claudish 13.1.0 → 13.3.0

package/dist/index.js

@@ -575,7 +575,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "13.1.0";
+var VERSION = "13.3.0";
 
 // src/logger.ts
 import { appendFile, existsSync as existsSync2, mkdirSync, readdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
@@ -6484,6 +6484,12 @@ function isOptInWireId(wireId) {
   return /-contributor(?:-free)?$/i.test(wireId.split("/").pop() ?? wireId);
 }
 function isOptInConnection(connection) {
+  if ("contentUse" in connection) {
+    if (connection.contentUse === "contributor")
+      return true;
+    if (connection.contentUse === "standard")
+      return false;
+  }
   return typeof connection.externalModelId === "string" && isOptInWireId(connection.externalModelId);
 }
 function splitOptInConnections(entry) {
@@ -6715,6 +6721,7 @@ var init_catalog_route_bindings = __esm(() => {
     vertex: { routeId: "vertex", routeProfileId: "google-cloud" },
     deepseek: { routeId: "deepseek", routeProfileId: "direct-api" },
     mistralai: { routeId: "mistralai", routeProfileId: "direct-api" },
+    "meta-muse-code": { routeId: "meta", routeProfileId: "muse-code-subscription" },
     meta: { routeId: "meta", routeProfileId: "direct-api" }
   };
   LOOKUP_ONLY_ROUTE_BINDINGS = {
@@ -10403,9 +10410,6 @@ function acceptsReasoningEffort(modelId) {
     return reasoning.supported === true && reasoning.control === "effort";
   return true;
 }
-function catalogReasoningFor(modelId) {
-  return lookupModelReasoning(norm(modelId)) ?? lookupModelReasoning(modelId);
-}
 function rememberReasoningEffortRejected(modelId) {
   const id = norm(modelId);
   if (!id || learnedRejects.has(id))
@@ -10530,7 +10534,7 @@ var init_grok_model_dialect = __esm(() => {
         return;
       }
       let value;
-      const reasoning = catalogReasoningFor(this.modelId);
+      const reasoning = this.lookupReasoningCapability();
       const clamped = reasoning ? this.clampToAdvertisedEffort(effort, reasoning) : undefined;
       if (clamped) {
         value = clamped;
@@ -10878,6 +10882,324 @@ var init_minimax_model_dialect = __esm(() => {
   };
 });
 
+// src/providers/keychain.ts
+function syncRun(args, stdin) {
+  try {
+    const proc = Bun.spawnSync([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: SPAWN_TIMEOUT_MS
+    });
+    return normalizeResult(proc.exitCode, proc.signalCode, decode(proc.stdout), decode(proc.stderr));
+  } catch (err) {
+    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function asyncRun(args, stdin) {
+  try {
+    const proc = Bun.spawn([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: SPAWN_TIMEOUT_MS
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    return normalizeResult(exitCode, proc.signalCode, stdout, stderr);
+  } catch (err) {
+    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+function spawnAsyncRun(args, stdin) {
+  try {
+    const proc = Bun.spawn([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const done = Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]).then(([stdout, stderr, exitCode]) => normalizeResult(exitCode, proc.signalCode, stdout, stderr), (err) => ({
+      code: 1,
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err)
+    }));
+    return { done, pid: proc.pid };
+  } catch (err) {
+    return {
+      done: Promise.resolve({
+        code: 1,
+        stdout: "",
+        stderr: err instanceof Error ? err.message : String(err)
+      }),
+      pid: undefined
+    };
+  }
+}
+function decode(buf) {
+  return buf ? new TextDecoder().decode(buf) : "";
+}
+function normalizeResult(exitCode, signalCode, stdout, stderr) {
+  if (typeof exitCode === "number")
+    return { code: exitCode, stdout, stderr };
+  const detail = signalCode ? `killed by ${signalCode}` : "terminated without an exit code";
+  return { code: -1, stdout, stderr: stderr.trim() || `security ${detail}` };
+}
+function invalidateKeychainCache() {
+  listMemo = null;
+  valueMemo.clear();
+}
+function now() {
+  return Date.now();
+}
+function isValidKeychainVarName(name) {
+  return ENV_VAR_NAME.test(name);
+}
+function describeUnstorableValue(value) {
+  if (value.length === 0)
+    return "value is empty";
+  if (CONTROL_CHARS.test(value)) {
+    return "value contains control characters (tab/newline/etc), which the keychain read path cannot represent unambiguously";
+  }
+  return null;
+}
+function isKeychainSupported() {
+  return deps.platform() === "darwin";
+}
+function keychainUnavailableReason() {
+  if (!isKeychainSupported()) {
+    return `the macOS Keychain is only available on macOS (this is ${deps.platform()})`;
+  }
+  return null;
+}
+function stripOneTrailingNewline(out) {
+  return out.endsWith(`
+`) ? out.slice(0, -1) : out;
+}
+function keychainFileArgs() {
+  const file = process.env.CLAUDISH_KEYCHAIN_FILE;
+  return file ? [file] : [];
+}
+function findArgs(envVar) {
+  return [
+    "find-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    envVar,
+    "-w",
+    ...keychainFileArgs()
+  ];
+}
+function interpretRead(envVar, res) {
+  if (res.code === 0) {
+    const value = stripOneTrailingNewline(res.stdout);
+    return value.length > 0 ? value : null;
+  }
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return null;
