claudish 13.0.3 → 13.2.0

package/dist/index.js

@@ -575,7 +575,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "13.0.3";
+var VERSION = "13.2.0";
 
 // src/logger.ts
 import { appendFile, existsSync as existsSync2, mkdirSync, readdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
@@ -10403,9 +10403,6 @@ function acceptsReasoningEffort(modelId) {
     return reasoning.supported === true && reasoning.control === "effort";
   return true;
 }
-function catalogReasoningFor(modelId) {
-  return lookupModelReasoning(norm(modelId)) ?? lookupModelReasoning(modelId);
-}
 function rememberReasoningEffortRejected(modelId) {
   const id = norm(modelId);
   if (!id || learnedRejects.has(id))
@@ -10530,7 +10527,7 @@ var init_grok_model_dialect = __esm(() => {
         return;
       }
       let value;
-      const reasoning = catalogReasoningFor(this.modelId);
+      const reasoning = this.lookupReasoningCapability();
       const clamped = reasoning ? this.clampToAdvertisedEffort(effort, reasoning) : undefined;
       if (clamped) {
         value = clamped;
@@ -10878,6 +10875,324 @@ var init_minimax_model_dialect = __esm(() => {
   };
 });
 
+// src/providers/keychain.ts
+function syncRun(args, stdin) {
+  try {
+    const proc = Bun.spawnSync([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: SPAWN_TIMEOUT_MS
+    });
+    return normalizeResult(proc.exitCode, proc.signalCode, decode(proc.stdout), decode(proc.stderr));
+  } catch (err) {
+    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function asyncRun(args, stdin) {
+  try {
+    const proc = Bun.spawn([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: SPAWN_TIMEOUT_MS
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    return normalizeResult(exitCode, proc.signalCode, stdout, stderr);
+  } catch (err) {
+    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+function spawnAsyncRun(args, stdin) {
+  try {
+    const proc = Bun.spawn([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const done = Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]).then(([stdout, stderr, exitCode]) => normalizeResult(exitCode, proc.signalCode, stdout, stderr), (err) => ({
+      code: 1,
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err)
+    }));
+    return { done, pid: proc.pid };
+  } catch (err) {
+    return {
+      done: Promise.resolve({
+        code: 1,
+        stdout: "",
+        stderr: err instanceof Error ? err.message : String(err)
+      }),
+      pid: undefined
+    };
+  }
+}
+function decode(buf) {
+  return buf ? new TextDecoder().decode(buf) : "";
+}
+function normalizeResult(exitCode, signalCode, stdout, stderr) {
+  if (typeof exitCode === "number")
+    return { code: exitCode, stdout, stderr };
+  const detail = signalCode ? `killed by ${signalCode}` : "terminated without an exit code";
+  return { code: -1, stdout, stderr: stderr.trim() || `security ${detail}` };
+}
+function invalidateKeychainCache() {
+  listMemo = null;
+  valueMemo.clear();
+}
+function now() {
+  return Date.now();
+}
+function isValidKeychainVarName(name) {
+  return ENV_VAR_NAME.test(name);
+}
+function describeUnstorableValue(value) {
+  if (value.length === 0)
+    return "value is empty";
+  if (CONTROL_CHARS.test(value)) {
+    return "value contains control characters (tab/newline/etc), which the keychain read path cannot represent unambiguously";
+  }
+  return null;
+}
+function isKeychainSupported() {
+  return deps.platform() === "darwin";
+}
+function keychainUnavailableReason() {
+  if (!isKeychainSupported()) {
+    return `the macOS Keychain is only available on macOS (this is ${deps.platform()})`;
+  }
+  return null;
+}
+function stripOneTrailingNewline(out) {
+  return out.endsWith(`
+`) ? out.slice(0, -1) : out;
+}
+function keychainFileArgs() {
+  const file = process.env.CLAUDISH_KEYCHAIN_FILE;
+  return file ? [file] : [];
+}
+function findArgs(envVar) {
+  return [
+    "find-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    envVar,
+    "-w",
+    ...keychainFileArgs()
+  ];
+}
+function interpretRead(envVar, res) {
+  if (res.code === 0) {
+    const value = stripOneTrailingNewline(res.stdout);
+    return value.length > 0 ? value : null;
+  }
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return null;
+  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+}
+function readKeychainSecret(envVar) {
+  if (!isKeychainSupported())
+    return null;
+  const cached = valueMemo.get(envVar);
+  const at = now();
+  if (cached && at - cached.at < MEMO_TTL_MS)
+    return cached.value;
+  const value = interpretRead(envVar, deps.run(findArgs(envVar)));
+  valueMemo.set(envVar, { at, value });
+  return value;
+}
+async function readKeychainSecretAsync(envVar) {
+  if (!isKeychainSupported())
+    return null;
+  const cached = valueMemo.get(envVar);
+  const at = now();
+  if (cached && at - cached.at < MEMO_TTL_MS)
+    return cached.value;
+  const value = interpretRead(envVar, await deps.runAsync(findArgs(envVar)));
+  valueMemo.set(envVar, { at, value });
+  return value;
+}
+function genericPasswordArgs(query, withValue) {
+  return [
+    "find-generic-password",
+    "-s",
+    query.service,
+    ...query.account !== undefined ? ["-a", query.account] : [],
+    ...withValue ? ["-w"] : [],
+    ...query.keychainFile !== undefined ? [query.keychainFile] : keychainFileArgs()
+  ];
+}
+function interpretGenericPassword(res, withValue) {
+  if (res.code === 0) {
+    if (!withValue)
+      return { kind: "found" };
+    const value = stripOneTrailingNewline(res.stdout);
+    return value.length > 0 ? { kind: "found", value } : { kind: "absent" };
+  }
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return { kind: "absent" };
+  return {
+    kind: "failed",
+    code: res.code,
+    error: res.stderr.trim() || `security exited ${res.code}`
+  };
+}
+async function findGenericPasswordPresence(query) {
+  if (!isKeychainSupported())
+    return { kind: "absent" };
+  const res = await deps.spawnAsync(genericPasswordArgs(query, false)).done;
+  return interpretGenericPassword(res, false);
+}
+function startGenericPasswordRead(query) {
+  if (!isKeychainSupported()) {
+    return { done: Promise.resolve({ kind: "absent" }), pid: undefined };
+  }
+  const spawn = deps.spawnAsync(genericPasswordArgs(query, true));
+  return { done: spawn.done.then((res) => interpretGenericPassword(res, true)), pid: spawn.pid };
+}
+function enumerateKeychainVars() {
+  if (!isKeychainSupported())
+    return { names: [], failed: false };
+  const at = now();
+  if (listMemo && at - listMemo.at < MEMO_TTL_MS)
+    return listMemo.value;
+  const res = deps.run(["dump-keychain", ...keychainFileArgs()]);
+  const value = res.code === 0 ? { names: parseDumpAccounts(res.stdout), failed: false } : {
+    names: [],
+    failed: true,
+    error: res.stderr.trim() || `security exited ${res.code}`
+  };
+  listMemo = { at, value };
+  return value;
+}
+function listKeychainVars() {
+  return enumerateKeychainVars().names;
+}
+function parseDumpAccounts(dump) {
+  const found = new Set;
+  for (const block of dump.split(/\nkeychain: /)) {
+    if (!block.includes(SVCE_MATCH))
+      continue;
+    const m = block.match(ACCT_ATTR);
+    if (m?.[1] && isValidKeychainVarName(m[1]))
