@khanglvm/llm-router 1.1.0 → 1.2.0

package/src/cli/router-module.js

@@ -37,6 +37,7 @@ import {
   sanitizeConfigForDisplay,
   validateRuntimeConfig
 } from "../runtime/config.js";
+import { CODEX_SUBSCRIPTION_MODELS } from "../runtime/subscription-constants.js";
 import { FORMATS } from "../translator/index.js";
 import {
   CLOUDFLARE_ACCOUNT_ID_ENV_NAME,
@@ -80,28 +81,23 @@ const MODEL_ALIAS_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
 const MODEL_ROUTING_STRATEGY_OPTIONS = [
   {
     value: "auto",
-    label: "Auto",
-    hint: "Recommended set-and-forget mode. Uses quota, cooldown, and health signals to avoid rate limits."
+    label: "Auto"
   },
   {
     value: "ordered",
-    label: "Ordered",
-    hint: "Try targets in the listed order. Move to the next one only when earlier targets are unavailable."
+    label: "Ordered"
   },
   {
     value: "round-robin",
-    label: "Round-robin",
-    hint: "Rotate evenly across eligible targets."
+    label: "Round-robin"
   },
   {
     value: "weighted-rr",
-    label: "Weighted round-robin",
-    hint: "Rotate across eligible targets, but favor higher weights."
+    label: "Weighted round-robin"
   },
   {
     value: "quota-aware-weighted-rr",
-    label: "Quota-aware weighted round-robin",
-    hint: "Like weighted round-robin, but also shifts traffic away from targets nearing limits."
+    label: "Quota-aware weighted round-robin"
   }
 ];
 const MODEL_ALIAS_STRATEGIES = MODEL_ROUTING_STRATEGY_OPTIONS.map((option) => option.value);
@@ -111,6 +107,14 @@ const DEFAULT_AI_HELP_GATEWAY_TEST_TIMEOUT_MS = 6000;
 const PROVIDER_TYPE_STANDARD = "standard";
 const PROVIDER_TYPE_SUBSCRIPTION = "subscription";
 const SUBSCRIPTION_TYPE_CHATGPT_CODEX = "chatgpt-codex";
+const SUBSCRIPTION_PROVIDER_PRESETS = Object.freeze([
+  Object.freeze({
+    subscriptionType: SUBSCRIPTION_TYPE_CHATGPT_CODEX,
+    label: "ChatGPT",
+    defaultName: "GPT Sub",
+    defaultModels: CODEX_SUBSCRIPTION_MODELS
+  })
+]);
 const RATE_LIMIT_WINDOW_UNIT_ALIASES = new Map([
   ["s", "second"],
   ["sec", "second"],
@@ -358,6 +362,18 @@ function normalizeSubscriptionTypeInput(value) {
   return "";
 }
 
+function getSubscriptionProviderPreset(subscriptionType) {
+  return SUBSCRIPTION_PROVIDER_PRESETS.find((preset) => preset.subscriptionType === subscriptionType) || null;
+}
+
+function getDefaultSubscriptionModelListInput(existingProvider) {
+  const existingModels = dedupeList((existingProvider?.models || []).map((model) => model?.id).filter(Boolean));
+  const defaults = existingModels.length > 0
+    ? existingModels
+    : CODEX_SUBSCRIPTION_MODELS;
+  return defaults.join(",");
+}
+
 function normalizeNameForCompare(value) {
   return String(value || "").trim().toLowerCase();
 }
@@ -376,20 +392,7 @@ function findProviderByFriendlyName(providers, name, { excludeId = "" } = {}) {
 }
 
 function printProviderInputGuidance(context) {
-  if (!canPrompt()) return;
-  const info = typeof context?.terminal?.info === "function" ? context.terminal.info.bind(context.terminal) : null;
-  const line = typeof context?.terminal?.line === "function" ? context.terminal.line.bind(context.terminal) : null;
-  const warn = typeof context?.terminal?.warn === "function" ? context.terminal.warn.bind(context.terminal) : null;
-  if (!line) return;
-
-  info?.("Provider config tips:");
-  line("  - Provider Friendly Name is shown in the management screen and must be unique.");
-  line("  - Provider ID is auto-generated by slugifying the friendly name; you can edit it.");
-  line("  - Provider type can be standard (API key + endpoint) or subscription (OAuth-backed ChatGPT Codex).");
-  line("  - Examples:");
-  line("    Friendly Name: OpenRouter Primary, RamClouds Production");
-  line("    Provider ID: openrouterPrimary, ramcloudsProd, chatgptPersonal");
-  line("    API Key: sk-or-v1-xxxxxxxx, sk-ant-api03-xxxxxxxx, sk-xxxxxxxx");
+  void context;
 }
 
 function trimOuterPunctuation(value) {
@@ -473,6 +476,26 @@ export function parseEndpointListInput(raw) {
   return normalized;
 }
 
+function isValidHttpUrl(value) {
+  try {
+    const parsed = new URL(String(value || ""));
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") && Boolean(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+function validateEndpointListInput(raw, { allowEmpty = false } = {}) {
+  const parsed = parseEndpointListInput(raw);
+  if (parsed.length === 0) {
+    return allowEmpty ? undefined : "Enter at least one valid endpoint URL (http:// or https://).";
+  }
+  if (!parsed.every((item) => isValidHttpUrl(item))) {
+    return "One or more endpoints are invalid. Use full http:// or https:// URLs.";
+  }
+  return undefined;
+}
+
 const MODEL_INPUT_NOISE_TOKENS = new Set([
   "discover",
   "progress",
@@ -571,6 +594,14 @@ function parseProviderModelListInput(raw) {
     .filter(Boolean));
 }
 
+function validateProviderModelListInput(raw, { allowEmpty = false } = {}) {
+  const parsed = parseProviderModelListInput(raw);
+  if (parsed.length === 0) {
+    return allowEmpty ? undefined : "Enter at least one valid model id.";
+  }
+  return undefined;
+}
+
 function normalizeQualifiedModelToken(token) {
   const value = trimOuterPunctuation(token)
     .replace(/[)\]}>.,;:]+$/g, "")
@@ -758,7 +789,7 @@ function maybeReportInputCleanup(context, label, rawValue, cleanedValues) {
   if ((cleanedValues || []).length > 0) {
     info?.(`Cleaned ${label} input: parsed ${(cleanedValues || []).length} item(s) from free-form text.`);
   } else {
-    warn?.(`Could not parse any ${label} from the provided text. Use comma/semicolon/space/newline-separated values.`);
+    warn?.(`Could not parse any ${label} from the provided text. Use comma-separated values (for example: a,b,c).`);
   }
 }
 
@@ -1011,10 +1042,9 @@ async function runProbeManualFallback(context, {
   if (unresolvedModels.length > 0) {
     info?.(`Manual fallback needs unresolved model review (${unresolvedModels.length} item(s)).`);
     const unresolvedInput = await context.prompts.text({
-      message: "Undetected models to add manually (comma / newline separated; leave blank to skip)",
-      initialValue: unresolvedModels.join("\n"),
-      paste: true,
-      multiline: true
+      message: "Add unresolved models (comma-separated, optional)",
+      initialValue: unresolvedModels.join(","),
+      validate: (value) => validateProviderModelListInput(value, { allowEmpty: true })
     });
     const manualModels = parseProviderModelListInput(unresolvedInput);
     maybeReportInputCleanup(context, "model", unresolvedInput, manualModels);
@@ -1026,7 +1056,7 @@ async function runProbeManualFallback(context, {
     const openaiInput = await context.prompts.text({
       message: "OpenAI-compatible endpoint for unresolved items (optional)",
       initialValue: "",
-      paste: true
+      validate: (value) => validateEndpointListInput(value, { allowEmpty: true })
     });
     openaiBase = parseEndpointListInput(openaiInput)[0] || "";
   }
@@ -1036,7 +1066,7 @@ async function runProbeManualFallback(context, {
     const claudeInput = await context.prompts.text({
       message: "Anthropic-compatible endpoint for unresolved items (optional)",
       initialValue: "",
-      paste: true
+      validate: (value) => validateEndpointListInput(value, { allowEmpty: true })
     });
     claudeBase = parseEndpointListInput(claudeInput)[0] || "";
   }
@@ -1059,13 +1089,11 @@ async function runProbeManualFallback(context, {
 
 function slugifyId(value, fallback = "provider") {
   const slug = String(value || fallback)
+    .toLowerCase()
     .trim()
-    .replace(/[^a-zA-Z0-9]+/g, "-")
+    .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-+|-+$/g, "");
-  if (!slug) return fallback;
-  return /^[A-Z]/.test(slug)
-    ? slug.charAt(0).toLowerCase() + slug.slice(1)
-    : slug;
+  return slug || fallback;
 }
 
 function sanitizeRateLimitBucketName(value) {
@@ -1082,6 +1110,23 @@ function slugifyRateLimitBucketId(value, fallback = "bucket") {
   return slug || fallback;
 }
 
+function resolveUniqueProviderId(baseId, providers, { excludeId = "" } = {}) {
+  const normalizedBase = slugifyId(baseId || "provider");
+  const excluded = String(excludeId || "").trim();
+  const reservedIds = new Set((providers || [])
+    .map((provider) => String(provider?.id || "").trim())
+    .filter((id) => id && id !== excluded));
+  if (!reservedIds.has(normalizedBase)) return normalizedBase;
+
+  let suffix = 2;
+  let candidate = `${normalizedBase}-${suffix}`;
+  while (reservedIds.has(candidate)) {
+    suffix += 1;
+    candidate = `${normalizedBase}-${suffix}`;
+  }
+  return candidate;
+}
+
 function resolveUniqueRateLimitBucketId(baseId, reservedIds) {
   const normalizedBase = String(baseId || "").trim() || "bucket";
   if (!(reservedIds instanceof Set)) return normalizedBase;
@@ -1136,69 +1181,294 @@ function formatRateLimitBucketScopeLabel(bucket) {
   return models.length > 0 ? models.join(", ") : "(none)";
 }
 
-export function summarizeConfig(config, configPath, { includeSecrets = false } = {}) {
-  const target = includeSecrets ? config : sanitizeConfigForDisplay(config);
-  const lines = [];
-  lines.push(`Config: ${configPath}`);
-  lines.push(`Version: ${target.version || 1}`);
-  lines.push(`Default model: ${target.defaultModel || "(not set)"}`);
-  lines.push(`Master key: ${target.masterKey || "(not set)"}`);
+function formatRequestFormatLabel(value) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (!normalized) return "";
+  if (normalized === FORMATS.OPENAI) return "OpenAI";
+  if (normalized === FORMATS.CLAUDE) return "Claude";
+  return normalized;
+}
 
-  if (!target.providers || target.providers.length === 0) {
-    lines.push("Providers: (none)");
-  } else {
-    lines.push("Providers:");
-    for (const provider of target.providers) {
-      const providerType = normalizeProviderTypeInput(provider.type) || PROVIDER_TYPE_STANDARD;
-      lines.push(`- ${provider.id} (${provider.name})`);
-      lines.push(`  type=${providerType}`);
-      if (providerType === PROVIDER_TYPE_SUBSCRIPTION) {
-        lines.push(`  subscriptionType=${provider.subscriptionType || provider.subscription_type || "(not set)"}`);
-        lines.push(`  subscriptionProfile=${provider.subscriptionProfile || provider.subscription_profile || provider.id || "default"}`);
-      }
-      if (provider.baseUrl) {
-        lines.push(`  baseUrl=${provider.baseUrl}`);
-      }
-      if (provider.baseUrlByFormat?.openai) {
-        lines.push(`  openaiBaseUrl=${provider.baseUrlByFormat.openai}`);
-      }
-      if (provider.baseUrlByFormat?.claude) {
-        lines.push(`  claudeBaseUrl=${provider.baseUrlByFormat.claude}`);
-      }
-      lines.push(`  formats=${(provider.formats || []).join(", ") || provider.format || "unknown"}`);
-      lines.push(`  apiKey=${provider.apiKey || "(from env/hidden)"}`);
-      lines.push(`  models=${(provider.models || []).map((model) => {
-        const fallbacks = (model.fallbackModels || []).join("|");
-        return fallbacks ? `${model.id}{fallback:${fallbacks}}` : model.id;
-      }).join(", ") || "(none)"}`);
-
-      const rateLimits = provider.rateLimits || [];
-      if (rateLimits.length === 0) {
-        lines.push("  rateLimits=(none)");
-      } else {
-        lines.push("  rateLimits:");
-        for (const bucket of rateLimits) {
-          lines.push(
-            `    - ${formatRateLimitBucketLabel(bucket, { includeId: true })}: models=${formatRateLimitBucketScopeLabel(bucket)} cap=${summarizeRateLimitBucketCap(bucket)} window=${formatRateLimitWindowForSummary(bucket.window)}`
-          );
-        }
-      }
-    }
-  }
+function formatRequestFormatList(values, fallback = "") {
+  const formats = dedupeList([
+    ...(Array.isArray(values) ? values : []),
+    ...(fallback ? [fallback] : [])
+  ]).map(formatRequestFormatLabel).filter(Boolean);
+  return formats.join(", ") || "Unknown";
+}
 