+  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+}
+function readKeychainSecret(envVar) {
+  if (!isKeychainSupported())
+    return null;
+  const cached = valueMemo.get(envVar);
+  const at = now();
+  if (cached && at - cached.at < MEMO_TTL_MS)
+    return cached.value;
+  const value = interpretRead(envVar, deps.run(findArgs(envVar)));
+  valueMemo.set(envVar, { at, value });
+  return value;
+}
+async function readKeychainSecretAsync(envVar) {
+  if (!isKeychainSupported())
+    return null;
+  const cached = valueMemo.get(envVar);
+  const at = now();
+  if (cached && at - cached.at < MEMO_TTL_MS)
+    return cached.value;
+  const value = interpretRead(envVar, await deps.runAsync(findArgs(envVar)));
+  valueMemo.set(envVar, { at, value });
+  return value;
+}
+function genericPasswordArgs(query, withValue) {
+  return [
+    "find-generic-password",
+    "-s",
+    query.service,
+    ...query.account !== undefined ? ["-a", query.account] : [],
+    ...withValue ? ["-w"] : [],
+    ...query.keychainFile !== undefined ? [query.keychainFile] : keychainFileArgs()
+  ];
+}
+function interpretGenericPassword(res, withValue) {
+  if (res.code === 0) {
+    if (!withValue)
+      return { kind: "found" };
+    const value = stripOneTrailingNewline(res.stdout);
+    return value.length > 0 ? { kind: "found", value } : { kind: "absent" };
+  }
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return { kind: "absent" };
+  return {
+    kind: "failed",
+    code: res.code,
+    error: res.stderr.trim() || `security exited ${res.code}`
+  };
+}
+async function findGenericPasswordPresence(query) {
+  if (!isKeychainSupported())
+    return { kind: "absent" };
+  const res = await deps.spawnAsync(genericPasswordArgs(query, false)).done;
+  return interpretGenericPassword(res, false);
+}
+function startGenericPasswordRead(query) {
+  if (!isKeychainSupported()) {
+    return { done: Promise.resolve({ kind: "absent" }), pid: undefined };
+  }
+  const spawn = deps.spawnAsync(genericPasswordArgs(query, true));
+  return { done: spawn.done.then((res) => interpretGenericPassword(res, true)), pid: spawn.pid };
+}
+function enumerateKeychainVars() {
+  if (!isKeychainSupported())
+    return { names: [], failed: false };
+  const at = now();
+  if (listMemo && at - listMemo.at < MEMO_TTL_MS)
+    return listMemo.value;
+  const res = deps.run(["dump-keychain", ...keychainFileArgs()]);
+  const value = res.code === 0 ? { names: parseDumpAccounts(res.stdout), failed: false } : {
+    names: [],
+    failed: true,
+    error: res.stderr.trim() || `security exited ${res.code}`
+  };
+  listMemo = { at, value };
+  return value;
+}
+function listKeychainVars() {
+  return enumerateKeychainVars().names;
+}
+function parseDumpAccounts(dump) {
+  const found = new Set;
+  for (const block of dump.split(/\nkeychain: /)) {
+    if (!block.includes(SVCE_MATCH))
+      continue;
+    const m = block.match(ACCT_ATTR);
+    if (m?.[1] && isValidKeychainVarName(m[1]))
+      found.add(m[1]);
+  }
+  return Array.from(found).sort();
+}
+function lookupKeychainVar(envVar) {
+  if (!isKeychainSupported())
+    return { present: false, failed: false };
+  const cached = valueMemo.get(envVar);
+  if (cached && now() - cached.at < MEMO_TTL_MS && cached.value !== null) {
+    return { present: true, failed: false };
+  }
+  const listed = enumerateKeychainVars();
+  return { present: listed.names.includes(envVar), failed: listed.failed };
+}
+function toHex(value) {
+  return Buffer.from(value, "utf8").toString("hex");
+}
+function quoteForStdin(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function writeKeychainSecret(envVar, value) {
+  const unsupported = keychainUnavailableReason();
+  if (unsupported)
+    throw new KeychainError(`Cannot write ${envVar}: ${unsupported}`);
+  if (!isValidKeychainVarName(envVar)) {
+    throw new KeychainError(`Cannot write "${envVar}": not a valid environment variable name`);
+  }
+  const unstorable = describeUnstorableValue(value);
+  if (unstorable)
+    throw new KeychainError(`Cannot store ${envVar}: ${unstorable}`);
+  invalidateKeychainCache();
+  const cmd = [
+    "add-generic-password",
+    "-s",
+    quoteForStdin(KEYCHAIN_SERVICE),
+    "-a",
+    quoteForStdin(envVar),
+    "-l",
+    quoteForStdin(`${KEYCHAIN_SERVICE}: ${envVar}`),
+    "-D",
+    quoteForStdin("application password"),
+    "-j",
+    quoteForStdin("Stored by claudish"),
+    "-X",
+    quoteForStdin(toHex(value)),
+    "-U",
+    "-T",
+    quoteForStdin(SECURITY_BIN),
+    ...keychainFileArgs().map(quoteForStdin)
+  ].join(" ");
+  const res = deps.run(["-i"], `${cmd}
+`);
+  if (res.code !== 0) {
+    throw new KeychainError(`Failed to store ${envVar} in the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+  }
+  invalidateKeychainCache();
+  const readBack = readKeychainSecret(envVar);
+  if (readBack !== value) {
+    throw new KeychainError(`Keychain write for ${envVar} did not round-trip \u2014 the stored value differs from what was written. ` + "The item may exceed the keychain's size limit; nothing should be assumed saved.");
+  }
+}
+function deleteKeychainSecret(envVar) {
+  if (!isKeychainSupported())
+    return false;
+  invalidateKeychainCache();
+  const res = deps.run([
