@jacobbd/relay-ai 0.2.7 → 0.2.8

package/dist/cli.js

@@ -31,6 +31,94 @@ import { wrapLanguageModel, extractReasoningMiddleware } from "ai";
 // src/constants.ts
 import { homedir } from "os";
 import { join } from "path";
+
+// package.json
+var package_default = {
+  name: "@jacobbd/relay-ai",
+  version: "0.2.8",
+  publishConfig: {
+    access: "public"
+  },
+  description: "Relay any model into any coding agent \u2014 launch Claude Code, Codex, and more with multi-provider gateways",
+  author: "jacob-bd",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/jacob-bd/relay-ai.git"
+  },
+  homepage: "https://github.com/jacob-bd/relay-ai#readme",
+  keywords: [
+    "claude",
+    "claude-code",
+    "codex",
+    "ai",
+    "llm",
+    "cli",
+    "gateway",
+    "relay",
+    "vertex"
+  ],
+  type: "module",
+  bin: {
+    "relay-ai": "dist/cli.js"
+  },
+  engines: {
+    node: ">=18"
+  },
+  scripts: {
+    build: "tsup",
+    dev: "tsup --watch",
+    test: "vitest run",
+    "test:watch": "vitest",
+    typecheck: "tsc --noEmit",
+    "refresh:models-dev": "node scripts/refresh-models-dev-cache.mjs",
+    prepublishOnly: `node -e "if (require('./package.json').version !== require('./package-lock.json').version) { console.error('Error: package.json and package-lock.json versions are out of sync! Run npm install to sync.'); process.exit(1); }" && npm run build`
+  },
+  dependencies: {
+    "@ai-sdk/alibaba": "^1.0.26",
+    "@ai-sdk/amazon-bedrock": "^4.0.113",
+    "@ai-sdk/azure": "^3.0.70",
+    "@ai-sdk/cerebras": "^2.0.54",
+    "@ai-sdk/cohere": "^3.0.36",
+    "@ai-sdk/deepinfra": "^2.0.52",
+    "@ai-sdk/gateway": "^3.0.125",
+    "@ai-sdk/google": "^3.0.80",
+    "@ai-sdk/google-vertex": "^4.0.142",
+    "@ai-sdk/groq": "^3.0.39",
+    "@ai-sdk/mistral": "^3.0.37",
+    "@ai-sdk/openai": "^3.0.68",
+    "@ai-sdk/openai-compatible": "^2.0.48",
+    "@ai-sdk/perplexity": "^3.0.33",
+    "@ai-sdk/togetherai": "^2.0.53",
+    "@ai-sdk/vercel": "^2.0.50",
+    "@ai-sdk/xai": "^3.0.93",
+    "@clack/prompts": "^0.9.1",
+    "@openrouter/ai-sdk-provider": "^2.9.0",
+    ai: "^6.0.197",
+    "gitlab-ai-provider": "^6.8.0",
+    "ipaddr.js": "^2.4.0",
+    open: "^11.0.0",
+    picocolors: "^1.1.1",
+    "smol-toml": "^1.6.1",
+    "venice-ai-sdk-provider": "^2.0.2",
+    zod: "^3.25.76"
+  },
+  devDependencies: {
+    "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^2.1.9",
+    tsup: "^8.0.0",
+    typescript: "^5.5.0",
+    vitest: "^2.0.0"
+  },
+  optionalDependencies: {
+    "@napi-rs/keyring": "^1.3.0"
+  },
+  overrides: {
+    ws: "^8.21.0"
+  }
+};
+
+// src/constants.ts
 var BACKENDS = {
   zen: {
     id: "zen",
@@ -76,7 +164,7 @@ function classifyModelFormat(modelId, providerNpm) {
   if (lower.startsWith("gemini-")) return "unsupported";
   return "openai";
 }
-var VERSION = "0.2.7";
+var VERSION = package_default.version;
 
 // src/oauth/pkce.ts
 function positiveSecondsToMs(value, defaultMs) {
@@ -889,6 +977,7 @@ function providerTagColor(providerId) {
     case "openai":
       return pc.white;
     case "xai":
+    case "xai-oauth":
       return pc.white;
     case "groq":
       return pc.red;
@@ -1050,6 +1139,20 @@ function findClaudeBinary() {
   }
   return null;
 }
+function getInstalledClaudeVersion() {
+  try {
+    const claudePath = findClaudeBinary();
+    if (!claudePath) return "2.1.183";
+    const result = execSync(`${isWindows ? `"${claudePath}"` : claudePath} --version`, {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const match = result.match(/(\d+\.\d+\.\d+)/);
+    if (match) return match[1];
+  } catch {
+  }
+  return "2.1.183";
+}
 function buildClaudeArgs(model, extraArgs) {
   return ["--model", model, ...extraArgs];
 }
@@ -1334,7 +1437,7 @@ function accessTokenIsExpiring(token, skewMs = OAUTH_REFRESH_SKEW_MS) {
     return false;
   }
 }
-var NATIVE_OAUTH_PROVIDER_IDS = ["xai", "openai", "github-copilot"];
+var NATIVE_OAUTH_PROVIDER_IDS = ["xai", "xai-oauth", "openai", "openai-oauth", "github-copilot"];
 function supportsNativeOAuth(providerId) {
   return NATIVE_OAUTH_PROVIDER_IDS.includes(providerId);
 }
@@ -1554,8 +1657,7 @@ async function runXaiDeviceCodeFlow(onDeviceCode, opts) {
 // src/oauth/refresh.ts
 function oauthCredentialShouldRefresh(cred, providerId) {
   if (oauthCredentialNeedsRefresh(cred)) return true;
-  if (providerId === "xai" && accessTokenIsExpiring(cred.access)) return true;
-  if (providerId === "github-copilot" && accessTokenIsExpiring(cred.access)) return true;
+  if (NATIVE_OAUTH_PROVIDER_IDS.includes(providerId) && accessTokenIsExpiring(cred.access)) return true;
   return false;
 }
 async function refreshStoredOAuthCredential(providerId, cred) {
@@ -1563,9 +1665,9 @@ async function refreshStoredOAuthCredential(providerId, cred) {
     throw new Error(`${providerId}: OAuth refresh token missing \u2014 run relay-ai providers auth ${providerId}`);
   }
   let tokens;
-  if (providerId === "openai") {
+  if (providerId === "openai" || providerId === "openai-oauth") {
     tokens = await refreshOpenAiAccessToken(cred.refresh);
-  } else if (providerId === "xai") {
+  } else if (providerId === "xai" || providerId === "xai-oauth") {
     tokens = await refreshXaiAccessToken(cred.refresh);
   } else if (providerId === "github-copilot") {
     tokens = await refreshGithubCopilotToken(cred.refresh);
@@ -2459,6 +2561,36 @@ function migrateLegacyCloudProviders(registry) {
   }
   return changed;
 }
+function migrateOAuthOpenAiProvider(registry) {
+  if (registry.providers.some((p19) => p19.id === "openai-oauth")) return false;
+  const idx = registry.providers.findIndex(
+    (p19) => p19.id === "openai" && p19.authType === "oauth"
+  );
+  if (idx < 0) return false;
+  const existing = registry.providers[idx];
+  registry.providers[idx] = {
+    ...existing,
+    id: "openai-oauth",
+    templateId: existing.templateId || "openai",
+    name: existing.name === "OpenAI" ? "OpenAI (ChatGPT)" : existing.name
+  };
+  return true;
+}
+function migrateOAuthXaiProvider(registry) {
+  if (registry.providers.some((p19) => p19.id === "xai-oauth")) return false;
+  const idx = registry.providers.findIndex(
+    (p19) => p19.id === "xai" && p19.authType === "oauth"
+  );
+  if (idx < 0) return false;
+  const existing = registry.providers[idx];
+  registry.providers[idx] = {
+    ...existing,
+    id: "xai-oauth",
+    templateId: existing.templateId || "xai",
+    name: existing.name === "xAI" ? "xAI Grok (SuperGrok)" : existing.name
+  };
+  return true;
+}
 
 // src/registry/validate.ts
 var PROVIDER_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
@@ -2566,7 +2698,10 @@ function loadRegistry(path = getProvidersPath()) {
   try {
     const raw = JSON.parse(readFileSync3(path, "utf8"));
     const registry = parseRegistry(raw);
-    if (migrateLegacyCloudProviders(registry)) {
+    let migrated = migrateLegacyCloudProviders(registry);
+    if (migrateOAuthOpenAiProvider(registry)) migrated = true;
+    if (migrateOAuthXaiProvider(registry)) migrated = true;
+    if (migrated) {
       try {
         saveRegistry(registry, path);
       } catch {
@@ -2603,6 +2738,7 @@ var TEMPLATE_TO_PRICING_PLATFORM = {
   cerebras: "cerebras",
   deepinfra: "deepinfra",
   xai: "xai",
+  "xai-oauth": "xai",
   perplexity: "perplexity",
   cohere: "cohere",
   openai: "openai",
@@ -2782,6 +2918,7 @@ var REGISTRY_TO_MODELS_DEV = {
   cerebras: "cerebras",
   deepinfra: "deepinfra",
   xai: "xai",
+  "xai-oauth": "xai",
   perplexity: "perplexity",
   cohere: "cohere",
   alibaba: "alibaba",
@@ -3307,6 +3444,11 @@ async function resolveRefreshCredential(provider, resolveKey) {
 function oauthAuthRef(providerId) {
   return `keyring:oauth:provider:${providerId}`;
 }
+function toOAuthRegistryId(id) {
+  if (id === "openai") return "openai-oauth";
+  if (id === "xai") return "xai-oauth";
+  return id;
+}
 function normalizeImportProviderIdentity(provider) {
   if (provider.id === "opencode") {
     return { ...provider, id: "zen", name: "OpenCode Zen" };
@@ -3336,8 +3478,10 @@ function buildImportProviderList(raw, authEntries) {
       { includeOAuthPlaceholders: true }
     );
     if (oauthProviders.length === 0) continue;
-    oauthByProviderId.set(provider.id, authEntry);
-    merged.push({ ...oauthProviders[0], apiKey: "" });
+    const registryId = toOAuthRegistryId(provider.id);
+    oauthByProviderId.set(registryId, authEntry);
+    merged.push({ ...oauthProviders[0], id: registryId, apiKey: "" });
+    covered.add(registryId);
     covered.add(provider.id);
   }
   return { providers: merged, oauth: { oauthByProviderId } };
@@ -4772,13 +4916,13 @@ function upstreamModelId(model) {
   const id = model.upstreamModelId ?? model.id;
   return id.replace(/\[1m\]$/i, "");
 }
-function isOpenAIChatCompletionsModel(model) {
+function supportsDirectOpenAIChatCompletions(model) {
   return model.modelFormat === "openai" && (!!model.completionsUrl || model.sourceBackend === "zen" || model.sourceBackend === "go");
 }
 function formatOpenAIModels(models) {
   return {
     object: "list",
-    data: models.filter(isOpenAIChatCompletionsModel).map((model) => ({
+    data: models.map((model) => ({
       id: model.id,
       object: "model",
       created: CREATED_AT_UNIX,
@@ -4893,6 +5037,9 @@ async function relayAnthropicMessages(res, messagesUrl, body, apiKey, clientWant
   res.end(text5);
 }
 
+// src/proxy.ts
+import { randomUUID } from "crypto";
+
 // src/sdk-adapter.ts
 import { streamText, generateText, tool, jsonSchema } from "ai";
 
@@ -4957,9 +5104,9 @@ function serializeToolResultContent(content) {
 
 // src/tool-search.ts
 var TOOL_SEARCH_TYPE_PREFIX = "tool_search_tool";
-function isToolSearchTool(tool3) {
-  if (typeof tool3.type === "string" && tool3.type.startsWith(TOOL_SEARCH_TYPE_PREFIX)) return true;
-  const name = tool3.name ?? "";
+function isToolSearchTool(tool4) {
+  if (typeof tool4.type === "string" && tool4.type.startsWith(TOOL_SEARCH_TYPE_PREFIX)) return true;
+  const name = tool4.name ?? "";
