@dst-justin/relay 2.3.1 → 2.5.0

package/README.md

@@ -1,4 +1,4 @@
-# relay
+<p align="center"><img src="assets/banner.png" alt="relay" width="600"></p>
 
 A lightweight CLI tool for switching between multiple Claude Code accounts instantly.
 
@@ -226,6 +226,39 @@ Warmup requires the autoswitch daemon to be running (`relay autoswitch start`) t
 }
 ```
 
+## LiteLLM providers
+
+Beyond subscription accounts, relay can route Claude Code through a [LiteLLM](https://docs.litellm.ai/) proxy — useful for supplementing subscription usage with other model providers.
+
+```bash
+relay provider add mylitellm --base-url http://localhost:4000 --token sk-your-litellm-key [--model claude-sonnet-4-5] [--discover-models]
+relay provider list
+relay provider use mylitellm   # routes every future `claude` launch through it
+relay provider off             # stop routing, subscription account resumes
+relay provider remove mylitellm
+```
+
+`--discover-models` lets Claude Code's `/model` picker show every model configured in your LiteLLM proxy's `config.yaml`, switchable live mid-session.
+
+For a one-off session on a specific account or provider, without touching any global state:
+
+```bash
+relay run mylitellm -- -p "say hi"   # or any claude args
+relay run work                       # same as relay work, then claude
+```
+
+Minimal LiteLLM `config.yaml`:
+```yaml
+model_list:
+  - model_name: claude-sonnet-4-5
+    litellm_params:
+      model: openai/gpt-4o
+      api_key: os.environ/OPENAI_API_KEY
+
+general_settings:
+  master_key: sk-your-litellm-master-key
+```
+
 ## How It Works
 
 relay stores a snapshot of each account's OAuth credentials in `~/.claude-relay/credentials/`. Switching writes the target account's credentials back into the store that Claude Code reads from.
@@ -255,6 +288,15 @@ Sessions live in `~/.claude/projects/` and are shared across all accounts — af
 
 ## Changelog
 
+### v2.5.0 — 2026-08-12
+- Add `--subagent-model` to `relay provider add`, storing a `subagent_model` field that `relay provider use`/`relay run` inject as `CLAUDE_CODE_SUBAGENT_MODEL` — lets a LiteLLM provider pin the subagent model independently of the main `ANTHROPIC_MODEL`.
+- `relay provider list` now also shows `subagent_model` when set.
+- Expand `relay help` with every subcommand's flags (provider add's `--base-url`/`--token`/`--model`/`--subagent-model`/`--discover-models`, `list -f`/`--no-usage`, `run -- <args>`, `warmup test`, aliases, etc.)
+
+### v2.4.0 — 2026-07-25
+- Add LiteLLM provider support: `relay provider add/list/use/off/remove` routes Claude Code through a LiteLLM proxy instead of a subscription account, via `${CLAUDE_DIR}/settings.json`'s env block (never touches Keychain/credentials).
+- Add `relay run <name>` for a one-off session pinned to a specific account or provider, independent of any global switch.
+
 ### v2.3.1 — 2026-07-12
 - Fix: autoswitch daemon now auto-redeploys and restarts after relay itself is updated — previously the daemon file was only regenerated by `relay autoswitch start`, so an already-running daemon would silently keep running stale code (missing new features and previously-fixed bugs) until manually restarted
 - Fix: `relay reorder` no longer drops accounts omitted from the typed order — they're now appended in their prior relative order instead of being silently removed from autoswitch rotation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dst-justin/relay",
-  "version": "2.3.1",
+  "version": "2.5.0",