-  const aliasEntries = Object.entries(target.modelAliases || {});
-  if (aliasEntries.length === 0) {
-    lines.push("Model aliases: (none)");
-  } else {
-    lines.push("Model aliases:");
-    for (const [aliasId, alias] of aliasEntries) {
-      lines.push(`- ${aliasId} strategy=${alias.strategy || "ordered"}`);
-      lines.push(`  targets=${formatAliasTargetsForSummary(alias.targets)}`);
-      lines.push(`  fallbackTargets=${formatAliasTargetsForSummary(alias.fallbackTargets)}`);
-    }
+function formatProviderTypeLabel(type) {
+  const normalized = normalizeProviderTypeInput(type) || PROVIDER_TYPE_STANDARD;
+  return normalized === PROVIDER_TYPE_SUBSCRIPTION ? "Subscription (OAuth)" : "Standard (API Key)";
+}
+
+function formatModelAliasStrategyLabel(strategy) {
+  const normalized = normalizeModelAliasStrategy(strategy) || "ordered";
+  return MODEL_ROUTING_STRATEGY_OPTIONS.find((option) => option.value === normalized)?.label || normalized;
+}
+
+function formatReportCell(value, { fallback = "-", maxLength = 180 } = {}) {
+  const compact = String(value ?? "")
+    .replace(/\s+/g, " ")
+    .trim();
+  if (!compact) return fallback;
+  if (compact.length <= maxLength) return compact;
+  return `${compact.slice(0, Math.max(1, maxLength - 3))}...`;
+}
+
+function renderAsciiTable(headers, rows, { emptyMessage = "No entries." } = {}) {
+  const normalizedHeaders = (headers || []).map((header) => formatReportCell(header, { fallback: "", maxLength: 120 }));
+  const normalizedRows = (rows || []).map((row) => normalizedHeaders.map((_, index) => {
+    const cell = Array.isArray(row) ? row[index] : undefined;
+    return formatReportCell(cell);
+  }));
+  if (normalizedRows.length === 0) return emptyMessage;
+
+  const widths = normalizedHeaders.map((header, index) => Math.max(
+    header.length,
+    ...normalizedRows.map((row) => row[index].length)
+  ));
+  const border = `+${widths.map((width) => "-".repeat(width + 2)).join("+")}+`;
+  const renderRow = (cells) => `| ${cells.map((cell, index) => cell.padEnd(widths[index])).join(" | ")} |`;
+
+  return [
+    border,
+    renderRow(normalizedHeaders),
+    border,
+    ...normalizedRows.map((row) => renderRow(row)),
+    border
+  ].join("\n");
+}
+
+function buildProviderEndpointRows(provider) {
+  const rows = [];
+  const seenUrls = new Set();
+  const addRow = (label, url) => {
+    const value = String(url || "").trim();
+    if (!value || seenUrls.has(value)) return;
+    seenUrls.add(value);
+    rows.push([label, value]);
+  };
+
+  addRow("OpenAI Endpoint", provider?.baseUrlByFormat?.openai);
+  addRow("Claude Endpoint", provider?.baseUrlByFormat?.claude);
+  addRow("Primary Endpoint", provider?.baseUrl);
+
+  if (rows.length === 0 && normalizeProviderTypeInput(provider?.type) === PROVIDER_TYPE_SUBSCRIPTION) {
+    rows.push(["Endpoint", "Managed by OAuth subscription provider"]);
   }
+  return rows;
+}
+
+function buildProviderModelRows(provider) {
+  const providerFormats = dedupeList([
+    ...(provider?.formats || []),
+    ...(provider?.format ? [provider.format] : [])
+  ]);
+  return (provider?.models || []).map((model) => ([
+    model?.id || "(unknown)",
+    formatRequestFormatList(dedupeList([...(model?.formats || []), ...providerFormats])),
+    dedupeList(model?.fallbackModels || []).join(", ") || "None"
+  ]));
+}
+
+function buildRateLimitBucketRows(rateLimits) {
+  return (rateLimits || []).map((bucket) => {
+    const requests = Number.parseInt(String(bucket?.requests ?? ""), 10);
+    const requestLimit = Number.isFinite(requests) && requests > 0
+      ? `${new Intl.NumberFormat("en-US").format(requests)} requests`
+      : "(unset)";
+    return [
+      formatRateLimitBucketLabel(bucket),
+      String(bucket?.id || "(not set)").trim() || "(not set)",
+      formatRateLimitBucketScopeLabel(bucket),
+      requestLimit,
+      formatRateLimitWindowForHuman(bucket?.window)
+    ];
+  });
+}
+
+function joinReportSections(...sections) {
+  return sections.filter((section) => String(section || "").trim().length > 0).join("\n\n");
+}
+
+function formatYesNo(value) {
+  return value ? "Yes" : "No";
+}
+
+function renderKeyValueSection(title, rows) {
+  return `${title}\n${renderAsciiTable(["Field", "Value"], rows || [])}`;
+}
+
+function renderListSection(title, items, { emptyMessage = "None." } = {}) {
+  const normalized = (items || [])
+    .map((item) => String(item || "").trim())
+    .filter(Boolean);
+  if (normalized.length === 0) return `${title}\n${emptyMessage}`;
+  return `${title}\n${normalized.map((item) => `- ${item}`).join("\n")}`;
+}
+
+function buildOperationReport(title, rows, extraSections = []) {
+  return joinReportSections(
+    title,
+    renderKeyValueSection("Overview", rows),
+    ...extraSections
+  );
+}
+
+function buildModelAliasTargetRows(targets) {
+  return (targets || []).map((target) => ([
+    target?.ref || "(invalid target)",
+    Number.isFinite(target?.weight) ? String(Number(target.weight)) : "Default"
+  ]));
+}
+
+function buildProviderSavedReport({
+  provider,
+  configPath,
+  probe,
+  masterKey
+}) {
+  const detailsRows = [
+    ["Config File", configPath],
+    ["Provider ID", provider?.id || "(unknown)"],
+    ["Provider Name", provider?.name || provider?.id || "(unknown)"],
+    ["Provider Type", formatProviderTypeLabel(provider?.type)],
+    ["Request Formats", formatRequestFormatList(provider?.formats, provider?.format)],
+    ["API Credential", normalizeProviderTypeInput(provider?.type) === PROVIDER_TYPE_SUBSCRIPTION
+      ? "Managed by OAuth session"
+      : (provider?.apiKey || "(from env/hidden)")]
+  ];
+  if (provider?.subscriptionType) detailsRows.push(["Subscription Type", provider.subscriptionType]);
+  if (provider?.subscriptionProfile) detailsRows.push(["Subscription Profile", provider.subscriptionProfile]);
+  detailsRows.push(["Master Key", masterKey || "(not set)"]);
+
+  const probeRows = probe
+    ? [
+      ["Auto-detection", probe.ok ? "Completed" : "Needs review"],
+      ["Preferred Request Format", formatRequestFormatLabel(probe.preferredFormat) || "(unknown)"],
+      ["Working Formats", formatRequestFormatList(probe.workingFormats || [])]
+    ]
+    : [["Auto-detection", "Skipped"]];
+
+  return joinReportSections(
+    "Provider Saved",
+    "Overview\n" + renderAsciiTable(["Field", "Value"], detailsRows),
+    "Endpoint Mapping\n" + renderAsciiTable(["Endpoint Type", "URL"], buildProviderEndpointRows(provider), {
+      emptyMessage: "No endpoints configured."
+    }),
+    "Models\n" + renderAsciiTable(["Model", "Request Format(s)", "Silent Fallbacks"], buildProviderModelRows(provider), {
+      emptyMessage: "No models configured."
+    }),
+    "Rate-Limit Buckets\n" + renderAsciiTable(["Bucket", "Bucket ID", "Scope", "Request Limit", "Time Window"], buildRateLimitBucketRows(provider?.rateLimits || []), {
+      emptyMessage: "No rate-limit buckets configured."
+    }),
+    "Detection Summary\n" + renderAsciiTable(["Check", "Result"], probeRows)
+  );
+}
+
+function buildModelAliasSavedReport(aliasId, alias) {
+  return joinReportSections(
+    "Model Alias Saved",
+    "Overview\n" + renderAsciiTable(["Field", "Value"], [
+      ["Alias ID", aliasId || "(unknown)"],
+      ["Routing Strategy", formatModelAliasStrategyLabel(alias?.strategy)]
+    ]),
+    "Primary Routes\n" + renderAsciiTable(["Model Route", "Weight"], buildModelAliasTargetRows(alias?.targets || []), {
+      emptyMessage: "No primary routes configured."
+    }),
+    "Fallback Routes\n" + renderAsciiTable(["Model Route", "Weight"], buildModelAliasTargetRows(alias?.fallbackTargets || []), {
+      emptyMessage: "No fallback routes configured."
+    })
+  );
+}
+
+function buildProviderRateLimitReport({
+  title,
+  providerId,
+  rateLimits
+}) {
+  return joinReportSections(
+    title || "Rate-Limit Buckets",
+    "Overview\n" + renderAsciiTable(["Field", "Value"], [
+      ["Provider ID", providerId || "(unknown)"],
+      ["Total Buckets", String((rateLimits || []).length)]
+    ]),
+    "Buckets\n" + renderAsciiTable(["Bucket", "Bucket ID", "Scope", "Request Limit", "Time Window"], buildRateLimitBucketRows(rateLimits || []), {
+      emptyMessage: "No rate-limit buckets configured."
+    })
+  );
+}
+
+function buildProviderConfigSection(provider) {
+  const infoRows = [
+    ["Provider ID", provider?.id || "(unknown)"],
+    ["Provider Name", provider?.name || provider?.id || "(unknown)"],
+    ["Provider Type", formatProviderTypeLabel(provider?.type)],
+    ["Request Formats", formatRequestFormatList(provider?.formats, provider?.format)],
+    ["API Credential", normalizeProviderTypeInput(provider?.type) === PROVIDER_TYPE_SUBSCRIPTION
+      ? "Managed by OAuth session"
+      : (provider?.apiKey || "(from env/hidden)")]
+  ];
+  if (provider?.subscriptionType) infoRows.push(["Subscription Type", provider.subscriptionType]);
+  if (provider?.subscriptionProfile) infoRows.push(["Subscription Profile", provider.subscriptionProfile]);
+
+  return joinReportSections(
+    `Provider: ${provider?.name || provider?.id || "(unknown)"}`,
+    "Provider Details\n" + renderAsciiTable(["Field", "Value"], infoRows),
+    "Endpoint Mapping\n" + renderAsciiTable(["Endpoint Type", "URL"], buildProviderEndpointRows(provider), {
+      emptyMessage: "No endpoints configured."
+    }),
+    "Models\n" + renderAsciiTable(["Model", "Request Format(s)", "Silent Fallbacks"], buildProviderModelRows(provider), {
+      emptyMessage: "No models configured."
+    }),
+    "Rate-Limit Buckets\n" + renderAsciiTable(["Bucket", "Bucket ID", "Scope", "Request Limit", "Time Window"], buildRateLimitBucketRows(provider?.rateLimits || []), {
+      emptyMessage: "No rate-limit buckets configured."
+    })
+  );
+}
 
-  return lines.join("\n");
+export function summarizeConfig(config, configPath, { includeSecrets = false } = {}) {
+  const target = includeSecrets ? config : sanitizeConfigForDisplay(config);
+  const providers = Array.isArray(target?.providers) ? target.providers : [];
+  const aliasEntries = Object.entries(target?.modelAliases || {});
+
+  const providerSummaryRows = providers.map((provider) => [
+    provider?.id || "(unknown)",
+    provider?.name || provider?.id || "(unknown)",
+    formatProviderTypeLabel(provider?.type),
+    formatRequestFormatList(provider?.formats, provider?.format),
+    String((provider?.models || []).length),
+    String((provider?.rateLimits || []).length)
+  ]);
+
+  const aliasRows = aliasEntries.map(([aliasId, alias]) => ([
+    aliasId,
+    formatModelAliasStrategyLabel(alias?.strategy),
+    formatAliasTargetsForSummary(alias?.targets),
+    formatAliasTargetsForSummary(alias?.fallbackTargets)
+  ]));
+
+  return joinReportSections(
+    "Current Router Configuration",
+    "Overview\n" + renderAsciiTable(["Field", "Value"], [
+      ["Config File", configPath],
+      ["Schema Version", String(target?.version || 1)],
+      ["Default Route", target?.defaultModel || "(not set)"],
+      ["Master Key", target?.masterKey || "(not set)"]
+    ]),
+    "Providers\n" + renderAsciiTable(
+      ["Provider ID", "Name", "Type", "Request Formats", "Models", "Rate-Limit Buckets"],
+      providerSummaryRows,
+      { emptyMessage: "No providers configured." }
+    ),
+    ...providers.map((provider) => buildProviderConfigSection(provider)),
+    "Model Aliases\n" + renderAsciiTable(
+      ["Alias ID", "Routing Strategy", "Primary Routes", "Fallback Routes"],
+      aliasRows,
+      { emptyMessage: "No model aliases configured." }
+    )
+  );
 }
 
 function runCommand(command, args, { cwd, input, envOverrides } = {}) {
@@ -2307,12 +2577,7 @@ async function resolveUpsertInput(context, existingConfig) {
         { value: "__new__", label: "Add new provider" },
         ...providers.map((provider) => ({
           value: provider.id,
-          label: `Edit ${provider.id}`,
-          hint: provider.baseUrl
-            ? String(provider.baseUrl)
-            : (normalizeProviderTypeInput(provider.type) === PROVIDER_TYPE_SUBSCRIPTION
-              ? `subscription:${provider.subscriptionType || provider.subscription_type || "(unknown)"}`
-              : "(no endpoint)")
+          label: `Edit ${provider.id}`
         }))
       ]
     });
@@ -2324,18 +2589,29 @@ async function resolveUpsertInput(context, existingConfig) {
   }
 
