@team-agent/installer 0.5.77 → 0.5.78

package/crates/team-agent/src/cli/models.rs

@@ -136,8 +136,15 @@ fn run_catalog(program: &Path, timeout: Duration, max_bytes: u64) -> Result<Vec<
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[cfg(unix)]
+    use std::io::Write;
+    #[cfg(unix)]
+    use std::sync::atomic::{AtomicU64, Ordering};
     use std::time::Instant;
 
+    #[cfg(unix)]
+    static FIXTURE_SEQUENCE: AtomicU64 = AtomicU64::new(0);
+
     #[cfg(unix)]
     #[test]
     fn real_dispatcher_child_helper() {
@@ -244,12 +251,13 @@ mod tests {
     #[cfg(unix)]
     fn fixture(body: &str) -> std::path::PathBuf {
         use std::os::unix::fs::PermissionsExt;
+        let sequence = FIXTURE_SEQUENCE.fetch_add(1, Ordering::Relaxed);
         let root = std::env::current_exe()
             .unwrap()
             .parent()
             .unwrap()
             .join(format!(
-                "team-agent-pi-fixture-{}-{}",
+                "team-agent-pi-fixture-{}-{}-{sequence}",
                 std::process::id(),
                 std::time::SystemTime::now()
                     .duration_since(std::time::UNIX_EPOCH)
@@ -269,6 +277,18 @@ mod tests {
         path
     }
 
+    #[cfg(unix)]
+    fn fixture_with_sidecars(body: &str) -> std::path::PathBuf {
+        let path = fixture(body);
+        let script = std::fs::read_to_string(&path).unwrap();
+        let script = script.strip_prefix("#!/bin/sh\n").unwrap();
+        let script = format!(
+            "#!/bin/sh\nprintf '1\\n' > \"$0.entered\" || :\n{script}body_status=$?\nprintf '1\\n' > \"$0.completed\" || :\nexit \"$body_status\"\n"
+        );
+        std::fs::write(&path, script).unwrap();
+        path
+    }
+
     #[cfg(unix)]
     fn cleanup_fixture(path: &Path) {
         let _ = std::fs::remove_dir_all(path.parent().unwrap());
@@ -294,15 +314,22 @@ mod tests {
     }
 
     #[cfg(unix)]
-    fn read_native_timeout_receipt(path: &Path) -> BTreeMap<String, String> {
+    fn native_timeout_stage_receipt(receipt: &Path) -> std::path::PathBuf {
+        receipt.with_extension("stage")
+    }
+
+    #[cfg(unix)]
+    fn parse_native_timeout_receipt(path: &Path) -> Option<BTreeMap<String, String>> {
         let mut fields = BTreeMap::new();
-        for line in std::fs::read_to_string(path).unwrap().lines() {
-            let (key, value) = line.split_once('=').expect("receipt key/value");
-            assert!(fields.insert(key.to_string(), value.to_string()).is_none());
+        for line in std::fs::read_to_string(path).ok()?.lines() {
+            let (key, value) = line.split_once('=')?;
+            if fields.insert(key.to_string(), value.to_string()).is_some() {
+                return None;
+            }
         }
-        assert_eq!(
-            fields.keys().map(String::as_str).collect::<Vec<_>>(),
-            vec![
+        let keys = fields.keys().map(String::as_str).collect::<Vec<_>>();
+        (keys
+            == vec![
                 "child_argv_exact",
                 "child_pid",
                 "child_spawn_attempts",
@@ -312,9 +339,22 @@ mod tests {
                 "parent_argv_exact",
                 "parent_pid",
                 "parent_started_once",
-            ]
-        );
-        fields
+            ])
+        .then_some(fields)
+    }
+
+    #[cfg(unix)]
+    fn wait_native_timeout_receipt(path: &Path) -> BTreeMap<String, String> {
+        let deadline = Instant::now() + Duration::from_millis(500);
+        loop {
+            if let Some(fields) = parse_native_timeout_receipt(path) {
+                return fields;
+            }
+            if Instant::now() >= deadline {
+                panic!("native timeout receipt did not become complete after runner return");
+            }
+            std::thread::sleep(Duration::from_millis(1));
+        }
     }
 