   return name.includes("tool_search") || name === "ToolSearch";
 }
 function extractReferencedToolNames(messages) {
@@ -4998,16 +5145,16 @@ function resolveUpstreamTools(tools, messages) {
   if (!tools?.length) return [];
   const referenced = extractReferencedToolNames(messages);
   const upstream = [];
-  for (const tool3 of tools) {
-    if (isToolSearchTool(tool3)) {
-      upstream.push(tool3);
+  for (const tool4 of tools) {
+    if (isToolSearchTool(tool4)) {
+      upstream.push(tool4);
       continue;
     }
-    if (tool3.defer_loading === true) {
-      if (referenced.has(tool3.name)) upstream.push(tool3);
+    if (tool4.defer_loading === true) {
+      if (referenced.has(tool4.name)) upstream.push(tool4);
       continue;
     }
-    upstream.push(tool3);
+    upstream.push(tool4);
   }
   return upstream;
 }
@@ -5149,13 +5296,15 @@ function translateRequest(body, npm, options) {
     messages
   );
   const effort = anthropicEffortFromRequest(body) ?? options?.defaultEffort;
-  const providerOptions = deepMergeProviderOptions(
-    deepMergeProviderOptions(
-      thinkingProviderOptions(npm),
-      effortProviderOptions(npm, effort, body.model, options?.reasoningMetadata)
-    ),
-    options?.openAiOAuth && systemText ? { openai: { instructions: systemText } } : void 0
+  let providerOptions = deepMergeProviderOptions(
+    thinkingProviderOptions(npm),
+    effortProviderOptions(npm, effort, body.model, options?.reasoningMetadata)
   );
+  if (options?.openAiOAuth && systemText) {
+    providerOptions = deepMergeProviderOptions(providerOptions, {
+      openai: { instructions: systemText }
+    });
+  }
   return {
     system: options?.openAiOAuth ? void 0 : systemText,
     messages: translateMessages(messages, npm),
@@ -5395,6 +5544,7 @@ function lookupRoute(byAlias, id) {
   return void 0;
 }
 function startProxyCatalog(routes, defaultAliasId, debug = false) {
+  const proxyToken = randomUUID();
   silenceSdkWarnings();
   if (routes.length === 0) {
     return Promise.reject(new Error("Proxy catalog requires at least one route"));
@@ -5442,6 +5592,10 @@ function startProxyCatalog(routes, defaultAliasId, debug = false) {
     }
     if (req.method === "POST" && req.url?.startsWith("/v1/messages")) {
       const inboundKey = extractApiKey(req);
+      if (inboundKey !== proxyToken) {
+        anthropicError(res, 401, "Invalid proxy token");
+        return;
+      }
       let anthropicBody;
       try {
         const raw = await readBody(req);
@@ -5453,7 +5607,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false) {
       const originalModel = anthropicBody.model;
       const clientWantsStream = Boolean(anthropicBody.stream);
       const route = lookupRoute(byAlias, originalModel) ?? defaultRoute;
-      const apiKey = route.apiKey || inboundKey || "";
+      const apiKey = route.apiKey;
       const upstreamUrl = route.upstreamUrl;
       plog(
         () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${apiKey ? `len:${apiKey.length}` : "MISSING"}`
@@ -5515,7 +5669,8 @@ function startProxyCatalog(routes, defaultAliasId, debug = false) {
           }
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          plog(() => `sdk error: ${message}`);
+          const body = err && typeof err === "object" && "responseBody" in err ? err.responseBody : void 0;
+          plog(() => `sdk error: ${message}${body ? ` \u2014 body: ${body}` : ""}`);
           if (!res.headersSent) {
             anthropicError(res, 502, message);
           } else {
@@ -5544,6 +5699,7 @@ data: ${JSON.stringify({ type: "error", error: { type: "api_error", message } })
       plog(() => `started on port ${addr.port}, catalog=${routes.length} model(s), default=${defaultRoute.aliasId}`);
       resolve({
         port: addr.port,
+        token: proxyToken,
         close: () => {
           process.off("unhandledRejection", onRejection);
           process.off("uncaughtException", onException);
@@ -5553,7 +5709,7 @@ data: ${JSON.stringify({ type: "error", error: { type: "api_error", message } })
     });
   });
 }
-function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk) {
+function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk, apiKey) {
   const bareModelId = stripOneMContextSuffix(modelId);
   const clientModelId = claudeCodeClientModelId(modelId, contextWindow);
   return startProxyCatalog([{
@@ -5561,8 +5717,7 @@ function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk)
     realModelId: sdk?.upstreamModelId ?? bareModelId,
     displayName: bareModelId,
     upstreamUrl: completionsUrl,
-    apiKey: "",
-    // '' → use inbound bearer from Claude Code (single-model compat)
+    apiKey: apiKey ?? "",
     modelFormat: "openai",
     contextWindow,
     npm: sdk?.npm,
@@ -5664,7 +5819,7 @@ function ensureAppHomeMigrated() {
   if (existsSync9(configPath)) return;
   const legacyConfig = join9(getLegacyAppHome(), "config.json");
   if (!existsSync9(legacyConfig)) return;
-  mkdirSync5(getAppHome(), { recursive: true });
+  mkdirSync5(getAppHome(), { recursive: true, mode: 448 });
   copyFileSync2(legacyConfig, configPath);
   const legacyVertex = join9(getLegacyAppHome(), "vertex-models.json");
   const vertexPath = join9(getAppHome(), "vertex-models.json");
@@ -5680,9 +5835,9 @@ function ensureConfigMigrated() {
   if (!existsSync9(legacyPath)) return;
   const legacy = readJsonFile(legacyPath);
   if (!legacy) return;
-  mkdirSync5(dirname4(configPath), { recursive: true });
+  mkdirSync5(dirname4(configPath), { recursive: true, mode: 448 });
   writeFileSync4(configPath, `${JSON.stringify(legacy, null, 2)}
-`, "utf8");
+`, { encoding: "utf8", mode: 384 });
   try {
     renameSync2(legacyPath, `${legacyPath}.migrated`);
   } catch {
@@ -5694,9 +5849,9 @@ function readConfig() {
 }
 function writeConfig(config) {
   const configPath = getConfigPath();
-  mkdirSync5(dirname4(configPath), { recursive: true });
+  mkdirSync5(dirname4(configPath), { recursive: true, mode: 448 });
   writeFileSync4(configPath, `${JSON.stringify(config, null, 2)}
-`, "utf8");
+`, { encoding: "utf8", mode: 384 });
 }
 function loadPreferences() {
   const config = readConfig();
@@ -5732,10 +5887,51 @@ function recordLaunchSelection(agent, providerId, modelId, prefs) {
     recentModelsByProvider: { ...prefs.recentModelsByProvider, [providerId]: updatedRecent }
   });
 }
-function getSavedServerPassword() {
-  return readConfig().server?.savedPassword?.trim() || null;
+var SERVER_PASSWORD_SERVICE = "relay-ai-server-password";
+var SERVER_PASSWORD_ACCOUNT = "server-password";
+async function getServerPasswordKeyring() {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    return new Entry(SERVER_PASSWORD_SERVICE, SERVER_PASSWORD_ACCOUNT);
+  } catch {
+    return null;
+  }
 }
-function setSavedServerPassword(password3) {
+async function getSavedServerPassword() {
+  const config = readConfig();
+  if (config.server?.savedPassword) {
+    const pwd = config.server.savedPassword;
+    const keyring2 = await getServerPasswordKeyring();
+    if (keyring2) {
+      try {
+        await keyring2.setPassword(pwd);
+        delete config.server.savedPassword;
+        if (Object.keys(config.server).length === 0) delete config.server;
+        writeConfig(config);
+      } catch {
+      }
+    }
+    return pwd;
+  }
+  const keyring = await getServerPasswordKeyring();
+  if (keyring) {
+    try {
+      return await keyring.getPassword();
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function setSavedServerPassword(password3) {
+  const keyring = await getServerPasswordKeyring();
+  if (keyring) {
+    try {
+      await keyring.setPassword(password3);
+      return;
+    } catch {
+    }
+  }
   const config = readConfig();
   config.server = {
     ...config.server ?? {},
@@ -5911,11 +6107,19 @@ function zenGoAsLocalProvider(backendId, models) {
 }
 function providersForPicker(catalog) {
   const registryIds = new Set(catalog.localProviders.map((p19) => p19.id));
-  return [
+  const providers = [
     ...catalog.zenModels.length > 0 && !registryIds.has("zen") ? [zenGoAsLocalProvider("zen", catalog.zenModels)] : [],
     ...catalog.goModels.length > 0 && !registryIds.has("go") ? [zenGoAsLocalProvider("go", catalog.goModels)] : [],
     ...catalog.localProviders
   ];
+  for (const p19 of providers) {
+    p19.models.sort((a, b) => {
+      const nameA = a.name || a.id;
+      const nameB = b.name || b.id;
+      return nameA.localeCompare(nameB, void 0, { sensitivity: "base", numeric: true });
+    });
+  }
+  return providers.sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base", numeric: true }));
 }
 async function resolveLocalProviderApiKey(provider) {
   const direct = provider.apiKey?.trim();
@@ -6131,6 +6335,147 @@ async function askSaveServerPassword() {
 
 // src/server/router.ts
 import { createServer as createServer2 } from "http";
+
+// src/openai-adapter.ts
+import { tool as tool2, jsonSchema as jsonSchema2, streamText as streamText2, generateText as generateText2 } from "ai";
+function translateOpenAiRequest(body) {
+  const toolNameById = /* @__PURE__ */ new Map();
+  for (const msg of body.messages) {
+    if (msg.role === "assistant" && msg.tool_calls) {
+      for (const tc of msg.tool_calls) toolNameById.set(tc.id, tc.function.name);
+    }
+  }
+  let system;
+  const messages = [];
+  for (const msg of body.messages) {
+    switch (msg.role) {
+      case "system":
+        system = typeof msg.content === "string" ? msg.content : void 0;
+        break;
+      case "user":
+        messages.push({ role: "user", content: msg.content });
+        break;
+      case "assistant": {
+        const parts = [];
+        if (typeof msg.content === "string" && msg.content) {
+          parts.push({ type: "text", text: msg.content });
+        }
+        for (const tc of msg.tool_calls ?? []) {
+          parts.push({
+            type: "tool-call",
+            toolCallId: tc.id,
+            toolName: tc.function.name,
+            input: parseToolArguments(tc.function.arguments)