+      found.add(m[1]);
+  }
+  return Array.from(found).sort();
+}
+function lookupKeychainVar(envVar) {
+  if (!isKeychainSupported())
+    return { present: false, failed: false };
+  const cached = valueMemo.get(envVar);
+  if (cached && now() - cached.at < MEMO_TTL_MS && cached.value !== null) {
+    return { present: true, failed: false };
+  }
+  const listed = enumerateKeychainVars();
+  return { present: listed.names.includes(envVar), failed: listed.failed };
+}
+function toHex(value) {
+  return Buffer.from(value, "utf8").toString("hex");
+}
+function quoteForStdin(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function writeKeychainSecret(envVar, value) {
+  const unsupported = keychainUnavailableReason();
+  if (unsupported)
+    throw new KeychainError(`Cannot write ${envVar}: ${unsupported}`);
+  if (!isValidKeychainVarName(envVar)) {
+    throw new KeychainError(`Cannot write "${envVar}": not a valid environment variable name`);
+  }
+  const unstorable = describeUnstorableValue(value);
+  if (unstorable)
+    throw new KeychainError(`Cannot store ${envVar}: ${unstorable}`);
+  invalidateKeychainCache();
+  const cmd = [
+    "add-generic-password",
+    "-s",
+    quoteForStdin(KEYCHAIN_SERVICE),
+    "-a",
+    quoteForStdin(envVar),
+    "-l",
+    quoteForStdin(`${KEYCHAIN_SERVICE}: ${envVar}`),
+    "-D",
+    quoteForStdin("application password"),
+    "-j",
+    quoteForStdin("Stored by claudish"),
+    "-X",
+    quoteForStdin(toHex(value)),
+    "-U",
+    "-T",
+    quoteForStdin(SECURITY_BIN),
+    ...keychainFileArgs().map(quoteForStdin)
+  ].join(" ");
+  const res = deps.run(["-i"], `${cmd}
+`);
+  if (res.code !== 0) {
+    throw new KeychainError(`Failed to store ${envVar} in the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+  }
+  invalidateKeychainCache();
+  const readBack = readKeychainSecret(envVar);
+  if (readBack !== value) {
+    throw new KeychainError(`Keychain write for ${envVar} did not round-trip \u2014 the stored value differs from what was written. ` + "The item may exceed the keychain's size limit; nothing should be assumed saved.");
+  }
+}
+function deleteKeychainSecret(envVar) {
+  if (!isKeychainSupported())
+    return false;
+  invalidateKeychainCache();
+  const res = deps.run([
+    "delete-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    envVar,
+    ...keychainFileArgs()
+  ]);
+  invalidateKeychainCache();
+  if (res.code === 0)
+    return true;
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return false;
+  throw new KeychainError(`Failed to delete ${envVar} from the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+}
+function valueTail2(value) {
+  if (value.length <= 6)
+    return "\u2022\u2022\u2022\u2022";
+  return `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
+}
+var KEYCHAIN_SERVICE = "claudish", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, defaultDeps, deps, listMemo = null, valueMemo, CONTROL_CHARS, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH;
+var init_keychain = __esm(() => {
+  KeychainError = class KeychainError extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+      super(message);
+      this.exitCode = exitCode;
+      this.name = "KeychainError";
+    }
+  };
+  defaultDeps = {
+    platform: () => process.platform,
+    run: syncRun,
+    runAsync: asyncRun,
+    spawnAsync: spawnAsyncRun
+  };
+  deps = defaultDeps;
+  valueMemo = new Map;
+  CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
+  ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+  ACCT_ATTR = /"acct"<blob>=(?:0x[0-9A-Fa-f]*\s+)?"([^"]*)"/;
+  SVCE_MATCH = `"svce"<blob>="${KEYCHAIN_SERVICE}"`;
+});
+
 // src/auth/antigravity-client-version.ts
 function getAgyClientVersion() {
   return version;
@@ -10999,6 +11314,46 @@ function defaultReadAgyVersion() {
     return null;
   }
 }
+function defaultAntigravityTokenDeps() {
+  return { ...defaultDeps2 };
+}
+async function raceDeadline(work, deadlineAt) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), Math.max(0, deadlineAt - Date.now()));
+  });
+  try {
+    return await Promise.race([work, timedOut]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function classifyKeychainFailure(code) {
+  return KEYCHAIN_LOCKED_EXIT_CODES.has(code) ? { kind: "locked" } : { kind: "failed" };
+}
+async function readAntigravityStoreClassified(deadlineMs) {
+  if (process.env.CLAUDISH_DISABLE_KEYCHAIN === "1")
+    return { kind: "failed" };
+  const deadlineAt = Date.now() + deadlineMs;
+  const query = { service: KC_SERVICE, account: KC_ACCOUNT };
+  const presence = await raceDeadline(findGenericPasswordPresence(query), deadlineAt);
+  if (presence === "timeout")
+    return { kind: "timeout" };
+  if (presence.kind === "absent")
+    return { kind: "absent" };
+  if (presence.kind === "failed")
+    return classifyKeychainFailure(presence.code);
+  const read = await raceDeadline(startGenericPasswordRead(query).done, deadlineAt);
+  if (read === "timeout")
+    return { kind: "timeout" };
+  if (read.kind === "absent")
+    return { kind: "absent" };
+  if (read.kind === "failed")
+    return classifyKeychainFailure(read.code);
+  const raw = (read.value ?? "").trim();
+  return raw.length > 0 ? { kind: "present", raw } : { kind: "absent" };
+}
 function parseRecord(raw) {
   if (!raw)
     return null;
@@ -11020,11 +11375,11 @@ function parseRecord(raw) {
 function encodeRecord(rec) {
   return PREFIX + Buffer.from(JSON.stringify(rec), "utf8").toString("base64");
 }
-function readSharedAntigravityToken(deps = defaultDeps) {
+function readSharedAntigravityToken(deps = defaultDeps2) {
   const rec = parseRecord(deps.readStore());
   return rec ? rec.token : null;
 }
-function hasSharedAntigravityToken(deps = defaultDeps) {
+function hasSharedAntigravityToken(deps = defaultDeps2) {
   const now = Date.now();
   if (cachedHasToken && now - cachedHasToken.at < HAS_TOKEN_TTL_MS)
     return cachedHasToken.value;
@@ -11037,7 +11392,7 @@ function hasSharedAntigravityToken(deps = defaultDeps) {
   cachedHasToken = { at: now, value };
   return value;
 }
-function writeSharedAntigravityToken(tok, deps = defaultDeps) {
+function writeSharedAntigravityToken(tok, deps = defaultDeps2) {
   const existing = parseRecord(deps.readStore());
   const base = existing ?? { token: tok };
   const merged = {
@@ -11046,7 +11401,7 @@ function writeSharedAntigravityToken(tok, deps = defaultDeps) {
   };
   deps.writeStore(encodeRecord(merged));
 }
-function deleteSharedAntigravityToken(deps = defaultDeps) {
+function deleteSharedAntigravityToken(deps = defaultDeps2) {
   (deps.deleteStore ?? defaultDeleteStore)();
   _resetAntigravityTokenState();
 }
@@ -11107,7 +11462,7 @@ function describeRefreshFailure(outcome) {
       return "The Antigravity session is expired and the Antigravity CLI refreshed it without " + "producing a valid token \u2014 the session has most likely been revoked. " + "Run `claudish login antigravity`.";
   }
 }
-function getValidAntigravityAccessToken(deps = defaultDeps) {
+function getValidAntigravityAccessToken(deps = defaultDeps2) {
   if (inFlight)
     return inFlight;
   inFlight = resolveValidToken(deps).finally(() => {
@@ -11115,7 +11470,7 @@ function getValidAntigravityAccessToken(deps = defaultDeps) {