     #[cfg(unix)]
@@ -334,15 +374,112 @@ mod tests {
         result
     }
 
+    #[cfg(unix)]
+    fn safe_fixture_sidecar(path: &Path, expected: &str) -> &'static str {
+        match std::fs::read_to_string(path) {
+            Ok(text) if text == expected => "present_expected",
+            Ok(_) => "present_unexpected",
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => "missing",
+            Err(_) => "unavailable",
+        }
+    }
+
+    #[cfg(unix)]
+    fn safe_runner_fixture_observation(path: &Path) -> String {
+        format!(
+            "fixture_entered={} fixture_completed={} fixture_count={}",
+            safe_fixture_sidecar(&path.with_extension("entered"), "1\n"),
+            safe_fixture_sidecar(&path.with_extension("completed"), "1\n"),
+            safe_fixture_sidecar(&path.with_extension("count"), "1:--list-models\n"),
+        )
+    }
+
+    #[cfg(unix)]
+    fn safe_runner_observation(
+        elapsed: Duration,
+        observation: &crate::lifecycle::launch::pi_mcp::PiCatalogTestObservation,
+    ) -> String {
+        format!(
+            "elapsed_ms={} spawn_count={} argv={:?} parent_pid={:?} parent_exit_success={:?} parent_exit_code={:?} reader_timeout={}",
+            elapsed.as_millis(),
+            observation.spawn_count,
+            observation.argv,
+            observation.parent_pid,
+            observation.parent_exit_success,
+            observation.parent_exit_code,
+            observation.reader_timeout,
+        )
+    }
+
+    #[cfg(unix)]
+    fn safe_models_result_class(result: &CmdResult) -> &'static str {
+        let CmdOutput::Human(text) = &result.output else {
+            return "non_human_output";
+        };
+        let Ok(value) = serde_json::from_str::<Value>(text) else {
+            return "non_json_output";
+        };
+        match value.get("ok").and_then(Value::as_bool) {
+            Some(true) => "success_json",
+            Some(false) => match value.get("error").and_then(Value::as_str) {
+                Some(error) if error.contains("unavailable") => "runner_unavailable",
+                Some(error) if error.contains("timed out") => "runner_timeout",
+                Some(error) if error.contains("command failed") => "runner_exit",
+                Some(error) if error.contains("could not be read") => "reader_error",
+                Some(error) if error.contains("exceeds") => "reader_oversize",
+                Some(error) if error.contains("catalog") => "parser_catalog_error",
+                Some(_) => "failure_json",
+                None => "failure_json_missing_error",
+            },
+            None => "json_missing_ok",
+        }
+    }
+
+    #[cfg(unix)]
+    fn safe_models_observation(
+        elapsed: Duration,
+        result: &CmdResult,
+        observation: &crate::lifecycle::launch::pi_mcp::PiCatalogTestObservation,
+    ) -> String {
+        format!(
+            "class={} elapsed_ms={} parent_pid={:?} parent_exit_success={:?} parent_exit_code={:?} reader_timeout={}",
+            safe_models_result_class(result),
+            elapsed.as_millis(),
+            observation.parent_pid,
+            observation.parent_exit_success,
+            observation.parent_exit_code,
+            observation.reader_timeout,
+        )
+    }
+
     #[cfg(unix)]
     #[test]
     fn runner_invokes_exact_argv_once_and_drains() {
-        let path = fixture(
+        let path = fixture_with_sidecars(
             "test \"$1\" = --list-models && echo provider model && echo openai-codex gpt-5.6-sol",
         );
-        assert!(run_catalog(&path, Duration::from_secs(1), 1024)
-            .unwrap()
-            .starts_with(b"provider model"));
+        let receipt = native_timeout_receipt();
+        assert!(!receipt.exists());
+        let started = Instant::now();
+        let (result, observation) =
+            crate::lifecycle::launch::pi_mcp::with_pi_catalog_test_observation(
+                &receipt,
+                None,
+                || run_catalog(&path, Duration::from_secs(1), 1024),
+            );
+        let elapsed = started.elapsed();
+        let fixture_observation = safe_runner_fixture_observation(&path);
+        assert!(
+            result
+                .as_ref()
+                .is_ok_and(|bytes| bytes.starts_with(b"provider model")),
+            "runner observation: {}; {}",
+            safe_runner_observation(elapsed, &observation),
+            fixture_observation
+        );
+        let _ = result.unwrap();
+        let _ = std::fs::remove_file(&receipt);
+        let _ = std::fs::remove_file(format!("{}.sock", receipt.display()));
         assert_eq!(
             std::fs::read_to_string(path.with_extension("count")).unwrap(),
             "1:--list-models\n"
@@ -350,28 +487,160 @@ mod tests {
         cleanup_fixture(&path);
     }
 
