudeVersion,
   getLocalPatchesPath,
   getLogsPath,
+  getOAuthAccountSlot,
   getSavedServerPassword,
   getServerExposedProviders,
   getServerFavoritesOnly,
@@ -18,12 +25,15 @@ import {
   getServerMaskGatewayIds,
   isDiscoveryDisabled,
   isValidProviderId,
-  launchClaude,
   listenTcpServer,
   loadPreferences,
   loadRegistry,
   loadRegistryStrict,
+  networkEnvBaseline,
+  providerDefaultAuthRef,
+  readLiveServerRuntimeStates,
   recordLaunchSelection,
+  recordNetworkEnvMutation,
   registerServerRuntimeState,
   removeAnthropicProxyBypass,
   resolveBridgeMode,
@@ -34,13 +44,14 @@ import {
   setServerFavoritesOnly,
   setServerListenMode,
   setServerMaskGatewayIds,
+  storeActiveOAuthAccount,
   tcpListenerUrlHost,
   unregisterServerRuntimeState,
   withCredentialMutationLock,
   withProviderMutationLock,
   withRegistryWriteLock,
   withRegistryWriteLockSync
-} from "./chunk-LBEJOEUY.js";
+} from "./chunk-MRO3KE3P.js";
 
 // src/cli.ts
 import pc13 from "picocolors";
@@ -109,8 +120,8 @@ function fmtProvider(name) {
 }
 function fmtProviderBracket(providerId, providerName, isFree) {
   const color = providerTagColor(providerId);
-  const text4 = isFree ? `${providerName} \xB7 free` : providerName;
-  return color(pc.bold(`(${text4})`));
+  const text5 = isFree ? `${providerName} \xB7 free` : providerName;
+  return color(pc.bold(`(${text5})`));
 }
 function providerTagColor(providerId) {
   switch (providerId) {
@@ -211,6 +222,151 @@ import * as p12 from "@clack/prompts";
 import { realpathSync as realpathSync2 } from "fs";
 import { fileURLToPath } from "url";
 
+// src/launch.ts
+import { spawn } from "child_process";
+import { appendFileSync } from "fs";
+
+// src/parent-notice.ts
+import { writeSync } from "fs";
+var MAX_NOTICE_CHARS = 2e3;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
+var activeSink = null;
+var stderrErrorGuardInstalled = false;
+function toNoticeLine(message) {
+  const flattened = message.replace(CONTROL_CHARS, " ").trimEnd();
+  const bounded = flattened.length > MAX_NOTICE_CHARS ? `${flattened.slice(0, MAX_NOTICE_CHARS)}...` : flattened;
+  return `${bounded}
+`;
+}
+function guardStderrErrors() {
+  if (stderrErrorGuardInstalled) return;
+  stderrErrorGuardInstalled = true;
+  try {
+    process.stderr.on("error", () => {
+    });
+  } catch {
+  }
+}
+function writeParentNoticeLines(lines) {
+  if (lines.length === 0) return;
+  guardStderrErrors();
+  try {
+    process.stderr.write(lines.join(""), () => {
+    });
+  } catch {
+  }
+}
+function writeParentNoticeLinesSync(lines) {
+  if (lines.length === 0) return;
+  try {
+    writeSync(2, lines.join(""));
+  } catch {
+  }
+}
+function emitParentNotice(message) {
+  const line = toNoticeLine(message);
+  try {
+    if (activeSink) activeSink(line);
+    else writeParentNoticeLines([line]);
+  } catch {
+  }
+}
+function installParentNoticeSink(sink) {
+  const previous = activeSink;
+  activeSink = sink;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    if (activeSink === sink) activeSink = previous;
+  };
+}
+
+// src/launch.ts
+var isWindows = process.platform === "win32";
+var MAX_QUEUED_NOTICES = 50;
+function buildClaudeArgs(model, extraArgs) {
+  return model ? ["--model", model, ...extraArgs] : [...extraArgs];
+}
+function launchClaude(env, model, extraArgs) {
+  return new Promise((resolve3) => {
+    const claudePath = findClaudeBinary();
+    const args = buildClaudeArgs(model, extraArgs);
+    const debugFileIdx = extraArgs.indexOf("--debug-file");
+    const debugLogPath = debugFileIdx !== -1 && extraArgs[debugFileIdx + 1] ? extraArgs[debugFileIdx + 1] : void 0;
+    const originalStdoutWrite = process.stdout.write;
+    const originalStderrWrite = process.stderr.write;
+    const muteWrite = (chunk, encoding, callback) => {
+      if (typeof encoding === "function") {
+        callback = encoding;
+      }
+      if (debugLogPath) {
+        try {
+          const str = typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk);
+          appendFileSync(debugLogPath, `[parent] ${str}`);
+        } catch {
+        }
+      }
+      if (callback) callback();
+      return true;
+    };
+    process.stdout.write = muteWrite;
+    process.stderr.write = muteWrite;
+    const queuedNotices = [];
+    let droppedNotices = 0;
+    const releaseNoticeSink = installParentNoticeSink((line) => {
+      if (debugLogPath) {
+        try {
+          appendFileSync(debugLogPath, `[parent] ${line}`);
+        } catch {
+        }
+      }
+      if (queuedNotices.length < MAX_QUEUED_NOTICES) queuedNotices.push(line);
+      else droppedNotices += 1;
+    });
+    const takeQueuedNotices = () => {
+      const lines = queuedNotices.splice(0, queuedNotices.length);
+      if (droppedNotices > 0) {
+        lines.push(
+          `clodex: warning: and ${droppedNotices} further notice${droppedNotices === 1 ? "" : "s"} suppressed while Claude Code held the terminal.
+`
+        );
+        droppedNotices = 0;
+      }
+      return lines;
+    };
+    const flushNoticesOnExit = () => {
+      writeParentNoticeLinesSync(takeQueuedNotices());
+    };
+    process.once("exit", flushNoticesOnExit);
+    const restore = () => {
+      releaseNoticeSink();
+      process.removeListener("exit", flushNoticesOnExit);
+      process.stdout.write = originalStdoutWrite;
+      process.stderr.write = originalStderrWrite;
+      writeParentNoticeLines(takeQueuedNotices());
+    };
+    const child = spawn(claudePath, args, {
+      stdio: "inherit",
+      env,
+      shell: isWindows
+    });
+    const forward = (signal) => {
+      child.kill(signal);
+    };
+    process.once("SIGINT", () => forward("SIGINT"));
+    process.once("SIGTERM", () => forward("SIGTERM"));
+    child.on("exit", (code) => {
+      restore();
+      resolve3(code ?? 0);
+    });
+    child.on("error", (err) => {
+      restore();
+      resolve3(1);
+    });
+  });
+}
+
 // src/constants.ts
 import { homedir } from "os";
 import { join } from "path";
@@ -218,7 +374,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.4.0",
+  version: "2.5.0",
   publishConfig: {
     access: "public"
   },
@@ -351,7 +507,7 @@ import {
 import { join as join2 } from "path";
 
 // src/credential-helper.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { createHash } from "crypto";
 import { accessSync, constants, statSync } from "fs";
 import { isAbsolute, normalize, resolve } from "path";
@@ -418,7 +574,7 @@ async function runCredentialHelper(operation, account, input, expectedHelperId)
     );
   }
   return new Promise((resolve3, reject) => {
-    const child = spawn(
+    const child = spawn2(
       helper.path,
       [operation, CREDENTIAL_HELPER_SERVICE, account],
       { shell: false, stdio: ["pipe", "pipe", "pipe"] }
@@ -902,8 +1058,9 @@ function buildChildEnv(baseUrl, model, apiKey, proxyPort, contextWindow, enableG
   applyClaudeCodeThirdPartyCompat(env);
   return env;
 }
-function buildHttpProxyChildEnv(proxyPort, caCertPath) {
-  const env = { ...process.env };
+function buildHttpProxyChildEnv(proxyPort, caCertPath, baseEnv = process.env) {
+  const baseline = networkEnvBaseline(baseEnv);
+  const env = { ...baseline };
   for (const name of CONFLICTING_ENV_VARS) {
     if (name === "ANTHROPIC_API_KEY" || name === "ANTHROPIC_AUTH_TOKEN" || name === "ANTHROPIC_MODEL") continue;
     delete env[name];
@@ -915,6 +1072,7 @@ function buildHttpProxyChildEnv(proxyPort, caCertPath) {
   env["http_proxy"] = proxyUrl;
   env["NODE_EXTRA_CA_CERTS"] = caCertPath;
   removeAnthropicProxyBypass(env);
+  recordNetworkEnvMutation(baseline, env);
   return env;
 }
 function classifyKeyringError(err) {
@@ -952,7 +1110,10 @@ var KEYRING_GENERATION_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0
 function oauthProviderIdFromAccount(account) {
   const prefix = "oauth:provider:";
   const baseAccount = credentialAccountBase(account);
-  return baseAccount.startsWith(prefix) ? baseAccount.slice(prefix.length) : null;
+  if (!baseAccount.startsWith(prefix)) return null;
+  const id = baseAccount.slice(prefix.length);
+  const slot = id.indexOf(":account:");
+  return slot === -1 ? id : id.slice(0, slot);
 }
 var oauthRefreshInflight = /* @__PURE__ */ new Map();
 var OAUTH_CREDENTIAL_CACHE_MAX_AGE_MS = 3e4;
@@ -992,8 +1153,8 @@ function parseAuthRef(authRef) {
 function clodexKeyEnvVar(providerId) {
   return `CLODEX_KEY_${providerId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
 }
-function readEnvCredential(varName) {
-  const raw = process.env[varName];
+function readEnvCredential(varName, env = process.env) {
+  const raw = env[varName];
   if (!raw?.trim()) return null;
   return raw.trim().split(/\r?\n/)[0]?.trim() || null;
 }
@@ -1017,6 +1178,26 @@ function usableEnvCredential(source, value, rejectedAccessToken) {
   }
   return value;
 }
+function readProviderCredentialOverride(providerId, env, options) {
+  if (options.ignoreProviderOverride) return null;
+  const variable = clodexKeyEnvVar(providerId);
+  const credential = usableEnvCredential(
+    `provider:${providerId}`,
+    readEnvCredential(variable, env),
+    options.rejectedAccessToken
+  );
+  if (!credential) return null;
+  return {
+    credential,
+    state: {
+      variable,
+      fingerprint: credentialFingerprint(credential)
+    }
+  };
+}
+function resolveProviderCredentialOverrideState(providerId, env = process.env, options = {}) {
+  return readProviderCredentialOverride(providerId, env, options)?.state ?? null;
+}
 function readKeyringEntry(keyring, service, account) {
   const value = new keyring.Entry(service, account).getPassword();
   if (value !== null) return value;
@@ -2505,25 +2686,37 @@ async function deleteStoredCredential(ref, diag, blockLegacy = true) {
     return false;
   }
 }
-async function resolveProviderCredential(providerId, authRef, diag, options = {}) {
+async function resolveProviderCredentialWithSource(providerId, authRef, diag, options = {}) {
   const parsed = parseAuthRef(authRef);
-  if (parsed?.kind === "none") return null;
-  const namespacedVar = clodexKeyEnvVar(providerId);
-  const namespaced = usableEnvCredential(
-    `provider:${providerId}`,
-    readEnvCredential(namespacedVar),
-    options.rejectedAccessToken
-  );
-  if (namespaced) return namespaced;
-  if (!parsed) return null;
+  if (parsed?.kind === "none") return { credential: null };
+  const namespaced = readProviderCredentialOverride(providerId, process.env, options);
+  if (namespaced) {
+    return {
+      credential: namespaced.credential,
+      credentialOverride: namespaced.state
+    };
+  }
+  if (!parsed) return { credential: null };
   if (parsed.kind === "env") {
-    return usableEnvCredential(
-      `provider:${providerId}:env:${parsed.varName}`,
-      readEnvCredential(parsed.varName),
-      options.rejectedAccessToken
-    );
+    return {
+      credential: usableEnvCredential(
+        `provider:${providerId}:env:${parsed.varName}`,
+        readEnvCredential(parsed.varName),
+        options.rejectedAccessToken
+      )
+    };
   }
-  return readProviderSecret(parsed, diag, options.rejectedAccessToken);
+  return {
+    credential: await readProviderSecret(parsed, diag, options.rejectedAccessToken)
+  };
+}
+async function resolveProviderCredential(providerId, authRef, diag, options = {}) {
+  return (await resolveProviderCredentialWithSource(
+    providerId,
+    authRef,
+    diag,
+    options
+  )).credential;
 }
 async function resolveProviderOAuthAccountId(authRef, diag) {
   const parsed = parseAuthRef(authRef);
@@ -3461,12 +3654,23 @@ function applyPricingToRegistryProviders(registry, cache) {
   let changed = false;
   for (const provider of registry.providers) {
     if (provider.preserveModelPricing) continue;
-    if (!provider.modelsCache?.models.length) continue;
     const platform = TEMPLATE_TO_PRICING_PLATFORM[provider.templateId] ?? TEMPLATE_TO_PRICING_PLATFORM[provider.id];
-    const enriched = enrichModelsWithPricing(provider.modelsCache.models, index, platform);
-    if (JSON.stringify(enriched) !== JSON.stringify(provider.modelsCache.models)) {
-      provider.modelsCache = { ...provider.modelsCache, models: enriched };
+    const enrichCache = (modelsCache) => {
+      if (!modelsCache?.models.length) return modelsCache;
+      const enriched = enrichModelsWithPricing(modelsCache.models, index, platform);
+      if (JSON.stringify(enriched) === JSON.stringify(modelsCache.models)) return modelsCache;
       changed = true;
+      return { ...modelsCache, models: enriched };
+    };
+    const topLevelCache = enrichCache(provider.modelsCache);
+    if (topLevelCache !== provider.modelsCache) provider.modelsCache = topLevelCache;
+    const defaultCache = enrichCache(provider.defaultModelsCache);
+    if (defaultCache !== provider.defaultModelsCache) provider.defaultModelsCache = defaultCache;
+    for (const [name, account] of Object.entries(provider.authAccounts ?? {})) {
+      const accountCache = enrichCache(account.modelsCache);
+      if (accountCache !== account.modelsCache) {
+        provider.authAccounts[name] = { ...account, modelsCache: accountCache };
+      }
     }
   }
   if (changed) {
@@ -3774,6 +3978,48 @@ function isAnonymousProvider(provider) {
 function isLegacyAnonymousCustomEndpoint(provider, credential) {
   return provider.authType === void 0 && (provider.templateId === "custom-openai" || provider.templateId === "custom-anthropic") && provider.authRef === `keyring:provider:${provider.id}` && credential === "local";
 }
+function applySelectedOAuthAccount(provider, selected = process.env[OAUTH_ACCOUNT_ENV], warn) {
+  const requested = selected?.trim().toLowerCase();
+  const fromEnvironment = Boolean(requested);
+  const name = requested || provider.activeAuthAccount?.trim();
+  if (!name) return provider;
+  if (!provider.enabled) return provider;
+  if (provider.authType !== "oauth") return provider;
+  const slots = provider.authAccounts;
+  const stored = provider.activeAuthAccount?.trim();
+  if (!slots || Object.keys(slots).length === 0) {
+    if (stored === void 0 || stored === "") {
+      if (fromEnvironment) {
+        warn?.(`${OAUTH_ACCOUNT_ENV}=${requested} ignored for provider "${provider.id}" because it has no named account slots.`);
+      }
+      return provider;
+    }
+    throw new Error(
+      `Provider "${provider.id}" is set to use account "${stored}", but it has no named accounts. Re-add the account with: clodex providers auth openai --account ` + stored + ", or clear the selection with: clodex providers"
+    );
+  }
+  if (!Object.prototype.hasOwnProperty.call(slots, name)) {
+    const available = Object.keys(slots).sort().join(", ");
+    throw new Error(
+      fromEnvironment ? `CLODEX_OAUTH_ACCOUNT=${name}: provider "${provider.id}" has no account named "${name}" (available: ${available}). Add it with: clodex providers auth openai --account ` + name : `Provider "${provider.id}" is set to use account "${name}", which no longer exists (available: ${available}). Choose another with: clodex providers`
+    );
+  }
+  const account = slots[name];
+  const projected = { ...provider, authRef: account.authRef };
+  if (fromEnvironment && name !== stored) {
+    if (account.modelsCache) projected.modelsCache = account.modelsCache;
+    else delete projected.modelsCache;
+  } else if (!projected.modelsCache && account.modelsCache) {
+    projected.modelsCache = account.modelsCache;
+  }
+  return projected;
+}
+function projectSelectedOAuthAccount(provider, selected = process.env[OAUTH_ACCOUNT_ENV]) {
+  const dormantOAuth = provider.authType === "oauth" && !provider.enabled;
+  const candidate = dormantOAuth ? { ...provider, enabled: true } : provider;
+  const projected = applySelectedOAuthAccount(candidate, selected);
+  return dormantOAuth ? { ...projected, enabled: false } : projected;
+}
 function materializeOne(provider, resolveCredential, agent) {
   if (!provider.enabled) return null;
   if (!isValidProviderId(provider.id)) return null;
@@ -3821,19 +4067,37 @@ function materializeRegistry(registry, resolveCredential, opts) {
 