   "description": "Multi-account switcher for Claude Code — instant credential swap across macOS, Linux, and Windows",
   "bin": {
     "relay": "./relay.js"

package/relay

@@ -14,8 +14,12 @@ META_STORE="${RELAY_DIR}/meta"
 CURRENT_FILE="${RELAY_DIR}/current"
 ORDER_FILE="${RELAY_DIR}/order"
 UPDATE_CACHE="${RELAY_DIR}/.update_cache"
+PROVIDERS_STORE="${RELAY_DIR}/providers"
+ACTIVE_PROVIDER_FILE="${RELAY_DIR}/active_provider"
+SETTINGS_ENV_SNAPSHOT="${RELAY_DIR}/settings_env_snapshot.json"
 CLAUDE_DIR="${HOME}/.claude"
 CLAUDE_JSON="${HOME}/.claude.json"
+CLAUDE_SETTINGS="${CLAUDE_DIR}/settings.json"
 REAL_CLAUDE=$(command -v claude 2>/dev/null || echo "")
 # macOS: /usr/bin/python3 uses the system TLS stack (correct certs);
 # /usr/local/bin/python3 (Homebrew/standalone) often lacks bundled certs → SSL failures
@@ -90,8 +94,8 @@ with open(lockfile, "a") as f:
   return "${status}"
 }
 
-mkdir -p "${CREDS_STORE}" "${META_STORE}" "${CLAUDE_DIR}"
-chmod 700 "${RELAY_DIR}" "${CREDS_STORE}" 2>/dev/null || true
+mkdir -p "${CREDS_STORE}" "${META_STORE}" "${PROVIDERS_STORE}" "${CLAUDE_DIR}"
+chmod 700 "${RELAY_DIR}" "${CREDS_STORE}" "${PROVIDERS_STORE}" 2>/dev/null || true
 
 [[ -z "${PY}" ]] && { err "python3 is required"; exit 1; }
 
@@ -100,6 +104,29 @@ account_creds()  { echo "${CREDS_STORE}/$1.json"; }
 account_meta()   { echo "${META_STORE}/$1"; }
 account_exists() { [[ -f "$(account_creds "$1")" ]]; }
 
+provider_file()   { echo "${PROVIDERS_STORE}/$1.json"; }
+provider_exists() { [[ -f "$(provider_file "$1")" ]]; }
+active_provider_name() { [[ -f "${ACTIVE_PROVIDER_FILE}" ]] && cat "${ACTIVE_PROVIDER_FILE}" || echo ""; }
+
+# list providers alphabetically, one per line (bash 3.2 compatible)
+list_provider_names() {
+  local f
+  for f in "${PROVIDERS_STORE}"/*.json; do
+    [[ -f "${f}" ]] || continue
+    basename "${f}" .json
+  done | sort
+}
+
+# read one string field from a provider's JSON file; "" if absent
+_provider_field() {
+  "${PY}" -c 'import json,sys; print(json.load(open(sys.argv[1])).get(sys.argv[2],"") or "")' "$(provider_file "$1")" "$2"
+}
+
+# "1" if the provider has discover_models truthy, else ""
+_provider_discover() {
+  "${PY}" -c 'import json,sys; print("1" if json.load(open(sys.argv[1])).get("discover_models") else "")' "$(provider_file "$1")"
+}
+
 # list accounts in canonical add-order, one per line (bash 3.2 compatible).
 # Self-healing: drops names whose credential file is gone, appends any
 # credential file not yet tracked (alphabetically), and rewrites ORDER_FILE.
@@ -266,6 +293,145 @@ require_claude() {
   exit 1
 }
 
+# Fully replace the 4 managed keys with exactly the given KEY=VALUE pairs.
+# Snapshots the pre-relay original values/absences the first time this is
+# called since the last full restore (SETTINGS_ENV_SNAPSHOT doesn't exist).
+# Assumes the caller already holds the credential lock.
+_settings_env_activate_locked() {
+  RELAY_SETTINGS_PATH="${CLAUDE_SETTINGS}" \
+  RELAY_SNAPSHOT_PATH="${SETTINGS_ENV_SNAPSHOT}" \
+  RELAY_ENV_PAIRS="$(printf '%s\n' "$@")" \
+  "${PY}" <<'EOF'
+import json, os, sys, tempfile
+
+MANAGED = ["ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_MODEL", "CLAUDE_CODE_SUBAGENT_MODEL", "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY"]
+
+def load_json(p, default):
+    if not os.path.exists(p):
+        return default
+    raw = open(p).read().strip()
+    return json.loads(raw) if raw else default
+
+def atomic_write(p, data, mode=0o600):
+    d = os.path.dirname(p) or "."