+    #[cfg(unix)]
+    const NATIVE_STAGE_KEYS: [&str; 5] = [
+        "parent_entry_ms",
+        "parent_before_child_spawn_ms",
+        "parent_after_child_spawn_ms",
+        "parent_before_exit_ms",
+        "test_spawn_return_ms",
+    ];
+
+    #[cfg(unix)]
+    // Match the native helper's UNIX epoch millisecond clock exactly.
+    fn append_native_stage(path: &Path, key: &str) {
+        if !NATIVE_STAGE_KEYS.contains(&key) {
+            return;
+        }
+        let Some(milliseconds) = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .map(|duration| duration.as_millis())
+        else {
+            return;
+        };
+        let Ok(mut file) = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(path)
+        else {
+            return;
+        };
+        let _ = writeln!(file, "{key}={milliseconds}");
+    }
+
+    #[cfg(unix)]
+    fn safe_native_stage(path: &Path) -> String {
+        let (read_state, text) = match std::fs::read_to_string(path) {
+            Ok(text) => ("ok", Some(text)),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => ("missing", None),
+            Err(_) => ("unavailable", None),
+        };
+        let mut fields = BTreeMap::new();
+        if let Some(ref text) = text {
+            for line in text.lines() {
+                let Some((key, value)) = line.split_once('=') else {
+                    continue;
+                };
+                if NATIVE_STAGE_KEYS.contains(&key)
+                    && value.len() <= 20
+                    && value.bytes().all(|byte| byte.is_ascii_digit())
+                {
+                    fields.entry(key).or_insert(value);
+                }
+            }
+        }
+        let field = |key: &str| fields.get(key).copied().unwrap_or("unknown");
+        format!(
+            "stage_read={read_state} parent_entry_ms={} parent_before_child_spawn_ms={} parent_after_child_spawn_ms={} parent_before_exit_ms={} test_spawn_return_ms={}",
+            field("parent_entry_ms"),
+            field("parent_before_child_spawn_ms"),
+            field("parent_after_child_spawn_ms"),
+            field("parent_before_exit_ms"),
+            field("test_spawn_return_ms"),
+        )
+    }
+
+    #[cfg(unix)]
+    fn wait_for_native_parent_exit(
+        child: &mut std::process::Child,
+        stage: &Path,
+    ) -> std::process::ExitStatus {
+        let deadline = Instant::now() + Duration::from_millis(500);
+        loop {
+            match child.try_wait() {
+                Ok(Some(status)) => return status,
+                Ok(None) if Instant::now() < deadline => {
+                    std::thread::sleep(Duration::from_millis(1));
+                }
+                Ok(None) => {
+                    let before_kill = safe_native_stage(stage);
+                    let _ = child.kill();
+                    let _ = child.wait();
+                    let after_wait = safe_native_stage(stage);
+                    panic!(
+                        "native parent did not exit before test setup deadline; stage_before_kill={before_kill}; stage_after_wait={after_wait}"
+                    );
+                }
+                Err(_) => {
+                    let before_kill = safe_native_stage(stage);
+                    let _ = child.kill();
+                    let _ = child.wait();
+                    let after_wait = safe_native_stage(stage);
+                    panic!(
+                        "native parent status could not be observed; stage_before_kill={before_kill}; stage_after_wait={after_wait}"
+                    );
+                }
+            }
+        }
+    }
+
+    /// Read/drain seam only: public `run_catalog` spawn coverage remains in the
+    /// normal success and fail-closed tests.
     #[cfg(unix)]
     #[test]
-    fn runner_timeout_is_bounded_when_descendant_keeps_stdout() {
+    fn reader_deadline_is_bounded_after_parent_exit_with_descendant_pipe() {
         let path = native_timeout_fixture();
         let receipt = native_timeout_receipt();
+        let stage = native_timeout_stage_receipt(&receipt);
         assert!(!receipt.exists());
+        assert!(!stage.exists());
+        let mut parent = std::process::Command::new(&path)
+            .arg("--list-models")
+            .env("TEAM_AGENT_MODELS_TIMEOUT_RECEIPT", &receipt)
+            .env("TEAM_AGENT_MODELS_TIMEOUT_STAGE_RECEIPT", &stage)
+            .env("TEAM_AGENT_MODELS_TIMEOUT_MODE", "descendant")
+            .stdin(std::process::Stdio::null())
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::null())
+            .spawn()
+            .unwrap();
+        append_native_stage(&stage, "test_spawn_return_ms");
+        let parent_pid = parent.id();
+        let parent_status = wait_for_native_parent_exit(&mut parent, &stage);
+        let stdout = parent.stdout.take().expect("native parent stdout pipe");
         let started = Instant::now();
         let (result, observation) =
             crate::lifecycle::launch::pi_mcp::with_pi_catalog_test_observation(
                 &receipt,
                 Some("descendant"),
-                || run_catalog(&path, Duration::from_millis(40), 1024),
+                || {
+                    crate::lifecycle::launch::pi_mcp::run_pi_catalog_after_parent_exit_for_test(
+                        stdout,
+                        parent_pid,
+                        parent_status,
+                        Duration::from_millis(40),
+                        1024,
+                    )
+                },
             );
-        assert!(started.elapsed() < Duration::from_millis(500));
+        let elapsed = started.elapsed();
+        assert!(
+            elapsed < Duration::from_millis(500),
+            "runner observation: {}",
+            safe_runner_observation(elapsed, &observation)
+        );
         assert!(result.unwrap_err().contains("timed out"));
-        assert_eq!(observation.spawn_count, 1);
-        assert_eq!(observation.argv, vec!["--list-models"]);
-        assert_eq!(observation.parent_exit_success, Some(true));
+        assert_eq!(
+            observation.parent_exit_success,
+            Some(true),
+            "runner observation: {}",
+            safe_runner_observation(elapsed, &observation)
+        );
         assert_eq!(observation.parent_exit_code, Some(0));
         assert!(observation.reader_timeout);
 
