@oh-my-pi/pi-coding-agent 17.3.5 → 17.3.8

package/src/cli/stats-cli.ts

@@ -5,7 +5,7 @@
  */
 
 import { truncateToWidth } from "@oh-my-pi/pi-tui/utils";
-import { APP_NAME, formatDuration, formatNumber, formatPercent } from "@oh-my-pi/pi-utils";
+import { formatDuration, formatNumber, formatPercent } from "@oh-my-pi/pi-utils";
 import chalk from "@oh-my-pi/pi-utils/chalk";
 import { openPath } from "../utils/open";
 
@@ -57,45 +57,11 @@ function shortenSessionFile(p: string): string {
 
 export interface StatsCommandArgs {
 	port: number;
+	host: string;
 	json: boolean;
 	summary: boolean;
 }
 
-// =============================================================================
-// Argument Parser
-// =============================================================================
-
-/**
- * Parse stats subcommand arguments.
- * Returns undefined if not a stats command.
- */
-export function parseStatsArgs(args: string[]): StatsCommandArgs | undefined {
-	if (args.length === 0 || args[0] !== "stats") {
-		return undefined;
-	}
-
-	const result: StatsCommandArgs = {
-		port: 3847,
-		json: false,
-		summary: false,
-	};
-
-	for (let i = 1; i < args.length; i++) {
-		const arg = args[i];
-		if (arg === "--json" || arg === "-j") {
-			result.json = true;
-		} else if (arg === "--summary" || arg === "-s") {
-			result.summary = true;
-		} else if ((arg === "--port" || arg === "-p") && i + 1 < args.length) {
-			result.port = parseInt(args[++i], 10);
-		} else if (arg.startsWith("--port=")) {
-			result.port = parseInt(arg.split("=")[1], 10);
-		}
-	}
-
-	return result;
-}
-
 function formatCost(n: number): string {
 	if (n < 0.01) return `$${n.toFixed(4)}`;
 	if (n < 1) return `$${n.toFixed(3)}`;
@@ -112,9 +78,8 @@ function normalizePremiumRequests(n: number): number {
 
 export async function runStatsCommand(cmd: StatsCommandArgs): Promise<void> {
 	// Lazy import to avoid loading stats module when not needed
-	const { getDashboardStats, syncAllSessions, getTotalMessageCount, startServer, closeDb } = await import(
-		"@oh-my-pi/omp-stats"
-	);
+	const { closeDb, formatStatsDashboardUrl, getDashboardStats, getTotalMessageCount, startServer, syncAllSessions } =
+		await import("@oh-my-pi/omp-stats");
 
 	// Sync session files first
 	const progress = createSyncProgressReporter();
@@ -136,8 +101,8 @@ export async function runStatsCommand(cmd: StatsCommandArgs): Promise<void> {
 	}
 
 	// Start the dashboard server
-	const { hostname, port } = await startServer(cmd.port);
-	const url = `http://${hostname}:${port}`;
+	const { hostname, port } = await startServer(cmd.port, cmd.host);
+	const url = formatStatsDashboardUrl(hostname, port);
 	console.log(chalk.green(`Dashboard available at: ${url}`));
 
 	// Open browser
@@ -197,34 +162,3 @@ async function printStatsSummary(): Promise<void> {
 
 	console.log("");
 }
-
-// =============================================================================
-// Help
-// =============================================================================
-
-export function printStatsHelp(): void {
-	console.log(`${chalk.bold(`${APP_NAME} stats`)} - AI Usage Statistics Dashboard
-
-${chalk.bold("Usage:")}
-  ${APP_NAME} stats [options]
-
-${chalk.bold("Options:")}
-  -p, --port <port>  Port for the dashboard server (default: 3847)
-  -j, --json         Output stats as JSON and exit
-  -s, --summary      Print summary to console and exit
-  -h, --help         Show this help message
-
-${chalk.bold("Examples:")}
-  ${APP_NAME} stats              # Start dashboard server
-  ${APP_NAME} stats --json       # Print stats as JSON
-  ${APP_NAME} stats --summary    # Print summary to console
-  ${APP_NAME} stats --port 8080  # Start on custom port
-
-${chalk.bold("Metrics:")}
-  - Total requests and error rate
-  - Token usage (input, output, cache)
-  - Cost breakdown
-  - Average duration and time to first token (TTFT)
-  - Tokens per second throughput
-`);
-}