+    "delete-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    envVar,
+    ...keychainFileArgs()
+  ]);
+  invalidateKeychainCache();
+  if (res.code === 0)
+    return true;
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return false;
+  throw new KeychainError(`Failed to delete ${envVar} from the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+}
+function valueTail2(value) {
+  if (value.length <= 6)
+    return "\u2022\u2022\u2022\u2022";
+  return `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
+}
+var KEYCHAIN_SERVICE = "claudish", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, defaultDeps, deps, listMemo = null, valueMemo, CONTROL_CHARS, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH;
+var init_keychain = __esm(() => {
+  KeychainError = class KeychainError extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+      super(message);
+      this.exitCode = exitCode;
+      this.name = "KeychainError";
+    }
+  };
+  defaultDeps = {
+    platform: () => process.platform,
+    run: syncRun,
+    runAsync: asyncRun,
+    spawnAsync: spawnAsyncRun
+  };
+  deps = defaultDeps;
+  valueMemo = new Map;
+  CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
+  ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+  ACCT_ATTR = /"acct"<blob>=(?:0x[0-9A-Fa-f]*\s+)?"([^"]*)"/;
+  SVCE_MATCH = `"svce"<blob>="${KEYCHAIN_SERVICE}"`;
+});
+
 // src/auth/antigravity-client-version.ts
 function getAgyClientVersion() {
   return version;
@@ -10999,6 +11321,46 @@ function defaultReadAgyVersion() {
     return null;
   }
 }
+function defaultAntigravityTokenDeps() {
+  return { ...defaultDeps2 };
+}
+async function raceDeadline(work, deadlineAt) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), Math.max(0, deadlineAt - Date.now()));
+  });
+  try {
+    return await Promise.race([work, timedOut]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function classifyKeychainFailure(code) {
+  return KEYCHAIN_LOCKED_EXIT_CODES.has(code) ? { kind: "locked" } : { kind: "failed" };
+}
+async function readAntigravityStoreClassified(deadlineMs) {
+  if (process.env.CLAUDISH_DISABLE_KEYCHAIN === "1")
+    return { kind: "failed" };
+  const deadlineAt = Date.now() + deadlineMs;
+  const query = { service: KC_SERVICE, account: KC_ACCOUNT };
+  const presence = await raceDeadline(findGenericPasswordPresence(query), deadlineAt);
+  if (presence === "timeout")
+    return { kind: "timeout" };
+  if (presence.kind === "absent")
+    return { kind: "absent" };
+  if (presence.kind === "failed")
+    return classifyKeychainFailure(presence.code);
+  const read = await raceDeadline(startGenericPasswordRead(query).done, deadlineAt);
+  if (read === "timeout")
+    return { kind: "timeout" };
+  if (read.kind === "absent")
+    return { kind: "absent" };
+  if (read.kind === "failed")
+    return classifyKeychainFailure(read.code);
+  const raw = (read.value ?? "").trim();
+  return raw.length > 0 ? { kind: "present", raw } : { kind: "absent" };
+}
 function parseRecord(raw) {
   if (!raw)
     return null;
@@ -11020,11 +11382,11 @@ function parseRecord(raw) {
 function encodeRecord(rec) {
   return PREFIX + Buffer.from(JSON.stringify(rec), "utf8").toString("base64");
 }
-function readSharedAntigravityToken(deps = defaultDeps) {
+function readSharedAntigravityToken(deps = defaultDeps2) {
   const rec = parseRecord(deps.readStore());
   return rec ? rec.token : null;
 }
-function hasSharedAntigravityToken(deps = defaultDeps) {
+function hasSharedAntigravityToken(deps = defaultDeps2) {
   const now = Date.now();
   if (cachedHasToken && now - cachedHasToken.at < HAS_TOKEN_TTL_MS)
     return cachedHasToken.value;
@@ -11037,7 +11399,7 @@ function hasSharedAntigravityToken(deps = defaultDeps) {
   cachedHasToken = { at: now, value };
   return value;
 }
-function writeSharedAntigravityToken(tok, deps = defaultDeps) {
+function writeSharedAntigravityToken(tok, deps = defaultDeps2) {
   const existing = parseRecord(deps.readStore());
   const base = existing ?? { token: tok };
   const merged = {
@@ -11046,7 +11408,7 @@ function writeSharedAntigravityToken(tok, deps = defaultDeps) {
   };
   deps.writeStore(encodeRecord(merged));
 }
-function deleteSharedAntigravityToken(deps = defaultDeps) {
+function deleteSharedAntigravityToken(deps = defaultDeps2) {
   (deps.deleteStore ?? defaultDeleteStore)();
   _resetAntigravityTokenState();
 }
@@ -11107,7 +11469,7 @@ function describeRefreshFailure(outcome) {
       return "The Antigravity session is expired and the Antigravity CLI refreshed it without " + "producing a valid token \u2014 the session has most likely been revoked. " + "Run `claudish login antigravity`.";
   }
 }
-function getValidAntigravityAccessToken(deps = defaultDeps) {
+function getValidAntigravityAccessToken(deps = defaultDeps2) {
   if (inFlight)
     return inFlight;
   inFlight = resolveValidToken(deps).finally(() => {
@@ -11115,7 +11477,7 @@ function getValidAntigravityAccessToken(deps = defaultDeps) {
   });
   return inFlight;
 }
-async function forceRefreshAntigravityToken(deps = defaultDeps) {
+async function forceRefreshAntigravityToken(deps = defaultDeps2) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
@@ -11156,10 +11518,11 @@ function _resetAntigravityTokenState() {
   cachedHasToken = null;