-        let fields = read_native_timeout_receipt(&receipt);
+        let fields = wait_native_timeout_receipt(&receipt);
         assert_eq!(fields["parent_started_once"], "1");
         assert_eq!(fields["parent_argv_exact"], "1");
         assert_eq!(fields["child_spawn_attempts"], "1");
@@ -384,6 +653,7 @@ mod tests {
         );
         assert_eq!(fields["child_pid"], fields["descendant_pid"]);
         let _ = std::fs::remove_file(&receipt);
+        let _ = std::fs::remove_file(&stage);
         let _ = std::fs::remove_file(format!("{}.sock", receipt.display()));
     }
 
@@ -398,16 +668,72 @@ mod tests {
             search: Some("sol".into()),
             json: true,
         };
-        let result = cmd_models_with(&args, &path, Duration::from_secs(1), 1024).unwrap();
-        let CmdOutput::Human(text) = result.output else {
-            panic!("expected JSON projection")
+        let receipt = native_timeout_receipt();
+        assert!(!receipt.exists());
+        let started = Instant::now();
+        let (result, observation) =
+            crate::lifecycle::launch::pi_mcp::with_pi_catalog_test_observation(
+                &receipt,
+                None,
+                || cmd_models_with(&args, &path, Duration::from_secs(1), 1024),
+            );
+        let elapsed = started.elapsed();
+        let result = match result {
+            Ok(result) => result,
+            Err(_) => panic!(
+                "command boundary returned a CLI error; class=cli_error elapsed_ms={} parent_pid={:?} parent_exit_success={:?} parent_exit_code={:?} reader_timeout={}",
+                elapsed.as_millis(),
+                observation.parent_pid,
+                observation.parent_exit_success,
+                observation.parent_exit_code,
+                observation.reader_timeout,
+            ),
         };
-        let value: Value = serde_json::from_str(&text).unwrap();
-        assert_eq!(value["schema_version"], "models.v1");
-        assert_eq!(value["models"][0]["role_model"], "openai-codex/gpt-5.6-sol");
-        assert_eq!(value["models"][0]["current"], false);
-        assert_eq!(value["auth"], "ok");
-        assert_eq!(value["models"].as_array().unwrap().len(), 1);
+        let CmdOutput::Human(text) = &result.output else {
+            panic!(
+                "expected JSON projection; {}",
+                safe_models_observation(elapsed, &result, &observation)
+            )
+        };
+        let value: Value = serde_json::from_str(text).unwrap_or_else(|_| {
+            panic!(
+                "expected valid JSON projection; {}",
+                safe_models_observation(elapsed, &result, &observation)
+            )
+        });
+        assert_eq!(
+            value["schema_version"],
+            "models.v1",
+            "{}",
+            safe_models_observation(elapsed, &result, &observation)
+        );
+        assert_eq!(
+            value["models"][0]["role_model"],
+            "openai-codex/gpt-5.6-sol",
+            "{}",
+            safe_models_observation(elapsed, &result, &observation)
+        );
+        assert_eq!(
+            value["models"][0]["current"],
+            false,
+            "{}",
+            safe_models_observation(elapsed, &result, &observation)
+        );
+        assert_eq!(
+            value["auth"],
+            "ok",
+            "{}",
+            safe_models_observation(elapsed, &result, &observation)
+        );
+        let model_count = value["models"].as_array().map(|models| models.len());
+        assert_eq!(
+            model_count,
+            Some(1),
+            "{}",
+            safe_models_observation(elapsed, &result, &observation)
+        );
+        let _ = std::fs::remove_file(&receipt);
+        let _ = std::fs::remove_file(format!("{}.sock", receipt.display()));
         let human = cmd_models_with(
             &ModelsArgs {
                 provider: "pi".into(),
@@ -441,12 +767,16 @@ mod tests {
     #[test]
     fn runner_fails_closed_for_nonzero_oversize_timeout_and_unavailable() {
         let fail = native_timeout_fixture();
+        let started = Instant::now();
         let (failed_result, fail_observation) = with_native_mode("exit7", || {
             run_catalog(&fail, Duration::from_secs(1), 1024)
         });
+        let elapsed = started.elapsed();
         assert_eq!(
             failed_result.unwrap_err(),
-            "Pi model catalog command failed"
+            "Pi model catalog command failed",
+            "runner observation: {}",
+            safe_runner_observation(elapsed, &fail_observation)
         );
         assert_eq!(fail_observation.spawn_count, 1);
         assert_eq!(fail_observation.argv, vec!["--list-models"]);