 // src/registry/load.ts
 async function loadRegistryProviders(diag, opts) {
-  const registry = loadRegistry();
+  const registry = loadRegistry(void 0, diag);
+  const providers = registry.providers.map((provider) => applySelectedOAuthAccount(
+    provider,
+    void 0,
+    opts?.warn
+  ));
+  const selectedRegistry = { ...registry, providers };
   const keys = /* @__PURE__ */ new Map();
   const oauthAccountIds = /* @__PURE__ */ new Map();
   const oauthProviderData = /* @__PURE__ */ new Map();
-  await Promise.all(registry.providers.map(async (provider) => {
-    if (isAnonymousProvider(provider)) return;
+  const blockedProviders = /* @__PURE__ */ new Map();
+  await Promise.all(providers.map(async (provider) => {
+    if (isAnonymousProvider(provider) || provider.authType === "none" || provider.authRef === "none:anonymous") return;
+    let resolved;
     try {
-      const key = await resolveProviderCredential(provider.id, provider.authRef, diag);
-      if (key) keys.set(provider.id, key);
+      resolved = await resolveProviderCredentialWithSource(provider.id, provider.authRef, diag);
     } catch (err) {
       diag?.(`${provider.id}: credential unavailable \u2014 ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    const credentialOverride = resolved.credentialOverride !== void 0;
+    if (provider.enabled && resolved.credentialOverride) {
+      blockedProviders.set(
+        provider.id,
+        `${resolved.credentialOverride.variable} is a process-scoped credential with no isolated model catalog for provider "${provider.id}". Save that credential as a provider or account and refresh its models, or unset the variable.`
+      );
+      return;
     }
-    if (provider.authType === "oauth") {
+    const credentialAvailable = Boolean(resolved.credential);
+    if (resolved.credential) keys.set(provider.id, resolved.credential);
+    if (provider.authType === "oauth" && credentialAvailable && !credentialOverride) {
       try {
         const accountId = await resolveProviderOAuthAccountId(provider.authRef, diag);
         if (accountId) oauthAccountIds.set(provider.id, accountId);
@@ -3843,11 +4107,16 @@ async function loadRegistryProviders(diag, opts) {
       }
     }
   }));
-  return materializeRegistry(registry, (provider) => keys.get(provider.id) ?? null, opts).map((provider) => ({
+  const materialized = materializeRegistry(selectedRegistry, (provider) => keys.get(provider.id) ?? null, opts).map((provider) => ({
     ...provider,
     oauthAccountId: oauthAccountIds.get(provider.id),
     providerData: oauthProviderData.get(provider.id)
   }));
+  Object.defineProperty(materialized, "blockedProviders", {
+    value: blockedProviders,
+    enumerable: false
+  });
+  return materialized;
 }
 
 // src/provider-templates.ts
@@ -3889,7 +4158,8 @@ function getTemplateById(id) {
 
 // src/provider-catalog.ts
 async function fetchProviderCatalog(opts) {
-  return loadRegistryProviders(void 0, opts);
+  const warn = (message) => console.warn(message);
+  return loadRegistryProviders(warn, { ...opts, warn });
 }
 function providersForPicker(providers) {
   for (const p13 of providers) {
@@ -3932,16 +4202,115 @@ function formatRegistryAuthLabel(provider) {
   }
   return provider.authRef;
 }
+var PROVIDER_DEFAULT_ACCOUNT_LABEL = "(provider default)";
+function resolveActiveAccount(provider, env = process.env) {
+  const slots = provider.authAccounts ?? {};
+  const has = (name) => Object.prototype.hasOwnProperty.call(slots, name);
+  const stored = provider.activeAuthAccount?.trim();
+  const override = env[OAUTH_ACCOUNT_ENV]?.trim().toLowerCase();
+  const projectOAuthSelection = (environmentSelection) => {
+    const latentOrphan = stored && !has(stored) && stored !== environmentSelection ? { latentOrphan: stored } : {};
+    if (environmentSelection) {
+      if (has(environmentSelection)) {
+        return {
+          kind: "slot",
+          name: environmentSelection,
+          fromEnvironment: true,
+          ...latentOrphan
+        };
+      }
+      if (Object.keys(slots).length > 0) {
+        return {
+          kind: "broken",
+          name: environmentSelection,
+          fromEnvironment: true,
+          ...latentOrphan
+        };
+      }
+    }
+    if (!stored) return { kind: "default" };
+    if (has(stored)) return { kind: "slot", name: stored, fromEnvironment: false };
+    return { kind: "broken", name: stored, fromEnvironment: false };
+  };
+  const selected = provider.authType !== "oauth" ? { ...projectOAuthSelection(void 0), inactiveReason: "non-oauth" } : provider.enabled ? projectOAuthSelection(override) : { ...projectOAuthSelection(override), inactiveReason: "disabled" };
+  const effectiveAuthRef = provider.authType === "oauth" && selected.kind === "slot" ? slots[selected.name]?.authRef : provider.authRef;
+  const credentialOverride = provider.authType !== "none" && effectiveAuthRef !== "none:anonymous" ? resolveProviderCredentialOverrideState(provider.id, env) : null;
+  if (!credentialOverride) return selected;
+  if (provider.authType === "oauth" && selected.kind === "broken") {
+    return { ...selected, credentialOverride };
+  }
+  return {
+    kind: "credential-override",
+    credentialOverride,
+    selection: selected,
+    ...selected.latentOrphan ? { latentOrphan: selected.latentOrphan } : {},
+    ...selected.inactiveReason ? { inactiveReason: selected.inactiveReason } : {}
+  };
+}
 async function resolveProvidersForDisplay() {
   const reg = loadRegistry();
   const entries = [];
   for (const provider of reg.providers) {
+    const accountNames = Object.keys(provider.authAccounts ?? {}).sort();
+    const effective = resolveActiveAccount(provider);
+    const selection = effective.kind === "credential-override" ? effective.selection : effective;
+    const credentialOverride = effective.credentialOverride;
+    const credentialOverrideWins = effective.kind === "credential-override";
+    const active = !credentialOverrideWins && selection.kind === "slot" && !selection.inactiveReason ? selection.name : void 0;
+    const projected = !credentialOverrideWins && selection.kind === "slot" && selection.inactiveReason === "disabled" ? selection.name : void 0;
+    const storedButInapplicable = selection.kind === "slot" && selection.inactiveReason === "non-oauth" ? selection.name : void 0;
+    const accountOverrideApplies = selection.kind !== "default" && selection.fromEnvironment;
+    const broken = selection.kind === "broken" ? selection : void 0;
+    const latent = selection.latentOrphan;
+    const label = (name) => {
+      if (name === active) {
+        return accountOverrideApplies ? `${name} (active, from ${OAUTH_ACCOUNT_ENV})` : `${name} (active)`;
+      }
+      if (credentialOverrideWins && selection.kind === "slot" && name === selection.name) {
+        if (selection.inactiveReason === "non-oauth") {
+          return `${name} (stored; provider is not OAuth)`;
+        }
+        const selectedFrom = accountOverrideApplies ? `, from ${OAUTH_ACCOUNT_ENV}` : "";
+        return selection.inactiveReason === "disabled" ? `${name} (selected${selectedFrom}; provider disabled; ${credentialOverride.variable} has no isolated model catalog)` : `${name} (selected${selectedFrom}; ${credentialOverride.variable} configured; launch blocked \u2014 no isolated model catalog)`;
+      }
+      if (name === projected) {
+        return accountOverrideApplies ? `${name} (selected, from ${OAUTH_ACCOUNT_ENV}; provider disabled)` : `${name} (selected; provider disabled)`;
+      }
+      if (name === storedButInapplicable) {
+        return `${name} (stored; provider is not OAuth)`;
+      }
+      return name;
+    };
+    const defaultLabel = selection.kind !== "default" ? PROVIDER_DEFAULT_ACCOUNT_LABEL : credentialOverrideWins ? selection.inactiveReason === "disabled" ? `${PROVIDER_DEFAULT_ACCOUNT_LABEL} (selected; provider disabled; ${credentialOverride.variable} has no isolated model catalog)` : selection.inactiveReason === "non-oauth" ? `${PROVIDER_DEFAULT_ACCOUNT_LABEL} (OAuth selection inactive; provider is not OAuth)` : `${PROVIDER_DEFAULT_ACCOUNT_LABEL} (selected; ${credentialOverride.variable} configured; launch blocked \u2014 no isolated model catalog)` : selection.inactiveReason === "disabled" ? `${PROVIDER_DEFAULT_ACCOUNT_LABEL} (selected; provider disabled)` : selection.inactiveReason === "non-oauth" ? `${PROVIDER_DEFAULT_ACCOUNT_LABEL} (OAuth selection inactive; provider is not OAuth)` : `${PROVIDER_DEFAULT_ACCOUNT_LABEL} (active)`;
+    const brokenConsequence = selection.inactiveReason === "disabled" ? "will fail if this provider is enabled" : selection.inactiveReason === "non-oauth" ? "ignored because this provider is not OAuth" : "every launch fails";
+    const accountList = [
+      defaultLabel,
+      ...accountNames.map(label),
+      // An inactive account selection gets saved-state wording, not a current
+      // OAuth outcome. A disabled provider is excluded from materialization;
+      // a non-OAuth provider may launch, but never applies these selectors.
+      ...broken ? [`${broken.name} (${selection.inactiveReason === "non-oauth" ? "stored" : "selected"}${broken.fromEnvironment ? ` via ${OAUTH_ACCOUNT_ENV}` : ""}, MISSING \u2014 ${brokenConsequence})`] : [],
+      ...latent ? [`${latent} (stored, MISSING \u2014 masked by ${OAUTH_ACCOUNT_ENV}; ${selection.inactiveReason === "disabled" ? "will fail if enabled without it" : "launches fail without it"})`] : []
+    ].join(", ");
+    const storedAuthLabel = formatRegistryAuthLabel(provider);
+    const effectiveAuthLabel = !credentialOverride ? storedAuthLabel : credentialOverrideWins ? provider.enabled ? `${credentialOverride.variable} (configured provider override; launch blocked \u2014 no isolated model catalog; stored auth: ${storedAuthLabel})` : `${credentialOverride.variable} (configured provider override; no isolated model catalog; provider disabled; stored auth: ${storedAuthLabel})` : `${storedAuthLabel}; ${credentialOverride.variable} is configured but blocked by the invalid OAuth account selection`;
+    const authLabel = accountNames.length || broken || latent ? `${effectiveAuthLabel}; accounts: ${accountList}` : effectiveAuthLabel;
     entries.push({
       id: provider.id,
       name: provider.name,
-      modelCount: provider.modelsCache?.models.length ?? 0,
+      // Model counts describe the identity this process would launch, not the
+      // persisted account hidden behind CLODEX_OAUTH_ACCOUNT. A broken
+      // selection has no safe catalog to advertise.
+      modelCount: (() => {
+        if (credentialOverrideWins) return 0;
+        try {
+          return projectSelectedOAuthAccount(provider).modelsCache?.models.length ?? 0;
+        } catch {
+          return 0;
+        }
+      })(),
       enabled: provider.enabled,
-      authLabel: formatRegistryAuthLabel(provider),
+      authLabel,
       inRegistry: true
     });
   }
@@ -3990,6 +4359,8 @@ import { createHash as createHash3 } from "crypto";
 import { AsyncLocalStorage } from "async_hooks";
 
 // src/outbound-proxy.ts
+import { networkInterfaces } from "os";
+import { HttpsProxyAgent } from "https-proxy-agent";
 function hasOutboundProxyEnv(env = process.env) {
   return Boolean(
     env["HTTPS_PROXY"]?.trim() || env["https_proxy"]?.trim() || env["HTTP_PROXY"]?.trim() || env["http_proxy"]?.trim()
@@ -4025,6 +4396,26 @@ function outboundProxyUrlForTarget(targetUrl, env = process.env) {
   if (noProxyBypasses(parsed.hostname, env)) return void 0;
   return proxy.trim();
 }
+function proxyUrlTargetsListener(proxyUrl, listenerHost, listenerPort, localAddresses = new Set(
+  Object.values(networkInterfaces()).flatMap((entries) => (entries ?? []).map((entry) => entry.address.toLowerCase()))
+)) {
+  let parsed;
+  try {
+    parsed = new URL(proxyUrl);
+  } catch {
+    return false;
+  }
+  const proxyPort = parsed.port ? Number(parsed.port) : parsed.protocol === "https:" ? 443 : parsed.protocol === "http:" ? 80 : void 0;
+  if (proxyPort !== listenerPort) return false;
+  const normalizeHost = (host) => host.toLowerCase().replace(/^\[|\]$/g, "");
+  const proxyHost = normalizeHost(parsed.hostname);
+  const boundHost = normalizeHost(listenerHost);
+  if (proxyHost === boundHost) return true;
+  const isLoopback = (host) => host === "localhost" || host === "::1" || /^127(?:\.\d{1,3}){3}$/.test(host);
+  const isWildcard = (host) => host === "0.0.0.0" || host === "::";
+  if (isLoopback(proxyHost) && (isLoopback(boundHost) || isWildcard(boundHost))) return true;
+  return isWildcard(boundHost) && (isWildcard(proxyHost) || localAddresses.has(proxyHost));
+}
 var dispatcherInstalled = false;
 async function installOutboundProxyDispatcher() {
   if (dispatcherInstalled) return true;
@@ -4041,11 +4432,24 @@ async function installOutboundProxyDispatcher() {
     return false;
   }
 }
-async function outboundWsProxyAgent(wsUrl) {
-  const proxyUrl = outboundProxyUrlForTarget(wsUrl);
+function outboundHttpProxyAgent(targetUrl, env = process.env) {
+  const proxyUrl = outboundProxyUrlForTarget(targetUrl, env);
   if (!proxyUrl) return void 0;
-  const { HttpsProxyAgent } = await import("https-proxy-agent");
-  return new HttpsProxyAgent(proxyUrl);
+  try {
+    const parsedProxy = new URL(proxyUrl);
+    if (!parsedProxy.hostname || !["http:", "https:"].includes(parsedProxy.protocol)) {
+      throw new TypeError("Invalid proxy URL");
+    }
+    return new HttpsProxyAgent(parsedProxy, { keepAlive: true });
+  } catch (err) {
+    console.error(
+      `clodex: HTTP(S)_PROXY cannot be used for a CONNECT tunnel; using a direct connection (${err instanceof Error ? err.message : String(err)})`
+    );
+    return void 0;
+  }
+}
+function outboundWsProxyAgent(wsUrl, env = process.env) {
+  return outboundHttpProxyAgent(wsUrl, env);
 }
 