   const baseProviderId = argProviderId || selectedExisting?.id || "";
-  const baseName = String(readArg(args, ["name"], selectedExisting?.name || "") || "");
-  const baseProviderType = normalizeProviderTypeInput(
-    readArg(args, ["type", "provider-type", "providerType"], selectedExisting?.type || PROVIDER_TYPE_STANDARD)
+  const rawNameArg = readArg(args, ["name"], undefined);
+  const providedName = String(rawNameArg !== undefined ? rawNameArg : (selectedExisting?.name || "")) || "";
+  const rawProviderTypeArg = readArg(args, ["type", "provider-type", "providerType"], undefined);
+  const hasProviderTypeArg = rawProviderTypeArg !== undefined;
+  const hasSubscriptionTypeArg = readArg(args, ["subscription-type", "subscriptionType"], undefined) !== undefined;
+  const hasSubscriptionProfileArg = readArg(args, ["subscription-profile", "subscriptionProfile"], undefined) !== undefined;
+  const hasModelsArg = readArg(args, ["models"], undefined) !== undefined;
+  const initialProviderType = normalizeProviderTypeInput(
+    rawProviderTypeArg !== undefined ? rawProviderTypeArg : (selectedExisting?.type || PROVIDER_TYPE_STANDARD)
   ) || PROVIDER_TYPE_STANDARD;
-  const baseSubscriptionType = normalizeSubscriptionTypeInput(
-    readArg(args, ["subscription-type", "subscriptionType"], selectedExisting?.subscriptionType || selectedExisting?.subscription_type || "")
-  );
-  const baseSubscriptionProfile = String(readArg(
+  const rawSubscriptionType = String(readArg(
     args,
-    ["subscription-profile", "subscriptionProfile"],
-    selectedExisting?.subscriptionProfile || selectedExisting?.subscription_profile || baseProviderId || "default"
+    ["subscription-type", "subscriptionType"],
+    selectedExisting?.subscriptionType || selectedExisting?.subscription_type || ""
   ) || "").trim();
+  const normalizedRequestedSubscriptionType = normalizeSubscriptionTypeInput(rawSubscriptionType);
+  const baseSubscriptionType = initialProviderType === PROVIDER_TYPE_SUBSCRIPTION
+    ? (
+        hasSubscriptionTypeArg
+          ? (normalizedRequestedSubscriptionType || rawSubscriptionType)
+          : (normalizedRequestedSubscriptionType || SUBSCRIPTION_TYPE_CHATGPT_CODEX)
+      )
+    : "";
   const baseUrl = String(readArg(args, ["base-url", "baseUrl"], selectedExisting?.baseUrl || "") || "");
   const baseEndpoints = parseEndpointListInput(readArg(
     args,
@@ -2365,29 +2641,144 @@ async function resolveUpsertInput(context, existingConfig) {
   const shouldProbe = !toBoolean(readArg(args, ["skip-probe", "skipProbe"], false), false);
   const setMasterKeyFlag = toBoolean(readArg(args, ["set-master-key", "setMasterKey"], false), false);
   const providedMasterKey = String(readArg(args, ["master-key", "masterKey"], "") || "");
+  const subscriptionDeviceCode = toBoolean(readArg(args, ["device-code", "deviceCode"], false), false);
   const parsedHeaders = applyDefaultHeaders(
     parseJsonObjectArg(baseHeaders, "--headers"),
     { force: !hasHeadersArg }
   );
-  const hasProviderTypeArg = readArg(args, ["type", "provider-type", "providerType"], undefined) !== undefined;
-  const hasSubscriptionTypeArg = readArg(args, ["subscription-type", "subscriptionType"], undefined) !== undefined;
-  const hasSubscriptionProfileArg = readArg(args, ["subscription-profile", "subscriptionProfile"], undefined) !== undefined;
-  const baseIsSubscription = baseProviderType === PROVIDER_TYPE_SUBSCRIPTION;
+  let providerType = initialProviderType;
+  if (canPrompt()) {
+    printProviderInputGuidance(context);
+    if (!hasProviderTypeArg) {
+      providerType = await context.prompts.select({
+        message: "Provider auth mode",
+        initialValue: providerType,
+        options: [
+          {
+            value: PROVIDER_TYPE_STANDARD,
+            label: "API Key"
+          },
+          {
+            value: PROVIDER_TYPE_SUBSCRIPTION,
+            label: "OAuth"
+          }
+        ]
+      });
+    }
+  }
+
+  let subscriptionType = providerType === PROVIDER_TYPE_SUBSCRIPTION
+    ? baseSubscriptionType
+    : "";
+  if (providerType === PROVIDER_TYPE_SUBSCRIPTION && canPrompt() && !hasSubscriptionTypeArg) {
+    subscriptionType = await context.prompts.select({
+      message: "Subscription provider",
+      initialValue: subscriptionType || SUBSCRIPTION_TYPE_CHATGPT_CODEX,
+      options: SUBSCRIPTION_PROVIDER_PRESETS.map((preset) => ({
+        value: preset.subscriptionType,
+        label: preset.label
+      }))
+    });
+  }
+  const subscriptionPreset = providerType === PROVIDER_TYPE_SUBSCRIPTION
+    ? getSubscriptionProviderPreset(subscriptionType || SUBSCRIPTION_TYPE_CHATGPT_CODEX)
+    : null;
+
+  const defaultName = String(
+    providedName ||
+    (providerType === PROVIDER_TYPE_SUBSCRIPTION ? subscriptionPreset?.defaultName : "") ||
+    ""
+  ).trim();
+
+  const name = canPrompt()
+    ? await context.prompts.text({
+        message: "Provider Friendly Name (unique, shown in management screen)",
+        required: true,
+        initialValue: defaultName,
+        placeholder: providerType === PROVIDER_TYPE_SUBSCRIPTION ? "GPT Sub" : "OpenRouter Primary",
+        validate: (value) => {
+          const candidate = String(value || "").trim();
+          if (!candidate) return "Provider Friendly Name is required.";
+          const duplicate = findProviderByFriendlyName(providers, candidate, { excludeId: selectedExisting?.id || baseProviderId });
+          if (duplicate) return `Provider Friendly Name '${candidate}' already exists (provider-id: ${duplicate.id}). Use a unique name.`;
+          return undefined;
+        }
+      })
+    : defaultName;
+
+  const generatedProviderId = resolveUniqueProviderId(
+    slugifyId(name || subscriptionPreset?.defaultName || "provider"),
+    providers,
+    { excludeId: selectedExisting?.id || baseProviderId }
+  );
+
+  const providerId = canPrompt()
+    ? (baseProviderId || await context.prompts.text({
+        message: "Provider ID (auto-slug from Friendly Name; editable)",
+        required: true,
+        initialValue: generatedProviderId,
+        placeholder: providerType === PROVIDER_TYPE_SUBSCRIPTION ? "gpt-sub" : "openrouter-primary",
+        validate: (value) => {
+          const candidate = String(value || "").trim();
+          if (!candidate) return "Provider ID is required.";
+          if (!PROVIDER_ID_PATTERN.test(candidate)) {
+            return "Use lowercase letters, numbers, and dashes only (e.g. openrouter-primary).";
+          }
+          const duplicate = (providers || []).find((provider) =>
+            provider &&
+            String(provider.id || "").trim() === candidate &&
+            String(provider.id || "").trim() !== String(selectedExisting?.id || baseProviderId || "").trim());
+          if (duplicate) {
+            return `Provider ID '${candidate}' already exists.`;
+          }
+          return undefined;
+        }
+      }))
+    : (baseProviderId || generatedProviderId);
+
+  const subscriptionProfile = providerType === PROVIDER_TYPE_SUBSCRIPTION
+    ? String(readArg(
+        args,
+        ["subscription-profile", "subscriptionProfile"],
+        selectedExisting?.subscriptionProfile || selectedExisting?.subscription_profile || providerId
+      ) || "").trim() || providerId
+    : "";
+  const requiresSubscriptionLogin = providerType === PROVIDER_TYPE_SUBSCRIPTION && (
+    !selectedExisting ||
+    normalizeProviderTypeInput(selectedExisting?.type) !== PROVIDER_TYPE_SUBSCRIPTION ||
+    (hasSubscriptionProfileArg && subscriptionProfile !== String(
+      selectedExisting?.subscriptionProfile || selectedExisting?.subscription_profile || selectedExisting?.id || ""
+    ).trim())
+  );
+  const subscriptionModelsInput = providerType === PROVIDER_TYPE_SUBSCRIPTION
+    ? String(
+        hasModelsArg
+          ? readArg(args, ["models"], "")
+          : getDefaultSubscriptionModelListInput(selectedExisting)
+      )
+    : "";
+  const baseIsSubscription = providerType === PROVIDER_TYPE_SUBSCRIPTION;
 
   if (!canPrompt()) {
     return {
       configPath,
-      providerId: baseProviderId || slugifyId(baseName || "provider"),
-      name: baseName,
-      providerType: baseProviderType,
-      subscriptionType: baseSubscriptionType,
-      subscriptionProfile: baseSubscriptionProfile || baseProviderId || "default",
+      providerId,
+      name,
+      providerType,
+      subscriptionType,
+      subscriptionProfile,
+      subscriptionDeviceCode,
+      requireSubscriptionLogin: requiresSubscriptionLogin,
+      hasModelsArg,
+      subscriptionModelsInput,
       baseUrl,
       endpoints: baseEndpoints,
       openaiBaseUrl: baseOpenAIBaseUrl,
       claudeBaseUrl: baseClaudeBaseUrl,
       apiKey: baseIsSubscription ? "" : (baseApiKey || selectedExisting?.apiKey || ""),
-      models: parseProviderModelListInput(baseModels),
+      models: baseIsSubscription
+        ? parseProviderModelListInput(subscriptionModelsInput)
+        : parseProviderModelListInput(baseModels),
       format: baseIsSubscription ? "openai" : baseFormat,
       formats: baseFormats,
       headers: parsedHeaders,
@@ -2398,90 +2789,11 @@ async function resolveUpsertInput(context, existingConfig) {
     };
   }
 
-  printProviderInputGuidance(context);
-
-  const name = baseName || await context.prompts.text({
-    message: "Provider Friendly Name (unique, shown in management screen)",
-    required: true,
-    placeholder: "OpenRouter Primary",
-    validate: (value) => {
-      const candidate = String(value || "").trim();
-      if (!candidate) return "Provider Friendly Name is required.";
-      const duplicate = findProviderByFriendlyName(providers, candidate, { excludeId: selectedExisting?.id || baseProviderId });
-      if (duplicate) return `Provider Friendly Name '${candidate}' already exists (provider-id: ${duplicate.id}). Use a unique name.`;
-      return undefined;
-    }
-  });
-
-  const providerId = baseProviderId || await context.prompts.text({
-    message: "Provider ID (auto-slug from Friendly Name; editable)",
-    required: true,
-    initialValue: slugifyId(name),
-    placeholder: "openrouterPrimary",
-    validate: (value) => {
-      const candidate = String(value || "").trim();
-      if (!candidate) return "Provider ID is required.";
-      if (!PROVIDER_ID_PATTERN.test(candidate)) {
-        return "Use slug/camelCase with letters, numbers, underscore, dot, or hyphen (e.g. openrouterPrimary).";
-      }
-      return undefined;
-    }
-  });
-
-  let providerType = baseProviderType;
-  if (!hasProviderTypeArg) {
-    providerType = await context.prompts.select({
-      message: "Provider type",
-      initialValue: providerType,
-      options: [
-        {
-          value: PROVIDER_TYPE_STANDARD,
-          label: "Standard API provider",
-          hint: "Use endpoint + API key providers such as OpenRouter, Anthropic, OpenAI-compatible gateways."
-        },
-        {
-          value: PROVIDER_TYPE_SUBSCRIPTION,
-          label: "Subscription provider",
-          hint: "Use OAuth-backed ChatGPT subscription access for predefined Codex/GPT models."
-        }
-      ]
-    });
-  }
-
-  let subscriptionType = baseSubscriptionType;
-  let subscriptionProfile = baseSubscriptionProfile || providerId || "default";
-  if (providerType === PROVIDER_TYPE_SUBSCRIPTION) {
-    if (!hasSubscriptionTypeArg) {
-      subscriptionType = await context.prompts.select({
-        message: "Subscription provider type",
-        initialValue: subscriptionType || SUBSCRIPTION_TYPE_CHATGPT_CODEX,
-        options: [
-          {
-            value: SUBSCRIPTION_TYPE_CHATGPT_CODEX,
-            label: "ChatGPT Codex",
-            hint: "Uses llm-router subscription login/logout/status OAuth flow and predefined GPT/Codex models."
-          }
-        ]
-      });
-    }
-    if (!hasSubscriptionProfileArg) {
-      subscriptionProfile = await context.prompts.text({
-        message: "Subscription profile ID",
-        required: true,
-        initialValue: subscriptionProfile,
-        placeholder: "personal",
-        validate: (value) => {
-          const candidate = String(value || "").trim();
-          if (!candidate) return "Subscription profile ID is required.";
-          return undefined;
-        }
-      });
-    }
-  }
-
   let apiKey = "";
   let endpoints = [];
-  let models = parseProviderModelListInput(baseModels);
+  let models = providerType === PROVIDER_TYPE_SUBSCRIPTION
+    ? parseProviderModelListInput(subscriptionModelsInput)
+    : parseProviderModelListInput(baseModels);
   let interactiveHeaders = parsedHeaders;
   let probe = false;
   let probeRequestsPerMinute = baseProbeRequestsPerMinute;
@@ -2489,7 +2801,7 @@ async function resolveUpsertInput(context, existingConfig) {
 
