cascade-ai 0.74.0 → 0.75.0

package/dist/cli.js

@@ -1,20 +1,20 @@
-import Anthropic from '@anthropic-ai/sdk';
-import OpenAI, { AzureOpenAI } from 'openai';
-import { GoogleGenAI, HarmBlockThreshold, HarmCategory } from '@google/genai';
 import dns from 'dns';
 import http, { createServer } from 'http';
 import https from 'https';
 import zlib from 'zlib';
 import { Readable } from 'stream';
+import Anthropic from '@anthropic-ai/sdk';
+import OpenAI, { AzureOpenAI } from 'openai';
+import { HarmBlockThreshold, HarmCategory, GoogleGenAI } from '@google/genai';
 import Database2 from 'better-sqlite3';
-import path34, { dirname } from 'path';
-import fs31, { mkdirSync, writeFileSync, existsSync, readFileSync, promises } from 'fs';
+import path35, { dirname } from 'path';
+import fs32, { mkdirSync, writeFileSync, existsSync, readFileSync, promises } from 'fs';
 import os10 from 'os';
 import crypto, { randomUUID, randomBytes, webcrypto, timingSafeEqual, createHash } from 'crypto';
 import { render, Box, Text, useStdout, useApp, useInput, Static } from 'ink';
 import { Command } from 'commander';
 import React2, { useState, useReducer, useRef, useCallback, useEffect, useMemo } from 'react';
-import chalk7 from 'chalk';
+import chalk8 from 'chalk';
 import dotenv from 'dotenv';
 import { fileURLToPath } from 'url';
 import fs11 from 'fs/promises';
@@ -1766,7 +1766,7 @@ var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SEC
 var init_constants = __esm({
   "src/constants.ts"() {
     init_pricing();
-    CASCADE_VERSION = "0.74.0";
+    CASCADE_VERSION = "0.75.0";
     CASCADE_CONFIG_FILE = ".cascade/config.json";
     CASCADE_DB_FILE = ".cascade/memory.db";
     CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
@@ -2195,6 +2195,244 @@ var init_constants = __esm({
     ];
   }
 });
+function preferIpv4Host(url) {
+  return url;
+}
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+function normalizeEndpoint(url) {
+  const raw = stripTrailingSlashes((url ?? "").trim());
+  if (!raw) return "";
+  try {
+    const u = new URL(raw);
+    const path40 = stripTrailingSlashes(`${u.pathname}${u.search}`);
+    return `${u.protocol}//${u.host.toLowerCase()}${path40}`;
+  } catch {
+    return raw.toLowerCase();
+  }
+}
+function stripPathSegment(url, segment) {
+  const trimmed = stripTrailingSlashes(url.trim());
+  const suffix = `/${segment}`;
+  return trimmed.endsWith(suffix) ? trimmed.slice(0, -suffix.length) : trimmed;
+}
+function clientApiRoot(type, url) {
+  const segment = CLIENT_VERSION_SEGMENT[type];
+  return segment ? stripPathSegment(url, segment) : stripTrailingSlashes(url.trim());
+}
+function headersFrom(raw) {
+  const out = new Headers();
+  for (const [k, v] of Object.entries(raw)) {
+    if (k === "content-encoding" || k === "content-length") continue;
+    if (Array.isArray(v)) out.set(k, v.join(", "));
+    else if (typeof v === "string") out.set(k, v);
+  }
+  return out;
+}
+async function fetchSameOrigin(url, init = {}, maxRedirects = MAX_REDIRECTS) {
+  const origin = new URL(url).origin;
+  let current = url;
+  let options = { ...init };
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    const res = await fetch(current, { ...options, redirect: "manual" });
+    if (![301, 302, 303, 307, 308].includes(res.status)) return res;
+    const location = res.headers.get("location");
+    if (!location) return res;
+    await res.body?.cancel().catch(() => {
+    });
+    const next = new URL(location, current);
+    if (next.origin !== origin) {
+      throw new Error(
+        `Refusing cross-origin redirect to ${next.origin}: the request carries a credential for ${origin}.`
+      );
+    }
+    const method = (options.method ?? "GET").toUpperCase();
+    const downgrades = res.status === 303 ? method !== "GET" && method !== "HEAD" : (res.status === 301 || res.status === 302) && method === "POST";
+    if (downgrades) {
+      const headers = new Headers(options.headers);
+      for (const h of ["content-type", "content-length", "content-encoding", "content-language", "content-location"]) {
+        headers.delete(h);
+      }
+      options = { ...options, method: "GET", body: void 0, headers };
+    }
+    current = next.toString();
+  }
+  throw new Error(`Too many redirects from ${url}`);
+}
+async function nodeHttpFetch(input, init = {}, redirectCount = 0, opts = {}) {
+  const urlStr = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  const u = new URL(preferIpv4Host(urlStr) ?? urlStr);
+  const lib = u.protocol === "https:" ? https : http;
+  const method = (init.method ?? "GET").toUpperCase();
+  const headers = {};
+  const h = init.headers;
+  if (h instanceof Headers) h.forEach((v, k) => {
+    headers[k] = v;
+  });
+  else if (Array.isArray(h)) for (const [k, v] of h) headers[k] = v;
+  else if (h) Object.assign(headers, h);
+  if (!Object.keys(headers).some((k) => k.toLowerCase() === "accept-encoding")) {
+    headers["accept-encoding"] = "gzip, deflate, br";
+  }
+  const body = init.body == null ? void 0 : typeof init.body === "string" ? init.body : Buffer.from(init.body);
+  return new Promise((resolve2, reject) => {
+    const req = lib.request(
+      {
+        hostname: u.hostname,
+        port: u.port || (u.protocol === "https:" ? 443 : 80),
+        path: u.pathname + u.search,
+        method,
+        headers
+      },
+      (res) => {
+        const status = res.statusCode ?? 200;
+        const location = res.headers.location;
+        if (REDIRECT_STATUSES.has(status) && location && redirectCount < MAX_REDIRECTS) {
+          res.resume();
+          const nextUrl = new URL(location, u).href;
+          if (opts.allowedRedirectOrigin && new URL(nextUrl).origin !== opts.allowedRedirectOrigin) {
+            reject(new Error(`Refusing cross-origin redirect to ${new URL(nextUrl).origin}`));
+            return;
+          }
+          const downgrade = status === 303 ? method !== "GET" && method !== "HEAD" : (status === 301 || status === 302) && method === "POST";
+          let nextInit = init;
+          if (downgrade) {
+            const headers2 = new Headers(init.headers);
+            for (const h2 of ["content-type", "content-length", "content-encoding", "content-language", "content-location"]) {
+              headers2.delete(h2);
+            }
+            nextInit = { ...init, method: "GET", body: void 0, headers: headers2 };
+          }
+          resolve2(nodeHttpFetch(nextUrl, nextInit, redirectCount + 1, opts));
+          return;
+        }
+        const encoding = (res.headers["content-encoding"] ?? "").toLowerCase();
+        let bodyStream = res;
+        if (encoding === "gzip" || encoding === "x-gzip") bodyStream = res.pipe(zlib.createGunzip());
+        else if (encoding === "deflate") bodyStream = res.pipe(zlib.createInflate());
+        else if (encoding === "br") bodyStream = res.pipe(zlib.createBrotliDecompress());
+        if (NULL_BODY_STATUSES.has(status)) {
+          bodyStream.resume();
+          resolve2(new Response(null, {
+            status,
+            statusText: res.statusMessage ?? "",
+            headers: headersFrom(res.headers)
+          }));
+          return;
+        }
+        const stream = Readable.toWeb(bodyStream);
+        resolve2(new Response(stream, {
+          status,
+          statusText: res.statusMessage ?? "",
+          headers: headersFrom(res.headers)
+        }));
+      }
+    );
+    req.on("error", reject);
+    req.setTimeout(15e3, () => req.destroy(new Error("request timed out")));
+    if (body !== void 0) req.write(body);
+    req.end();
+  });
+}
+var CLIENT_VERSION_SEGMENT, REDIRECT_STATUSES, NULL_BODY_STATUSES, MAX_REDIRECTS;
+var init_net = __esm({
+  "src/utils/net.ts"() {
+    try {
+      dns.setDefaultResultOrder("ipv4first");
+    } catch {
+    }
+    CLIENT_VERSION_SEGMENT = {
+      anthropic: "v1",
+      gemini: "v1beta"
+    };
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+    NULL_BODY_STATUSES = /* @__PURE__ */ new Set([204, 205, 304]);
+    MAX_REDIRECTS = 5;
+  }
+});
+
+// src/config/revoked-credentials.ts
+function isRevokedSubscriptionCredential(p) {
+  if (typeof p !== "object" || p === null) return false;
+  if (p.type !== "anthropic") return false;
+  if (!p.authToken && !p.apiKey) return false;
+  return isSubscriptionToken(p.authToken) || isSubscriptionToken(p.apiKey) || Boolean(p.authToken) && /claude\s*code/i.test(p.credentialSource ?? "");
+}
+function isSubscriptionToken(secret) {
+  return !!secret && secret.trim().startsWith("sk-ant-oat");
+}
+function stripRevokedCredentials(providers, { keepForEndpoint = true } = {}) {
+  let removed = 0;
+  const kept = [];
+  for (const p of providers) {
+    if (!isRevokedSubscriptionCredential(p)) {
+      kept.push(p);
+      continue;
+    }
+    removed++;
+    const cleaned = { ...p };
+    if (isSubscriptionToken(cleaned.apiKey)) delete cleaned.apiKey;
+    const bearerIsDead = isSubscriptionToken(cleaned.authToken) || Boolean(cleaned.authToken) && /claude\s*code/i.test(cleaned.credentialSource ?? "");
+    if (bearerIsDead) {
+      delete cleaned.authToken;
+      delete cleaned.credentialSource;
+    }
+    const worthKeeping = Boolean(
+      cleaned.apiKey || cleaned.authToken || keepForEndpoint && cleaned.baseUrl
+    );
+    if (worthKeeping) kept.push(cleaned);
+  }
+  return { kept, removed };
+}
+function stripRevokedFromConfig(raw) {
+  const result = { removed: 0 };
+  if (typeof raw !== "object" || raw === null) return result;
+  const cfg = raw;
+  if (Array.isArray(cfg["providers"])) {
+    const pass = stripRevokedCredentials(cfg["providers"]);
+    result.removed = pass.removed;
+    if (pass.removed > 0) cfg["providers"] = pass.kept;
+  }
+  return result;
+}
+function hasUsableAnthropic(providers) {
+  return providers.some((p) => p?.type === "anthropic" && Boolean(p.apiKey || p.authToken && p.baseUrl));
+}
+function clearAnthropicPins(models, providers) {
+  const cleared = [];
+  if (typeof models !== "object" || models === null) return cleared;
+  const tiers = models;
+  for (const tier of ["t1", "t2", "t3"]) {
+    const pin = tiers[tier];
+    if (typeof pin !== "string" || !namesAnthropicModel(pin, providers)) continue;
+    delete tiers[tier];
+    cleared.push({ tier, model: pin });
+  }
+  return cleared;
+}
+function namesAnthropicModel(pin, providers) {
+  const value = pin.trim().toLowerCase();
+  if (!value) return false;
+  if (value.includes(":")) return value.startsWith("anthropic:");
+  const known = Object.values(MODELS).some(
+    (m) => m.provider === "anthropic" && m.id.toLowerCase() === value
+  );
+  if (!known && !value.startsWith("claude-")) return false;
+  return !canBeServedElsewhere(value, providers);
+}
+function canBeServedElsewhere(modelId, providers) {
+  return providers.some((p) => p && p.type === "azure" && (p.deploymentName ?? "").trim().toLowerCase() === modelId);
+}
+var REVOKED_CREDENTIAL_REASON;
+var init_revoked_credentials = __esm({
+  "src/config/revoked-credentials.ts"() {
+    init_constants();
+    REVOKED_CREDENTIAL_REASON = "Anthropic no longer permits third-party tools to use Claude subscription credentials and refuses them at the API, so the linked Claude Code token could not have worked. Add an API key from the Claude Console, or set ANTHROPIC_AUTH_TOKEN with a gateway.";
+  }
+});
 
 // src/utils/cost.ts
 function resolveModelPricing(model, opts = {}) {
@@ -2347,6 +2585,8 @@ var init_model_filter = __esm({
 var anthropic_exports = {};
 __export(anthropic_exports, {
   AnthropicProvider: () => AnthropicProvider,
+  anthropicApiRoot: () => anthropicApiRoot,
+  anthropicAuth: () => anthropicAuth,
   toAnthropicToolUse: () => toAnthropicToolUse,
   toAnthropicTools: () => toAnthropicTools
 });
@@ -2371,25 +2611,56 @@ function toAnthropicToolUse(toolCalls) {
     input: tc.input
   }));
 }
-var AnthropicProvider;
+function anthropicApiRoot(configured) {
+  if (!configured) return void 0;
+  const root = clientApiRoot("anthropic", configured);
+  return root || void 0;
+}
+function anthropicAuth(config) {
+  const gateway = anthropicApiRoot(config.baseUrl);
+  const bearerIsSubscription = isSubscriptionToken(config.authToken);
+  const keyIsSubscription = isSubscriptionToken(config.apiKey);
+  if (bearerIsSubscription || keyIsSubscription) {
+    if (config.apiKey && !keyIsSubscription) return { mode: "apiKey", key: config.apiKey };
+    throw new Error(
+      "This Anthropic credential is a Claude subscription token, which Anthropic does not permit third-party clients to use. Configure an API key from console.anthropic.com instead."
+    );
+  }
+  if (config.authToken && gateway) return { mode: "bearer", token: config.authToken };
+  if (config.apiKey) return { mode: "apiKey", key: config.apiKey };
+  if (config.authToken) {
+    throw new Error(
+      "Anthropic bearer token configured without a gateway URL. A bearer is only valid at the gateway that issued it, so it will not be sent to the public API. Set `baseUrl` to that gateway, or configure `apiKey` instead."
+    );
+  }
+  return { mode: "none" };
+}
+var sameOriginFetch, AnthropicProvider;
 var init_anthropic = __esm({
   "src/providers/anthropic.ts"() {
     init_constants();
     init_base();
     init_pricing();
     init_model_filter();
+    init_net();
+    init_revoked_credentials();
+    sameOriginFetch = ((input, init) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      return fetchSameOrigin(url, init);
+    });
     AnthropicProvider = class extends BaseProvider {
       client;
       constructor(config, model) {
         super(config, model);
-        if (config.authToken) {
-          this.client = new Anthropic({
-            authToken: config.authToken,
-            defaultHeaders: { "anthropic-beta": "oauth-2025-04-20" }
-          });
+        const baseURL = anthropicApiRoot(config.baseUrl);
+        const auth2 = anthropicAuth(config);
+        if (auth2.mode === "bearer") {
+          this.client = new Anthropic({ authToken: auth2.token, fetch: sameOriginFetch, baseURL });
         } else {
           this.client = new Anthropic({
-            apiKey: config.apiKey
+            apiKey: auth2.mode === "apiKey" ? auth2.key : void 0,
+            fetch: sameOriginFetch,
+            ...baseURL ? { baseURL } : {}
           });
         }
       }
@@ -2465,21 +2736,24 @@ var init_anthropic = __esm({
       async countTokens(text) {
         return Math.ceil(text.length / 4);
       }
-      async listModels() {
+      async listModels(options = {}) {
+        const staticCatalog = () => options.staticFallback === false ? [] : Object.values(MODELS).filter((m) => m.provider === "anthropic");
         try {
-          const resp = await fetch("https://api.anthropic.com/v1/models", {
+          const base = anthropicApiRoot(this.config.baseUrl) ?? "https://api.anthropic.com";
+          const modelsUrl = `${base}/v1/models`;
+          const auth2 = anthropicAuth(this.config);
+          const resp = await fetchSameOrigin(modelsUrl, {
             headers: {
-              "x-api-key": this.config.apiKey ?? "",
+              // Same decision the constructor makes — see anthropicAuth(). Read
+              // straight off `config`, this branch sent a bearer to the public
+              // default host whenever no gateway was configured.
+              ...auth2.mode === "bearer" ? { authorization: `Bearer ${auth2.token}` } : { "x-api-key": auth2.mode === "apiKey" ? auth2.key : "" },
               "anthropic-version": "2023-06-01"
             }
           });
-          if (!resp.ok) {
-            return Object.values(MODELS).filter((m) => m.provider === "anthropic");
-          }
+          if (!resp.ok) return staticCatalog();
           const data = await resp.json();
-          if (!Array.isArray(data?.data)) {
-            return Object.values(MODELS).filter((m) => m.provider === "anthropic");
-          }
+          if (!Array.isArray(data?.data)) return staticCatalog();
           return data.data.filter((m) => isChatModel(m.id)).map((m) => {
             const known = Object.values(MODELS).find((km) => km.id === m.id && km.provider === "anthropic");
             if (known) return known;
@@ -2497,7 +2771,7 @@ var init_anthropic = __esm({
             });
           });
         } catch {
-          return Object.values(MODELS).filter((m) => m.provider === "anthropic");
+          return staticCatalog();
         }
       }
       async isAvailable() {
@@ -2717,7 +2991,8 @@ var init_openai = __esm({
       async countTokens(text) {
         return Math.ceil(text.length / 4);
       }
-      async listModels() {
+      async listModels(options = {}) {
+        const staticCatalog = () => options.staticFallback === false ? [] : Object.values(MODELS).filter((m) => m.provider === "openai");
         try {
           const response = await this.client.models.list();
           return response.data.filter((m) => isChatModel(m.id)).map((m) => {
@@ -2737,7 +3012,7 @@ var init_openai = __esm({
             });
           });
         } catch {
-          return Object.values(MODELS).filter((m) => m.provider === "openai");
+          return staticCatalog();
         }
       }
       async isAvailable() {
@@ -3039,9 +3314,46 @@ var init_gemini_schema = __esm({
 var gemini_exports = {};
 __export(gemini_exports, {
   GeminiProvider: () => GeminiProvider,
+  geminiApiRoot: () => geminiApiRoot,
   toGeminiFunctionCalls: () => toGeminiFunctionCalls,
   toGeminiTools: () => toGeminiTools
 });
+async function* parseSseChunks(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffered = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffered += decoder.decode(value, { stream: true });
+      let cut = buffered.indexOf("\n");
+      while (cut !== -1) {
+        const line = buffered.slice(0, cut).trim();
+        buffered = buffered.slice(cut + 1);
+        if (line.startsWith("data:")) {
+          const payload = line.slice(5).trim();
+          if (payload && payload !== "[DONE]") {
+            try {
+              yield JSON.parse(payload);
+            } catch {
+            }
+          }
+        }
+        cut = buffered.indexOf("\n");
+      }
+    }
+  } finally {
+    reader.releaseLock();
+    await body.cancel().catch(() => {
+    });
+  }
+}
+function geminiApiRoot(baseUrl) {
+  const configured = baseUrl?.trim();
+  if (!configured) return GEMINI_PUBLIC_ROOT;
+  return clientApiRoot("gemini", configured) || GEMINI_PUBLIC_ROOT;
+}
 function toGeminiTools(tools) {
   return tools.map((tool) => ({
     name: tool.name,
@@ -3074,7 +3386,7 @@ async function describeGeminiError(resp) {
     return "";
   }
 }
-var GeminiProvider;
+var GEMINI_API_VERSION, GEMINI_PUBLIC_ROOT, SAFETY_SETTINGS, GeminiProvider;
 var init_gemini = __esm({
   "src/providers/gemini.ts"() {
     init_constants();
@@ -3082,11 +3394,21 @@ var init_gemini = __esm({
     init_pricing();
     init_model_filter();
     init_gemini_schema();
+    init_net();
+    GEMINI_API_VERSION = "v1beta";
+    GEMINI_PUBLIC_ROOT = "https://generativelanguage.googleapis.com";
+    SAFETY_SETTINGS = [
+      { category: HarmCategory.HARM_CATEGORY_HARASSMENT, threshold: HarmBlockThreshold.BLOCK_NONE },
+      { category: HarmCategory.HARM_CATEGORY_HATE_SPEECH, threshold: HarmBlockThreshold.BLOCK_NONE }
+    ];
     GeminiProvider = class extends BaseProvider {
       client;
       constructor(config, model) {
         super(config, model);
-        this.client = new GoogleGenAI({ apiKey: config.apiKey ?? "" });
+        this.client = new GoogleGenAI({
+          apiKey: config.apiKey ?? "",
+          ...config.baseUrl ? { httpOptions: { baseUrl: geminiApiRoot(config.baseUrl) } } : {}
+        });
       }
       async generate(options) {
         const chunks = [];
@@ -3094,15 +3416,12 @@ var init_gemini = __esm({
       }
       async generateStream(options, onChunk) {
         const contents = this.buildContents(options.messages, options.images);
-        const stream = await this.client.models.generateContentStream({
+        const stream = this.config.baseUrl ? await this.streamOverRest(contents, options) : await this.client.models.generateContentStream({
           model: this.model.id,
           contents,
           config: {
             systemInstruction: options.systemPrompt,
-            safetySettings: [
-              { category: HarmCategory.HARM_CATEGORY_HARASSMENT, threshold: HarmBlockThreshold.BLOCK_NONE },
-              { category: HarmCategory.HARM_CATEGORY_HATE_SPEECH, threshold: HarmBlockThreshold.BLOCK_NONE }
-            ],
+            safetySettings: SAFETY_SETTINGS,
             tools: options.tools?.length ? [{ functionDeclarations: toGeminiTools(options.tools) }] : void 0,
             abortSignal: options.signal
           }
@@ -3153,25 +3472,40 @@ var init_gemini = __esm({
         };
       }
       async countTokens(text) {
+        const contents = [{ role: "user", parts: [{ text }] }];
         try {
-          const result = await this.client.models.countTokens({
-            model: this.model.id,
-            contents: [{ role: "user", parts: [{ text }] }]
-          });
+          if (this.config.baseUrl) {
+            const resp = await fetchSameOrigin(
+              `${geminiApiRoot(this.config.baseUrl)}/${GEMINI_API_VERSION}/models/${encodeURIComponent(this.model.id)}:countTokens`,
+              {
+                method: "POST",
+                headers: {
+                  "x-goog-api-key": this.config.apiKey ?? "",
+                  "content-type": "application/json"
+                },
+                body: JSON.stringify({ contents })
+              }
+            );
+            if (!resp.ok) return Math.ceil(text.length / 4);
+            const data = await resp.json();
+            return data.totalTokens ?? 0;
+          }
+          const result = await this.client.models.countTokens({ model: this.model.id, contents });
           return result.totalTokens ?? 0;
         } catch {
           return Math.ceil(text.length / 4);
         }
       }
-      async listModels() {
+      async listModels(options = {}) {
+        const staticCatalog = () => options.staticFallback === false ? [] : Object.values(MODELS).filter((m) => m.provider === "gemini");
         try {
           const resp = await this.fetchModelList();
           if (!resp.ok) {
-            return Object.values(MODELS).filter((m) => m.provider === "gemini");
+            return staticCatalog();
           }
           const data = await resp.json();
           if (!Array.isArray(data?.models)) {
-            return Object.values(MODELS).filter((m) => m.provider === "gemini");
+            return staticCatalog();
           }
           return data.models.filter((m) => isChatModel(m.name.replace("models/", ""), m.supportedGenerationMethods)).map((m) => {
             const id = m.name.replace("models/", "");
@@ -3193,7 +3527,7 @@ var init_gemini = __esm({
             });
           });
         } catch {
-          return Object.values(MODELS).filter((m) => m.provider === "gemini");
+          return staticCatalog();
         }
       }
       /**
@@ -3246,8 +3580,43 @@ var init_gemini = __esm({
        * logs, error reports and shell history, and this one would carry the key
        * with it.
        */
+      /**
+       * Generation against a configured endpoint, issued by hand.
+       *
+       * Same wire protocol the SDK speaks — `:streamGenerateContent?alt=sse` on
+       * `/v1beta`, with the same body — so the chunk shapes the caller walks are
+       * identical and neither transport needs its own parsing. The difference that
+       * matters is `fetchSameOrigin`: the key is never replayed on a host the
+       * configured origin redirects to.
+       */
+      async streamOverRest(contents, options) {
+        const url = `${geminiApiRoot(this.config.baseUrl)}/${GEMINI_API_VERSION}/models/${encodeURIComponent(this.model.id)}:streamGenerateContent?alt=sse`;
+        const resp = await fetchSameOrigin(url, {
+          method: "POST",
+          headers: {
+            "x-goog-api-key": this.config.apiKey ?? "",
+            "content-type": "application/json"
+          },
+          body: JSON.stringify({
+            contents,
+            // REST wants the object form; the SDK accepts a bare string and wraps
+            // it itself.