package/crates/team-agent/src/cli/named_address.rs

@@ -694,9 +694,23 @@ fn resolve_worker(
         }
     };
     let matches = matching_session_window(&targets, session, window);
-    match matches.len() {
-        1 => {
-            let pane = matches[0];
+    let selected_pane = match matches.len() {
+        1 => matches.first().copied(),
+        n if n > 1 => {
+            let state_pane_id =
+                string_field(agent_entry, "pane_id").filter(|pane_id| !pane_id.is_empty());
+            let mut state_matches = matches.iter().copied().filter(|pane| {
+                state_pane_id.is_some_and(|pane_id| pane.pane_id.as_str() == pane_id)
+            });
+            match (state_matches.next(), state_matches.next()) {
+                (Some(pane), None) => Some(pane),
+                _ => None,
+            }
+        }
+        _ => None,
+    };
+    match selected_pane {
+        Some(pane) => {
             let state_pane_id = string_field(agent_entry, "pane_id").map(str::to_string);
             let state_pane_stale = state_pane_id
                 .as_deref()
@@ -727,7 +741,7 @@ fn resolve_worker(
                 warning,
             })
         }
-        0 => Ok(resolved_worker_without_live(
+        None if matches.is_empty() => Ok(resolved_worker_without_live(
             sender_workspace,
             target_workspace,
             team,
@@ -738,7 +752,7 @@ fn resolve_worker(
             window,
             transport.tmux_endpoint(),
         )),
-        _ => Err(name_ambiguous(
+        None => Err(name_ambiguous(
             "multiple live panes match the same session/window",
             matches
                 .into_iter()

package/crates/team-agent/src/cli/profile.rs

@@ -20,17 +20,20 @@ pub fn cmd_profile(args: &ProfileArgs) -> Result<CmdResult, CliError> {
 fn init_profile(args: &ProfileArgs) -> Result<Value, CliError> {
     let auth_mode = args.auth_mode.as_deref().unwrap_or("subscription");
     validate_auth_mode(auth_mode)?;
+    let proxy_mode = args.proxy_mode.as_deref().unwrap_or("inherit");
+    validate_proxy_mode(proxy_mode)?;
     let dir = profile_dir(args);
     std::fs::create_dir_all(&dir)?;
     let path = dir.join(format!("{}.env", args.name));
     let template_path = dir.join(format!("{}.example.env", args.name));
-    let body = profile_template(&args.name, auth_mode);
+    let body = profile_template(&args.name, auth_mode, proxy_mode);
     let created_profile = write_new_file(&path, &body)?;
     if created_profile {
         set_owner_only_permissions(&path)?;
     }
     let created_template = write_new_file(&template_path, &body)?;
     write_boundary_files(&dir)?;
+    let actual_proxy_mode = display_proxy_mode(&read_profile_env(&path)?);
 