   invalidateReadStoreMemo();
 }
-var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
+var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps2, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
 var init_antigravity_token = __esm(() => {
   init_logger();
-  defaultDeps = {
+  init_keychain();
+  defaultDeps2 = {
     readStore: defaultReadStore,
     writeStore: defaultWriteStore,
     deleteStore: defaultDeleteStore,
@@ -11167,6 +11530,7 @@ var init_antigravity_token = __esm(() => {
     readAgyVersion: defaultReadAgyVersion,
     now: () => Date.now()
   };
+  KEYCHAIN_LOCKED_EXIT_CODES = new Set([36, 51, 128]);
 });
 
 // src/auth/antigravity-user.ts
@@ -11182,11 +11546,18 @@ function makeTerminalSetupError(message) {
   err.terminal = true;
   return err;
 }
+function resolveAntigravityClientVersion() {
+  const agy = getAgyClientVersion();
+  return agy ? { version: agy, source: "agy" } : { version: AGY_FALLBACK_CLIENT_VERSION, source: "fallback" };
+}
 function antigravityClientVersion() {
-  return getAgyClientVersion() ?? AGY_FALLBACK_CLIENT_VERSION;
+  return resolveAntigravityClientVersion().version;
+}
+function userAgentFor(version) {
+  return `antigravity/cli/${version} (aidev_client; os_type=${process.platform}; arch=${process.arch}; auth_method=consumer)`;
 }
 function buildAntigravityUserAgent() {
-  return `antigravity/cli/${antigravityClientVersion()} (aidev_client; os_type=${process.platform}; arch=${process.arch}; auth_method=consumer)`;
+  return userAgentFor(antigravityClientVersion());
 }
 function resetAntigravityUserCache() {
   cachedAgProjectId = null;
@@ -11278,6 +11649,45 @@ function flattenAgentModelSorts(sorts) {
   }
   return ids.length > 0 ? ids : undefined;
 }
+async function fetchAntigravityAvailableModelsRaw(accessToken, projectId, opts) {
+  const url = `${apiBase()}:fetchAvailableModels`;
+  const { version, source } = resolveAntigravityClientVersion();
+  const base = {
+    url,
+    clientVersion: version,
+    clientVersionSource: source
+  };
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+        "User-Agent": userAgentFor(version)
+      },
+      body: JSON.stringify({ project: projectId }),
+      ...opts?.signal ? { signal: opts.signal } : {}
+    });
+  } catch (error) {
+    return { ...base, kind: "unreachable", error };
+  }
+  const fetchedAt = new Date((opts?.now ?? Date.now)()).toISOString();
+  const answered = { ...base, kind: "answered", status: res.status, fetchedAt };
+  if (!res.ok)
+    return { ...answered, body: { kind: "unread" } };
+  let text;
+  try {
+    text = await res.text();
+  } catch {
+    return { ...answered, body: { kind: "read-failed" } };
+  }
+  try {
+    return { ...answered, body: { kind: "json", text, value: JSON.parse(text) } };
+  } catch {
+    return { ...answered, body: { kind: "not-json" } };
+  }
+}
 async function getServedAntigravityModels(accessToken, projectId, opts) {
   const now = Date.now();
   const version = antigravityClientVersion();
@@ -11290,17 +11700,15 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
     return agServedCache;
   }
   try {
-    const res = await fetch(`${apiBase()}:fetchAvailableModels`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
-        "User-Agent": buildAntigravityUserAgent()
-      },
-      body: JSON.stringify({ project: projectId })
-    });
-    if (res.ok) {
-      const data = await res.json();
+    const raw = await fetchAntigravityAvailableModelsRaw(accessToken, projectId);
+    if (raw.kind === "unreachable") {
+      log(`[Antigravity] fetchAvailableModels error: ${raw.error}`);
+    } else if (raw.status < 200 || raw.status >= 300) {
+      log(`[Antigravity] fetchAvailableModels failed: ${raw.status}`);
+    } else if (raw.body.kind !== "json") {
+      log(`[Antigravity] fetchAvailableModels error: ${raw.body.kind === "not-json" ? "the body is not JSON" : "the body could not be read"}`);
+    } else {
+      const data = raw.body.value;
       const servedIds = data.models ? Object.keys(data.models) : [];
       const defaultId = typeof data.defaultAgentModelId === "string" ? data.defaultAgentModelId : null;
       if (servedIds.length > 0) {
@@ -11347,11 +11755,9 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
           ...agentModelIds ? { agentModelIds } : {}
         };
         agServedCacheAt = now;
-        agServedCacheVersion = version;
+        agServedCacheVersion = raw.clientVersion;
         return agServedCache;
       }
-    } else {
-      log(`[Antigravity] fetchAvailableModels failed: ${res.status}`);
     }
   } catch (err) {
     log(`[Antigravity] fetchAvailableModels error: ${err}`);
@@ -12914,7 +13320,7 @@ async function performRefresh(cred) {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body,
-      signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
+      signal: AbortSignal.timeout(refreshTimeoutMs)
     });
   } catch (error) {
     throw Object.assign(new Error(`Could not reach ${tokenEndpoint} to refresh the Grok token: ${error.message}`, { cause: markOwnTimeout(error) }), { claudishEndpoint: tokenEndpoint });
@@ -12980,13 +13386,14 @@ function refreshShared(cred) {
   }
   return refreshInFlight;
 }