+            ...options.systemPrompt ? { systemInstruction: { parts: [{ text: options.systemPrompt }] } } : {},
+            safetySettings: SAFETY_SETTINGS,
+            ...options.tools?.length ? { tools: [{ functionDeclarations: toGeminiTools(options.tools) }] } : {}
+          }),
+          signal: options.signal
+        });
+        if (!resp.ok || !resp.body) {
+          const detail = await resp.text().catch(() => "");
+          throw new ProviderUnreachableError(
+            `Gemini generation failed at ${geminiApiRoot(this.config.baseUrl)}: ${resp.status}${detail ? ` \u2014 ${detail.slice(0, 200)}` : ""}`
+          );
+        }
+        return parseSseChunks(resp.body);
+      }
       fetchModelList() {
-        return fetch("https://generativelanguage.googleapis.com/v1beta/models", {
+        return fetchSameOrigin(`${geminiApiRoot(this.config.baseUrl)}/${GEMINI_API_VERSION}/models`, {
           headers: { "x-goog-api-key": this.config.apiKey ?? "" }
         });
       }
@@ -3335,84 +3704,6 @@ var init_gemini = __esm({
     };
   }
 });
-function preferIpv4Host(url) {
-  return url;
-}
-async function nodeHttpFetch(input, init = {}, redirectCount = 0, opts = {}) {
-  const urlStr = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-  const u = new URL(preferIpv4Host(urlStr) ?? urlStr);
-  const lib = u.protocol === "https:" ? https : http;
-  const method = (init.method ?? "GET").toUpperCase();
-  const headers = {};
-  const h = init.headers;
-  if (h instanceof Headers) h.forEach((v, k) => {
-    headers[k] = v;
-  });
-  else if (Array.isArray(h)) for (const [k, v] of h) headers[k] = v;
-  else if (h) Object.assign(headers, h);
-  if (!Object.keys(headers).some((k) => k.toLowerCase() === "accept-encoding")) {
-    headers["accept-encoding"] = "gzip, deflate, br";
-  }
-  const body = init.body == null ? void 0 : typeof init.body === "string" ? init.body : Buffer.from(init.body);
-  return new Promise((resolve2, reject) => {
-    const req = lib.request(
-      {
-        hostname: u.hostname,
-        port: u.port || (u.protocol === "https:" ? 443 : 80),
-        path: u.pathname + u.search,
-        method,
-        headers
-      },
-      (res) => {
-        const status = res.statusCode ?? 200;
-        const location = res.headers.location;
-        if (status >= 300 && status < 400 && location && redirectCount < MAX_REDIRECTS) {
-          res.resume();
-          const nextUrl = new URL(location, u).href;
-          if (opts.allowedRedirectOrigin && new URL(nextUrl).origin !== opts.allowedRedirectOrigin) {
-            reject(new Error(`Refusing cross-origin redirect to ${new URL(nextUrl).origin}`));
-            return;
-          }
-          const downgrade = status === 303 || (status === 301 || status === 302) && method !== "GET" && method !== "HEAD";
-          const nextInit = downgrade ? { ...init, method: "GET", body: void 0 } : init;
-          resolve2(nodeHttpFetch(nextUrl, nextInit, redirectCount + 1, opts));
-          return;
-        }
-        const encoding = (res.headers["content-encoding"] ?? "").toLowerCase();
-        let bodyStream = res;
-        if (encoding === "gzip" || encoding === "x-gzip") bodyStream = res.pipe(zlib.createGunzip());
-        else if (encoding === "deflate") bodyStream = res.pipe(zlib.createInflate());
-        else if (encoding === "br") bodyStream = res.pipe(zlib.createBrotliDecompress());
-        const stream = Readable.toWeb(bodyStream);
-        const respHeaders = new Headers();
-        for (const [k, v] of Object.entries(res.headers)) {
-          if (k === "content-encoding" || k === "content-length") continue;
-          if (Array.isArray(v)) respHeaders.set(k, v.join(", "));
-          else if (typeof v === "string") respHeaders.set(k, v);
-        }
-        resolve2(new Response(stream, {
-          status,
-          statusText: res.statusMessage ?? "",
-          headers: respHeaders
-        }));
-      }
-    );
-    req.on("error", reject);
-    req.setTimeout(15e3, () => req.destroy(new Error("request timed out")));
-    if (body !== void 0) req.write(body);
-    req.end();
-  });
-}
-var MAX_REDIRECTS;
-var init_net = __esm({
-  "src/utils/net.ts"() {
-    try {
-      dns.setDefaultResultOrder("ipv4first");
-    } catch {
-    }
-    MAX_REDIRECTS = 5;
-  }
-});
 
 // src/providers/ollama.ts
 var ollama_exports = {};
@@ -3701,12 +3992,38 @@ var init_openai_compatible = __esm({
     OpenAICompatibleProvider = class extends OpenAIProvider {
       constructor(config, model) {
         super({ ...config, apiKey: config.apiKey ?? "not-required" }, model);
+        if (!config.baseUrl?.trim()) {
+          throw new Error(
+            "An OpenAI-compatible provider requires `baseUrl`: without one the OpenAI SDK sends to api.openai.com, so a key issued by another service would go to OpenAI."
+          );
+        }
         this.client = new OpenAI({
           apiKey: config.apiKey ?? "not-required",
           baseURL: preferIpv4Host(config.baseUrl),
-          fetch: nodeHttpFetch
+          // Bound to the configured origin, NOT bare `nodeHttpFetch`. That helper
+          // follows a 3xx by reusing `init` verbatim — headers included — so an
+          // endpoint that redirected to another host was handed
+          // `Authorization: Bearer <apiKey>` on the second one. This is the same
+          // leak the Anthropic paths were fixed for; `allowedRedirectOrigin` exists
+          // precisely for callers that attach a credential, and this one attaches
+          // it on every request.
+          fetch: ((input, init) => nodeHttpFetch(input, init ?? {}, 0, this.redirectPolicy()))
         });
       }
+      /**
+       * Redirects may only stay on the host the credential was configured for.
+       *
+       * An unparseable `baseUrl` yields no policy, which is the pre-existing
+       * behaviour — but such a config cannot address anything anyway, so the
+       * request fails before a redirect is possible.
+       */
+      redirectPolicy() {
+        try {
+          return { allowedRedirectOrigin: new URL(preferIpv4Host(this.config.baseUrl) ?? "").origin };
+        } catch {
+          return {};
+        }
+      }
       modelsUrl() {
         const base = (preferIpv4Host(this.config.baseUrl) ?? "").replace(/\/+$/, "");
         return base + "/models";
@@ -3717,7 +4034,7 @@ var init_openai_compatible = __esm({
         return h;
       }
       async listModels() {
-        const res = await nodeHttpFetch(this.modelsUrl(), { headers: this.authHeaders() });
+        const res = await nodeHttpFetch(this.modelsUrl(), { headers: this.authHeaders() }, 0, this.redirectPolicy());
         if (!res.ok) throw new Error(`models endpoint ${this.modelsUrl()} returned HTTP ${res.status}`);
         const body = await res.json();
         const raw = Array.isArray(body?.data) ? body.data : Array.isArray(body?.models) ? body.models : [];
@@ -3747,7 +4064,7 @@ var init_openai_compatible = __esm({
       }
       async isAvailable() {
         try {
-          const res = await nodeHttpFetch(this.modelsUrl(), { headers: this.authHeaders() });
+          const res = await nodeHttpFetch(this.modelsUrl(), { headers: this.authHeaders() }, 0, this.redirectPolicy());
           return res.ok;
         } catch {
           return false;
@@ -3769,12 +4086,12 @@ var init_audit_logger = __esm({
       constructor(workspacePath, debugMode = false) {
         this.workspacePath = workspacePath;
         this.debugMode = debugMode;
-        const cascadeDir = path34.join(workspacePath, ".cascade");
-        if (!fs31.existsSync(cascadeDir)) {
-          fs31.mkdirSync(cascadeDir, { recursive: true });
+        const cascadeDir = path35.join(workspacePath, ".cascade");
+        if (!fs32.existsSync(cascadeDir)) {
+          fs32.mkdirSync(cascadeDir, { recursive: true });
         }
-        this.keyPath = path34.join(cascadeDir, "audit_log.key");
-        this.dbPath = path34.join(cascadeDir, "audit_log.db");
+        this.keyPath = path35.join(cascadeDir, "audit_log.key");
+        this.dbPath = path35.join(cascadeDir, "audit_log.db");
         this.initEncryptionKey();
         this.db = new Database2(this.dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -3804,11 +4121,11 @@ var init_audit_logger = __esm({
         return crypto.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
       }
       initEncryptionKey() {
-        if (fs31.existsSync(this.keyPath)) {
-          this.encryptionKey = fs31.readFileSync(this.keyPath);
+        if (fs32.existsSync(this.keyPath)) {
+          this.encryptionKey = fs32.readFileSync(this.keyPath);
         } else {
           this.encryptionKey = crypto.randomBytes(32);
-          fs31.writeFileSync(this.keyPath, this.encryptionKey);
+          fs32.writeFileSync(this.keyPath, this.encryptionKey);
         }
       }
       encrypt(text) {
@@ -3886,9 +4203,9 @@ var init_audit_logger = __esm({
       dumpDebugIfNeeded() {
         if (!this.debugMode) return;
         try {
-          const dumpPath = path34.join(os10.tmpdir(), "cascade_audit_logs_debug.json");
+          const dumpPath = path35.join(os10.tmpdir(), "cascade_audit_logs_debug.json");
           const entries = this.getAllLogs();
-          fs31.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+          fs32.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
         } catch (err) {
           console.error("Failed to dump debug audit logs", err);
         }
@@ -3943,7 +4260,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs31.existsSync(this.storePath)) {
+      if (password && fs32.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -3962,7 +4279,7 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs31.existsSync(this.storePath)) {
+    if (!fs32.existsSync(this.storePath)) {
       const salt = crypto.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -3976,7 +4293,7 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs31.existsSync(this.storePath)) {
+    if (!fs32.existsSync(this.storePath)) {
       const salt = crypto.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -4034,7 +4351,7 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs31.existsSync(this.storePath)) return {};
+    if (!fs32.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
@@ -4056,8 +4373,8 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs31.mkdirSync(path34.dirname(this.storePath), { recursive: true });
-    fs31.writeFileSync(this.storePath, out, { mode: 384 });
+    fs32.mkdirSync(path35.dirname(this.storePath), { recursive: true });
+    fs32.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
@@ -4067,11 +4384,11 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs31.mkdirSync(path34.dirname(this.storePath), { recursive: true });
-    fs31.writeFileSync(this.storePath, out, { mode: 384 });
+    fs32.mkdirSync(path35.dirname(this.storePath), { recursive: true });
+    fs32.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs31.readFileSync(this.storePath);
+    const buf = fs32.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -4104,7 +4421,7 @@ var CascadeIgnore = class {
     ]);
   }
   async load(workspacePath) {
-    const filePath = path34.join(workspacePath, ".cascadeignore");
+    const filePath = path35.join(workspacePath, ".cascadeignore");
     try {
       const content = await fs11.readFile(filePath, "utf-8");
       const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
@@ -4115,7 +4432,7 @@ var CascadeIgnore = class {
   }
   isIgnored(filePath, workspacePath) {
     try {
-      const relative = workspacePath ? path34.relative(workspacePath, filePath) : filePath;
+      const relative = workspacePath ? path35.relative(workspacePath, filePath) : filePath;
       return this.ig.ignores(relative);
     } catch {
       return false;
@@ -4126,7 +4443,7 @@ var CascadeIgnore = class {
   }
 };
 async function createDefaultIgnoreFile(workspacePath) {
-  const filePath = path34.join(workspacePath, ".cascadeignore");
+  const filePath = path35.join(workspacePath, ".cascadeignore");
   const content = `# .cascadeignore \u2014 Files Cascade agents cannot read or modify
 # Syntax identical to .gitignore
 
@@ -4156,7 +4473,7 @@ Thumbs.db
   await fs11.writeFile(filePath, content, "utf-8");
 }
 async function loadCascadeMd(workspacePath) {
-  const filePath = path34.join(workspacePath, "CASCADE.md");
+  const filePath = path35.join(workspacePath, "CASCADE.md");
   try {
     const raw = await fs11.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
@@ -4185,7 +4502,7 @@ ${raw.trim()}`;
   return { raw, sections, systemPrompt };
 }
 async function createDefaultCascadeMd(workspacePath) {
-  const filePath = path34.join(workspacePath, "CASCADE.md");
+  const filePath = path35.join(workspacePath, "CASCADE.md");
   const content = `# Cascade Project Instructions
 
 This file contains project-specific instructions for the Cascade AI agent.
@@ -4220,7 +4537,7 @@ List any areas the agent should not touch.
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs31.mkdirSync(path34.dirname(dbPath), { recursive: true });
+    fs32.mkdirSync(path35.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database2(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -5484,21 +5801,80 @@ function validateConfig(raw) {
 
 // src/config/global-credentials.ts
 init_constants();
-function credentialsPath(globalDir2) {
-  return path34.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
+
+// src/config/azure-endpoint.ts
+init_net();
+function normalizeAzureEndpoint(url) {
+  return normalizeEndpoint(url);
 }
-function providerKey(p) {
-  if (p.type === "azure") {
-    return `azure:${p.deploymentName ?? p.baseUrl ?? p.label ?? ""}`;
-  }
+function sameAzureEndpoint(a, b) {
+  return normalizeAzureEndpoint(a) === normalizeAzureEndpoint(b);
+}
+
+// src/config/endpoint-identity.ts
+init_net();
+var DEFAULT_ENDPOINT = {
+  anthropic: "https://api.anthropic.com",
+  openai: "https://api.openai.com/v1",
+  gemini: "https://generativelanguage.googleapis.com"
+};
+function hasDefaultEndpoint(type) {
+  return Object.hasOwn(DEFAULT_ENDPOINT, type);
+}
+function credentialEndpointIdentity(type, baseUrl) {
+  const configured = baseUrl?.trim();
+  const effective = configured || DEFAULT_ENDPOINT[type];
+  if (!effective) return null;
+  return normalizeEndpoint(clientApiRoot(type, effective));
+}
+function sameCredentialEndpoint(type, a, b) {
+  const left = credentialEndpointIdentity(type, a);
+  const right = credentialEndpointIdentity(type, b);
+  if (left === null && right === null) return true;
+  if (left === null || right === null) return false;
+  return left === right;
+}
+function credentialEndpointsConflict(type, rowEndpoint, credentialEndpoint) {
+  const row = rowEndpoint?.trim() ? credentialEndpointIdentity(type, rowEndpoint) : null;
+  const credential = credentialEndpointIdentity(type, credentialEndpoint);
+  if (row === null) return false;
+  if (credential === null) return true;
+  return row !== credential;
+}
+
+// src/config/global-credentials.ts
+function credentialsPath(globalDir2) {
+  return path35.join(globalDir2, GLOBAL_CREDENTIALS_FILE);
+}
+function providerKey(p) {
   return p.type;
 }
+function azureEndpoint(p) {
+  return p.baseUrl === void 0 ? void 0 : normalizeAzureEndpoint(p.baseUrl);
+}
+function sameAzureEntry(a, b) {
+  const strong = [
+    [a.deploymentName, b.deploymentName],
+    [azureEndpoint(a), azureEndpoint(b)]
+  ];
+  let shared = 0;
+  for (const [x, y] of strong) {
+    if (!x || !y) continue;
+    if (x !== y) return false;
+    shared++;
+  }
+  if (shared > 0) return true;
+  const aNamesSomething = Boolean(a.deploymentName || azureEndpoint(a));
+  const bNamesSomething = Boolean(b.deploymentName || azureEndpoint(b));
+  if (aNamesSomething || bNamesSomething) return false;
+  return Boolean(a.label && b.label && a.label === b.label);
+}
 function isPersistable(p) {
   return Boolean(p.apiKey || p.authToken || p.type === "azure" || p.baseUrl);
 }
 function loadGlobalCredentials(globalDir2) {
   try {
-    const raw = fs31.readFileSync(credentialsPath(globalDir2), "utf-8");
+    const raw = fs32.readFileSync(credentialsPath(globalDir2), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.providers)) return [];
     return parsed.providers.filter(
@@ -5510,34 +5886,93 @@ function loadGlobalCredentials(globalDir2) {
 }
 function saveGlobalCredentials(globalDir2, providers) {
   const filePath = credentialsPath(globalDir2);
-  fs31.mkdirSync(globalDir2, { recursive: true, mode: 448 });
+  fs32.mkdirSync(globalDir2, { recursive: true, mode: 448 });
   const body = { version: 1, providers: providers.filter(isPersistable) };
   const tmp = `${filePath}.tmp`;
-  fs31.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
-  fs31.renameSync(tmp, filePath);
+  fs32.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+  fs32.renameSync(tmp, filePath);
   try {
-    fs31.chmodSync(filePath, 384);
+    fs32.chmodSync(filePath, 384);
   } catch {
   }
 }
 function mergeGlobalCredentials(workspaceProviders, globalProviders) {
   const merged = [...workspaceProviders];
-  const byKey = new Map(merged.map((p) => [providerKey(p), p]));
+  const byKey = new Map(merged.filter((p) => p.type !== "azure").map((p) => [providerKey(p), p]));
   for (const g of globalProviders) {
-    const existing = byKey.get(providerKey(g));
+    if (g.type === "azure" && !g.deploymentName?.trim() && azureEndpoint(g)) {
+      const onResource = merged.filter((p) => p.type === "azure" && sameAzureEntry(p, g));
+      if (onResource.length > 0) {
+        for (const row of onResource) fillFrom(row, g);
+        continue;
+      }
+    }
+    const existing = g.type === "azure" ? merged.find((p) => p.type === "azure" && sameAzureEntry(p, g)) : byKey.get(providerKey(g));
     if (!existing) {
       merged.push({ ...g });
-      byKey.set(providerKey(g), merged[merged.length - 1]);
+      if (g.type !== "azure") byKey.set(providerKey(g), merged[merged.length - 1]);
       continue;
     }
-    if (!existing.apiKey && g.apiKey) existing.apiKey = g.apiKey;
-    if (!existing.authToken && g.authToken) existing.authToken = g.authToken;
-    if (!existing.baseUrl && g.baseUrl) existing.baseUrl = g.baseUrl;
-    if (!existing.apiVersion && g.apiVersion) existing.apiVersion = g.apiVersion;
-    if (!existing.label && g.label) existing.label = g.label;
+    fillFrom(existing, g);
   }
   return merged;
 }
+function fillFrom(existing, g) {
+  const credentialled = Boolean(existing.apiKey || existing.authToken);
+  const endpointsDiffer = credentialEndpointsConflict(existing.type, existing.baseUrl, g.baseUrl);
+  if (!credentialled && !endpointsDiffer && g.apiKey) {
+    existing.apiKey = g.apiKey;
+    if (g.baseUrl) existing.baseUrl = g.baseUrl;
+  }
+  if (!credentialled && !endpointsDiffer && !existing.apiKey && g.authToken && g.baseUrl) {
+    existing.authToken = g.authToken;
+    existing.baseUrl = g.baseUrl;
+  }
+  if (!credentialled && !existing.baseUrl && g.baseUrl) existing.baseUrl = g.baseUrl;
+  if (!existing.apiVersion && g.apiVersion) existing.apiVersion = g.apiVersion;
+  if (!existing.label && g.label) existing.label = g.label;
+}
+
+// src/config/azure-routing.ts
+function routableAzureRows(rows) {
+  return rows.filter((p) => p.type === "azure" && p.baseUrl?.trim());
+}
+function resolveAzureRouting(view, write, env) {
+  const rows = routableAzureRows(view);
+  const resourcesOf = (list) => [...new Set(list.map((p) => normalizeAzureEndpoint(p.baseUrl)))];
+  if (rows.length === 0) return { ok: false, reason: "no-routable-rows", resources: [] };
+  const endpoint = env.endpoint?.trim();
+  const deployment = env.deployment?.trim();
+  const named = deployment ? rows.filter((p) => (p.deploymentName?.trim() ?? "") === deployment) : [];
+  let anchor;
+  if (endpoint) {
+    anchor = rows.find((p) => sameAzureEndpoint(p.baseUrl, endpoint));
+    if (!anchor) {
+      return { ok: false, reason: "endpoint-not-configured", resources: resourcesOf(rows) };
+    }
+    const elsewhere = named.filter((p) => !sameAzureEndpoint(p.baseUrl, endpoint));
+    if (elsewhere.length > 0) {
+      return { ok: false, reason: "name-on-another-resource", resources: resourcesOf(elsewhere) };
+    }
+  } else if (named.length > 0) {
+    const owners = resourcesOf(named);
+    if (owners.length > 1) return { ok: false, reason: "ambiguous-resource", resources: owners };
+    anchor = named[0];
+  } else {
+    const all = resourcesOf(rows);
+    if (all.length !== 1) return { ok: false, reason: "ambiguous-resource", resources: all };
+    anchor = rows[0];
+  }
+  const resource = anchor.baseUrl;
+  const onResource = routableAzureRows(write).filter((p) => sameAzureEndpoint(p.baseUrl, resource));
+  const alreadyThere = deployment ? onResource.some((p) => (p.deploymentName?.trim() ?? "") === deployment) || named.some((p) => sameAzureEndpoint(p.baseUrl, resource)) : true;
+  return {
+    ok: true,
+    resource,
+    rows: onResource,
+    ...deployment && !alreadyThere ? { createDeployment: deployment } : {}
+  };
+}
 
 // src/config/retired-providers.ts
 var RETIRED_PROVIDER_TYPES = {
@@ -5547,7 +5982,7 @@ function isRetiredProviderType(type) {
   return typeof type === "string" && Object.hasOwn(RETIRED_PROVIDER_TYPES, type);
 }
 function didCleanupChangeAnything(c) {
-  return c.removed.length > 0 || c.clearedPins.length > 0;
+  return c.removed.length > 0 || c.clearedPins.length > 0 || (c.revokedCredentials ?? 0) > 0 || (c.unusableCredentials ?? 0) > 0;
 }
 function stripRetiredProviders(raw) {
   const cleanup = { removed: [], clearedPins: [] };
@@ -5594,11 +6029,24 @@ function describeCleanup(c) {
   for (const type of c.removed) {
     parts.push(`removed the retired "${type}" provider (${RETIRED_PROVIDER_TYPES[type]})`);
   }
+  if ((c.revokedCredentials ?? 0) > 0) {
+    parts.push("discarded a linked Claude subscription token, which Anthropic no longer permits third-party tools to use");
+  }
+  const unusable = c.unusableCredentials ?? 0;
+  if (unusable > 0) {
+    parts.push(
+      `discarded ${unusable} synced gateway token${unusable === 1 ? "" : "s"} that named no gateway URL \u2014 a bearer is only valid at the gateway that issued it`
+    );
+  }
   if (c.clearedPins.length > 0) {
     parts.push(`reset ${c.clearedPins.map((t) => t.toUpperCase()).join("/")} to Auto, since the pin named it`);
   }
+  if (parts.length === 0) return "";
   return `Cascade config migration: ${parts.join("; ")}.`;
 }
+
+// src/config/index.ts
+init_revoked_credentials();
 var MCP_TOOL_PREFIX = "mcp__";
 var MAX_SEGMENT_LENGTH = 24;
 var SEGMENT_HASH_LENGTH = 8;
@@ -5780,10 +6228,31 @@ function removeMcpServerDenials(disabledTools, serverName) {
 // src/config/index.ts
 init_constants();
 var KEY_OPTIONAL_PROVIDER_TYPES = /* @__PURE__ */ new Set(["ollama", "openai-compatible"]);
+function hasProviderCredential(p) {
+  if (!p) return false;
+  if (typeof p.apiKey === "string" && p.apiKey.length > 0) return true;
+  return typeof p.authToken === "string" && p.authToken.length > 0 && typeof p.baseUrl === "string" && p.baseUrl.length > 0;
+}
+function isRoutable(p) {
+  if (p.type === "openai-compatible") return Boolean(p.baseUrl?.trim());
+  if (p.type === "azure") return Boolean(p.baseUrl?.trim() && p.deploymentName?.trim());
+  return true;
+}
 function hasUsableProvider(providers) {
   if (!providers?.length) return false;
-  return providers.some((p) => KEY_OPTIONAL_PROVIDER_TYPES.has(p.type) || !!p.apiKey || !!p.authToken);
+  return providers.some((p) => isRoutable(p) && (KEY_OPTIONAL_PROVIDER_TYPES.has(p.type) || hasProviderCredential(p)));
+}
+function applyProviderApiKey(providers, type, apiKey, extra = {}) {
+  const existing = providers.find((p) => p.type === type);
+  if (existing) {
+    existing.apiKey = apiKey;
+    existing.authToken = void 0;
+    if (extra.baseUrl) existing.baseUrl = extra.baseUrl;
+    return;
+  }
+  providers.push({ type, apiKey, ...extra.baseUrl ? { baseUrl: extra.baseUrl } : {} });
 }
+var ENV_ENDPOINT_CHANNEL = /* @__PURE__ */ new Set(["anthropic"]);
 var ConfigManager = class {
   config;
   keystore;
@@ -5803,6 +6272,16 @@ var ConfigManager = class {
    * fallback for a list that is empty for some unrelated reason.
    */
   retiredCleanup;
+  /**
+   * How many dead subscription credentials THIS load removed. Per-load like
+   * `retiredCleanup`, for the same reason: a second load() on the same instance
+   * must not re-announce a migration that already happened.