   });
   return inFlight;
 }
-async function forceRefreshAntigravityToken(deps = defaultDeps) {
+async function forceRefreshAntigravityToken(deps = defaultDeps2) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
@@ -11156,10 +11511,11 @@ function _resetAntigravityTokenState() {
   cachedHasToken = null;
   invalidateReadStoreMemo();
 }
-var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
+var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps2, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
 var init_antigravity_token = __esm(() => {
   init_logger();
-  defaultDeps = {
+  init_keychain();
+  defaultDeps2 = {
     readStore: defaultReadStore,
     writeStore: defaultWriteStore,
     deleteStore: defaultDeleteStore,
@@ -11167,6 +11523,7 @@ var init_antigravity_token = __esm(() => {
     readAgyVersion: defaultReadAgyVersion,
     now: () => Date.now()
   };
+  KEYCHAIN_LOCKED_EXIT_CODES = new Set([36, 51, 128]);
 });
 
 // src/auth/antigravity-user.ts
@@ -11182,11 +11539,18 @@ function makeTerminalSetupError(message) {
   err.terminal = true;
   return err;
 }
+function resolveAntigravityClientVersion() {
+  const agy = getAgyClientVersion();
+  return agy ? { version: agy, source: "agy" } : { version: AGY_FALLBACK_CLIENT_VERSION, source: "fallback" };
+}
 function antigravityClientVersion() {
-  return getAgyClientVersion() ?? AGY_FALLBACK_CLIENT_VERSION;
+  return resolveAntigravityClientVersion().version;
+}
+function userAgentFor(version) {
+  return `antigravity/cli/${version} (aidev_client; os_type=${process.platform}; arch=${process.arch}; auth_method=consumer)`;
 }
 function buildAntigravityUserAgent() {
-  return `antigravity/cli/${antigravityClientVersion()} (aidev_client; os_type=${process.platform}; arch=${process.arch}; auth_method=consumer)`;
+  return userAgentFor(antigravityClientVersion());
 }
 function resetAntigravityUserCache() {
   cachedAgProjectId = null;
@@ -11278,6 +11642,45 @@ function flattenAgentModelSorts(sorts) {
   }
   return ids.length > 0 ? ids : undefined;
 }
+async function fetchAntigravityAvailableModelsRaw(accessToken, projectId, opts) {
+  const url = `${apiBase()}:fetchAvailableModels`;
+  const { version, source } = resolveAntigravityClientVersion();
+  const base = {
+    url,
+    clientVersion: version,
+    clientVersionSource: source
+  };
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+        "User-Agent": userAgentFor(version)
+      },
+      body: JSON.stringify({ project: projectId }),
+      ...opts?.signal ? { signal: opts.signal } : {}
+    });
+  } catch (error) {
+    return { ...base, kind: "unreachable", error };
+  }
+  const fetchedAt = new Date((opts?.now ?? Date.now)()).toISOString();
+  const answered = { ...base, kind: "answered", status: res.status, fetchedAt };
+  if (!res.ok)
+    return { ...answered, body: { kind: "unread" } };
+  let text;
+  try {
+    text = await res.text();
+  } catch {
+    return { ...answered, body: { kind: "read-failed" } };
+  }
+  try {
+    return { ...answered, body: { kind: "json", text, value: JSON.parse(text) } };
+  } catch {
+    return { ...answered, body: { kind: "not-json" } };
+  }
+}
 async function getServedAntigravityModels(accessToken, projectId, opts) {
   const now = Date.now();
   const version = antigravityClientVersion();
@@ -11290,17 +11693,15 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
     return agServedCache;
   }
   try {
-    const res = await fetch(`${apiBase()}:fetchAvailableModels`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
-        "User-Agent": buildAntigravityUserAgent()
-      },
-      body: JSON.stringify({ project: projectId })
-    });
-    if (res.ok) {
-      const data = await res.json();
+    const raw = await fetchAntigravityAvailableModelsRaw(accessToken, projectId);
+    if (raw.kind === "unreachable") {
+      log(`[Antigravity] fetchAvailableModels error: ${raw.error}`);
+    } else if (raw.status < 200 || raw.status >= 300) {
+      log(`[Antigravity] fetchAvailableModels failed: ${raw.status}`);
+    } else if (raw.body.kind !== "json") {
+      log(`[Antigravity] fetchAvailableModels error: ${raw.body.kind === "not-json" ? "the body is not JSON" : "the body could not be read"}`);
+    } else {
+      const data = raw.body.value;
       const servedIds = data.models ? Object.keys(data.models) : [];
       const defaultId = typeof data.defaultAgentModelId === "string" ? data.defaultAgentModelId : null;
       if (servedIds.length > 0) {
@@ -11347,11 +11748,9 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
           ...agentModelIds ? { agentModelIds } : {}
         };
         agServedCacheAt = now;
-        agServedCacheVersion = version;
+        agServedCacheVersion = raw.clientVersion;
         return agServedCache;
       }
-    } else {
-      log(`[Antigravity] fetchAvailableModels failed: ${res.status}`);
     }
   } catch (err) {
     log(`[Antigravity] fetchAvailableModels error: ${err}`);
@@ -12914,7 +13313,7 @@ async function performRefresh(cred) {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body,
-      signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
+      signal: AbortSignal.timeout(refreshTimeoutMs)
     });
   } catch (error) {
     throw Object.assign(new Error(`Could not reach ${tokenEndpoint} to refresh the Grok token: ${error.message}`, { cause: markOwnTimeout(error) }), { claudishEndpoint: tokenEndpoint });
@@ -12980,13 +13379,14 @@ function refreshShared(cred) {
   }
   return refreshInFlight;
 }
-var GROK_PROXY_URL_ENV = "GROK_PROXY_URL", DEFAULT_GROK_PROXY_URL = "https://cli-chat-proxy.grok.com/v1", GROK_CLIENT_IDENTIFIER = "grok-shell", FALLBACK_GROK_CLIENT_VERSION = "1.0.4", LEGACY_SCOPE = "https://accounts.x.ai/sign-in", EXPIRY_SKEW_MS2, grokHomeOverride = null, claudishOAuthPathOverride = null, GROK_CHANNEL_URL = "https://x.ai/cli/stable", liveClientVersion = null, SIGN_IN_HINT, refreshInFlight = null;
+var GROK_PROXY_URL_ENV = "GROK_PROXY_URL", DEFAULT_GROK_PROXY_URL = "https://cli-chat-proxy.grok.com/v1", GROK_CLIENT_IDENTIFIER = "grok-shell", FALLBACK_GROK_CLIENT_VERSION = "1.0.4", LEGACY_SCOPE = "https://accounts.x.ai/sign-in", EXPIRY_SKEW_MS2, grokHomeOverride = null, claudishOAuthPathOverride = null, GROK_CHANNEL_URL = "https://x.ai/cli/stable", liveClientVersion = null, SIGN_IN_HINT, refreshInFlight = null, refreshTimeoutMs;
 var init_grok_credentials = __esm(() => {
   init_grok_oauth();
   init_connection_error();
   init_transient_retry();
   EXPIRY_SKEW_MS2 = 5 * 60 * 1000;
   SIGN_IN_HINT = "Run `claudish login grok` (no Grok CLI required \u2014 SuperGrok or X Premium+ subscription). " + "An existing `grok login` (~/.grok/auth.json) is also picked up automatically.";
+  refreshTimeoutMs = TOKEN_REFRESH_TIMEOUT_MS;
 });
 
 // src/auth/quota/sources/grok.ts
@@ -13269,7 +13669,7 @@ function createGeminiThoughtSignatureHook() {
     description: "Sends Gemini's reasoning_details back with the assistant tool calls they were produced for",
     order: "pre",
     models: ["*gemini*", "*google/*"],
-    selectByUpstream: (upstream) => upstream.wireApi === "gemini" || upstream.vendor === "google",
+    selectByUpstream: { wireApis: ["gemini"], vendors: ["google"] },
     routes: "all",
     defaultSeverity: "fix",