+    fd, tmp = tempfile.mkstemp(dir=d, prefix=".relay-tmp-")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump(data, f, indent=2)
+            f.write("\n")
+        os.chmod(tmp, mode)
+        os.replace(tmp, p)
+    except Exception:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+path = os.environ["RELAY_SETTINGS_PATH"]
+snapshot_path = os.environ["RELAY_SNAPSHOT_PATH"]
+pairs = [p for p in os.environ.get("RELAY_ENV_PAIRS", "").split("\n") if p]
+
+try:
+    data = load_json(path, {})
+except json.JSONDecodeError as e:
+    print(f"settings.json is not valid JSON: {e}", file=sys.stderr)
+    sys.exit(1)
+if not isinstance(data, dict):
+    print("settings.json root is not a JSON object", file=sys.stderr)
+    sys.exit(1)
+
+env = data.get("env")
+if not isinstance(env, dict):
+    env = {}
+
+if not os.path.exists(snapshot_path):
+    snapshot = {k: env.get(k) for k in MANAGED}
+    atomic_write(snapshot_path, snapshot, 0o600)
+
+for k in MANAGED:
+    env.pop(k, None)
+for pair in pairs:
+    k, _, v = pair.partition("=")
+    env[k] = v
+data["env"] = env
+atomic_write(path, data, 0o600)
+EOF
+}
+_settings_env_activate() { with_credential_lock _settings_env_activate_locked "$@"; }
+
+# Restore the snapshotted values/absences for the 4 managed keys (or clear
+# them if no snapshot exists, as a defensive fallback), then delete the
+# snapshot. Assumes the caller already holds the credential lock.
+_settings_env_restore_locked() {
+  "${PY}" - "${CLAUDE_SETTINGS}" "${SETTINGS_ENV_SNAPSHOT}" <<'EOF'
+import json, os, sys, tempfile
+
+MANAGED = ["ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_MODEL", "CLAUDE_CODE_SUBAGENT_MODEL", "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY"]
+
+def load_json(p, default):
+    if not os.path.exists(p):
+        return default
+    raw = open(p).read().strip()
+    return json.loads(raw) if raw else default
+
+def atomic_write(p, data, mode=0o600):
+    d = os.path.dirname(p) or "."
+    fd, tmp = tempfile.mkstemp(dir=d, prefix=".relay-tmp-")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump(data, f, indent=2)
+            f.write("\n")
+        os.chmod(tmp, mode)
+        os.replace(tmp, p)
+    except Exception:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+path, snapshot_path = sys.argv[1], sys.argv[2]
+
+try:
+    data = load_json(path, {})
+except json.JSONDecodeError as e:
+    print(f"settings.json is not valid JSON: {e}", file=sys.stderr)
+    sys.exit(1)
+if not isinstance(data, dict):
+    print("settings.json root is not a JSON object", file=sys.stderr)
+    sys.exit(1)
+
+env = data.get("env")
+if not isinstance(env, dict):
+    env = {}
+
+changed = False
+if os.path.exists(snapshot_path):
+    snapshot = load_json(snapshot_path, {})
+    for k in MANAGED:
+        v = snapshot.get(k)
+        if v is None:
+            changed = env.pop(k, None) is not None or changed
+        else:
+            changed = env.get(k) != v or changed
+            env[k] = v
+else:
+    for k in MANAGED:
+        if k in env:
+            del env[k]
+            changed = True
+
+if changed:
+    data["env"] = env
+    atomic_write(path, data, 0o600)
+
+if os.path.exists(snapshot_path):
+    os.unlink(snapshot_path)
+EOF
+}
+_settings_env_restore() { with_credential_lock _settings_env_restore_locked; }
+
 # ══════════════════════════════════════════════════════════════════
 # Python core: parallel usage fetch + table rendering
 # args: <mode: quick|full> <creds_dir> <meta_dir> <current_name> [--no-usage]
@@ -521,6 +687,11 @@ _do_switch_locked() {
   local name="$1"
   local current; current=$(current_name)
 
+  if [[ -n "$(active_provider_name)" ]]; then
+    _settings_env_restore_locked
+    rm -f "${ACTIVE_PROVIDER_FILE}"
+  fi
+
   if [[ "${current}" == "${name}" ]]; then
     ok "Already on account '${B}${name}${R}'"
     return 0
@@ -560,8 +731,16 @@ _sync_current_creds() {
   [[ -n "${live}" ]] && printf '%s' "${live}" > "$(account_creds "${cur}")"
 }
 
+_provider_banner() {
+  local active; active=$(active_provider_name)
+  [[ -z "${active}" ]] && return 0
+  local base_url; base_url=$(_provider_field "${active}" base_url)
+  printf "\n  ${YL}⚡ litellm:${R} ${B}%s${R} ${D}(%s)${R}\n" "${active}" "${base_url}"
+}
+
 cmd_quick() {
   _check_update_bg
+  _provider_banner
   _sync_current_creds
   render_table quick "${CREDS_STORE}" "${META_STORE}" "$(current_name)" "$@"
   _show_update_notice
@@ -607,6 +786,7 @@ cmd_list() {
 }
 
 _cmd_status_once() {
+  _provider_banner
   _sync_current_creds
   local current; current=$(current_name)
   hdr "Current Status"
@@ -784,12 +964,217 @@ PYEOF
   fi
 }
 
+cmd_provider_add() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay provider add <name> --base-url <url> --token <token> [--model <model>] [--subagent-model <model>] [--discover-models]"; exit 1; }
+  shift
+  case "${name}" in
+    *[!a-zA-Z0-9_-]*) err "name must contain only letters, numbers, underscores, or hyphens"; exit 1 ;;
+  esac
+  if account_exists "${name}"; then
+    err "'${name}' is already an account — pick a different provider name"
+    exit 1
+  fi
+  if provider_exists "${name}"; then
+    warn "Provider '${name}' already exists"
+    log "To change it: relay provider remove ${name} && relay provider add ${name} ..."