+   */
+  revokedCredentials = 0;
+  /** Tier pins cleared by the revoked-credential migration this load. */
+  revokedPins = [];
+  /** This load's revoked-credential explanation, joined with any retirement one. */
+  revokedNotice;
   /**
    * Human-readable migration notice held for a UI to display. `console.warn`
    * is not sufficient: the REPL clears the TTY immediately after load(), and
@@ -5818,7 +6297,7 @@ var ConfigManager = class {
   /** `globalDirOverride` exists for tests — never point it at the real home dir there. */
   constructor(workspacePath = process.cwd(), globalDirOverride) {
     this.workspacePath = workspacePath;
-    this.globalDir = globalDirOverride ?? path34.join(os10.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = globalDirOverride ?? path35.join(os10.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
@@ -5832,22 +6311,38 @@ var ConfigManager = class {
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path34.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path34.join(this.workspacePath, CASCADE_DB_FILE));
-    const globalCreds = filterRetiredCredentials(loadGlobalCredentials(this.globalDir));
-    if (globalCreds.removed.length > 0) {
+    this.keystore = new Keystore(path35.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path35.join(this.workspacePath, CASCADE_DB_FILE));
+    const globalRevoked = stripRevokedCredentials(loadGlobalCredentials(this.globalDir));
+    const globalCreds = filterRetiredCredentials(globalRevoked.kept);
+    if (globalRevoked.removed > 0) this.revokedCredentials += globalRevoked.removed;
+    if (globalCreds.removed.length > 0 || globalRevoked.removed > 0) {
+      const retiredHere = globalCreds.removed.length > 0;
       try {
         saveGlobalCredentials(this.globalDir, globalCreds.kept);
       } catch (err) {
         console.warn(`Could not rewrite the global credential store: ${err instanceof Error ? err.message : String(err)}`);
       }
-      this.retiredCleanup = {
-        removed: [.../* @__PURE__ */ new Set([...this.retiredCleanup?.removed ?? [], ...globalCreds.removed])],
-        clearedPins: this.retiredCleanup?.clearedPins ?? []
-      };
+      if (retiredHere) {
+        this.retiredCleanup = {
+          removed: [.../* @__PURE__ */ new Set([...this.retiredCleanup?.removed ?? [], ...globalCreds.removed])],
+          clearedPins: this.retiredCleanup?.clearedPins ?? []
+        };
+      }
     }
-    await this.injectEnvKeys();
+    await this.injectEnvKeys(globalCreds.kept);
     this.config.providers = mergeGlobalCredentials(this.config.providers, globalCreds.kept);
+    if (this.revokedCredentials > 0 && !hasUsableAnthropic(this.config.providers)) {
+      this.revokedPins = clearAnthropicPins(this.config.models, this.config.providers);
+      if (this.revokedPins.length > 0) {
+        await this.persistClearedPins(this.revokedPins.map((p) => p.tier));
+      }
+    }
+    if (this.revokedCredentials > 0) {
+      const pins = this.revokedPins.length ? ` Cleared the ${this.revokedPins.map((p) => `${p.tier.toUpperCase()} pin (${p.model})`).join(" and ")}, since it named Anthropic.` : "";
+      this.revokedNotice = `Cascade config migration: ${REVOKED_CREDENTIAL_REASON}${pins}`;
+      console.warn(this.revokedNotice);
+    }
     for (const type of Object.keys(RETIRED_PROVIDER_TYPES)) {
       try {
         this.store.purgeCachedModelsForRetiredProvider(type);
@@ -5856,10 +6351,14 @@ var ConfigManager = class {
     }
     await this.ensureDefaultIdentity();
     if (mcpNamesChanged) await this.save();
+    const notices = [];
     if (this.retiredCleanup) {
-      console.warn(describeCleanup(this.retiredCleanup));
-      this.pendingRetiredNotice = describeCleanup(this.retiredCleanup);
+      const retired = describeCleanup(this.retiredCleanup);
+      console.warn(retired);
+      notices.push(retired);
     }
+    if (this.revokedNotice) notices.push(this.revokedNotice);
+    if (notices.length > 0) this.pendingRetiredNotice = notices.join(" ");
   }
   getConfig() {
     return this.config;
@@ -5879,12 +6378,18 @@ var ConfigManager = class {
   getWorkspacePath() {
     return this.workspacePath;
   }
-  async save() {
-    const configPath = path34.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs11.mkdir(path34.dirname(configPath), { recursive: true });
-    await fs11.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+  /**
+   * @param config What to persist. Defaults to the manager's own, but a
+   * transactional save hands in the validated copy it has NOT adopted yet —
+   * writing before adopting is what stops a run picking up configuration that
+   * never reached the disk (see `commitSettings`).
+   */
+  async save(config = this.config) {
+    const configPath = path35.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs11.mkdir(path35.dirname(configPath), { recursive: true });
+    await fs11.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
     try {
-      saveGlobalCredentials(this.globalDir, this.config.providers);
+      saveGlobalCredentials(this.globalDir, config.providers);
     } catch (err) {
       console.warn(`Failed to sync credentials to global store: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -5915,19 +6420,35 @@ var ConfigManager = class {
     const configProvider = this.config.providers.find((p) => p.type === provider);
     return configProvider?.apiKey;
   }
+  /**
+   * The bearer token configured for a provider, if any.
+   *
+   * Companion to getApiKey(). A provider can be fully configured with only
+   * this — `cascade link` and ANTHROPIC_AUTH_TOKEN both produce it — so any
+   * surface that asks "is this provider set up" has to consult both, or it
+   * reports a working install as unconfigured.
+   */
+  getAuthToken(provider) {
+    return this.config.providers.find((p) => p.type === provider)?.authToken;
+  }
   async loadConfig() {
     this.retiredCleanup = void 0;
-    const configPath = path34.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    this.revokedCredentials = 0;
+    this.revokedPins = [];
+    this.revokedNotice = void 0;
+    const configPath = path35.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
       const raw = await fs11.readFile(configPath, "utf-8");
       const parsed = JSON.parse(raw);
       const cleanup = stripRetiredProviders(parsed);
-      if (didCleanupChangeAnything(cleanup)) {
-        this.retiredCleanup = cleanup;
+      const revokedHere = stripRevokedFromConfig(parsed).removed;
+      if (revokedHere > 0) this.revokedCredentials += revokedHere;
+      if (didCleanupChangeAnything(cleanup) || revokedHere > 0) {
+        if (didCleanupChangeAnything(cleanup)) this.retiredCleanup = cleanup;
         try {
           await fs11.writeFile(configPath, JSON.stringify(parsed, null, 2), "utf-8");
         } catch (err) {
-          console.warn(`Could not persist the retired-provider migration: ${err instanceof Error ? err.message : String(err)}`);
+          console.warn(`Could not persist the config migration: ${err instanceof Error ? err.message : String(err)}`);
         }
       }
       return validateConfig(parsed);
@@ -5938,9 +6459,102 @@ var ConfigManager = class {
       throw err;
     }
   }
-  async injectEnvKeys() {
+  /**
+   * Rewrite the workspace file with those tier pins removed.
+   *
+   * A targeted edit of the RAW file, not save(). By this point `this.config`
+   * carries environment keys and machine-global credentials, and save()
+   * serializes the whole object — so persisting through it would copy secrets
+   * kept 0600 in ~/.cascade-ai into a workspace file that may be 0644. Same
+   * reasoning as the migration write in loadConfig(); best-effort for the same
+   * reason, since a read-only config directory must not abort startup.
+   */
+  /**
+   * The Azure entries `AZURE_OPENAI_KEY` belongs to — possibly several.
+   *
+   * `AZURE_OPENAI_ENDPOINT` names the resource. Without one, a single
+   * configured resource is unambiguous and anything more is a guess — and
+   * guessing wrong writes a key to a resource that will reject it.
+   *
+   * ALL the deployments on that resource, not the first. An Azure key is
+   * resource-scoped, so every deployment there shares it, and Azure is
+   * configured one entry per deployment — the router binds each model to its
+   * own row, matching `deploymentName` against the model id, so filling only
+   * the first left the rest issuing requests with no key at all.
+   */
+  azureEntriesForEnv(globalProviders = []) {
+    const workspace = this.config.providers;
+    const routing = resolveAzureRouting(
+      [...workspace, ...globalProviders],
+      workspace,
+      {
+        endpoint: process.env["AZURE_OPENAI_ENDPOINT"],
+        deployment: process.env["AZURE_OPENAI_DEPLOYMENT"] ?? process.env["AZURE_OPENAI_DEPLOYMENT_NAME"]
+      }
+    );
+    if (!routing.ok) return [];
+    const onResource = [...routing.rows];
+    const claimEndpointlessRow = (name) => {
+      const row = this.config.providers.find((p) => p.type === "azure" && !p.baseUrl?.trim() && (p.deploymentName?.trim() ?? "") === name);
+      if (!row) return void 0;
+      if (row.apiKey || row.authToken) {
+        console.warn(
+          `Ignoring the stored key on Azure deployment "${name}": it was saved without an endpoint, so there is nothing to show it belongs to ${routing.resource}. AZURE_OPENAI_KEY is being used instead.`
+        );
+        row.apiKey = void 0;
+        row.authToken = void 0;
+      }
+      row.baseUrl = routing.resource;
+      onResource.push(row);
+      return row;
+    };
+    for (const g of globalProviders) {
+      if (g.type !== "azure" || !g.baseUrl?.trim()) continue;
+      if (!sameAzureEndpoint(g.baseUrl, routing.resource)) continue;
+      const name = g.deploymentName?.trim() ?? "";
+      if (onResource.some((p) => (p.deploymentName?.trim() ?? "") === name)) continue;
+      if (claimEndpointlessRow(name)) continue;
+      const row = { ...g, apiKey: void 0, authToken: void 0 };
+      this.config.providers.push(row);
+      onResource.push(row);
+    }
+    if (routing.createDeployment && !claimEndpointlessRow(routing.createDeployment)) {
+      const row = {
+        type: "azure",
+        deploymentName: routing.createDeployment,
+        baseUrl: routing.resource
+      };
+      this.config.providers.push(row);
+      onResource.push(row);
+    }
+    return onResource;
+  }
+  async persistClearedPins(tiers) {
+    const configPath = path35.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    try {
+      const raw = JSON.parse(await fs11.readFile(configPath, "utf-8"));
+      const models = raw["models"];
+      if (typeof models !== "object" || models === null) return;
+      for (const tier of tiers) delete models[tier];
+      await fs11.writeFile(configPath, JSON.stringify(raw, null, 2), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      console.warn(`Could not persist the cleared model pin: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  /**
+   * `globalProviders` is the machine-global credential store, passed in
+   * READ-ONLY. This runs before mergeGlobalCredentials() on purpose — an
+   * exported key should outrank a stored one, which only holds while the
+   * injection goes first — but a few of the questions asked here are about the
+   * user's whole configuration rather than this workspace's file, and answering
+   * those from the workspace alone is what produced the gateway bug this
+   * argument fixes.
+   */
+  async injectEnvKeys(globalProviders = []) {
     const wasEmpty = this.config.providers.length === 0;
-    const emptiedByRetirement = wasEmpty && !!this.retiredCleanup;
+    const emptiedByRetirement = wasEmpty && (!!this.retiredCleanup || this.revokedCredentials > 0);
+    const mayCreate = (type) => wasEmpty || type === "anthropic" && this.revokedCredentials > 0;
     const envProviders = [
       { env: "ANTHROPIC_API_KEY", type: "anthropic" },
       { env: "OPENAI_API_KEY", type: "openai" },
@@ -5950,11 +6564,66 @@ var ConfigManager = class {
     for (const { env, type } of envProviders) {
       const key = process.env[env];
       if (!key) continue;
-      const existing = this.config.providers.find((p) => p.type === type);
-      if (!existing && wasEmpty) {
-        this.config.providers.push({ type, apiKey: key });
-      } else if (existing && !existing.apiKey) {
-        existing.apiKey = key;
+      if (isSubscriptionToken(key)) continue;
+      const targets = type === "azure" ? this.azureEntriesForEnv(globalProviders) : [this.config.providers.find((p) => p.type === type)].filter((p) => !!p);
+      const existing = targets[0];
+      const globalMatch = type === "azure" ? void 0 : globalProviders.find((p) => p.type === type);
+      const anthropicGateway = type === "anthropic" ? process.env["ANTHROPIC_BASE_URL"] : void 0;
+      if (!existing && (mayCreate(type) || globalMatch)) {
+        if (type === "azure") {
+          const endpoint = process.env["AZURE_OPENAI_ENDPOINT"];
+          const deploymentName = process.env["AZURE_OPENAI_DEPLOYMENT"] ?? process.env["AZURE_OPENAI_DEPLOYMENT_NAME"];
+          if (!endpoint || !deploymentName) continue;
+          const apiVersion = process.env["AZURE_OPENAI_API_VERSION"];
+          this.config.providers.push({
+            type,
+            apiKey: key,
+            baseUrl: endpoint,
+            deploymentName,
+            ...apiVersion ? { apiVersion } : {}
+          });
+          continue;
+        }
+        const inherited = ENV_ENDPOINT_CHANNEL.has(type) ? anthropicGateway : anthropicGateway ?? globalMatch?.baseUrl;
+        this.config.providers.push({
+          type,
+          apiKey: key,
+          ...inherited ? { baseUrl: inherited } : {}
+        });
+      } else if (existing) {
+        for (const target of targets) {
+          if (target.apiKey || target.authToken) continue;
+          if (anthropicGateway) {
+            target.apiKey = key;
+            target.baseUrl = anthropicGateway;
+            continue;
+          }
+          if (target.baseUrl && hasDefaultEndpoint(type) && !sameCredentialEndpoint(type, void 0, target.baseUrl)) {
+            if (ENV_ENDPOINT_CHANNEL.has(type)) target.baseUrl = void 0;
+            else {
+              console.warn(
+                `${env} will be used at the ${type} endpoint configured in this workspace (${target.baseUrl}), not at the provider's public host. Remove that \`baseUrl\` if the key was issued by ${type} directly.`
+              );
+            }
+          }
+          target.apiKey = key;
+        }
+      }
+    }
+    const authToken = process.env["ANTHROPIC_AUTH_TOKEN"];
+    if (authToken && !isSubscriptionToken(authToken)) {
+      const existing = this.config.providers.find((p) => p.type === "anthropic");
+      const globalAnthropic = globalProviders.find((p) => p.type === "anthropic");
+      const gateway = process.env["ANTHROPIC_BASE_URL"] ?? existing?.baseUrl ?? globalAnthropic?.baseUrl;
+      if (gateway) {
+        if (existing) {
+          if (!existing.apiKey && !existing.authToken) {
+            existing.authToken = authToken;
+            existing.baseUrl = gateway;
+          }
+        } else if (mayCreate("anthropic") || globalAnthropic) {
+          this.config.providers.push({ type: "anthropic", authToken, baseUrl: gateway });
+        }
       }
     }
     if (wasEmpty && !emptiedByRetirement && !this.config.providers.find((p) => p.type === "ollama")) {
@@ -6306,15 +6975,15 @@ function SafeTextInput(props) {
   const displayValue = mask ? mask.repeat(value.length) : value;
   let rendered;
   if (displayValue.length === 0) {
-    rendered = showCursor && focus ? placeholder.length > 0 ? chalk7.inverse(placeholder[0]) + chalk7.grey(placeholder.slice(1)) : chalk7.inverse(" ") : placeholder.length > 0 ? chalk7.grey(placeholder) : "";
+    rendered = showCursor && focus ? placeholder.length > 0 ? chalk8.inverse(placeholder[0]) + chalk8.grey(placeholder.slice(1)) : chalk8.inverse(" ") : placeholder.length > 0 ? chalk8.grey(placeholder) : "";
   } else if (!showCursor || !focus) {
     rendered = displayValue;
   } else {
     let out = "";
     for (let i = 0; i < displayValue.length; i++) {
-      out += i === cursorOffset ? chalk7.inverse(displayValue[i]) : displayValue[i];
+      out += i === cursorOffset ? chalk8.inverse(displayValue[i]) : displayValue[i];
     }
-    if (cursorOffset >= displayValue.length) out += chalk7.inverse(" ");
+    if (cursorOffset >= displayValue.length) out += chalk8.inverse(" ");
     rendered = out;
   }
   return /* @__PURE__ */ jsx(Text, { children: rendered });
@@ -7358,7 +8027,7 @@ init_pricing();
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+var DEFAULT_CACHE_FILE = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
 function normalizeModelId2(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
@@ -7505,7 +8174,7 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs11.mkdir(path34.dirname(this.opts.cacheFile), { recursive: true });
+      await fs11.mkdir(path35.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
@@ -7772,9 +8441,50 @@ function guardTokens(text) {
 var DISCOVERY_TTL_MS = 15 * 60 * 1e3;
 var DISCOVERY_TIMEOUT_MS = 4e3;
 var cloudDiscoveryCache = /* @__PURE__ */ new Map();
+var IDENTITY_SWEEP_INTERVAL_MS = 60 * 1e3;
+var credentialIdentities = /* @__PURE__ */ new Map();
+var lastIdentitySweep = 0;
+var identitySweepTimer;
+function ensureIdentitySweeper() {
+  if (identitySweepTimer) return;
+  identitySweepTimer = setInterval(() => {
+    sweepExpired(Date.now());
+    if (credentialIdentities.size === 0 && identitySweepTimer) {
+      clearInterval(identitySweepTimer);
+      identitySweepTimer = void 0;
+    }
+  }, IDENTITY_SWEEP_INTERVAL_MS);
+  identitySweepTimer.unref?.();
+}
+function sweepExpired(now) {
+  for (const [key, held] of credentialIdentities) {
+    if (now - held.at > DISCOVERY_TTL_MS) credentialIdentities.delete(key);
+  }
+  for (const [key, entry] of cloudDiscoveryCache) {
+    if (now - entry.at > DISCOVERY_TTL_MS) cloudDiscoveryCache.delete(key);
+  }
+}
+function credentialIdentity(secret) {
+  if (!secret) return "-";
+  const now = Date.now();
+  if (now - lastIdentitySweep > IDENTITY_SWEEP_INTERVAL_MS) {
+    lastIdentitySweep = now;
+    sweepExpired(now);
+  }
+  const held = credentialIdentities.get(secret);
+  if (held && now - held.at <= DISCOVERY_TTL_MS) return held.id;
+  const id = crypto.randomUUID();
+  credentialIdentities.set(secret, { id, at: now });
+  ensureIdentitySweeper();
+  return id;
+}
 function discoveryCacheKey(type, cfg) {
-  const raw = `${type}|${cfg.apiKey ?? ""}|${cfg.baseUrl ?? ""}`;
-  return crypto.createHash("sha256").update(raw).digest("hex").slice(0, 24);
+  return [
+    type,
+    credentialIdentity(cfg.apiKey),
+    credentialIdentity(cfg.authToken),
+    cfg.baseUrl ?? ""
+  ].join("|");
 }
 function applyTierLimits(options, tier, limits) {
   if (!limits) return options;
@@ -8073,7 +8783,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     await Promise.all(providers.map(async (type) => {
       if (!this.selector.isProviderAvailable(type)) return;
       const cfg = config.providers.find((p) => p.type === type);
-      if (!cfg?.apiKey) return;
+      if (!cfg || !hasProviderCredential(cfg)) return;
       const cacheKey = discoveryCacheKey(type, cfg);
       let entry = cloudDiscoveryCache.get(cacheKey);
       if (!entry || Date.now() - entry.at > DISCOVERY_TTL_MS) {
@@ -8082,7 +8792,11 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
         try {
           const provider = this.createProvider(cfg, seed);
           if (typeof provider.listModels !== "function") return;
-          const models = await withTimeout(provider.listModels(), DISCOVERY_TIMEOUT_MS, `${type} model discovery timed out`);
+          const models = await withTimeout(
+            provider.listModels({ staticFallback: false }),
+            DISCOVERY_TIMEOUT_MS,
+            `${type} model discovery timed out`
+          );
           if (!models.length) return;
           entry = { models, ids: models.map((m) => m.id), at: Date.now() };
           cloudDiscoveryCache.set(cacheKey, entry);
@@ -10346,8 +11060,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         // Media generation can run for a minute; without this a cancelled run
         // still pays for an image nobody will see.