 // src/upstream-error.ts
@@ -4537,13 +4941,9 @@ function warnReasoningNormalizationGap(fields, log12) {
   if (warnedReasoningGaps.has(signature)) return;
   if (warnedReasoningGaps.size >= MAX_REASONING_GAP_WARNINGS) return;
   warnedReasoningGaps.add(signature);
-  try {
-    process.stderr.write(`${message}
-`);
-    if (warnedReasoningGaps.size === MAX_REASONING_GAP_WARNINGS) {
-      process.stderr.write("clodex: warning: further reasoning-normalization warnings suppressed.\n");
-    }
-  } catch {
+  emitParentNotice(message);
+  if (warnedReasoningGaps.size === MAX_REASONING_GAP_WARNINGS) {
+    emitParentNotice("clodex: warning: further reasoning-normalization warnings suppressed.");
   }
 }
 function toolArgumentNormalizationGap(expected, actual, requiredProps) {
@@ -4592,13 +4992,9 @@ function warnToolArgumentNormalizationGap(gap, log12) {
   if (warnedToolArgumentGaps.has(signature)) return;
   if (warnedToolArgumentGaps.size >= MAX_TOOL_ARGUMENT_GAP_WARNINGS) return;
   warnedToolArgumentGaps.add(signature);
-  try {
-    process.stderr.write(`${message}
-`);
-    if (warnedToolArgumentGaps.size === MAX_TOOL_ARGUMENT_GAP_WARNINGS) {
-      process.stderr.write("clodex: warning: further tool-argument normalization warnings suppressed.\n");
-    }
-  } catch {
+  emitParentNotice(message);
+  if (warnedToolArgumentGaps.size === MAX_TOOL_ARGUMENT_GAP_WARNINGS) {
+    emitParentNotice("clodex: warning: further tool-argument normalization warnings suppressed.");
   }
 }
 function continuationMismatchDetails(entry, payload, log12, warnOnGap = false) {
@@ -5036,12 +5432,12 @@ function expectedAssistantItems(ctx) {
     const type = accumulator.type ?? (typeof done.type === "string" ? done.type : void 0);
     if (type === "message") {
       const doneContent = Array.isArray(done.content) ? done.content : void 0;
-      const text4 = accumulator.text || (doneContent ? doneContent.filter((part) => part && typeof part === "object" && part.type === "output_text").map((part) => String(part.text ?? "")).join("") : "");
-      output.push({ role: "assistant", content: [{ type: "output_text", text: text4 }] });
+      const text5 = accumulator.text || (doneContent ? doneContent.filter((part) => part && typeof part === "object" && part.type === "output_text").map((part) => String(part.text ?? "")).join("") : "");
+      output.push({ role: "assistant", content: [{ type: "output_text", text: text5 }] });
       continue;
     }
     if (type === "reasoning") {
-      const summary = accumulator.summaries.size ? [...accumulator.summaries.entries()].sort(([a], [b]) => a - b).map(([, text4]) => ({ type: "summary_text", text: text4 })) : Array.isArray(done.summary) ? done.summary : [];
+      const summary = accumulator.summaries.size ? [...accumulator.summaries.entries()].sort(([a], [b]) => a - b).map(([, text5]) => ({ type: "summary_text", text: text5 })) : Array.isArray(done.summary) ? done.summary : [];
       output.push({ ...withoutEphemeralFields(done), type: "reasoning", summary });
       continue;
     }
@@ -5260,7 +5656,7 @@ function transportReplaySafe(ctx) {
 function handleSocketMessage(entry, data) {
   const ctx = entry.current;
   if (!ctx || ctx.closed) return;
-  const text4 = Array.isArray(data) ? Buffer.concat(data).toString("utf8") : data.toString("utf8");
+  const text5 = Array.isArray(data) ? Buffer.concat(data).toString("utf8") : data.toString("utf8");
   ctx.frameCount += 1;
   if (ctx.transportRetryPending) {
     ctx.transportRetryPending = false;
@@ -5272,9 +5668,9 @@ function handleSocketMessage(entry, data) {
   }
   let event;
   try {
-    event = JSON.parse(text4);
+    event = JSON.parse(text5);
   } catch {
-    ctx.pendingEvents.push(text4.replace(/\r?\n/g, " "));
+    ctx.pendingEvents.push(text5.replace(/\r?\n/g, " "));
     flushPending(ctx);
     return;
   }
@@ -5815,8 +6211,8 @@ function buildClaudeCodeBillingSystemLine() {
 function systemBlockText(block) {
   if (typeof block === "string") return block;
   if (block && typeof block === "object" && "text" in block) {
-    const text4 = block.text;
-    return typeof text4 === "string" ? text4 : void 0;
+    const text5 = block.text;
+    return typeof text5 === "string" ? text5 : void 0;
   }
   return void 0;
 }
@@ -6734,7 +7130,12 @@ function isManagedCredentialAccount(account) {
   const base = credentialAccountBase2(account);
   if (!base) return false;
   const oauth = /^oauth:provider:(.+)$/.exec(base);
-  if (oauth) return isValidProviderId(oauth[1]);
+  if (oauth) {
+    const id = oauth[1];
+    const slot = id.indexOf(":account:");
+    if (slot === -1) return isValidProviderId(id);
+    return isValidProviderId(id.slice(0, slot)) && OAUTH_ACCOUNT_NAME_RE.test(id.slice(slot + ":account:".length));
+  }
   const provider = /^provider:([^:]+)(?::(.+))?$/.exec(base);
   if (!provider || !isValidProviderId(provider[1])) return false;
   const suffix = provider[2];
@@ -6886,7 +7287,7 @@ function appendError(errors, context, error) {
   errors.push(`${context}: ${errorMessage(error)}`);
 }
 function credentialIsReferenced(registry, authRef) {
-  return registry.providers.some((provider) => provider.authRef === authRef);
+  return registry.providers.some((provider) => provider.authRef === authRef || provider.defaultAuthRef === authRef || Object.values(provider.authAccounts ?? {}).some((slot) => slot.authRef === authRef));
 }
 async function journalCredentialWrite(authRef) {
   if (!await queueCredentialDelete(authRef)) {
@@ -7075,8 +7476,8 @@ function compactLogValueWithMarker(value, max) {
 function systemPreview(system) {
   if (typeof system === "string") return compactLogValue(system, REQUEST_PREVIEW_MAX) || void 0;
   if (!Array.isArray(system)) return void 0;
-  const text4 = system.map((block) => typeof block === "string" ? block : block && typeof block === "object" && typeof block.text === "string" ? block.text : "").filter(Boolean).join(" ");
-  return compactLogValue(text4, REQUEST_PREVIEW_MAX) || void 0;
+  const text5 = system.map((block) => typeof block === "string" ? block : block && typeof block === "object" && typeof block.text === "string" ? block.text : "").filter(Boolean).join(" ");
+  return compactLogValue(text5, REQUEST_PREVIEW_MAX) || void 0;
 }
 function inlineSystemPreview(messages) {
   if (!Array.isArray(messages)) return void 0;
@@ -7102,9 +7503,9 @@ function getLatestMessagePreview(messages, system) {
       if (typeof content === "string") {
         summary = content;
       } else if (Array.isArray(content)) {
-        const text4 = content.filter((block) => Boolean(block && typeof block === "object")).filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join(" ");
-        if (text4.trim()) {
-          summary = text4;
+        const text5 = content.filter((block) => Boolean(block && typeof block === "object")).filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join(" ");
+        if (text5.trim()) {
+          summary = text5;
         } else {
           const blockTypes = [...new Set(content.filter((block) => Boolean(block && typeof block === "object")).map((block) => typeof block.type === "string" ? block.type : "unknown"))];
           if (blockTypes.length > 0) blockSummary = `${role}: [${blockTypes.join(", ")}]`;
@@ -7200,6 +7601,7 @@ function writeInferenceRequestLog(path, entry) {
     ...claudeSessionId ? { claudeSessionId } : {},
     modelId: compactLogValue(entry.modelId),
     ...entry.effort ? { effort: compactLogValue(entry.effort, 100) } : {},
+    ...entry.serviceTier ? { serviceTier: compactLogValue(entry.serviceTier, 40) } : {},
     provider: compactLogValue(entry.provider, 200),
     route: entry.route,
     ...entry.stream !== void 0 ? { stream: entry.stream } : {},
@@ -7624,6 +8026,25 @@ async function fetchTemplateModels(template, apiKey, baseUrlOverride, extraHeade
 }
 
 // src/registry/add-template.ts
+function existingProviderError(template, existing, replaceExisting) {
+  if (!existing) return null;
+  const removeFirst = `Remove it first with: clodex providers remove ${template.id}`;
+  if (!replaceExisting) {
+    return {
+      added: false,
+      error: `${template.name} is already configured.`,
+      hint: removeFirst
+    };
+  }
+  if (existing.defaultAuthRef !== void 0 || existing.activeAuthAccount !== void 0 || Object.keys(existing.authAccounts ?? {}).length > 0) {
+    return {
+      added: false,
+      error: `${template.name} has OAuth account state and cannot be replaced in place.`,
+      hint: removeFirst
+    };
+  }
+  return null;
+}
 async function probeTemplatePackage(template) {
   if (!template.supported) return template.unsupportedReason ?? "Provider is not supported yet.";
   if (!template.npm) return "Template is missing an SDK package.";
@@ -7657,13 +8078,10 @@ async function addProviderFromTemplate(template, apiKey, opts) {
   const existingState = await withRegistryWriteLock(() => {
     const registry = loadRegistryStrict();
     const existing = registry.providers.find((p13) => p13.id === template.id);
-    if (existing && !opts?.replaceExisting) {
+    const error = existingProviderError(template, existing, opts?.replaceExisting);
+    if (error) {
       return {
-        error: {
-          added: false,
-          error: `${template.name} is already configured.`,
-          hint: `Remove it first with: clodex providers remove ${template.id}`
-        }
+        error
       };
     }
     return { authRef: existing?.authRef ?? null, error: null };
@@ -7697,14 +8115,11 @@ async function addProviderFromTemplate(template, apiKey, opts) {
     const currentState = await withRegistryWriteLock(() => {
       const registry = loadRegistryStrict();
       const existing = registry.providers.find((p13) => p13.id === template.id);
-      if (existing && !opts?.replaceExisting) {
+      const error = existingProviderError(template, existing, opts?.replaceExisting);
+      if (error) {
         return {
           existingAuthRef: null,
-          error: {
-            added: false,
-            error: `${template.name} is already configured.`,
-            hint: `Remove it first with: clodex providers remove ${template.id}`
-          }
+          error
         };
       }
       return { existingAuthRef: existing?.authRef ?? null, error: null };
@@ -7726,13 +8141,8 @@ async function addProviderFromTemplate(template, apiKey, opts) {
       return withRegistryWriteLock(async () => {
         const registry = loadRegistryStrict();
         const existing = registry.providers.find((p13) => p13.id === template.id);
-        if (existing && !opts?.replaceExisting) {
-          return {
-            added: false,
-            error: `${template.name} is already configured.`,
-            hint: `Remove it first with: clodex providers remove ${template.id}`
-          };
-        }
+        const existingError = existingProviderError(template, existing, opts?.replaceExisting);
+        if (existingError) return existingError;
         if ((existing?.authRef ?? null) !== currentState.existingAuthRef) {
           return {
             added: false,
@@ -7823,11 +8233,21 @@ async function removeProviderWithinLifecycle(id, opts) {
           credentialDeleted: false,
           error: `Provider not found: ${id}`
         },
-        authRef: null
+        queuedRefs: []
       };
     }
     const [removedProvider] = registry.providers.splice(index, 1);
-    const cleanupQueued = opts?.deleteCredential !== false ? await queueCredentialDelete(removedProvider.authRef) : false;
+    const queuedRefs = [];
+    if (opts?.deleteCredential !== false) {
+      const credentialRefs = /* @__PURE__ */ new Set([
+        removedProvider.authRef,
+        ...removedProvider.defaultAuthRef ? [removedProvider.defaultAuthRef] : [],
+        ...Object.values(removedProvider.authAccounts ?? {}).map((slot) => slot.authRef)
+      ]);
+      for (const authRef of credentialRefs) {
+        if (await queueCredentialDelete(authRef)) queuedRefs.push(authRef);
+      }
+    }
     saveRegistry(registry);
     return {
       result: {
@@ -7836,14 +8256,14 @@ async function removeProviderWithinLifecycle(id, opts) {
         name: removedProvider.name,
         credentialDeleted: false
       },
-      authRef: cleanupQueued ? removedProvider.authRef : null
+      queuedRefs
     };
   });
-  if (removal.authRef) {
+  if (removal.queuedRefs.length > 0) {
     try {
       const cleanup = await reconcilePendingCredentialDeletes();
-      removal.result.credentialDeleted = cleanup.deleted.includes(removal.authRef);
-      removal.result.credentialCleanupPending = cleanup.pending.includes(removal.authRef) || cleanup.persistenceError !== void 0;
+      removal.result.credentialDeleted = removal.queuedRefs.every((ref) => cleanup.deleted.includes(ref));
+      removal.result.credentialCleanupPending = removal.queuedRefs.some((ref) => cleanup.pending.includes(ref)) || cleanup.persistenceError !== void 0;
     } catch {
       removal.result.credentialCleanupPending = true;
     }
@@ -7854,6 +8274,60 @@ async function removeProviderWithinLifecycle(id, opts) {
 async function removeProviderFromRegistry(id, opts) {
   return withProviderMutationLock(id, () => removeProviderWithinLifecycle(id, opts));
 }
+async function setActiveOAuthAccount(id, account) {
+  return withProviderMutationLock(id, () => withRegistryWriteLock(() => {
+    const registry = loadRegistryStrict();
+    const provider = registry.providers.find((p13) => p13.id === id);
+    if (!provider) return { updated: false, error: `Provider not found: ${id}` };
+    const name = account?.trim().toLowerCase();
+    const previous = provider.activeAuthAccount?.trim() || void 0;
+    const selectedSlot = name ? getOAuthAccountSlot(provider, name) : void 0;
+    let selectionChanged = previous !== name;
+    let storageChanged = false;
+    if (name && !selectedSlot) {
+      const slots = provider.authAccounts ?? {};
+      const available = Object.keys(slots).sort().join(", ") || "none";
+      return {
+        updated: false,
+        error: `${provider.name} has no account named "${name}" (available: ${available}).`
+      };
+    }
+    if (name && provider.authType === "oauth") {
+      storageChanged = storeActiveOAuthAccount(provider, name, selectedSlot.authRef);
+    }
+    if (selectionChanged && provider.authType === "oauth") {
+      const previousSlot = previous ? getOAuthAccountSlot(provider, previous) : void 0;
+      if (previous && previousSlot && provider.modelsCache && provider.authAccounts) {
+        provider.authAccounts[previous] = {
+          ...previousSlot,
+          modelsCache: provider.modelsCache
+        };
+      }
+      const selectedCache = selectedSlot?.modelsCache;
+      if (selectedCache) {
+        provider.modelsCache = selectedCache;
+        provider.refreshedAt = selectedCache.fetchedAt;
+      } else {
+        delete provider.modelsCache;
+        delete provider.refreshedAt;
+      }
+    }
+    if (name && provider.authType !== "oauth") {
+      storageChanged = clearActiveOAuthAccount(provider) || storageChanged;
+      if (provider.activeAuthAccount !== name) {
+        provider.activeAuthAccount = name;
+        storageChanged = true;
+      }
+    } else if (!name && (previous !== void 0 || provider.defaultAuthRef !== void 0)) {
+      storageChanged = clearActiveOAuthAccount(provider);
+    } else if (!name) {
+      selectionChanged = false;
+    }
+    const migrationNeedsPersistence = registry.schemaVersion < REGISTRY_SCHEMA_VERSION_WITH_MATERIALIZED_ACTIVE_ACCOUNT && provider.defaultAuthRef !== void 0;
+    if (selectionChanged || storageChanged || migrationNeedsPersistence) saveRegistry(registry);
+    return { updated: true, changed: selectionChanged, ...name ? { account: name } : {}, provider };
+  }));
+}
 function toggleProviderEnabled(id) {
   return withRegistryWriteLockSync(() => {
     const registry = loadRegistryStrict();
@@ -8117,6 +8591,41 @@ function resolveModelSource(provider) {
 }
 