     statsName: GEMINI_THOUGHT_SIGNATURE_STATS_NAME,
@@ -16959,7 +17359,7 @@ var init_errors2 = __esm(() => {
 });
 
 // ../../node_modules/.bun/zod@4.1.13/node_modules/zod/v4/classic/parse.js
-var parse4, parseAsync2, safeParse2, safeParseAsync2, encode, decode, encodeAsync, decodeAsync, safeEncode, safeDecode, safeEncodeAsync, safeDecodeAsync;
+var parse4, parseAsync2, safeParse2, safeParseAsync2, encode, decode2, encodeAsync, decodeAsync, safeEncode, safeDecode, safeEncodeAsync, safeDecodeAsync;
 var init_parse2 = __esm(() => {
   init_core2();
   init_errors2();
@@ -16968,7 +17368,7 @@ var init_parse2 = __esm(() => {
   safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
   safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
   encode = /* @__PURE__ */ _encode(ZodRealError);
-  decode = /* @__PURE__ */ _decode(ZodRealError);
+  decode2 = /* @__PURE__ */ _decode(ZodRealError);
   encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
   decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
   safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -17173,7 +17573,7 @@ var init_schemas2 = __esm(() => {
     inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
     inst.spa = inst.safeParseAsync;
     inst.encode = (data, params) => encode(inst, data, params);
-    inst.decode = (data, params) => decode(inst, data, params);
+    inst.decode = (data, params) => decode2(inst, data, params);
     inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);
     inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);
     inst.safeEncode = (data, params) => safeEncode(inst, data, params);
@@ -18426,7 +18826,17 @@ async function prune(path) {
   await rename(tmp, path);
   log(`[behavior:journal] pruned ${lines.length - survivors.length} of ${lines.length} entries ` + `to stay under ${Math.round(MAX_JOURNAL_BYTES / 1e6)}MB`);
 }
-async function recordDecision(entry, path = journalPath()) {
+function recordDecision(entry, path = journalPath()) {
+  const previous = pendingAppends.get(path) ?? Promise.resolve();
+  const next = previous.then(() => appendDecision(entry, path));
+  pendingAppends.set(path, next);
+  next.then(() => {
+    if (pendingAppends.get(path) === next)
+      pendingAppends.delete(path);
+  });
+  return next;
+}
+async function appendDecision(entry, path) {
   try {
     const size = await stat(path).then((s) => s.size, () => 0);
     if (size === 0)
@@ -18440,7 +18850,7 @@ async function recordDecision(entry, path = journalPath()) {
     log(`[behavior:journal] could not record: ${err}`);
   }
 }
-var JOURNAL_SCHEMA_VERSION = 2, UPLOAD_SURFACES, UPLOAD_DECISIONS, MAX_DETAIL_CHARS = 200, MAX_JOURNAL_BYTES, PRUNE_TO_BYTES;
+var JOURNAL_SCHEMA_VERSION = 2, UPLOAD_SURFACES, UPLOAD_DECISIONS, MAX_DETAIL_CHARS = 200, MAX_JOURNAL_BYTES, PRUNE_TO_BYTES, pendingAppends;
 var init_journal = __esm(() => {
   init_logger();
   UPLOAD_SURFACES = new Set([
@@ -18458,6 +18868,7 @@ var init_journal = __esm(() => {
   ]);
   MAX_JOURNAL_BYTES = 32 * 1024 * 1024;
   PRUNE_TO_BYTES = Math.floor(MAX_JOURNAL_BYTES * 0.6);
+  pendingAppends = new Map;
 });
 
 // src/hooks/output-capture.ts
@@ -19650,6 +20061,9 @@ var init_loader = __esm(() => {
 function isProxyEvent(event) {
   return PROXY_EVENTS.has(event);
 }
+function upstreamSelected(selector, upstream) {
+  return upstream.wireApi !== null && selector.wireApis.includes(upstream.wireApi) || upstream.vendor !== null && selector.vendors.includes(upstream.vendor);
+}
 function eventsOf(def) {
   const events = [];
   const on = def.on ?? {};
@@ -19744,7 +20158,7 @@ function routeMatches(hook, route, upstream) {
   if (hook.routes === "foreign" && route.native)
     return false;
   if (upstream && hook.selectByUpstream)
-    return hook.selectByUpstream(upstream);
+    return upstreamSelected(hook.selectByUpstream, upstream);
   return hook.models.some((glob) => globMatches(glob, route.modelId));
 }
 var CLOSED_HANDLER_KEYS, RAW_KEYS2, PROXY_EVENTS, ORDER_RANK;
@@ -22936,324 +23350,6 @@ var init_antigravity_credential = __esm(() => {
   init_antigravity_user();
 });
 
-// src/providers/keychain.ts
-function syncRun(args, stdin) {
-  try {
-    const proc = Bun.spawnSync([SECURITY_BIN, ...args], {
-      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: SPAWN_TIMEOUT_MS
-    });
-    return normalizeResult(proc.exitCode, proc.signalCode, decode2(proc.stdout), decode2(proc.stderr));
-  } catch (err) {
-    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
-  }
-}
-async function asyncRun(args, stdin) {
-  try {
-    const proc = Bun.spawn([SECURITY_BIN, ...args], {
-      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: SPAWN_TIMEOUT_MS
-    });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]);
-    return normalizeResult(exitCode, proc.signalCode, stdout, stderr);
-  } catch (err) {
-    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
-  }
-}
-function spawnAsyncRun(args, stdin) {
-  try {
-    const proc = Bun.spawn([SECURITY_BIN, ...args], {
-      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const done = Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]).then(([stdout, stderr, exitCode]) => normalizeResult(exitCode, proc.signalCode, stdout, stderr), (err) => ({
-      code: 1,
-      stdout: "",
-      stderr: err instanceof Error ? err.message : String(err)
-    }));
-    return { done, pid: proc.pid };
-  } catch (err) {
-    return {
-      done: Promise.resolve({
-        code: 1,
-        stdout: "",
-        stderr: err instanceof Error ? err.message : String(err)
-      }),
-      pid: undefined
-    };
-  }
-}
-function decode2(buf) {
-  return buf ? new TextDecoder().decode(buf) : "";
-}
-function normalizeResult(exitCode, signalCode, stdout, stderr) {
-  if (typeof exitCode === "number")
-    return { code: exitCode, stdout, stderr };
-  const detail = signalCode ? `killed by ${signalCode}` : "terminated without an exit code";
-  return { code: -1, stdout, stderr: stderr.trim() || `security ${detail}` };
-}
-function invalidateKeychainCache() {
-  listMemo = null;
-  valueMemo.clear();
-}
-function now() {
-  return Date.now();
-}
-function isValidKeychainVarName(name) {
-  return ENV_VAR_NAME.test(name);
-}
-function describeUnstorableValue(value) {
-  if (value.length === 0)
-    return "value is empty";
-  if (CONTROL_CHARS.test(value)) {
-    return "value contains control characters (tab/newline/etc), which the keychain read path cannot represent unambiguously";
-  }
-  return null;
-}
-function isKeychainSupported() {
-  return deps.platform() === "darwin";
-}
-function keychainUnavailableReason() {
-  if (!isKeychainSupported()) {
-    return `the macOS Keychain is only available on macOS (this is ${deps.platform()})`;
-  }
-  return null;
-}
-function stripOneTrailingNewline(out) {
-  return out.endsWith(`
-`) ? out.slice(0, -1) : out;
-}
-function keychainFileArgs() {
-  const file = process.env.CLAUDISH_KEYCHAIN_FILE;
-  return file ? [file] : [];
-}
-function findArgs(envVar) {
-  return [
-    "find-generic-password",
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-a",
-    envVar,
-    "-w",
-    ...keychainFileArgs()
-  ];
-}
-function interpretRead(envVar, res) {
-  if (res.code === 0) {
-    const value = stripOneTrailingNewline(res.stdout);