         ...this.signal ? { signal: this.signal } : {},
-        saveSnapshot: async (path39, content) => {
-          this.store?.addFileSnapshot(this.taskId, path39, content);
+        saveSnapshot: async (path40, content) => {
+          this.store?.addFileSnapshot(this.taskId, path40, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -10550,7 +11264,7 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execFileAsync2 = promisify4(execFile3);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path34.resolve(this.artifactRoot(), artifactPath);
+      const absolutePath = path35.resolve(this.artifactRoot(), artifactPath);
       try {
         const stat = await fs11.stat(absolutePath);
         if (!stat.isFile()) {
@@ -10585,7 +11299,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path34.extname(absolutePath).toLowerCase();
+        const ext = path35.extname(absolutePath).toLowerCase();
         const check = ext === ".ts" || ext === ".tsx" ? { cmd: "npx", args: ["tsc", "--noEmit", absolutePath] } : ext === ".js" || ext === ".jsx" ? { cmd: process.execPath, args: ["--check", absolutePath] } : ext === ".py" ? { cmd: "python", args: ["-m", "py_compile", absolutePath] } : null;
         if (check) {
           try {
@@ -10677,7 +11391,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
   async checkAcceptance(assignment) {
     const criteria = assignment.acceptance ?? [];
     if (!criteria.length) return [];
-    const resolve2 = (target) => path34.resolve(this.artifactRoot(), target);
+    const resolve2 = (target) => path35.resolve(this.artifactRoot(), target);
     return evaluateAcceptance(criteria, assignment.files ?? [], {
       stat: async (target) => {
         try {
@@ -13906,16 +14620,16 @@ function resolveInWorkspace(workspaceRoot, input) {
   if (typeof input !== "string" || input.length === 0) {
     throw new WorkspaceSandboxError(String(input), workspaceRoot);
   }
-  const root = path34.resolve(workspaceRoot);
-  const abs = path34.isAbsolute(input) ? path34.resolve(input) : path34.resolve(root, input);
-  const rel = path34.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path34.isAbsolute(rel)) {
+  const root = path35.resolve(workspaceRoot);
+  const abs = path35.isAbsolute(input) ? path35.resolve(input) : path35.resolve(root, input);
+  const rel = path35.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path35.isAbsolute(rel)) {
     throw new WorkspaceSandboxError(input, root);
   }
   try {
-    const real = fs31.realpathSync(abs);
-    const realRel = path34.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path34.isAbsolute(realRel))) {
+    const real = fs32.realpathSync(abs);
+    const realRel = path35.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path35.isAbsolute(realRel))) {
       throw new WorkspaceSandboxError(input, root);
     }
   } catch (e) {
@@ -14568,7 +15282,7 @@ var GenerateDocumentTool = class extends BaseTool {
       }
     }
     const bytes = await renderDocument(ext, content, { name: filePath, loadImageBytes });
-    await fs11.mkdir(path34.dirname(absPath), { recursive: true });
+    await fs11.mkdir(path35.dirname(absPath), { recursive: true });
     await fs11.writeFile(absPath, bytes);
     const charts = countCharts(content);
     return [
@@ -14789,7 +15503,7 @@ var FileWriteTool = class extends BaseTool {
       } catch {
       }
     }
-    await fs11.mkdir(path34.dirname(absPath), { recursive: true });
+    await fs11.mkdir(path35.dirname(absPath), { recursive: true });
     await fs11.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
@@ -15287,7 +16001,7 @@ var ImageAnalyzeTool = class extends BaseTool {
 };
 async function fileToImageAttachment(filePath) {
   const data = await fs11.readFile(filePath);
-  const ext = path34.extname(filePath).toLowerCase();
+  const ext = path35.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -15321,14 +16035,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path34.dirname(filePath);
-    if (!fs31.existsSync(dir)) {
-      fs31.mkdirSync(dir, { recursive: true });
+    const dir = path35.dirname(filePath);
+    if (!fs32.existsSync(dir)) {
+      fs32.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve2, reject) => {
       try {
         const doc = new PDFDocument({ margin: 50 });
-        const stream = fs31.createWriteStream(filePath);
+        const stream = fs32.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -15406,22 +16120,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path34.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs31.existsSync(tmpDir)) {
-      fs31.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path35.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs32.existsSync(tmpDir)) {
+      fs32.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path34.join(tmpDir, fileName);
-    fs31.writeFileSync(filePath, code, "utf-8");
+    const filePath = path35.join(tmpDir, fileName);
+    fs32.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve2) => {
       const startMs = Date.now();
       execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs31.existsSync(filePath)) {
-            fs31.unlinkSync(filePath);
+          if (fs32.existsSync(filePath)) {
+            fs32.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -15733,7 +16447,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path34.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path35.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -15746,7 +16460,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs11.stat(path34.join(searchPath, rel));
+          const stat = await fs11.stat(path35.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -15795,7 +16509,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path34.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path35.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -15849,12 +16563,12 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path34.relative(searchPath, searchPath) || "."];
+      files = [path35.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path34.join(searchPath, rel);
+      const abs = path35.join(searchPath, rel);
       let content;
       try {
         content = await fs11.readFile(abs, "utf-8");
@@ -16253,10 +16967,10 @@ var ToolRegistry = class extends EventEmitter {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path34.resolve(this.workspaceRoot, filePath);
-    const rel = path34.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path34.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path34.sep).join("/");
+    const abs = path35.resolve(this.workspaceRoot, filePath);
+    const rel = path35.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path35.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path35.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
@@ -16490,22 +17204,22 @@ var FileMcpOAuthStore = class {
   filePath;
   load() {
     try {
-      return JSON.parse(fs31.readFileSync(this.filePath, "utf-8"));
+      return JSON.parse(fs32.readFileSync(this.filePath, "utf-8"));
     } catch {
       return void 0;
     }
   }
   save(state) {
-    fs31.mkdirSync(path34.dirname(this.filePath), { recursive: true, mode: 448 });
-    fs31.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
+    fs32.mkdirSync(path35.dirname(this.filePath), { recursive: true, mode: 448 });
+    fs32.writeFileSync(this.filePath, JSON.stringify(state, null, 2), { mode: 384 });
     try {
-      fs31.chmodSync(this.filePath, 384);
+      fs32.chmodSync(this.filePath, 384);
     } catch {
     }
   }
   clear() {
     try {
-      fs31.rmSync(this.filePath);
+      fs32.rmSync(this.filePath);
     } catch {
     }
   }
@@ -17153,7 +17867,7 @@ var TaskAnalyzer = class {
 
 // src/core/router/model-performance-tracker.ts
 init_pricing();
-var DEFAULT_STATS_FILE = path34.join(os10.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path35.join(os10.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class {
   stats = /* @__PURE__ */ new Map();
   featureStats = /* @__PURE__ */ new Map();
@@ -17193,7 +17907,7 @@ var ModelPerformanceTracker = class {
   async save() {
     if (this.readOnly) return;
     try {
-      await fs11.mkdir(path34.dirname(this.statsFile), { recursive: true });
+      await fs11.mkdir(path35.dirname(this.statsFile), { recursive: true });
       const modelsObj = {};
       const featuresObj = {};
       for (const [key, stat] of this.stats) modelsObj[key] = stat;
@@ -17741,7 +18455,7 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path34.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path35.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
       const raw = await fs11.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
@@ -17765,8 +18479,8 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path34.join(this.workspacePath, ".cascade");
-    const file = path34.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path35.join(this.workspacePath, ".cascade");
+    const file = path35.join(dir, DYNAMIC_TOOLS_FILE);
     try {
       await fs11.mkdir(dir, { recursive: true });
       await fs11.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
@@ -17786,12 +18500,12 @@ var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
     this.debugMode = debugMode;
-    const cascadeDir = path34.join(workspacePath, ".cascade");
-    if (!fs31.existsSync(cascadeDir)) {
-      fs31.mkdirSync(cascadeDir, { recursive: true });
+    const cascadeDir = path35.join(workspacePath, ".cascade");
+    if (!fs32.existsSync(cascadeDir)) {
+      fs32.mkdirSync(cascadeDir, { recursive: true });
     }
-    this.keyPath = path34.join(cascadeDir, "world_state.key");
-    this.dbPath = path34.join(cascadeDir, "world_state.db");
+    this.keyPath = path35.join(cascadeDir, "world_state.key");
+    this.dbPath = path35.join(cascadeDir, "world_state.db");
     this.initEncryptionKey();
     this.db = new Database2(this.dbPath);
     this.db.pragma("journal_mode = WAL");
@@ -17848,11 +18562,11 @@ var WorldStateDB = class {
     ).run(e, r, row.encrypted_value, row.source_worker, row.timestamp, validTo, change);
   }
   initEncryptionKey() {
-    if (fs31.existsSync(this.keyPath)) {
-      this.encryptionKey = fs31.readFileSync(this.keyPath);
+    if (fs32.existsSync(this.keyPath)) {
+      this.encryptionKey = fs32.readFileSync(this.keyPath);
     } else {
       this.encryptionKey = crypto.randomBytes(32);
-      fs31.writeFileSync(this.keyPath, this.encryptionKey);
+      fs32.writeFileSync(this.keyPath, this.encryptionKey);
     }
   }
   encrypt(text) {
@@ -18138,9 +18852,9 @@ var WorldStateDB = class {
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
-      const dumpPath = path34.join(os10.tmpdir(), "cascade_world_state_debug.json");
+      const dumpPath = path35.join(os10.tmpdir(), "cascade_world_state_debug.json");
       const entries = this.getAllEntries();
-      fs31.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+      fs32.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
     } catch (err) {
       console.error("Failed to dump debug world state", err);
     }
@@ -18197,7 +18911,7 @@ var ResumeStore = class {
         createdAt: checkpoint.createdAt ?? new Date(timestamp).toISOString()
       };
       await promises.mkdir(this.dir, { recursive: true });
-      const finalPath = path34.join(this.dir, `${timestamp}-${safeId(record.taskId)}.json`);
+      const finalPath = path35.join(this.dir, `${timestamp}-${safeId(record.taskId)}.json`);
       const tempPath = `${finalPath}.${process.pid}.tmp`;
       await promises.writeFile(tempPath, JSON.stringify(record, null, 2), "utf-8");
       await promises.rename(tempPath, finalPath);
@@ -18220,7 +18934,7 @@ var ResumeStore = class {
     const checkpoints = [];
     for (const candidate of candidates2) {
       try {
-        const raw = await promises.readFile(path34.join(this.dir, candidate.name), "utf-8");
+        const raw = await promises.readFile(path35.join(this.dir, candidate.name), "utf-8");
         const parsed = JSON.parse(raw);
         if (isCheckpoint(parsed)) checkpoints.push(parsed);
       } catch {
@@ -18259,7 +18973,7 @@ var ResumeStore = class {
       const source = entries.find((name) => FILE_PATTERN.exec(name)?.[2] === wanted);
       if (!source) return null;
       const claimId = `${this.now()}-${safeId(target.taskId)}`;
-      await promises.rename(path34.join(this.dir, source), path34.join(this.dir, `${claimId}${CLAIM_SUFFIX}`));
+      await promises.rename(path35.join(this.dir, source), path35.join(this.dir, `${claimId}${CLAIM_SUFFIX}`));
       return { checkpoint: target, claimId };
     } catch {
       return null;
@@ -18269,8 +18983,8 @@ var ResumeStore = class {
   async release(claimId) {
     try {
       await promises.rename(
-        path34.join(this.dir, `${claimId}${CLAIM_SUFFIX}`),
-        path34.join(this.dir, `${claimId}.json`)
+        path35.join(this.dir, `${claimId}${CLAIM_SUFFIX}`),
+        path35.join(this.dir, `${claimId}.json`)
       );
     } catch {
     }
@@ -18278,7 +18992,7 @@ var ResumeStore = class {
   /** Discard a claim for good — the resumed run has taken ownership. */
   async settle(claimId) {
     try {
-      await promises.rm(path34.join(this.dir, `${claimId}${CLAIM_SUFFIX}`), { force: true });
+      await promises.rm(path35.join(this.dir, `${claimId}${CLAIM_SUFFIX}`), { force: true });
     } catch {
     }
   }
@@ -18307,8 +19021,8 @@ var ResumeStore = class {
         const stamp2 = Number(/^(\d+)-/.exec(name)?.[1]);
         if (!Number.isFinite(stamp2) || stamp2 >= cutoff) continue;
         await promises.rename(
-          path34.join(this.dir, name),
-          path34.join(this.dir, `${name.slice(0, -CLAIM_SUFFIX.length)}.json`)
+          path35.join(this.dir, name),
+          path35.join(this.dir, `${name.slice(0, -CLAIM_SUFFIX.length)}.json`)
         );
         reclaimed++;
       }
@@ -18324,7 +19038,7 @@ var ResumeStore = class {
       await Promise.all(entries.map(async (name) => {
         const match = FILE_PATTERN.exec(name);
         if (match?.[2] === wanted) {
-          await promises.rm(path34.join(this.dir, name), { force: true });
+          await promises.rm(path35.join(this.dir, name), { force: true });
         }
       }));
     } catch {
@@ -18339,7 +19053,7 @@ var ResumeStore = class {
       const doomed = files.filter((f, index) => f.timestamp < cutoff || index >= this.maxCheckpoints);
       const staleTemps = entries.filter((name) => name.endsWith(".tmp")).filter((name) => (Number(FILE_PATTERN.exec(name.replace(/\.\d+\.tmp$/, ".json"))?.[1]) || 0) < cutoff);
       await Promise.all([...doomed.map((f) => f.name), ...staleTemps].map(
-        (name) => promises.rm(path34.join(this.dir, name), { force: true })
+        (name) => promises.rm(path35.join(this.dir, name), { force: true })
       ));
     } catch {
     }
@@ -18716,7 +19430,7 @@ var WorkspaceIndex = class {
   isIgnored;
   chunker;
   constructor(opts) {
-    this.root = path34.resolve(opts.root);
+    this.root = path35.resolve(opts.root);
     this.db = opts.db;
     this.namespace = opts.namespace ?? "code";
     this.extensions = new Set((opts.extensions ?? DEFAULT_EXTENSIONS).map((e) => e.replace(/^\./, "").toLowerCase()));
@@ -18748,14 +19462,14 @@ var WorkspaceIndex = class {
         return;
       }
       for (const entry of entries) {
-        const abs = path34.join(dir, entry.name);
+        const abs = path35.join(dir, entry.name);
         if (entry.isDirectory()) {
           if (HARD_SKIP_DIRS.has(entry.name) || this.isIgnored(abs)) continue;
           await walk(abs);
         } else if (entry.isFile()) {
-          const ext = path34.extname(entry.name).slice(1).toLowerCase();
+          const ext = path35.extname(entry.name).slice(1).toLowerCase();
           if (!this.extensions.has(ext) || this.isIgnored(abs)) continue;
-          out.push(path34.relative(this.root, abs));
+          out.push(path35.relative(this.root, abs));
         }
       }
     };
@@ -18785,7 +19499,7 @@ var WorkspaceIndex = class {
     const entries = [];
     for (const rel of rels) {
       try {
-        const abs = path34.join(this.root, rel);
+        const abs = path35.join(this.root, rel);
         const stat = await fs11.stat(abs);
         if (stat.size > this.maxFileBytes) continue;
         const buf = await fs11.readFile(abs);
@@ -19275,13 +19989,13 @@ var Cascade = class _Cascade extends EventEmitter {
     this.toolRegistry = new ToolRegistry(this.config.tools, workspacePath);
     try {
       this.router.setDeadModelStore(new DeadModelStore(
-        fileDeadModelPersistence(path34.join(workspacePath, ".cascade", "dead-models.json"))
+        fileDeadModelPersistence(path35.join(workspacePath, ".cascade", "dead-models.json"))
       ));
     } catch {
     }
     try {
       this.resumeStore = new ResumeStore({
-        dir: path34.join(workspacePath, ".cascade", "resume")
+        dir: path35.join(workspacePath, ".cascade", "resume")
       });
     } catch {
     }
@@ -19369,8 +20083,8 @@ var Cascade = class _Cascade extends EventEmitter {
       this.emit("log", { level: "warn", message: "Code index enabled but no embeddings-capable provider is configured \u2014 skipping." });
       return;
     }
-    const dbPath = ci.dbPath || path34.join(this.workspacePath, ".cascade", "code-index.db");
-    fs31.mkdirSync(path34.dirname(dbPath), { recursive: true });
+    const dbPath = ci.dbPath || path35.join(this.workspacePath, ".cascade", "code-index.db");
+    fs32.mkdirSync(path35.dirname(dbPath), { recursive: true });
     const db = new Database2(dbPath);
     db.pragma("journal_mode = WAL");
     const complete = chatCompleterFromProviders(this.config.providers);
@@ -20818,14 +21532,14 @@ ${finalOutput}` : ""
 init_constants();
 var CLOUD_SESSION_FILE = "cloud-session.json";
 function globalDir(homeDir = os10.homedir()) {
-  return path34.join(homeDir, GLOBAL_CONFIG_DIR);
+  return path35.join(homeDir, GLOBAL_CONFIG_DIR);
 }
 function cloudSessionPath(dir = globalDir()) {
-  return path34.join(dir, CLOUD_SESSION_FILE);
+  return path35.join(dir, CLOUD_SESSION_FILE);
 }
 function loadCloudSession(dir = globalDir()) {
   try {
-    const raw = fs31.readFileSync(cloudSessionPath(dir), "utf-8");
+    const raw = fs32.readFileSync(cloudSessionPath(dir), "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed?.refreshToken || !parsed?.serverUrl) return null;
     return parsed;
@@ -20834,17 +21548,17 @@ function loadCloudSession(dir = globalDir()) {
   }
 }
 function saveCloudSession(session, dir = globalDir()) {
-  fs31.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs32.mkdirSync(dir, { recursive: true, mode: 448 });
   const file = cloudSessionPath(dir);
-  fs31.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
+  fs32.writeFileSync(file, JSON.stringify(session, null, 2), { mode: 384 });
   try {
-    fs31.chmodSync(file, 384);
+    fs32.chmodSync(file, 384);
   } catch {
   }
 }
 function clearCloudSession(dir = globalDir()) {
   try {
-    fs31.rmSync(cloudSessionPath(dir));
+    fs32.rmSync(cloudSessionPath(dir));
   } catch {
   }
 }
@@ -21016,16 +21730,16 @@ var CloudClient = class _CloudClient {
     return (await this.refresh()).accessToken;
   }
   /** Authenticated request that refreshes once on a 401 (e.g. server-side revoke). */
-  async authed(path39, init = {}) {
-    const call = (token) => fetch(this.url(path39), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
+  async authed(path40, init = {}) {
+    const call = (token) => fetch(this.url(path40), { ...init, headers: { ...init.headers ?? {}, Authorization: `Bearer ${token}` } });
     let res = await call(await this.accessToken());
     if (res.status === 401) res = await call((await this.refresh()).accessToken);
     if (!res.ok) throw new Error(`Request failed (${res.status}).`);
     const text = await res.text();
     return text ? JSON.parse(text) : {};
   }
-  authedGet(path39) {
-    return this.authed(path39);
+  authedGet(path40) {
+    return this.authed(path40);
   }
   async fetchMe(token) {
     const res = await fetch(this.url("/api/me"), { headers: { Authorization: `Bearer ${token}` } });
@@ -21886,7 +22600,7 @@ function StatusBarInternal({
   const savedStr = savedUsd > 0 ? ` \xB7 saved $${savedUsd.toFixed(4)}` : "";
   const rightStr = ` ${formatTokens(tokens)} \xB7 $${costUsd.toFixed(4)}${savedStr} ${isExecuting ? "\u26A1" : "\xB7"} `;
   const gap = Math.max(0, width - leftStr.length - rightStr.length);
-  const line = chalk7.bgHex(theme.colors.primary).hex(theme.colors.background)(chalk7.bold(leftStr) + " ".repeat(gap) + rightStr);
+  const line = chalk8.bgHex(theme.colors.primary).hex(theme.colors.background)(chalk8.bold(leftStr) + " ".repeat(gap) + rightStr);
   return /* @__PURE__ */ jsx(Text, { children: line });
 }
 function formatTokens(n) {
@@ -22355,7 +23069,7 @@ function renderContent(content, theme) {
         i
       );
     }
-    const rendered = part.replace(/\*\*(.*?)\*\*/g, (_, t) => chalk7.bold(t)).replace(/`(.*?)`/g, (_, t) => chalk7.bgHex(theme.colors.border)(t));
+    const rendered = part.replace(/\*\*(.*?)\*\*/g, (_, t) => chalk8.bold(t)).replace(/`(.*?)`/g, (_, t) => chalk8.bgHex(theme.colors.border)(t));
     return /* @__PURE__ */ jsx(Text, { wrap: "wrap", children: rendered }, i);
   });
 }
@@ -22799,9 +23513,9 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, s
       }
     } catch {
     }
-    const configPath = path34.join(workspacePath, ".cascade", "config.json");
+    const configPath = path35.join(workspacePath, ".cascade", "config.json");
     try {
-      await fs11.mkdir(path34.dirname(configPath), { recursive: true });
+      await fs11.mkdir(path35.dirname(configPath), { recursive: true });
       await fs11.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -22853,9 +23567,9 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, s
       if (msg.includes("non-text parts")) return;
       originalLog(...args);
     };
-    const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
     storeRef.current = store;
-    globalStoreRef.current = new MemoryStore(path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE));
+    globalStoreRef.current = new MemoryStore(path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE));
     const identityRows = store.listIdentities().map((i) => ({ id: i.id, name: i.name, isDefault: i.isDefault }));
     setIdentities(identityRows);
     let initialIdentityId = config.defaultIdentityId ?? identityRows.find((i) => i.isDefault)?.id ?? identityRows[0]?.id;
@@ -22935,7 +23649,7 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, s
       onThemeChange: (name) => setTheme(getTheme(name)),
       onExport: async (fmt) => {
         const stamp2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        const exportPath = path34.join(workspacePath, `cascade-export-${stamp2}.${fmt === "json" ? "json" : "md"}`);
+        const exportPath = path35.join(workspacePath, `cascade-export-${stamp2}.${fmt === "json" ? "json" : "md"}`);
         if (fmt === "json") {
           await fs11.writeFile(exportPath, JSON.stringify({ sessionId: sessionIdRef.current, messages: state.messages }, null, 2), "utf-8");
         } else {
@@ -23843,7 +24557,7 @@ function stringifySlashOutput(val) {
 }
 async function searchSessionsAndMessages(query, workspacePath) {
   if (!query) return "Usage: /search <query>";
-  const dbPath = path34.join(workspacePath, CASCADE_DB_FILE);
+  const dbPath = path35.join(workspacePath, CASCADE_DB_FILE);
   try {
     await fs11.access(dbPath);
   } catch {
@@ -23877,7 +24591,7 @@ async function searchSessionsAndMessages(query, workspacePath) {
 async function diagnoseRuntime(config, workspacePath) {
   const providers = config.providers.map((p) => `${p.type}${p.apiKey ? " (key set)" : " (no key)"}`).join("\n");
   const models = [`T1: ${config.models.t1 ?? "default"}`, `T2: ${config.models.t2 ?? "default"}`, `T3: ${config.models.t3 ?? "default"}`].join("\n");
-  const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
   try {
     const sessions2 = store.listSessions(void 0, 3);
     return [
@@ -23896,7 +24610,7 @@ async function diagnoseRuntime(config, workspacePath) {
 }
 async function showRecentLogs(args, workspacePath) {
   const limit = Number.parseInt(args[0] ?? "10", 10) || 10;
-  const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
   try {
     const logs = store.listRuntimeNodeLogs(void 0, void 0, limit);
     if (!logs.length) return "No recent runtime logs.";
@@ -23908,7 +24622,7 @@ async function showRecentLogs(args, workspacePath) {
 async function loadSessionSnapshot(args, workspacePath) {
   const sessionId = args[0];
   if (!sessionId) return "Usage: /resume <sessionId>";
-  const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
   try {
     const session = store.getSession(sessionId);
     if (!session) return `Session not found: ${sessionId}`;
@@ -24328,9 +25042,9 @@ function SetupWizard({ workspacePath, onComplete }) {
           ...anyAuto ? { cascadeAuto: true } : {}
         };
         const config = CascadeConfigSchema.parse(rawConfig);
-        const configDir = path34.join(workspacePath, ".cascade");
+        const configDir = path35.join(workspacePath, ".cascade");
         await fs11.mkdir(configDir, { recursive: true });
-        const configPath = path34.join(workspacePath, CASCADE_CONFIG_FILE);
+        const configPath = path35.join(workspacePath, CASCADE_CONFIG_FILE);
         await fs11.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
         savedConfigRef.current = config;
         dispatchRef.current({ type: "GO_DONE" });
@@ -24671,25 +25385,25 @@ function printTelemetryBanner() {
 async function initCommand(workspacePath = process.cwd()) {
   const spin = ora({ text: "Initializing Cascade project\u2026", color: "magenta" }).start();
   try {
-    const configDir = path34.join(workspacePath, ".cascade");
+    const configDir = path35.join(workspacePath, ".cascade");
     await fs11.mkdir(configDir, { recursive: true });
-    const mdPath = path34.join(workspacePath, "CASCADE.md");
+    const mdPath = path35.join(workspacePath, "CASCADE.md");
     if (!await fileExists(mdPath)) {
       await createDefaultCascadeMd(workspacePath);
-      spin.succeed(chalk7.green("Created CASCADE.md"));
+      spin.succeed(chalk8.green("Created CASCADE.md"));
     }
-    const ignorePath = path34.join(workspacePath, ".cascadeignore");
+    const ignorePath = path35.join(workspacePath, ".cascadeignore");
     if (!await fileExists(ignorePath)) {
       await createDefaultIgnoreFile(workspacePath);
-      spin.succeed(chalk7.green("Created .cascadeignore"));
+      spin.succeed(chalk8.green("Created .cascadeignore"));
     }
     spin.stop();
     console.log();
-    console.log(chalk7.magenta("  \u25C8 Cascade AI \u2014 Project initialized"));
+    console.log(chalk8.magenta("  \u25C8 Cascade AI \u2014 Project initialized"));
     console.log();
-    const configPath = path34.join(workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path35.join(workspacePath, CASCADE_CONFIG_FILE);
     if (await fileExists(configPath)) {
-      console.log(chalk7.yellow("  .cascade/config.json already exists \u2014 launching wizard to reconfigure."));
+      console.log(chalk8.yellow("  .cascade/config.json already exists \u2014 launching wizard to reconfigure."));
       console.log();
     }
     const config = await runSetupWizard(workspacePath);
@@ -24697,10 +25411,10 @@ async function initCommand(workspacePath = process.cwd()) {
     await cm.load();
     await cm.updateConfig(config);
     console.log();
-    console.log(chalk7.green("  \u25C8 Setup complete! Run `cascade` to start."));
+    console.log(chalk8.green("  \u25C8 Setup complete! Run `cascade` to start."));
     console.log();
   } catch (err) {
-    console.error(chalk7.red(`Init failed: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk8.red(`Init failed: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
 }
@@ -24715,7 +25429,20 @@ async function fileExists(p) {
 
 // src/cli/commands/doctor.ts
 init_constants();
+
+// src/config/credential-discovery.ts
+init_revoked_credentials();
 var TOS_WARNING = "Reusing this subscription token outside its own CLI may violate the vendor\u2019s terms of service.";
+var ANTHROPIC_OAUTH_WARNING = "Anthropic does not permit third-party tools to route requests through Claude subscription credentials, and blocks them server-side. Use an API key from the Claude Console, or ANTHROPIC_AUTH_TOKEN with a gateway. See code.claude.com/docs/en/legal-and-compliance.";
+var OPENAI_COMPATIBLE_ENV = [
+  { id: "openrouter", env: "OPENROUTER_API_KEY", label: "OpenRouter", baseUrl: "https://openrouter.ai/api/v1" },
+  { id: "groq", env: "GROQ_API_KEY", label: "Groq", baseUrl: "https://api.groq.com/openai/v1" },
+  { id: "deepseek", env: "DEEPSEEK_API_KEY", label: "DeepSeek", baseUrl: "https://api.deepseek.com/v1" },
+  { id: "xai", env: "XAI_API_KEY", label: "xAI", baseUrl: "https://api.x.ai/v1" },
+  { id: "mistral", env: "MISTRAL_API_KEY", label: "Mistral", baseUrl: "https://api.mistral.ai/v1" },
+  { id: "together", env: "TOGETHER_API_KEY", label: "Together AI", baseUrl: "https://api.together.xyz/v1" },
+  { id: "fireworks", env: "FIREWORKS_API_KEY", label: "Fireworks AI", baseUrl: "https://api.fireworks.ai/inference/v1" }
+];
 async function readJson(file) {
   try {
     const raw = await fs11.readFile(file, "utf-8");
@@ -24739,36 +25466,118 @@ function fromEnv(env) {
   for (const { env: name, provider } of map) {
     const secret = str(env[name]);
     if (!secret || seen.has(provider)) continue;
+    if (isSubscriptionToken(secret)) {
+      out.push({
+        provider,
+        sourceTool: `Environment (${name})`,
+        kind: "oauth",
+        secret,
+        directlyUsable: false,
+        warning: ANTHROPIC_OAUTH_WARNING
+      });
+      continue;
+    }
     seen.add(provider);
-    out.push({ provider, sourceTool: `Environment (${name})`, kind: "api-key", secret, directlyUsable: true });
+    const gateway = provider === "anthropic" ? str(env["ANTHROPIC_BASE_URL"]) : void 0;
+    out.push({
+      provider,
+      sourceTool: `Environment (${name})`,
+      kind: "api-key",
+      secret,
+      directlyUsable: true,
+      ...gateway ? { baseUrl: gateway } : {}
+    });
+  }
+  const authToken = str(env["ANTHROPIC_AUTH_TOKEN"]);
+  if (authToken && !seen.has("anthropic")) {
+    seen.add("anthropic");
+    if (isSubscriptionToken(authToken)) {
+      out.push({
+        provider: "anthropic",
+        sourceTool: "Environment (ANTHROPIC_AUTH_TOKEN)",
+        kind: "oauth",
+        secret: authToken,
+        directlyUsable: false,
+        warning: ANTHROPIC_OAUTH_WARNING
+      });
+    } else {
+      const gateway = str(env["ANTHROPIC_BASE_URL"]);
+      out.push({
+        provider: "anthropic",
+        sourceTool: "Environment (ANTHROPIC_AUTH_TOKEN)",
+        kind: "bearer",
+        secret: authToken,
+        directlyUsable: Boolean(gateway),
+        ...gateway ? { baseUrl: gateway } : {},
+        ...gateway ? {} : {
+          warning: "A bearer token is only valid at the gateway that issued it. Set ANTHROPIC_BASE_URL to that gateway, or configure `baseUrl` for the anthropic provider, before linking it."