package/src/cli/update-cli.ts

@@ -15,7 +15,12 @@ import chalk from "@oh-my-pi/pi-utils/chalk";
 import { withFileLock } from "@oh-my-pi/pi-utils/file-lock";
 import { $ } from "bun";
 import { theme } from "../modes/theme/theme";
-import { isTimeoutError, withTimeoutSignal } from "../utils/fetch-timeout";
+import {
+	isTimeoutError,
+	isUnsupportedProxyError,
+	unsupportedProxyMessage,
+	withTimeoutSignal,
+} from "../utils/fetch-timeout";
 
 const REPO = "can1357/oh-my-pi";
 const PACKAGE = "@oh-my-pi/pi-coding-agent";
@@ -248,6 +253,7 @@ async function getReleaseBinaryAsset(
 		if (isTimeoutError(err)) {
 			throw new Error("Timed out fetching GitHub release metadata after 30s", { cause: err });
 		}
+		if (isUnsupportedProxyError(err)) throw new Error(unsupportedProxyMessage(), { cause: err });
 		throw err;
 	}
 	if ((response.status === 403 && !githubToken) || response.status === 429) {
@@ -287,6 +293,7 @@ export async function downloadVerifiedBinary(options: VerifiedBinaryDownloadOpti
 		if (isTimeoutError(err)) {
 			throw new Error("Timed out downloading release binary after 15 minutes", { cause: err });
 		}
+		if (isUnsupportedProxyError(err)) throw new Error(unsupportedProxyMessage(), { cause: err });
 		throw err;
 	}
 	if (!response.ok || !response.body) {
@@ -326,6 +333,7 @@ export async function downloadVerifiedBinary(options: VerifiedBinaryDownloadOpti
 		if (isTimeoutError(err)) {
 			throw new Error("Timed out downloading release binary after 15 minutes", { cause: err });
 		}
+		if (isUnsupportedProxyError(err)) throw new Error(unsupportedProxyMessage(), { cause: err });
 		throw err;
 	}
 }
@@ -441,6 +449,14 @@ function tryRealpath(p: string): string | undefined {
 	}
 }
 
+function isSymlinkPath(p: string): boolean {
+	try {
+		return fs.lstatSync(p).isSymbolicLink();
+	} catch {
+		return false;
+	}
+}
+
 function isPathInDirectoryLexical(filePath: string, directoryPath: string): boolean {
 	const normalizedPath = normalizePathForComparison(path.resolve(filePath));
 	const normalizedDirectory = normalizePathForComparison(path.resolve(directoryPath));
@@ -509,6 +525,14 @@ interface UpdateMethodResolutionOptions {
 	 * preserves a global package symlink instead of resolving into its checkout.
 	 */
 	ompLinkTarget?: string;
+	/**
+	 * Whether package-manager routing (bun/npm) is permitted. Binary-only
+	 * releases pass `false`: a manager launcher then resolves to `"binary"` and
+	 * is taken over in place rather than reinstalled through its manager. Defaults
+	 * to `true` in {@link resolveUpdateMethod} so callers that only classify need
+	 * not set it.
+	 */
+	allowPackageManagers?: boolean;
 }
 