+          });
+        }
+        messages.push({ role: "assistant", content: parts.length > 0 ? parts : "" });
+        break;
+      }
+      case "tool": {
+        const resultPart = {
+          type: "tool-result",
+          toolCallId: msg.tool_call_id ?? "",
+          toolName: toolNameById.get(msg.tool_call_id ?? "") ?? "unknown",
+          output: {
+            type: "text",
+            value: typeof msg.content === "string" ? msg.content : JSON.stringify(msg.content ?? "")
+          }
+        };
+        const lastMsg = messages[messages.length - 1];
+        if (lastMsg?.role === "tool" && Array.isArray(lastMsg.content)) {
+          lastMsg.content.push(resultPart);
+        } else {
+          messages.push({ role: "tool", content: [resultPart] });
+        }
+        break;
+      }
+    }
+  }
+  let sdkToolChoice;
+  if (body.tool_choice === "auto" || body.tool_choice === "required") {
+    sdkToolChoice = body.tool_choice;
+  } else if (typeof body.tool_choice === "object" && body.tool_choice?.type === "function") {
+    sdkToolChoice = { type: "tool", toolName: body.tool_choice.function.name };
+  }
+  let tools;
+  if (body.tools?.length) {
+    tools = {};
+    for (const t of body.tools) {
+      if (t.type === "function" && t.function.name) {
+        const schema = t.function.parameters ? jsonSchema2(t.function.parameters) : void 0;
+        tools[t.function.name] = tool2({
+          description: t.function.description ?? "",
+          inputSchema: schema ?? jsonSchema2({ type: "object", properties: {} })
+        });
+      }
+    }
+  }
+  return {
+    system,
+    messages,
+    tools,
+    toolChoice: sdkToolChoice,
+    temperature: body.temperature,
+    maxOutputTokens: body.max_completion_tokens ?? body.max_tokens
+  };
+}
+async function generateOpenAiResponse(model, params, responseModelId) {
+  const result = await generateText2({ model, ...params });
+  const message = { role: "assistant", content: result.text || null };
+  if (result.toolCalls?.length) {
+    message.tool_calls = result.toolCalls.map((tc) => ({
+      id: tc.toolCallId,
+      type: "function",
+      function: { name: tc.toolName, arguments: JSON.stringify(tc.args) }
+    }));
+  }
+  return {
+    id: `chatcmpl-${Date.now()}`,
+    object: "chat.completion",
+    created: Math.floor(Date.now() / 1e3),
+    model: responseModelId,
+    choices: [{ index: 0, message, finish_reason: result.finishReason || "stop" }],
+    usage: {
+      prompt_tokens: result.usage?.promptTokens ?? 0,
+      completion_tokens: result.usage?.completionTokens ?? 0,
+      total_tokens: result.usage?.totalTokens ?? 0
+    }
+  };
+}
+async function streamOpenAiResponse(model, params, responseModelId, onChunk) {
+  const { fullStream } = streamText2({ model, ...params });
+  const baseData = {
+    id: `chatcmpl-${Date.now()}`,
+    object: "chat.completion.chunk",
+    created: Math.floor(Date.now() / 1e3),
+    model: responseModelId
+  };
+  const send = (delta, finish_reason = null) => onChunk(`data: ${JSON.stringify({ ...baseData, choices: [{ index: 0, delta, finish_reason }] })}
+
+`);
+  for await (const part of fullStream) {
+    const p19 = part;
+    switch (p19.type) {
+      case "text-delta":
+        send({ role: "assistant", content: p19.textDelta ?? p19.text ?? "" });
+        break;
+      case "tool-input-start":
+      case "tool-call-streaming-start":
+        send({ role: "assistant", tool_calls: [{ index: 0, id: p19.id ?? p19.toolCallId, type: "function", function: { name: p19.toolName, arguments: "" } }] });
+        break;
+      case "tool-input-delta":
+      case "tool-call-delta":
+        send({ tool_calls: [{ index: 0, function: { arguments: p19.delta ?? p19.text ?? p19.argsTextDelta ?? "" } }] });
+        break;
+      case "finish":
+        send({}, p19.finishReason || "stop");
+        break;
+    }
+  }
+  onChunk("data: [DONE]\n\n");
+}
+
+// src/server/router.ts
 function makeServerLog(debugLogPath) {
   if (!debugLogPath) return () => {
   };
@@ -6194,7 +6539,7 @@ async function routeRequest(req, res, options, modelCache, plog) {
       return;
     }
     if (req.method === "POST" && pathname === "/openai/v1/chat/completions") {
-      await handleOpenAIChatCompletions(req, res, options);
+      await handleOpenAIChatCompletions(req, res, options, modelCache, plog);
       return;
     }
     sendJson(res, 404, { error: { message: "Not found" } });
@@ -6233,21 +6578,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       return;
     }
     const apiKey = model.apiKey ?? options.apiKey;
-    const cacheKey = sdkModelCacheKey(model);
-    let languageModel = modelCache.get(cacheKey);
-    if (!languageModel) {
-      languageModel = await createLanguageModel({
-        npm: model.npm,
-        modelId: upstreamModelId(model),
-        apiKey,
-        baseURL: model.apiBaseUrl,
-        providerId: model.providerId ?? model.sourceBackend,
-        authType: model.authType,
-        oauthAccountId: model.oauthAccountId,
-        vertex: options.vertex
-      });
-      modelCache.set(cacheKey, languageModel);
-    }
+    const languageModel = await getOrInitLanguageModel(modelCache, model, model.npm, model.apiBaseUrl, apiKey, options.vertex);
     const params = translateRequest(body, model.npm, {
       defaultEffort: anthropicEffortFromRequest(body) ? void 0 : model.defaultEffort,
       openAiOAuth: model.npm === "@ai-sdk/openai" && model.authType === "oauth",
@@ -6260,7 +6591,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       }
     });
     const clientWantsStream = Boolean(body.stream);
-    const responseModelId = options.gateway?.maskGatewayIds ? gatewayDisplayName(model, options.gateway) : typeof body.model === "string" ? body.model : model.id;
+    const responseModelId = getResponseModelId(body.model, model, options);
     plog(() => `sdk npm=${model.npm} upstream=${upstreamModelId(model)} responseModel=${responseModelId} stream=${clientWantsStream}`);
     try {
       if (clientWantsStream) {
@@ -6284,7 +6615,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
   }
   sendJson(res, 400, { error: { message: `Unsupported model format: ${model.modelFormat}` } });
 }
-async function handleOpenAIChatCompletions(req, res, options) {
+async function handleOpenAIChatCompletions(req, res, options, modelCache, plog) {
   const body = await readJson(req);
   if (!body) {
     sendJson(res, 400, { error: { message: "Invalid JSON body" } });
@@ -6292,29 +6623,46 @@ async function handleOpenAIChatCompletions(req, res, options) {
   }
   const model = lookupModel(res, options.catalog, body.model);
   if (!model) return;
-  if (model.modelFormat === "openai") {
-    if (!isOpenAIChatCompletionsModel(model)) {
-      sendJson(res, 400, {
-        error: {
-          message: `OpenAI chat completions are not available for model: ${model.id}. Use /anthropic/v1/messages.`
-        }
-      });
-      return;
-    }
+  if (supportsDirectOpenAIChatCompletions(model)) {
     if (model.completionsUrl && !/^https?:\/\//i.test(model.completionsUrl)) {
       sendJson(res, 400, { error: { message: `Invalid provider completionsUrl: must be http:// or https://` } });
       return;
     }
     const completionsUrl = model.completionsUrl ? model.completionsUrl : `${backendFor(options, model).baseUrl}/v1/chat/completions`;
-    const apiKey = model.apiKey ?? options.apiKey;
-    await forwardJson(res, completionsUrl, body, apiKey);
+    const apiKey2 = model.apiKey ?? options.apiKey;
+    await relayAnthropicMessages(res, completionsUrl, body, apiKey2, Boolean(body.stream));
     return;
   }
-  if (model.modelFormat === "anthropic") {
-    sendJson(res, 400, { error: { message: "OpenAI to Anthropic reverse translation is not supported yet" } });
+  const npm = model.npm || (model.modelFormat === "anthropic" ? "@ai-sdk/anthropic" : void 0);
+  if (!npm) {
+    sendJson(res, 400, { error: { message: `No SDK provider for model: ${model.id}` } });
     return;
   }
-  sendJson(res, 400, { error: { message: `Unsupported model format: ${model.modelFormat}` } });
+  const apiKey = model.apiKey ?? options.apiKey;
+  const baseURL = model.modelFormat === "anthropic" ? model.baseUrl : model.apiBaseUrl;
+  const languageModel = await getOrInitLanguageModel(modelCache, model, npm, baseURL, apiKey, options.vertex);
+  const params = translateOpenAiRequest(body);
+  const clientWantsStream = Boolean(body.stream);
+  const responseModelId = getResponseModelId(body.model, model, options);
+  plog(() => `sdk-openai npm=${npm} upstream=${upstreamModelId(model)} responseModel=${responseModelId} stream=${clientWantsStream}`);
+  try {
+    if (clientWantsStream) {
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive"
+      });
+      await streamOpenAiResponse(languageModel, params, responseModelId, (chunk) => res.write(chunk));
+      res.end();
+    } else {
+      const response = await generateOpenAiResponse(languageModel, params, responseModelId);
+      sendJson(res, 200, response);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!res.headersSent) sendJson(res, 502, { error: { message } });
+    else res.end();
+  }
 }
 function lookupModel(res, catalog, modelId) {
   if (typeof modelId !== "string") {
@@ -6336,14 +6684,32 @@ function backendFor(options, model) {
   if (model.sourceBackend === "go") return options.backends.go;
   throw new Error(`Provider ${model.sourceBackend} is not a cloud backend \u2014 model must set baseUrl/completionsUrl`);
 }
-function sdkModelCacheKey(model) {
-  return [
+async function getOrInitLanguageModel(modelCache, model, npm, baseURL, apiKey, vertex) {
+  const cacheKey = [
     model.providerId ?? model.sourceBackend,
     model.id,
     upstreamModelId(model),
-    model.npm ?? "",
-    model.apiBaseUrl ?? ""
+    npm,
+    baseURL ?? ""
   ].join("");
+  let languageModel = modelCache.get(cacheKey);
+  if (!languageModel) {
+    languageModel = await createLanguageModel({
+      npm,
+      modelId: upstreamModelId(model),