+    return 0
+  fi
+
+  local base_url="" token="" model="" subagent_model="" discover=0
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --base-url) base_url="${2:-}"; shift 2 ;;
+      --token) token="${2:-}"; shift 2 ;;
+      --model) model="${2:-}"; shift 2 ;;
+      --subagent-model) subagent_model="${2:-}"; shift 2 ;;
+      --discover-models) discover=1; shift ;;
+      *) err "unknown option: $1"; exit 1 ;;
+    esac
+  done
+
+  [[ -z "${base_url}" ]] && { err "--base-url is required"; exit 1; }
+  [[ -z "${token}" ]] && { err "--token is required"; exit 1; }
+  case "${base_url}" in
+    http://*|https://*) ;;
+    *) err "--base-url must start with http:// or https://"; exit 1 ;;
+  esac
+
+  RELAY_PROVIDER_PATH="$(provider_file "${name}")" \
+  RELAY_PROVIDER_BASE_URL="${base_url}" \
+  RELAY_PROVIDER_TOKEN="${token}" \
+  RELAY_PROVIDER_MODEL="${model}" \
+  RELAY_PROVIDER_SUBAGENT_MODEL="${subagent_model}" \
+  RELAY_PROVIDER_DISCOVER="${discover}" \
+  "${PY}" -c '
+import json, os
+path = os.environ["RELAY_PROVIDER_PATH"]
+base_url = os.environ["RELAY_PROVIDER_BASE_URL"]
+token = os.environ["RELAY_PROVIDER_TOKEN"]
+model = os.environ.get("RELAY_PROVIDER_MODEL", "")
+subagent_model = os.environ.get("RELAY_PROVIDER_SUBAGENT_MODEL", "")
+discover = os.environ.get("RELAY_PROVIDER_DISCOVER", "")
+d = {"base_url": base_url, "auth_token": token}
+if model:
+    d["model"] = model
+if subagent_model:
+    d["subagent_model"] = subagent_model
+if discover == "1":
+    d["discover_models"] = True
+with open(path, "w") as f:
+    json.dump(d, f)
+os.chmod(path, 0o600)
+'
+
+  ok "Provider '${B}${name}${R}' added  ${D}${base_url}${R}"
+}
+
+cmd_provider_list() {
+  hdr "LiteLLM providers"
+  local names; names=$(list_provider_names)
+  if [[ -z "${names}" ]]; then
+    warn "No providers configured — add one with: relay provider add <name> --base-url <url> --token <token>"
+    return 0
+  fi
+  local active; active=$(active_provider_name)
+  local name base_url model subagent_model info
+  while IFS= read -r name; do
+    [[ -z "${name}" ]] && continue
+    base_url=$(_provider_field "${name}" base_url)
+    model=$(_provider_field "${name}" model)
+    subagent_model=$(_provider_field "${name}" subagent_model)
+    info="${base_url}"
+    [[ -n "${model}" ]] && info="${info}  model=${model}"
+    [[ -n "${subagent_model}" ]] && info="${info}  subagent_model=${subagent_model}"
+    if [[ "${name}" == "${active}" ]]; then
+      printf "  ${GR}${B}✓ %-16s${R} ${D}%s${R}\n" "${name}" "${info}"
+    else
+      printf "    %-16s ${D}%s${R}\n" "${name}" "${info}"
+    fi
+  done <<< "${names}"
+}
+
+cmd_provider_use() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay provider use <name>"; exit 1; }
+  provider_exists "${name}" || { err "Provider '${name}' not found"; exit 1; }
+
+  local base_url token model subagent_model discover
+  base_url=$(_provider_field "${name}" base_url)
+  token=$(_provider_field "${name}" auth_token)
+  model=$(_provider_field "${name}" model)