-var GROK_PROXY_URL_ENV = "GROK_PROXY_URL", DEFAULT_GROK_PROXY_URL = "https://cli-chat-proxy.grok.com/v1", GROK_CLIENT_IDENTIFIER = "grok-shell", FALLBACK_GROK_CLIENT_VERSION = "1.0.4", LEGACY_SCOPE = "https://accounts.x.ai/sign-in", EXPIRY_SKEW_MS2, grokHomeOverride = null, claudishOAuthPathOverride = null, GROK_CHANNEL_URL = "https://x.ai/cli/stable", liveClientVersion = null, SIGN_IN_HINT, refreshInFlight = null;
+var GROK_PROXY_URL_ENV = "GROK_PROXY_URL", DEFAULT_GROK_PROXY_URL = "https://cli-chat-proxy.grok.com/v1", GROK_CLIENT_IDENTIFIER = "grok-shell", FALLBACK_GROK_CLIENT_VERSION = "1.0.4", LEGACY_SCOPE = "https://accounts.x.ai/sign-in", EXPIRY_SKEW_MS2, grokHomeOverride = null, claudishOAuthPathOverride = null, GROK_CHANNEL_URL = "https://x.ai/cli/stable", liveClientVersion = null, SIGN_IN_HINT, refreshInFlight = null, refreshTimeoutMs;
 var init_grok_credentials = __esm(() => {
   init_grok_oauth();
   init_connection_error();
   init_transient_retry();
   EXPIRY_SKEW_MS2 = 5 * 60 * 1000;
   SIGN_IN_HINT = "Run `claudish login grok` (no Grok CLI required \u2014 SuperGrok or X Premium+ subscription). " + "An existing `grok login` (~/.grok/auth.json) is also picked up automatically.";
+  refreshTimeoutMs = TOKEN_REFRESH_TIMEOUT_MS;
 });
 
 // src/auth/quota/sources/grok.ts
@@ -16959,7 +17366,7 @@ var init_errors2 = __esm(() => {
 });
 
 // ../../node_modules/.bun/zod@4.1.13/node_modules/zod/v4/classic/parse.js
-var parse4, parseAsync2, safeParse2, safeParseAsync2, encode, decode, encodeAsync, decodeAsync, safeEncode, safeDecode, safeEncodeAsync, safeDecodeAsync;
+var parse4, parseAsync2, safeParse2, safeParseAsync2, encode, decode2, encodeAsync, decodeAsync, safeEncode, safeDecode, safeEncodeAsync, safeDecodeAsync;
 var init_parse2 = __esm(() => {
   init_core2();
   init_errors2();
@@ -16968,7 +17375,7 @@ var init_parse2 = __esm(() => {
   safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
   safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
   encode = /* @__PURE__ */ _encode(ZodRealError);
-  decode = /* @__PURE__ */ _decode(ZodRealError);
+  decode2 = /* @__PURE__ */ _decode(ZodRealError);
   encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
   decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
   safeEncode = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -17173,7 +17580,7 @@ var init_schemas2 = __esm(() => {
     inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
     inst.spa = inst.safeParseAsync;
     inst.encode = (data, params) => encode(inst, data, params);
-    inst.decode = (data, params) => decode(inst, data, params);
+    inst.decode = (data, params) => decode2(inst, data, params);
     inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);
     inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);
     inst.safeEncode = (data, params) => safeEncode(inst, data, params);
@@ -22950,324 +23357,6 @@ var init_antigravity_credential = __esm(() => {
   init_antigravity_user();
 });
 
-// src/providers/keychain.ts
-function syncRun(args, stdin) {
-  try {
-    const proc = Bun.spawnSync([SECURITY_BIN, ...args], {
-      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: SPAWN_TIMEOUT_MS
-    });
-    return normalizeResult(proc.exitCode, proc.signalCode, decode2(proc.stdout), decode2(proc.stderr));
-  } catch (err) {
-    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
-  }
-}
-async function asyncRun(args, stdin) {
-  try {
-    const proc = Bun.spawn([SECURITY_BIN, ...args], {
-      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: SPAWN_TIMEOUT_MS
-    });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]);
-    return normalizeResult(exitCode, proc.signalCode, stdout, stderr);
-  } catch (err) {
-    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
-  }
-}
-function spawnAsyncRun(args, stdin) {
-  try {
-    const proc = Bun.spawn([SECURITY_BIN, ...args], {
-      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const done = Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]).then(([stdout, stderr, exitCode]) => normalizeResult(exitCode, proc.signalCode, stdout, stderr), (err) => ({
-      code: 1,
-      stdout: "",
-      stderr: err instanceof Error ? err.message : String(err)
-    }));
-    return { done, pid: proc.pid };
-  } catch (err) {
-    return {
-      done: Promise.resolve({
-        code: 1,
-        stdout: "",
-        stderr: err instanceof Error ? err.message : String(err)
-      }),
-      pid: undefined
-    };
-  }
-}
-function decode2(buf) {
-  return buf ? new TextDecoder().decode(buf) : "";
-}
-function normalizeResult(exitCode, signalCode, stdout, stderr) {
-  if (typeof exitCode === "number")
-    return { code: exitCode, stdout, stderr };
-  const detail = signalCode ? `killed by ${signalCode}` : "terminated without an exit code";
-  return { code: -1, stdout, stderr: stderr.trim() || `security ${detail}` };
-}
-function invalidateKeychainCache() {
-  listMemo = null;
-  valueMemo.clear();
-}
-function now() {
-  return Date.now();
-}
-function isValidKeychainVarName(name) {
-  return ENV_VAR_NAME.test(name);
-}
-function describeUnstorableValue(value) {
-  if (value.length === 0)
-    return "value is empty";
-  if (CONTROL_CHARS.test(value)) {
-    return "value contains control characters (tab/newline/etc), which the keychain read path cannot represent unambiguously";