-    return value.length > 0 ? value : null;
-  }
-  if (res.code === EXIT_ITEM_NOT_FOUND)
-    return null;
-  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
-}
-function readKeychainSecret(envVar) {
-  if (!isKeychainSupported())
-    return null;
-  const cached = valueMemo.get(envVar);
-  const at = now();
-  if (cached && at - cached.at < MEMO_TTL_MS)
-    return cached.value;
-  const value = interpretRead(envVar, deps.run(findArgs(envVar)));
-  valueMemo.set(envVar, { at, value });
-  return value;
-}
-async function readKeychainSecretAsync(envVar) {
-  if (!isKeychainSupported())
-    return null;
-  const cached = valueMemo.get(envVar);
-  const at = now();
-  if (cached && at - cached.at < MEMO_TTL_MS)
-    return cached.value;
-  const value = interpretRead(envVar, await deps.runAsync(findArgs(envVar)));
-  valueMemo.set(envVar, { at, value });
-  return value;
-}
-function genericPasswordArgs(query, withValue) {
-  return [
-    "find-generic-password",
-    "-s",
-    query.service,
-    ...query.account !== undefined ? ["-a", query.account] : [],
-    ...withValue ? ["-w"] : [],
-    ...query.keychainFile !== undefined ? [query.keychainFile] : keychainFileArgs()
-  ];
-}
-function interpretGenericPassword(res, withValue) {
-  if (res.code === 0) {
-    if (!withValue)
-      return { kind: "found" };
-    const value = stripOneTrailingNewline(res.stdout);
-    return value.length > 0 ? { kind: "found", value } : { kind: "absent" };
-  }
-  if (res.code === EXIT_ITEM_NOT_FOUND)
-    return { kind: "absent" };
-  return {
-    kind: "failed",
-    code: res.code,
-    error: res.stderr.trim() || `security exited ${res.code}`
-  };
-}
-async function findGenericPasswordPresence(query) {
-  if (!isKeychainSupported())
-    return { kind: "absent" };
-  const res = await deps.spawnAsync(genericPasswordArgs(query, false)).done;
-  return interpretGenericPassword(res, false);
-}
-function startGenericPasswordRead(query) {
-  if (!isKeychainSupported()) {
-    return { done: Promise.resolve({ kind: "absent" }), pid: undefined };
-  }
-  const spawn = deps.spawnAsync(genericPasswordArgs(query, true));
-  return { done: spawn.done.then((res) => interpretGenericPassword(res, true)), pid: spawn.pid };
-}
-function enumerateKeychainVars() {
-  if (!isKeychainSupported())
-    return { names: [], failed: false };
-  const at = now();
-  if (listMemo && at - listMemo.at < MEMO_TTL_MS)
-    return listMemo.value;
-  const res = deps.run(["dump-keychain", ...keychainFileArgs()]);
-  const value = res.code === 0 ? { names: parseDumpAccounts(res.stdout), failed: false } : {
-    names: [],
-    failed: true,
-    error: res.stderr.trim() || `security exited ${res.code}`
-  };
-  listMemo = { at, value };
-  return value;
-}
-function listKeychainVars() {
-  return enumerateKeychainVars().names;
-}
-function parseDumpAccounts(dump) {
-  const found = new Set;
-  for (const block of dump.split(/\nkeychain: /)) {
-    if (!block.includes(SVCE_MATCH))
-      continue;
-    const m = block.match(ACCT_ATTR);
-    if (m?.[1] && isValidKeychainVarName(m[1]))
-      found.add(m[1]);
-  }
-  return Array.from(found).sort();
-}
-function lookupKeychainVar(envVar) {
-  if (!isKeychainSupported())
-    return { present: false, failed: false };
-  const cached = valueMemo.get(envVar);
-  if (cached && now() - cached.at < MEMO_TTL_MS && cached.value !== null) {
-    return { present: true, failed: false };
-  }
-  const listed = enumerateKeychainVars();
-  return { present: listed.names.includes(envVar), failed: listed.failed };
-}
-function toHex(value) {
-  return Buffer.from(value, "utf8").toString("hex");
-}
-function quoteForStdin(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-function writeKeychainSecret(envVar, value) {
-  const unsupported = keychainUnavailableReason();
-  if (unsupported)
-    throw new KeychainError(`Cannot write ${envVar}: ${unsupported}`);
-  if (!isValidKeychainVarName(envVar)) {
-    throw new KeychainError(`Cannot write "${envVar}": not a valid environment variable name`);
-  }
-  const unstorable = describeUnstorableValue(value);
-  if (unstorable)
-    throw new KeychainError(`Cannot store ${envVar}: ${unstorable}`);
-  invalidateKeychainCache();
-  const cmd = [
-    "add-generic-password",
-    "-s",
-    quoteForStdin(KEYCHAIN_SERVICE),
-    "-a",
-    quoteForStdin(envVar),
-    "-l",
-    quoteForStdin(`${KEYCHAIN_SERVICE}: ${envVar}`),
-    "-D",
-    quoteForStdin("application password"),
-    "-j",
-    quoteForStdin("Stored by claudish"),
-    "-X",
-    quoteForStdin(toHex(value)),
-    "-U",
-    "-T",
-    quoteForStdin(SECURITY_BIN),
-    ...keychainFileArgs().map(quoteForStdin)
-  ].join(" ");
-  const res = deps.run(["-i"], `${cmd}
-`);
-  if (res.code !== 0) {
-    throw new KeychainError(`Failed to store ${envVar} in the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
-  }
-  invalidateKeychainCache();
-  const readBack = readKeychainSecret(envVar);
-  if (readBack !== value) {
-    throw new KeychainError(`Keychain write for ${envVar} did not round-trip \u2014 the stored value differs from what was written. ` + "The item may exceed the keychain's size limit; nothing should be assumed saved.");
-  }
-}
-function deleteKeychainSecret(envVar) {
-  if (!isKeychainSupported())
-    return false;
-  invalidateKeychainCache();
-  const res = deps.run([
-    "delete-generic-password",
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-a",
-    envVar,
-    ...keychainFileArgs()
-  ]);
-  invalidateKeychainCache();
-  if (res.code === 0)
-    return true;
-  if (res.code === EXIT_ITEM_NOT_FOUND)
-    return false;
-  throw new KeychainError(`Failed to delete ${envVar} from the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
-}
-function valueTail2(value) {
-  if (value.length <= 6)
-    return "\u2022\u2022\u2022\u2022";
-  return `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
-}
-var KEYCHAIN_SERVICE = "claudish", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, defaultDeps2, deps, listMemo = null, valueMemo, CONTROL_CHARS, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH;
-var init_keychain = __esm(() => {
-  KeychainError = class KeychainError extends Error {
-    exitCode;
-    constructor(message, exitCode) {
-      super(message);
-      this.exitCode = exitCode;
-      this.name = "KeychainError";
-    }
-  };
-  defaultDeps2 = {
-    platform: () => process.platform,
-    run: syncRun,
-    runAsync: asyncRun,
-    spawnAsync: spawnAsyncRun
-  };
-  deps = defaultDeps2;
-  valueMemo = new Map;
-  CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
-  ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-  ACCT_ATTR = /"acct"<blob>=(?:0x[0-9A-Fa-f]*\s+)?"([^"]*)"/;
-  SVCE_MATCH = `"svce"<blob>="${KEYCHAIN_SERVICE}"`;
-});
-
 // src/auth/credentials/local-api-key.ts
 function resolveLocalApiKey(q) {
   return realValue(process.env[q.envVar]) || (q.aliases ?? []).map((a) => realValue(process.env[a])).find((v) => !!v) || realValue(getApiKey(q.envVar));
@@ -67956,6 +68052,9 @@ ${h("SUBCOMMANDS")}
   ${green("claudish providers")} ${yellow("[--json]")}             Show provider credential status (no key material)
   ${green("claudish quota")} ${yellow("[provider]")}              Show remaining quota/usage (alias: usage)