 type UpdateTarget =
@@ -525,6 +549,7 @@ function resolveUpdateMethod(
 	options: UpdateMethodResolutionOptions = {},
 ): UpdateMethod {
 	const {
+		allowPackageManagers = true,
 		bunGlobalDir,
 		homebrewPrefix,
 		miseBinDirs = [],
@@ -555,6 +580,7 @@ function resolveUpdateMethod(
 		globalBinDir: bunBinDir,
 	});
 	if (
+		allowPackageManagers &&
 		bunBinDir &&
 		isPathInDirectory(ompPath, bunBinDir) &&
 		!isStandaloneRegularFile &&
@@ -564,6 +590,7 @@ function resolveUpdateMethod(
 	}
 	const npmNodeModulesDir = resolveNpmGlobalNodeModulesDir(npmBinDir);
 	if (
+		allowPackageManagers &&
 		npmBinDir &&
 		isPathInDirectory(ompPath, npmBinDir) &&
 		!isStandaloneRegularFile &&
@@ -611,10 +638,25 @@ export function resolveUpdateTargetFromPath(
 		ompLinkTarget,
 	});
 	if (method === "binary") {
-		// A package-manager-enabled update follows a foreign alias to replace
-		// its standalone binary. Binary-only releases intentionally replace the
-		// selected manager launcher in place.
-		const binaryPath = options.allowPackageManagers && ompIsSymlink ? (ompRealpath ?? ompPath) : ompPath;
+		// A symlinked launcher created by bun/npm is taken over in place on a
+		// binary-only release: routing through the manager is impossible, so the
+		// standalone binary replaces the launcher and keeps the PATH entry live.
+		// Every other symlink — a foreign alias, or an admin symlink into a
+		// shared install — is self-healing: update the real binary it resolves
+		// to and leave the launcher untouched, in every distribution channel.
+		// The old channel gate clobbered these foreign launchers on binary-only
+		// releases (EACCES on a root-owned link dir, or a stale split-brain copy
+		// of the binary shadowing the shared install).
+		const managerLauncher =
+			ompIsSymlink &&
+			!options.allowPackageManagers &&
+			resolveUpdateMethod(ompPath, bunBinDir, {
+				...options,
+				allowPackageManagers: true,
+				ompIsRegularFile,
+				ompLinkTarget,
+			}) !== "binary";
+		const binaryPath = ompIsSymlink && !managerLauncher ? (ompRealpath ?? ompPath) : ompPath;
 		return { method, path: binaryPath, replacesSymlink: ompIsSymlink && binaryPath === ompPath };
 	}
 	if (method === "bun" || method === "npm") return { method, path: ompPath };
@@ -623,25 +665,34 @@ export function resolveUpdateTargetFromPath(
 /**
  * Resolve how the running install should be updated.
  *
- * `allowPackageManagers: false` skips the `bun pm bin -g` / `npm prefix -g`
- * probes entirely — used for binary-only releases, where routing through a
- * package manager is never valid and the probes would be wasted subprocesses.
+ * `allowPackageManagers: false` disables bun/npm routing — used for
+ * binary-only releases, where reinstalling through a package manager is never
+ * valid. The `bun pm bin -g` / `npm prefix -g` probes are then skipped unless
+ * the launcher is a symlink, whose bin dirs distinguish a manager launcher
+ * (taken over in place) from a foreign symlink (resolved to its real binary).
  * Homebrew/mise detection always runs: both managers install GitHub release
  * binaries and stay valid regardless of how the release is distributed.
  */
 async function resolveUpdateTarget(options: { allowPackageManagers: boolean }): Promise<UpdateTarget> {
-	const bunBinDir = options.allowPackageManagers ? await getBunGlobalBinDir() : undefined;
-	const npmBinDir = options.allowPackageManagers ? await getNpmGlobalBinDir() : undefined;
 	const homebrewPrefix = await getHomebrewFormulaPrefix();
 	const miseAvailable = $which("mise") !== undefined;
 	const miseBinDirs = miseAvailable ? await getMiseBinDirs() : [];
 	const miseDataDir = miseAvailable ? getMiseDataDir() : undefined;
 	const ompPath = resolveOmpPath();
 
+	// Binary-only releases skip package-manager routing, but a symlinked
+	// launcher still needs the manager bin dirs to tell a bun/npm launcher
+	// (taken over in place) from a foreign symlink (resolved to its real
+	// binary). A plain-file install never needs the distinction, so the common
+	// case stays probe-free.
+	const probeManagers = options.allowPackageManagers || (ompPath !== undefined && isSymlinkPath(ompPath));
+	const bunBinDir = probeManagers ? await getBunGlobalBinDir() : undefined;
+	const npmBinDir = probeManagers ? await getNpmGlobalBinDir() : undefined;
+
 	if (ompPath) {
 		return resolveUpdateTargetFromPath(ompPath, bunBinDir, {
 			allowPackageManagers: options.allowPackageManagers,
-			bunGlobalDir: options.allowPackageManagers ? process.env.BUN_INSTALL_GLOBAL_DIR : undefined,
+			bunGlobalDir: probeManagers ? process.env.BUN_INSTALL_GLOBAL_DIR : undefined,
 			homebrewPrefix,
 			miseBinDirs,
 			miseDataDir,
@@ -672,6 +723,7 @@ async function fetchLatestManifest(
 				cause: err,
 			});
 		}
+		if (isUnsupportedProxyError(err)) throw new Error(unsupportedProxyMessage(), { cause: err });
 		throw err;
 	}
 	if (!response.ok) {