   if (providerType === PROVIDER_TYPE_SUBSCRIPTION) {
     const info = typeof context?.terminal?.info === "function" ? context.terminal.info.bind(context.terminal) : null;
-    info?.("Subscription providers use OAuth login and predefined GPT/Codex models. Endpoint probe and API key prompts are skipped.");
+    info?.(`${subscriptionPreset?.label || "ChatGPT"} uses browser OAuth login. Model validation will run after authentication.`);
   } else {
     const askReplaceKey = selectedExisting?.apiKey ? await context.prompts.confirm({
       message: "Replace saved API key?",
@@ -2507,21 +2819,19 @@ async function resolveUpsertInput(context, existingConfig) {
     });
 
     const endpointsInput = await context.prompts.text({
-      message: "Provider endpoints (comma / ; / space / newline separated; multiline paste supported)",
+      message: "Provider endpoints (comma-separated URLs)",
       required: true,
-      initialValue: baseEndpoints.join("\n"),
-      paste: true,
-      multiline: true
+      initialValue: baseEndpoints.join(","),
+      validate: (value) => validateEndpointListInput(value)
     });
     endpoints = parseEndpointListInput(endpointsInput);
     maybeReportInputCleanup(context, "endpoint", endpointsInput, endpoints);
 
     const modelsInput = await context.prompts.text({
-      message: "Provider models (comma / ; / space / newline separated; multiline paste supported)",
+      message: "Provider models (comma-separated IDs)",
       required: true,
       initialValue: baseModels,
-      paste: true,
-      multiline: true
+      validate: (value) => validateProviderModelListInput(value)
     });
     models = parseProviderModelListInput(modelsInput);
     maybeReportInputCleanup(context, "model", modelsInput, models);
@@ -2584,6 +2894,10 @@ async function resolveUpsertInput(context, existingConfig) {
     providerType,
     subscriptionType,
     subscriptionProfile,
+    subscriptionDeviceCode,
+    requireSubscriptionLogin: requiresSubscriptionLogin,
+    hasModelsArg,
+    subscriptionModelsInput,
     baseUrl,
     endpoints,
     openaiBaseUrl: baseOpenAIBaseUrl,
@@ -2600,14 +2914,208 @@ async function resolveUpsertInput(context, existingConfig) {
   };
 }
 
+async function resolveSubscriptionAuthFns(context) {
+  if (context?.subscriptionAuth && typeof context.subscriptionAuth === "object") {
+    return context.subscriptionAuth;
+  }
+  return import("../runtime/subscription-auth.js");
+}
+
+async function resolveSubscriptionProviderFns(context) {
+  if (context?.subscriptionProvider && typeof context.subscriptionProvider === "object") {
+    return context.subscriptionProvider;
+  }
+  return import("../runtime/subscription-provider.js");
+}
+
+async function ensureSubscriptionAuthenticated(context, {
+  profile,
+  forceLogin = false,
+  deviceCode = false
+}) {
+  const line = typeof context?.terminal?.line === "function" ? context.terminal.line.bind(context.terminal) : null;
+  const authFns = await resolveSubscriptionAuthFns(context);
+  const getAuthStatus = typeof authFns.getAuthStatus === "function" ? authFns.getAuthStatus : null;
+  const loginWithBrowser = typeof authFns.loginWithBrowser === "function" ? authFns.loginWithBrowser : null;
+  const loginWithDeviceCode = typeof authFns.loginWithDeviceCode === "function" ? authFns.loginWithDeviceCode : null;
+
+  if (!getAuthStatus || !loginWithBrowser || !loginWithDeviceCode) {
+    throw new Error("Subscription auth module is missing required login/status functions.");
+  }
+
+  if (!forceLogin) {
+    const status = await getAuthStatus(profile);
+    if (status?.authenticated) {
+      line?.(`Subscription profile '${profile}' already authenticated.`);
+      return { authenticated: true, loginAttempted: false };
+    }
+  }
+
+  line?.(`Starting OAuth login for subscription profile '${profile}'...`);
+  if (deviceCode) {
+    await loginWithDeviceCode(profile, {
+      onCode: ({ userCode, verificationUri, expiresIn }) => {
+        line?.(`Open ${verificationUri} and enter code ${userCode} (expires in ${Math.floor(Number(expiresIn || 0) / 60)} minutes).`);
+      }
+    });
+  } else {
+    await loginWithBrowser(profile, {
+      onUrl: (url, meta = {}) => {
+        if (meta?.openedBrowser === true) {
+          line?.("Opened browser for OAuth login. Complete authentication to continue.");
+        } else {
+          line?.(`Open this OAuth URL in your browser: ${url}`);
+        }
+      }
+    });
+  }
+
+  const refreshedStatus = await getAuthStatus(profile);
+  if (!refreshedStatus?.authenticated) {
+    throw new Error(`OAuth login did not complete for subscription profile '${profile}'.`);
+  }
+  return { authenticated: true, loginAttempted: true };
+}
+
+function buildSubscriptionProbeSeed(models) {
+  const modelSupport = {};
+  const modelPreferredFormat = {};
+  for (const model of (models || [])) {
+    modelSupport[model] = [FORMATS.OPENAI];
+    modelPreferredFormat[model] = FORMATS.OPENAI;
+  }
+
+  return {
+    ok: true,
+    preferredFormat: FORMATS.OPENAI,
+    formats: [FORMATS.OPENAI],
+    workingFormats: [FORMATS.OPENAI],
+    models: [...(models || [])],
+    modelSupport,
+    modelPreferredFormat
+  };
+}
+
+function summarizeSubscriptionProbeFailure(result, fallback = "Subscription model probe failed.") {
+  if (!result || typeof result !== "object") return fallback;
+  if (result.errorKind) return `${result.errorKind}: ${result.status || "unknown-status"}`;
+  if (Number.isFinite(result.status)) return `status=${result.status}`;
+  return fallback;
+}
+
+async function closeSubscriptionProbeResponse(result) {
+  if (!(result?.response instanceof Response)) return;
+  const body = result.response.body;
+  if (body && typeof body.cancel === "function") {
+    try {
+      await body.cancel();
+      return;
+    } catch {
+      // Fall through and try draining as a best effort.
+    }
+  }
+  try {
+    await result.response.arrayBuffer();
+  } catch {
+    // Ignore cleanup failure for probe responses.
+  }
+}
+
+async function probeSubscriptionModels(context, {
+  providerId,
+  providerName,
+  subscriptionType,
+  subscriptionProfile,
+  models,
+  headers
+}) {
+  const line = typeof context?.terminal?.line === "function" ? context.terminal.line.bind(context.terminal) : null;
+  const providerFns = await resolveSubscriptionProviderFns(context);
+  const makeSubscriptionProviderCall = typeof providerFns.makeSubscriptionProviderCall === "function"
+    ? providerFns.makeSubscriptionProviderCall
+    : null;
+  if (!makeSubscriptionProviderCall) {
+    throw new Error("Subscription provider module is missing makeSubscriptionProviderCall.");
+  }
+
+  const uniqueModels = dedupeList(models);
+  const provider = {
+    id: providerId,
+    name: providerName,
+    type: PROVIDER_TYPE_SUBSCRIPTION,
+    subscriptionType,
+    subscriptionProfile,
+    headers: headers || {},
+    models: uniqueModels.map((id) => ({ id }))
+  };
+
+  const failures = [];
+  for (const modelId of uniqueModels) {
+    line?.(`[subscription probe] Testing model ${modelId}...`);
+    const probeBody = {
+      model: modelId,
+      stream: true,
+      store: false,
+      instructions: "You are a helpful assistant. Reply concisely.",
+      input: [
+        {
+          type: "message",
+          role: "user",
+          content: [
+            {
+              type: "input_text",
+              text: "Reply with exactly: pong"
+            }
+          ]
+        }
+      ],
+      tools: [],
+      tool_choice: "auto",
+      parallel_tool_calls: false
+    };
+    const result = await makeSubscriptionProviderCall({
+      provider,
+      body: probeBody,
+      stream: true
+    });
+
+    if (result?.ok) {
+      await closeSubscriptionProbeResponse(result);
+      continue;
+    }
+
+    let details = summarizeSubscriptionProbeFailure(result);
+    if (result?.response instanceof Response) {
+      try {
+        const raw = await result.response.text();
+        const compact = String(raw || "").trim().replace(/\s+/g, " ");
+        if (compact) details = compact.slice(0, 300);
+      } catch {
+        // Ignore response parsing failure and keep fallback details.
+      }
+    }
+    failures.push({ modelId, details });
+  }
+
+  return {
+    ok: failures.length === 0,
+    failures,
+    probe: buildSubscriptionProbeSeed(uniqueModels)
+  };
+}
+
 async function doUpsertProvider(context) {
   const configPath = readArg(context.args, ["config", "configPath"], getDefaultConfigPath());
   const existingConfig = await readConfigFile(configPath);
   const input = await resolveUpsertInput(context, existingConfig);
   const providerType = normalizeProviderTypeInput(input.providerType) || PROVIDER_TYPE_STANDARD;
   const isSubscriptionProvider = providerType === PROVIDER_TYPE_SUBSCRIPTION;
-  const subscriptionType = normalizeSubscriptionTypeInput(input.subscriptionType);
-  const subscriptionProfile = String(input.subscriptionProfile || input.providerId || "default").trim() || "default";
+  const rawSubscriptionType = String(input.subscriptionType || "").trim();
+  const normalizedSubscriptionType = normalizeSubscriptionTypeInput(rawSubscriptionType);
+  const subscriptionType = isSubscriptionProvider
+    ? (normalizedSubscriptionType || SUBSCRIPTION_TYPE_CHATGPT_CODEX)
+    : "";
+  const subscriptionProfile = String(input.subscriptionProfile || input.providerId || "default").trim() || input.providerId || "default";
 
   const endpointCandidates = parseEndpointListInput([
     ...(input.endpoints || []),
@@ -2616,6 +3124,7 @@ async function doUpsertProvider(context) {
     input.baseUrl
   ].filter(Boolean).join(","));
   const hasAnyEndpoint = endpointCandidates.length > 0;
+  const hasAnyModel = dedupeList(input.models || []).length > 0;
   if (!input.name) {
     return {
       ok: false,
@@ -2624,12 +3133,12 @@ async function doUpsertProvider(context) {
       errorMessage: "Provider Friendly Name is required."
     };
   }
-  if (isSubscriptionProvider && !subscriptionType) {
+  if (isSubscriptionProvider && rawSubscriptionType && !normalizedSubscriptionType) {
     return {
       ok: false,
       mode: context.mode,
       exitCode: EXIT_VALIDATION,
-      errorMessage: "subscription-type is required for provider type 'subscription' (e.g. --subscription-type=chatgpt-codex)."
+      errorMessage: `Unsupported subscription-type '${rawSubscriptionType}'. Supported: ${SUBSCRIPTION_TYPE_CHATGPT_CODEX}.`
     };
   }
   if (!isSubscriptionProvider && (!hasAnyEndpoint || !input.apiKey)) {
@@ -2640,13 +3149,29 @@ async function doUpsertProvider(context) {
       errorMessage: "Missing provider inputs: provider-id, name, api-key, and at least one endpoint."
     };
   }
+  if (!isSubscriptionProvider && endpointCandidates.some((endpoint) => !isValidHttpUrl(endpoint))) {
+    return {
+      ok: false,
+      mode: context.mode,
+      exitCode: EXIT_VALIDATION,
+      errorMessage: "One or more endpoints are invalid. Use full http:// or https:// URLs."
+    };
+  }
+  if (!isSubscriptionProvider && !hasAnyModel) {
+    return {
+      ok: false,
+      mode: context.mode,
+      exitCode: EXIT_VALIDATION,
+      errorMessage: "At least one valid model id is required."
+    };
+  }
 
   if (!PROVIDER_ID_PATTERN.test(input.providerId)) {
     return {
       ok: false,
       mode: context.mode,
       exitCode: EXIT_VALIDATION,
-      errorMessage: `Invalid provider id '${input.providerId}'. Use slug/camelCase (e.g. openrouter or myProvider).`
+      errorMessage: `Invalid provider id '${input.providerId}'. Use lowercase letters, numbers, and dashes (e.g. openrouter-primary).`
     };
   }
 
@@ -2667,144 +3192,260 @@ async function doUpsertProvider(context) {
   let effectiveBaseUrl = String(input.baseUrl || "").trim();
   let effectiveOpenAIBaseUrl = String(input.openaiBaseUrl || "").trim();
   let effectiveClaudeBaseUrl = String(input.claudeBaseUrl || "").trim();
-  let effectiveModels = [...(input.models || [])];
+  let effectiveModels = dedupeList(input.models || []);
   const shouldProbe = !isSubscriptionProvider && Boolean(input.shouldProbe);
 