+      apiKey,
+      baseURL,
+      providerId: model.providerId ?? model.sourceBackend,
+      authType: model.authType,
+      oauthAccountId: model.oauthAccountId,
+      vertex
+    });
+    modelCache.set(cacheKey, languageModel);
+  }
+  return languageModel;
+}
+function getResponseModelId(bodyModel, model, options) {
+  return options.gateway?.maskGatewayIds ? gatewayDisplayName(model, options.gateway) : typeof bodyModel === "string" ? bodyModel : model.id;
 }
 async function forwardJson(res, url, body, apiKey, inboundBeta) {
   const upstream = await postJsonUpstream(url, body, apiKey, inboundBeta);
@@ -6607,16 +6973,44 @@ function createVertexModelCatalog(models) {
 }
 
 // src/server/index.ts
-function getLocalIp() {
+function getLocalIps() {
   const ifaces = networkInterfaces();
-  for (const iface of Object.values(ifaces)) {
+  const result = [];
+  for (const [name, iface] of Object.entries(ifaces)) {
     for (const addr of iface ?? []) {
       if (addr.family === "IPv4" && !addr.internal) {
-        return addr.address;
+        result.push({ name, address: addr.address });
       }
     }
   }
-  return "<this-computer-ip>";
+  return result;
+}
+function printModelCatalog(models, gateway) {
+  if (models.length === 0) return;
+  const groups = /* @__PURE__ */ new Map();
+  for (const model of models) {
+    const label = gatewayProviderLabel(model);
+    let list = groups.get(label);
+    if (!list) {
+      list = [];
+      groups.set(label, list);
+    }
+    list.push(model);
+  }
+  const sortedGroups = [...groups.entries()].sort((a, b) => a[0].localeCompare(b[0]));
+  console.log(pc6.bold("Model catalog:"));
+  console.log("");
+  for (const [label, groupModels] of sortedGroups) {
+    console.log(`  ${pc6.bold(label)}`);
+    const sorted = [...groupModels].sort((a, b) => a.name.localeCompare(b.name));
+    for (const model of sorted) {
+      const anthropicId = exposedGatewayAliasId(model, gateway);
+      console.log(`    ${model.name}`);
+      console.log(`      ${pc6.dim("anthropic:")} ${pc6.cyan(anthropicId)}`);
+      console.log(`      ${pc6.dim("openai:   ")} ${pc6.cyan(model.id)}`);
+    }
+    console.log("");
+  }
 }
 function filterZenModelsForServer(models) {
   const zenProvider = loadRegistry().providers.find((entry) => entry.id === "zen" && entry.enabled);
@@ -6698,13 +7092,19 @@ function waitForShutdown() {
   });
 }
 async function getServerPasswordForMode(mode) {
-  if (mode === "local") return null;
-  const savedPassword = getSavedServerPassword();
+  if (mode === "local") return { password: null, wasSaved: false };
+  const savedPassword = await getSavedServerPassword();
   let serverPassword = null;
+  let wasSaved = false;
   if (savedPassword) {
     const savedChoice = await askUseSavedServerPassword();
     if (!savedChoice) return void 0;
-    serverPassword = savedChoice === "use-saved" ? savedPassword : await askServerPassword();
+    if (savedChoice === "use-saved") {
+      serverPassword = savedPassword;
+      wasSaved = true;
+    } else {
+      serverPassword = await askServerPassword();
+    }
   } else {
     serverPassword = await askServerPassword();
   }
@@ -6712,9 +7112,12 @@ async function getServerPasswordForMode(mode) {
   if (serverPassword !== savedPassword) {
     const savePassword = await askSaveServerPassword();
     if (savePassword === null) return void 0;
-    if (savePassword) setSavedServerPassword(serverPassword);
+    if (savePassword) {
+      await setSavedServerPassword(serverPassword);
+      wasSaved = true;
+    }
   }
-  return serverPassword;
+  return { password: serverPassword, wasSaved };
 }
 async function configureExposedProviders() {
   p6.log.info("Add providers to expose. Listed providers are removed when selected \u2014 like favorites.");
@@ -6770,8 +7173,9 @@ async function runVertexServerCommand() {
   }
   const mode = await askListenMode();
   if (!mode) return 0;
-  const serverPassword = await getServerPasswordForMode(mode);
-  if (serverPassword === void 0) return 0;
+  const pwResult = await getServerPasswordForMode(mode);
+  if (pwResult === void 0) return 0;
+  const { password: serverPassword, wasSaved: passwordWasSaved } = pwResult;
   const host = mode === "network" ? "0.0.0.0" : "127.0.0.1";
   const models = vertexModelsToServerModels(vertexConfig);
   const server = await startServer({
@@ -6791,13 +7195,20 @@ async function runVertexServerCommand() {
   console.log(`  Anthropic:  http://127.0.0.1:${server.port}/anthropic`);
   console.log(`  Models:     ${models.map((model) => model.id).join(", ")}`);
   if (mode === "network") {
-    console.log(`  Network:    http://${getLocalIp()}:${server.port}`);
-    console.log(`  API key:    ${serverPassword}`);
+    for (const { name, address } of getLocalIps()) {
+      console.log(`  Network (${name}):  http://${address}:${server.port}/anthropic`);
+    }
+    if (passwordWasSaved) {
+      console.log("  API key:    saved, rotate with `relay-ai server --setup`");
+    } else {
+      console.log(`  API key:    ${serverPassword}`);
+    }
   } else {
     console.log("  API key:    any non-empty value");
   }
   console.log(pc6.dim("  Auth:       gcloud Application Default Credentials"));
   console.log("");
+  printModelCatalog(models);
   console.log(pc6.dim("Press Ctrl+C to stop."));
   await waitForShutdown();
   await server.close();
@@ -6835,8 +7246,9 @@ async function runServerCommand(options = {}) {
   if (!runConfig) return 0;
   const mode = await askListenMode();
   if (!mode) return 0;
-  const serverPassword = await getServerPasswordForMode(mode);
-  if (serverPassword === void 0) return 0;
+  const pwResult = await getServerPasswordForMode(mode);
+  if (pwResult === void 0) return 0;
+  const { password: serverPassword, wasSaved: passwordWasSaved } = pwResult;
   const host = mode === "network" ? "0.0.0.0" : "127.0.0.1";
   const spinner9 = p6.spinner();
   spinner9.start("Fetching available models...");
@@ -6896,10 +7308,18 @@ async function runServerCommand(options = {}) {
   console.log("");
   console.log(pc6.bold(pc6.green("Relay AI server running")));
   console.log(`  Anthropic:  http://127.0.0.1:${server.port}/anthropic`);
-  console.log(`  OpenAI:     http://127.0.0.1:${server.port}/openai`);
+  console.log(`  OpenAI:     http://127.0.0.1:${server.port}/openai/v1`);
   if (mode === "network") {
-    console.log(`  Network:    http://${getLocalIp()}:${server.port}`);
-    console.log(`  API key:    ${serverPassword}`);
+    for (const { name, address } of getLocalIps()) {
+      console.log(`  Network (${name}):`);
+      console.log(`    Anthropic:  http://${address}:${server.port}/anthropic`);
+      console.log(`    OpenAI:     http://${address}:${server.port}/openai/v1`);
+    }
+    if (passwordWasSaved) {
+      console.log("  API key:    saved, rotate with `relay-ai server --setup`");
+    } else {
+      console.log(`  API key:    ${serverPassword}`);
+    }
   } else {
     console.log("  API key:    any non-empty value");
   }
@@ -6913,6 +7333,7 @@ async function runServerCommand(options = {}) {
     console.log(pc6.dim("  Discovery:  gateway ids masked for Claude Desktop / Cowork"));
   }
   console.log("");
+  printModelCatalog(models, gateway);
   console.log(pc6.dim("Press Ctrl+C to stop."));
   await waitForShutdown();
   await server.close();
@@ -6934,16 +7355,24 @@ var MODE_SEARCH = "search";
 var MODE_BROWSE = "browse";
 function sortModelsByBrand(models) {
   return [...models].sort((a, b) => {
-    const brandCmp = a.brand.localeCompare(b.brand);
-    return brandCmp !== 0 ? brandCmp : a.id.localeCompare(b.id);
+    const brandCmp = a.brand.localeCompare(b.brand, void 0, { sensitivity: "base" });
+    if (brandCmp !== 0) return brandCmp;
+    const nameA = a.name || a.id;
+    const nameB = b.name || b.id;
+    return nameA.localeCompare(nameB, void 0, { sensitivity: "base", numeric: true });
   });
 }
+function normalizeForSearch(s) {
+  return s.toLowerCase().replace(/[\s\-._/]+/g, " ").trim();
+}
 function filterModelsBySearch(models, query) {
-  const q = query.trim().toLowerCase();
+  const q = query.trim();
   if (!q) return [];
-  return models.filter(
-    (m) => m.id.toLowerCase().includes(q) || m.name.toLowerCase().includes(q) || m.brand.toLowerCase().includes(q)
-  );
+  const tokens = normalizeForSearch(q).split(" ").filter(Boolean);
+  return models.filter((m) => {
+    const fields = [normalizeForSearch(m.id), normalizeForSearch(m.name), normalizeForSearch(m.brand)];
+    return tokens.every((token) => fields.some((f) => f.includes(token)));
+  });
 }
 function sliceModelPage(items, page, pageSize = MODEL_PAGE_SIZE) {
   const totalPages = Math.max(1, Math.ceil(items.length / pageSize));
@@ -7018,12 +7447,12 @@ async function selectLargeCatalog(models, browseList, toOption, message, initial
             value: MODE_BROWSE,
             label: pc7.cyan("Browse all models"),
             hint: `${MODEL_PAGE_SIZE} per page \xB7 ${Math.ceil(browseList.length / MODEL_PAGE_SIZE)} pages`
-          }
+          },
+          navOption("__back__", "\u2190 Go back", "Select a different provider")
         ]
       });
-      if (p7.isCancel(method)) {
-        p7.cancel("Cancelled.");
-        return null;
+      if (p7.isCancel(method) || String(method) === "__back__") {
+        return "back";
       }
       mode = method === MODE_BROWSE ? "browse" : "search";
       continue;
@@ -7083,16 +7512,18 @@ async function selectModelWithSearch(models, toOption, message, initialModelId,
   if (models.length === 0) return null;
   const orderedBrowse = browseList ?? sortModelsByBrand(models);
   if (models.length <= MODEL_SEARCH_THRESHOLD) {
-    const options = models.map(toOption);
+    const options = [
+      ...models.map(toOption),
+      navOption("__back__", "\u2190 Go back", "")
+    ];
     const initialValue = initialModelId && options.some((o) => o.value === initialModelId) ? initialModelId : options[0]?.value;
     const picked = await p7.select({