+  subagent_model=$(_provider_field "${name}" subagent_model)
+  discover=$(_provider_discover "${name}")
+
+  local pairs=("ANTHROPIC_BASE_URL=${base_url}" "ANTHROPIC_AUTH_TOKEN=${token}")
+  [[ -n "${model}" ]] && pairs+=("ANTHROPIC_MODEL=${model}")
+  [[ -n "${subagent_model}" ]] && pairs+=("CLAUDE_CODE_SUBAGENT_MODEL=${subagent_model}")
+  [[ -n "${discover}" ]] && pairs+=("CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1")
+
+  _settings_env_activate "${pairs[@]}" || { err "Failed to update ${CLAUDE_SETTINGS}"; exit 1; }
+  printf '%s' "${name}" > "${ACTIVE_PROVIDER_FILE}"
+
+  printf "\n  ${GR}${B}⚡ provider active → %s${R}  ${D}%s${R}\n" "${name}" "${base_url}"
+  printf "  ${D}Active sessions pick up the switch on next message. New session: ${CY}claude -c${R}\n\n"
+}
+
+cmd_provider_off() {
+  local active; active=$(active_provider_name)
+  if [[ -z "${active}" ]]; then
+    warn "No provider is currently active"
+    return 0
+  fi
+  _settings_env_restore || { err "Failed to update ${CLAUDE_SETTINGS}"; exit 1; }
+  rm -f "${ACTIVE_PROVIDER_FILE}"
+  ok "Provider mode off — subscription account resumes"
+}
+
+cmd_provider_remove() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay provider remove <name>"; exit 1; }
+  provider_exists "${name}" || { err "Provider '${name}' not found"; exit 1; }
+  printf "\n  ${YL}Delete provider '${B}${name}${R}${YL}'? (y/N) ${R}"
+  read -r c
+  [[ "${c}" = "y" || "${c}" = "Y" ]] || { log "cancelled"; return 0; }
+  if [[ "$(active_provider_name)" == "${name}" ]]; then
+    cmd_provider_off
+  fi
+  rm -f "$(provider_file "${name}")"
+  ok "Deleted provider '${name}'"
+}
+
+cmd_run() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay run <name> [-- <claude args...>]"; exit 1; }
+  shift
+  [[ "${1:-}" == "--" ]] && shift
+
+  require_claude
+
+  if account_exists "${name}"; then
+    do_switch "${name}"
+    exec "${REAL_CLAUDE}" "$@"
+  elif provider_exists "${name}"; then
+    local base_url token model subagent_model discover settings_file
+    base_url=$(_provider_field "${name}" base_url)
+    token=$(_provider_field "${name}" auth_token)
+    model=$(_provider_field "${name}" model)
+    subagent_model=$(_provider_field "${name}" subagent_model)
+    discover=$(_provider_discover "${name}")
+
+    # Opportunistic cleanup: a prior `relay run <provider>` can't clean up
+    # after itself (exec replaces the process, so no trap ever fires) —
+    # sweep anything old enough that the session which created it has
+    # almost certainly ended, so these don't accumulate indefinitely.
+    find "${RELAY_DIR}" -maxdepth 1 -name '.run-settings.*' -mtime +1 -delete 2>/dev/null || true
+
+    # Written to a chmod-600 file under RELAY_DIR (mktemp's default file
+    # mode is already 0600) rather than passed inline via `claude`'s own
+    # argv — the exec'd claude process's cmdline would otherwise expose
+    # this provider's auth token to any local user via `ps`/`ps aux` for
+    # the entire session lifetime.