-  if (shouldProbe && endpointCandidates.length > 0 && effectiveModels.length === 0) {
-    return {
-      ok: false,
-      mode: context.mode,
-      exitCode: EXIT_VALIDATION,
-      errorMessage: "Model list is required for endpoint-model probe. Provide --models=modelA,modelB."
-    };
-  }
-
-  if (shouldProbe) {
-    const startedAt = Date.now();
-    const reportProgress = probeProgressReporter(context);
-    const probeRequestsPerMinute = toPositiveInteger(
-      input.probeRequestsPerMinute,
-      DEFAULT_PROBE_REQUESTS_PER_MINUTE
-    );
-    const canRunMatrixProbe = endpointCandidates.length > 0 && effectiveModels.length > 0;
-    if (canRunMatrixProbe) {
-      probe = await probeProviderEndpointMatrix({
-        endpoints: endpointCandidates,
-        models: effectiveModels,
-        apiKey: input.apiKey,
-        headers: input.headers,
-        requestsPerMinute: probeRequestsPerMinute,
-        maxRateLimitRetries: DEFAULT_PROBE_MAX_RATE_LIMIT_RETRIES,
-        onProgress: reportProgress
+  if (isSubscriptionProvider) {
+    try {
+      await ensureSubscriptionAuthenticated(context, {
+        profile: subscriptionProfile,
+        forceLogin: Boolean(input.requireSubscriptionLogin),
+        deviceCode: Boolean(input.subscriptionDeviceCode)
       });
-      effectiveOpenAIBaseUrl = probe.baseUrlByFormat?.openai || effectiveOpenAIBaseUrl;
-      effectiveClaudeBaseUrl = probe.baseUrlByFormat?.claude || effectiveClaudeBaseUrl;
-      effectiveBaseUrl =
-        (probe.preferredFormat && probe.baseUrlByFormat?.[probe.preferredFormat]) ||
-        effectiveOpenAIBaseUrl ||
-        effectiveClaudeBaseUrl ||
-        endpointCandidates[0] ||
-        effectiveBaseUrl;
-      if ((probe.models || []).length > 0) {
-        effectiveModels = effectiveModels.length > 0
-          ? effectiveModels.filter((model) => (probe.models || []).includes(model))
-          : [...probe.models];
-      }
-    } else {
-      const probeBaseUrlByFormat = {};
-      if (effectiveOpenAIBaseUrl) probeBaseUrlByFormat.openai = effectiveOpenAIBaseUrl;
-      if (effectiveClaudeBaseUrl) probeBaseUrlByFormat.claude = effectiveClaudeBaseUrl;
-
-      probe = await probeProvider({
-        baseUrl: effectiveBaseUrl || endpointCandidates[0],
-        baseUrlByFormat: Object.keys(probeBaseUrlByFormat).length > 0 ? probeBaseUrlByFormat : undefined,
-        apiKey: input.apiKey,
-        headers: input.headers,
-        onProgress: reportProgress
+    } catch (error) {
+      return {
+        ok: false,
+        mode: context.mode,
+        exitCode: EXIT_FAILURE,
+        errorMessage: `Subscription OAuth login failed: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+
+    if (canPrompt() && !input.hasModelsArg) {
+      const modelsInput = await context.prompts.text({
+        message: "Subscription models (comma-separated IDs)",
+        required: true,
+        initialValue: String(input.subscriptionModelsInput || "").trim(),
+        validate: (value) => validateProviderModelListInput(value)
       });
+      effectiveModels = parseProviderModelListInput(modelsInput);
+      maybeReportInputCleanup(context, "model", modelsInput, effectiveModels);
+    } else if (effectiveModels.length === 0) {
+      effectiveModels = parseProviderModelListInput(input.subscriptionModelsInput || "");
     }
-    const line = typeof context?.terminal?.line === "function" ? context.terminal.line.bind(context.terminal) : null;
-    if (line) {
-      const tookMs = Date.now() - startedAt;
-      line(`Auto-discovery finished in ${(tookMs / 1000).toFixed(1)}s.`);
+
+    if (effectiveModels.length === 0) {
+      return {
+        ok: false,
+        mode: context.mode,
+        exitCode: EXIT_VALIDATION,
+        errorMessage: "Subscription provider requires at least one model after editing."
+      };
     }
-    selectedFormat = probe.preferredFormat || selectedFormat;
-    if (probe?.manualFallbackRecommended) {
+
+    const warn = typeof context?.terminal?.warn === "function" ? context.terminal.warn.bind(context.terminal) : null;
+    const formatProbeFailures = (failures = []) => [
+      "Subscription model probe failed. Remove unsupported models and retry.",
+      ...failures.map((entry) => `- ${entry.modelId}: ${entry.details}`)
+    ].join("\n");
+
+    while (true) {
+      let subscriptionProbe = null;
+      try {
+        subscriptionProbe = await probeSubscriptionModels(context, {
+          providerId: input.providerId,
+          providerName: input.name,
+          subscriptionType,
+          subscriptionProfile,
+          models: effectiveModels,
+          headers: input.headers
+        });
+      } catch (error) {
+        return {
+          ok: false,
+          mode: context.mode,
+          exitCode: EXIT_FAILURE,
+          errorMessage: `Subscription model validation failed: ${error instanceof Error ? error.message : String(error)}`
+        };
+      }
+
+      if (subscriptionProbe.ok) {
+        probe = subscriptionProbe.probe;
+        break;
+      }
+
       if (!canPrompt()) {
-        const scope = probe?.failureScope === "full" ? "full" : "partial";
         return {
           ok: false,
           mode: context.mode,
           exitCode: EXIT_FAILURE,
-          errorMessage: scope === "full"
-            ? "Auto-discovery failed fully (no working endpoint/format detected). Re-run interactively for manual fallback or use --skip-probe=true with explicit endpoint/format."
-            : "Auto-discovery failed partially (some endpoint/model checks unresolved). Re-run interactively for manual fallback or use --skip-probe=true with explicit endpoint/model inputs."
+          errorMessage: formatProbeFailures(subscriptionProbe.failures)
         };
       }
-      const fallback = await runProbeManualFallback(context, {
-        probe,
-        selectedFormat,
-        effectiveOpenAIBaseUrl,
-        effectiveClaudeBaseUrl,
-        effectiveModels
-      });
-      selectedFormat = fallback.selectedFormat;
-      effectiveOpenAIBaseUrl = fallback.effectiveOpenAIBaseUrl;
-      effectiveClaudeBaseUrl = fallback.effectiveClaudeBaseUrl;
-      effectiveModels = fallback.effectiveModels;
-      effectiveBaseUrl =
-        (selectedFormat === "openai" ? effectiveOpenAIBaseUrl : "") ||
-        (selectedFormat === "claude" ? effectiveClaudeBaseUrl : "") ||
-        effectiveOpenAIBaseUrl ||
-        effectiveClaudeBaseUrl ||
-        effectiveBaseUrl ||
-        endpointCandidates[0];
-    } else if (!probe.ok) {
-      if (canPrompt()) {
-        const continueWithoutProbe = await context.prompts.confirm({
-          message: "Probe failed to confirm working endpoint/model support. Save provider anyway?",
-          initialValue: false
-        });
-        if (!continueWithoutProbe) {
-          return {
-            ok: false,
-            mode: context.mode,
-            exitCode: EXIT_FAILURE,
-            errorMessage: "Config cancelled because provider probe failed."
-          };
-        }
 
-        selectedFormat = await promptProviderFormat(context, {
-          message: "Probe could not confirm a working format. Choose primary provider format",
-          initialFormat: selectedFormat
-        });
-      } else {
+      warn?.(formatProbeFailures(subscriptionProbe.failures));
+      const retry = await context.prompts.confirm({
+        message: "Edit subscription models and retry probe?",
+        initialValue: true
+      });
+      if (!retry) {
         return {
           ok: false,
           mode: context.mode,
           exitCode: EXIT_FAILURE,
-          errorMessage: "Provider probe failed. Provide valid endpoints/models or use --skip-probe=true to force save."
+          errorMessage: formatProbeFailures(subscriptionProbe.failures)
         };
       }
-    }
-  }
 
-  if (!shouldProbe && !isSubscriptionProvider) {
-    if (!effectiveBaseUrl && endpointCandidates.length > 0) {
-      effectiveBaseUrl = endpointCandidates[0];
-    }
-    if (!effectiveOpenAIBaseUrl && !effectiveClaudeBaseUrl && endpointCandidates.length === 1 && selectedFormat) {
-      if (selectedFormat === "openai") effectiveOpenAIBaseUrl = endpointCandidates[0];
-      if (selectedFormat === "claude") effectiveClaudeBaseUrl = endpointCandidates[0];
+      const modelsInput = await context.prompts.text({
+        message: "Subscription models (comma-separated IDs)",
+        required: true,
+        initialValue: effectiveModels.join(","),
+        validate: (value) => validateProviderModelListInput(value)
+      });
+      effectiveModels = parseProviderModelListInput(modelsInput);
+      maybeReportInputCleanup(context, "model", modelsInput, effectiveModels);
+      if (effectiveModels.length === 0) {
+        return {
+          ok: false,
+          mode: context.mode,
+          exitCode: EXIT_VALIDATION,
+          errorMessage: "Subscription provider requires at least one model after editing."
+        };
+      }
     }
-    if (!effectiveOpenAIBaseUrl && !effectiveClaudeBaseUrl && endpointCandidates.length > 1) {
+
+    selectedFormat = FORMATS.OPENAI;
+    effectiveBaseUrl = "";
+    effectiveOpenAIBaseUrl = "";
+    effectiveClaudeBaseUrl = "";
+  } else {
+    if (shouldProbe && endpointCandidates.length > 0 && effectiveModels.length === 0) {
       return {
         ok: false,
         mode: context.mode,
         exitCode: EXIT_VALIDATION,
-        errorMessage: "Multiple endpoints require probe mode (recommended) or explicit --openai-base-url/--claude-base-url."
+        errorMessage: "Model list is required for endpoint-model probe. Provide --models=modelA,modelB."
       };
     }
+
+    if (shouldProbe) {
+      const startedAt = Date.now();
+      const reportProgress = probeProgressReporter(context);
+      const probeRequestsPerMinute = toPositiveInteger(
+        input.probeRequestsPerMinute,
+        DEFAULT_PROBE_REQUESTS_PER_MINUTE
+      );
+      const canRunMatrixProbe = endpointCandidates.length > 0 && effectiveModels.length > 0;
+      if (canRunMatrixProbe) {
+        probe = await probeProviderEndpointMatrix({
+          endpoints: endpointCandidates,
+          models: effectiveModels,
+          apiKey: input.apiKey,
+          headers: input.headers,
+          requestsPerMinute: probeRequestsPerMinute,
+          maxRateLimitRetries: DEFAULT_PROBE_MAX_RATE_LIMIT_RETRIES,
+          onProgress: reportProgress
+        });
+        effectiveOpenAIBaseUrl = probe.baseUrlByFormat?.openai || effectiveOpenAIBaseUrl;
+        effectiveClaudeBaseUrl = probe.baseUrlByFormat?.claude || effectiveClaudeBaseUrl;
+        effectiveBaseUrl =
+          (probe.preferredFormat && probe.baseUrlByFormat?.[probe.preferredFormat]) ||
+          effectiveOpenAIBaseUrl ||
+          effectiveClaudeBaseUrl ||
+          endpointCandidates[0] ||
+          effectiveBaseUrl;
+        if ((probe.models || []).length > 0) {
+          effectiveModels = effectiveModels.length > 0
+            ? effectiveModels.filter((model) => (probe.models || []).includes(model))
+            : [...probe.models];
+        }
+      } else {
+        const probeBaseUrlByFormat = {};
+        if (effectiveOpenAIBaseUrl) probeBaseUrlByFormat.openai = effectiveOpenAIBaseUrl;
+        if (effectiveClaudeBaseUrl) probeBaseUrlByFormat.claude = effectiveClaudeBaseUrl;
+
+        probe = await probeProvider({
+          baseUrl: effectiveBaseUrl || endpointCandidates[0],
+          baseUrlByFormat: Object.keys(probeBaseUrlByFormat).length > 0 ? probeBaseUrlByFormat : undefined,
+          apiKey: input.apiKey,
+          headers: input.headers,
+          onProgress: reportProgress
+        });
+      }
+      const line = typeof context?.terminal?.line === "function" ? context.terminal.line.bind(context.terminal) : null;
+      if (line) {
+        const tookMs = Date.now() - startedAt;
+        line(`Auto-discovery finished in ${(tookMs / 1000).toFixed(1)}s.`);
+      }
+      selectedFormat = probe.preferredFormat || selectedFormat;
+      if (probe?.manualFallbackRecommended) {
+        if (!canPrompt()) {
+          const scope = probe?.failureScope === "full" ? "full" : "partial";
+          return {
+            ok: false,
+            mode: context.mode,
+            exitCode: EXIT_FAILURE,
+            errorMessage: scope === "full"
+              ? "Auto-discovery failed fully (no working endpoint/format detected). Re-run interactively for manual fallback or use --skip-probe=true with explicit endpoint/format."
+              : "Auto-discovery failed partially (some endpoint/model checks unresolved). Re-run interactively for manual fallback or use --skip-probe=true with explicit endpoint/model inputs."
+          };
+        }
+        const fallback = await runProbeManualFallback(context, {
+          probe,
+          selectedFormat,
+          effectiveOpenAIBaseUrl,
+          effectiveClaudeBaseUrl,
+          effectiveModels
+        });
+        selectedFormat = fallback.selectedFormat;
+        effectiveOpenAIBaseUrl = fallback.effectiveOpenAIBaseUrl;
+        effectiveClaudeBaseUrl = fallback.effectiveClaudeBaseUrl;
+        effectiveModels = fallback.effectiveModels;
+        effectiveBaseUrl =
+          (selectedFormat === "openai" ? effectiveOpenAIBaseUrl : "") ||
+          (selectedFormat === "claude" ? effectiveClaudeBaseUrl : "") ||
+          effectiveOpenAIBaseUrl ||
+          effectiveClaudeBaseUrl ||
+          effectiveBaseUrl ||
+          endpointCandidates[0];
+      } else if (!probe.ok) {
+        if (canPrompt()) {
+          const continueWithoutProbe = await context.prompts.confirm({
+            message: "Probe failed to confirm working endpoint/model support. Save provider anyway?",
+            initialValue: false
+          });
+          if (!continueWithoutProbe) {
+            return {
+              ok: false,
+              mode: context.mode,
+              exitCode: EXIT_FAILURE,
+              errorMessage: "Config cancelled because provider probe failed."
+            };
+          }
+
+          selectedFormat = await promptProviderFormat(context, {
+            message: "Probe could not confirm a working format. Choose primary provider format",
+            initialFormat: selectedFormat
+          });
+        } else {
+          return {
+            ok: false,
+            mode: context.mode,
+            exitCode: EXIT_FAILURE,
+            errorMessage: "Provider probe failed. Provide valid endpoints/models or use --skip-probe=true to force save."
+          };
+        }
+      }
+    }
+
+    if (!shouldProbe) {
+      if (!effectiveBaseUrl && endpointCandidates.length > 0) {
+        effectiveBaseUrl = endpointCandidates[0];
+      }
+      if (!effectiveOpenAIBaseUrl && !effectiveClaudeBaseUrl && endpointCandidates.length === 1 && selectedFormat) {
+        if (selectedFormat === "openai") effectiveOpenAIBaseUrl = endpointCandidates[0];
+        if (selectedFormat === "claude") effectiveClaudeBaseUrl = endpointCandidates[0];
+      }
+      if (!effectiveOpenAIBaseUrl && !effectiveClaudeBaseUrl && endpointCandidates.length > 1) {
+        return {
+          ok: false,
+          mode: context.mode,
+          exitCode: EXIT_VALIDATION,
+          errorMessage: "Multiple endpoints require probe mode (recommended) or explicit --openai-base-url/--claude-base-url."
+        };
+      }
+    }
   }
 