+        }
+      });
+    }
+  }
+  const azureKey = str(env["AZURE_OPENAI_KEY"]) ?? str(env["AZURE_OPENAI_API_KEY"]);
+  if (azureKey) {
+    const endpoint = str(env["AZURE_OPENAI_ENDPOINT"]);
+    const deployment = str(env["AZURE_OPENAI_DEPLOYMENT"]) ?? str(env["AZURE_OPENAI_DEPLOYMENT_NAME"]);
+    const apiVersion = str(env["AZURE_OPENAI_API_VERSION"]);
+    const missing = [
+      !endpoint && "AZURE_OPENAI_ENDPOINT",
+      !deployment && "AZURE_OPENAI_DEPLOYMENT"
+    ].filter((x) => typeof x === "string");
+    out.push({
+      provider: "azure",
+      sourceTool: "Environment (AZURE_OPENAI_KEY)",
+      kind: "api-key",
+      secret: azureKey,
+      directlyUsable: missing.length === 0,
+      ...endpoint ? { baseUrl: endpoint } : {},
+      ...deployment ? { deploymentName: deployment } : {},
+      ...apiVersion ? { apiVersion } : {},
+      ...missing.length ? { warning: `Azure also needs ${missing.join(" and ")} \u2014 a key alone cannot address a deployment.` } : {}
+    });
+  }
+  for (const { id, env: name, label, baseUrl } of OPENAI_COMPATIBLE_ENV) {
+    const secret = str(env[name]);
+    if (!secret) continue;
+    out.push({
+      provider: "openai-compatible",
+      sourceTool: `Environment (${name}) \u2014 ${label}`,
+      kind: "api-key",
+      secret,
+      directlyUsable: true,
+      baseUrl,
+      serviceId: id
+    });
   }
   return out;
 }
-async function fromClaudeCode(home) {
-  const file = path34.join(home, ".claude", ".credentials.json");
+async function fromClaudeCode(home, env) {
+  const dir = str(env["CLAUDE_CONFIG_DIR"]) ?? path35.join(home, ".claude");
+  const file = path35.join(dir, ".credentials.json");
   const data = await readJson(file);
   if (!data) return [];
+  const found = [];
+  const apiKey = str(data["apiKey"]) ?? str(data["anthropicApiKey"]);
+  if (apiKey) {
+    found.push({ provider: "anthropic", sourceTool: "Claude Code", kind: "api-key", secret: apiKey, directlyUsable: true, sourcePath: file });
+  }
   const oauth = data["claudeAiOauth"];
   const oauthToken = str(oauth?.["accessToken"]);
   if (oauthToken) {
-    return [{
+    found.push({
       provider: "anthropic",
       sourceTool: "Claude Code",
       kind: "oauth",
       secret: oauthToken,
-      directlyUsable: true,
-      warning: TOS_WARNING,
+      directlyUsable: false,
+      warning: ANTHROPIC_OAUTH_WARNING,
       sourcePath: file
-    }];
-  }
-  const apiKey = str(data["apiKey"]) ?? str(data["anthropicApiKey"]);
-  if (apiKey) {
-    return [{ provider: "anthropic", sourceTool: "Claude Code", kind: "api-key", secret: apiKey, directlyUsable: true, sourcePath: file }];
+    });
   }
-  return [];
+  return found;
 }
 async function fromCodex(home) {
-  const file = path34.join(home, ".codex", "auth.json");
+  const file = path35.join(home, ".codex", "auth.json");
   const data = await readJson(file);
   if (!data) return [];
   const apiKey = str(data["OPENAI_API_KEY"]);
@@ -24791,7 +25600,7 @@ async function fromCodex(home) {
   return [];
 }
 async function fromGemini(home) {
-  const file = path34.join(home, ".gemini", "oauth_creds.json");
+  const file = path35.join(home, ".gemini", "oauth_creds.json");
   const data = await readJson(file);
   const accessToken = str(data?.["access_token"]);
   if (!accessToken) return [];
@@ -24807,7 +25616,7 @@ async function fromGemini(home) {
 }
 async function fromCopilot(home) {
   for (const name of ["apps.json", "hosts.json"]) {
-    const file = path34.join(home, ".config", "github-copilot", name);
+    const file = path35.join(home, ".config", "github-copilot", name);
     const data = await readJson(file);
     if (!data) continue;
     for (const value of Object.values(data)) {
@@ -24832,7 +25641,7 @@ async function discoverCredentials(opts = {}) {
   const env = opts.env ?? process.env;
   const groups = await Promise.all([
     Promise.resolve(fromEnv(env)),
-    fromClaudeCode(home),
+    fromClaudeCode(home, env),
     fromCodex(home),
     fromGemini(home),
     fromCopilot(home)
@@ -24843,10 +25652,257 @@ function maskSecret(secret) {
   if (secret.length <= 8) return "\u2022\u2022\u2022\u2022";
   return `${secret.slice(0, 6)}\u2026${secret.slice(-2)}`;
 }
+async function linkCommand(target, options = {}) {
+  const found = await discoverCredentials();
+  if (found.length === 0) {
+    console.log(chalk8.yellow("\n  No reusable credentials found.\n"));
+    console.log(chalk8.gray("  Cascade looks for Claude Code, Codex, Gemini CLI, and GitHub Copilot logins,"));
+    console.log(chalk8.gray("  plus ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY in your environment.\n"));
+    return;
+  }
+  if (!target) {
+    printDiscovered(found);
+    return;
+  }
+  const resolved = normalizeProvider(target);
+  if (!resolved) {
+    const services2 = OPENAI_COMPATIBLE_ENV.map((s) => s.id).join(", ");
+    console.log(chalk8.red(`
+  Unknown provider "${target}".`));
+    console.log(chalk8.gray(`  Use one of: anthropic, openai, gemini, azure, openai-compatible`));
+    console.log(chalk8.gray(`  \u2026or name a compatible service directly: ${services2}
+`));
+    return;
+  }
+  const { provider, serviceId } = resolved;
+  const candidates2 = found.filter((c) => c.provider === provider && (!serviceId || c.serviceId === serviceId));
+  const services = [...new Set(candidates2.map((c) => c.serviceId).filter((id) => !!id))];
+  if (!serviceId && services.length > 1) {
+    console.log(chalk8.yellow(`
+  Keys for several OpenAI-compatible services are set, and "${target}" does not say which.`));
+    console.log(chalk8.gray("  Name the one you mean:\n"));
+    for (const id of services) console.log(chalk8.cyan(`      cascade link ${id}`));
+    console.log("");
+    return;
+  }
+  const chosen = candidates2.find((c) => c.directlyUsable) ?? candidates2[0];
+  if (!chosen) {
+    console.log(chalk8.yellow(`
+  No detected credential maps to "${provider}".
+`));
+    return;
+  }
+  const cm = new ConfigManager(options.workspace ?? process.cwd());
+  await cm.load();
+  const configured = cm.getConfig().providers;
+  const routedByConfig = isRoutedByConfig(chosen, configured);
+  if (!chosen.directlyUsable && !routedByConfig) {
+    console.log(chalk8.yellow(`
+  Found a ${chosen.sourceTool} credential, but it can't be used against the standard ${provider} API.`));
+    if (chosen.warning) console.log(chalk8.gray(`  ${chosen.warning}`));
+    console.log(chalk8.gray("  Cascade won't adopt it because it would create a non-working provider.\n"));
+    if (options.acceptRisk && chosen.kind === "oauth") {
+      console.log(chalk8.gray("  --accept-risk no longer applies \u2014 a subscription token is refused by the"));
+      console.log(chalk8.gray("  provider itself, so there is no working configuration to opt into.\n"));
+    }
+    console.log(chalk8.gray(`  Set ${chalk8.white(envKeyFor(provider))} instead, or add a key with `) + chalk8.cyan("cascade init") + chalk8.gray(".\n"));
+    return;
+  }
+  const adopted = await adoptCredential(chosen, cm);
+  if (!adopted) return;
+  console.log(chalk8.green(`
+  \u2713 Linked ${provider} using your ${chosen.sourceTool} credential (${maskSecret(chosen.secret)}).`));
+  if (chosen.kind === "bearer") {
+    console.log(chalk8.gray("  Adopted as a bearer token \u2014 set `baseUrl` to the gateway that issued it."));
+  }
+  console.log(chalk8.gray("  Run `cascade doctor` to verify, or `cascade` to start.\n"));
+}
+function isRoutedByConfig(cred, configured) {
+  if (cred.provider === "azure") {
+    return configured.some((p) => p.type === "azure" && p.deploymentName?.trim() && p.baseUrl?.trim());
+  }
+  return cred.kind === "bearer" && configured.some((p) => p.type === cred.provider && p.baseUrl?.trim());
+}
+function willAdoptFromConfig(cred, configured) {
+  if (cred.provider === "azure") {
+    const target = cred.baseUrl?.trim();
+    const deployment = cred.deploymentName?.trim();
+    if (target && deployment) return !azureRoutedTarget(deployment, target, configured).collision;
+    return azureDeploymentsForCredential(cred, configured).length > 0;
+  }
+  return cred.directlyUsable || isRoutedByConfig(cred, configured);
+}
+function azureRoutedTarget(deployment, target, configured) {
+  const named = (p) => p.type === "azure" && (p.deploymentName?.trim() ?? "") === deployment;
+  const existing = configured.find((p) => named(p) && (sameAzureEndpoint(p.baseUrl, target) || !p.baseUrl?.trim()));
+  if (existing) return { existing, collision: false };
+  return {
+    collision: configured.some((p) => named(p) && !!p.baseUrl?.trim() && !sameAzureEndpoint(p.baseUrl, target))
+  };
+}
+function azureDeploymentsForCredential(cred, configured) {
+  const routing = resolveAzureRouting(configured, configured, {
+    endpoint: cred.baseUrl,
+    deployment: cred.deploymentName
+  });
+  return routing.ok ? routing.rows : [];
+}
+function azureRoutingForCredential(cred, configured) {
+  return resolveAzureRouting(configured, configured, {
+    endpoint: cred.baseUrl,
+    deployment: cred.deploymentName
+  });
+}
+function printDiscovered(found) {
+  console.log(chalk8.magenta("\n  \u25C8 Detected credentials\n"));
+  for (const c of found) {
+    const usable = c.directlyUsable ? chalk8.green("usable") : chalk8.yellow("needs vendor backend");
+    const kind = c.kind === "oauth" ? chalk8.yellow("subscription") : c.kind === "bearer" ? chalk8.cyan("bearer") : chalk8.gray("api-key");
+    console.log(`  ${chalk8.white(c.provider.padEnd(18))} ${chalk8.gray(maskSecret(c.secret).padEnd(12))} ${kind}  ${usable}`);
+    console.log(chalk8.gray(`    from ${c.sourceTool}`));
+    if (c.warning) console.log(chalk8.yellow(`    \u26A0 ${c.warning}`));
+  }
+  console.log(chalk8.gray("\n  Adopt one with:  ") + chalk8.cyan("cascade link <provider>"));
+  console.log(chalk8.gray("  Subscription tokens are listed for visibility and cannot be adopted.\n"));
+}
+function envKeyFor(provider) {
+  if (provider === "openai") return "OPENAI_API_KEY";
+  if (provider === "gemini") return "GEMINI_API_KEY";
+  if (provider === "anthropic") return "ANTHROPIC_API_KEY";
+  if (provider === "azure") return "AZURE_OPENAI_KEY";
+  return "the provider's API key";
+}
+function normalizeProvider(target) {
+  const t = target.toLowerCase();
+  if (t === "anthropic" || t === "claude" || t === "claude-code") return { provider: "anthropic" };
+  if (t === "openai" || t === "codex" || t === "gpt") return { provider: "openai" };
+  if (t === "gemini" || t === "google") return { provider: "gemini" };
+  if (t === "azure" || t === "azure-openai") return { provider: "azure" };
+  if (t === "openai-compatible" || t === "compatible") return { provider: "openai-compatible" };
+  const service = OPENAI_COMPATIBLE_ENV.find((s) => s.id === t || s.label.toLowerCase() === t);
+  if (service) return { provider: "openai-compatible", serviceId: service.id };
+  return null;
+}
+async function adoptCredential(cred, cm) {
+  const config = cm.getConfig();
+  const azureDeployments = cred.provider === "azure" ? config.providers.filter((p) => p.type === "azure" && p.deploymentName?.trim()) : [];
+  if (azureDeployments.length > 0) {
+    const target = cred.baseUrl?.trim();
+    const deployment = cred.deploymentName?.trim();
+    if (target && deployment) {
+      const { existing: existing2, collision: claimedElsewhere } = azureRoutedTarget(deployment, target, config.providers);
+      if (claimedElsewhere) {
+        console.log(chalk8.yellow(`
+  A different Azure resource already has a deployment named "${deployment}".`));
+        console.log(chalk8.gray("  Deployment names are model ids in Cascade, so two resources cannot share one \u2014"));
+        console.log(chalk8.gray("  the second would never be selected. Rename one deployment, or remove the entry"));
+        console.log(chalk8.gray("  you no longer use, then run this again.\n"));
+        return false;
+      }
+      const patch2 = {
+        apiKey: cred.secret,
+        credentialSource: cred.sourceTool,
+        ...cred.apiVersion ? { apiVersion: cred.apiVersion } : {}
+      };
+      const updated = config.providers.map((p) => {
+        if (p === existing2) return { ...p, baseUrl: target, ...patch2 };
+        const sibling = p.type === "azure" && p.deploymentName?.trim() && sameAzureEndpoint(p.baseUrl, target);
+        return sibling ? { ...p, ...patch2 } : p;
+      });
+      const providers3 = existing2 ? updated : [...updated, {
+        type: "azure",
+        baseUrl: target,
+        deploymentName: deployment,
+        ...patch2
+      }];
+      await cm.updateConfig({ providers: providers3 });
+      return true;
+    }
+    const scoped = azureDeploymentsForCredential(cred, config.providers);
+    if (scoped.length === 0) {
+      const all = [...new Set(azureDeployments.map((p) => normalizeAzureEndpoint(p.baseUrl)))];
+      const onTarget = target ? azureDeployments.some((p) => sameAzureEndpoint(p.baseUrl, target)) : true;
+      const anyRouted = azureDeployments.some((p) => p.baseUrl?.trim());
+      if (!anyRouted) {
+        console.log(chalk8.yellow("\n  The configured Azure deployments have no endpoint."));
+        console.log(chalk8.gray("  A deployment needs its resource URL before a key can reach it \u2014"));
+        console.log(chalk8.gray("  set AZURE_OPENAI_ENDPOINT, or add `baseUrl` to the entries in"));
+        console.log(chalk8.gray("  .cascade/config.json, then run this again.\n"));
+        return false;
+      }
+      if (target && !onTarget) {
+        console.log(chalk8.yellow(`
+  No configured Azure deployment is on ${target}.`));
+        console.log(chalk8.gray("  Set AZURE_OPENAI_DEPLOYMENT as well to add one, or point"));
+        console.log(chalk8.gray("  AZURE_OPENAI_ENDPOINT at a resource you have configured:\n"));
+      } else {
+        console.log(chalk8.yellow("\n  Several Azure resources are configured, and an Azure key belongs to one of them."));
+        console.log(chalk8.gray("  Set AZURE_OPENAI_ENDPOINT to the resource this key is for, then run again:\n"));
+      }
+      for (const r of all) console.log(chalk8.gray(`      ${r || "(no endpoint set)"}`));
+      console.log("");
+      return false;
+    }
+    const patch = {
+      apiKey: cred.secret,
+      credentialSource: cred.sourceTool,
+      ...cred.apiVersion ? { apiVersion: cred.apiVersion } : {}
+    };
+    const providers2 = config.providers.map((p) => scoped.includes(p) ? { ...p, ...patch } : p);
+    const routing = azureRoutingForCredential(cred, config.providers);
+    if (routing.ok && routing.createDeployment) {
+      providers2.push({
+        type: "azure",
+        deploymentName: routing.createDeployment,
+        baseUrl: routing.resource,
+        ...patch
+      });
+      console.log(chalk8.gray(
+        `  Added deployment "${routing.createDeployment}" on ${normalizeAzureEndpoint(routing.resource)}.`
+      ));
+    }
+    await cm.updateConfig({ providers: providers2 });
+    return true;
+  }
+  const existing = config.providers.find((p) => p.type === cred.provider);
+  const next = {
+    ...existing,
+    type: cred.provider,
+    credentialSource: cred.sourceTool,
+    // Both cleared first: adopting a credential REPLACES the old one, and
+    // leaving a stale key beside a new token makes which one is in use depend
+    // on provider-internal precedence.
+    apiKey: void 0,
+    authToken: void 0
+  };
+  if (cred.kind === "bearer") {
+    next.authToken = cred.secret;
+  } else {
+    next.apiKey = cred.secret;
+  }
+  if (cred.kind !== "bearer" && !cred.baseUrl && hasDefaultEndpoint(cred.provider) && next.baseUrl) {
+    delete next.baseUrl;
+    delete next.local;
+  }
+  if (cred.baseUrl) {
+    next.baseUrl = cred.baseUrl;
+    delete next.local;
+  }
+  if (cred.deploymentName) next.deploymentName = cred.deploymentName;
+  if (cred.apiVersion) next.apiVersion = cred.apiVersion;
+  const providers = config.providers.filter((p) => p.type !== cred.provider);
+  providers.push(next);
+  await cm.updateConfig({ providers });
+  return true;
+}
 
 // src/cli/commands/doctor.ts
+function linkableCredentialsDetail(discovered, configured = []) {
+  const usable = discovered.filter((d) => willAdoptFromConfig(d, configured)).length;
+  return usable > 0 ? `${discovered.length} found (${usable} usable) \u2014 run \`cascade link\` to adopt` : `${discovered.length} found, none usable \u2014 run \`cascade link\` to see why`;
+}
 async function doctorCommand() {
-  console.log(chalk7.magenta("\n  \u25C8 Cascade Doctor \u2014 System Diagnostics\n"));
+  console.log(chalk8.magenta("\n  \u25C8 Cascade Doctor \u2014 System Diagnostics\n"));
   const checks = [];
   const nodeVersion = process.versions.node;
   const [major] = nodeVersion.split(".").map(Number);
@@ -24861,7 +25917,7 @@ async function doctorCommand() {
   checks.push({
     label: "Cascade config",
     ok: true,
-    detail: `Loaded ${path34.join(process.cwd(), CASCADE_CONFIG_FILE)}`
+    detail: `Loaded ${path35.join(process.cwd(), CASCADE_CONFIG_FILE)}`
   });
   const providers = [
     { type: "anthropic", name: "Anthropic" },
@@ -24871,10 +25927,11 @@ async function doctorCommand() {
   ];
   for (const { type, name } of providers) {
     const key = cm.getApiKey(type);
+    const token = key ? void 0 : cm.getAuthToken(type);
     checks.push({
-      label: `${name} API key`,
-      ok: Boolean(key),
-      detail: key ? "Set" : "Missing"
+      label: `${name} credential`,
+      ok: Boolean(key || token),
+      detail: key ? "API key set" : token ? "Bearer token set" : "Missing"
     });
   }
   const ollamaOk = await checkEndpoint(OLLAMA_BASE_URL + "/api/tags");
@@ -24928,32 +25985,31 @@ async function doctorCommand() {
   try {
     const discovered = await discoverCredentials();
     if (discovered.length > 0) {
-      const usable = discovered.filter((d) => d.directlyUsable).length;
       checks.push({
         label: "Linkable credentials",
         ok: true,
-        detail: `${discovered.length} found (${usable} usable) \u2014 run \`cascade link\` to adopt`
+        detail: linkableCredentialsDetail(discovered, config.providers ?? [])
       });
     }
   } catch {
   }
   for (const c of checks) {
-    const icon = c.ok ? chalk7.green("  \u2713") : chalk7.yellow("  \u25CB");
-    const label = c.ok ? chalk7.white(c.label) : chalk7.gray(c.label);
-    const detail = c.detail ? chalk7.gray(` \u2014 ${c.detail}`) : "";
+    const icon = c.ok ? chalk8.green("  \u2713") : chalk8.yellow("  \u25CB");
+    const label = c.ok ? chalk8.white(c.label) : chalk8.gray(c.label);
+    const detail = c.detail ? chalk8.gray(` \u2014 ${c.detail}`) : "";
     console.log(`${icon}  ${label}${detail}`);
   }
   const failures2 = checks.filter((c) => !c.ok);
   console.log();
   if (failures2.length === 0) {
-    console.log(chalk7.green("  All checks passed!\n"));
+    console.log(chalk8.green("  All checks passed!\n"));
   } else {
-    const critical = failures2.filter((c) => c.label.includes("Node") || c.label.includes("API key"));
+    const critical = failures2.filter((c) => c.label.includes("Node") || c.label.includes("credential"));
     if (critical.length) {
-      console.log(chalk7.yellow(`  ${critical.length} issue(s) need attention.
+      console.log(chalk8.yellow(`  ${critical.length} issue(s) need attention.
 `));
     } else {
-      console.log(chalk7.gray(`  ${failures2.length} optional item(s) not configured.
+      console.log(chalk8.gray(`  ${failures2.length} optional item(s) not configured.