   ${green("claudish serve")} ${yellow("--port <n> --models <p>")}  Run the Claude Desktop redirect gateway
+  ${green("claudish subscription models antigravity")} ${yellow("--raw --json")}
+                                          Print the raw Antigravity fetchAvailableModels
+                                          ${dim("body as one JSON line (for models-index)")}
   ${green("claudish update")}                        Check for updates and install the latest version
 
   ${bold("Profiles:")}
@@ -69366,6 +69465,7 @@ var init_pane_launch = __esm(() => {
     "serve",
     "providers",
     "keychain",
+    "subscription",
     "hooks",
     "team",
     "login",
@@ -72085,6 +72185,7 @@ class PaneSessionImpl {
   stderrHead = "";
   paneClosed = false;
   paneExited = false;
+  exitCodeQuery = false;
   reaping = false;
   fastReap = false;
   reapPromise = null;
@@ -72595,7 +72696,7 @@ class PaneSessionImpl {
     }
   }
   checkLiveness() {
-    if (this.client || !this.panePidValue || this.paneExited)
+    if (this.client || !this.panePidValue || this.paneExited || this.exitCodeQuery)
       return;
     const now = Date.now();
     if (now - this.lastLivenessAt < 1000)
@@ -72605,11 +72706,55 @@ class PaneSessionImpl {
       process.kill(this.panePidValue, 0);
     } catch (e) {
       if (e.code === "ESRCH") {
-        this.paneExited = true;
-        this.applyExitPath(null);
+        this.exitCodeQuery = true;
+        this.exitCodeFromMagmux().then((code) => {
+          this.exitCodeQuery = false;
+          if (this.paneExited || isTerminalPhase(this.phase))
+            return;
+          this.paneExited = true;
+          this.exitCode = code;
+          this.step(() => this.applyExitPath(code));
+        });
       }
     }
   }
+  async exitCodeFromMagmux() {
+    const deadline = Date.now() + EXIT_CODE_QUERY_MS;
+    const left = () => deadline - Date.now();
+    const client = await this.dialWithin(left);
+    if (!client)
+      return null;
+    try {
+      while (left() > 0) {
+        const r = await client.request({ type: "list" }, Math.max(1, left()));
+        if (!r.ok)
+          return null;
+        const p0 = r.result.panes?.find((p) => p.pane === 0);
+        if (!p0)
+          return null;
+        if (p0.dead === true)
+          return typeof p0.exitCode === "number" ? p0.exitCode : null;
+        await Bun.sleep(Math.min(EXIT_CODE_RETRY_MS, Math.max(0, left())));
+      }
+      return null;
+    } finally {
+      client.close();
+    }
+  }
+  async dialWithin(left) {
+    while (left() > 0 && !this.reaping && !isTerminalPhase(this.phase)) {
+      try {
+        const dial = MagmuxClient.dial(this.sockPath);
+        const client = await Promise.race([dial, Bun.sleep(Math.max(0, left())).then(() => null)]);
+        if (!client)
+          dial.then((late) => late.close()).catch(() => {});
+        return client;
+      } catch {
+        await Bun.sleep(Math.min(EXIT_CODE_RETRY_MS, Math.max(0, left())));
+      }
+    }
+    return null;
+  }
   t(key, dflt) {
     return this.o.timings?.[key] ?? dflt;
   }
@@ -74558,7 +74703,7 @@ async function startPaneSession(o) {
   await session.start({ magmuxBinary: magmux.binary, env: p.magmuxEnv, cwd: p.cwd });
   return session;
 }
-var BOOT_TIMEOUT_MS = 90000, ADMIT_TIMEOUT_MS = 30000, DEGRADED_ENTRY_MS = 1e4, SCREEN_SETTLE_QUIET_MS = 3000, PANEL_SETTLE_MS = 500, SEND_CLIENT_SLACK_MS = 2000, MIN_READY_TIMEOUT_MS = 1000, BUSY_RETRY_MS = 250, MISMATCH_SETTLE_MS = 1000, CLEAR_WAIT_MS = 1000, BOOT_STATIC_MS = 5000, TICK_MS = 250, WATCH_FPS = 4, POLL_BACKSTOP_MS = 1000, TURN_END_MISSING_FACTOR = 3, RESIZE_REPLY_MS = 1e4, RESIZE_SCREEN_MS = 1000, GATE_POLL_MS = 250, GATE_REPLY_MS = 1000, GATE_STALE_MS = 1000, GATE_GRACE_MS, GATE_DEAD_BACKSTOP_MS = 1000, GATE_KINDLESS_REASONS, RUNTIME_DIALOG_KINDS, REGISTRY_READ_MS = 250, REGISTRY_DISAGREE_MS = 2000, REGISTRY_GATE_BOOT_DISAGREE_MS = 5000, REGISTRY_MISSING_MS = 5000, MAX_ANOMALY_KEYS = 64, KEPT_ANSWERS = 4, DEFAULT_MAX_CONSECUTIVE = 3, EVENT_REASON, VERDICT_EVENT, PaneStartError;
+var BOOT_TIMEOUT_MS = 90000, ADMIT_TIMEOUT_MS = 30000, DEGRADED_ENTRY_MS = 1e4, SCREEN_SETTLE_QUIET_MS = 3000, PANEL_SETTLE_MS = 500, SEND_CLIENT_SLACK_MS = 2000, MIN_READY_TIMEOUT_MS = 1000, BUSY_RETRY_MS = 250, MISMATCH_SETTLE_MS = 1000, CLEAR_WAIT_MS = 1000, BOOT_STATIC_MS = 5000, TICK_MS = 250, WATCH_FPS = 4, POLL_BACKSTOP_MS = 1000, TURN_END_MISSING_FACTOR = 3, RESIZE_REPLY_MS = 1e4, RESIZE_SCREEN_MS = 1000, GATE_POLL_MS = 250, GATE_REPLY_MS = 1000, GATE_STALE_MS = 1000, GATE_GRACE_MS, GATE_DEAD_BACKSTOP_MS = 1000, EXIT_CODE_QUERY_MS = 2000, EXIT_CODE_RETRY_MS = 50, GATE_KINDLESS_REASONS, RUNTIME_DIALOG_KINDS, REGISTRY_READ_MS = 250, REGISTRY_DISAGREE_MS = 2000, REGISTRY_GATE_BOOT_DISAGREE_MS = 5000, REGISTRY_MISSING_MS = 5000, MAX_ANOMALY_KEYS = 64, KEPT_ANSWERS = 4, DEFAULT_MAX_CONSECUTIVE = 3, EVENT_REASON, VERDICT_EVENT, PaneStartError;
 var init_pane_session = __esm(() => {
   init_queue();
   init_parent_session();
@@ -79759,10 +79904,26 @@ function hookRow(hook, severity) {
     severity,
     routes: hook.routes,
     models: [...hook.models],
+    ...hook.selectByUpstream && {
+      catalogSelection: {
+        wireApis: [...hook.selectByUpstream.wireApis],
+        vendors: [...hook.selectByUpstream.vendors]
+      }
+    },
     order: hook.order,
     unsafe: hook.unsafe
   };
 }
+function selectionOf(r) {
+  const globs = r.models.join(", ");
+  if (!r.catalogSelection)
+    return r.models.join(",") !== "*" ? `models ${globs}` : null;
+  const facts = [
+    ...r.catalogSelection.wireApis.map((w) => `wire ${w}`),
+    ...r.catalogSelection.vendors.map((v) => `vendor ${v}`)
+  ].join(" or ");
+  return `catalog ${facts}; without a catalog connection, models ${globs}`;
+}
 async function list(json) {
   const set = await loadHookSet({ hostMode: "other", moduleWarn: () => {} });
   const rows = set.registry.hooks.map((h) => hookRow(h, set.registry.severityOf(h)));
@@ -79789,7 +79950,7 @@ Hooks, in effective order
       `${r.source}`,
       `events ${r.events.join(", ")}`,
       `routes ${r.routes}`,
-      r.models.join(",") !== "*" ? `models ${r.models.join(", ")}` : null,
+      selectionOf(r),
       r.order !== "normal" ? `order ${r.order}` : null
     ].filter(Boolean);
     console.log(`  ${dim2(scope.join(" \xB7 "))}
@@ -81018,6 +81179,364 @@ var init_keychain_command = __esm(() => {
   VALUE_FLAGS = new Set(["--config", "--from", "--only"]);
 });
 
+// src/subscription-models-command.ts
+var exports_subscription_models_command = {};
+__export(exports_subscription_models_command, {
+  EXIT: () => EXIT,
+  FAILURE_CODES: () => FAILURE_CODES,
+  INTERNAL_ERROR_MESSAGE: () => INTERNAL_ERROR_MESSAGE,
+  SECRET_GUARD_MESSAGE: () => SECRET_GUARD_MESSAGE,
+  SUBSCRIPTION_MODELS_USAGE: () => SUBSCRIPTION_MODELS_USAGE,
+  SUBSCRIPTION_MODEL_LIST_SCHEMA: () => SUBSCRIPTION_MODEL_LIST_SCHEMA,
+  defaultSubscriptionModelsDeps: () => defaultSubscriptionModelsDeps,
+  exitCodeFor: () => exitCodeFor,
+  parseSubscriptionModelsArgs: () => parseSubscriptionModelsArgs,
+  reportSubscriptionInternalError: () => reportSubscriptionInternalError,
+  runAntigravityRawModelList: () => runAntigravityRawModelList,