       message,
       options,
       initialValue
     });
-    if (p7.isCancel(picked)) {
-      p7.cancel("Cancelled.");
-      return null;
+    if (p7.isCancel(picked) || String(picked) === "__back__") {
+      return "back";
     }
     const selected = models.find((m) => m.id === String(picked));
     if (!selected) return null;
@@ -7117,32 +7548,43 @@ async function browseAllModels(provider, prefs) {
 async function pickLocalModel(provider, conflicts, prefs) {
   const recentIds = (prefs.recentModelsByProvider?.[provider.id] ?? []).slice(0, MAX_RECENT);
   const recentModels = recentIds.map((id) => provider.models.find((m) => m.id === id)).filter((m) => m !== void 0);
-  let selectedModel;
-  if (recentModels.length > 0) {
-    const options = [
-      ...recentModels.map((m) => modelToOption(m, "recent")),
-      navOption(BROWSE_ALL, "Browse all models \u2192", `${provider.models.length} available`)
-    ];
-    const picked = await p7.select({
-      message: "Which model?",
-      options,
-      initialValue: recentModels[0].id
-    });
-    if (p7.isCancel(picked)) {
-      p7.cancel("Cancelled.");
-      return null;
-    }
-    if (String(picked) === BROWSE_ALL) {
+  let selectedModel = null;
+  while (true) {
+    if (recentModels.length > 0) {
+      const options = [
+        ...recentModels.map((m) => modelToOption(m, "recent")),
+        navOption(BROWSE_ALL, "Browse all models \u2192", `${provider.models.length} available`),
+        navOption("__back__", "\u2190 Go back", "Select a different provider")
+      ];
+      const picked = await p7.select({
+        message: "Which model?",
+        options,
+        initialValue: recentModels[0].id
+      });
+      if (p7.isCancel(picked) || String(picked) === "__back__") {
+        return "back";
+      }
+      if (String(picked) === BROWSE_ALL) {
+        const browsed = await browseAllModels(provider, prefs);
+        if (browsed === "back") {
+          continue;
+        }
+        if (!browsed) return null;
+        selectedModel = browsed;
+        break;
+      } else {
+        selectedModel = recentModels.find((m) => m.id === String(picked));
+        break;
+      }
+    } else {
       const browsed = await browseAllModels(provider, prefs);
+      if (browsed === "back") {
+        return "back";
+      }
       if (!browsed) return null;
       selectedModel = browsed;
-    } else {
-      selectedModel = recentModels.find((m) => m.id === String(picked));
+      break;
     }
-  } else {
-    const browsed = await browseAllModels(provider, prefs);
-    if (!browsed) return null;
-    selectedModel = browsed;
   }
   noteEnvConflicts(conflicts);
   const modelLabel = formatCodexModelLabel(selectedModel);
@@ -7473,6 +7915,71 @@ function toggleProviderEnabled(id) {
   return { toggled: true, enabled: provider.enabled };
 }
 
+// src/data/openai-oauth-models.ts
+var CHATGPT_CODEX_UNSUPPORTED_MODELS = /* @__PURE__ */ new Set([
+  "gpt-5.5-fast"
+  // confirmed: rejected by chatgpt.com/backend-api/codex
+]);
+var OPENAI_OAUTH_MODEL_SEEDS = [
+  // GPT-5.5 family (Pro)
+  { id: "gpt-5.5", name: "GPT-5.5", reasoning: true },
+  // GPT-5.4 family
+  { id: "gpt-5.4", name: "GPT-5.4" },
+  { id: "gpt-5.4-mini", name: "GPT-5.4 Mini" },
+  // GPT-5 base (Pro / Plus)
+  { id: "gpt-5", name: "GPT-5", reasoning: true },
+  // o-series reasoning (Plus+)
+  { id: "o4-mini", name: "o4 Mini", reasoning: true },
+  { id: "o3", name: "o3", reasoning: true },
+  { id: "o3-mini", name: "o3 Mini", reasoning: true },
+  { id: "o1", name: "o1", reasoning: true },
+  { id: "o1-mini", name: "o1 Mini", reasoning: true }
+];
+function buildOpenAiOAuthModels() {
+  return OPENAI_OAUTH_MODEL_SEEDS.map((seed) => {
+    const prefix = seed.id.split("-")[0] ?? seed.id;
+    return {
+      id: seed.id,
+      name: seed.name,
+      upstreamModelId: seed.id,
+      family: prefix,
+      brand: deriveBrand(prefix),
+      contextWindow: resolveContextWindow(seed.id),
+      modelFormat: "openai",
+      npm: "@ai-sdk/openai",
+      reasoning: seed.reasoning
+    };
+  });
+}
+
+// src/data/xai-oauth-models.ts
+var XAI_OAUTH_MODEL_SEEDS = [
+  // Grok 4 family
+  { id: "grok-4", name: "Grok 4", reasoning: true },
+  { id: "grok-4-fast", name: "Grok 4 Fast", reasoning: true },
+  // Grok 3 family
+  { id: "grok-3", name: "Grok 3", reasoning: true },
+  { id: "grok-3-fast", name: "Grok 3 Fast" },
+  { id: "grok-3-mini", name: "Grok 3 Mini", reasoning: true },
+  { id: "grok-3-mini-fast", name: "Grok 3 Mini Fast", reasoning: true }
+];
+function buildXaiOAuthModels() {
+  return XAI_OAUTH_MODEL_SEEDS.map((seed) => {
+    const prefix = seed.id.split("-")[0] ?? seed.id;
+    return {
+      id: seed.id,
+      name: seed.name,
+      upstreamModelId: seed.id,
+      family: prefix,
+      brand: deriveBrand(prefix),
+      contextWindow: resolveContextWindow(seed.id),
+      modelFormat: "openai",
+      npm: "@ai-sdk/xai",
+      reasoning: seed.reasoning
+    };
+  });
+}
+
 // src/registry/refresh-models.ts
 function modelInfoToCached(m, npm, apiUrl) {
   return {
@@ -7499,6 +8006,99 @@ async function refreshZenGoProvider(provider) {
     return modelInfoToCached(m, npm, apiUrl);
   });
 }
+async function refreshOAuthProvider(provider, accessToken) {
+  const tpl = provider.templateId ?? provider.id;
+  if (tpl === "openai") return refreshOpenAiOAuthModels(accessToken);
+  if (tpl === "xai") return refreshXaiOAuthModels(accessToken);
+  throw new Error(`refreshOAuthProvider: unsupported template "${tpl}"`);
+}
+function parseOpenAiModelEntries(body) {
+  if (!body || typeof body !== "object") return [];
+  const b = body;
+  if (Array.isArray(b.models)) {
+    return b.models.map((m) => ({ id: m.slug ?? "", name: m.title ?? m.name ?? m.slug ?? "", context_window: m.context_window })).filter((m) => m.id.length > 0);
+  }
+  if (Array.isArray(b.data)) {
+    return b.data.map((m) => ({ id: m.id ?? "", name: m.name ?? m.id ?? "", context_window: m.context_window })).filter((m) => m.id.length > 0);
+  }
+  return [];
+}
+function buildDynamicOAuthModel(id, name, contextWindow, seedById) {
+  if (seedById.has(id)) return seedById.get(id);
+  const prefix = id.split("-")[0] ?? id;
+  return {
+    id,
+    name,
+    upstreamModelId: id,
+    family: prefix,
+    brand: deriveBrand(prefix),
+    contextWindow: contextWindow ?? resolveContextWindow(id),
+    modelFormat: "openai",
+    npm: "@ai-sdk/openai",
+    reasoning: modelPrefersResponsesApi(id)
+  };
+}
+async function fetchJsonWithAuth(url, accessToken, timeoutMs) {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const response = await fetch(url, {
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`,
+        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+      },
+      signal: controller.signal
+    }).finally(() => clearTimeout(timer));
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function refreshOpenAiOAuthModels(accessToken) {
+  const TIMEOUT_MS = 1e4;
+  const seedById = new Map(buildOpenAiOAuthModels().map((m) => [m.id, m]));
+  const toModels = (entries) => entries.map(({ id, name, context_window }) => buildDynamicOAuthModel(id, name, context_window, seedById));
+  const claudeVersion = getInstalledClaudeVersion();
+  const codexBody = await fetchJsonWithAuth(
+    `https://chatgpt.com/backend-api/codex/models?client_version=${claudeVersion}`,
+    accessToken,
+    TIMEOUT_MS
+  );
+  const codexEntries = parseOpenAiModelEntries(codexBody);
+  if (codexEntries.length > 0) {
+    return { models: toModels(codexEntries), source: "live" };
+  }
+  const chatGptBody = await fetchJsonWithAuth(
+    "https://chatgpt.com/backend-api/models",
+    accessToken,
+    TIMEOUT_MS
+  );
+  const chatGptEntries = parseOpenAiModelEntries(chatGptBody).filter(({ id }) => !CHATGPT_CODEX_UNSUPPORTED_MODELS.has(id));
+  if (chatGptEntries.length > 0) {
+    return { models: toModels(chatGptEntries), source: "live" };
+  }
+  return { models: [...seedById.values()], source: "seed" };
+}
+async function refreshXaiOAuthModels(accessToken) {
+  const seed = buildXaiOAuthModels();
+  const seedById = new Map(seed.map((m) => [m.id, m]));
+  const body = await fetchJsonWithAuth("https://api.x.ai/v1/models", accessToken, 8e3);
+  if (body) {
+    const ids = (body.data ?? []).map((m) => m.id).filter((id) => !!id);
+    if (ids.length > 0) {
+      const live = ids.map((id) => {
+        const cached = seedById.get(id);
+        if (cached) return cached;
+        const prefix = id.split("-")[0] ?? id;
+        return { id, name: id, upstreamModelId: id, family: prefix, brand: deriveBrand(prefix), contextWindow: resolveContextWindow(id), modelFormat: "openai", npm: "@ai-sdk/xai", reasoning: modelPrefersResponsesApi(id) };
+      });
+      return { models: live, source: "live" };
+    }
+  }
+  return { models: seed, source: "seed" };
+}
 async function refreshApiListProvider(provider, apiKey) {
   const npm = provider.api.npm ?? "@ai-sdk/openai-compatible";
   const catalogTemplate = resolveProviderTemplate(provider);
@@ -7578,6 +8178,25 @@ async function refreshProviderModels(providerId, apiKey, registry = loadRegistry
     let baseUrl;
     if (source === "zen-go-api") {
       models = await refreshZenGoProvider(provider);
+    } else if (provider.authType === "oauth" && (["openai", "xai", "xai-oauth"].includes(provider.templateId ?? provider.id) || provider.id === "openai-oauth" || provider.id === "xai-oauth")) {
+      if (!apiKey) {
+        return {
+          id: provider.id,
+          name: provider.name,
+          ok: false,
+          reason: "OAuth token not available \u2014 try signing in again with relay-ai providers auth."
+        };
+      }
+      const oauthResult = await refreshOAuthProvider(provider, apiKey);
+      models = oauthResult.models;
+      if (models.length === 0) {
+        return {
+          id: provider.id,
+          name: provider.name,
+          ok: false,
+          reason: "No models available for this OAuth provider \u2014 try signing in again."