 // src/registry/refresh-credentials.ts
+function refreshCredentialSnapshot(provider, selected = process.env[OAUTH_ACCOUNT_ENV], options = {}) {
+  const environmentAccount = selected === null ? void 0 : selected?.trim().toLowerCase() || void 0;
+  const effective = projectSelectedOAuthAccount(provider, environmentAccount ?? "");
+  const activeAuthAccount = provider.activeAuthAccount?.trim() || void 0;
+  const selectedName = environmentAccount || activeAuthAccount;
+  const selectedAccount = provider.authType === "oauth" && selectedName ? getOAuthAccountSlot(provider, selectedName) : void 0;
+  const credentialOverride = effective.authType !== "none" && effective.authRef !== "none:anonymous" ? resolveProviderCredentialOverrideState(effective.id, process.env, {
+    ignoreProviderOverride: options.ignoreProviderOverride
+  }) : null;
+  return {
+    provider: {
+      id: provider.id,
+      addedAt: provider.addedAt,
+      enabled: provider.enabled,
+      authType: provider.authType,
+      templateId: provider.templateId,
+      api: {
+        ...provider.api,
+        ...provider.api.headers ? { headers: { ...provider.api.headers } } : {}
+      }
+    },
+    authRef: effective.authRef,
+    ...activeAuthAccount ? { activeAuthAccount } : {},
+    ...environmentAccount ? { environmentAccount } : {},
+    ...selectedName && selectedAccount ? {
+      selectedAccount: {
+        name: selectedName,
+        authRef: selectedAccount.authRef,
+        addedAt: selectedAccount.addedAt
+      }
+    } : {},
+    ...credentialOverride ? { credentialOverride } : {},
+    ...options.ignoreProviderOverride ? { ignoreProviderOverride: true } : {}
+  };
+}
 var PLACEHOLDER_KEYS = /* @__PURE__ */ new Set([
   "anything",
   "local",
@@ -8156,20 +8665,36 @@ function skipWithCachedModels(provider, reason) {
     reason
   };
 }
-async function resolveRefreshCredential(provider, resolveKey) {
-  if (isAnonymousProvider(provider)) return null;
-  let key;
+async function resolveRefreshCredentialWithSource(provider, resolveKey, selected = process.env[OAUTH_ACCOUNT_ENV], options = {}) {
+  const effectiveProvider = projectSelectedOAuthAccount(provider, selected ?? "");
+  if (isAnonymousProvider(effectiveProvider) || effectiveProvider.authType === "none" || effectiveProvider.authRef === "none:anonymous") return { credential: null };
+  let resolved;
   try {
-    key = await resolveKey(provider);
+    const result = await resolveKey(effectiveProvider);
+    resolved = typeof result === "object" && result !== null ? result : {
+      credential: result,
+      // Backwards-compatible resolvers return only the key. Attribute the
+      // current usable override for them; production resolvers return the
+      // source atomically with the credential and close this race fully.
+      ...result ? {
+        credentialOverride: resolveProviderCredentialOverrideState(
+          effectiveProvider.id,
+          process.env,
+          { ignoreProviderOverride: options.ignoreProviderOverride }
+        ) ?? void 0
+      } : {}
+    };
   } catch {
-    key = null;
+    resolved = { credential: null };
   }
-  if (!isLikelyPlaceholderKey(key)) return key;
-  for (const envVar of ENV_FALLBACK_BY_PROVIDER[provider.id] ?? []) {
+  if (resolved.credentialOverride || !isLikelyPlaceholderKey(resolved.credential)) {
+    return resolved;
+  }
+  for (const envVar of ENV_FALLBACK_BY_PROVIDER[effectiveProvider.id] ?? []) {
     const fromEnv = process.env[envVar]?.trim();
-    if (fromEnv && !isLikelyPlaceholderKey(fromEnv)) return fromEnv;
+    if (fromEnv && !isLikelyPlaceholderKey(fromEnv)) return { credential: fromEnv };
   }
-  return key;
+  return resolved;
 }
 