+  subscriptionModelsCommand: () => subscriptionModelsCommand
+});
+function exitCodeFor(failure) {
+  if (failure.class === "internal")
+    return failure.code === "usage" ? EXIT.usage : EXIT.internal;
+  return EXIT[failure.class];
+}
+function defaultSubscriptionModelsDeps() {
+  return {
+    platform: () => process.platform,
+    readStore: readAntigravityStoreClassified,
+    tokenDeps: defaultAntigravityTokenDeps,
+    now: () => Date.now(),
+    httpTimeoutMs: 30000,
+    keychainDeadlineMs: 1e4,
+    writeStdout: (line) => new Promise((resolve, reject) => {
+      process.stdout.write(line, (err) => err ? reject(err) : resolve());
+    }),
+    writeStderr: (line) => {
+      process.stderr.write(line);
+    }
+  };
+}
+function parseSubscriptionModelsArgs(argv) {
+  const positionals = argv.filter((a) => !a.startsWith("-"));
+  const flags = argv.filter((a) => a.startsWith("-"));
+  const positionalsOk = positionals.length === 2 && positionals[0] === "models" && positionals[1] === "antigravity";
+  const flagsOk = flags.length === 2 && flags.includes("--raw") && flags.includes("--json");
+  return positionalsOk && flagsOk ? { ok: true, provider: "antigravity" } : { ok: false };
+}
+function addSecret(secrets, value) {
+  if (typeof value === "string" && value.length > 0)
+    secrets.values.add(value);
+}
+function buildEnvelope(facts, failure, body) {
+  return {
+    schema: SUBSCRIPTION_MODEL_LIST_SCHEMA,
+    ...facts.provider !== undefined ? { provider: facts.provider } : {},
+    claudishVersion: VERSION,
+    ...facts.fetchedAt !== undefined ? { fetchedAt: facts.fetchedAt } : {},
+    ...facts.sourceUrl !== undefined ? { sourceUrl: facts.sourceUrl } : {},
+    ...facts.clientVersion !== undefined ? { clientVersion: facts.clientVersion } : {},
+    ...facts.clientVersionSource !== undefined ? { clientVersionSource: facts.clientVersionSource } : {},
+    tokenRefreshed: facts.tokenRefreshed,
+    ...facts.httpStatus !== undefined ? { httpStatus: facts.httpStatus } : {},
+    ...failure ? { failure } : {},
+    ...body !== undefined ? { body } : {}
+  };
+}
+function failureOf2(cls, code, httpStatus) {
+  return { class: cls, code, ...httpStatus !== undefined ? { httpStatus } : {} };
+}
+function stripUserinfo(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]*@/i, "$1");
+  }
+}
+function storeReadFailure(read) {
+  switch (read.kind) {
+    case "absent":
+      return failureOf2("credential_missing", "keychain_item_absent");
+    case "locked":
+      return failureOf2("keychain_locked", "keychain_locked");
+    case "timeout":
+      return failureOf2("keychain_locked", "keychain_read_timeout");
+    default:
+      return failureOf2("keychain_locked", "keychain_read_failed");
+  }
+}
+function tokenFailure(refreshCalled, outcome) {
+  if (!refreshCalled)
+    return failureOf2("credential_missing", "token_unparseable");
+  switch (outcome?.kind) {
+    case "not-installed":
+      return failureOf2("mint_failed", "agy_missing");
+    case "timeout":
+      return failureOf2("mint_failed", "agy_refresh_timeout");
+    case "ran":
+      return failureOf2("mint_failed", "agy_refresh_no_valid_token");
+    default:
+      return failureOf2("mint_failed", "agy_refresh_failed");
+  }
+}
+function loadCodeAssistFailure(err) {
+  const fields = err ?? {};
+  const status = typeof fields.upstreamStatus === "number" ? fields.upstreamStatus : undefined;
+  if (status !== undefined) {
+    if (status === 429)
+      return failureOf2("network", "load_code_assist_429", status);
+    if (status >= 500 && status <= 599)
+      return failureOf2("network", "load_code_assist_5xx", status);
+    return failureOf2("mint_failed", "load_code_assist_4xx", status);
+  }
+  if (err instanceof SyntaxError)
+    return failureOf2("mint_failed", "load_code_assist_bad_body");
+  if (fields.terminal === true)
+    return failureOf2("mint_failed", "load_code_assist_no_project");
+  return failureOf2("network", "load_code_assist_network_error");
+}
+function listFailure(value, status) {
+  const models = value !== null && typeof value === "object" && !Array.isArray(value) ? value.models : undefined;
+  if (models === null || typeof models !== "object" || Array.isArray(models)) {
+    return failureOf2("list_incomplete", "models_absent", status);
+  }
+  if (Object.keys(models).length === 0) {
+    return failureOf2("list_incomplete", "models_empty", status);
+  }
+  return null;
+}
+async function raceTimeout(work, ms) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), ms);
+  });
+  work.catch(() => {});
+  try {
+    return await Promise.race([work, timedOut]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function fail(facts, failure) {
+  return { envelope: buildEnvelope(facts, failure), exitCode: exitCodeFor(failure) };
+}
+function lineOf(envelope) {
+  return `${JSON.stringify(envelope)}
+`;
+}
+function containsSecret(secrets, ...texts) {
+  for (const secret of secrets.values) {
+    if (texts.some((text) => text?.includes(secret)))
+      return true;
+  }
+  return false;
+}
+function safeStderr(deps, line) {
+  try {
+    deps.writeStderr(line);
+  } catch {}
+}
+async function writeInternalFailure(deps, facts, code, stderrLine, secrets) {
+  const failure = failureOf2("internal", code);
+  safeStderr(deps, `${stderrLine}
+`);
+  const line = lineOf(buildEnvelope(facts, failure));
+  if (!secrets || !containsSecret(secrets, line)) {
+    try {
+      await deps.writeStdout(line);
+    } catch {}
+  }
+  return exitCodeFor(failure);
+}
+async function reportSubscriptionInternalError(deps) {
+  let resolved;
+  try {
+    resolved = deps ?? defaultSubscriptionModelsDeps();
+  } catch {
+    process.stderr.write(`${INTERNAL_ERROR_MESSAGE}
+`);
+    return EXIT.internal;
+  }
+  return writeInternalFailure(resolved, { tokenRefreshed: false }, "internal_error", INTERNAL_ERROR_MESSAGE);
+}
+async function obtainAccessToken(deps, facts, secrets, preRaw) {
+  const base = deps.tokenDeps();
+  let firstRead = true;
+  let refreshCalled = false;
+  let refreshOutcome = null;
+  const laterReads = [];
+  const observed = {
+    ...base,
+    readStore: () => {
+      if (firstRead) {
+        firstRead = false;
+        return preRaw;
+      }
+      const raw = base.readStore();
+      if (raw)
+        laterReads.push(raw);
+      return raw;
+    },
+    runAgyRefresh: () => {
+      refreshCalled = true;
+      facts.tokenRefreshed = true;
+      refreshOutcome = base.runAgyRefresh();
+      return refreshOutcome;
+    }
+  };
+  let accessToken;
+  try {
+    accessToken = await getValidAntigravityAccessToken(observed);
+  } catch {
+    return { ok: false, result: fail(facts, tokenFailure(refreshCalled, refreshOutcome)) };
+  }
+  addSecret(secrets, accessToken);
+  for (const raw of [preRaw, ...laterReads]) {
+    addSecret(secrets, raw);
+    addSecret(secrets, readSharedAntigravityToken({ ...base, readStore: () => raw })?.refresh_token);
+  }
+  return { ok: true, accessToken };
+}
+function classifyAvailableModels(facts, raw, timedOut) {
+  facts.sourceUrl = stripUserinfo(raw.url);
+  facts.clientVersion = raw.clientVersion;
+  facts.clientVersionSource = raw.clientVersionSource;
+  const networkCode = timedOut ? "fetch_available_models_timeout" : "fetch_available_models_network_error";