 `));
     }
   }
@@ -24971,19 +26027,19 @@ async function checkEndpoint(url) {
   }
 }
 async function indexCommand(dirPath) {
-  const workspace = path34.resolve(dirPath || process.cwd());
+  const workspace = path35.resolve(dirPath || process.cwd());
   const cm = new ConfigManager(workspace);
   await cm.load();
   const config = cm.getConfig();
   const embedder = embedderFromProviders(config.providers);
   if (!embedder) {
-    console.log(chalk7.red("\n  No embeddings-capable provider configured."));
-    console.log(chalk7.dim("  Add an OpenAI, OpenAI-compatible, or Ollama key, then re-run `cascade index`.\n"));
+    console.log(chalk8.red("\n  No embeddings-capable provider configured."));
+    console.log(chalk8.dim("  Add an OpenAI, OpenAI-compatible, or Ollama key, then re-run `cascade index`.\n"));
     process.exitCode = 1;
     return;
   }
-  const dbPath = config.codeIndex?.dbPath || path34.join(workspace, ".cascade", "code-index.db");
-  fs31.mkdirSync(path34.dirname(dbPath), { recursive: true });
+  const dbPath = config.codeIndex?.dbPath || path35.join(workspace, ".cascade", "code-index.db");
+  fs32.mkdirSync(path35.dirname(dbPath), { recursive: true });
   const db = new Database2(dbPath);
   db.pragma("journal_mode = WAL");
   const complete = chatCompleterFromProviders(config.providers);
@@ -24997,20 +26053,20 @@ async function indexCommand(dirPath) {
     reranker,
     isIgnored: (abs) => ignore4.isIgnored(abs, workspace)
   });
-  console.log(chalk7.magenta(`
+  console.log(chalk8.magenta(`
   \u25C8 Indexing ${workspace}
 `));
   let seen = 0;
   const res = await index.refresh(() => {
     seen++;
-    if (seen % 10 === 0) process.stdout.write(chalk7.dim(`  \u2026embedded ${seen} changed files\r`));
+    if (seen % 10 === 0) process.stdout.write(chalk8.dim(`  \u2026embedded ${seen} changed files\r`));
   });
   console.log(
-    chalk7.green(`  \u2713 ${res.filesIndexed} file(s) indexed`) + chalk7.dim(` \xB7 ${res.chunks} chunks \xB7 ${res.filesUnchanged} unchanged \xB7 ${res.filesRemoved} removed`)
+    chalk8.green(`  \u2713 ${res.filesIndexed} file(s) indexed`) + chalk8.dim(` \xB7 ${res.chunks} chunks \xB7 ${res.filesUnchanged} unchanged \xB7 ${res.filesRemoved} removed`)
   );
-  console.log(chalk7.dim(`  Index: ${dbPath}`));
+  console.log(chalk8.dim(`  Index: ${dbPath}`));
   if (!config.codeIndex?.enabled) {
-    console.log(chalk7.dim("  Tip: set codeIndex.enabled = true in your config to give runs the code_search tool."));
+    console.log(chalk8.dim("  Tip: set codeIndex.enabled = true in your config to give runs the code_search tool."));
   }
   console.log("");
   db.close();
@@ -25059,6 +26115,7 @@ async function decryptJSON(blob, passphrase) {
 }
 
 // src/cloud/keysync.ts
+init_revoked_credentials();
 function providerSig(p) {
   return [p.type, p.baseUrl ?? "", p.deploymentName ?? "", p.label ?? ""].join("\0");
 }
@@ -25131,6 +26188,19 @@ function gatherSyncBundle(config) {
 function applySyncBundle(bundle, config, cleanup) {
   const dropped = stripRetiredProviders(bundle);
   if (cleanup) cleanup.removed = dropped.removed;
+  let revokedFromBundle = 0;
+  let unusableFromBundle = 0;
+  if (Array.isArray(bundle.providers)) {
+    const pass = stripRevokedCredentials(bundle.providers, { keepForEndpoint: false });
+    revokedFromBundle = pass.removed;
+    if (pass.removed > 0) bundle.providers = pass.kept;
+    const usable = bundle.providers.filter((p) => {
+      const orphanBearer = Boolean(p.authToken) && !p.apiKey && !p.baseUrl;
+      if (orphanBearer) unusableFromBundle++;
+      return !orphanBearer;
+    });
+    if (unusableFromBundle > 0) bundle.providers = usable;
+  }
   const next = { ...config, tools: { ...config.tools } };
   if (bundle.providers) next.providers = mergeByKey(config.providers, bundle.providers, providerSig) ?? [];
   if (bundle.webSearch) next.tools.webSearch = { ...config.tools?.webSearch, ...bundle.webSearch };
@@ -25148,10 +26218,15 @@ function applySyncBundle(bundle, config, cleanup) {
   if (bundle.budget) next.budget = { ...config.budget, ...bundle.budget };
   const merged = { ...next.models };
   const clearedFromMerge = clearRetiredPins(merged);
-  if (clearedFromMerge.length > 0) next.models = merged;
+  const clearedRevoked = revokedFromBundle > 0 && !hasUsableAnthropic(next.providers ?? []) ? clearAnthropicPins(merged, next.providers ?? []) : [];
+  if (clearedFromMerge.length > 0 || clearedRevoked.length > 0) {
+    next.models = merged;
+  }
   if (cleanup) {
+    cleanup.revokedCredentials = revokedFromBundle;
+    cleanup.unusableCredentials = unusableFromBundle;
     cleanup.clearedPins = ["t1", "t2", "t3"].filter(
-      (t) => (dropped.clearedPins.includes(t) || clearedFromMerge.includes(t)) && next.models?.[t] === void 0
+      (t) => (dropped.clearedPins.includes(t) || clearedFromMerge.includes(t) || clearedRevoked.some((c) => c.tier === t)) && next.models?.[t] === void 0
     );
   }
   if (bundle.prefs) {
@@ -25177,43 +26252,43 @@ function openBrowser(url) {
   }
 }
 function notSignedIn() {
-  console.log(chalk7.dim("\n  Not signed in. Run `cascade login` first.\n"));
+  console.log(chalk8.dim("\n  Not signed in. Run `cascade login` first.\n"));
   process.exitCode = 1;
 }
 function promptHidden(question) {
   return new Promise((resolve2) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-    let masked = false;
+    let masked2 = false;
     rl._writeToOutput = (s) => {
-      if (!masked || !process.stdin.isTTY) process.stdout.write(s);
+      if (!masked2 || !process.stdin.isTTY) process.stdout.write(s);
     };
     rl.question(question, (answer) => {
       rl.close();
       process.stdout.write("\n");
       resolve2(answer.trim());
     });
-    masked = true;
+    masked2 = true;
   });
 }
 async function loginCommand(opts = {}) {
   const serverUrl = resolveServerUrl(opts.server);
   const client = new CloudClient(serverUrl);
-  console.log(chalk7.magenta("\n  \u25C8 Sign in to Cascade Cloud"));
-  console.log(chalk7.dim(`  ${serverUrl}
+  console.log(chalk8.magenta("\n  \u25C8 Sign in to Cascade Cloud"));
+  console.log(chalk8.dim(`  ${serverUrl}
 `));
   try {
     const session = await client.runDeviceLogin((d) => {
-      console.log(`  1. Open   ${chalk7.cyan(d.verificationUri)}`);
-      console.log(`  2. Enter  ${chalk7.bold.yellow(d.userCode)}`);
-      console.log(chalk7.dim("\n  Waiting for you to approve\u2026"));
+      console.log(`  1. Open   ${chalk8.cyan(d.verificationUri)}`);
+      console.log(`  2. Enter  ${chalk8.bold.yellow(d.userCode)}`);
+      console.log(chalk8.dim("\n  Waiting for you to approve\u2026"));
       openBrowser(`${d.verificationUri}?code=${encodeURIComponent(d.userCode)}`);
     });
     const who = session.user.name || session.user.email || session.user.id;
-    console.log(chalk7.green(`
+    console.log(chalk8.green(`
   \u2713 Signed in as ${who}
 `));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25222,11 +26297,11 @@ async function loginCommand(opts = {}) {
 async function logoutCommand() {
   const client = CloudClient.fromSession();
   if (!client) {
-    console.log(chalk7.dim("\n  Not signed in.\n"));
+    console.log(chalk8.dim("\n  Not signed in.\n"));
     return;
   }
   await client.logout();
-  console.log(chalk7.green("\n  \u2713 Signed out.\n"));
+  console.log(chalk8.green("\n  \u2713 Signed out.\n"));
 }
 async function whoamiCommand() {
   const client = CloudClient.fromSession();
@@ -25234,10 +26309,10 @@ async function whoamiCommand() {
   try {
     const me = await client.me();
     console.log(`
-  ${chalk7.bold(me.name || "\u2014")}  ${chalk7.dim(me.email || "")}${me.plan ? chalk7.dim(`  \xB7 ${me.plan}`) : ""}
+  ${chalk8.bold(me.name || "\u2014")}  ${chalk8.dim(me.email || "")}${me.plan ? chalk8.dim(`  \xB7 ${me.plan}`) : ""}
 `);
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25249,16 +26324,16 @@ async function sessionsCommand() {
   try {
     const convos = await client.listConversations();
     if (convos.length === 0) {
-      console.log(chalk7.dim("\n  No cloud chats yet.\n"));
+      console.log(chalk8.dim("\n  No cloud chats yet.\n"));
       return;
     }
-    console.log(chalk7.magenta("\n  \u25C8 Your cloud chats\n"));
+    console.log(chalk8.magenta("\n  \u25C8 Your cloud chats\n"));
     for (const c of convos) {
-      console.log(`  ${chalk7.dim(c.id.slice(0, 8))}  ${c.title?.trim() || chalk7.dim("(untitled)")}`);
+      console.log(`  ${chalk8.dim(c.id.slice(0, 8))}  ${c.title?.trim() || chalk8.dim("(untitled)")}`);
     }
-    console.log(chalk7.dim("\n  cascade sessions show <id>   read a chat (id or its first characters)\n"));
+    console.log(chalk8.dim("\n  cascade sessions show <id>   read a chat (id or its first characters)\n"));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25272,9 +26347,9 @@ function formatCloudTranscript(messages) {
   for (const m of messages) {
     const n = m.siblingIds?.length ?? 1;
     const i = m.siblingIds && m.id ? m.siblingIds.indexOf(m.id) + 1 : 1;
-    const branch = n > 1 ? chalk7.yellow(` \u2039${i}/${n}\u203A`) : "";
-    const tag = m.id ? chalk7.dim(` [${shortId2(m.id)}]`) : "";
-    const who = m.role === "user" ? chalk7.bold.cyan("You") : chalk7.bold.magenta("Cascade");
+    const branch = n > 1 ? chalk8.yellow(` \u2039${i}/${n}\u203A`) : "";
+    const tag = m.id ? chalk8.dim(` [${shortId2(m.id)}]`) : "";
+    const who = m.role === "user" ? chalk8.bold.cyan("You") : chalk8.bold.magenta("Cascade");
     lines.push(`  ${who}${tag}${branch}`);
     lines.push("  " + m.content.replace(/\n/g, "\n  ") + "\n");
   }
@@ -25290,23 +26365,23 @@ async function sessionShowCommand(idOrPrefix) {
   try {
     const match = await resolveConversation(client, idOrPrefix);
     if (!match) {
-      console.log(chalk7.red(`
+      console.log(chalk8.red(`
   No chat matching "${idOrPrefix}".
 `));
       process.exitCode = 1;
       return;
     }
     const msgs = await client.getMessages(match.id);
-    console.log(chalk7.magenta(`
+    console.log(chalk8.magenta(`
   \u25C8 ${match.title?.trim() || "(untitled)"}
 `));
     console.log(formatCloudTranscript(msgs));
     if (msgs.some((m) => (m.siblingIds?.length ?? 1) > 1)) {
-      console.log(chalk7.dim("  cascade sessions branch <chat> <message>   switch to another version"));
+      console.log(chalk8.dim("  cascade sessions branch <chat> <message>   switch to another version"));
     }
-    console.log(chalk7.dim("  cascade sessions rm <chat> <message>       delete a message + its replies\n"));
+    console.log(chalk8.dim("  cascade sessions rm <chat> <message>       delete a message + its replies\n"));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25321,7 +26396,7 @@ async function sessionBranchCommand(chat, message) {
   try {
     const match = await resolveConversation(client, chat);
     if (!match) {
-      console.log(chalk7.red(`
+      console.log(chalk8.red(`
   No chat matching "${chat}".
 `));
       process.exitCode = 1;
@@ -25330,12 +26405,12 @@ async function sessionBranchCommand(chat, message) {
     const active = await client.getMessages(match.id);
     const targetId = resolveMessage(active, message) ?? message;
     const next = await client.selectBranch(match.id, targetId);
-    console.log(chalk7.magenta(`
+    console.log(chalk8.magenta(`
   \u25C8 Switched branch \u2014 ${match.title?.trim() || "(untitled)"}
 `));
     console.log(formatCloudTranscript(next));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25347,7 +26422,7 @@ async function sessionRemoveMessageCommand(chat, message) {
   try {
     const match = await resolveConversation(client, chat);
     if (!match) {
-      console.log(chalk7.red(`
+      console.log(chalk8.red(`
   No chat matching "${chat}".
 `));
       process.exitCode = 1;
@@ -25356,11 +26431,11 @@ async function sessionRemoveMessageCommand(chat, message) {
     const active = await client.getMessages(match.id);
     const targetId = resolveMessage(active, message) ?? message;
     const next = await client.deleteMessage(match.id, targetId);
-    console.log(chalk7.green("\n  \u2713 Deleted that message and its replies.\n"));
+    console.log(chalk8.green("\n  \u2713 Deleted that message and its replies.\n"));
     if (next.length) console.log(formatCloudTranscript(next));
-    else console.log(chalk7.dim("  (the conversation is now empty)\n"));
+    else console.log(chalk8.dim("  (the conversation is now empty)\n"));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25372,18 +26447,18 @@ async function sessionRenameCommand(chat, title) {
   try {
     const match = await resolveConversation(client, chat);
     if (!match) {
-      console.log(chalk7.red(`
+      console.log(chalk8.red(`
   No chat matching "${chat}".
 `));
       process.exitCode = 1;
       return;
     }
     await client.renameConversation(match.id, title);
-    console.log(chalk7.green(`
+    console.log(chalk8.green(`
   \u2713 Renamed to "${title}".
 `));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25395,18 +26470,18 @@ async function sessionDeleteCommand(chat) {
   try {
     const match = await resolveConversation(client, chat);
     if (!match) {
-      console.log(chalk7.red(`
+      console.log(chalk8.red(`
   No chat matching "${chat}".
 `));
       process.exitCode = 1;
       return;
     }
     await client.deleteConversation(match.id);
-    console.log(chalk7.green(`
+    console.log(chalk8.green(`
   \u2713 Deleted "${match.title?.trim() || "(untitled)"}".
 `));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25418,21 +26493,21 @@ async function syncPushCommand() {
   const cm = new ConfigManager(process.cwd());
   await cm.load();
   const bundle = gatherSyncBundle(cm.getConfig());
-  console.log(chalk7.magenta("\n  \u25C8 Sync your settings to your account"));
-  console.log(chalk7.dim("  Encrypted on this device with a passphrase we never see.\n"));
+  console.log(chalk8.magenta("\n  \u25C8 Sync your settings to your account"));
+  console.log(chalk8.dim("  Encrypted on this device with a passphrase we never see.\n"));
   const pass = await promptHidden("  Passphrase: ");
   if (!pass) {
-    console.log(chalk7.dim("\n  Cancelled.\n"));
+    console.log(chalk8.dim("\n  Cancelled.\n"));
     return;
   }
   try {
     const blob = await encryptJSON(bundle, pass);
     const r = await client.pushSecrets(blob);
-    console.log(chalk7.green(`
+    console.log(chalk8.green(`
   \u2713 Synced (v${r.version}). Run \`cascade sync pull\` on another device.
 `));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25445,27 +26520,27 @@ async function syncPullCommand() {
   try {
     ({ blob } = await client.pullSecrets());
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
     return;
   }
   if (!blob) {
-    console.log(chalk7.dim("\n  Nothing synced to your account yet. Run `cascade sync push` first.\n"));
+    console.log(chalk8.dim("\n  Nothing synced to your account yet. Run `cascade sync push` first.\n"));
     return;
   }
-  console.log(chalk7.magenta("\n  \u25C8 Apply your synced settings to this device\n"));
+  console.log(chalk8.magenta("\n  \u25C8 Apply your synced settings to this device\n"));
   const pass = await promptHidden("  Passphrase: ");
   if (!pass) {
-    console.log(chalk7.dim("\n  Cancelled.\n"));
+    console.log(chalk8.dim("\n  Cancelled.\n"));
     return;
   }
   let bundle;
   try {
     bundle = await decryptJSON(blob, pass);
   } catch {
-    console.log(chalk7.red("\n  Could not decrypt \u2014 check your passphrase and try again.\n"));
+    console.log(chalk8.red("\n  Could not decrypt \u2014 check your passphrase and try again.\n"));
     process.exitCode = 1;
     return;
   }
@@ -25474,13 +26549,13 @@ async function syncPullCommand() {
     await cm.load();
     const cleanup = { removed: [], clearedPins: [] };
     await cm.updateConfig(applySyncBundle(bundle, cm.getConfig(), cleanup));
-    console.log(chalk7.green("\n  \u2713 Applied your synced settings. Your keys are ready here.\n"));
+    console.log(chalk8.green("\n  \u2713 Applied your synced settings. Your keys are ready here.\n"));
     if (didCleanupChangeAnything(cleanup)) {
-      console.log(chalk7.yellow(`  ${describeCleanup(cleanup)}
+      console.log(chalk8.yellow(`  ${describeCleanup(cleanup)}
 `));
     }
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   Could not apply your synced settings: ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25496,7 +26571,7 @@ function openBrowser2(url) {
 }
 function storePathFor(name) {
   const safe = name.replace(/[^a-z0-9._-]/gi, "_").slice(0, 64) || "server";
-  return path34.join(os10.homedir(), ".cascade-ai", "mcp-oauth", `${safe}.json`);
+  return path35.join(os10.homedir(), ".cascade-ai", "mcp-oauth", `${safe}.json`);
 }
 function defaultName(url) {
   try {
@@ -25507,8 +26582,8 @@ function defaultName(url) {
 }
 async function mcpConnectCommand(url, opts = {}) {
   const desiredName = opts.name?.trim() || defaultName(url);
-  console.log(chalk7.magenta("\n  \u25C8 Connect an MCP server via OAuth"));
-  console.log(chalk7.dim(`  ${url}
+  console.log(chalk8.magenta("\n  \u25C8 Connect an MCP server via OAuth"));
+  console.log(chalk8.dim(`  ${url}
 `));
   try {
     const cm = new ConfigManager(process.cwd());
@@ -25524,7 +26599,7 @@ async function mcpConnectCommand(url, opts = {}) {
       store,
       clientName: "Cascade AI",
       openUrl: (u) => {
-        console.log(chalk7.dim("  Opening your browser to authorize\u2026"));
+        console.log(chalk8.dim("  Opening your browser to authorize\u2026"));
         openBrowser2(u);
       }
     });
@@ -25534,11 +26609,11 @@ async function mcpConnectCommand(url, opts = {}) {
     config.tools.mcpServers = servers;
     config.tools.mcpTrusted = Array.from(/* @__PURE__ */ new Set([...config.tools.mcpTrusted ?? [], name]));
     await cm.updateConfig(config);
-    console.log(chalk7.green(`
+    console.log(chalk8.green(`
   \u2713 Connected "${name}". Its tools are available to your runs.
 `));
   } catch (err) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   ${err instanceof Error ? err.message : String(err)}
 `));
     process.exitCode = 1;
@@ -25549,13 +26624,13 @@ async function mcpListCommand() {
   await cm.load();
   const servers = cm.getConfig().tools?.mcpServers ?? [];
   if (!servers.length) {
-    console.log(chalk7.dim("\n  No MCP servers configured.\n"));
+    console.log(chalk8.dim("\n  No MCP servers configured.\n"));
     return;
   }
-  console.log(chalk7.magenta("\n  \u25C8 MCP servers\n"));
+  console.log(chalk8.magenta("\n  \u25C8 MCP servers\n"));
   for (const s of servers) {
-    const kind = s.oauthStore ? chalk7.green("oauth") : s.headers ? chalk7.cyan("token") : s.command ? chalk7.dim("local") : chalk7.dim("open");
-    console.log(`  ${chalk7.bold(s.name)}  ${chalk7.dim(s.url || s.command || "")}  ${kind}`);
+    const kind = s.oauthStore ? chalk8.green("oauth") : s.headers ? chalk8.cyan("token") : s.command ? chalk8.dim("local") : chalk8.dim("open");
+    console.log(`  ${chalk8.bold(s.name)}  ${chalk8.dim(s.url || s.command || "")}  ${kind}`);
   }
   console.log();
 }
@@ -25566,7 +26641,7 @@ async function mcpRemoveCommand(name) {
   const servers = config.tools?.mcpServers ?? [];
   const match = servers.find((s) => s.name === name);
   if (!match) {
-    console.log(chalk7.red(`
+    console.log(chalk8.red(`
   No MCP server named "${name}".
 `));
     process.exitCode = 1;
@@ -25582,7 +26657,7 @@ async function mcpRemoveCommand(name) {
     }
   }
   await cm.updateConfig(config);
-  console.log(chalk7.green(`
+  console.log(chalk8.green(`
   \u2713 Removed "${name}".
 `));
 }
@@ -25596,16 +26671,302 @@ async function updateCommand() {
     const { stdout } = await execAsync2("npm show cascade-ai version", { timeout: 1e4 });
     const latest = stdout.trim().split("\n").filter(Boolean).pop() ?? "";
     if (latest === CASCADE_VERSION) {
-      spin.succeed(chalk7.green(`Already up to date (v${CASCADE_VERSION})`));
+      spin.succeed(chalk8.green(`Already up to date (v${CASCADE_VERSION})`));
       return;
     }
     spin.text = `Updating cascade-ai ${CASCADE_VERSION} \u2192 ${latest}\u2026`;
     await execAsync2("npm install -g cascade-ai@latest", { timeout: 6e4 });
-    spin.succeed(chalk7.green(`Updated to v${latest}! Restart your terminal.`));
+    spin.succeed(chalk8.green(`Updated to v${latest}! Restart your terminal.`));
   } catch (err) {
-    spin.fail(chalk7.red(`Update failed: ${err instanceof Error ? err.message : String(err)}`));
+    spin.fail(chalk8.red(`Update failed: ${err instanceof Error ? err.message : String(err)}`));
+  }
+}
+
+// src/config/credential-write.ts
+function endpointFromSettingsPayload(endpoints, type) {
+  if (!endpoints || !Object.hasOwn(endpoints, type)) return { kind: "preserve" };
+  const baseUrl = endpoints[type]?.trim();
+  return baseUrl ? { kind: "at", baseUrl } : { kind: "cleared" };
+}
+function targetEndpoint(endpoint, existing) {
+  switch (endpoint.kind) {
+    case "at":
+      return endpoint.baseUrl;
+    // An explicit clear, always. Whether the row then falls back to a public
+    // host or becomes unroutable is the provider's business, decided before we
+    // get here.