     let mut obj = Map::new();
     obj.insert("ok".to_string(), Value::Bool(true));
@@ -39,6 +42,14 @@ fn init_profile(args: &ProfileArgs) -> Result<Value, CliError> {
         "auth_mode".to_string(),
         Value::String(auth_mode.to_string()),
     );
+    obj.insert(
+        "proxy_mode".to_string(),
+        Value::String(actual_proxy_mode),
+    );
+    obj.insert(
+        "proxy_mode_changed".to_string(),
+        Value::Bool(created_profile),
+    );
     obj.insert("path".to_string(), path_value(&path));
     obj.insert("template_path".to_string(), path_value(&template_path));
     obj.insert("created_profile".to_string(), Value::Bool(created_profile));
@@ -72,6 +83,7 @@ fn doctor_profile(args: &ProfileArgs) -> Result<Value, CliError> {
     let values = read_profile_env(&path)?;
     let auth_mode =
         profile_value(&values, "AUTH_MODE").unwrap_or_else(|| "subscription".to_string());
+    let proxy_mode = display_proxy_mode(&values);
     let secret_keys = secret_keys_present(&values);
     let keys = sorted_keys(&values);
     let mut obj = Map::new();
@@ -83,6 +95,7 @@ fn doctor_profile(args: &ProfileArgs) -> Result<Value, CliError> {
         Value::Bool(credential_present(&values)),
     );
     obj.insert("auth_mode".to_string(), Value::String(auth_mode));
+    obj.insert("proxy_mode".to_string(), Value::String(proxy_mode));
     obj.insert("keys_present".to_string(), string_array(keys));
     obj.insert(
         "raw_file_read_allowed_for_agents".to_string(),
@@ -112,6 +125,7 @@ fn show_profile(args: &ProfileArgs) -> Result<Value, CliError> {
     let values = read_profile_env(&path)?;
     let auth_mode =
         profile_value(&values, "AUTH_MODE").unwrap_or_else(|| "subscription".to_string());
+    let proxy_mode = display_proxy_mode(&values);
     let secret_keys = secret_keys_present(&values);
     let missing_common = missing_common_keys(&values, &auth_mode);
     let mut obj = Map::new();
@@ -122,6 +136,7 @@ fn show_profile(args: &ProfileArgs) -> Result<Value, CliError> {
         Value::Bool(credential_present(&values)),
     );
     obj.insert("auth_mode".to_string(), Value::String(auth_mode));
+    obj.insert("proxy_mode".to_string(), Value::String(proxy_mode));
     obj.insert("values".to_string(), redacted_values(&values));
     obj.insert(
         "keys_present".to_string(),
@@ -157,12 +172,21 @@ fn validate_auth_mode(auth_mode: &str) -> Result<(), CliError> {
     }
 }
 
-fn profile_template(name: &str, auth_mode: &str) -> String {
+fn validate_proxy_mode(proxy_mode: &str) -> Result<(), CliError> {
+    match proxy_mode {
+        "direct" | "inherit" => Ok(()),
+        other => Err(CliError::Usage(format!(
+            "invalid --proxy-mode: {other} (expected direct|inherit)"
+        ))),
+    }
+}
+
+fn profile_template(name: &str, auth_mode: &str, proxy_mode: &str) -> String {
     match auth_mode {
         "compatible_api" | "official_api" => {
-            format!("AUTH_MODE={auth_mode}\nPROFILE_NAME={name}\nBASE_URL=\nAPI_KEY=\nMODEL=\n")
+            format!("AUTH_MODE={auth_mode}\nPROFILE_NAME={name}\nPROXY_MODE={proxy_mode}\nBASE_URL=\nAPI_KEY=\nMODEL=\n")
         }
-        _ => format!("AUTH_MODE=subscription\nPROFILE_NAME={name}\n"),
+        _ => format!("AUTH_MODE=subscription\nPROFILE_NAME={name}\nPROXY_MODE={proxy_mode}\n"),
     }
 }
 
@@ -235,6 +259,13 @@ fn profile_value(values: &Map<String, Value>, key: &str) -> Option<String> {
         .map(ToString::to_string)
 }
 
+fn display_proxy_mode(values: &Map<String, Value>) -> String {
+    profile_value(values, "PROXY_MODE")
+        .or_else(|| profile_value(values, "NETWORK_MODE"))
+        .map(|value| value.trim().to_ascii_lowercase())
+        .unwrap_or_else(|| "inherit".to_string())
+}
+
 fn missing_profile_value(args: &ProfileArgs, path: &Path, template_path: Option<&Path>) -> Value {
     let mut obj = Map::new();
     obj.insert("ok".to_string(), Value::Bool(false));