package/src/cli-commands.ts

@@ -10,7 +10,13 @@
  */
 import type { CommandEntry } from "@oh-my-pi/pi-utils/cli";
 import * as commandHelp from "./cli/command-help";
-import { flagConsumesValue } from "./cli/flag-tables";
+import {
+	EXTENSION_SHADOWABLE_STRING_FLAGS,
+	flagConsumesValue,
+	OPTIONAL_VALUE_FLAGS,
+	STRING_VALUE_FLAGS,
+	VALUELESS_FLAGS,
+} from "./cli/flag-tables";
 import { launchHelp } from "./commands/launch-help";
 
 export const commands: CommandEntry[] = [
@@ -285,12 +291,54 @@ function leadingSubcommandIndex(argv: string[]): number {
 	return -1;
 }
 
+/**
+ * Subcommands that share the launch flag surface, so leading global flags
+ * (`--cwd`, `--model`, `--approval-mode`, …) placed before them are meaningful
+ * and must be forwarded ({@link resolveCliArgv}, #2970). Every other subcommand
+ * parses only its own flags.
+ */
+export const LAUNCH_FLAG_COMMANDS: Record<string, true> = { launch: true, acp: true };
+
+/** Whether `arg` names a flag from the launch surface (bare or `--flag=value`). */
+function isLaunchGlobalFlag(arg: string): boolean {
+	const eq = arg.indexOf("=");
+	const name = arg.startsWith("--") && eq !== -1 ? arg.slice(0, eq) : arg;
+	return (
+		STRING_VALUE_FLAGS.has(name) ||
+		OPTIONAL_VALUE_FLAGS.has(name) ||
+		VALUELESS_FLAGS.has(name) ||
+		EXTENSION_SHADOWABLE_STRING_FLAGS.has(name)
+	);
+}
+
+/**
+ * Drop recognized launch-global flags (and any value they consume) from the
+ * leading segment before a hoisted non-launch subcommand. `--cwd` and friends
+ * belong to the launch surface and mean nothing to a subcommand like `update`,
+ * whose strict parser would otherwise reject them with a cryptic
+ * `node:util.parseArgs` error (#8891). Tokens the launch tables don't recognize
+ * are kept, so a subcommand's own leading flags still reach it.
+ */
+function stripLaunchGlobalFlags(leading: readonly string[]): string[] {
+	const kept: string[] = [];
+	for (let index = 0; index < leading.length; index += 1) {
+		const arg = leading[index];
+		if (isLaunchGlobalFlag(arg)) {
+			if (flagConsumesValue(arg, leading[index + 1])) index += 1;
+			continue;
+		}
+		kept.push(arg);
+	}
+	return kept;
+}
+
 /**
  * Decide what the CLI runner should do with raw argv: reject bare reserved
  * management words, pass help/version through untouched, route a recognized
  * subcommand (even behind leading global flags like `--approval-mode=yolo`) to
- * that command with the flags preserved, and forward everything else to
- * `launch` (#2970).
+ * that command, and forward everything else to `launch` (#2970). Leading
+ * launch-global flags are forwarded to launch-shaped commands but stripped for
+ * other subcommands that cannot parse them (#8891).
  */
 export function resolveCliArgv(argv: string[]): ResolvedCliArgv {
 	const first = argv[0];
@@ -302,12 +350,18 @@ export function resolveCliArgv(argv: string[]): ResolvedCliArgv {
 	if (isSubcommand(first)) return { argv };
 	// A subcommand can hide behind leading global option flags
 	// (`omp --approval-mode=yolo acp`). `run` dispatches strictly on argv[0], so
-	// hoist the subcommand to the front and keep the leading flags as its own
-	// argv; the command's parser then applies them. Genuine launch prompts (no
-	// trailing subcommand) are untouched.
+	// hoist the subcommand to the front. Launch-shaped commands share the launch
+	// flag surface, so their leading flags are forwarded and applied; every other
+	// subcommand parses only its own flags, so launch-global flags placed before
+	// it (`omp --cwd <dir> update`) are stripped rather than forwarded into a
+	// crash (#8891). Genuine launch prompts (no trailing subcommand) are untouched.
 	const subIndex = leadingSubcommandIndex(argv);
 	if (subIndex >= 0) {
-		return { argv: [argv[subIndex], ...argv.slice(0, subIndex), ...argv.slice(subIndex + 1)] };
+		const sub = argv[subIndex];
+		const leading = argv.slice(0, subIndex);
+		const trailing = argv.slice(subIndex + 1);
+		const forwardedLeading = LAUNCH_FLAG_COMMANDS[sub] === true ? leading : stripLaunchGlobalFlags(leading);
+		return { argv: [sub, ...forwardedLeading, ...trailing] };
 	}
 	return { argv: ["launch", ...argv] };
 }

package/src/commands/completions.ts

@@ -5,7 +5,7 @@
  * (see `cli/completion-gen.ts`), so it never drifts from the actual CLI surface.
  */
 