   const effectiveFormat = isSubscriptionProvider
@@ -2844,24 +3485,17 @@ async function doUpsertProvider(context) {
   });
 
   await writeConfigFile(nextConfig, input.configPath);
+  const savedProvider = (nextConfig.providers || []).find((entry) => entry.id === provider.id) || provider;
   return {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Saved provider '${provider.id}' to ${input.configPath}`,
-      probe
-        ? `probe preferred=${probe.preferredFormat || "(none)"} working=${(probe.workingFormats || []).join(",") || "(none)"}`
-        : "probe=skipped",
-      `type=${provider.type || PROVIDER_TYPE_STANDARD}`,
-      provider.subscriptionType ? `subscriptionType=${provider.subscriptionType}` : "",
-      provider.subscriptionProfile ? `subscriptionProfile=${provider.subscriptionProfile}` : "",
-      provider.baseUrlByFormat?.openai ? `openaiBaseUrl=${provider.baseUrlByFormat.openai}` : "",
-      provider.baseUrlByFormat?.claude ? `claudeBaseUrl=${provider.baseUrlByFormat.claude}` : "",
-      `formats=${(provider.formats || []).join(", ") || provider.format || "unknown"}`,
-      `models=${provider.models.map((m) => `${m.id}${m.formats?.length ? `[${m.formats.join("|")}]` : ""}`).join(", ")}`,
-      `masterKey=${nextConfig.masterKey ? maskSecret(nextConfig.masterKey) : "(not set)"}`
-    ].join("\n")
+    data: buildProviderSavedReport({
+      provider: savedProvider,
+      configPath: input.configPath,
+      probe,
+      masterKey: nextConfig.masterKey ? maskSecret(nextConfig.masterKey) : "(not set)"
+    })
   };
 }
 
@@ -2934,13 +3568,16 @@ async function doMigrateConfig(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      migration.changed
-        ? `Migrated config ${migration.beforeVersion} -> ${migration.afterVersion}.`
-        : `Config already at target schema (version ${migration.afterVersion}).`,
-      migration.backupPath ? `backup=${migration.backupPath}` : "backup=(not created)",
-      `config=${configPath}`
-    ].join("\n")
+    data: buildOperationReport(
+      migration.changed ? "Config Migration Completed" : "Config Already Up To Date",
+      [
+        ["Config File", configPath],
+        ["Previous Version", String(migration.beforeVersion)],
+        ["Current Version", String(migration.afterVersion)],
+        ["Backup Created", formatYesNo(Boolean(migration.backupPath))],
+        ["Backup File", migration.backupPath || "(not created)"]
+      ]
+    )
   };
 }
 
@@ -2958,8 +3595,7 @@ async function doRemoveProvider(context) {
       message: "Remove provider",
       options: config.providers.map((provider) => ({
         value: provider.id,
-        label: provider.id,
-        hint: `${provider.models.length} model(s)`
+        label: provider.id
       }))
     });
   }
@@ -3009,8 +3645,7 @@ async function doRemoveModel(context) {
         message: "Select provider",
         options: config.providers.map((provider) => ({
           value: provider.id,
-          label: provider.id,
-          hint: `${provider.models.length} model(s)`
+          label: provider.id
         }))
       });
     }
@@ -3079,8 +3714,7 @@ async function doSetModelFallbacks(context) {
         message: "Select provider for silent-fallback",
         options: config.providers.map((provider) => ({
           value: provider.id,
-          label: provider.id,
-          hint: `${provider.models.length} model(s)`
+          label: provider.id
         }))
       });
     }
@@ -3165,14 +3799,24 @@ async function doSetModelFallbacks(context) {
   }
 
   await writeConfigFile(updated.config, configPath);
+  const routeRef = `${providerId}/${updated.modelId || modelId}`;
+  const fallbackRows = (updated.fallbackModels || []).map((entry) => [entry]);
   return {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Updated silent-fallback models for '${providerId}/${updated.modelId || modelId}'.`,
-      `fallbacks=${(updated.fallbackModels || []).join(", ") || "(none)"}`
-    ].join("\n")
+    data: buildOperationReport(
+      "Model Silent Fallbacks Updated",
+      [
+        ["Source Model Route", routeRef],
+        ["Fallback Count", String((updated.fallbackModels || []).length)]
+      ],
+      [
+        "Fallback Routes\n" + renderAsciiTable(["Model Route"], fallbackRows, {
+          emptyMessage: "No fallback routes configured."
+        })
+      ]
+    )
   };
 }
 
@@ -3219,8 +3863,7 @@ async function doUpsertModelAlias(context) {
             { value: "__new__", label: "Create new alias" },
             ...aliasIds.map((id) => ({
               value: id,
-              label: `Edit ${id}`,
-              hint: `${(aliases[id]?.targets || []).length} target(s)`
+              label: `Edit ${id}`
             }))
           ]
         });
@@ -3249,8 +3892,7 @@ async function doUpsertModelAlias(context) {
       message: "Model alias routing strategy",
       options: MODEL_ROUTING_STRATEGY_OPTIONS.map((option) => ({
         value: option.value,
-        label: option.label,
-        hint: option.hint
+        label: option.label
       })),
       initialValue: selectedStrategy
     });
@@ -3293,15 +3935,13 @@ async function doUpsertModelAlias(context) {
     }
 
     await writeConfigFile(updated.config, configPath);
+    const savedAliasId = updated.aliasId || aliasId;
+    const savedAlias = updated.config.modelAliases?.[savedAliasId];
     return {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: [
-        `Upserted model alias '${updated.aliasId || aliasId}'.`,
-        `targets=${formatAliasTargetsForSummary(updated.config.modelAliases?.[updated.aliasId || aliasId]?.targets)}`,
-        `fallbackTargets=${formatAliasTargetsForSummary(updated.config.modelAliases?.[updated.aliasId || aliasId]?.fallbackTargets)}`
-      ].join("\n")
+      data: buildModelAliasSavedReport(savedAliasId, savedAlias)
     };
   }
 
@@ -3324,15 +3964,13 @@ async function doUpsertModelAlias(context) {
   }
 
   await writeConfigFile(updated.config, configPath);
+  const savedAliasId = updated.aliasId || aliasId;
+  const savedAlias = updated.config.modelAliases?.[savedAliasId];
   return {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Upserted model alias '${updated.aliasId || aliasId}'.`,
-      `targets=${formatAliasTargetsForSummary(updated.config.modelAliases?.[updated.aliasId || aliasId]?.targets)}`,
-      `fallbackTargets=${formatAliasTargetsForSummary(updated.config.modelAliases?.[updated.aliasId || aliasId]?.fallbackTargets)}`
-    ].join("\n")
+    data: buildModelAliasSavedReport(savedAliasId, savedAlias)
   };
 }
 
@@ -3385,37 +4023,32 @@ function printRateLimitBucketIntro(context) {
 }
 
 function buildProviderRateLimitReview(provider) {
-  const buckets = provider?.rateLimits || [];
-  if (buckets.length === 0) {
-    return `Provider '${provider?.id || "(unknown)"}' has no rate-limit buckets.`;
-  }
-
-  return [
-    `Rate-limit buckets for '${provider?.id || "(unknown)"}':`,
-    ...buckets.map((bucket) => `- ${formatRateLimitBucketLabel(bucket, { includeId: true })}: ${summarizeRateLimitBucketCap(bucket)} | scope=${formatRateLimitBucketScopeLabel(bucket)}`)
-  ].join("\n");
+  return buildProviderRateLimitReport({
+    title: "Rate-Limit Bucket Review",
+    providerId: provider?.id,
+    rateLimits: provider?.rateLimits || []
+  });
 }
 
 function buildRateLimitBucketPromptOptions(provider) {
   return (provider?.rateLimits || []).map((bucket) => ({
     value: bucket.id,
-    label: `${formatRateLimitBucketLabel(bucket)} (${summarizeRateLimitBucketCap(bucket)})`,
-    hint: formatRateLimitBucketScopeLabel(bucket)
+    label: `${formatRateLimitBucketLabel(bucket)} (${summarizeRateLimitBucketCap(bucket)})`
   }));
 }
 
 function buildRateLimitWindowUnitOptions(initialUnit = "") {
   const options = [
-    { value: "minute", label: "Minute", hint: "Fixed to 1 minute" },
-    { value: "hour", label: "Hour(s)", hint: "Choose any positive hour count" },
-    { value: "week", label: "Week", hint: "Fixed to 1 week" },
-    { value: "month", label: "Month", hint: "Fixed to 1 month" }
+    { value: "minute", label: "Minute" },
+    { value: "hour", label: "Hour(s)" },
+    { value: "week", label: "Week" },
+    { value: "month", label: "Month" }
   ];
   if (initialUnit === "day") {
-    options.push({ value: "day", label: "Day (legacy)", hint: "Retained for existing configs" });
+    options.push({ value: "day", label: "Day (legacy)" });
   }
   if (initialUnit === "second") {
-    options.push({ value: "second", label: "Second (legacy)", hint: "Retained for existing configs" });
+    options.push({ value: "second", label: "Second (legacy)" });
   }
   return options;
 }
@@ -3594,8 +4227,7 @@ async function doSetProviderRateLimits(context) {
         message: "Select provider for rate-limit buckets",
         options: config.providers.map((provider) => ({
           value: provider.id,
-          label: provider.id,
-          hint: `${(provider.rateLimits || []).length} bucket(s)`
+          label: provider.id
         }))
       });
     }
@@ -3643,7 +4275,16 @@ async function doSetProviderRateLimits(context) {
       if (action === "remove") {
         const bucketOptions = buildRateLimitBucketPromptOptions(provider);
         if (bucketOptions.length === 0) {
-          return { ok: true, mode: context.mode, exitCode: EXIT_SUCCESS, data: `Provider '${providerId}' has no rate-limit buckets.` };
+          return {
+            ok: true,
+            mode: context.mode,
+            exitCode: EXIT_SUCCESS,
+            data: buildProviderRateLimitReport({
+              title: "Rate-Limit Bucket Review",
+              providerId,
+              rateLimits: provider.rateLimits || []
+            })
+          };
         }
 
         const selectedBucketId = await context.prompts.select({
@@ -3676,14 +4317,27 @@ async function doSetProviderRateLimits(context) {
           ok: true,
           mode: context.mode,
           exitCode: EXIT_SUCCESS,
-          data: `Removed rate-limit bucket '${formatRateLimitBucketLabel(selectedBucket, { includeId: true })}' from '${providerId}'.`
+          data: buildProviderRateLimitReport({
+            title: `Rate-Limit Bucket Removed: ${formatRateLimitBucketLabel(selectedBucket, { includeId: true })}`,
+            providerId,
+            rateLimits: removed.rateLimits || []
+          })
         };
       }
 
       if (action === "edit") {
         const bucketOptions = buildRateLimitBucketPromptOptions(provider);
         if (bucketOptions.length === 0) {
-          return { ok: true, mode: context.mode, exitCode: EXIT_SUCCESS, data: `Provider '${providerId}' has no rate-limit buckets.` };
+          return {
+            ok: true,
+            mode: context.mode,
+            exitCode: EXIT_SUCCESS,
+            data: buildProviderRateLimitReport({
+              title: "Rate-Limit Bucket Review",
+              providerId,
+              rateLimits: provider.rateLimits || []
+            })
+          };
         }
 
         const selectedBucketId = await context.prompts.select({
@@ -3729,10 +4383,11 @@ async function doSetProviderRateLimits(context) {
           ok: true,
           mode: context.mode,
           exitCode: EXIT_SUCCESS,
-          data: [
-            `Updated rate-limit bucket '${formatRateLimitBucketLabel(wizard.bucket, { includeId: true })}' on '${providerId}'.`,
-            `bucketCount=${updated.rateLimits?.length || 0}`
-          ].join("\n")
+          data: buildProviderRateLimitReport({
+            title: `Rate-Limit Bucket Updated: ${formatRateLimitBucketLabel(wizard.bucket, { includeId: true })}`,
+            providerId,
+            rateLimits: updated.rateLimits || []
+          })
         };
       }
 