 // src/data/openai-oauth-models.ts
@@ -8319,10 +8844,13 @@ async function refreshOpenAiOAuthModels(accessToken) {
   if (chatGptEntries.length > 0) {
     return { models: toModels(chatGptEntries), source: "live" };
   }
+  const failures = [codexResult.error, chatGptResult.error].filter((error) => error !== void 0);
+  const credentialFailure = failures.find((error) => /(?:\brejected\b|\b401\b|\b403\b)/i.test(error));
   return {
     models: [...seedById.values()],
     source: "seed",
-    failureReason: chatGptResult.error ?? codexResult.error
+    failureReason: credentialFailure ?? chatGptResult.error ?? codexResult.error,
+    credentialRejected: credentialFailure !== void 0
   };
 }
 async function refreshApiListProvider(provider, apiKey) {
@@ -8375,32 +8903,111 @@ async function refreshApiListProvider(provider, apiKey) {
     baseUrl: fetched.baseUrl
   };
 }
-function updateProviderCache(registry, providerId, models, baseUrl) {
+function updateProviderCache(registry, providerId, models, baseUrl, credentialSnapshot) {
   const idx = registry.providers.findIndex((p13) => p13.id === providerId);
   if (idx < 0) return;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const existing = registry.providers[idx];
+  const modelsCache = { fetchedAt: now, models };
+  const selectedAccount = credentialSnapshot?.selectedAccount;
+  const temporaryAccount = isTemporaryAccountSelection(credentialSnapshot);
+  const selectedSlot = selectedAccount ? getOAuthAccountSlot(existing, selectedAccount.name) : void 0;
+  const authAccounts = selectedAccount && selectedSlot ? {
+    ...existing.authAccounts,
+    [selectedAccount.name]: {
+      ...selectedSlot,
+      modelsCache
+    }
+  } : existing.authAccounts;
   registry.providers[idx] = {
     ...existing,
-    refreshedAt: now,
     api: baseUrl ? { ...existing.api, url: baseUrl } : existing.api,
-    modelsCache: {
-      fetchedAt: now,
-      models
-    }
+    ...authAccounts ? { authAccounts } : {},
+    ...!temporaryAccount ? { refreshedAt: now, modelsCache } : {}
   };
 }
+function isTemporaryAccountSelection(snapshot) {
+  return Boolean(
+    snapshot?.environmentAccount && snapshot.selectedAccount && snapshot.environmentAccount !== snapshot.activeAuthAccount
+  );
+}
+function providerWithRefreshCache(provider, snapshot) {
+  const selected = snapshot?.selectedAccount;
+  const temporary = isTemporaryAccountSelection(snapshot);
+  if (!temporary || !selected) return provider;
+  const projected = { ...provider };
+  const cache = getOAuthAccountSlot(provider, selected.name)?.modelsCache;
+  if (cache) projected.modelsCache = cache;
+  else delete projected.modelsCache;
+  return projected;
+}
 function providerDiscoveryInputsMatch(current, started) {
-  return current.authRef === started.authRef && current.authType === started.authType && current.templateId === started.templateId && isDeepStrictEqual(current.api, started.api);
+  return current.authRef === started.authRef && current.enabled === started.enabled && current.authType === started.authType && current.templateId === started.templateId && isDeepStrictEqual(current.api, started.api);
+}
+function assertRefreshCredentialStillCurrent(current, snapshot) {
+  const routing = snapshot.provider;
+  if (current.id !== routing.id || current.addedAt !== routing.addedAt || current.enabled !== routing.enabled || current.authType !== routing.authType || current.templateId !== routing.templateId || !isDeepStrictEqual(current.api, routing.api)) {
+    throw new Error("Provider configuration changed while credentials were resolving.");
+  }
+  const activeAuthAccount = current.activeAuthAccount?.trim() || void 0;
+  if (activeAuthAccount !== snapshot.activeAuthAccount) {
+    throw new Error("Provider account selection changed while models were refreshing.");
+  }
+  let currentSnapshot;
+  try {
+    currentSnapshot = refreshCredentialSnapshot(
+      current,
+      snapshot.environmentAccount ?? null,
+      { ignoreProviderOverride: snapshot.ignoreProviderOverride }
+    );
+  } catch {
+    throw new Error("Provider account selection changed while models were refreshing.");
+  }
+  if (currentSnapshot.authRef !== snapshot.authRef) {
+    throw new Error("Provider credentials changed while models were refreshing.");
+  }
+  if (!isDeepStrictEqual(currentSnapshot.selectedAccount, snapshot.selectedAccount)) {
+    throw new Error("Provider account credentials changed while models were refreshing.");
+  }
+  if (!isDeepStrictEqual(currentSnapshot.credentialOverride, snapshot.credentialOverride)) {
+    throw new Error("Provider credential override changed while models were refreshing.");
+  }
 }
-async function refreshProviderModels(providerId, apiKey, registry) {
+async function refreshProviderModels(providerId, apiKey, registry, credentialSnapshot) {
   const workingRegistry = registry ?? loadRegistryStrict();
   const provider = workingRegistry.providers.find((p13) => p13.id === providerId);
   if (!provider) {
     return { id: providerId, name: providerId, ok: false, reason: "Provider not found." };
   }
+  if (credentialSnapshot) {
+    try {
+      assertRefreshCredentialStillCurrent(provider, credentialSnapshot);
+    } catch (err) {
+      return {
+        id: provider.id,
+        name: provider.name,
+        ok: false,
+        reason: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  const cacheProvider = providerWithRefreshCache(provider, credentialSnapshot);
+  if (credentialSnapshot?.credentialOverride) {
+    return skipWithCachedModels(
+      cacheProvider,
+      `${credentialSnapshot.credentialOverride.variable} is a process-scoped provider credential override \u2014 skipped the persistent model refresh so another shell cannot inherit this credential's catalog.`
+    );
+  }
   const source = resolveModelSource(provider);
   if (source === "manual-only") {
+    if (provider.authType !== "none" && !apiKey) {
+      return {
+        id: provider.id,
+        name: provider.name,
+        ok: false,
+        reason: provider.authType === "oauth" ? "OAuth token not available \u2014 try signing in again with clodex providers auth." : "API key not available \u2014 cannot verify the saved model catalog."
+      };
+    }
     return {
       id: provider.id,
       name: provider.name,
@@ -8410,7 +9017,8 @@ async function refreshProviderModels(providerId, apiKey, registry) {
     };
   }
   try {
-    const previousModelCount = provider.modelsCache?.models.length ?? 0;
+    const previousModelCount = cacheProvider.modelsCache?.models.length ?? 0;
+    const hadPreviousRefresh = isTemporaryAccountSelection(credentialSnapshot) ? cacheProvider.modelsCache !== void 0 : provider.refreshedAt !== void 0;
     let models = [];
     let baseUrl;
     let oauthFallbackReason;
@@ -8423,11 +9031,21 @@ async function refreshProviderModels(providerId, apiKey, registry) {
           reason: "OAuth token not available \u2014 try signing in again with clodex providers auth."
         };
       }
-      const oauthResult = await refreshOAuthProvider(provider, apiKey);
+      const oauthResult = await refreshOAuthProvider(cacheProvider, apiKey);
       const failureDetail = oauthResult.failureReason ? ` (${oauthResult.failureReason})` : "";
-      if (oauthResult.source === "seed" && cachedModelCount(provider) > 0) {
+      if (oauthResult.source === "seed" && oauthResult.credentialRejected) {
+        const count = cachedModelCount(cacheProvider);
+        return {
+          id: provider.id,
+          name: provider.name,
+          ok: false,
+          ...count > 0 ? { modelCount: count } : {},
+          reason: `OAuth credential was rejected${failureDetail}. ` + (count > 0 ? `Kept ${count} cached model${count === 1 ? "" : "s"}, but sign in again before launching.` : "Sign in again before refreshing or launching.")
+        };
+      }
+      if (oauthResult.source === "seed" && cachedModelCount(cacheProvider) > 0) {
         return skipWithCachedModels(
-          provider,
+          cacheProvider,
           `Live model discovery failed${failureDetail} \u2014 kept your existing cached model list instead of overwriting it with clodex's built-in fallback list. Try refreshing again later.`
         );
       }
@@ -8448,11 +9066,21 @@ async function refreshProviderModels(providerId, apiKey, registry) {
       const keyOptional = template?.apiKeyOptional === true;
       const effectiveKey = keyOptional && isLikelyPlaceholderKey(apiKey) ? "" : apiKey;
       if (!keyOptional && isLikelyPlaceholderKey(effectiveKey)) {
-        if (cachedModelCount(provider) > 0) {
-          return skipWithCachedModels(
-            provider,
-            "A placeholder API key is configured \u2014 kept cached model list. Add this provider again via clodex providers add with a real key to refresh live."
-          );
+        if (cachedModelCount(cacheProvider) > 0) {
+          if (isLegacyAnonymousCustomEndpoint(provider, effectiveKey)) {
+            return skipWithCachedModels(
+              cacheProvider,
+              "Legacy anonymous custom endpoint \u2014 kept cached model list."
+            );
+          }
+          const count = cachedModelCount(cacheProvider);
+          return {
+            id: provider.id,
+            name: provider.name,
+            ok: false,
+            modelCount: count,
+            reason: `A placeholder API key is configured \u2014 kept ${count} cached model${count === 1 ? "" : "s"}, but add this provider again with a real key before launching.`
+          };
         }
         return {
           id: provider.id,
@@ -8471,11 +9099,15 @@ async function refreshProviderModels(providerId, apiKey, registry) {
       }
       const fetched = await refreshApiListProvider(provider, effectiveKey ?? "");
       if (fetched.error) {
-        if ((fetched.error.includes("rejected") || fetched.error.includes("401") || fetched.error.includes("403")) && cachedModelCount(provider) > 0) {
-          return skipWithCachedModels(
-            provider,
-            `${fetched.error} Kept ${cachedModelCount(provider)} cached model${cachedModelCount(provider) === 1 ? "" : "s"} from import. Update your API key via clodex providers add if you need a live refresh.`
-          );
+        if ((fetched.error.includes("rejected") || fetched.error.includes("401") || fetched.error.includes("403")) && cachedModelCount(cacheProvider) > 0) {
+          const count = cachedModelCount(cacheProvider);
+          return {
+            id: provider.id,
+            name: provider.name,
+            ok: false,
+            modelCount: count,
+            reason: `${fetched.error} Kept ${count} cached model${count === 1 ? "" : "s"} from import, but update the API key before launching.`
+          };
         }
         return { id: provider.id, name: provider.name, ok: false, reason: fetched.error };
       }
@@ -8489,13 +9121,16 @@ async function refreshProviderModels(providerId, apiKey, registry) {
       const currentRegistry = loadRegistryStrict();
       const currentProvider = currentRegistry.providers.find((candidate) => candidate.id === providerId);
       if (!currentProvider) throw new Error("Provider was removed while models were refreshing.");
+      if (credentialSnapshot) {
+        assertRefreshCredentialStillCurrent(currentProvider, credentialSnapshot);
+      }
       if (currentProvider.authRef !== provider.authRef) {
         throw new Error("Provider credentials changed while models were refreshing.");
       }
       if (!providerDiscoveryInputsMatch(currentProvider, provider)) {
         throw new Error("Provider configuration changed while models were refreshing.");
       }
-      updateProviderCache(currentRegistry, providerId, enriched, baseUrl);
+      updateProviderCache(currentRegistry, providerId, enriched, baseUrl, credentialSnapshot);
       saveRegistry(currentRegistry);
     });
     enrichPricingAsync();
@@ -8504,7 +9139,7 @@ async function refreshProviderModels(providerId, apiKey, registry) {
       name: provider.name,
       ok: true,
       modelCount: enriched.length,
-      previousModelCount: provider.refreshedAt ? previousModelCount : void 0,
+      previousModelCount: hadPreviousRefresh ? previousModelCount : void 0,
       reason: oauthFallbackReason
     };
   } catch (err) {
@@ -8516,13 +9151,63 @@ async function refreshProviderModels(providerId, apiKey, registry) {
     };
   }
 }
+async function refreshProviderModelsWithCredential(providerId, resolveKey, selected = process.env[OAUTH_ACCOUNT_ENV], options = {}) {
+  return withProviderMutationLock(providerId, async () => {
+    const provider = loadRegistryStrict().providers.find((candidate) => candidate.id === providerId);
+    if (!provider) {
+      return { id: providerId, name: providerId, ok: false, reason: "Provider not found." };
+    }
+    if (options.requireEnabled && !provider.enabled) {
+      return {
+        id: provider.id,
+        name: provider.name,
+        ok: true,
+        skipped: true,
+        reason: "Provider was disabled before its model refresh began."
+      };
+    }
+    const accountOverride = selected === null ? null : selected ?? process.env[OAUTH_ACCOUNT_ENV] ?? null;
+    const snapshot = refreshCredentialSnapshot(provider, accountOverride, {
+      ignoreProviderOverride: options.ignoreProviderOverride
+    });
+    const resolved = await resolveRefreshCredentialWithSource(
+      provider,
+      resolveKey,
+      accountOverride,
+      { ignoreProviderOverride: options.ignoreProviderOverride }
+    );
+    if (!isDeepStrictEqual(resolved.credentialOverride, snapshot.credentialOverride)) {
+      return {
+        id: provider.id,
+        name: provider.name,
+        ok: false,
+        reason: "Provider credential override changed while models were refreshing."
+      };
+    }
+    return refreshProviderModels(provider.id, resolved.credential, void 0, snapshot);
+  });
+}
 async function refreshAllProviderModels(resolveKey) {
   const refreshed = [];
   const registry = loadRegistryStrict();
   const enabledProviders = registry.providers.filter((p13) => p13.enabled);
   for (const provider of enabledProviders) {
-    const key = await resolveRefreshCredential(provider, resolveKey);
-    refreshed.push(await refreshProviderModels(provider.id, key));
+    const accountOverride = process.env[OAUTH_ACCOUNT_ENV] ?? null;
+    try {
+      refreshed.push(await refreshProviderModelsWithCredential(
+        provider.id,
+        resolveKey,
+        accountOverride,
+        { requireEnabled: true }
+      ));
+    } catch (err) {
+      refreshed.push({
+        id: provider.id,
+        name: provider.name,
+        ok: false,
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
   }
   return { refreshed };
 }
@@ -8531,6 +9216,15 @@ async function refreshAllProviderModels(resolveKey) {
 import pc3 from "picocolors";
 import * as p2 from "@clack/prompts";
 import open from "open";
+function validateOAuthAccountName(name) {
+  const trimmed = name.trim().toLowerCase();
+  if (!OAUTH_ACCOUNT_NAME_RE.test(trimmed)) {
+    throw new Error(
+      `Invalid account name "${name}" \u2014 use 1-32 characters: lowercase letters, digits, "-" or "_", starting with a letter or digit.`
+    );
+  }
+  return trimmed;
+}
 var OPENAI_DISPLAY = "OpenAI ChatGPT Plus/Pro";
 var PROVIDER_DISPLAY = {
   openai: OPENAI_DISPLAY,
@@ -8560,6 +9254,47 @@ async function runNativeDeviceCode(providerId) {
     throw err;
   }
 }
+async function upsertOAuthAccountSlot(registryId, account, authRef, expectedAuthRef) {
+  return withRegistryWriteLock(async () => {
+    const registry = loadRegistryStrict();
+    const entry = registry.providers.find((pr) => pr.id === registryId);
+    if (!entry) {
+      throw new Error(
+        `Provider "${registryId}" is not configured yet \u2014 run the default sign-in first: clodex providers auth openai`
+      );
+    }
+    const previousAuthRef = getOAuthAccountSlot(entry, account)?.authRef;
+    if (previousAuthRef !== expectedAuthRef) {
+      throw new Error(`Account "${account}" of "${registryId}" changed while its credential was being saved`);
+    }
+    const updated = {
+      ...entry,
+      authAccounts: {
+        ...entry.authAccounts,
+        [account]: {
+          authRef,
+          addedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      }
+    };
+    if (entry.activeAuthAccount === account) {
+      storeActiveOAuthAccount(updated, account, authRef);
+      delete updated.modelsCache;
+      delete updated.refreshedAt;
+    }
+    const idx = registry.providers.findIndex((provider) => provider.id === registryId);
+    registry.providers[idx] = updated;
+    if (previousAuthRef && previousAuthRef !== authRef) {
+      await queueCredentialDelete(previousAuthRef);
+    }
+    saveRegistry(registry);
+    try {
+      await cancelCredentialDelete(authRef);
+    } catch {
+    }
+    return updated;
+  });
+}
 function oauthDisplayName(registryId, fallbackName) {
   if (registryId === "openai-oauth") return "OpenAI (ChatGPT)";
   return fallbackName;
@@ -8571,7 +9306,7 @@ async function upsertOAuthProvider(providerId, authRef, expectedAuthRef) {
     const registry = loadRegistryStrict();
     const template = getTemplateById(templateId);
     let entry = registry.providers.find((pr) => pr.id === registryId);
-    if (entry?.authRef !== expectedAuthRef) {
+    if ((entry ? providerDefaultAuthRef(entry) : void 0) !== expectedAuthRef) {
       throw new Error(`Provider "${registryId}" changed while its credential was being saved`);
     }
     if (!entry) {
@@ -8579,7 +9314,7 @@ async function upsertOAuthProvider(providerId, authRef, expectedAuthRef) {
         throw new Error(`Provider "${providerId}" is not in your registry and has no template`);
       }
     }
-    const previousAuthRef = entry?.authRef;
+    const previousAuthRef = entry ? providerDefaultAuthRef(entry) : void 0;
     if (!entry) {
       if (!template) throw new Error(`Provider "${providerId}" has no template`);
       const displayName = oauthDisplayName(registryId, template.name);
@@ -8597,8 +9332,34 @@ async function upsertOAuthProvider(providerId, authRef, expectedAuthRef) {
         },
         addedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
+    } else if (entry.activeAuthAccount) {
+      const selected = getOAuthAccountSlot(entry, entry.activeAuthAccount);
+      if (!selected) {
+        throw new Error(
+          `Provider "${registryId}" is set to use account "${entry.activeAuthAccount}", which no longer exists`
+        );
+      }
+      entry = {
+        ...entry,
+        authType: "oauth",
+        authRef: selected.authRef,
+        defaultAuthRef: authRef,
+        templateId
+      };
+      delete entry.defaultModelsCache;
+      if (selected.modelsCache) {
+        entry.modelsCache = selected.modelsCache;
+        entry.refreshedAt = selected.modelsCache.fetchedAt;
+      } else {
+        delete entry.modelsCache;
+        delete entry.refreshedAt;
+      }
     } else {
       entry = { ...entry, authType: "oauth", authRef, templateId };
+      delete entry.defaultAuthRef;
+      delete entry.defaultModelsCache;
+      delete entry.modelsCache;
+      delete entry.refreshedAt;
     }
     const idx = registry.providers.findIndex((provider) => provider.id === registryId);
     if (idx >= 0) registry.providers[idx] = entry;
@@ -8614,9 +9375,9 @@ async function upsertOAuthProvider(providerId, authRef, expectedAuthRef) {
     return entry;
   });
 }
-async function persistNativeOAuthCredential(providerId, cred) {
+async function persistNativeOAuthCredential(providerId, cred, accountName) {
   const registryId = toOAuthRegistryId(providerId);
-  const account = `oauth:provider:${registryId}`;
+  const account = accountName ? `oauth:provider:${registryId}:account:${accountName}` : `oauth:provider:${registryId}`;
   const registryProvider = await withProviderMutationLock(registryId, async () => {
     const existingAuthRef = await withRegistryWriteLock(
       () => {
@@ -8626,7 +9387,17 @@ async function persistNativeOAuthCredential(providerId, cred) {
         if (!existing && !getTemplateById(templateId)) {
           throw new Error(`Provider "${providerId}" is not in your registry and has no template`);
         }
-        return existing?.authRef;
+        if (accountName && !existing) {
+          throw new Error(
+            `Provider "${registryId}" is not configured yet \u2014 run the default sign-in first: clodex providers auth openai`
+          );
+        }
+        if (accountName && existing?.authType !== "oauth") {
+          throw new Error(
+            `Provider "${registryId}" does not currently have a default OAuth sign-in \u2014 run clodex providers auth openai without --account first.`
+          );
+        }
+        return accountName ? existing ? getOAuthAccountSlot(existing, accountName)?.authRef : void 0 : existing ? providerDefaultAuthRef(existing) : void 0;
       }
     );
     const authRef = credentialInstanceAuthRef(account);
@@ -8643,7 +9414,7 @@ async function persistNativeOAuthCredential(providerId, cred) {
           `Could not save OAuth tokens to the credential store${diagMsg ? ` \u2014 ${diagMsg}` : " \u2014 check access and try again"}`
         );
       }
-      return upsertOAuthProvider(providerId, authRef, existingAuthRef);
+      return accountName ? upsertOAuthAccountSlot(registryId, accountName, authRef, existingAuthRef) : upsertOAuthProvider(providerId, authRef, existingAuthRef);
     });
   });
   let credentialCleanupPending = true;
@@ -8658,11 +9429,25 @@ async function persistNativeOAuthCredential(providerId, cred) {
     credentialCleanupPending
   };
 }
-async function authenticateProvider(providerId, _options = {}) {
+async function authenticateProvider(providerId, options = {}) {
   const registryId = toOAuthRegistryId(providerId);
+  const accountName = options.account === void 0 ? void 0 : validateOAuthAccountName(options.account);
   if (!supportsNativeOAuth(providerId)) {
     throw new Error("OAuth sign-in is only available for openai (ChatGPT Plus/Pro).");
   }
+  if (accountName) {
+    const existing = loadRegistryStrict().providers.find((provider) => provider.id === registryId);
+    if (!existing) {
+      throw new Error(
+        `Provider "${registryId}" is not configured yet \u2014 run the default sign-in first: clodex providers auth openai`
+      );
+    }
+    if (existing.authType !== "oauth") {
+      throw new Error(
+        `Provider "${registryId}" does not currently have a default OAuth sign-in \u2014 run clodex providers auth openai without --account first.`
+      );
+    }
+  }
   let storeDiagMsg = "";
   const storeReady = await probeProviderCredentialStore(oauthAuthRef(registryId), (msg) => {
     storeDiagMsg = msg;
@@ -8673,12 +9458,29 @@ async function authenticateProvider(providerId, _options = {}) {
     );
   }
   const cred = await runNativeDeviceCode(providerId);
-  const persisted = await persistNativeOAuthCredential(providerId, cred);
+  const persisted = await persistNativeOAuthCredential(providerId, cred, accountName);
   const refreshSpinner = p2.spinner();
   refreshSpinner.start("Refreshing model list...");
   try {
-    await refreshProviderModels(registryId, cred.access);
-    refreshSpinner.stop("Models refreshed");
+    const accountOverride = accountName ?? (persisted.registryProvider.activeAuthAccount === void 0 ? null : process.env[OAUTH_ACCOUNT_ENV] ?? null);
+    const refreshResult = await refreshProviderModelsWithCredential(
+      registryId,
+      async (provider) => resolveProviderCredentialWithSource(
+        provider.id,
+        provider.authRef,
+        void 0,
+        { ignoreProviderOverride: true }
+      ),
+      accountOverride,
+      { ignoreProviderOverride: true }
+    );
+    if (refreshResult.skipped) {
+      refreshSpinner.stop(`Models not refreshed${refreshResult.reason ? ` \u2014 ${refreshResult.reason}` : ""}`);
+    } else if (refreshResult.ok) {
+      refreshSpinner.stop("Models refreshed");
+    } else {
+      refreshSpinner.stop(`Could not refresh models${refreshResult.reason ? ` \u2014 ${refreshResult.reason}` : ""}`);
+    }
   } catch {
     refreshSpinner.stop("Could not refresh models \u2014 run clodex providers refresh-models later");
   }
@@ -8694,9 +9496,15 @@ function providerAuthHelpText() {
 
 ${pc3.bold("Usage:")}
   clodex providers auth openai
+  clodex providers auth openai --account work
 
 ${pc3.bold("Device code (works on SSH/VPS):")}
-  openai   ChatGPT Plus/Pro (device code at auth.openai.com/codex/device)`;
+  openai   ChatGPT Plus/Pro (device code at auth.openai.com/codex/device)
+
+${pc3.bold("Named accounts:")}
+  --account <name>   store an additional ChatGPT account under a named slot
+                     (the default sign-in is untouched). Select one at launch:
+                     CLODEX_OAUTH_ACCOUNT=work clodex claude`;
 }
 