+    settings_file=$(mktemp "${RELAY_DIR}/.run-settings.XXXXXX")
+    RELAY_RUN_BASE_URL="${base_url}" \
+    RELAY_RUN_TOKEN="${token}" \
+    RELAY_RUN_MODEL="${model}" \
+    RELAY_RUN_SUBAGENT_MODEL="${subagent_model}" \
+    RELAY_RUN_DISCOVER="${discover}" \
+    RELAY_RUN_SETTINGS_FILE="${settings_file}" \
+    "${PY}" -c '
+import json, os
+base_url = os.environ["RELAY_RUN_BASE_URL"]
+token = os.environ["RELAY_RUN_TOKEN"]
+model = os.environ.get("RELAY_RUN_MODEL", "")
+subagent_model = os.environ.get("RELAY_RUN_SUBAGENT_MODEL", "")
+discover = os.environ.get("RELAY_RUN_DISCOVER", "")
+env = {"ANTHROPIC_BASE_URL": base_url, "ANTHROPIC_AUTH_TOKEN": token}
+if model:
+    env["ANTHROPIC_MODEL"] = model
+if subagent_model:
+    env["CLAUDE_CODE_SUBAGENT_MODEL"] = subagent_model
+if discover == "1":
+    env["CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY"] = "1"
+with open(os.environ["RELAY_RUN_SETTINGS_FILE"], "w") as f:
+    json.dump({"env": env}, f)
+'
+
+    exec "${REAL_CLAUDE}" --settings "${settings_file}" "$@"
+  else
+    err "Unknown account or provider: ${name}"
+    exit 1
+  fi
+}
+
 cmd_add() {
   local name="${1:-}"
   [[ -z "${name}" ]] && { err "usage: relay add <name>"; exit 1; }
   case "${name}" in
     *[!a-zA-Z0-9_-]*) err "name must contain only letters, numbers, underscores, or hyphens"; exit 1 ;;
   esac
+  if provider_exists "${name}"; then
+    err "'${name}' is already a LiteLLM provider — pick a different account name"
+    exit 1
+  fi
   require_claude
   if account_exists "${name}"; then
     warn "Account '${name}' already exists"
@@ -2352,44 +2737,91 @@ cmd_uninstall() {
 
 cmd_help() {
   printf "\n${B}${CY}  relay${R} ${D}%s — multi-account switcher for Claude Code${R}\n\n" "$(_read_version)"
+
   printf "  ${B}Inside Claude Code (prefix with !)${R}\n"
-  printf "  %-32s %s\n" "  !relay"           "account menu + 5hr usage"
-  printf "  %-32s %s\n" "  !relay 2"         "switch to account #2"
-  printf "  %-32s %s\n" "  !relay work"      "switch to named account"
-  printf "  %-32s %s\n" "  !relay status"    "detailed usage for current account"
+  printf "  %-42s %s\n" "  !relay"           "account menu + 5hr usage"
+  printf "  %-42s %s\n" "  !relay 2"         "switch to account #2 (by index shown in the menu)"
+  printf "  %-42s %s\n" "  !relay work"      "switch to account named 'work'"
+  printf "  %-42s %s\n" "  !relay status"    "detailed usage for current account"
   echo ""
+
   printf "  ${B}Account management${R}\n"
-  printf "  %-32s %s\n" "  relay add <name>"         "add account via browser login"
-  printf "  %-32s %s\n" "  relay add-force <name>"   "force re-login for existing account"
-  printf "  %-32s %s\n" "  relay refresh <name>"     "re-login to refresh an expired token"
-  printf "  %-32s %s\n" "  relay refresh-all"        "silent OAuth refresh for all accounts"
-  printf "  %-32s %s\n" "  relay save <name>"        "save current login state"
-  printf "  %-32s %s\n" "  relay rename <old> <new>" "rename an account"
-  printf "  %-32s %s\n" "  relay reorder"            "change account display/switch order"
-  printf "  %-32s %s\n" "  relay list"               "full list with weekly usage"
-  printf "  %-32s %s\n" "  relay list -f"            "live-refresh mode (Ctrl+C to exit)"
-  printf "  %-32s %s\n" "  relay list --no-usage"    "list without querying API"
-  printf "  %-32s %s\n" "  relay status -f"          "live-refresh current account status"
-  printf "  %-32s %s\n" "  relay remove <name>"      "delete an account"
-  printf "  %-32s %s\n" "  relay sessions"           "show all sessions"
-  printf "  %-32s %s\n" "  relay version"             "show current version"
-  printf "  %-32s %s\n" "  relay update"              "update to latest version"
-  printf "  %-32s %s\n" "  relay uninstall"          "remove relay and all account data"