-import { APP_NAME, VERSION } from "@oh-my-pi/pi-utils";
+import { APP_NAME, postmortem, VERSION } from "@oh-my-pi/pi-utils";
 import { Args, type CliConfig, Command, type CommandCtor } from "@oh-my-pi/pi-utils/cli";
 import { completionsHelp as commandHelp } from "../cli/command-help";
 import { buildSpec, generateCompletion, type Shell } from "../cli/completion-gen";
@@ -55,6 +55,7 @@ export default class Completions extends Command {
 		}
 
 		await Bun.write(Bun.stdout, await generateLiveCompletion(shell));
+		await postmortem.quit(0);
 	}
 }
 

package/src/commands/stats.ts

@@ -4,13 +4,15 @@
 
 import { Command, Flags } from "@oh-my-pi/pi-utils/cli";
 import { statsHelp as commandHelp } from "../cli/command-help";
-import { runStatsCommand, type StatsCommandArgs } from "../cli/stats-cli";
-import { initTheme } from "../modes/theme/theme";
+import type { StatsCommandArgs } from "../cli/stats-cli";
+import * as statsCli from "../cli/stats-cli";
+import * as theme from "../modes/theme/theme";
 
 export default class Stats extends Command {
 	static description = commandHelp.description;
 	static flags = {
 		port: Flags.integer({ char: "p", description: "Port for the dashboard server", default: 3847 }),
+		host: Flags.string({ description: "Host to bind", default: "127.0.0.1" }),
 		json: Flags.boolean({ char: "j", description: "Output stats as JSON", default: false }),
 		summary: Flags.boolean({ char: "s", description: "Print summary to console", default: false }),
 	};
@@ -20,11 +22,12 @@ export default class Stats extends Command {
 
 		const cmd: StatsCommandArgs = {
 			port: flags.port,
+			host: flags.host ?? "127.0.0.1",
 			json: flags.json,
 			summary: flags.summary,
 		};
 
-		await initTheme();
-		await runStatsCommand(cmd);
+		await theme.initTheme();
+		await statsCli.runStatsCommand(cmd);
 	}
 }

package/src/commit/agentic/index.ts

@@ -11,7 +11,7 @@ import { ModelRegistry } from "../../config/model-registry";
 import { Settings } from "../../config/settings";
 import { discoverAuthStorage, discoverContextFiles, loadCliExtensionProviders } from "../../sdk";
 import * as git from "../../utils/git";
-import { abortOnGitFailure, pushOrAbort } from "../execute";
+import { abortOnGitFailure, CommitAbortedError, pushOrAbort } from "../execute";
 import { type ExistingChangelogEntries, runCommitAgentSession } from "./agent";
 import { generateFallbackProposal } from "./fallback";
 import { assignLockFilesToPlan } from "./lock-files";
@@ -303,7 +303,20 @@ async function runSplitCommit(
 	}
 
 	process.stdout.write("● Creating split commits...\n");
-	const stagedDiff = await git.diff(ctx.cwd, { cached: true, binary: true });
+	let stagedDiff: string;
+	try {
+		stagedDiff = await git.diff(ctx.cwd, { cached: true, binary: true, requireComplete: true });
+	} catch (error) {
+		if (error instanceof git.GitOutputTruncatedError) {
+			process.stderr.write(
+				`✗ Cannot create split commits: ${error.message}\n` +
+					"  A large or binary file makes the staged diff too big to slice safely.\n" +
+					"  Commit the large file(s) on their own, then re-run for the rest.\n",
+			);
+			throw new CommitAbortedError();
+		}
+		throw error;
+	}
 	await git.stage.reset(ctx.cwd);
 	for (const [position, commitIndex] of order.entries()) {
 		const commit = plan.commits[commitIndex];

package/src/commit/git/diff.ts

@@ -21,9 +21,13 @@ export function parseNumstat(output: string): NumstatEntry[] {
 