+  if (raw.kind === "unreachable")
+    return fail(facts, failureOf2("network", networkCode));
+  facts.fetchedAt = raw.fetchedAt;
+  facts.httpStatus = raw.status;
+  if (raw.status < 200 || raw.status >= 300) {
+    return { envelope: buildEnvelope(facts), exitCode: EXIT.ok };
+  }
+  switch (raw.body.kind) {
+    case "json": {
+      const incomplete = listFailure(raw.body.value, raw.status);
+      if (incomplete)
+        return fail(facts, incomplete);
+      return {
+        envelope: buildEnvelope(facts, undefined, raw.body.text),
+        exitCode: EXIT.ok,
+        bodyText: raw.body.text
+      };
+    }
+    case "not-json":
+      return fail(facts, failureOf2("list_incomplete", "body_not_json", raw.status));
+    default:
+      return fail(facts, failureOf2("network", networkCode, raw.status));
+  }
+}
+async function determine(deps, secrets, facts) {
+  if (deps.platform() !== "darwin") {
+    return fail(facts, failureOf2("credential_missing", "platform_unsupported"));
+  }
+  const read = await deps.readStore(deps.keychainDeadlineMs);
+  if (read.kind !== "present")
+    return fail(facts, storeReadFailure(read));
+  addSecret(secrets, read.raw);
+  const token = await obtainAccessToken(deps, facts, secrets, read.raw);
+  if (!token.ok)
+    return token.result;
+  const version = resolveAntigravityClientVersion();
+  facts.clientVersion = version.version;
+  facts.clientVersionSource = version.source;
+  let projectId;
+  try {
+    const setup = await raceTimeout(setupAntigravityUser(token.accessToken), deps.httpTimeoutMs);
+    if (setup === TIMED_OUT)
+      return fail(facts, failureOf2("network", "load_code_assist_timeout"));
+    projectId = setup.projectId;
+  } catch (err) {
+    return fail(facts, loadCodeAssistFailure(err));
+  }
+  addSecret(secrets, projectId);
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), deps.httpTimeoutMs);
+  try {
+    const raw = await fetchAntigravityAvailableModelsRaw(token.accessToken, projectId, {
+      signal: controller.signal,
+      now: deps.now
+    });
+    return classifyAvailableModels(facts, raw, controller.signal.aborted);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function runAntigravityRawModelList(deps) {
+  const secrets = { values: new Set };
+  const facts = { provider: "antigravity", tokenRefreshed: false };
+  let line;
+  let exitCode;
+  let bodyText;
+  try {
+    const result = await determine(deps, secrets, facts);
+    line = lineOf(result.envelope);
+    exitCode = result.exitCode;
+    bodyText = result.bodyText;
+  } catch {
+    return writeInternalFailure(deps, { provider: facts.provider, tokenRefreshed: facts.tokenRefreshed }, "internal_error", INTERNAL_ERROR_MESSAGE, secrets);
+  }
+  if (containsSecret(secrets, line, bodyText)) {
+    return writeInternalFailure(deps, facts, "secret_guard", SECRET_GUARD_MESSAGE, secrets);
+  }
+  try {
+    await deps.writeStdout(line);
+  } catch {
+    safeStderr(deps, `${INTERNAL_ERROR_MESSAGE}
+`);
+    return EXIT.internal;
+  }
+  return exitCode;
+}
+async function subscriptionModelsCommand(argv, deps = defaultSubscriptionModelsDeps()) {
+  if (!parseSubscriptionModelsArgs(argv).ok) {
+    return writeInternalFailure(deps, { tokenRefreshed: false }, "usage", SUBSCRIPTION_MODELS_USAGE);
+  }
+  return runAntigravityRawModelList(deps);
+}
+var SUBSCRIPTION_MODEL_LIST_SCHEMA = "claudish.subscription-model-list.v1", FAILURE_CODES, EXIT, SUBSCRIPTION_MODELS_USAGE = "usage: claudish subscription models antigravity --raw --json", SECRET_GUARD_MESSAGE = "[claudish subscription] refused: output contained a credential value", INTERNAL_ERROR_MESSAGE = "[claudish subscription] internal error", TIMED_OUT;
+var init_subscription_models_command = __esm(() => {
+  init_antigravity_token();
+  init_antigravity_user();
+  FAILURE_CODES = {
+    credential_missing: ["platform_unsupported", "keychain_item_absent", "token_unparseable"],
+    keychain_locked: ["keychain_locked", "keychain_read_timeout", "keychain_read_failed"],
+    mint_failed: [
+      "agy_missing",
+      "agy_refresh_failed",
+      "agy_refresh_timeout",
+      "agy_refresh_no_valid_token",
+      "load_code_assist_4xx",
+      "load_code_assist_no_project",
+      "load_code_assist_bad_body"
+    ],
+    network: [
+      "load_code_assist_network_error",
+      "load_code_assist_429",
+      "load_code_assist_5xx",
+      "load_code_assist_timeout",
+      "fetch_available_models_network_error",
+      "fetch_available_models_timeout"
+    ],
+    list_incomplete: ["models_absent", "models_empty", "body_not_json"],
+    internal: ["usage", "secret_guard", "internal_error"]
+  };
+  EXIT = {
+    ok: 0,
+    internal: 1,
+    usage: 2,
+    credential_missing: 3,
+    keychain_locked: 4,
+    mint_failed: 5,
+    network: 6,
+    list_incomplete: 7
+  };
+  TIMED_OUT = Symbol("timed-out");
+});
+
 // src/auth/antigravity-oauth.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync39, unlinkSync as unlinkSync9 } from "fs";
@@ -89414,7 +89933,7 @@ class InteractiveDriver {
       try {
         this.binding.fireEnd(outcome);
       } catch {}
-      await raceTimeout(this.binding.endSettled?.() ?? Promise.resolve(), SESSION_END_WAIT_MS);
+      await raceTimeout2(this.binding.endSettled?.() ?? Promise.resolve(), SESSION_END_WAIT_MS);
       try {
         this.binding.sweepInbox?.();
       } catch {}
@@ -90057,7 +90576,7 @@ function fileSizeOf(path) {
     return 0;
   }
 }
-function raceTimeout(p, ms) {
+function raceTimeout2(p, ms) {
   return new Promise((resolve) => {
     const t = setTimeout(resolve, ms);
     p.then(() => {
@@ -94346,6 +94865,7 @@ function classifyStartupKind() {
     "stats",
     "providers",
     "keychain",
+    "subscription",
     "login",
     "logout",
     "quota",
@@ -94483,6 +95003,7 @@ var isConfigCommand = firstPositional === "config";
 var isServeCommand = firstPositional === "serve";
 var isProvidersCommand = firstPositional === "providers";
 var isKeychainCommand = firstPositional === "keychain";
+var isSubscriptionCommand = firstPositional === "subscription";
 var isHooksCommand = firstPositional === "hooks";
 var isTeamCommand = firstPositional === "team";
 var isLoginCommand = firstPositional === "login";
@@ -94528,6 +95049,14 @@ if (isMcpMode) {
     console.error(`[claudish keychain] ${e instanceof Error ? e.message : String(e)}`);
     process.exit(1);
   }));
+} else if (isSubscriptionCommand) {
+  const subscriptionArgIndex = args.indexOf("subscription");
+  const subscriptionModule = () => Promise.resolve().then(() => (init_subscription_models_command(), exports_subscription_models_command));
+  subscriptionModule().then((m) => m.subscriptionModelsCommand(args.slice(subscriptionArgIndex + 1))).catch(() => subscriptionModule().then((m) => m.reportSubscriptionInternalError()).catch(() => {
+    process.stderr.write(`[claudish subscription] internal error
+`);
+    return 1;
+  })).then((code) => process.exit(code));
 } else if (isLoginCommand) {
   const loginProviderArg = args.find((a, i) => i > args.indexOf("login") && !a.startsWith("-"));
   Promise.resolve().then(() => (init_auth_commands(), {})).then((m) => loginCommand(loginProviderArg).catch(handlePromptExit));