 // src/prompts.ts
@@ -9045,10 +9853,19 @@ function parseProvidersArgs(args) {
   if (first === "auth") {
     if (rest.length === 0) return { subcommand: "auth", showHelp: true };
     let authMethod;
+    let authAccount;
     const positional = [];
-    for (const arg of rest) {
+    for (let i = 0; i < rest.length; i++) {
+      const arg = rest[i];
       if (arg === "--native") authMethod = "native";
-      else if (arg.startsWith("-")) {
+      else if (arg === "--account") {
+        const value = rest[i + 1];
+        if (!value || value.startsWith("-")) {
+          return { subcommand: "auth", showHelp: false, error: "Usage: clodex providers auth <id> --account <name>" };
+        }
+        authAccount = value;
+        i++;
+      } else if (arg.startsWith("-")) {
         return { subcommand: "auth", showHelp: false, error: `Unknown auth option: ${arg}` };
       } else {
         positional.push(arg);
@@ -9057,7 +9874,7 @@ function parseProvidersArgs(args) {
     if (positional.length !== 1) {
       return { subcommand: "auth", showHelp: false, error: "Usage: clodex providers auth <id>" };
     }
-    return { subcommand: "auth", showHelp: false, removeId: positional[0], authMethod };
+    return { subcommand: "auth", showHelp: false, removeId: positional[0], authMethod, authAccount };
   }
   if (first === "remove") {
     if (rest.length === 0) return { subcommand: "remove", showHelp: false, error: "Usage: clodex providers remove <id>" };
@@ -9090,13 +9907,133 @@ ${pc5.bold("Subcommands:")}
   remove      Remove a provider by id
   refresh-models  Update cached model lists`;
 }
+function accountSwitchOutcome(providerName, saved, effective) {
+  const savedLabel = saved ?? PROVIDER_DEFAULT_ACCOUNT_LABEL;
+  if (effective.kind === "credential-override") {
+    const variable = effective.credentialOverride.variable;
+    if (effective.inactiveReason === "non-oauth") {
+      return {
+        ok: false,
+        message: `Saved ${savedLabel} for ${providerName}, but this provider is not configured for OAuth account selection; ${variable} is configured and blocks launch because it has no isolated model catalog. Save that credential as a provider or unset the variable.`
+      };
+    }
+    if (effective.inactiveReason === "disabled") {
+      return {
+        ok: false,
+        message: `Saved ${savedLabel} for ${providerName} (provider disabled); ${variable} has no isolated model catalog, so enabling the provider in this shell will fail until that credential is saved and refreshed or the variable is unset.`
+      };
+    }
+    return {
+      ok: false,
+      message: `Saved ${savedLabel} for ${providerName}, but ${variable} has no isolated model catalog, so launches are blocked. Save that credential as a provider or account and refresh its models, or unset the variable.`
+    };
+  }
+  if (effective.inactiveReason === "non-oauth") {
+    return {
+      ok: true,
+      message: `Saved ${savedLabel} for ${providerName}, but this provider is not configured for OAuth account selection.`
+    };
+  }
+  if (effective.inactiveReason === "disabled") {
+    if (effective.kind === "broken") {
+      const blockedOverride = effective.credentialOverride ? ` ${effective.credentialOverride.variable} is configured, but OAuth account selection is validated before credential resolution.` : "";
+      return {
+        ok: false,
+        message: effective.fromEnvironment ? `Saved ${savedLabel} for ${providerName} (provider disabled), but ${OAUTH_ACCOUNT_ENV}=${effective.name} names no such account \u2014 enabling it in this shell will fail until the variable is unset or corrected.${blockedOverride}` : `Saved ${savedLabel} for ${providerName} (provider disabled), but that account no longer exists \u2014 enabling the provider will fail.${blockedOverride}`
+      };
+    }
+    if (effective.kind === "slot" && effective.fromEnvironment && effective.name !== saved) {
+      return {
+        ok: true,
+        message: `Saved ${savedLabel} for ${providerName} (provider disabled); if enabled in this shell, ${OAUTH_ACCOUNT_ENV}=${effective.name} will override it.`
+      };
+    }
+    return {
+      ok: true,
+      message: `Saved ${savedLabel} for ${providerName} (provider disabled).`
+    };
+  }
+  if (effective.kind === "broken") {
+    const blockedOverride = effective.credentialOverride ? ` ${effective.credentialOverride.variable} is configured, but OAuth account selection is validated before credential resolution.` : "";
+    return {
+      ok: false,
+      message: effective.fromEnvironment ? `Saved ${savedLabel} for ${providerName}, but ${OAUTH_ACCOUNT_ENV}=${effective.name} names no such account \u2014 every launch fails until it is unset or corrected.${blockedOverride}` : `Saved ${savedLabel} for ${providerName}, but it names no existing account \u2014 every launch fails.${blockedOverride}`
+    };
+  }
+  if (effective.kind === "slot" && effective.fromEnvironment && effective.name !== saved) {
+    return {
+      ok: true,
+      message: `Saved ${savedLabel} for ${providerName}, but ${OAUTH_ACCOUNT_ENV}=${effective.name} overrides it in this shell.`
+    };
+  }
+  return {
+    ok: true,
+    message: `${providerName} will launch as ${savedLabel}.`,
+    confirmsLaunch: true
+  };
+}
+function accountSwitchServerRestartWarning(liveServerCount, selectionChanged = true) {
+  if (!selectionChanged || !Number.isInteger(liveServerCount) || liveServerCount <= 0) return null;
+  return `Restart ${liveServerCount} running standalone clodex server${liveServerCount === 1 ? "" : "s"} ${liveServerCount === 1 ? "because it retains" : "because they retain"} the previous provider and credential snapshot.`;
+}
+function accountSwitchHint(provider, effective) {
+  if (effective.kind === "credential-override") {
+    const variable = effective.credentialOverride.variable;
+    const selected = effective.selection;
+    const account = selected.kind === "slot" ? `account ${selected.name}` : selected.kind === "default" ? PROVIDER_DEFAULT_ACCOUNT_LABEL : `missing stored OAuth account "${selected.name}"`;
+    const masked2 = selected.latentOrphan ? `; stored "${selected.latentOrphan}" is missing and will fail without ${OAUTH_ACCOUNT_ENV}` : "";
+    if (effective.inactiveReason === "non-oauth") {
+      return `${variable} is configured but launches are blocked because it has no isolated model catalog; OAuth selection (${account}) is stored but inactive because this provider is not configured for OAuth${masked2}`;
+    }
+    if (effective.inactiveReason === "disabled") {
+      return `${variable} is configured for ${account} but has no isolated model catalog; enabling this provider will fail until that credential is saved and refreshed or the variable is unset${masked2}`;
+    }
+    return `${variable} is configured for ${account}, but launches are blocked because it has no isolated model catalog; save and refresh that credential or unset the variable${masked2}`;
+  }
+  if (effective.inactiveReason === "non-oauth") {
+    if (effective.kind === "broken") {
+      return `Stored OAuth account "${effective.name}" no longer exists \u2014 provider is not configured for OAuth selection`;
+    }
+    if (effective.kind === "slot") {
+      return `Stored OAuth account: ${effective.name} (provider is not configured for OAuth selection)`;
+    }
+    return "OAuth account selection inactive (provider is not configured for OAuth)";
+  }
+  if (effective.inactiveReason === "disabled") {
+    const masked2 = effective.latentOrphan ? `; stored "${effective.latentOrphan}" is missing and will fail if enabled without the override` : "";
+    if (effective.kind === "broken") {
+      const blockedOverride = effective.credentialOverride ? `; ${effective.credentialOverride.variable} cannot bypass account selection` : "";
+      return effective.fromEnvironment ? `${OAUTH_ACCOUNT_ENV}=${effective.name} names no such account \u2014 enabling this provider will fail${masked2}${blockedOverride}` : `Selected account "${effective.name}" no longer exists \u2014 enabling this provider will fail${blockedOverride}`;
+    }
+    if (effective.kind === "slot") {
+      return effective.fromEnvironment ? `If enabled, ${OAUTH_ACCOUNT_ENV}=${effective.name} overrides the stored ${provider.activeAuthAccount ?? PROVIDER_DEFAULT_ACCOUNT_LABEL}${masked2}` : `Saved account: ${effective.name} (provider disabled)`;
+    }
+    return `Saved account: ${PROVIDER_DEFAULT_ACCOUNT_LABEL} (provider disabled)`;
+  }
+  if (effective.kind === "broken") {
+    const also = effective.latentOrphan ? ` (and stored "${effective.latentOrphan}" is missing too)` : "";
+    const blockedOverride = effective.credentialOverride ? `; ${effective.credentialOverride.variable} cannot bypass account selection` : "";
+    return effective.fromEnvironment ? `${OAUTH_ACCOUNT_ENV}=${effective.name} names no such account \u2014 every launch fails${also}` + blockedOverride : `Selected account "${effective.name}" no longer exists \u2014 every launch fails; clear it here${blockedOverride}`;
+  }
+  const masked = effective.latentOrphan ? ` \u2014 stored "${effective.latentOrphan}" no longer exists and will fail without it` : "";
+  if (effective.kind === "default") {
+    return `Every launch currently uses ${PROVIDER_DEFAULT_ACCOUNT_LABEL}${masked}`;
+  }
+  return effective.fromEnvironment ? `${OAUTH_ACCOUNT_ENV}=${effective.name} overrides the stored ${provider.activeAuthAccount ?? PROVIDER_DEFAULT_ACCOUNT_LABEL}${masked}` : `Every launch currently uses ${effective.name}${masked}`;
+}
+function shouldOfferAccountSwitch(provider) {
+  return Object.keys(provider.authAccounts ?? {}).length > 0 || provider.activeAuthAccount !== void 0;
+}
 function providerLabel(name, modelCount, enabled) {
   return `${fmtEnabledStar(enabled)} ${fmtProvider(name)} ${pc5.dim(`(${modelCount} model${modelCount === 1 ? "" : "s"})`)}`;
 }
-async function runProvidersAuthWithCleanupState(providerId, method, cleanupState) {
+async function runProvidersAuthWithCleanupState(providerId, method, cleanupState, account) {
   try {
-    const result = await authenticateProvider(providerId, { method });
-    p4.log.success(`Signed in to ${result.registryProvider.name} \u2014 credential saved to the credential store.`);
+    const result = await authenticateProvider(providerId, { method, account });
+    const slot = account === void 0 ? void 0 : validateOAuthAccountName(account);
+    p4.log.success(
+      slot ? `Signed in to ${result.registryProvider.name} (account "${slot}") \u2014 make it the account every launch uses with: clodex providers` : `Signed in to ${result.registryProvider.name} \u2014 credential saved to the credential store.`
+    );
     reportCredentialCleanup(result.credentialCleanupPending, cleanupState, true);
     return 0;
   } catch (err) {
@@ -9111,8 +10048,8 @@ async function runProvidersAuthWithCleanupState(providerId, method, cleanupState
 async function runProvidersAuth(providerId, method) {
   return runProvidersAuthWithCleanupState(providerId, method);
 }
-async function runProvidersRefreshModels(providerId) {
-  const resolveKey = async (provider) => resolveProviderCredential(provider.id, provider.authRef);
+async function runProvidersRefreshModels(providerId, options = {}) {
+  const resolveKey = async (provider) => resolveProviderCredentialWithSource(provider.id, provider.authRef);
   if (providerId) {
     const registry = loadRegistry();
     const provider = registry.providers.find((p13) => p13.id === providerId);
@@ -9122,11 +10059,25 @@ async function runProvidersRefreshModels(providerId) {
     }
     const spinner6 = p4.spinner();
     spinner6.start(`Refreshing ${provider.name}...`);
-    const key = await resolveRefreshCredential(
-      provider,
-      async (p13) => resolveProviderCredential(p13.id, p13.authRef)
-    );
-    const result = await refreshProviderModels(providerId, key);
+    const accountOverride = options.accountOverride === void 0 ? process.env[OAUTH_ACCOUNT_ENV] ?? null : options.accountOverride;
+    let result;
+    try {
+      result = await refreshProviderModelsWithCredential(
+        providerId,
+        async (candidate) => resolveProviderCredentialWithSource(
+          candidate.id,
+          candidate.authRef,
+          void 0,
+          { ignoreProviderOverride: options.ignoreProviderCredentialOverride }
+        ),
+        accountOverride,
+        { ignoreProviderOverride: options.ignoreProviderCredentialOverride }
+      );
+    } catch (err) {
+      spinner6.stop("");
+      p4.log.error(err instanceof Error ? err.message : String(err));
+      return 1;
+    }
     spinner6.stop("");
     if (result.skipped) {
       const countNote = result.modelCount ? ` (${result.modelCount} cached models kept)` : "";
@@ -9300,8 +10251,22 @@ async function runProviderDetail(id) {
   const registry = loadRegistry();
   const provider = registry.providers.find((pr) => pr.id === id);
   if (!provider) return "back";
-  const modelCount = provider.modelsCache?.models.length ?? 0;
-  const authLabel = formatRegistryAuthLabel(provider);
+  const effective = resolveActiveAccount(provider);
+  let modelProvider;
+  try {
+    modelProvider = projectSelectedOAuthAccount(provider);
+    if (effective.kind === "credential-override") {
+      modelProvider = { ...modelProvider };
+      delete modelProvider.modelsCache;
+      delete modelProvider.refreshedAt;
+    }
+  } catch {
+    modelProvider = { ...provider };
+    delete modelProvider.modelsCache;
+    delete modelProvider.refreshedAt;
+  }
+  const modelCount = modelProvider.modelsCache?.models.length ?? 0;
+  const authLabel = (await resolveProvidersForDisplay()).find((entry) => entry.id === id)?.authLabel ?? formatRegistryAuthLabel(provider);
   printProviderDetailPanel(provider.name, modelCount, authLabel);
   const detailOptions = [];
   if (modelCount > 0) {
@@ -9316,11 +10281,29 @@ async function runProviderDetail(id) {
     label: "Refresh model list",
     hint: "Fetch latest models from the provider API"
   });
+  const accountSlots = Object.keys(provider.authAccounts ?? {}).sort();
   if (supportsNativeOAuth(id) || provider.authType === "oauth") {
     detailOptions.push({
       value: "auth",
       label: "Sign in again (OAuth)",
-      hint: "Refresh OAuth tokens or switch accounts"
+      // Says what the action DOES. It calls the auth flow with no account
+      // name, so it re-authenticates the provider's own credential and cannot
+      // create or refresh a named slot — the previous wording advertised
+      // exactly the thing it does not do, which is worst when the account
+      // needing reauthentication is a named one that this would leave broken
+      // while overwriting the default.
+      hint: accountSlots.length > 0 ? `Re-authenticate ${PROVIDER_DEFAULT_ACCOUNT_LABEL} only \u2014 for a named account: clodex providers auth ${id} --account <name>` : `Re-authenticate ${PROVIDER_DEFAULT_ACCOUNT_LABEL}`
+    });
+  }
+  if (shouldOfferAccountSwitch(provider)) {
+    detailOptions.push({
+      value: "account",
+      label: "Switch account",
+      // Same resolver the list view uses, so this screen cannot contradict it
+      // about which identity is live — including when the answer is "none of
+      // them, the launch fails", which this hint previously reported as a
+      // working account.
+      hint: accountSwitchHint(provider, effective)
     });
   }
   detailOptions.push(
@@ -9338,8 +10321,8 @@ async function runProviderDetail(id) {
   });
   if (p4.isCancel(action) || action === "back") return "back";
   if (action === "browse") {
-    const cachedModels = provider.modelsCache?.models ?? [];
-    const localModels = cachedModels.map((m) => cachedModelToLocal(m, provider)).filter((m) => m !== null);
+    const cachedModels = modelProvider.modelsCache?.models ?? [];
+    const localModels = cachedModels.map((m) => cachedModelToLocal(m, modelProvider)).filter((m) => m !== null);
     const localProvider = {
       id: provider.id,
       name: provider.name,
@@ -9357,6 +10340,71 @@ async function runProviderDetail(id) {
     await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(id, void 0, state));
     return "back";
   }
+  if (action === "account") {
+    const providerDefault = "<default>";
+    const stored = provider.activeAuthAccount;
+    const current = stored !== void 0 && accountSlots.includes(stored) ? stored : providerDefault;
+    const chosen = await p4.select({
+      message: "Which account should every launch use?",
+      initialValue: current,
+      options: [
+        {
+          value: providerDefault,
+          label: PROVIDER_DEFAULT_ACCOUNT_LABEL,
+          hint: "the provider's original sign-in"
+        },
+        ...accountSlots.map((name) => ({
+          value: name,
+          label: name,
+          hint: effective.kind === "slot" && effective.name === name ? effective.fromEnvironment ? `active via ${OAUTH_ACCOUNT_ENV}` : "current" : name === provider.activeAuthAccount ? "stored" : ""
+        }))
+      ]
+    });
+    if (p4.isCancel(chosen)) return "back";
+    return withProviderMutationLock(id, async () => {
+      const result = await setActiveOAuthAccount(id, chosen === providerDefault ? void 0 : chosen);
+      if (!result.updated) {
+        p4.log.error(result.error ?? "Could not switch account.");
+        return "back";
+      }
+      if (!result.provider) {
+        p4.log.error("Account selection was saved, but the resulting provider state could not be read.");
+        return "back";
+      }
+      const refreshExitCode = await runProvidersRefreshModels(id, {
+        accountOverride: null,
+        ignoreProviderCredentialOverride: true
+      });
+      const currentProvider = loadRegistry().providers.find((candidate) => candidate.id === id);
+      if (!currentProvider) {
+        p4.log.error("Account selection was saved, but the resulting provider state could not be read.");
+        return "back";
+      }
+      const outcome = accountSwitchOutcome(
+        currentProvider.name,
+        result.account,
+        resolveActiveAccount(currentProvider)
+      );
+      const selectedCatalogReady = Boolean(currentProvider.modelsCache?.models.length);
+      if (outcome.ok && currentProvider.enabled && currentProvider.authType === "oauth" && (refreshExitCode !== 0 || !selectedCatalogReady)) {
+        const savedLabel = result.account ?? PROVIDER_DEFAULT_ACCOUNT_LABEL;
+        const savedContext = outcome.confirmsLaunch ? `Saved ${savedLabel} for ${currentProvider.name}.` : outcome.message;
+        p4.log.warn(
+          `${savedContext} Automatic model refresh for the saved selection did not produce a usable catalog; choose Switch account again to retry it before relying on that selection for launches.`
+        );
+      } else if (outcome.ok) {
+        p4.log.success(outcome.message);
+      } else {
+        p4.log.warn(outcome.message);
+      }
+      const restartWarning = accountSwitchServerRestartWarning(
+        readLiveServerRuntimeStates().length,
+        result.changed
+      );
+      if (restartWarning) p4.log.warn(restartWarning);
+      return "back";
+    });
+  }
   if (action === "toggle") {
     const result = toggleProviderEnabled(id);
     if (result.toggled) {
@@ -9385,6 +10433,12 @@ async function runProvidersHub() {
     const configuredIds = new Set(entries.map((entry) => entry.id));
     if (listVisibleOAuthTemplates(configuredIds).length > 0) {
       options.push({ value: "auth-menu", label: "\u2192 Sign in with ChatGPT (OAuth)", hint: "device code" });
+    } else if (configuredIds.has("openai-oauth")) {
+      options.push({
+        value: "auth-account",
+        label: "\u2192 Add another ChatGPT account",
+        hint: "named slot; pick which one launches via Switch account"
+      });
     }
     if (entries.length > 0) {
       options.push({ value: "refresh-all", label: "\u21BA Refresh all models", hint: "Update model lists for all providers" });
@@ -9409,6 +10463,23 @@ async function runProvidersHub() {
       await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", void 0, state));
       continue;
     }
+    if (choice === "auth-account") {
+      const name = await p4.text({
+        message: "Name for this account (choose which one launches with: clodex providers)",
+        placeholder: "work",
+        validate: (value) => {
+          try {
+            validateOAuthAccountName(String(value ?? ""));
+            return void 0;
+          } catch (err) {
+            return err instanceof Error ? err.message : String(err);
+          }
+        }
+      });
+      if (p4.isCancel(name)) continue;
+      await runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState("openai", void 0, state, String(name)));
+      continue;
+    }
     if (typeof choice === "string" && choice.startsWith("provider:")) {
       const id = choice.slice("provider:".length);
       const outcome = await runProviderDetail(id);
@@ -9443,7 +10514,7 @@ async function runProvidersCommand(args) {
       console.log(providerAuthHelpText());
       return 0;
     }
-    return runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(parsed.removeId, parsed.authMethod, state));
+    return runWithCredentialCleanup((state) => runProvidersAuthWithCleanupState(parsed.removeId, parsed.authMethod, state, parsed.authAccount));
   }
   relayIntro("Your OpenAI providers");
   return runProvidersHub();
@@ -9484,7 +10555,7 @@ async function runFirstRunWizard(_trace = false) {
 