 export function parseFileDiffs(diff: string): FileDiff[] {
 	const sections: FileDiff[] = [];
-	const parts = diff.split("\ndiff --git ");
+	// Split on a line-start lookahead so each block keeps its terminating
+	// newline(s) verbatim. Consuming the delimiter would drop the blank line
+	// that terminates a `GIT binary patch` block, corrupting binary diffs on
+	// rebuild (issue #8899).
+	const parts = diff.split(/^(?=diff --git )/m);
 	for (let index = 0; index < parts.length; index += 1) {
-		const part = index === 0 ? parts[index] : `diff --git ${parts[index]}`;
+		const part = parts[index];
 		if (!part.trim()) continue;
 		const lines = part.split("\n");
 		const header = lines[0] ?? "";

package/src/config/model-resolver.ts

@@ -22,7 +22,7 @@ import { modelMatchesHost } from "@oh-my-pi/pi-catalog/hosts";
 import { buildModelProviderPriorityRank } from "@oh-my-pi/pi-catalog/identity";
 import { stripThinkingVariantToken } from "@oh-my-pi/pi-catalog/identity/family";
 import { clampThinkingLevelForModel } from "@oh-my-pi/pi-catalog/model-thinking";
-import { modelsAreEqual } from "@oh-my-pi/pi-catalog/models";
+import { type GeneratedProvider, getBundledModels, modelsAreEqual } from "@oh-my-pi/pi-catalog/models";
 import { DEFAULT_MODEL_PER_PROVIDER } from "@oh-my-pi/pi-catalog/provider-models";
 import { resolveBareVariantAlias, resolveVariantAlias } from "@oh-my-pi/pi-catalog/variant-collapse";
 import { fuzzyMatch } from "@oh-my-pi/pi-tui";
@@ -595,6 +595,41 @@ function includeSyntheticAllowedModels(available: Model<Api>[], allowedModels: I
 	return result;
 }
 
+/**
+ * Provider-lock a raw-id cross match.
+ *
+ * A slash-prefixed selector like `anthropic/claude-opus-5` is ambiguous: it is
+ * both the `anthropic` provider's canonical selector and — verbatim — an
+ * OpenRouter aggregator model id. When the named provider genuinely carries
+ * that model id in the bundled catalog but the model is missing from the
+ * candidate set (provider disabled, no credentials, or filtered out), letting
+ * the raw-id fallback re-bind the request onto a different provider's
+ * same-named model is a silent, expensive surprise — typically the aggregator's
+ * copy (OpenRouter bills published per-token Claude prices). Such a reference
+ * is provider-locked: it must fail rather than shadow.
+ *
+ * The lock only applies when the named provider carries the exact id in the
+ * bundled catalog. An aggregator raw id the named provider does NOT carry
+ * (e.g. `openai/gpt-4o:extended` — `openai` bundles `gpt-4o`, not the
+ * `:extended` variant) is legitimately an aggregator id and keeps resolving
+ * through the raw-id fallback, so bare aggregator selectors keep working.
+ */
+function isProviderLockedCrossMatch(pattern: string, matchedModel: Model<Api>): boolean {
+	const slashIdx = pattern.indexOf("/");
+	if (slashIdx <= 0) {
+		return false;
+	}
+	const provider = pattern.slice(0, slashIdx).toLowerCase();
+	const modelId = pattern.slice(slashIdx + 1).toLowerCase();
+	if (matchedModel.provider.toLowerCase() === provider) {
+		return false;
+	}
+	// Case-insensitive on both halves: the surrounding matcher lowercases the
+	// selector before comparing ids, so the lock must not evaporate on case
+	// variance (catalog provider keys are lowercase; model ids may not be).
+	return getBundledModels(provider as GeneratedProvider).some(m => m.id.toLowerCase() === modelId);
+}
+
 /**
  * Find an exact explicit provider/model match.
  */
@@ -644,11 +679,17 @@ function matchModel(
 	// Exact ID match (case-insensitive) — this must happen before provider-scoped
 	// fuzzy matching so raw IDs that contain slashes (for example OpenRouter model
 	// IDs like "openai/gpt-4o:extended") still resolve as IDs instead of being
-	// misread as a provider-qualified selector.
+	// misread as a provider-qualified selector. A provider-qualified pattern
+	// whose named provider carries the id stays locked to that provider when its
+	// only exact-id matches live on a different provider (isProviderLockedCrossMatch).
 	const lowerPattern = modelPattern.toLowerCase();
 	const exactMatches = availableModels.filter(m => m.id.toLowerCase() === lowerPattern);
 	if (exactMatches.length > 0) {
-		return pickPreferredModel(exactMatches, context);
+		const unlockedMatches = exactMatches.filter(m => !isProviderLockedCrossMatch(modelPattern, m));
+		if (unlockedMatches.length > 0) {
+			return pickPreferredModel(unlockedMatches, context);
+		}
+		return undefined;
 	}
 