+  printf "  %-42s %s\n" "  relay add <name>"         "add account via browser login (opens claude /login)"
+  printf "  %-42s %s\n" "  relay add-force <name>"   "wipe stored creds/meta first, then force re-login"
+  printf "  %-42s %s\n" "  relay refresh <name>"     "re-login to refresh an expired/expiring token"
+  printf "  %-42s %s\n" "  relay refresh-all"        "silent OAuth refresh for every stored account"
+  printf "  %-42s %s\n" "  relay save <name>"        "save whatever is currently logged in as <name>"
+  printf "  %-42s %s\n" "  relay rename <old> <new>" "rename an account (updates order + current pointer)"
+  printf "  %-42s %s\n" "  relay remove <name>"      "delete an account (alias: rm, del)"
+  printf "  %-42s %s\n" "  relay reorder"            "interactively change account display/switch order"
+  printf "  %-42s %s\n" "  relay switch <name|#>"    "switch account by name or index (alias: sw, use)"
+  printf "  %-42s %s\n" "  relay <name>"             "bare name/index also switches (shortcut for switch)"
+  printf "  %-42s %s\n" "  relay continue [name]"    "optionally switch, then exec 'claude --continue' (alias: cont, c)"
   echo ""
-  printf "  ${B}Autoswitch${R}\n"
-  printf "  %-32s %s\n" "  relay autoswitch config"   "set up auto-switching"
-  printf "  %-32s %s\n" "  relay autoswitch start/stop" "manage background daemon"
-  printf "  %-32s %s\n" "  relay autoswitch status"   "daemon state + thresholds"
+
+  printf "  ${B}Listing & status${R}\n"
+  printf "  %-42s %s\n" "  relay list"               "full account list with weekly usage (alias: ls)"
+  printf "  %-42s %s\n" "    -f, --follow"           "live-refresh mode, redraws every 30s (Ctrl+C to exit)"
+  printf "  %-42s %s\n" "    --no-usage"             "list without querying the usage API (fast, offline)"
+  printf "  %-42s %s\n" "  relay status"             "detailed usage for the current account (alias: st)"
+  printf "  %-42s %s\n" "    -f"                     "live-refresh current account status"
+  printf "  %-42s %s\n" "  relay sessions"           "show all local Claude sessions (alias: sess)"
+  echo ""
+
+  printf "  ${B}One-off runs${R}\n"
+  printf "  %-42s %s\n" "  relay run <name>"           "one-off session on an account or provider, then exec claude"
+  printf "  %-42s %s\n" "  relay run <name> -- <args>" "forward extra args to claude itself, e.g. -- --resume"
+  printf "  %-42s %s\n" "    (leaves global switch/provider state untouched — safe for concurrent sessions)"
+  echo ""
+
+  printf "  ${B}LiteLLM providers${R}\n"
+  printf "  %-42s %s\n" "  relay provider add <name>"  "add a LiteLLM-compatible provider (alias: prov)"
+  printf "  %-42s %s\n" "    --base-url <url>"         "required: http(s):// base URL of the gateway"
+  printf "  %-42s %s\n" "    --token <token>"          "required: auth token/API key for the gateway"
+  printf "  %-42s %s\n" "    --model <model>"          "optional: pin ANTHROPIC_MODEL to this alias"
+  printf "  %-42s %s\n" "    --subagent-model <model>" "optional: pin CLAUDE_CODE_SUBAGENT_MODEL"
+  printf "  %-42s %s\n" "                              " "(overrides every subagent's own model: frontmatter)"
+  printf "  %-42s %s\n" "    --discover-models"        "optional: enable gateway model discovery instead of pinning"
+  printf "  %-42s %s\n" "  relay provider list"         "list configured providers + their settings"
+  printf "  %-42s %s\n" "  relay provider use <name>"   "route all future sessions through this provider"
+  printf "  %-42s %s\n" "  relay provider off"          "stop routing through a provider, resume subscription account"
+  printf "  %-42s %s\n" "  relay provider remove <name>" "delete a provider (prompts for confirmation)"
+  echo ""
+
+  printf "  ${B}Autoswitch daemon${R}\n"
+  printf "  %-42s %s\n" "  relay autoswitch config"     "interactive setup: order, thresholds, poll interval (alias: as)"