 // src/proxy.ts
 import { createServer } from "http";
-import { appendFileSync, openSync as openSync3, writeSync, closeSync as closeSync3 } from "fs";
+import { appendFileSync as appendFileSync2, openSync as openSync3, writeSync as writeSync2, closeSync as closeSync3 } from "fs";
 
 // src/http-utils.ts
 import * as zlib from "zlib";
@@ -10133,10 +11204,10 @@ async function relayAnthropicMessages(res, messagesUrl, body, apiKey, clientWant
     res.end(JSON.stringify({ type: "error", error: { type: "api_error", message: "Upstream returned empty response body" } }));
     return;
   }
-  let text4 = await upstreamRes.text();
+  let text5 = await upstreamRes.text();
   let parsed;
   try {
-    parsed = JSON.parse(text4);
+    parsed = JSON.parse(text5);
   } catch {
     res.writeHead(502, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ type: "error", error: { type: "api_error", message: "Upstream response was not valid JSON" } }));
@@ -10144,13 +11215,13 @@ async function relayAnthropicMessages(res, messagesUrl, body, apiKey, clientWant
   }
   if (options.responseModelOverride && parsed && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.model === "string") {
     parsed.model = options.responseModelOverride;
-    text4 = JSON.stringify(parsed);
+    text5 = JSON.stringify(parsed);
   }
   res.writeHead(200, {
     "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(text4).toString()
+    "Content-Length": Buffer.byteLength(text5).toString()
   });
-  res.end(text4);
+  res.end(text5);
 }
 
 // src/proxy.ts
@@ -10306,7 +11377,7 @@ function reportOnce(raw, message, warn) {
   } catch {
   }
 }
-function upstreamMaxRetries(env = process.env, warn = (message) => console.error(`clodex: ${message}`)) {
+function upstreamMaxRetries(env = process.env, warn = (message) => emitParentNotice(`clodex: ${message}`)) {
   const raw = env[UPSTREAM_MAX_RETRIES_ENV]?.trim();
   if (raw === void 0 || raw === "") return void 0;
   const value = Number(raw);
@@ -10375,10 +11446,10 @@ function supportsOpenAiPromptCacheBreakpoints(modelId) {
   const minor = Number(match[2] ?? 0);
   return major > 5 || major === 5 && minor >= 6;
 }
-function stripClaudeCodeBillingHeader(text4) {
-  if (!text4.startsWith(CLAUDE_CODE_BILLING_HEADER_PREFIX)) return text4;
-  const newline = text4.indexOf("\n");
-  return newline === -1 ? void 0 : text4.slice(newline + 1);
+function stripClaudeCodeBillingHeader(text5) {
+  if (!text5.startsWith(CLAUDE_CODE_BILLING_HEADER_PREFIX)) return text5;
+  const newline = text5.indexOf("\n");
+  return newline === -1 ? void 0 : text5.slice(newline + 1);
 }
 function systemToString(system, stripAnthropicBillingHeader = false) {
   if (!system) return void 0;
@@ -10387,8 +11458,8 @@ function systemToString(system, stripAnthropicBillingHeader = false) {
   }
   const blocks = system.map((b) => typeof b === "string" ? b : b.text ?? "");
   if (!stripAnthropicBillingHeader) return blocks.join("\n");
-  return blocks.flatMap((text4) => {
-    const stripped = stripClaudeCodeBillingHeader(text4);
+  return blocks.flatMap((text5) => {
+    const stripped = stripClaudeCodeBillingHeader(text5);
     return stripped === void 0 ? [] : [stripped];
   }).join("\n");
 }
@@ -10404,12 +11475,12 @@ function translateTopLevelSystemForOpenAi(system) {
   }
   return system.flatMap((block) => {
     const raw = typeof block === "string" ? block : block.text ?? "";
-    const text4 = stripClaudeCodeBillingHeader(raw) ?? "";
-    if (!text4.trim()) return [];
+    const text5 = stripClaudeCodeBillingHeader(raw) ?? "";
+    if (!text5.trim()) return [];
     const cacheControl = typeof block === "string" ? void 0 : block.cache_control;
     return [{
       role: "system",
-      content: text4,
+      content: text5,
       ...cacheControl ? { providerOptions: { openai: { promptCacheBreakpoint: { mode: "explicit" } } } } : {}
     }];
   });
@@ -10466,9 +11537,9 @@ function annotateToolNames(messages) {
   }
 }
 function thinkingToSdkPart(block, npm) {
-  const text4 = block.thinking ?? "";
-  if (npm === "@ai-sdk/openai" && !block.signature && !text4.trim()) return null;
-  const part = { type: "reasoning", text: text4 };
+  const text5 = block.thinking ?? "";
+  if (npm === "@ai-sdk/openai" && !block.signature && !text5.trim()) return null;
+  const part = { type: "reasoning", text: text5 };
   if (block.signature) {
     if (npm === "@ai-sdk/google") {
       part.providerOptions = { google: { thoughtSignature: block.signature } };
@@ -10584,8 +11655,8 @@ function isClaudeCodeStructuredOutputCompactRequest(body) {
   if (!body.tools?.some((candidate) => candidate.name === "StructuredOutput")) return false;
   const finalMessage = body.messages.at(-1);
   if (!finalMessage || finalMessage.role !== "user") return false;
-  const text4 = typeof finalMessage.content === "string" ? finalMessage.content : finalMessage.content.filter((block) => block.type === "text").map((block) => block.text ?? "").join("\n");
-  return text4.includes(COMPACT_TEXT_ONLY_START) && text4.includes(COMPACT_TEXT_ONLY_END);
+  const text5 = typeof finalMessage.content === "string" ? finalMessage.content : finalMessage.content.filter((block) => block.type === "text").map((block) => block.text ?? "").join("\n");
+  return text5.includes(COMPACT_TEXT_ONLY_START) && text5.includes(COMPACT_TEXT_ONLY_END);
 }
 function translateRequest(body, npm, options) {
   const messages = body.messages ?? [];
@@ -10614,10 +11685,12 @@ function translateRequest(body, npm, options) {
   const supportsExplicitOpenAiCaching = !options?.openAiOAuth && supportsOpenAiPromptCacheBreakpoints(upstreamModelId2);
   if (npm === "@ai-sdk/openai") {
     const claudeSessionId = extractClaudeSessionId(body, options?.claudeSessionId);
+    const serviceTier = options?.openAiOAuth ? oauthServiceTier() : void 0;
     providerOptions = deepMergeProviderOptions(providerOptions, {
       openai: {
         promptCacheKey: claudeSessionId ? claudeSessionPromptCacheKey(claudeSessionId) : openAiPromptCacheKey(baseSystem, upstreamTools),
-        ...supportsExplicitOpenAiCaching ? { promptCacheOptions: { mode: "implicit", ttl: "30m" } } : {}
+        ...supportsExplicitOpenAiCaching ? { promptCacheOptions: { mode: "implicit", ttl: "30m" } } : {},
+        ...serviceTier ? { serviceTier } : {}
       }
     });
   }
@@ -10635,6 +11708,35 @@ function translateRequest(body, npm, options) {
     providerOptions
   };
 }
+function isOpenAiOAuthRoute(route) {
+  return route?.npm === "@ai-sdk/openai" && route.authType === "oauth";
+}
+var SERVICE_TIERS = /* @__PURE__ */ new Set(["auto", "default", "flex", "priority"]);
+var warnedInvalidServiceTier = false;
+var warnedUnsupportedServiceTier = false;
+function oauthServiceTier() {
+  const raw = process.env.CLODEX_SERVICE_TIER;
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const normalized = raw.trim().toLowerCase() === "fast" ? "priority" : raw.trim().toLowerCase();
+  if (!SERVICE_TIERS.has(normalized)) {
+    if (!warnedInvalidServiceTier) {
+      warnedInvalidServiceTier = true;
+      emitParentNotice("clodex: ignoring CLODEX_SERVICE_TIER (expected auto, default, flex, priority, or fast)");
+    }
+    return void 0;
+  }
+  return normalized;
+}
+function reportUnsupportedServiceTier(params, warnings) {
+  if (warnedUnsupportedServiceTier || !params.providerOptions?.openai?.serviceTier) return;
+  if (!Array.isArray(warnings) || !warnings.some((warning) => {
+    if (!warning || typeof warning !== "object") return false;
+    const candidate = warning;
+    return candidate.type === "unsupported" && candidate.feature === "serviceTier";
+  })) return;
+  warnedUnsupportedServiceTier = true;
+  emitParentNotice("clodex: requested service tier was not sent for this model; the backend default will be used");
+}
 function toAnthropicUsage(u) {
   const total = u?.inputTokens ?? 0;
   const cacheRead = u?.inputTokenDetails?.cacheReadTokens ?? u?.cachedInputTokens ?? 0;
@@ -10884,7 +11986,8 @@ async function streamAnthropicResponse(model, params, modelId, write, log12, obs
     maxRetries: upstreamMaxRetries(),
     abortSignal,
     onError: () => {
-    }
+    },
+    onStepFinish: (step) => reportUnsupportedServiceTier(params, step.warnings)
   });
   const watchedStream = (async function* () {
     try {
@@ -10910,10 +12013,11 @@ async function streamAnthropicResponse(model, params, modelId, write, log12, obs
   }
 }
 async function generateAnthropicResponse(model, params, modelId, options) {
-  let text4;
+  let text5;
   let toolCalls;
   let finishReason;
   let usage;
+  let warnings;
   if (options?.forceStream) {
     const forceAbort = new AbortController();
     const stopForwardingAbort = forwardAbortSignal(options.abortSignal, forceAbort);
@@ -10933,7 +12037,8 @@ async function generateAnthropicResponse(model, params, modelId, options) {
       maxRetries: upstreamMaxRetries(),
       abortSignal,
       onError: () => {
-      }
+      },
+      onStepFinish: (step) => reportUnsupportedServiceTier(params, step.warnings)
     });
     const streamedText = [];
     const streamedToolCalls = [];
@@ -10972,7 +12077,7 @@ async function generateAnthropicResponse(model, params, modelId, options) {
       clearTimeout(totalTimer);
       if (!forceAbort.signal.aborted) forceAbort.abort();
     }
-    text4 = streamedText.join("");
+    text5 = streamedText.join("");
     toolCalls = streamedToolCalls;
     finishReason = streamedFinishReason;
     usage = streamedUsage;
@@ -10990,13 +12095,14 @@ async function generateAnthropicResponse(model, params, modelId, options) {
         maxRetries: upstreamMaxRetries(),
         abortSignal: generateAbort.signal
       });
-      ({ text: text4, toolCalls, finishReason, usage } = r);
+      ({ text: text5, toolCalls, finishReason, usage, warnings } = r);
     } finally {
       stopForwardingAbort();
       clearTimeout(totalTimer);
       if (!generateAbort.signal.aborted) generateAbort.abort();
     }
   }
+  reportUnsupportedServiceTier(params, warnings);
   const requiredProps = toolRequiredProps(params.tools);
   return {
     id: "msg_" + Date.now(),
@@ -11004,7 +12110,7 @@ async function generateAnthropicResponse(model, params, modelId, options) {
     role: "assistant",
     model: modelId,
     content: [
-      ...text4 ? [{ type: "text", text: text4 }] : [],
+      ...text5 ? [{ type: "text", text: text5 }] : [],
       ...toolCalls.map((tc) => ({
         type: "tool_use",
         id: encodeToolUseId(tc.toolCallId, grabRoundTripSignature(tc)),
@@ -11165,14 +12271,14 @@ function appendSecureLog(logPath, line) {
   try {
     const fd = openSync3(logPath, "a", 384);
     try {
-      writeSync(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
+      writeSync2(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } finally {
       closeSync3(fd);
     }
   } catch {
     try {
-      appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
+      appendFileSync2(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } catch {
     }
@@ -11338,8 +12444,9 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
       }
       const upstreamUrl = route.upstreamUrl;
       const routeAuthType = route.authType ?? "api";
+      const loggedTier = isOpenAiOAuthRoute(route) ? oauthServiceTier() : void 0;
       plog(
-        () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${routeAuthType === "none" ? "none" : apiKey ? `len:${apiKey.length}` : "MISSING"}`
+        () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${routeAuthType === "none" ? "none" : apiKey ? `len:${apiKey.length}` : "MISSING"}` + (loggedTier ? ` tier=${loggedTier}` : "")
       );
       const usesSdkAdapter = isSdkMigratedNpm(route.npm);
       if (messagesEndpoint === "count_tokens") {
@@ -11428,7 +12535,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
         return;
       }
       if (usesSdkAdapter) {
-        const openAiOAuth = route.npm === "@ai-sdk/openai" && route.authType === "oauth";
+        const openAiOAuth = isOpenAiOAuthRoute(route);
         const claudeSessionIdHeader = Array.isArray(req.headers["x-claude-code-session-id"]) ? req.headers["x-claude-code-session-id"][0] : req.headers["x-claude-code-session-id"];
         const claudeSessionId = extractClaudeSessionId(anthropicBody, claudeSessionIdHeader);
         const translationLifecycle = createTranslationLifecycle(
@@ -11685,7 +12792,7 @@ function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk,
 
 // src/server/index.ts
 import pc10 from "picocolors";
-import { networkInterfaces } from "os";
+import { networkInterfaces as networkInterfaces2 } from "os";
 import * as p9 from "@clack/prompts";
 