+    case "cleared":
+      return void 0;
+    case "preserve":
+      return existing?.baseUrl;
   }
 }
+function namesCustomHost(row) {
+  if (!row?.baseUrl) return false;
+  return !sameCredentialEndpoint(row.type, row.baseUrl, void 0);
+}
+function applyProviderCredential(providers, type, apiKey, endpoint) {
+  const existing = providers.find((p) => p.type === type);
+  if (endpoint.kind === "cleared" && !hasDefaultEndpoint(type)) {
+    if (existing) {
+      existing.baseUrl = void 0;
+      existing.apiKey = void 0;
+      existing.authToken = void 0;
+      delete existing.local;
+    }
+    return { written: false, reason: "unroutable" };
+  }
+  if (endpoint.kind === "preserve" && namesCustomHost(existing)) {
+    return { written: false, reason: "ambiguous-scope" };
+  }
+  const nextBaseUrl = targetEndpoint(endpoint, existing);
+  if (existing && !sameCredentialEndpoint(type, existing.baseUrl, nextBaseUrl)) {
+    delete existing.local;
+  }
+  if (existing && nextBaseUrl === void 0) existing.baseUrl = void 0;
+  applyProviderApiKey(providers, type, apiKey, nextBaseUrl ? { baseUrl: nextBaseUrl } : {});
+  return { written: true };
+}
+function credentialDispositionForEdit(existing, nextBaseUrl, replacementKey) {
+  if (replacementKey) return "replaced";
+  return sameCredentialEndpoint(existing.type, existing.baseUrl, nextBaseUrl) ? "keep" : "clear";
+}
+function applyEndpointEdit(existing, nextBaseUrl, replacementKey) {
+  if (credentialDispositionForEdit(existing, nextBaseUrl, replacementKey) === "clear") {
+    existing.apiKey = void 0;
+    existing.authToken = void 0;
+  }
+  if (!sameCredentialEndpoint(existing.type, existing.baseUrl, nextBaseUrl)) {
+    delete existing.local;
+  }
+  existing.baseUrl = nextBaseUrl || void 0;
+}
+function explainRefusal(type, reason) {
+  return reason === "unroutable" ? `The ${type} key was not saved: its endpoint was cleared, and ${type} has no default host, so there is nowhere the key could be sent. Enter the endpoint URL alongside the key.` : `The ${type} key was not saved: this provider is configured with a custom endpoint, and Cascade cannot tell whether the new key was issued by that endpoint or by the provider directly. Set the endpoint field alongside the key \u2014 clear it if the key is for the provider itself.`;
+}
+function applySettingsCredentials(providers, data) {
+  const refused = [];
+  if (data.keys) {
+    for (const [type, apiKey] of Object.entries(data.keys)) {
+      if (!apiKey) continue;
+      const outcome = applyProviderCredential(
+        providers,
+        type,
+        apiKey,
+        endpointFromSettingsPayload(data.endpoints, type)
+      );
+      if (!outcome.written) refused.push({ type, reason: outcome.reason });
+    }
+  }
+  if (!data.endpoints) return { refused };
+  for (const [type, baseUrl] of Object.entries(data.endpoints)) {
+    if (type === "azure") continue;
+    if (!Object.hasOwn(data.endpoints, type)) continue;
+    const existing = providers.find((p) => p.type === type);
+    if (!existing) {
+      if (baseUrl) providers.push({ type, baseUrl });
+      continue;
+    }
+    applyEndpointEdit(existing, baseUrl, data.keys?.[type]);
+  }
+  return { refused };
+}
+
+// src/config/settings-payload.ts
+function priorAzureRow(prior, incoming) {
+  if (!incoming.deploymentName) return void 0;
+  return prior.find((p) => p.deploymentName === incoming.deploymentName && sameAzureEndpoint(p.baseUrl, incoming.baseUrl));
+}
+function applySettingsPayload(config, data) {
+  if (!Array.isArray(config.providers)) config.providers = [];
+  const result = applySettingsCredentials(config.providers, data);
+  if (Array.isArray(data.azureDeployments)) {
+    const priorAzure = config.providers.filter((p) => p.type === "azure");
+    const nonAzure = config.providers.filter((p) => p.type !== "azure");
+    const nextAzure = data.azureDeployments.map((d) => {
+      const prior = priorAzureRow(priorAzure, d);
+      const apiKey = d.apiKey ? d.apiKey : prior?.apiKey;
+      const model = d.model ?? prior?.model;
+      const region = d.region ?? prior?.region;
+      return {
+        type: "azure",
+        ...d.label ? { label: d.label } : {},
+        ...d.baseUrl ? { baseUrl: d.baseUrl } : {},
+        ...d.deploymentName ? { deploymentName: d.deploymentName } : {},
+        ...d.apiVersion ? { apiVersion: d.apiVersion } : {},
+        ...apiKey ? { apiKey } : {},
+        ...model ? { model } : {},
+        ...region ? { region } : {}
+      };
+    }).filter((d) => d.apiKey || d.baseUrl || d.deploymentName);
+    config.providers = [...nonAzure, ...nextAzure];
+  }
+  if (data.models) {
+    const models = config.models ?? {};
+    for (const [tier, val] of Object.entries(data.models)) {
+      if (val && val !== "auto") models[tier] = val;
+      else delete models[tier];
+    }
+    config.models = models;
+  }
+  if (data.budget) {
+    const b = data.budget;
+    config.budget = config.budget ?? {};
+    const cap = (key, target, accept, round = false) => {
+      if (!Object.hasOwn(b, key)) return;
+      const v = b[key];
+      if (typeof v === "number" && accept(v)) config.budget[target] = round ? Math.floor(v) : v;
+      else delete config.budget[target];
+    };
+    cap("maxCostPerRun", "maxCostPerRunUsd", (n) => n > 0);
+    cap("dailyBudgetUsd", "dailyBudgetUsd", (n) => n > 0);
+    cap("sessionBudgetUsd", "sessionBudgetUsd", (n) => n > 0);
+    cap("maxTokensPerRun", "maxTokensPerRun", (n) => n > 0, true);
+    cap("warnAtPct", "warnAtPct", (n) => n > 0 && n <= 100);
+    if (b.autoBias === "balanced" || b.autoBias === "quality" || b.autoBias === "cost") {
+      config.autoBias = b.autoBias;
+    }
+  }
+  if (data.webSearch && typeof data.webSearch === "object") {
+    config.tools = config.tools ?? {};
+    const prior = config.tools.webSearch ?? {};
+    const next = { ...prior };
+    if (typeof data.webSearch.searxngUrl === "string") next.searxngUrl = data.webSearch.searxngUrl.trim() || void 0;
+    if (data.webSearch.braveApiKey) next.braveApiKey = data.webSearch.braveApiKey;
+    if (data.webSearch.tavilyApiKey) next.tavilyApiKey = data.webSearch.tavilyApiKey;
+    config.tools.webSearch = next;
+  }
+  if (data.advanced && typeof data.advanced === "object") {
+    const a = data.advanced;
+    const num = (v, min, max) => {
+      const n = Number(v);
+      return Number.isFinite(n) && n >= min && n <= max ? n : void 0;
+    };
+    if (a["autonomy"] === "manual" || a["autonomy"] === "auto") config.autonomy = a["autonomy"];
+    if (["never", "complex", "all", "always"].includes(a["planApproval"])) config.planApproval = a["planApproval"];
+    {
+      const n = num(a["approvalTimeoutMs"], 1e3, 864e5);
+      if (n !== void 0) config.approvalTimeoutMs = Math.floor(n);
+    }
+    if (["auto", "parallel", "sequential"].includes(a["t3Execution"])) config.t3Execution = a["t3Execution"];
+    {
+      const n = num(a["localConcurrency"], 1, 16);
+      if (n !== void 0) config.localConcurrency = Math.floor(n);
+    }
+    {
+      const n = num(a["localInferenceTimeoutMs"], 1e3, 36e5);
+      if (n !== void 0) config.localInferenceTimeoutMs = Math.floor(n);
+    }
+    {
+      const n = num(a["cloudInferenceTimeoutMs"], 1e3, 36e5);
+      if (n !== void 0) config.cloudInferenceTimeoutMs = Math.floor(n);
+    }
+    if (typeof a["reflectionEnabled"] === "boolean") config.reflection = { ...config.reflection ?? {}, enabled: a["reflectionEnabled"] };
+    if (typeof a["cascadeAuto"] === "boolean") config.cascadeAuto = a["cascadeAuto"];
+    if (["auto", "T1", "T2", "T3"].includes(a["forceTier"])) config.routing = { ...config.routing ?? {}, forceTier: a["forceTier"] };
+    if (typeof a["benchmarksLive"] === "boolean") config.benchmarks = { ...config.benchmarks ?? {}, live: a["benchmarksLive"] };
+    if (["isolate", "worker", "auto"].includes(a["dynamicToolSandbox"])) config.tools = { ...config.tools ?? {}, dynamicToolSandbox: a["dynamicToolSandbox"] };
+    if (typeof a["factsExtraction"] === "boolean") config.knowledge = { ...config.knowledge ?? {}, factsExtraction: a["factsExtraction"] };
+    if (typeof a["rememberSessions"] === "boolean") config.memory = { ...config.memory ?? {}, rememberSessions: a["rememberSessions"] };
+    if (typeof a["enableToolCreation"] === "boolean") config.enableToolCreation = a["enableToolCreation"];
+    if (typeof a["persistDynamicTools"] === "boolean") config.persistDynamicTools = a["persistDynamicTools"];
+    if (typeof a["telemetryEnabled"] === "boolean") config.telemetry = { ...config.telemetry ?? {}, enabled: a["telemetryEnabled"] };
+  }
+  return result;
+}
+function settingsSnapshot(config) {
+  const providers = config.providers ?? [];
+  const endpoints = {};
+  for (const p of providers) {
+    if (p?.type && p?.baseUrl && p.type !== "azure") endpoints[p.type] = p.baseUrl;
+  }
+  const ws = config.tools?.webSearch ?? {};
+  return {
+    models: config.models ?? {},
+    budget: {
+      maxCostPerRun: config.budget?.maxCostPerRunUsd,
+      autoBias: config.autoBias,
+      dailyBudgetUsd: config.budget?.dailyBudgetUsd,
+      sessionBudgetUsd: config.budget?.sessionBudgetUsd,
+      maxTokensPerRun: config.budget?.maxTokensPerRun,
+      warnAtPct: config.budget?.warnAtPct
+    },
+    // Through the shared predicate: `authToken` is a credential too, and
+    // counting only `apiKey` showed a bearer-configured provider as unconfigured.
+    providersWithKey: providers.filter((p) => hasProviderCredential(p)).map((p) => p.type),
+    endpoints,
+    azureDeployments: providers.filter((p) => p.type === "azure").map((p) => ({
+      label: p.label,
+      baseUrl: p.baseUrl,
+      deploymentName: p.deploymentName,
+      apiVersion: p.apiVersion,
+      // Surfaced so a panel that round-trips the snapshot cannot drop them.
+      model: p.model,
+      region: p.region,
+      hasKey: typeof p.apiKey === "string" && p.apiKey.length > 0
+    })),
+    webSearch: {
+      searxngUrl: ws.searxngUrl,
+      hasBraveKey: typeof ws.braveApiKey === "string" && ws.braveApiKey.length > 0,
+      hasTavilyKey: typeof ws.tavilyApiKey === "string" && ws.tavilyApiKey.length > 0
+    },
+    advanced: {
+      autonomy: config.autonomy,
+      planApproval: config.planApproval,
+      approvalTimeoutMs: config.approvalTimeoutMs,
+      t3Execution: config.t3Execution,
+      localConcurrency: config.localConcurrency,
+      localInferenceTimeoutMs: config.localInferenceTimeoutMs,
+      cloudInferenceTimeoutMs: config.cloudInferenceTimeoutMs,
+      reflectionEnabled: config.reflection?.enabled,
+      cascadeAuto: config.cascadeAuto,
+      forceTier: config.routing?.forceTier,
+      benchmarksLive: config.benchmarks?.live,
+      dynamicToolSandbox: config.tools?.dynamicToolSandbox,
+      factsExtraction: config.knowledge?.factsExtraction,
+      rememberSessions: config.memory?.rememberSessions,
+      enableToolCreation: config.enableToolCreation,
+      persistDynamicTools: config.persistDynamicTools,
+      telemetryEnabled: config.telemetry?.enabled
+    }
+  };
+}
+async function commitSettings(live, data, write) {
+  const staged = structuredClone(live);
+  const { refused } = applySettingsPayload(staged, data);
+  let committed;
+  try {
+    committed = validateConfig(staged);
+  } catch (err) {
+    return {
+      ok: false,
+      refused,
+      error: `Those settings are not valid: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const written = await write(committed);
+  if (!written.ok) {
+    return { ok: false, refused, error: `Could not write the config file: ${written.error}` };
+  }
+  replaceInPlace(live, committed);
+  return { ok: true, refused };
+}
+function replaceInPlace(target, source) {
+  const t = target;
+  for (const key of Object.keys(t)) delete t[key];
+  Object.assign(t, structuredClone(source));
+}
+function writeConfigFile(configPath, config) {
+  try {
+    fs32.mkdirSync(path35.dirname(configPath), { recursive: true });
+    fs32.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+// src/dashboard/server.ts
 init_constants();
 var JWT_ALGORITHM = "HS256";
 function createToken(user, secret) {
@@ -25853,12 +27214,22 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * The handler's result is ACKNOWLEDGED to the caller.
+   *
+   * A settings save can be partly refused — a key whose host cannot be
+   * determined is deliberately not stored — and this path had no way to say so,
+   * so the panel cleared the input and reported success over a key the backend
+   * had dropped. Socket.IO's own ack channel carries it back, which needs no
+   * new event name and cannot be missed by a client that forgot to subscribe.
+   */
   onConfigUpdate(callback) {
     this.io.on("connection", (socket) => {
-      socket.on("config:update", (payload) => {
-        if (typeof payload === "object" && payload !== null) {
-          callback(payload);
-        }
+      socket.on("config:update", (payload, ack) => {
+        if (typeof payload !== "object" || payload === null) return;
+        void callback(payload).then((result) => {
+          if (typeof ack === "function") ack(result);
+        });
       });
     });
   }
@@ -26004,8 +27375,47 @@ function aggregateCostStats(sessions2, opts = {}) {
 }
 
 // src/dashboard/server.ts
-var __dirname$1 = path34.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path35.dirname(fileURLToPath(import.meta.url));
 var ORPHANED_ESCALATION_GRACE_MS = 3e4;
+var MASK = "***";
+function masked(key, value) {
+  return { [key]: value ? MASK : void 0 };
+}
+function redactProviderSecrets(config) {
+  const safe = { ...config };
+  safe.providers = (config.providers ?? []).map((p) => ({
+    ...p,
+    ...masked("apiKey", p.apiKey),
+    ...masked("authToken", p.authToken)
+  }));
+  if (config.tools) {
+    safe.tools = { ...config.tools };
+    if (config.tools.webSearch) {
+      safe.tools.webSearch = {
+        ...config.tools.webSearch,
+        ...masked("braveApiKey", config.tools.webSearch.braveApiKey),
+        ...masked("tavilyApiKey", config.tools.webSearch.tavilyApiKey)
+      };
+    }
+    if (config.tools.mcpServers) {
+      safe.tools.mcpServers = config.tools.mcpServers.map((server) => ({
+        ...server,
+        ...server.headers ? { headers: Object.fromEntries(Object.keys(server.headers).map((k) => [k, MASK])) } : {},
+        ...server.env ? { env: Object.fromEntries(Object.keys(server.env).map((k) => [k, MASK])) } : {}
+      }));
+    }
+  }
+  if (config.dashboard) {
+    safe.dashboard = { ...config.dashboard, ...masked("secret", config.dashboard.secret) };
+  }
+  if (config.telemetry) {
+    safe.telemetry = {
+      ...config.telemetry,
+      ...masked("posthogApiKey", config.telemetry.posthogApiKey)
+    };
+  }
+  return safe;
+}
 var DashboardServer = class {
   app;
   httpServer;
@@ -26080,40 +27490,21 @@ var DashboardServer = class {
       this.activeSessions.get(sessionId)?.rateLastRun(rating);
     });
     this.socket.onConfigGet((socketId) => {
-      this.socket.emitToSocket(socketId, "config:current", {
-        models: this.config.models ?? {},
-        budget: {
-          maxCostPerRun: this.config.budget?.maxCostPerRunUsd,
-          autoBias: this.config.autoBias
-        },
-        providersWithKey: (this.config.providers ?? []).filter((p) => typeof p.apiKey === "string" && p.apiKey.length > 0).map((p) => p.type)
-      });
+      this.socket.emitToSocket(socketId, "config:current", settingsSnapshot(this.config));
     });
-    this.socket.onConfigUpdate((data) => {
-      if (data.keys) {
-        for (const [type, apiKey] of Object.entries(data.keys)) {
-          if (!apiKey) continue;
-          const provider = this.config.providers.find((p) => p.type === type);
-          if (provider) provider.apiKey = apiKey;
-          else this.config.providers.push({ type, apiKey });
-        }
-      }
-      if (data.models) {
-        const models = this.config.models;
-        for (const [tier, val] of Object.entries(data.models)) {
-          if (val && val !== "auto") models[tier] = val;
-          else delete models[tier];
-        }
-      }
-      if (data.budget) {
-        if (typeof data.budget.maxCostPerRun === "number") {
-          this.config.budget.maxCostPerRunUsd = data.budget.maxCostPerRun;
-        }
-        if (data.budget.autoBias === "balanced" || data.budget.autoBias === "quality" || data.budget.autoBias === "cost") {
-          this.config.autoBias = data.budget.autoBias;
-        }
+    this.socket.onConfigUpdate(async (data) => {
+      const result = await commitSettings(this.config, data, (committed) => this.persistConfig(committed));
+      const refused = result.refused.map((r) => ({
+        type: r.type,
+        reason: r.reason,
+        message: explainRefusal(r.type, r.reason)
+      }));
+      for (const r of refused) console.warn(r.message);
+      if (!result.ok) {
+        return { refused, snapshot: settingsSnapshot(this.config), error: result.error };
       }
-      this.persistConfig();
+      this.syncGlobalCredentials();
+      return { refused, snapshot: settingsSnapshot(this.config) };
     });
     this.socket.onCascadeRun(async (prompt, model, socketId, requestedSessionId, forceTier) => {
       const sessionId = requestedSessionId ?? randomUUID();
@@ -26282,16 +27673,47 @@ var DashboardServer = class {
    * made over the socket (Settings → Save) persist across restarts. Best-effort:
    * a write failure is logged but never crashes the running dashboard.
    */
-  persistConfig() {
-    try {
-      const configPath = path34.join(this.workspacePath, CASCADE_CONFIG_FILE);
-      fs31.mkdirSync(path34.dirname(configPath), { recursive: true });
-      fs31.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
-    } catch (err) {
-      console.warn(`[dashboard] Failed to persist config: ${err instanceof Error ? err.message : String(err)}`);
-    }
+  /**
+   * Returns the durability of the WORKSPACE write, because a caller
+   * acknowledging a save has to know it happened.
+   *
+   * This was `void` and swallowed every filesystem error, so a read-only
+   * config path or a full disk produced: the live object mutated, the write
+   * failed, the socket acknowledged success, and the panel cleared the keys the
+   * user had typed. The changes then vanished at the next restart. "The handler
+   * ran" is not "the save is durable".
+   *
+   * The global-credential sync below is genuinely best-effort — it is a
+   * convenience copy, and failing it does not lose what the user just entered.
+   */
+  /**
+   * @param config REQUIRED, with no default. `commitSettings` writes the
+   * validated copy BEFORE adopting it, so a writer that reached for
+   * `this.config` instead would persist the configuration being replaced — and
+   * a default parameter is exactly the affordance that lets that happen
+   * silently and still typecheck.
+   */
+  persistConfig(config) {
+    const result = writeConfigFile(path35.join(this.workspacePath, CASCADE_CONFIG_FILE), config);
+    if (!result.ok) console.warn(`[dashboard] Failed to persist config: ${result.error}`);
+    return result;
+  }
+  /**
+   * Copy provider credentials to the machine-global store, so keys saved over
+   * the socket survive a workspace switch — the same sync `ConfigManager.save()`
+   * performs.
+   *
+   * Separate from the workspace write, and called only AFTER it succeeds. It
+   * used to run unconditionally inside `persistConfig()`, so a failed workspace
+   * write still pushed the provider half of a rejected save into the global
+   * store: half the change persisted, behind an error saying none of it had.
+   *
+   * Best-effort on its own account: this is a convenience copy, and failing it
+   * does not lose what the user just entered.
+   */
+  syncGlobalCredentials() {
     try {
-      saveGlobalCredentials(path34.join(os10.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
+      saveGlobalCredentials(path35.join(os10.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
     } catch (err) {
       console.warn(`[dashboard] Failed to sync global credentials: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -26306,15 +27728,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path34.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path35.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs31.existsSync(secretPath)) {
-        const existing = fs31.readFileSync(secretPath, "utf-8").trim();
+      if (fs32.existsSync(secretPath)) {
+        const existing = fs32.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = randomUUID();
-      fs31.mkdirSync(path34.dirname(secretPath), { recursive: true });
-      fs31.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs32.mkdirSync(path35.dirname(secretPath), { recursive: true });
+      fs32.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -26341,7 +27763,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -26721,12 +28143,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path34.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path35.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs31.existsSync(watchPath)) continue;
-      fs31.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs32.existsSync(watchPath)) continue;
+      fs32.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -26848,7 +28270,7 @@ ${prompt}`;
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -26941,7 +28363,7 @@ ${prompt}`;
     });
     this.app.delete("/api/sessions", auth2, (req, res) => {
       const body = req.body;
-      const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -26964,7 +28386,7 @@ ${prompt}`;
     });
     this.app.delete("/api/runtime", auth2, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -27033,8 +28455,7 @@ ${prompt}`;
       res.json(log);
     });
     this.app.get("/api/config", auth2, (_req, res) => {
-      const safe = { ...this.config };
-      safe.providers = safe.providers.map((p) => ({ ...p, apiKey: p.apiKey ? "***" : void 0 }));
+      const safe = redactProviderSecrets(this.config);
       res.json(safe);
     });
     this.app.put("/api/config", auth2, async (req, res) => {
@@ -27050,12 +28471,12 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path34.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs31.existsSync(configPath) ? JSON.parse(fs31.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path35.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs32.existsSync(configPath) ? JSON.parse(fs32.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs31.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs31.renameSync(tmp, configPath);
+        fs32.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs32.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
@@ -27083,7 +28504,7 @@ ${prompt}`;
     this.app.get("/api/runtime", auth2, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -27424,13 +28845,13 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    const prodPath = path34.resolve(__dirname$1, "../web/dist");
-    const devPath = path34.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs31.existsSync(prodPath) ? prodPath : devPath;
-    if (fs31.existsSync(webDistPath)) {
+    const prodPath = path35.resolve(__dirname$1, "../web/dist");
+    const devPath = path35.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs32.existsSync(prodPath) ? prodPath : devPath;
+    if (fs32.existsSync(webDistPath)) {
       this.app.use(express.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path34.join(webDistPath, "index.html"));
+        res.sendFile(path35.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {
@@ -27451,7 +28872,7 @@ init_constants();
 async function dashboardCommand(config, workspacePath = process.cwd()) {
   const port = config.dashboard.port ?? DEFAULT_DASHBOARD_PORT;
   const spin = ora({ text: `Starting dashboard on port ${port}\u2026`, color: "magenta" }).start();
-  const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
   const server = new DashboardServer(config, store, workspacePath);
   server.watchRuntimeChanges();
   const gThis = globalThis;
@@ -27463,10 +28884,10 @@ async function dashboardCommand(config, workspacePath = process.cwd()) {
   process.once("exit", onExit);
   try {
     await server.start();
-    spin.succeed(chalk7.green(`Dashboard running at http://localhost:${port}`));
+    spin.succeed(chalk8.green(`Dashboard running at http://localhost:${port}`));
     server.refreshRuntime("workspace");
     server.refreshRuntime("global");
-    console.log(chalk7.gray(`  Press Ctrl+C to stop
+    console.log(chalk8.gray(`  Press Ctrl+C to stop
 `));
     await new Promise(() => {
     });
@@ -27475,7 +28896,7 @@ async function dashboardCommand(config, workspacePath = process.cwd()) {
     await server.stop().catch(() => {
     });
     onExit();
-    spin.fail(chalk7.red(`Dashboard failed: ${err instanceof Error ? err.message : String(err)}`));
+    spin.fail(chalk8.red(`Dashboard failed: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
 }
@@ -27483,18 +28904,18 @@ init_constants();
 function makeIdentityCommand(workspacePath = process.cwd()) {
   const identity = new Command("identity").alias("id").description("Manage Cascade identities");
   identity.command("list").description("List all available identities").action(() => {
-    const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
     try {
       const identities = store.listIdentities();
-      console.log(chalk7.bold("\n  Identities:"));
+      console.log(chalk8.bold("\n  Identities:"));
       if (identities.length === 0) {
-        console.log(chalk7.gray("  No identities found."));
+        console.log(chalk8.gray("  No identities found."));
       } else {
         identities.forEach((id) => {
-          const defaultLabel = id.isDefault ? chalk7.green(" [Default]") : "";
-          console.log(`  - ${chalk7.cyan(id.name)}${defaultLabel}`);
-          console.log(chalk7.gray(`    ID: ${id.id}`));
-          if (id.description) console.log(chalk7.gray(`    ${id.description}`));
+          const defaultLabel = id.isDefault ? chalk8.green(" [Default]") : "";
+          console.log(`  - ${chalk8.cyan(id.name)}${defaultLabel}`);
+          console.log(chalk8.gray(`    ID: ${id.id}`));
+          if (id.description) console.log(chalk8.gray(`    ${id.description}`));
         });
       }
       console.log();
@@ -27503,7 +28924,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
     }
   });
   identity.command("create <name>").description("Create a new identity").option("-d, --desc <text>", "Description of the identity").option("-s, --system <text>", "System prompt").option("--default", "Set as default identity").action((name, options) => {
-    const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
     try {
       if (options.default) {
         const existingDefault = store.getDefaultIdentity();
@@ -27520,21 +28941,21 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
         isDefault: !!options.default,
         createdAt: (/* @__PURE__ */ new Date()).toISOString()
       });
-      console.log(chalk7.green(`
+      console.log(chalk8.green(`
   Successfully created identity: ${name} (${id})`));
-      if (options.default) console.log(chalk7.green("  Set as default."));
+      if (options.default) console.log(chalk8.green("  Set as default."));
       console.log();
     } finally {
       store.close();
     }
   });
   identity.command("set-default <name>").description("Set an identity as default by name or ID").action((query) => {
-    const store = new MemoryStore(path34.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path35.join(workspacePath, CASCADE_DB_FILE));
     try {
       const identities = store.listIdentities();
       const match = identities.find((i) => i.id === query || i.name.toLowerCase() === query.toLowerCase());
       if (!match) {
-        console.error(chalk7.red(`
+        console.error(chalk8.red(`
   Identity '${query}' not found.
 `));
         process.exit(1);
@@ -27544,7 +28965,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
         store.updateIdentity(existingDefault.id, { isDefault: false });
       }
       store.updateIdentity(match.id, { isDefault: true });
-      console.log(chalk7.green(`
+      console.log(chalk8.green(`
   Identity ${match.name} is now the default.