 	const bedrockInferenceProfile = resolveBedrockInferenceProfileModelId(modelPattern, availableModels);
@@ -1710,11 +1751,14 @@ function findExactCliModel(
 	// Flat-id (or full-selector-string) matches prefer authenticated providers,
 	// then fall back to catalog order. This covers aggregator-style flat ids
 	// that merely look provider-qualified (e.g. "openai/gpt-oss-120b" hosted on
-	// OpenRouter), where the provider/id decomposition above found nothing.
+	// OpenRouter), where the provider/id decomposition above found nothing. A
+	// provider-qualified selector whose named provider carries the id must not
+	// re-bind onto another provider's same-named flat id
+	// (isProviderLockedCrossMatch); it stays provider-locked and fails instead.
 	const lower = selector.toLowerCase();
 	const isFlatMatch = (model: Model<Api>) =>
 		model.id.toLowerCase() === lower || formatModelString(model).toLowerCase() === lower;
-	const preferred = availableModels.find(isFlatMatch);
+	const preferred = availableModels.find(m => isFlatMatch(m) && !isProviderLockedCrossMatch(selector, m));
 	if (preferred) return preferred;
 	// The unauthenticated catalog fallback is a weak match: a bare id like
 	// `default` collides with the bundled `cursor/default` model, which must not
@@ -1723,7 +1767,9 @@ function findExactCliModel(
 	// role gets a chance first; the deferred fuzzy fallback below still recovers
 	// the catalog id when no role matches.
 	if (options?.catalogFallback === false) return undefined;
-	return availableModels === allModels ? undefined : allModels.find(isFlatMatch);
+	return availableModels === allModels
+		? undefined
+		: allModels.find(m => isFlatMatch(m) && !isProviderLockedCrossMatch(selector, m));
 }
 
 export interface ResolveCliModelResult {

package/src/config/models-config.ts

@@ -66,12 +66,12 @@ export function validateProviderConfiguration(
 		const requiresAuth =
 			mode === "runtime-register"
 				? !config.apiKey && !config.oauthConfigured
-				: !config.apiKey && (config.auth ?? "apiKey") !== "none";
+				: !config.apiKey && (config.auth ?? "apiKey") !== "none" && (config.auth ?? "apiKey") !== "oauth";
 		if (requiresAuth) {
 			throw new Error(
 				mode === "runtime-register"
 					? `Provider ${providerName}: "apiKey" or "oauth" is required when defining models.`
-					: `Provider ${providerName}: "apiKey" is required when defining custom models unless auth is "none".`,
+					: `Provider ${providerName}: "apiKey" is required when defining custom models unless auth is "none" or "oauth".`,
 			);
 		}
 	}

package/src/config/settings-schema.ts

@@ -5254,6 +5254,39 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"providers.cacheRetention": {
+		type: "enum",
+		values: ["auto", "short", "long", "none"] as const,
+		default: "auto",
+		ui: {
+			tab: "providers",
+			group: "Protocol",
+			label: "Prompt Cache Retention",
+			description:
+				"Prompt-cache retention forwarded to providers that support it (Anthropic, Bedrock, OpenRouter, OpenAI)",
+			options: [
+				{
+					value: "auto",
+					label: "Auto",
+					description:
+						"Provider default — Anthropic uses 5m entries kept warm by idle keep-alive refreshes; PI_CACHE_RETENTION still applies",
+				},
+				{
+					value: "short",
+					label: "Short (5m)",
+					description:
+						"Cheapest cache writes; Anthropic keeps the entry warm with bounded keep-alive refreshes while idle",
+				},
+				{
+					value: "long",
+					label: "Long (1h)",
+					description: "1h TTL where the provider supports it; pricier writes, no keep-alive refresh requests",
+				},
+				{ value: "none", label: "Off", description: "Disable prompt caching and cache-affinity routing" },
+			],
+		},
+	},
+
 	"providers.streamFirstEventTimeoutSeconds": {
 		type: "number",
 		default: -1,