-  }
-  return null;
-}
-function isKeychainSupported() {
-  return deps.platform() === "darwin";
-}
-function keychainUnavailableReason() {
-  if (!isKeychainSupported()) {
-    return `the macOS Keychain is only available on macOS (this is ${deps.platform()})`;
-  }
-  return null;
-}
-function stripOneTrailingNewline(out) {
-  return out.endsWith(`
-`) ? out.slice(0, -1) : out;
-}
-function keychainFileArgs() {
-  const file = process.env.CLAUDISH_KEYCHAIN_FILE;
-  return file ? [file] : [];
-}
-function findArgs(envVar) {
-  return [
-    "find-generic-password",
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-a",
-    envVar,
-    "-w",
-    ...keychainFileArgs()
-  ];
-}
-function interpretRead(envVar, res) {
-  if (res.code === 0) {
-    const value = stripOneTrailingNewline(res.stdout);
-    return value.length > 0 ? value : null;
-  }
-  if (res.code === EXIT_ITEM_NOT_FOUND)
-    return null;
-  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
-}
-function readKeychainSecret(envVar) {
-  if (!isKeychainSupported())
-    return null;
-  const cached = valueMemo.get(envVar);
-  const at = now();
-  if (cached && at - cached.at < MEMO_TTL_MS)
-    return cached.value;
-  const value = interpretRead(envVar, deps.run(findArgs(envVar)));
-  valueMemo.set(envVar, { at, value });
-  return value;
-}
-async function readKeychainSecretAsync(envVar) {
-  if (!isKeychainSupported())
-    return null;
-  const cached = valueMemo.get(envVar);
-  const at = now();
-  if (cached && at - cached.at < MEMO_TTL_MS)
-    return cached.value;
-  const value = interpretRead(envVar, await deps.runAsync(findArgs(envVar)));
-  valueMemo.set(envVar, { at, value });
-  return value;
-}
-function genericPasswordArgs(query, withValue) {
-  return [
-    "find-generic-password",
-    "-s",
-    query.service,
-    ...query.account !== undefined ? ["-a", query.account] : [],
-    ...withValue ? ["-w"] : [],
-    ...query.keychainFile !== undefined ? [query.keychainFile] : keychainFileArgs()
-  ];
-}
-function interpretGenericPassword(res, withValue) {
-  if (res.code === 0) {
-    if (!withValue)
-      return { kind: "found" };
-    const value = stripOneTrailingNewline(res.stdout);
-    return value.length > 0 ? { kind: "found", value } : { kind: "absent" };
-  }
-  if (res.code === EXIT_ITEM_NOT_FOUND)
-    return { kind: "absent" };
-  return {
-    kind: "failed",
-    code: res.code,
-    error: res.stderr.trim() || `security exited ${res.code}`
-  };
-}
-async function findGenericPasswordPresence(query) {
-  if (!isKeychainSupported())
-    return { kind: "absent" };
-  const res = await deps.spawnAsync(genericPasswordArgs(query, false)).done;
-  return interpretGenericPassword(res, false);
-}
-function startGenericPasswordRead(query) {
-  if (!isKeychainSupported()) {
-    return { done: Promise.resolve({ kind: "absent" }), pid: undefined };
-  }
-  const spawn = deps.spawnAsync(genericPasswordArgs(query, true));
-  return { done: spawn.done.then((res) => interpretGenericPassword(res, true)), pid: spawn.pid };
-}
-function enumerateKeychainVars() {
-  if (!isKeychainSupported())
-    return { names: [], failed: false };
-  const at = now();
-  if (listMemo && at - listMemo.at < MEMO_TTL_MS)
-    return listMemo.value;
-  const res = deps.run(["dump-keychain", ...keychainFileArgs()]);
-  const value = res.code === 0 ? { names: parseDumpAccounts(res.stdout), failed: false } : {
-    names: [],
-    failed: true,
-    error: res.stderr.trim() || `security exited ${res.code}`
-  };
-  listMemo = { at, value };
-  return value;
-}
-function listKeychainVars() {
-  return enumerateKeychainVars().names;
-}
-function parseDumpAccounts(dump) {
-  const found = new Set;
-  for (const block of dump.split(/\nkeychain: /)) {
-    if (!block.includes(SVCE_MATCH))
-      continue;
-    const m = block.match(ACCT_ATTR);
-    if (m?.[1] && isValidKeychainVarName(m[1]))
-      found.add(m[1]);
-  }
-  return Array.from(found).sort();
-}
-function lookupKeychainVar(envVar) {
-  if (!isKeychainSupported())
-    return { present: false, failed: false };
-  const cached = valueMemo.get(envVar);
-  if (cached && now() - cached.at < MEMO_TTL_MS && cached.value !== null) {
-    return { present: true, failed: false };
-  }
-  const listed = enumerateKeychainVars();
-  return { present: listed.names.includes(envVar), failed: listed.failed };
-}
-function toHex(value) {
-  return Buffer.from(value, "utf8").toString("hex");
-}
-function quoteForStdin(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-function writeKeychainSecret(envVar, value) {
-  const unsupported = keychainUnavailableReason();
-  if (unsupported)
-    throw new KeychainError(`Cannot write ${envVar}: ${unsupported}`);
-  if (!isValidKeychainVarName(envVar)) {
-    throw new KeychainError(`Cannot write "${envVar}": not a valid environment variable name`);
-  }
-  const unstorable = describeUnstorableValue(value);
-  if (unstorable)
-    throw new KeychainError(`Cannot store ${envVar}: ${unstorable}`);
-  invalidateKeychainCache();
-  const cmd = [
-    "add-generic-password",
-    "-s",
-    quoteForStdin(KEYCHAIN_SERVICE),
-    "-a",
-    quoteForStdin(envVar),
-    "-l",
-    quoteForStdin(`${KEYCHAIN_SERVICE}: ${envVar}`),