 `));
     } finally {
@@ -27555,7 +28976,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
 }
 init_pricing();
 async function modelsCommand(options = {}) {
-  console.log(chalk7.magenta("\n  \u25C8 Cascade Models\n"));
+  console.log(chalk8.magenta("\n  \u25C8 Cascade Models\n"));
   const cm = new ConfigManager(process.cwd());
   await cm.load();
   const config = cm.getConfig();
@@ -27563,16 +28984,16 @@ async function modelsCommand(options = {}) {
   try {
     await router.init(config);
   } catch (err) {
-    console.error(chalk7.red(`  Failed to initialize router: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk8.red(`  Failed to initialize router: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   await withTimeout(router.refreshLiveData(), 6e3, "live data timeout").catch(() => {
   });
   const liveData = router.getLiveData();
   const tiers = [
-    { tier: "T1", label: "T1 Administrator", color: chalk7.hex("#4C8DFF") },
-    { tier: "T2", label: "T2 Manager", color: chalk7.hex("#38B0DE") },
-    { tier: "T3", label: "T3 Worker", color: chalk7.hex("#2DD4BF") }
+    { tier: "T1", label: "T1 Administrator", color: chalk8.hex("#4C8DFF") },
+    { tier: "T2", label: "T2 Manager", color: chalk8.hex("#38B0DE") },
+    { tier: "T3", label: "T3 Worker", color: chalk8.hex("#2DD4BF") }
   ];
   let anyMissing = false;
   let anyUnpriced = false;
@@ -27584,76 +29005,76 @@ async function modelsCommand(options = {}) {
       const costIn = unpriced ? "cost not tracked" : model.inputCostPer1kTokens === 0 ? "free" : `$${model.inputCostPer1kTokens.toFixed(4)}/1K in`;
       const costOut = unpriced ? "" : model.outputCostPer1kTokens === 0 ? "free" : `, $${model.outputCostPer1kTokens.toFixed(4)}/1K out`;
       const ctx = model.contextWindow >= 1e6 ? `${(model.contextWindow / 1e6).toFixed(1)}M ctx` : `${(model.contextWindow / 1e3).toFixed(0)}K ctx`;
-      const local = model.isLocal ? chalk7.gray(" [local]") : "";
-      const vision = model.isVisionCapable ? chalk7.gray(" \u{1F441}") : "";
+      const local = model.isLocal ? chalk8.gray(" [local]") : "";
+      const vision = model.isVisionCapable ? chalk8.gray(" \u{1F441}") : "";
       const bench = Math.round(benchmarkScore01(model, "mixed") * 100);
       console.log(
-        `  ${color.bold(tier)}  ${chalk7.white(col(model.name, 24))}${chalk7.gray(col(model.provider, 16))}` + (options.verbose ? `${chalk7.gray(col(ctx, 12))}${chalk7.gray(col(`bench ${bench}/100`, 14))}${chalk7.gray(`${costIn}${costOut}`)}` : `${chalk7.gray(col(ctx, 10))}${chalk7.gray(`bench ${bench}/100`)}`) + local + vision
+        `  ${color.bold(tier)}  ${chalk8.white(col(model.name, 24))}${chalk8.gray(col(model.provider, 16))}` + (options.verbose ? `${chalk8.gray(col(ctx, 12))}${chalk8.gray(col(`bench ${bench}/100`, 14))}${chalk8.gray(`${costIn}${costOut}`)}` : `${chalk8.gray(col(ctx, 10))}${chalk8.gray(`bench ${bench}/100`)}`) + local + vision
       );
     } else {
-      console.log(`  ${color.bold(tier)}  ${chalk7.red("No model available")}  ${chalk7.gray(`(check provider config for ${label})`)}`);
+      console.log(`  ${color.bold(tier)}  ${chalk8.red("No model available")}  ${chalk8.gray(`(check provider config for ${label})`)}`);
       anyMissing = true;
     }
   }
   console.log();
   const providers = config.providers.map((p) => p.type).join(", ") || "(none)";
-  console.log(chalk7.gray(`  Configured providers: ${providers}`));
+  console.log(chalk8.gray(`  Configured providers: ${providers}`));
   if (liveData) {
     const src = liveData.getDataSource();
     const gen = liveData.getGeneratedAt();
     const srcLabel = src === "live" ? "live (just fetched)" : src === "cache" ? "cached" : "bundled";
     const pricingMeta = pricingDatasetMeta();
-    console.log(chalk7.gray(
+    console.log(chalk8.gray(
       `  Benchmark data: ${srcLabel}` + (gen ? ` \xB7 updated ${gen.slice(0, 10)}` : "") + ` \xB7 pricing: ${liveData.hasLivePricing() ? "live (OpenRouter)" : "dataset"} (baseline ${pricingMeta.generatedAt})`
     ));
     const drift = liveData.getPriceDisagreements();
     if (drift.length) {
-      console.log(chalk7.yellow(`
+      console.log(chalk8.yellow(`
   ${drift.length} model${drift.length === 1 ? "" : "s"} priced differently by the live source than by the bundled dataset:`));
       for (const d of drift.slice(0, 10)) {
-        console.log(chalk7.gray(
+        console.log(chalk8.gray(
           `    ${d.provider}:${d.modelId}  dataset $${d.dataset.input.toFixed(5)}/$${d.dataset.output.toFixed(5)} per 1K (as of ${d.datasetAsOf})  \u2192  live $${d.live.input.toFixed(5)}/$${d.live.output.toFixed(5)}  (${d.ratio}\xD7)`
         ));
       }
-      console.log(chalk7.gray("    Live pricing is used. Refresh src/core/router/pricing-data.json to clear this."));
+      console.log(chalk8.gray("    Live pricing is used. Refresh src/core/router/pricing-data.json to clear this."));
     }
   }
   if (anyUnpriced) {
-    console.log(chalk7.yellow(
+    console.log(chalk8.yellow(
       '\n  Some tiers use a model with no published price \u2014 their spend is reported as "cost not tracked", never $0.00,\n  and is not counted toward a cost budget. Add the model to the pricing dataset, or set `local: true` on the\n  provider if the endpoint genuinely costs nothing to run.'
     ));
   }
   if (options.verbose) {
     console.log();
-    console.log(chalk7.white("  Available models by provider:\n"));
+    console.log(chalk8.white("  Available models by provider:\n"));
     const allProviderTypes = [...new Set(config.providers.map((p) => p.type))];
     for (const providerType of allProviderTypes) {
       const available = router.getModelsForProvider(providerType);
       if (available.length === 0) continue;
-      console.log(chalk7.gray(`  ${providerType}:`));
+      console.log(chalk8.gray(`  ${providerType}:`));
       for (const m of available) {
         const override = config.models.t1 === m.id ? " \u2190 T1" : config.models.t2 === m.id ? " \u2190 T2" : config.models.t3 === m.id ? " \u2190 T3" : "";
-        console.log(`    ${chalk7.white(col(m.name, 28))}${chalk7.gray(m.id)}${chalk7.yellow(override)}`);
+        console.log(`    ${chalk8.white(col(m.name, 28))}${chalk8.gray(m.id)}${chalk8.yellow(override)}`);
       }
       console.log();
     }
   }
   if (anyMissing) {
-    console.log(chalk7.yellow("  Some tiers have no available model. Run `cascade doctor` for details.\n"));
+    console.log(chalk8.yellow("  Some tiers have no available model. Run `cascade doctor` for details.\n"));
   } else {
-    console.log(chalk7.green("  All tiers are configured.\n"));
+    console.log(chalk8.green("  All tiers are configured.\n"));
   }
 }
 async function setModelCommand(action, tierArg, value) {
   const tier = (tierArg ?? "").toLowerCase();
   if (!["t1", "t2", "t3"].includes(tier)) {
-    console.error(chalk7.red(`  Invalid tier "${tierArg ?? ""}". Use t1, t2, or t3.`));
-    console.log(chalk7.gray("  e.g. cascade models set t1 anthropic:claude-opus-4-8"));
+    console.error(chalk8.red(`  Invalid tier "${tierArg ?? ""}". Use t1, t2, or t3.`));
+    console.log(chalk8.gray("  e.g. cascade models set t1 anthropic:claude-opus-4-8"));
     process.exit(1);
   }
   const override = action === "unset" ? "auto" : (value ?? "").trim();
   if (action === "set" && !override) {
-    console.error(chalk7.red('  Missing value. e.g. cascade models set t3 openai:gpt-4o-mini  (or "auto")'));
+    console.error(chalk8.red('  Missing value. e.g. cascade models set t3 openai:gpt-4o-mini  (or "auto")'));
     process.exit(1);
   }
   const cm = new ConfigManager(process.cwd());
@@ -27663,8 +29084,8 @@ async function setModelCommand(action, tierArg, value) {
   if (override === "auto") delete models[tier];
   else models[tier] = override;
   await cm.updateConfig({ models });
-  const label = override === "auto" ? chalk7.gray("auto (routing decides)") : chalk7.white(override);
-  console.log(chalk7.green(`
+  const label = override === "auto" ? chalk8.gray("auto (routing decides)") : chalk8.white(override);
+  console.log(chalk8.green(`
   \u2713 ${tier.toUpperCase()} model set to ${label}
 `));
 }
@@ -27678,8 +29099,8 @@ async function exportCommand(options = {}) {
   let store;
   try {
     const workspacePath = options.workspacePath ?? process.cwd();
-    const workspaceDbPath = path34.join(workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path34.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE);
+    const workspaceDbPath = path35.join(workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path35.join(os10.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE);
     let dbPath = globalDbPath;
     try {
       await fs11.access(workspaceDbPath);
@@ -27688,7 +29109,7 @@ async function exportCommand(options = {}) {
     }
     store = new MemoryStore(dbPath);
   } catch (err) {
-    spin.fail(chalk7.red(`Cannot open memory store: ${err instanceof Error ? err.message : String(err)}`));
+    spin.fail(chalk8.red(`Cannot open memory store: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
   try {
@@ -27696,7 +29117,7 @@ async function exportCommand(options = {}) {
     if (options.sessionId) {
       const session2 = store.getSession(options.sessionId);
       if (!session2) {
-        spin.fail(chalk7.red(`Session "${options.sessionId}" not found.`));
+        spin.fail(chalk8.red(`Session "${options.sessionId}" not found.`));
         process.exit(1);
       }
       sessions2 = [session2];
@@ -27704,14 +29125,14 @@ async function exportCommand(options = {}) {
       const limit = options.last ?? 10;
       sessions2 = store.listSessions(void 0, limit);
       if (sessions2.length === 0) {
-        spin.warn(chalk7.yellow("No sessions found."));
+        spin.warn(chalk8.yellow("No sessions found."));
         return;
       }
       const latest = sessions2[0];
       const full = store.getSession(latest.id);
       sessions2 = full ? [full] : [];
       if (sessions2.length === 0) {
-        spin.fail(chalk7.red("Could not load latest session."));
+        spin.fail(chalk8.red("Could not load latest session."));
         process.exit(1);
       }
     }
@@ -27721,17 +29142,17 @@ async function exportCommand(options = {}) {
     const ext = format === "json" ? ".json" : ".md";
     const safeName = session.title.replace(/[^\w\s-]/g, "").replace(/\s+/g, "-").slice(0, 60);
     const defaultFile = `cascade-export-${safeName}${ext}`;
-    const outPath = options.output ? path34.resolve(options.output) : path34.join(process.cwd(), defaultFile);
+    const outPath = options.output ? path35.resolve(options.output) : path35.join(process.cwd(), defaultFile);
     await fs11.writeFile(outPath, content, "utf-8");
-    spin.succeed(chalk7.green(`Exported to ${chalk7.white(outPath)}`));
+    spin.succeed(chalk8.green(`Exported to ${chalk8.white(outPath)}`));
     const messageCount = Array.isArray(session.messages) ? session.messages.length : 0;
     console.log();
-    console.log(chalk7.gray(`  Session:  ${session.title}`));
-    console.log(chalk7.gray(`  Messages: ${messageCount}`));
-    console.log(chalk7.gray(`  Format:   ${format}`));
+    console.log(chalk8.gray(`  Session:  ${session.title}`));
+    console.log(chalk8.gray(`  Messages: ${messageCount}`));
+    console.log(chalk8.gray(`  Format:   ${format}`));
     console.log();
   } catch (err) {
-    spin.fail(chalk7.red(`Export failed: ${err instanceof Error ? err.message : String(err)}`));
+    spin.fail(chalk8.red(`Export failed: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
 }
@@ -27785,93 +29206,6 @@ function buildJsonExport(session) {
   };
   return JSON.stringify(payload, null, 2);
 }
-async function linkCommand(target, options = {}) {
-  const found = await discoverCredentials();
-  if (found.length === 0) {
-    console.log(chalk7.yellow("\n  No reusable credentials found.\n"));
-    console.log(chalk7.gray("  Cascade looks for Claude Code, Codex, Gemini CLI, and GitHub Copilot logins,"));
-    console.log(chalk7.gray("  plus ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY in your environment.\n"));
-    return;
-  }
-  if (!target) {
-    printDiscovered(found);
-    return;
-  }
-  const provider = normalizeProvider(target);
-  if (!provider) {
-    console.log(chalk7.red(`
-  Unknown provider "${target}". Use one of: anthropic, openai, gemini.
-`));
-    return;
-  }
-  const candidates2 = found.filter((c) => c.provider === provider);
-  const chosen = candidates2.find((c) => c.directlyUsable) ?? candidates2[0];
-  if (!chosen) {
-    console.log(chalk7.yellow(`
-  No detected credential maps to "${provider}".
-`));
-    return;
-  }
-  if (!chosen.directlyUsable) {
-    console.log(chalk7.yellow(`
-  Found a ${chosen.sourceTool} credential, but it can't be used against the standard ${provider} API.`));
-    if (chosen.warning) console.log(chalk7.gray(`  ${chosen.warning}`));
-    console.log(chalk7.gray("  Cascade won't adopt it because it would create a non-working provider.\n"));
-    return;
-  }
-  if (chosen.kind === "oauth" && !options.acceptRisk) {
-    console.log(chalk7.yellow(`
-  ${chosen.sourceTool} provides a subscription OAuth token, not an API key.`));
-    if (chosen.warning) console.log(chalk7.gray(`  ${chosen.warning}`));
-    console.log(chalk7.gray("  Re-run with --accept-risk to adopt it anyway:\n"));
-    console.log(chalk7.cyan(`      cascade link ${provider} --accept-risk
-`));
-    return;
-  }
-  await adoptCredential(chosen, options.workspace ?? process.cwd());
-  console.log(chalk7.green(`
-  \u2713 Linked ${provider} using your ${chosen.sourceTool} credential (${maskSecret(chosen.secret)}).`));
-  if (chosen.kind === "oauth") {
-    console.log(chalk7.gray("  Adopted as an OAuth bearer token \u2014 revoke it in the source tool to disable."));
-  }
-  console.log(chalk7.gray("  Run `cascade doctor` to verify, or `cascade` to start.\n"));
-}
-function printDiscovered(found) {
-  console.log(chalk7.magenta("\n  \u25C8 Detected credentials\n"));
-  for (const c of found) {
-    const usable = c.directlyUsable ? chalk7.green("usable") : chalk7.yellow("needs vendor backend");
-    const kind = c.kind === "oauth" ? chalk7.yellow("oauth") : chalk7.gray("api-key");
-    console.log(`  ${chalk7.white(c.provider.padEnd(18))} ${chalk7.gray(maskSecret(c.secret).padEnd(12))} ${kind}  ${usable}`);
-    console.log(chalk7.gray(`    from ${c.sourceTool}`));
-    if (c.warning) console.log(chalk7.yellow(`    \u26A0 ${c.warning}`));
-  }
-  console.log(chalk7.gray("\n  Adopt one with:  ") + chalk7.cyan("cascade link <provider> [--accept-risk]"));
-  console.log(chalk7.gray("  --accept-risk is required for subscription OAuth tokens.\n"));
-}
-function normalizeProvider(target) {
-  const t = target.toLowerCase();
-  if (t === "anthropic" || t === "claude" || t === "claude-code") return "anthropic";
-  if (t === "openai" || t === "codex" || t === "gpt") return "openai";
-  if (t === "gemini" || t === "google") return "gemini";
-  return null;
-}
-async function adoptCredential(cred, workspace) {
-  const cm = new ConfigManager(workspace);
-  await cm.load();
-  const config = cm.getConfig();
-  const next = {
-    type: cred.provider,
-    credentialSource: cred.sourceTool
-  };
-  if (cred.kind === "oauth" && cred.provider === "anthropic") {
-    next.authToken = cred.secret;
-  } else {
-    next.apiKey = cred.secret;
-  }
-  const providers = config.providers.filter((p) => p.type !== cred.provider);
-  providers.push(next);
-  await cm.updateConfig({ providers });
-}
 async function telemetryCommand(action) {
   const cm = new ConfigManager(process.cwd());
   await cm.load();
@@ -27879,12 +29213,12 @@ async function telemetryCommand(action) {
   if (action === "status") {
     const state = config.telemetry?.enabled ? "ON" : "OFF";
     console.log();
-    console.log(chalk7.magenta("  \u25C8 Cascade Telemetry"));
+    console.log(chalk8.magenta("  \u25C8 Cascade Telemetry"));
     console.log();
-    console.log(`  Status: ${config.telemetry?.enabled ? chalk7.green(state) : chalk7.gray(state)}`);
-    console.log(chalk7.gray("  Scope:  anonymous session metadata only (no prompts/outputs)"));
+    console.log(`  Status: ${config.telemetry?.enabled ? chalk8.green(state) : chalk8.gray(state)}`);
+    console.log(chalk8.gray("  Scope:  anonymous session metadata only (no prompts/outputs)"));
     console.log();
-    console.log(chalk7.gray("  Toggle with:  cascade telemetry on   |   cascade telemetry off"));
+    console.log(chalk8.gray("  Toggle with:  cascade telemetry on   |   cascade telemetry off"));
     console.log();
     return;
   }
@@ -27898,11 +29232,11 @@ async function telemetryCommand(action) {
   });
   console.log();
   if (enabled) {
-    console.log(chalk7.green(`  \u2713 Telemetry enabled.`));
-    console.log(chalk7.gray("    Anonymous session metadata (no prompts, no outputs) will be sent."));
+    console.log(chalk8.green(`  \u2713 Telemetry enabled.`));
+    console.log(chalk8.gray("    Anonymous session metadata (no prompts, no outputs) will be sent."));
   } else {
-    console.log(chalk7.yellow(`  \u2713 Telemetry disabled.`));
-    console.log(chalk7.gray("    No events will be transmitted from this workspace."));
+    console.log(chalk8.yellow(`  \u2713 Telemetry disabled.`));
+    console.log(chalk8.gray("    No events will be transmitted from this workspace."));
   }
   console.log();
 }
@@ -27912,11 +29246,11 @@ async function statsCommand() {
   await tracker.load();
   const all = tracker.getAll();
   if (all.size === 0) {
-    console.log(chalk7.dim("\n  No routing history yet \u2014 run some tasks first.\n"));
+    console.log(chalk8.dim("\n  No routing history yet \u2014 run some tasks first.\n"));
     return;
   }
-  console.log(chalk7.magenta("\n  \u25C8 Auto-Routing History\n"));
-  console.log(chalk7.dim("  Per-task-type model performance learned from past runs.\n"));
+  console.log(chalk8.magenta("\n  \u25C8 Auto-Routing History\n"));
+  console.log(chalk8.dim("  Per-task-type model performance learned from past runs.\n"));
   for (const taskType of TASK_TYPES) {
     const entries = [];
     for (const [key, stat] of all) {
@@ -27928,36 +29262,36 @@ async function statsCommand() {
     }
     if (entries.length === 0) continue;
     entries.sort((a, b) => b.successRate - a.successRate || b.samples - a.samples);
-    console.log(chalk7.bold(`  ${taskType.toUpperCase()}`));
+    console.log(chalk8.bold(`  ${taskType.toUpperCase()}`));
     const header = `  ${"Model".padEnd(36)} ${"Success".padEnd(9)} ${"Samples".padEnd(9)} Avg cost`;
-    console.log(chalk7.dim(header));
-    console.log(chalk7.dim("  " + "\u2500".repeat(62)));
+    console.log(chalk8.dim(header));
+    console.log(chalk8.dim("  " + "\u2500".repeat(62)));
     for (const e of entries) {
       const pct = `${Math.round(e.successRate * 100)}%`;
       const cost = e.avgCostUsd < 1e-4 ? "<$0.0001" : `$${e.avgCostUsd.toFixed(4)}`;
-      const color = e.successRate >= 0.8 ? chalk7.green : e.successRate >= 0.5 ? chalk7.yellow : chalk7.red;
+      const color = e.successRate >= 0.8 ? chalk8.green : e.successRate >= 0.5 ? chalk8.yellow : chalk8.red;
       console.log(
-        `  ${e.modelId.padEnd(36)} ${color(pct.padEnd(9))} ${String(e.samples).padEnd(9)} ${chalk7.dim(cost)}`
+        `  ${e.modelId.padEnd(36)} ${color(pct.padEnd(9))} ${String(e.samples).padEnd(9)} ${chalk8.dim(cost)}`
       );
     }
     console.log();
   }
-  console.log(chalk7.dim("  tip: use /rate good | bad after a task to improve these scores.\n"));
+  console.log(chalk8.dim("  tip: use /rate good | bad after a task to improve these scores.\n"));
 }
 
 // src/cli/index.ts
 dotenv.config();
 function warnIfBuildIsStale() {
   try {
-    const here = path34.dirname(fileURLToPath(import.meta.url));
+    const here = path35.dirname(fileURLToPath(import.meta.url));
     for (const rel of ["..", "../.."]) {
-      const pkgPath = path34.join(here, rel, "package.json");
-      if (!fs31.existsSync(pkgPath)) continue;
-      const pkg = JSON.parse(fs31.readFileSync(pkgPath, "utf-8"));
+      const pkgPath = path35.join(here, rel, "package.json");
+      if (!fs32.existsSync(pkgPath)) continue;
+      const pkg = JSON.parse(fs32.readFileSync(pkgPath, "utf-8"));
       if (pkg.name !== "cascade-ai") continue;
       if (pkg.version && pkg.version !== CASCADE_VERSION) {
         console.error(
-          chalk7.yellow(
+          chalk8.yellow(
             `\u26A0 Stale build: compiled output is v${CASCADE_VERSION} but the source tree is v${pkg.version}.
   Run: npm install && npm run build`
           )
@@ -28056,7 +29390,7 @@ mcp.command("list").description("List configured MCP servers").action(async () =
 mcp.command("remove <name>").description("Remove an MCP server (and its stored OAuth tokens)").action(async (name) => {
   await mcpRemoveCommand(name);
 });
-program.command("link [provider]").description("Reuse credentials from other AI CLIs (Claude Code, Codex, Gemini CLI, Copilot)").option("--accept-risk", "Adopt a subscription OAuth token despite the ToS warning").action(async (provider, opts) => {
+program.command("link [provider]").description("Reuse credentials from other AI CLIs (Claude Code, Codex, Gemini CLI, Copilot)").option("--accept-risk", "Deprecated \u2014 subscription tokens can no longer be adopted").action(async (provider, opts) => {
   await linkCommand(provider, { acceptRisk: opts.acceptRisk, workspace: process.cwd() });
 });
 program.command("update").description("Update Cascade to the latest version").action(async () => {
@@ -28082,7 +29416,7 @@ program.command("models [action] [tier] [value]").description("List AI models pe
 program.command("telemetry [action]").description("Toggle anonymous usage telemetry (on | off | status). Default: status").action(async (action) => {
   const normalized = (action ?? "status").toLowerCase();
   if (normalized !== "on" && normalized !== "off" && normalized !== "status") {
-    console.error(chalk7.red(`Unknown action: ${action}. Use: on | off | status`));
+    console.error(chalk8.red(`Unknown action: ${action}. Use: on | off | status`));
     process.exit(1);
   }
   await telemetryCommand(normalized);
@@ -28104,15 +29438,15 @@ async function startRepl(options) {
   try {
     await cm.load();
   } catch (err) {
-    console.error(chalk7.red(`Config error: ${err instanceof Error ? err.message : String(err)}`));
-    console.error(chalk7.gray("Run `cascade init` to set up this directory."));
+    console.error(chalk8.red(`Config error: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk8.gray("Run `cascade init` to set up this directory."));
     process.exit(1);
   }
   let config = cm.getConfig();
   const startupNotice = cm.takeRetiredNotice();
   const needsSetup = !hasUsableProvider(config.providers);
   if (needsSetup) {
-    console.log(chalk7.magenta("  \u25C8 No providers configured \u2014 launching setup wizard\u2026"));
+    console.log(chalk8.magenta("  \u25C8 No providers configured \u2014 launching setup wizard\u2026"));
     console.log();
     config = await runSetupWizard(workspacePath);
     await cm.updateConfig(config);
@@ -28147,24 +29481,24 @@ async function runHeadless(prompt, options) {
   try {
     await cm.load();
   } catch (err) {
-    console.error(chalk7.red(`Config error: ${err instanceof Error ? err.message : String(err)}`));
-    console.error(chalk7.gray("Run `cascade init` to set up this directory."));
+    console.error(chalk8.red(`Config error: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk8.gray("Run `cascade init` to set up this directory."));
     process.exit(1);
   }
   const config = cm.getConfig();
   const needsSetup = !hasUsableProvider(config.providers);
   if (needsSetup) {
-    console.error(chalk7.red("No providers configured. Run `cascade init` first."));
+    console.error(chalk8.red("No providers configured. Run `cascade init` first."));
     process.exit(1);
   }
   const cascade = new Cascade(config, workspacePath);
   try {
     await cascade.init();
   } catch (err) {
-    console.error(chalk7.red(`Initialization failed: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk8.red(`Initialization failed: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
-  console.error(chalk7.gray("  \u25C8 Running headlessly \u2014 tool approvals are auto-granted."));
+  console.error(chalk8.gray("  \u25C8 Running headlessly \u2014 tool approvals are auto-granted."));
   let lastProgress = "";
   cascade.on("tier:status", (ev) => {
     const action = ev?.currentAction?.trim();
@@ -28172,7 +29506,7 @@ async function runHeadless(prompt, options) {
     const line = `  \xB7 ${ev.role ?? ""} ${action}`.trimEnd();
     if (line === lastProgress) return;
     lastProgress = line;
-    console.error(chalk7.gray(line));
+    console.error(chalk8.gray(line));
   });
   try {
     const result = await cascade.run({
@@ -28183,7 +29517,7 @@ async function runHeadless(prompt, options) {
     });
     process.stdout.write(result.output.trimEnd() + "\n");
   } catch (err) {
-    console.error(chalk7.red(`Error: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(chalk8.red(`Error: ${err instanceof Error ? err.message : String(err)}`));
     await cascade.close().catch(() => {
     });
     process.exit(1);
@@ -28195,9 +29529,9 @@ async function runHeadless(prompt, options) {
 function printBanner() {
   if (process.stdout.columns < 60) return;
   console.log();
-  console.log("  " + chalk7.hex("#4C8DFF").bold("\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log("  " + chalk7.hex("#38B0DE").bold("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588") + "   " + chalk7.white.bold("CASCADE") + chalk7.gray("  v" + CASCADE_VERSION));
-  console.log("  " + chalk7.hex("#2DD4BF").bold("    \u2588\u2588\u2588\u2588\u2588\u2588") + "   " + chalk7.hex("#8A93A8")("multi-tier orchestration"));
+  console.log("  " + chalk8.hex("#4C8DFF").bold("\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log("  " + chalk8.hex("#38B0DE").bold("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588") + "   " + chalk8.white.bold("CASCADE") + chalk8.gray("  v" + CASCADE_VERSION));
+  console.log("  " + chalk8.hex("#2DD4BF").bold("    \u2588\u2588\u2588\u2588\u2588\u2588") + "   " + chalk8.hex("#8A93A8")("multi-tier orchestration"));
   console.log();
 }
 program.parse(process.argv);