+        };
+      }
     } else {
       const template = resolveProviderTemplate(provider);
       const keyOptional = template?.apiKeyOptional === true;
@@ -7688,6 +8307,7 @@ async function refreshAllProviderModels(resolveKey) {
 // src/registry/provider-auth.ts
 import pc9 from "picocolors";
 import * as p9 from "@clack/prompts";
+import open from "open";
 
 // src/registry/auth-broker.ts
 import { spawn as spawn3 } from "child_process";
@@ -7715,22 +8335,30 @@ async function runOpencodeAuthBroker(providerId, options = {}) {
 }
 
 // src/registry/provider-auth.ts
+var OPENAI_DISPLAY = "OpenAI ChatGPT Plus/Pro";
 var PROVIDER_DISPLAY = {
   xai: "xAI Grok (SuperGrok)",
-  openai: "OpenAI ChatGPT Plus/Pro",
+  "xai-oauth": "xAI Grok (SuperGrok)",
+  openai: OPENAI_DISPLAY,
+  "openai-oauth": OPENAI_DISPLAY,
   "github-copilot": "GitHub Copilot (Individual / Business)"
 };
+function openBrowser(url) {
+  open(url).catch(() => {
+  });
+}
 async function runNativeDeviceCode(providerId) {
   const label = PROVIDER_DISPLAY[providerId];
   printOAuthStepsPanel(`${label} \u2014 Sign in`, label);
   const spinner9 = p9.spinner();
   spinner9.start("Waiting for authorization...");
   try {
-    if (providerId === "xai") {
+    if (providerId === "xai" || providerId === "xai-oauth") {
       const tokens2 = await runXaiDeviceCodeFlow(({ url, userCode }) => {
         spinner9.stop("");
         p9.log.info(`Visit: ${pc9.cyan(url)}`);
         p9.log.info(`Enter code: ${pc9.bold(userCode)}`);
+        openBrowser(url);
         spinner9.start("Waiting for authorization...");
       });
       spinner9.stop(pc9.green("Signed in to xAI"));
@@ -7741,6 +8369,7 @@ async function runNativeDeviceCode(providerId) {
         spinner9.stop("");
         p9.log.info(`Visit: ${pc9.cyan(url)}`);
         p9.log.info(`Enter code: ${pc9.bold(userCode)}`);
+        openBrowser(url);
         spinner9.start("Waiting for authorization...");
       });
       spinner9.stop(pc9.green("Signed in to GitHub Copilot"));
@@ -7750,6 +8379,7 @@ async function runNativeDeviceCode(providerId) {
       spinner9.stop("");
       p9.log.info(`Visit: ${pc9.cyan(url)}`);
       p9.log.info(`Enter code: ${pc9.bold(userCode)}`);
+      openBrowser(url);
       spinner9.start("Waiting for authorization...");
     });
     spinner9.stop(pc9.green("Signed in to OpenAI ChatGPT"));
@@ -7760,28 +8390,32 @@ async function runNativeDeviceCode(providerId) {
   }
 }
 async function upsertOAuthProvider(providerId, cred) {
+  const registryId = toOAuthRegistryId(providerId);
+  const templateId = providerId.replace(/-oauth$/, "") || providerId;
   const registry = loadRegistry();
-  const authRef = oauthAuthRef(providerId);
-  let entry = registry.providers.find((pr) => pr.id === providerId);
+  const authRef = oauthAuthRef(registryId);
+  let entry = registry.providers.find((pr) => pr.id === registryId);
   if (!entry) {
     const raw = await fetchRawOpencodeProviders();
     if (raw) {
       const { providers } = buildImportProviderList(raw, { [providerId]: cred });
-      const lp = providers.find((pr) => pr.id === providerId);
+      const lp = providers.find((pr) => pr.id === registryId || pr.id === providerId);
       if (lp) {
-        entry = localProviderToRegistry(lp, { authType: "oauth", authRef }) ?? void 0;
+        const converted = localProviderToRegistry(lp, { authType: "oauth", authRef });
+        if (converted) entry = { ...converted, id: registryId, templateId };
       }
     }
   }
   if (!entry) {
-    const template = getTemplateById(providerId);
+    const template = getTemplateById(templateId);
     if (!template) {
       throw new Error(`Provider "${providerId}" is not in your registry and has no template`);
     }
+    const displayName = registryId === "openai-oauth" ? "OpenAI (ChatGPT)" : registryId === "xai-oauth" ? "xAI (SuperGrok)" : template.name;
     entry = {
-      id: providerId,
-      templateId: template.id,
-      name: template.name,
+      id: registryId,
+      templateId,
+      name: displayName,
       enabled: true,
       authRef,
       authType: "oauth",
@@ -7789,24 +8423,25 @@ async function upsertOAuthProvider(providerId, cred) {
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
   } else {
-    entry = { ...entry, authType: "oauth", authRef };
+    entry = { ...entry, authType: "oauth", authRef, templateId };
   }
-  const idx = registry.providers.findIndex((pr) => pr.id === providerId);
+  const idx = registry.providers.findIndex((pr) => pr.id === registryId);
   if (idx >= 0) registry.providers[idx] = entry;
   else registry.providers.push(entry);
   saveRegistry(registry);
   return entry;
 }
 async function authenticateProvider(providerId, options = {}) {
+  const registryId = toOAuthRegistryId(providerId);
   if (!supportsNativeOAuth(providerId)) {
     if (findOpencodeBinary()) {
       const cred2 = await runOpencodeAuthBroker(providerId, { method: options.brokerMethod });
-      const saved2 = await saveProviderCredential(oauthAuthRef(providerId), oauthCredentialToKeychainJson(cred2));
+      const saved2 = await saveProviderCredential(oauthAuthRef(registryId), oauthCredentialToKeychainJson(cred2));
       if (!saved2) {
         p9.log.warn("Could not save OAuth tokens to Keychain \u2014 session may not persist.");
       }
       const registryProvider2 = await upsertOAuthProvider(providerId, cred2);
-      return { providerId, credential: cred2, registryProvider: registryProvider2 };
+      return { providerId: registryId, credential: cred2, registryProvider: registryProvider2 };
     }
     throw new Error(
       `Native OAuth is only built in for xai and openai. Install OpenCode for other OAuth providers.`
@@ -7830,7 +8465,7 @@ async function authenticateProvider(providerId, options = {}) {
     }
   }
   const cred = method === "broker" ? await runOpencodeAuthBroker(providerId, { method: options.brokerMethod }) : await runNativeDeviceCode(providerId);
-  const saved = await saveProviderCredential(oauthAuthRef(providerId), oauthCredentialToKeychainJson(cred));
+  const saved = await saveProviderCredential(oauthAuthRef(registryId), oauthCredentialToKeychainJson(cred));
   if (!saved) {
     p9.log.warn("Could not save OAuth tokens to Keychain \u2014 session may not persist.");
   }
@@ -7838,12 +8473,12 @@ async function authenticateProvider(providerId, options = {}) {
   const refreshSpinner = p9.spinner();
   refreshSpinner.start("Refreshing model list...");
   try {
-    await refreshProviderModels(providerId, cred.access);
+    await refreshProviderModels(registryId, cred.access);
     refreshSpinner.stop("Models refreshed");
   } catch {
     refreshSpinner.stop("Could not refresh models \u2014 run relay-ai providers refresh-models later");
   }
-  return { providerId, credential: cred, registryProvider };
+  return { providerId: registryId, credential: cred, registryProvider };
 }
 function providerAuthHelpText() {
   return `${pc9.bold("relay-ai providers auth")} \u2014 sign in with OAuth
@@ -8536,7 +9171,7 @@ import * as p13 from "@clack/prompts";
 import { createServer as createServer3 } from "http";
 
 // src/codex-responses-adapter.ts
-import { streamText as streamText2, generateText as generateText2, tool as tool2, jsonSchema as jsonSchema2 } from "ai";
+import { streamText as streamText3, generateText as generateText3, tool as tool3, jsonSchema as jsonSchema3 } from "ai";
 function messageText(content) {
   if (typeof content === "string") return content;
   return (content ?? []).map((p19) => p19.type === "output_text" || p19.type === "input_text" || p19.type === "text" ? p19.text ?? "" : "").join("");
@@ -8660,9 +9295,9 @@ function translateResponsesTools(tools) {
   const out = {};
   for (const t of tools) {
     if (t.type !== "function" || !t.name) continue;
-    out[t.name] = tool2({
+    out[t.name] = tool3({
       description: t.description ?? "",
-      inputSchema: jsonSchema2(t.parameters ?? { type: "object", properties: {} })
+      inputSchema: jsonSchema3(t.parameters ?? { type: "object", properties: {} })
     });
   }
   return Object.keys(out).length ? out : void 0;
@@ -8905,24 +9540,24 @@ async function writeResponsesStream(fullStream, modelId, write) {
     });
     outputItems.unshift(reasoningItem);
   }
-  for (const tool3 of toolStates) {
+  for (const tool4 of toolStates) {
     emit("response.function_call_arguments.done", {
       type: "response.function_call_arguments.done",
-      item_id: tool3.itemId,
-      output_index: tool3.outputIndex,
-      arguments: tool3.args
+      item_id: tool4.itemId,
+      output_index: tool4.outputIndex,
+      arguments: tool4.args
     });
     const fcItem = {
       type: "function_call",
-      id: tool3.itemId,
-      call_id: tool3.callId,
-      name: tool3.name,
-      arguments: tool3.args,
+      id: tool4.itemId,
+      call_id: tool4.callId,
+      name: tool4.name,
+      arguments: tool4.args,
       status: "completed"
     };
     emit("response.output_item.done", {
       type: "response.output_item.done",
-      output_index: tool3.outputIndex,
+      output_index: tool4.outputIndex,
       item: fcItem
     });
     outputItems.push(fcItem);
@@ -8941,7 +9576,7 @@ async function writeResponsesStream(fullStream, modelId, write) {
   });
 }
 async function streamResponsesResponse(model, params, modelId, write) {
-  const result = streamText2({ model, ...params });
+  const result = streamText3({ model, ...params });
   Promise.resolve(result.text).catch(() => {
   });
   Promise.resolve(result.toolCalls).catch(() => {
@@ -8955,7 +9590,7 @@ async function streamResponsesResponse(model, params, modelId, write) {
   await writeResponsesStream(result.fullStream, modelId, write);
 }
 async function generateResponsesResponse(model, params, modelId) {
-  const r = await generateText2({ model, ...params });
+  const r = await generateText3({ model, ...params });
   const createdAt = Math.floor(Date.now() / 1e3);
   const responseId = newResponseId();
   const output = [];
@@ -9143,6 +9778,24 @@ async function startCodexProxy(routes, options = {}) {
       if (debug) {
         log17(`-> ${req.method} ${url} content-type=${req.headers["content-type"] ?? "(none)"} content-encoding=${req.headers["content-encoding"] ?? "(none)"} content-length=${req.headers["content-length"] ?? "(none)"}`);
       }
+      if (!requireAuth && req.method === "POST") {
+        const origin = req.headers.origin;
+        const referer = req.headers.referer;
+        const isValidLoopback = (uStr) => {
+          if (!uStr) return true;
+          try {
+            const parsed = new URL(Array.isArray(uStr) ? uStr[0] : uStr);
+            const h = parsed.hostname;
+            return h === "127.0.0.1" || h === "localhost" || h === "::1";
+          } catch {
+            return false;
+          }
+        };