-    "-D",
-    quoteForStdin("application password"),
-    "-j",
-    quoteForStdin("Stored by claudish"),
-    "-X",
-    quoteForStdin(toHex(value)),
-    "-U",
-    "-T",
-    quoteForStdin(SECURITY_BIN),
-    ...keychainFileArgs().map(quoteForStdin)
-  ].join(" ");
-  const res = deps.run(["-i"], `${cmd}
-`);
-  if (res.code !== 0) {
-    throw new KeychainError(`Failed to store ${envVar} in the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
-  }
-  invalidateKeychainCache();
-  const readBack = readKeychainSecret(envVar);
-  if (readBack !== value) {
-    throw new KeychainError(`Keychain write for ${envVar} did not round-trip \u2014 the stored value differs from what was written. ` + "The item may exceed the keychain's size limit; nothing should be assumed saved.");
-  }
-}
-function deleteKeychainSecret(envVar) {
-  if (!isKeychainSupported())
-    return false;
-  invalidateKeychainCache();
-  const res = deps.run([
-    "delete-generic-password",
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-a",
-    envVar,
-    ...keychainFileArgs()
-  ]);
-  invalidateKeychainCache();
-  if (res.code === 0)
-    return true;
-  if (res.code === EXIT_ITEM_NOT_FOUND)
-    return false;
-  throw new KeychainError(`Failed to delete ${envVar} from the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
-}
-function valueTail2(value) {
-  if (value.length <= 6)
-    return "\u2022\u2022\u2022\u2022";
-  return `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
-}
-var KEYCHAIN_SERVICE = "claudish", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, defaultDeps2, deps, listMemo = null, valueMemo, CONTROL_CHARS, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH;
-var init_keychain = __esm(() => {
-  KeychainError = class KeychainError extends Error {
-    exitCode;
-    constructor(message, exitCode) {
-      super(message);
-      this.exitCode = exitCode;
-      this.name = "KeychainError";
-    }
-  };
-  defaultDeps2 = {
-    platform: () => process.platform,
-    run: syncRun,
-    runAsync: asyncRun,
-    spawnAsync: spawnAsyncRun
-  };
-  deps = defaultDeps2;
-  valueMemo = new Map;
-  CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
-  ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-  ACCT_ATTR = /"acct"<blob>=(?:0x[0-9A-Fa-f]*\s+)?"([^"]*)"/;
-  SVCE_MATCH = `"svce"<blob>="${KEYCHAIN_SERVICE}"`;
-});
-
 // src/auth/credentials/local-api-key.ts
 function resolveLocalApiKey(q) {
   return realValue(process.env[q.envVar]) || (q.aliases ?? []).map((a) => realValue(process.env[a])).find((v) => !!v) || realValue(getApiKey(q.envVar));
@@ -35488,6 +35577,9 @@ function effectiveBaseUrl(registryBaseUrl, definitionBaseUrl, resolvedBaseUrl) {
   }
   return { baseUrl: resolvedBaseUrl.replace(/\/+$/, ""), overridden: true };
 }
+function requestBaseUrl(connection, api) {
+  return connection.provider === "meta-muse-code" ? `${MUSE_CODE_BASE_URL}/v1` : connectionBaseUrl(connection, api);
+}
 function describeConnectionWire(connection) {
   const where = `${connection.route.routeId}/${connection.route.routeProfileId} \xB7 ${connection.externalModelId}`;
   const { wire } = connection;
@@ -35497,7 +35589,7 @@ function describeConnectionWire(connection) {
     const apis = Object.keys(connection.profile.apis).join(", ") || "none";
     return `${where}: wire unknown \u2014 tries ${apis} in turn`;
   }
-  const base = connectionBaseUrl(connection, wire.api);
+  const base = requestBaseUrl(connection, wire.api);
   const url = base ? wireRequestUrl(base, wire.api, connection.externalModelId) : "no base URL";
   const status = (value) => typeof value === "string" ? value : value.status;
   const parts = [`${wire.api} ${url}`, `limit ${status(wire.tokenParam)}`];
@@ -35666,11 +35758,14 @@ function tryInTurn(ctx, definitionName, connection, why) {
   };
 }
 function buildKnownWireHandler(ctx, definitionName, connection, wire) {
-  const registryBase = connectionBaseUrl(connection, wire.api);
+  const registryBase = requestBaseUrl(connection, wire.api);
   if (!registryBase)
     return null;
   const definition = getProviderByName(definitionName);
-  const { baseUrl, overridden } = effectiveBaseUrl(registryBase, definition?.baseUrl, ctx.provider.baseUrl);
+  const { baseUrl, overridden } = definitionName === "meta-muse-code" ? { baseUrl: registryBase, overridden: false } : effectiveBaseUrl(registryBase, definition?.baseUrl, ctx.provider.baseUrl);
+  if (definitionName === "meta-muse-code" && ctx.provider.baseUrl && ctx.provider.baseUrl !== definition?.baseUrl) {
+    log(`[Wire] meta-muse-code: user base URL ignored \u2192 ${baseUrl}`);
+  }
   const url = wireRequestUrl(baseUrl, wire.api, connection.externalModelId);
   if (overridden)
     log(`[Wire] ${definitionName}: base URL overridden by user config \u2192 ${baseUrl}`);
@@ -35698,6 +35793,7 @@ var init_wire_handler = __esm(() => {
   init_catalog_client();
   init_connection_resolver();
   init_connection_wire();
+  init_muse_mint();
   init_provider_definitions();
   init_anthropic_compat();
   init_gemini_apikey();
@@ -50334,12 +50430,15 @@ function projectRecommendations(recommendations, catalog, richModels = [], now =
     const priority = (rankByTier.get(recommended.tier) ?? 0) + 1;
     rankByTier.set(recommended.tier, priority);