+  printf "  %-42s %s\n" "  relay autoswitch start"      "install + start the background launchd/systemd daemon"
+  printf "  %-42s %s\n" "  relay autoswitch stop"       "stop and uninstall the background daemon"
+  printf "  %-42s %s\n" "  relay autoswitch status"     "daemon running state + per-account thresholds"
+  printf "  %-42s %s\n" "  relay autoswitch log"        "tail the daemon's log file"
+  printf "  %-42s %s\n" "  relay autoswitch"             "no subcommand: config if unset, else status"
   echo ""
+
+  printf "  ${B}Locking (autoswitch)${R}\n"
+  printf "  %-42s %s\n" "  relay lock <name>"        "exclude an account from autoswitch cycling when over limit"
+  printf "  %-42s %s\n" "  relay unlock <name>"      "remove a lock"
+  printf "  %-42s %s\n" "  relay lock"               "no argument: show all locked accounts"
+  echo ""
+
   printf "  ${B}Warmup${R}\n"
-  printf "  %-32s %s\n" "  relay warmup add <acct> <HH:MM>" "pre-warm an account's 5hr window daily"
-  printf "  %-32s %s\n" "  relay warmup remove <acct> [HH:MM]" "remove a warmup schedule"
-  printf "  %-32s %s\n" "  relay warmup list"         "show scheduled warmups + last result"
-  printf "  %-32s %s\n" "  relay warmup pause/resume" "suspend/re-enable without deleting"
-  printf "  %-32s %s\n" "  relay lock <name>"         "prevent account from cycling back when over limit"
-  printf "  %-32s %s\n" "  relay unlock <name>"       "remove lock"
-  printf "  %-32s %s\n" "  relay lock"                "show locked accounts"
+  printf "  %-42s %s\n" "  relay warmup add <acct> <HH:MM>"    "schedule a daily pre-warm ping (24h local time)"
+  printf "  %-42s %s\n" "  relay warmup remove <acct> [HH:MM]" "remove one scheduled time, or all for <acct> if omitted (alias: rm)"
+  printf "  %-42s %s\n" "  relay warmup list"                  "show scheduled warmups + last-run result (alias: ls)"
+  printf "  %-42s %s\n" "  relay warmup test <acct>"           "fire a warmup ping for <acct> right now, synchronously"
+  printf "  %-42s %s\n" "  relay warmup pause"                 "suspend all warmups without deleting entries"
+  printf "  %-42s %s\n" "  relay warmup resume"                "re-enable previously paused warmups"
+  printf "  %-42s %s\n" "  relay warmup"                       "no subcommand: same as 'relay warmup list'"
+  printf "  %-42s %s\n" "    requires the autoswitch daemon running (relay autoswitch start) to actually fire"
   echo ""
+
+  printf "  ${B}Maintenance${R}\n"
+  printf "  %-42s %s\n" "  relay version"    "show current version (alias: --version, -V)"
+  printf "  %-42s %s\n" "  relay update"     "update relay to latest version"
+  printf "  %-42s %s\n" "  relay install"    "(re)install shell integration / launcher"
+  printf "  %-42s %s\n" "  relay uninstall"  "remove relay and all account data"
+  printf "  %-42s %s\n" "  relay help"       "show this help (alias: --help, -h)"
+  echo ""
+
   printf "  ${D}switches the OAuth credential (macOS Keychain / Linux ~/.claude/.credentials.json); sessions are shared${R}\n"
   printf "  ${D}after switching: claude -c to resume, claude --resume <id> for a specific session${R}\n\n"
   _check_update_bg
@@ -2427,6 +2859,18 @@ case "${CMD}" in
   remove|rm|del)    cmd_remove "$@" ;;
   rename|mv)        cmd_rename "$@" ;;
   reorder)          cmd_reorder "$@" ;;
+  provider|prov)
+    sub="${1:-}"
+    [[ -n "${1:-}" ]] && shift
+    case "${sub}" in
+      add)    cmd_provider_add "$@" ;;
+      list|ls) cmd_provider_list ;;
+      use)    cmd_provider_use "$@" ;;
+      off)    cmd_provider_off ;;
+      remove|rm) cmd_provider_remove "$@" ;;
+      *) err "usage: relay provider <add|list|use|off|remove> ..."; exit 1 ;;
+    esac ;;
+  run)              cmd_run "$@" ;;
   sessions|sess)    cmd_sessions ;;
   autoswitch|as)    cmd_autoswitch "$@" ;;
   lock)             cmd_lock "$@" ;;