+        if (!isValidLoopback(origin) || !isValidLoopback(referer)) {
+          sendJson(res, 403, { error: { message: "Forbidden origin", type: "invalid_request_error" } });
+          return;
+        }
+      }
       if (req.method === "GET" && url === "/health") {
         sendJson(res, 200, { ok: true });
         return;
@@ -9220,6 +9873,9 @@ async function startCodexProxy(routes, options = {}) {
         const modelId = String(body.model ?? "");
         const resolved = resolveModel(routes, models, modelId);
         if (!resolved) {
+          if (debug) {
+            log17(`resolveModel failed: requested="${modelId}" known=[${routes.map((r) => r.modelId).join(", ")}]`);
+          }
           sendJson(res, 404, { error: { message: `Unknown model: ${modelId}`, type: "invalid_request_error" } });
           return;
         }
@@ -9337,7 +9993,7 @@ function resolveCodexRoute(provider, model, apiKey) {
     reasoning: model.reasoning,
     interleavedReasoningField: model.interleavedReasoningField
   };
-  if (provider.id === "openai" && provider.authType !== "oauth" && model.modelFormat === "openai") {
+  if (model.npm === "@ai-sdk/openai" && provider.authType !== "oauth" && model.modelFormat === "openai") {
     return { tier: "direct", ...base };
   }
   return { tier: "proxy", ...base };
@@ -9372,6 +10028,7 @@ function codexProviderEnvKey(providerId) {
   const known = {
     openai: "OPENAI_API_KEY",
     xai: "XAI_API_KEY",
+    "xai-oauth": "XAI_API_KEY",
     anthropic: "ANTHROPIC_API_KEY",
     google: "GEMINI_API_KEY"
   };
@@ -9672,7 +10329,7 @@ function launchCodex(modelId, env, extraArgs) {
 // src/codex/prompts.ts
 import pc11 from "picocolors";
 import * as p11 from "@clack/prompts";
-async function pickCodexProvider(providers, prefs, hasFavorites = false) {
+async function pickCodexProvider(providers, prefs, hasFavorites = false, initialProviderId) {
   if (providers.length === 0 && !hasFavorites) return null;
   const options = providers.map((lp) => providerSelectOption(lp));
   if (hasFavorites) {
@@ -9682,7 +10339,7 @@ async function pickCodexProvider(providers, prefs, hasFavorites = false) {
       hint: `${prefs.favoriteModels?.length ?? 0} saved favorites`
     });
   }
-  const initial = prefs.lastCodexProvider && options.some((o) => o.value === prefs.lastCodexProvider) ? prefs.lastCodexProvider : options[0].value;
+  const initial = initialProviderId && options.some((o) => o.value === initialProviderId) ? initialProviderId : prefs.lastCodexProvider && options.some((o) => o.value === prefs.lastCodexProvider) ? prefs.lastCodexProvider : options[0].value;
   const chosen = await p11.select({
     message: "Which provider for Codex?",
     options,
@@ -9698,32 +10355,43 @@ async function pickCodexProvider(providers, prefs, hasFavorites = false) {
 async function pickCodexModel(provider, prefs) {
   const recentIds = (prefs.recentModelsByProvider?.[provider.id] ?? []).slice(0, 3);
   const recentModels = recentIds.map((id) => provider.models.find((m) => m.id === id)).filter((m) => m !== void 0);
-  let selectedModel;
-  if (recentModels.length > 0) {
-    const options = [
-      ...recentModels.map((m) => modelSelectOption(m, "recent")),
-      navOption("__browse_all__", "Browse all models \u2192", `${provider.models.length} available`)
-    ];
-    const picked = await p11.select({
-      message: `Model for ${provider.name}?`,
-      options,
-      initialValue: recentModels[0].id
-    });
-    if (p11.isCancel(picked)) {
-      p11.cancel("Cancelled.");
-      return null;
-    }
-    if (String(picked) === "__browse_all__") {
+  let selectedModel = null;
+  while (true) {
+    if (recentModels.length > 0) {
+      const options = [
+        ...recentModels.map((m) => modelSelectOption(m, "recent")),
+        navOption("__browse_all__", "Browse all models \u2192", `${provider.models.length} available`),
+        navOption("__back__", "\u2190 Go back", "Select a different provider")
+      ];
+      const picked = await p11.select({
+        message: `Model for ${provider.name}?`,
+        options,
+        initialValue: recentModels[0].id
+      });
+      if (p11.isCancel(picked) || String(picked) === "__back__") {
+        return "back";
+      }
+      if (String(picked) === "__browse_all__") {
+        const browsed = await browseAllModels(provider, prefs);
+        if (browsed === "back") {
+          continue;
+        }
+        if (!browsed) return null;
+        selectedModel = browsed;
+        break;
+      } else {
+        selectedModel = recentModels.find((m) => m.id === String(picked));
+        break;
+      }
+    } else {
       const browsed = await browseAllModels(provider, prefs);
+      if (browsed === "back") {
+        return "back";
+      }
       if (!browsed) return null;
       selectedModel = browsed;
-    } else {
-      selectedModel = recentModels.find((m) => m.id === String(picked));
+      break;
     }
-  } else {
-    const browsed = await browseAllModels(provider, prefs);
-    if (!browsed) return null;
-    selectedModel = browsed;
   }
   return selectedModel;
 }
@@ -9846,13 +10514,18 @@ function buildFavoritesAppCatalog(resolved) {
 // src/codex/favorites-launch.ts
 import * as p12 from "@clack/prompts";
 function buildCodexProxyRoutesFromResolved(resolved, providersById) {
-  return resolved.map((r) => {
+  const skippedOAuth = [];
+  const routes = resolved.map((r) => {
     const provider = providersById.get(r.providerId);
     if (!provider) return void 0;
     const model = r.model;
+    if (!r.apiKey && provider.authType === "oauth") {
+      skippedOAuth.push(`${r.providerId}/${model.id}`);
+      return void 0;
+    }
     const route = resolveCodexRoute(provider, model, r.apiKey);
     return {
-      modelId: route.modelId,
+      modelId: codexCliFavoritesSlug(r.providerId, model.id),
       npm: route.npm,
       apiKey: route.apiKey,
       baseURL: route.baseURL,
@@ -9862,6 +10535,12 @@ function buildCodexProxyRoutesFromResolved(resolved, providersById) {
       oauthAccountId: route.oauthAccountId
     };
   }).filter((r) => r !== void 0);
+  if (skippedOAuth.length > 0) {
+    p12.log.warn(
+      `Skipped ${skippedOAuth.length} OAuth favorite(s) (OAuth auth not supported in favorites catalog): ${skippedOAuth.join(", ")}`
+    );
+  }
+  return routes;
 }
 function resolveCodexFavorites(activeProvider, selectedModel, compatible, favorites, agent, zenGoApiKey) {
   const ctx = {
@@ -10381,26 +11060,35 @@ Error: ${launchPlan.error}
       p13.log.step(`Using ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
     }
   } else if (!configOnly) {
-    const pickedProvider = await pickCodexProvider(compatible, prefs, favoritesActive);
-    if (!pickedProvider) return 0;
-    if (pickedProvider === "__favorites__") {
-      const favoriteProviders = compatible.map((provider) => ({
-        ...provider,
-        models: routableModelsForProvider(provider, "codex")
-      }));
-      const favoriteStart = resolveFirstAvailableFavorite(favorites, favoriteProviders);
-      if (!favoriteStart) {
-        p13.log.warn("No saved Codex favorites are currently available.");
-        return 0;
+    let currentInitialProvider = prefs.lastCodexProvider && compatible.some((o) => o.id === prefs.lastCodexProvider) ? prefs.lastCodexProvider : compatible[0].id;
+    while (true) {
+      const pickedProvider = await pickCodexProvider(compatible, prefs, favoritesActive, currentInitialProvider);
+      if (!pickedProvider) return 0;
+      if (pickedProvider === "__favorites__") {
+        const favoriteProviders = compatible.map((provider) => ({
+          ...provider,
+          models: routableModelsForProvider(provider, "codex")
+        }));
+        const favoriteStart = resolveFirstAvailableFavorite(favorites, favoriteProviders);
+        if (!favoriteStart) {
+          p13.log.warn("No saved Codex favorites are currently available.");
+          return 0;
+        }
+        activeProvider = favoriteStart.provider;
+        selectedModel = favoriteStart.model;
+        p13.log.step(`Loaded Favorites Catalog. Starting model: ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
+        break;
+      } else {
+        activeProvider = pickedProvider;
+        const pickedModelResult = await pickCodexModel(activeProvider, prefs);
+        if (pickedModelResult === "back") {
+          currentInitialProvider = activeProvider.id;
+          continue;
+        }
+        if (!pickedModelResult) return 0;
+        selectedModel = pickedModelResult;
+        break;
       }
-      activeProvider = favoriteStart.provider;
-      selectedModel = favoriteStart.model;
-      p13.log.step(`Loaded Favorites Catalog. Starting model: ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
-    } else {
-      activeProvider = pickedProvider;
-      const pickedModel = await pickCodexModel(activeProvider, prefs);
-      if (!pickedModel) return 0;
-      selectedModel = pickedModel;
     }
   }
   let resolvedFavorites = [];
@@ -11045,9 +11733,9 @@ function openCodexAppAt(path) {
   }
   if (process.platform === "win32") {
     if (path.startsWith("shell:AppsFolder\\")) {
-      runPowerShell(`Start-Process ${JSON.stringify(path)}`);
+      runPowerShell(`Start-Process '${path.replace(/'/g, "''")}'`);
     } else {
-      runPowerShell(`Start-Process -FilePath ${JSON.stringify(path)}`);
+      runPowerShell(`Start-Process -FilePath '${path.replace(/'/g, "''")}'`);
     }
   }
 }
@@ -11380,23 +12068,32 @@ async function runCodexAppCommand(args, opts = {}) {
   );
   let selectedModel = activeProvider.models.find((m) => m.id === prefs.lastCodexModel) ?? activeProvider.models[0];
   if (!configOnly) {
-    const pickedProvider = await pickCodexProvider(compatible, prefs, favoritesActive);
-    if (!pickedProvider) return 0;
-    if (pickedProvider === "__favorites__") {
-      const favoriteProviders = compatible.map(providerForCodexPicker);
-      const favoriteStart = resolveFirstAvailableFavorite(favorites, favoriteProviders);
-      if (!favoriteStart) {
-        p15.log.warn("No saved Codex App favorites are currently available.");
-        return 0;
+    let currentInitialProvider = prefs.lastCodexProvider && compatible.some((o) => o.id === prefs.lastCodexProvider) ? prefs.lastCodexProvider : compatible[0].id;
+    while (true) {
+      const pickedProvider = await pickCodexProvider(compatible, prefs, favoritesActive, currentInitialProvider);
+      if (!pickedProvider) return 0;
+      if (pickedProvider === "__favorites__") {
+        const favoriteProviders = compatible.map(providerForCodexPicker);
+        const favoriteStart = resolveFirstAvailableFavorite(favorites, favoriteProviders);
+        if (!favoriteStart) {
+          p15.log.warn("No saved Codex App favorites are currently available.");
+          return 0;