 // src/target-compatibility.ts
@@ -11898,6 +13005,7 @@ function translateOpenAiRequest(body, options) {
   }
   if (options?.openAiOAuth) {
     const instructions = system?.trim() || "You are a coding assistant.";
+    const serviceTier = oauthServiceTier();
     return {
       messages,
       tools,
@@ -11907,7 +13015,8 @@ function translateOpenAiRequest(body, options) {
         openai: {
           store: false,
           include: ["reasoning.encrypted_content"],
-          instructions
+          instructions,
+          ...serviceTier ? { serviceTier } : {}
         }
       }
     };
@@ -11954,7 +13063,8 @@ async function generateOpenAiResponse(model, params, responseModelId, options) {
       ...params,
       maxRetries: upstreamMaxRetries(),
       onError: () => {
-      }
+      },
+      onStepFinish: (step) => reportUnsupportedServiceTier(params, step.warnings)
     });
     result = await collectOpenAiStream(stream);
   } else {
@@ -11964,6 +13074,7 @@ async function generateOpenAiResponse(model, params, responseModelId, options) {
       maxRetries: upstreamMaxRetries()
     });
   }
+  reportUnsupportedServiceTier(params, result.warnings);
   const message = { role: "assistant", content: result.text || null };
   if (result.toolCalls?.length) {
     message.tool_calls = result.toolCalls.map((tc) => ({
@@ -11989,7 +13100,8 @@ async function streamOpenAiResponse(model, params, responseModelId, onChunk) {
   const { stream } = streamText2({
     model,
     ...params,
-    maxRetries: upstreamMaxRetries()
+    maxRetries: upstreamMaxRetries(),
+    onStepFinish: (step) => reportUnsupportedServiceTier(params, step.warnings)
   });
   const baseData = {
     id: `chatcmpl-${Date.now()}`,
@@ -12267,6 +13379,9 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       modelId: body.model,
       effort: anthropicEffortFromRequest(body) ?? model.defaultEffort,
       claudeSessionId,
+      // Use the adapter's route predicate and resolver so this records the same
+      // pre-dispatch request intent. It does not prove SDK serialization.
+      serviceTier: isOpenAiOAuthRoute(model) ? oauthServiceTier() : void 0,
       provider: inferenceProvider(model),
       route: "translated",
       requestPreview: getLatestMessagePreview(body.messages, body.system)
@@ -12276,7 +13391,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     if (npmMaxTools !== void 0 && toolCount > npmMaxTools) {
       plog(`tools truncated: ${toolCount} \u2192 ${npmMaxTools} (provider limit)`);
     }
-    const openAiOAuth = model.npm === "@ai-sdk/openai" && model.authType === "oauth";
+    const openAiOAuth = isOpenAiOAuthRoute(model);
     const params = translateRequest(body, model.npm, {
       defaultEffort: anthropicEffortFromRequest(body) ? void 0 : model.defaultEffort,
       openAiOAuth,
@@ -12463,12 +13578,13 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
   auditInference(options, {
     modelId: body.model,
     effort: openAiEffort(body),
+    serviceTier: isOpenAiOAuthRoute(model) ? oauthServiceTier() : void 0,
     provider: inferenceProvider(model),
     route: "translated",
     requestPreview: getLatestMessagePreview(body.messages, body.system)
   });
   const baseURL = model.modelFormat === "anthropic" ? model.baseUrl : model.apiBaseUrl;
-  const openAiOAuth = npm === "@ai-sdk/openai" && model.authType === "oauth";
+  const openAiOAuth = isOpenAiOAuthRoute(model);
   const params = translateOpenAiRequest(body, { openAiOAuth });
   const clientWantsStream = Boolean(body.stream);
   const responseModelId = getResponseModelId(body.model, model, options);
@@ -12987,7 +14103,7 @@ function requestHeadersWithoutProxyHeaders(req) {
   }
   return headers;
 }
-function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorized, onErrorResponse, onResponseUsage, lifecycle, isLocalShutdown = () => false) {
+function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorized, agent, onErrorResponse, onResponseUsage, lifecycle, isLocalShutdown = () => false) {
   return new Promise((resolve3) => {
     const startedAt = Date.now();
     let lastActivityAt = startedAt;
@@ -13047,7 +14163,8 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
       path: req.url,
       headers: requestHeadersWithoutProxyHeaders(req),
       servername: net.isIP(origin.hostname) ? void 0 : origin.hostname,
-      rejectUnauthorized
+      rejectUnauthorized,
+      agent
     }, (upstreamRes) => {
       headersReceived = true;
       statusCode = upstreamRes.statusCode ?? 502;
@@ -13388,6 +14505,8 @@ async function startHttpProxy(options) {
     reservedModelIds.add(normalizeRouteLookupId(modelId));
   }
   const anthropicOrigin = new URL2(options.anthropicOrigin ?? "https://api.anthropic.com");
+  const anthropicProxyUrl = outboundProxyUrlForTarget(anthropicOrigin.href);
+  let anthropicAgent;
   let adapter = options.adapterHandle ?? null;
   if (options.routes.length > 0) {
     adapter ??= await startProxyCatalog(
@@ -13470,6 +14589,9 @@ async function startHttpProxy(options) {
           claudeSessionId,
           modelId: typeof parsed?.model === "string" ? parsed.model : "unknown",
           effort: parsed ? anthropicEffortFromRequest(parsed) : void 0,
+          // Only for the route that actually carries one, using the same
+          // predicate and the same resolver the adapter applies.
+          serviceTier: isOpenAiOAuthRoute(route) ? oauthServiceTier() : void 0,
           provider,
           route: route ? "translated" : "passthrough",
           stream: Boolean(parsed?.stream),
@@ -13513,6 +14635,7 @@ async function startHttpProxy(options) {
         rawBody,
         anthropicOrigin,
         options.anthropicRejectUnauthorized ?? true,
+        anthropicAgent,
         messagesEndpoint === "messages" && options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
           requestId,
           modelId: typeof parsed?.model === "string" ? parsed.model : "unknown",
@@ -13547,7 +14670,8 @@ async function startHttpProxy(options) {
       res,
       rawBody,
       anthropicOrigin,
-      options.anthropicRejectUnauthorized ?? true
+      options.anthropicRejectUnauthorized ?? true,
+      anthropicAgent
     );
   });
   const sockets = /* @__PURE__ */ new Set();
@@ -13606,6 +14730,17 @@ async function startHttpProxy(options) {
     adapter?.close();
     throw err;
   }
+  if (anthropicProxyUrl && proxyUrlTargetsListener(
+    anthropicProxyUrl,
+    address.address,
+    address.port
+  )) {
+    console.error(
+      "clodex: HTTP(S)_PROXY points at this proxy; sending Anthropic passthrough direct"
+    );
+  } else {
+    anthropicAgent = outboundHttpProxyAgent(anthropicOrigin.href);
+  }
   return {
     host: options.host ?? "127.0.0.1",
     port: address.port,
@@ -13621,6 +14756,7 @@ async function startHttpProxy(options) {
       for (const socket of sockets) socket.destroy();
       await new Promise((resolve3) => proxyServer.close(() => resolve3()));
       mitmServer.close();
+      anthropicAgent?.destroy();
       adapter?.close();
     }
   };
@@ -13826,7 +14962,7 @@ async function runHttpProxyServerCommand(debug = false, webSocketDiagnostics = f
 
 // src/server/index.ts
 function getLocalIps() {
-  const ifaces = networkInterfaces();
+  const ifaces = networkInterfaces2();
   const result = [];
   for (const [name, iface] of Object.entries(ifaces)) {
     for (const addr of iface ?? []) {
@@ -14839,6 +15975,10 @@ function captureBuiltInPatchProofs(source, config, results) {
     "PATCH 9: default effort",
     /\/\*ccpatch:default-effort\*\/var _cce=Object\.assign\(Object\.create\(null\),\{[^{}]*\}\)\[String\([\w$]+\|\|""\)\.trim\(\)\.toLowerCase\(\)\];if\(_cce!==void 0\)return _cce;/
   );
+  addPattern(
+    "PATCH 10: child network environment",
+    /\/\*ccpatch:child-network-env\*\/let _clodexChildEnv=process\.env,[\s\S]*?catch\(_clodexError\)\{\}\}/
+  );
   return proofs;
 }
 function builtInPatchProofsChanged(source, proofs) {
@@ -15001,7 +16141,7 @@ function collectPristineFacts(args) {
 }
 
 // src/patch-transforms.ts
-var PATCH_TRANSFORMS_VERSION = 3;
+var PATCH_TRANSFORMS_VERSION = 5;
 var NATIVE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var BASE_EFFORT_LEVELS = ["low", "medium", "high"];
 function projectNativeEffort(effort) {
@@ -15296,6 +16436,36 @@ function applyClodexPatches(source, config) {
       );
     }
   }
+  {
+    const patchName = "PATCH 10: child network environment";
+    const marker = "/*ccpatch:child-network-env*/";
+    const contractVar = q(NETWORK_ENV_CONTRACT_VAR);
+    const networkVars = JSON.stringify(CHILD_NETWORK_ENV_VARS);
+    const requiredBodyLiterals = [
+      "{...process.env",
+      "CLAUDE_CODE_REMOTE",
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "CLAUDE_CODE_SUBSCRIPTION_TYPE",
+      "CLAUDE_BG_PTY_AUTH",
+      '"OTEL_"',
+      "CLAUDE_CODE_OTEL_DIAG_STDERR"
+    ];
+    applyOnce(
+      patchName,
+      /(function [\w$]+\(\)\{)(let [\w$]+=[\w$]+\(\),[\w$]+=Object\.keys\([\w$]+\)\.length>0,[\w$]+=Object\.keys\([\w$]+\)\.length>0,[\w$]+=[\w$]+\(process\.env\.CLAUDE_CODE_REMOTE\)\?(?:(?!\}\s*function )[\s\S])*?for\(let [\w$]+ of [\w$]+\)delete [\w$]+\[[\w$]+\],delete [\w$]+\[`INPUT_\$\{[\w$]+\}`\];return [\w$]+)(\})/,
+      (_match, head, body, tail) => {
+        const targetIsValid = requiredBodyLiterals.every((literal) => body.includes(literal)) && !/\bfunction\s*[\w$]*\(/.test(body);
+        if (!targetIsValid) {
+          log12("FAIL", patchName, "target validation failed");
+          fail("clodex patch: child network environment target validation failed");
+        }
+        const restoredBody = body.replace(/process\.env/g, "_clodexChildEnv");
+        const restore = marker + "let _clodexChildEnv=process.env,_clodexNetworkRaw=_clodexChildEnv[" + contractVar + "];if(_clodexNetworkRaw!==void 0){_clodexChildEnv={..._clodexChildEnv};delete _clodexChildEnv[" + contractVar + '];try{let _clodexNetwork=JSON.parse(_clodexNetworkRaw);if(_clodexNetwork&&typeof _clodexNetwork==="object"&&!Array.isArray(_clodexNetwork)&&_clodexNetwork.version===1&&_clodexNetwork.original&&typeof _clodexNetwork.original==="object"&&!Array.isArray(_clodexNetwork.original)&&_clodexNetwork.injected&&typeof _clodexNetwork.injected==="object"&&!Array.isArray(_clodexNetwork.injected)&&Object.keys(_clodexNetwork.original).every(_clodexKey=>' + networkVars + '.includes(_clodexKey)&&(typeof _clodexNetwork.original[_clodexKey]==="string"||_clodexNetwork.original[_clodexKey]===null)&&Object.prototype.hasOwnProperty.call(_clodexNetwork.injected,_clodexKey))&&Object.keys(_clodexNetwork.injected).every(_clodexKey=>' + networkVars + '.includes(_clodexKey)&&(typeof _clodexNetwork.injected[_clodexKey]==="string"||_clodexNetwork.injected[_clodexKey]===null)&&Object.prototype.hasOwnProperty.call(_clodexNetwork.original,_clodexKey)))for(let _clodexKey of ' + networkVars + '){if(Object.prototype.hasOwnProperty.call(_clodexNetwork.original,_clodexKey)&&Object.prototype.hasOwnProperty.call(_clodexNetwork.injected,_clodexKey)){let _clodexOriginal=_clodexNetwork.original[_clodexKey],_clodexInjected=_clodexNetwork.injected[_clodexKey],_clodexCurrent=_clodexChildEnv[_clodexKey]===void 0?null:_clodexChildEnv[_clodexKey];if((typeof _clodexOriginal==="string"||_clodexOriginal===null)&&(typeof _clodexInjected==="string"||_clodexInjected===null)&&_clodexCurrent===_clodexInjected){if(_clodexOriginal===null)delete _clodexChildEnv[_clodexKey];else _clodexChildEnv[_clodexKey]=_clodexOriginal}}}}catch(_clodexError){}}';
+        return head + restore + restoredBody + tail;
+      },
+      { marker, required: true }
+    );
+  }
   return { content: js, results: report };
 }
 
@@ -15889,7 +17059,7 @@ async function runLaunchPatchCheck(opts = {}) {
 }
 
 // src/cli.ts
-var STARTER_CLAUDE_FLAGS = /* @__PURE__ */ new Set(["--dry-run", "--trace", "--endpoint", "--proxy", "--save-mode", "--help", "-h", "--version", "-v"]);
+var STARTER_CLAUDE_FLAGS = /* @__PURE__ */ new Set(["--dry-run", "--trace", "--fast", "--endpoint", "--proxy", "--save-mode", "--help", "-h", "--version", "-v"]);
 var CLODEX_LAUNCH_FLAGS = /* @__PURE__ */ new Set(["--provider", "--model"]);
 function parseClodexLaunchFlag(arg, rest, index, parsed) {
   if (arg === "--provider" || arg === "--model") {
@@ -16116,6 +17286,7 @@ function parseArgs(args) {
     }
     if (arg === "--dry-run") parsed.dryRun = true;
     if (arg === "--trace") parsed.trace = true;
+    if (arg === "--fast") parsed.fast = true;
     consumeBridgeModeFlag(arg, parsed);
     if (arg === "--save-mode") parsed.saveBridgeMode = true;
     if (arg === "--help" || arg === "-h") parsed.showHelp = true;
@@ -16185,6 +17356,8 @@ ${pc13.bold("Options:")}
   --save-mode  With --endpoint/--proxy: save that mode as the claude default
   --dry-run    Run the wizard but show a preview instead of launching Claude Code
   --trace      Write debug logs to ~/.clodex/logs/ and show errors on exit
+  --fast       Request Codex fast mode (service_tier=priority) on ChatGPT-OAuth models
+               (equivalent to CLODEX_SERVICE_TIER=fast; warns if the SDK omits it)
   --provider   Boot provider id (skip wizard when paired with --model or in print mode)
   --model      Boot model id (skip wizard when paired with --provider or in print mode)
   --help       Show this command help
@@ -16365,9 +17538,9 @@ ${pc13.bold("Behavior:")}
   permissions. Local failures are reported but never block the built-ins.
   Run clodex patch again after every claude update.`;
 }
-function printHelp(text4) {
+function printHelp(text5) {
   console.log(`
-${text4}
+${text5}
 `);
 }
 function reportInactiveCatalogAliases(modelAliases) {
@@ -16765,6 +17938,7 @@ async function runClaudeHttpProxyCommand(parsed, claudeArgs, agentStdout) {
 }
 async function runClaudeCommand(parsed) {
   const { dryRun, trace, launchProvider, launchModel } = parsed;
+  if (parsed.fast) process.env.CLODEX_SERVICE_TIER = "fast";
   const claudeArgs = normalizeClaudeAgentArgs(parsed.claudeArgs);
   const agentStdout = wantsCleanAgentStdout("claude", claudeArgs);
   setAgentStdoutMode(agentStdout);
@@ -16834,7 +18008,12 @@ Error: ${launchPlan.error}
     catalogSpinner.stop("");
   }
   const allProviders = providersForTarget(providersForPicker(catalog), "claude");
+  const blockedLaunchReason = launchPlan.skip && launchPlan.target?.providerId ? catalog.blockedProviders.get(launchPlan.target.providerId) : void 0;
   if (allProviders.length === 0) {
+    if (blockedLaunchReason) {
+      p12.log.error(blockedLaunchReason);
+      return 1;
+    }
     p12.log.warn("No providers available.");
     p12.log.info(pc13.dim("Run clodex providers to get started."));
     return 0;
@@ -16854,7 +18033,7 @@ Error: ${launchPlan.error}
     const resolved = findProviderAndModel(allProviders, launchPlan.target);
     if (!resolved) {
       p12.log.error(
-        `Provider/model not found: ${launchPlan.target.providerId} / ${launchPlan.target.modelId}`
+        blockedLaunchReason ?? `Provider/model not found: ${launchPlan.target.providerId} / ${launchPlan.target.modelId}`
       );
       return 1;
     }