@@ -3789,10 +4444,11 @@ async function doSetProviderRateLimits(context) {
         ok: true,
         mode: context.mode,
         exitCode: EXIT_SUCCESS,
-        data: [
-          `Updated rate-limit buckets for '${providerId}'.`,
-          `bucketCount=${updated.rateLimits?.length || 0}`
-        ].join("\n")
+        data: buildProviderRateLimitReport({
+          title: "Rate-Limit Buckets Updated",
+          providerId,
+          rateLimits: updated.rateLimits || []
+        })
       };
     }
 
@@ -3800,7 +4456,16 @@ async function doSetProviderRateLimits(context) {
       if (!bucketId) {
         const bucketOptions = buildRateLimitBucketPromptOptions(provider);
         if (bucketOptions.length === 0) {
-          return { ok: true, mode: context.mode, exitCode: EXIT_SUCCESS, data: `Provider '${providerId}' has no rate-limit buckets.` };
+          return {
+            ok: true,
+            mode: context.mode,
+            exitCode: EXIT_SUCCESS,
+            data: buildProviderRateLimitReport({
+              title: "Rate-Limit Bucket Review",
+              providerId,
+              rateLimits: provider.rateLimits || []
+            })
+          };
         }
         bucketId = await context.prompts.select({
           message: `Remove rate-limit bucket from ${providerId}`,
@@ -3921,7 +4586,11 @@ async function doSetProviderRateLimits(context) {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: `Removed rate-limit bucket '${bucketId}' from '${providerId}'.`
+      data: buildProviderRateLimitReport({
+        title: `Rate-Limit Bucket Removed: ${bucketId}`,
+        providerId,
+        rateLimits: removed.rateLimits || []
+      })
     };
   }
 
@@ -3966,10 +4635,11 @@ async function doSetProviderRateLimits(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Updated rate-limit buckets for '${providerId}'.`,
-      `bucketCount=${updated.rateLimits?.length || 0}`
-    ].join("\n")
+    data: buildProviderRateLimitReport({
+      title: "Rate-Limit Buckets Updated",
+      providerId,
+      rateLimits: updated.rateLimits || []
+    })
   };
 }
 
@@ -4017,10 +4687,17 @@ async function doSetMasterKey(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Updated master key in ${configPath} (${maskSecret(masterKey)}).`,
-      keyGenerated ? `Generated key (copy now): ${masterKey}` : ""
-    ].filter(Boolean).join("\n")
+    data: buildOperationReport(
+      "Worker Master Key Updated",
+      [
+        ["Config File", configPath],
+        ["Stored Key", maskSecret(masterKey)],
+        ["Generated In This Run", formatYesNo(keyGenerated)]
+      ],
+      keyGenerated
+        ? [renderListSection("Generated Key (Copy Now)", [masterKey])]
+        : []
+    )
   };
 }
 
@@ -4074,14 +4751,18 @@ async function doStartupInstall(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Installed OS startup (${result.manager})`,
-      `service=${result.serviceId}`,
-      `file=${result.filePath}`,
-      `start target=http://${host}:${port}`,
-      `binary watch=${watchBinary ? "enabled" : "disabled"}`,
-      `local auth=${requireAuth ? "required (masterKey)" : "disabled"}`
-    ].join("\n")
+    data: buildOperationReport(
+      "OS Startup Service Installed",
+      [
+        ["Startup Manager", result.manager || "Unknown"],
+        ["Service Name", result.serviceId || "Unknown"],
+        ["Service File", result.filePath || "(not provided)"],
+        ["Start Target", `http://${host}:${port}`],
+        ["Config Hot Reload", watchConfig ? "Enabled" : "Disabled"],
+        ["Binary Auto-Restart", watchBinary ? "Enabled" : "Disabled"],
+        ["Local API Auth", requireAuth ? "Required (Master Key)" : "Disabled"]
+      ]
+    )
   };
 }
 
@@ -4101,11 +4782,14 @@ async function doStartupUninstall(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `Uninstalled OS startup (${result.manager})`,
-      `service=${result.serviceId}`,
-      `file=${result.filePath}`
-    ].join("\n")
+    data: buildOperationReport(
+      "OS Startup Service Uninstalled",
+      [
+        ["Startup Manager", result.manager || "Unknown"],
+        ["Service Name", result.serviceId || "Unknown"],
+        ["Service File", result.filePath || "(not provided)"]
+      ]
+    )
   };
 }
 
@@ -4115,14 +4799,17 @@ async function doStartupStatus(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `manager=${status.manager}`,
-      `service=${status.serviceId}`,
-      `installed=${status.installed}`,
-      `running=${status.running}`,
-      status.filePath ? `file=${status.filePath}` : "",
-      status.detail ? `detail=${String(status.detail).trim()}` : ""
-    ].filter(Boolean).join("\n")
+    data: buildOperationReport(
+      "OS Startup Service Status",
+      [
+        ["Startup Manager", status.manager || "Unknown"],
+        ["Service Name", status.serviceId || "Unknown"],
+        ["Installed", formatYesNo(Boolean(status.installed))],
+        ["Running", formatYesNo(Boolean(status.running))],
+        ["Service File", status.filePath || "(not provided)"],
+        ["Details", status.detail ? String(status.detail).trim() : "(none)"]
+      ]
+    )
   };
 }
 
@@ -4261,11 +4948,14 @@ async function runStopAction(context) {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: [
-        "Stopped startup-managed llm-router instance.",
-        `manager=${stopped.detail?.manager || "unknown"}`,
-        `service=${stopped.detail?.serviceId || "unknown"}`
-      ].join("\n")
+      data: buildOperationReport(
+        "Router Stopped",
+        [
+          ["Stop Mode", "Startup-managed service"],
+          ["Startup Manager", stopped.detail?.manager || "Unknown"],
+          ["Service Name", stopped.detail?.serviceId || "Unknown"]
+        ]
+      )
     };
   }
 
@@ -4274,7 +4964,14 @@ async function runStopAction(context) {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: `Stopped llm-router process pid=${stopped.detail?.pid || "unknown"} (${stopped.detail?.signal || "SIGTERM"}).`
+      data: buildOperationReport(
+        "Router Stopped",
+        [
+          ["Stop Mode", "Manual process"],
+          ["Process ID", String(stopped.detail?.pid || "Unknown")],
+          ["Signal", stopped.detail?.signal || "SIGTERM"]
+        ]
+      )
     };
   }
 
@@ -4317,11 +5014,14 @@ async function runReloadAction(context) {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: [
-        "Restarted startup-managed llm-router instance.",
-        `manager=${result.detail?.manager || "unknown"}`,
-        `service=${result.detail?.serviceId || "unknown"}`
-      ].join("\n")
+      data: buildOperationReport(
+        "Router Reloaded",
+        [
+          ["Reload Mode", "Startup-managed service"],
+          ["Startup Manager", result.detail?.manager || "Unknown"],
+          ["Service Name", result.detail?.serviceId || "Unknown"]
+        ]
+      )
     };
   }
 
@@ -4754,7 +5454,7 @@ async function runAiHelpAction(context) {
   const suggestions = [];
   if (providerCount === 0) {
     suggestions.push("Add first provider with at least one model. Run: llm-router config --operation=upsert-provider --provider-id=<id> --name=\"<name>\" --base-url=<url> --api-key=<key> --models=<model1,model2>");
-    suggestions.push("Or add OAuth-backed subscription provider. Run: llm-router config --operation=upsert-provider --provider-id=chatgpt --name=\"ChatGPT Subscription\" --type=subscription --subscription-type=chatgpt-codex --subscription-profile=default");
+    suggestions.push("Or add OAuth-backed subscription provider. Run: llm-router config --operation=upsert-provider --provider-id=chatgpt --name=\"GPT Sub\" --type=subscription --subscription-type=chatgpt-codex --subscription-profile=default");
   } else {
     const providersWithoutModels = providers
       .filter((provider) => (provider.models || []).filter((model) => model && model.enabled !== false).length === 0)
@@ -4882,7 +5582,7 @@ async function runAiHelpAction(context) {
     "1. Upsert provider + models:",
     "   llm-router config --operation=upsert-provider --provider-id=<id> --name=\"<name>\" --endpoints=<url1,url2> --api-key=<key> --models=<model1,model2>",
     "1b. Upsert subscription provider (OAuth-backed ChatGPT Codex):",
-    "   llm-router config --operation=upsert-provider --provider-id=chatgpt --name=\"ChatGPT Subscription\" --type=subscription --subscription-type=chatgpt-codex --subscription-profile=default",
+    "   llm-router config --operation=upsert-provider --provider-id=chatgpt --name=\"GPT Sub\" --type=subscription --subscription-type=chatgpt-codex --subscription-profile=default",
     "   llm-router subscription login --profile=default",
     "2. Upsert model alias/group:",
     "   llm-router config --operation=upsert-model-alias --alias-id=<alias> --strategy=auto --targets=<provider/model,...>",
@@ -5197,48 +5897,75 @@ async function runDeployAction(context) {
     await fsPromises.writeFile(resolvedOut, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
 
     if (exportOnly) {
+      const exportWarnings = [
+        ...largeConfigWarningLines,
+        mustConfirmLargeConfig
+          ? "Manual deploy may fail on Cloudflare Free tier unless you reduce config size."
+          : ""
+      ].filter(Boolean);
       return {
         ok: true,
         mode: context.mode,
         exitCode: EXIT_SUCCESS,
-        data: [
-          ...largeConfigWarningLines,
-          mustConfirmLargeConfig
-            ? "Manual deploy may fail on Cloudflare Free tier unless you reduce config size."
-            : "",
-          `Exported worker config to ${resolvedOut}`,
-          `wrangler secret put LLM_ROUTER_CONFIG_JSON${cfEnv ? ` --env ${cfEnv}` : ""} < ${resolvedOut}`
-        ].filter(Boolean).join("\n")
+        data: buildOperationReport(
+          "Worker Config Exported",
+          [
+            ["Export File", resolvedOut],
+            ["Payload Size (bytes)", new Intl.NumberFormat("en-US").format(payloadBytes)],
+            ["Cloudflare Tier", `${formatCloudflareTierLabel(tierReport)} (${tierReport.reason || "unknown"})`],
+            ["Environment", cfEnv || "(default)"]
+          ],
+          [
+            renderListSection("Warnings", exportWarnings, { emptyMessage: "None." }),
+            renderListSection("Next Command", [
+              `wrangler secret put LLM_ROUTER_CONFIG_JSON${cfEnv ? ` --env ${cfEnv}` : ""} < ${resolvedOut}`
+            ])
+          ]
+        )
       };
     }
   }
 
   if (dryRun) {
+    const dryRunWarnings = [
+      allowWeakMasterKey ? "Weak master key override is enabled." : "",
+      ...largeConfigWarningLines,
+      mustConfirmLargeConfig
+        ? "Interactive deploy requires explicit confirmation (default: No)."
+        : "",
+      mustConfirmLargeConfig
+        ? "Use --allow-large-config=true to bypass this check in non-interactive mode."
+        : "",
+      generatedDeployMasterKey ? "Generated a deploy-time master key (not written to local config)." : ""
+    ].filter(Boolean);
+    const dryRunCommands = [
+      `wrangler${wranglerConfigPath ? ` --config ${wranglerConfigPath}` : ""} secret put LLM_ROUTER_CONFIG_JSON${cfEnv ? ` --env ${cfEnv}` : ""}`,
+      `wrangler${wranglerConfigPath ? ` --config ${wranglerConfigPath}` : ""} deploy${cfEnv ? ` --env ${cfEnv}` : ""}`
+    ];
     return {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: [
-        "Dry run (no deployment executed).",
-        allowWeakMasterKey ? "WARNING: weak master key override enabled." : "",
-        ...largeConfigWarningLines,
-        mustConfirmLargeConfig
-          ? "Interactive deploy requires explicit confirmation (default: No)."
-          : "",
-        mustConfirmLargeConfig
-          ? "Use --allow-large-config=true to bypass this check in non-interactive mode."
-          : "",
-        generatedDeployMasterKey ? "Generated a deploy-time master key (not written to local config)." : "",
-        `projectDir=${projectDir}`,
-        cloudflareApiTokenSource !== "none"
-          ? `cloudflareApiToken=${cloudflareApiTokenSource === "prompt" ? "provided-via-prompt" : `from-${cloudflareApiTokenSource}`}`
-          : "",
-        cloudflareAccountId ? `cloudflareAccountId=${cloudflareAccountId}` : "",
-        `cloudflareTier=${formatCloudflareTierLabel(tierReport)} (${tierReport.reason || "unknown"})`,
-        `wrangler${wranglerConfigPath ? ` --config ${wranglerConfigPath}` : ""} secret put LLM_ROUTER_CONFIG_JSON${cfEnv ? ` --env ${cfEnv}` : ""}`,
-        `wrangler${wranglerConfigPath ? ` --config ${wranglerConfigPath}` : ""} deploy${cfEnv ? ` --env ${cfEnv}` : ""}`,
-        `Payload bytes=${payloadBytes}`
-      ].filter(Boolean).join("\n")
+      data: buildOperationReport(
+        "Cloudflare Deploy Dry Run",
+        [
+          ["Project Directory", projectDir],
+          ["Wrangler Config", wranglerConfigPath || "(default)"],
+          ["Cloudflare API Token Source", cloudflareApiTokenSource === "none"
+            ? "(not set)"
+            : (cloudflareApiTokenSource === "prompt" ? "Prompt input" : `Environment (${cloudflareApiTokenSource})`)],
+          ["Cloudflare Account ID", cloudflareAccountId || "(not set)"],
+          ["Cloudflare Tier", `${formatCloudflareTierLabel(tierReport)} (${tierReport.reason || "unknown"})`],
+          ["Environment", cfEnv || "(default)"],
+          ["Payload Size (bytes)", new Intl.NumberFormat("en-US").format(payloadBytes)],
+          ["Generated Deploy Key", formatYesNo(generatedDeployMasterKey)],
+          ["Weak Key Override", formatYesNo(allowWeakMasterKey)]
+        ],
+        [
+          renderListSection("Warnings", dryRunWarnings, { emptyMessage: "None." }),
+          renderListSection("Commands", dryRunCommands)
+        ]
+      )
     };
   }
 