+        }
+        activeProvider = favoriteStart.provider;
+        selectedModel = favoriteStart.model;
+        p15.log.step(`Loaded Favorites Catalog. Starting model: ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
+        break;
+      } else {
+        activeProvider = providerForCodexPicker(pickedProvider);
+        const pickedModelResult = await pickCodexModel(activeProvider, prefs);
+        if (pickedModelResult === "back") {
+          currentInitialProvider = activeProvider.id;
+          continue;
+        }
+        if (!pickedModelResult) return 0;
+        selectedModel = pickedModelResult;
+        break;
       }
-      activeProvider = favoriteStart.provider;
-      selectedModel = favoriteStart.model;
-      p15.log.step(`Loaded Favorites Catalog. Starting model: ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
-    } else {
-      activeProvider = providerForCodexPicker(pickedProvider);
-      const pickedModel = await pickCodexModel(activeProvider, prefs);
-      if (!pickedModel) return 0;
-      selectedModel = pickedModel;
     }
   }
   const regEntry = loadRegistry().providers.find((pr) => pr.id === activeProvider.id);
@@ -11575,7 +12272,7 @@ import * as p17 from "@clack/prompts";
 import { existsSync as existsSync16, readFileSync as readFileSync13, writeFileSync as writeFileSync7, mkdirSync as mkdirSync9 } from "fs";
 import { homedir as homedir11 } from "os";
 import { join as join17, dirname as dirname7 } from "path";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 function getClaudeDesktopHome() {
   if (process.platform === "win32") {
     return join17(process.env.APPDATA || join17(homedir11(), "AppData", "Roaming"), "Claude-3p");
@@ -11613,7 +12310,7 @@ function buildRelayAiConfig(proxyPort) {
   };
 }
 function writeRelayAiConfig(proxyPort) {
-  const uuid = randomUUID();
+  const uuid = randomUUID2();
   const configPath = join17(getConfigLibraryPath(), `${uuid}.json`);
   const config = buildRelayAiConfig(proxyPort);
   mkdirSync9(dirname7(configPath), { recursive: true });
@@ -11878,9 +12575,9 @@ function openClaudeAppAt(path) {
   }
   if (process.platform === "win32") {
     if (path.startsWith("shell:AppsFolder\\")) {
-      runPowerShell2(`Start-Process ${JSON.stringify(path)}`);
+      runPowerShell2(`Start-Process '${path.replace(/'/g, "''")}'`);
     } else {
-      runPowerShell2(`Start-Process -FilePath ${JSON.stringify(path)}`);
+      runPowerShell2(`Start-Process -FilePath '${path.replace(/'/g, "''")}'`);
     }
   }
 }
@@ -13002,7 +13699,7 @@ async function launchClaudeViaCatalog(catalogRoutes, startingRoute, contextWindo
   const childEnv = buildChildEnv(
     `http://127.0.0.1:${proxyHandle.port}`,
     startingRoute.aliasId,
-    "catalog-proxy",
+    proxyHandle.token,
     proxyHandle.port,
     contextWindow,
     true
@@ -13086,39 +13783,86 @@ async function runModelsCommand() {
       });
       if (p18.isCancel(addPath)) continue;
       let provider;
-      let browsed;
+      let browsedMultiple = [];
       if (addPath === "global") {
         const globalPick = await pickGlobalFavoriteModel(allProviders, favorites);
         if (globalPick === null) continue;
         if (globalPick !== ADD_BY_PROVIDER) {
           provider = allProviders.find((ap) => ap.id === globalPick.providerId);
-          browsed = globalPick.model;
+          browsedMultiple = [globalPick.model];
         }
       }
-      if (!browsed) {
-        const providerOptions = allProviders.map((ap) => providerSelectOption(ap));
-        const pickedProviderId = await p18.select({
-          message: "Which provider?",
-          options: providerOptions
-        });
-        if (p18.isCancel(pickedProviderId)) continue;
-        provider = allProviders.find((ap) => ap.id === pickedProviderId);
-        browsed = await browseAllModels(provider, prefs) ?? void 0;
-        if (!browsed) continue;
+      if (browsedMultiple.length === 0) {
+        let currentInitialProvider = void 0;
+        while (true) {
+          const providerOptions = allProviders.map((ap) => providerSelectOption(ap));
+          const pickedProviderId = await p18.select({
+            message: "Which provider?",
+            options: providerOptions,
+            initialValue: currentInitialProvider
+          });
+          if (p18.isCancel(pickedProviderId)) break;
+          provider = allProviders.find((ap) => ap.id === pickedProviderId);
+          const options2 = provider.models.map((m) => {
+            const favorited = isFavorite(favorites, { providerId: provider.id, modelId: m.id });
+            const label = formatCodexModelLabel(m);
+            return {
+              value: m.id,
+              label: fmtModel(label, m.id),
+              hint: favorited ? pc16.yellow("\u2605 already favorite") : ""
+            };
+          });
+          const pickedModelIds = await p18.multiselect({
+            message: `Select models to add from ${provider.name} ${pc16.dim("(Space to select, Enter to confirm)")}`,
+            options: options2,
+            required: false
+          });
+          if (p18.isCancel(pickedModelIds)) {
+            currentInitialProvider = provider.id;
+            continue;
+          }
+          if (pickedModelIds.length === 0) {
+            currentInitialProvider = provider.id;
+            continue;
+          }
+          browsedMultiple = provider.models.filter((m) => pickedModelIds.includes(m.id));
+          break;
+        }
+        if (browsedMultiple.length === 0) continue;
       }
-      const fav = { providerId: provider.id, modelId: browsed.id };
-      const result = addFavorite(favorites, fav);
-      if (!result.ok) {
-        if (result.reason === "duplicate") {
-          p18.log.warn(`${browsed.name || browsed.id} is already in your favorites.`);
+      const addedModels = [];
+      let duplicateCount = 0;
+      let limitReached = false;
+      for (const model of browsedMultiple) {
+        const fav = { providerId: provider.id, modelId: model.id };
+        const result = addFavorite(favorites, fav);
+        if (!result.ok) {
+          if (result.reason === "duplicate") {
+            duplicateCount++;
+          } else {
+            limitReached = true;
+            break;
+          }
         } else {
-          p18.log.warn(`Limit of ${MAX_MODEL_CATALOG} favorites reached \u2014 remove one first.`);
+          favorites = result.list;
+          favoritesDirty = true;
+          addedModels.push(model);
         }
-        continue;
       }
-      favorites = result.list;
-      favoritesDirty = true;
-      p18.log.success(`Added ${browsed.name || browsed.id} (${provider.name}) to favorites.`);
+      if (addedModels.length > 0) {
+        if (addedModels.length === 1) {
+          const modelName = addedModels[0].name || addedModels[0].id;
+          p18.log.success(`Added ${modelName} (${provider.name}) to favorites.`);
+        } else {
+          p18.log.success(`Added ${addedModels.length} models from ${provider.name} to favorites.`);
+        }
+      }
+      if (duplicateCount > 0) {
+        p18.log.warn(`${duplicateCount} selected model(s) were already in your favorites.`);
+      }
+      if (limitReached) {
+        p18.log.warn(`Limit of ${MAX_MODEL_CATALOG} favorites reached \u2014 some selected models could not be added.`);
+      }
     } else if (choice.startsWith("fav-")) {
       const idx = parseInt(choice.slice(4), 10);
       const fav = favorites[idx];
@@ -13226,31 +13970,40 @@ Error: ${launchPlan.error}
     }
     if (!dryRun) recordLaunchSelection("claude", activeProvider.id, selectedModel.id, prefs);
   } else {
-    const chosen = await p18.select({
-      message: "Which provider?",
-      options: providerOptions,
-      initialValue: initialProvider
-    });
-    if (p18.isCancel(chosen)) {
-      p18.cancel("Cancelled.");
-      return 0;
-    }
-    const providerChoice = chosen;
-    if (providerChoice === "__favorites__") {
-      const favoriteStart = resolveFirstAvailableFavorite(favorites, allProviders);
-      if (!favoriteStart) {
-        p18.log.warn("No saved favorites are currently available.");
+    let currentInitialProvider = initialProvider;
+    while (true) {
+      const chosen = await p18.select({
+        message: "Which provider?",
+        options: providerOptions,
+        initialValue: currentInitialProvider
+      });
+      if (p18.isCancel(chosen)) {
+        p18.cancel("Cancelled.");
         return 0;
       }
-      activeProvider = favoriteStart.provider;
-      selectedModel = favoriteStart.model;
-      p18.log.step(`Loaded Favorites Catalog. Starting model: ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
-    } else {
-      activeProvider = allProviders.find((lp) => lp.id === providerChoice);
-      const pickedModel = await pickLocalModel(activeProvider, conflicts, prefs);
-      if (!pickedModel) return 0;
-      selectedModel = pickedModel;
-      if (!dryRun) recordLaunchSelection("claude", activeProvider.id, selectedModel.id, prefs);
+      const providerChoice = chosen;
+      if (providerChoice === "__favorites__") {
+        const favoriteStart = resolveFirstAvailableFavorite(favorites, allProviders);
+        if (!favoriteStart) {
+          p18.log.warn("No saved favorites are currently available.");
+          return 0;
+        }
+        activeProvider = favoriteStart.provider;
+        selectedModel = favoriteStart.model;
+        p18.log.step(`Loaded Favorites Catalog. Starting model: ${selectedModel.name || selectedModel.id} (${activeProvider.name})`);
+        break;
+      } else {
+        activeProvider = allProviders.find((lp) => lp.id === providerChoice);
+        const pickedModelResult = await pickLocalModel(activeProvider, conflicts, prefs);
+        if (pickedModelResult === "back") {
+          currentInitialProvider = activeProvider.id;
+          continue;
+        }
+        if (!pickedModelResult) return 0;
+        selectedModel = pickedModelResult;
+        if (!dryRun) recordLaunchSelection("claude", activeProvider.id, selectedModel.id, prefs);
+        break;
+      }
     }
   }
   const localProviders = catalog.localProviders.length > 0 ? catalog.localProviders : null;
@@ -13346,7 +14099,8 @@ Error: ${launchPlan.error}
           supportedParameters: selectedModel.supportedParameters,
           reasoning: selectedModel.reasoning,
           interleavedReasoningField: selectedModel.interleavedReasoningField
-        }
+        },
+        launchApiKey
       );
       if (!isAgentStdoutMode()) {
         p18.log.info(
@@ -13360,7 +14114,7 @@ Error: ${launchPlan.error}
     childEnv = buildChildEnv(
       `http://127.0.0.1:${proxyHandle.port}`,
       selectedModel.id,
-      launchApiKey,
+      proxyHandle.token,
       proxyHandle.port,
       selectedModel.contextWindow
     );