@@ -5367,15 +6094,36 @@ async function runDeployAction(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      "Cloudflare deployment completed.",
-      generatedDeployMasterKey ? "Generated a deploy-time master key. Persist it with `llm-router config --operation=set-master-key --master-key=...` if needed." : "",
-      wranglerTargetMessage,
-      deployZoneName ? `Deploy zone: ${deployZoneName}` : "",
-      secretResult.stdout.trim(),
-      deployResult.stdout.trim(),
-      postDeployGuide
-    ].filter(Boolean).join("\n")
+    data: buildOperationReport(
+      "Cloudflare Deployment Completed",
+      [
+        ["Project Directory", projectDir],
+        ["Environment", cfEnv || "(default)"],
+        ["Deploy Target", deployUsesWorkersDev ? "workers.dev" : (deployHost ? deployHost : "custom route")],
+        ["Deploy Zone", deployZoneName || "(not set)"],
+        ["Generated Deploy Key", formatYesNo(generatedDeployMasterKey)]
+      ],
+      [
+        renderListSection(
+          "Notes",
+          [
+            generatedDeployMasterKey
+              ? "Generated a deploy-time master key. Persist it with `llm-router config --operation=set-master-key --master-key=...` if needed."
+              : "",
+            wranglerTargetMessage
+          ],
+          { emptyMessage: "None." }
+        ),
+        renderListSection("Wrangler Output", [secretResult.stdout.trim(), deployResult.stdout.trim()], { emptyMessage: "No additional output." }),
+        postDeployGuide
+          ? renderListSection("Post-Deploy Checks", [
+            `dig +short ${deployHost} @1.1.1.1`,
+            `curl -I https://${deployHost}/anthropic`,
+            `Claude Code base URL: https://${deployHost}/anthropic (no :8787)`
+          ])
+          : ""
+      ]
+    )
   };
   } finally {
     if (typeof cleanupWranglerConfig === "function") {
@@ -5503,16 +6251,31 @@ async function runWorkerKeyAction(context) {
       ok: true,
       mode: context.mode,
       exitCode: EXIT_SUCCESS,
-      data: [
-        "Dry run (no secret update executed).",
-        allowWeakMasterKey ? "WARNING: weak master key override enabled." : "",
-        keyGenerated ? "Generated key for this operation." : "",
-        `projectDir=${projectDir}`,
-        cfEnv ? `env=${cfEnv}` : "",
-        `target=LLM_ROUTER_MASTER_KEY (${exists === null ? "existence unknown" : (exists ? "exists" : "missing")})`,
-        `wrangler secret put LLM_ROUTER_MASTER_KEY${cfEnv ? ` --env ${cfEnv}` : ""}`,
-        `masterKey=${maskSecret(masterKey)}`
-      ].filter(Boolean).join("\n")
+      data: buildOperationReport(
+        "Worker Key Dry Run",
+        [
+          ["Project Directory", projectDir],
+          ["Environment", cfEnv || "(default)"],
+          ["Target Secret", "LLM_ROUTER_MASTER_KEY"],
+          ["Secret Exists", exists === null ? "Unknown" : formatYesNo(Boolean(exists))],
+          ["Stored Key", maskSecret(masterKey)],
+          ["Generated In This Run", formatYesNo(keyGenerated)],
+          ["Weak Key Override", formatYesNo(allowWeakMasterKey)]
+        ],
+        [
+          renderListSection(
+            "Warnings",
+            [
+              allowWeakMasterKey ? "Weak master key override is enabled." : "",
+              keyGenerated ? "Generated key for this operation." : ""
+            ],
+            { emptyMessage: "None." }
+          ),
+          renderListSection("Command", [
+            `wrangler secret put LLM_ROUTER_MASTER_KEY${cfEnv ? ` --env ${cfEnv}` : ""}`
+          ])
+        ]
+      )
     };
   }
 
@@ -5547,14 +6310,22 @@ async function runWorkerKeyAction(context) {
     ok: true,
     mode: context.mode,
     exitCode: EXIT_SUCCESS,
-    data: [
-      `${exists === true ? "Updated" : "Set"} LLM_ROUTER_MASTER_KEY on Cloudflare Worker.`,
-      cfEnv ? `env=${cfEnv}` : "",
-      `projectDir=${projectDir}`,
-      `masterKey=${maskSecret(masterKey)}`,
-      keyGenerated ? `Generated key (copy now): ${masterKey}` : "",
-      putResult.stdout.trim()
-    ].filter(Boolean).join("\n")
+    data: buildOperationReport(
+      `${exists === true ? "Worker Key Updated" : "Worker Key Set"}`,
+      [
+        ["Target Secret", "LLM_ROUTER_MASTER_KEY"],
+        ["Environment", cfEnv || "(default)"],
+        ["Project Directory", projectDir],
+        ["Stored Key", maskSecret(masterKey)],
+        ["Generated In This Run", formatYesNo(keyGenerated)]
+      ],
+      [
+        keyGenerated
+          ? renderListSection("Generated Key (Copy Now)", [masterKey])
+          : "",
+        renderListSection("Wrangler Output", [putResult.stdout.trim()], { emptyMessage: "No additional output." })
+      ]
+    )
   };
 }
 
@@ -5603,8 +6374,13 @@ async function runSubscriptionLoginAction(context) {
       lines.push("");
       
       const success = await loginWithBrowser(profile, {
-        onUrl: (url) => {
-          lines.push(`If browser doesn't open, visit: ${url}`);
+        onUrl: (url, meta = {}) => {
+          if (meta?.openedBrowser === true) {
+            lines.push("Opened browser for OAuth login.");
+            lines.push(`Fallback URL: ${url}`);
+            return;
+          }
+          lines.push(`Open this URL to login: ${url}`);
         }
       });
       
@@ -5881,6 +6657,7 @@ const routerModule = {
           "provider-type",
           "subscription-type",
           "subscription-profile",
+          "device-code",
           "endpoints",
           "base-url",
           "openai-base-url",
@@ -5932,23 +6709,24 @@ const routerModule = {
         summary: "Manage providers, model aliases, rate-limit buckets, master key, and OS startup. TUI by default; commandline via --operation.",
         args: [
           { name: "operation", required: false, description: "Config operation (optional; prompts if omitted).", example: "--operation=upsert-provider" },
-          { name: "provider-id", required: false, description: "Provider id (slug/camelCase).", example: "--provider-id=openrouter" },
+          { name: "provider-id", required: false, description: "Provider id (lowercase letters/numbers/dashes).", example: "--provider-id=openrouter-primary" },
           { name: "name", required: false, description: "Provider Friendly Name (must be unique; shown in management screen).", example: "--name=OpenRouter Primary" },
-          { name: "type", required: false, description: "Provider type: standard | subscription.", example: "--type=subscription" },
-          { name: "subscription-type", required: false, description: "Required when --type=subscription. Supported: chatgpt-codex.", example: "--subscription-type=chatgpt-codex" },
-          { name: "subscription-profile", required: false, description: "OAuth token profile for subscription provider.", example: "--subscription-profile=personal" },
-          { name: "endpoints", required: false, description: "For standard provider: endpoint candidates for auto-probe (comma/semicolon/space/newline separated; TUI supports multiline paste).", example: "--endpoints=https://ramclouds.me,https://ramclouds.me/v1" },
+          { name: "type", required: false, description: "Provider type: standard (API key) | subscription (OAuth).", example: "--type=subscription" },
+          { name: "subscription-type", required: false, description: "For --type=subscription. Defaults to chatgpt-codex.", example: "--subscription-type=chatgpt-codex" },
+          { name: "subscription-profile", required: false, description: "OAuth token profile for subscription provider (defaults to provider-id).", example: "--subscription-profile=personal" },
+          { name: "device-code", required: false, description: "For subscription OAuth login during upsert: use device-code flow instead of browser.", example: "--device-code=true" },
+          { name: "endpoints", required: false, description: "For standard provider: endpoint candidates for auto-probe (comma-separated URLs).", example: "--endpoints=https://ramclouds.me,https://ramclouds.me/v1" },
           { name: "base-url", required: false, description: "For standard provider: provider base URL.", example: "--base-url=https://openrouter.ai/api/v1" },
           { name: "openai-base-url", required: false, description: "For standard provider: OpenAI endpoint base URL (format-specific override).", example: "--openai-base-url=https://ramclouds.me/v1" },
           { name: "claude-base-url", required: false, description: "For standard provider: Anthropic endpoint base URL (format-specific override).", example: "--claude-base-url=https://ramclouds.me" },
           { name: "api-key", required: false, description: "For standard provider: API key.", example: "--api-key=sk-or-v1-..." },
-          { name: "models", required: false, description: "Model list (comma/semicolon/space/newline separated; strips common log/error noise; TUI supports multiline paste). For chatgpt-codex subscription type, predefined models are applied automatically.", example: "--models=gpt-4o,claude-3-5-sonnet-latest" },
+          { name: "models", required: false, description: "Model list (comma-separated IDs; strips common log/error noise). For chatgpt-codex subscription type, defaults are prefilled and you can add/remove models; all selected models are live-validated before save.", example: "--models=gpt-5.3-codex,gpt-5-codex" },
           { name: "model", required: false, description: "Single model id (used by remove-model).", example: "--model=gpt-4o" },
-          { name: "fallback-models", required: false, description: "Qualified fallback models for set-model-fallbacks (comma/semicolon/space separated).", example: "--fallback-models=openrouter/gpt-4o,anthropic/claude-3-7-sonnet" },
+          { name: "fallback-models", required: false, description: "Qualified fallback models for set-model-fallbacks (comma-separated).", example: "--fallback-models=openrouter/gpt-4o,anthropic/claude-3-7-sonnet" },
           { name: "clear-fallbacks", required: false, description: "Clear all fallback models for set-model-fallbacks.", example: "--clear-fallbacks=true" },
           { name: "alias-id", required: false, description: "Model alias id for upsert/remove alias operations.", example: "--alias-id=chat.default" },
           { name: "strategy", required: false, description: "Model alias routing strategy: auto | ordered | round-robin | weighted-rr | quota-aware-weighted-rr.", example: "--strategy=auto" },
-          { name: "targets", required: false, description: "Model alias target list syntax: <ref>@<weight> (comma/semicolon/space/newline separated).", example: "--targets=openrouter/gpt-4o-mini@3,anthropic/claude-3-5-haiku@2" },
+          { name: "targets", required: false, description: "Model alias target list syntax: <ref>@<weight> (comma-separated).", example: "--targets=openrouter/gpt-4o-mini@3,anthropic/claude-3-5-haiku@2" },
           { name: "fallback-targets", required: false, description: "Model alias fallback target list with same syntax as --targets.", example: "--fallback-targets=openrouter/gpt-4o" },
           { name: "clear-fallback-targets", required: false, description: "Clear alias fallback target list.", example: "--clear-fallback-targets=true" },
           { name: "alias-metadata", required: false, description: "Optional alias metadata JSON object.", example: "--alias-metadata={\"owner\":\"router-team\"}" },
@@ -5980,7 +6758,7 @@ const routerModule = {
         examples: [
           "llm-router config",
           "llm-router config --operation=upsert-provider --provider-id=ramclouds --name=RamClouds --api-key=sk-... --endpoints=https://ramclouds.me,https://ramclouds.me/v1 --models=claude-opus-4-6-thinking,gpt-5.3-codex",
-          "llm-router config --operation=upsert-provider --provider-id=chatgpt --name=\"ChatGPT Subscription\" --type=subscription --subscription-type=chatgpt-codex --subscription-profile=default",
+          "llm-router config --operation=upsert-provider --provider-id=chatgpt --name=\"GPT Sub\" --type=subscription --subscription-type=chatgpt-codex --subscription-profile=default",
           "llm-router subscription login --profile=default",
           "llm-router config --operation=upsert-model-alias --alias-id=chat.default --strategy=auto --targets=openrouter/gpt-4o-mini@3,anthropic/claude-3-5-haiku@2 --fallback-targets=openrouter/gpt-4o",
           "llm-router config --operation=set-provider-rate-limits --provider-id=openrouter --bucket-id=openrouter-all-month --bucket-models=all --bucket-requests=20000 --bucket-window=month:1",