     const rich = richById.get(recommended.modelId);
+    const nativeProvider = nativeProviderForVendor(rich?.provider ?? model.provider ?? "");
+    const nativeRouteAvailable = Boolean(nativeProvider && model.aggregators?.some((connection) => connection.routeStatus === "mapped" && catalogRouteMatchesProvider(connection.route, nativeProvider)));
     const subscription = recommended.tier === "subscription" ? subscriptionRouteFor(recommended, model, catalog.plans) : undefined;
     models.push({
       id: recommended.modelId,
       name: rich?.displayName ?? model.displayName ?? recommended.modelId,
       description: rich?.description ?? "",
       provider: rich?.provider ?? model.provider ?? "",
+      nativeRouteAvailable,
       recommendationTier: recommended.tier,
       priority,
       pricing: {
@@ -50546,7 +50645,7 @@ function uniqueRecommendedModels(entries) {
 }
 function collectRoutingPrefixes(group, getNativePrefix) {
   const slug = (group.primary.provider || "").toLowerCase();
-  const native = getNativePrefix(slug);
+  const native = group.primary.nativeRouteAvailable === false ? null : getNativePrefix(slug);
   const seen = new Set;
   const out = [];
   if (native) {
@@ -50791,13 +50890,14 @@ function getAvailableModels() {
   _cachedModelIds = result;
   return result;
 }
-var RECOMMENDATION_SECTIONS, RECOMMENDATION_TIER_INDEX, _cachedModelInfo = null, _cachedModelIds = null, _cachedRecommendedModels = null, FIREBASE_BASE_URL = "https://us-central1-claudish-6da10.cloudfunctions.net/queryModels", FIREBASE_RECOMMENDED_URL, RECOMMENDED_PROJECTION_VERSION = 1, RECOMMENDED_MODELS_CACHE_PATH, RECOMMENDED_FETCH_TIMEOUT_MS = 5000, SEARCH_FETCH_TIMEOUT_MS = 1e4, RECOMMENDED_ROUTE_TIER_ORDER;
+var RECOMMENDATION_SECTIONS, RECOMMENDATION_TIER_INDEX, _cachedModelInfo = null, _cachedModelIds = null, _cachedRecommendedModels = null, FIREBASE_BASE_URL = "https://us-central1-claudish-6da10.cloudfunctions.net/queryModels", FIREBASE_RECOMMENDED_URL, RECOMMENDED_PROJECTION_VERSION = 2, RECOMMENDED_MODELS_CACHE_PATH, RECOMMENDED_FETCH_TIMEOUT_MS = 5000, SEARCH_FETCH_TIMEOUT_MS = 1e4, RECOMMENDED_ROUTE_TIER_ORDER;
 var init_model_loader = __esm(() => {
   init_all_models_cache();
   init_auto_route();
   init_cache_ttl();
   init_catalog_client();
   init_catalog_route_bindings();
+  init_route_candidates();
   RECOMMENDATION_SECTIONS = [
     { recommendationTier: "flagship", title: "Flagship", quickPickEligible: true },
     {
@@ -67970,6 +68070,9 @@ ${h("SUBCOMMANDS")}
   ${green("claudish providers")} ${yellow("[--json]")}             Show provider credential status (no key material)
   ${green("claudish quota")} ${yellow("[provider]")}              Show remaining quota/usage (alias: usage)
   ${green("claudish serve")} ${yellow("--port <n> --models <p>")}  Run the Claude Desktop redirect gateway
+  ${green("claudish subscription models antigravity")} ${yellow("--raw --json")}
+                                          Print the raw Antigravity fetchAvailableModels
+                                          ${dim("body as one JSON line (for models-index)")}
   ${green("claudish update")}                        Check for updates and install the latest version
 
   ${bold("Profiles:")}
@@ -69380,6 +69483,7 @@ var init_pane_launch = __esm(() => {
     "serve",
     "providers",
     "keychain",
+    "subscription",
     "hooks",
     "team",
     "login",
@@ -81093,6 +81197,364 @@ var init_keychain_command = __esm(() => {
   VALUE_FLAGS = new Set(["--config", "--from", "--only"]);
 });
 
+// src/subscription-models-command.ts
+var exports_subscription_models_command = {};
+__export(exports_subscription_models_command, {
+  EXIT: () => EXIT,
+  FAILURE_CODES: () => FAILURE_CODES,
+  INTERNAL_ERROR_MESSAGE: () => INTERNAL_ERROR_MESSAGE,
+  SECRET_GUARD_MESSAGE: () => SECRET_GUARD_MESSAGE,
+  SUBSCRIPTION_MODELS_USAGE: () => SUBSCRIPTION_MODELS_USAGE,
+  SUBSCRIPTION_MODEL_LIST_SCHEMA: () => SUBSCRIPTION_MODEL_LIST_SCHEMA,
+  defaultSubscriptionModelsDeps: () => defaultSubscriptionModelsDeps,
+  exitCodeFor: () => exitCodeFor,
+  parseSubscriptionModelsArgs: () => parseSubscriptionModelsArgs,
+  reportSubscriptionInternalError: () => reportSubscriptionInternalError,
+  runAntigravityRawModelList: () => runAntigravityRawModelList,
+  subscriptionModelsCommand: () => subscriptionModelsCommand
+});
+function exitCodeFor(failure) {
+  if (failure.class === "internal")
+    return failure.code === "usage" ? EXIT.usage : EXIT.internal;
+  return EXIT[failure.class];
+}
+function defaultSubscriptionModelsDeps() {
+  return {
+    platform: () => process.platform,
+    readStore: readAntigravityStoreClassified,
+    tokenDeps: defaultAntigravityTokenDeps,
+    now: () => Date.now(),
+    httpTimeoutMs: 30000,
+    keychainDeadlineMs: 1e4,
+    writeStdout: (line) => new Promise((resolve, reject) => {
+      process.stdout.write(line, (err) => err ? reject(err) : resolve());
+    }),
+    writeStderr: (line) => {
+      process.stderr.write(line);
+    }
+  };
+}
+function parseSubscriptionModelsArgs(argv) {
+  const positionals = argv.filter((a) => !a.startsWith("-"));
+  const flags = argv.filter((a) => a.startsWith("-"));
+  const positionalsOk = positionals.length === 2 && positionals[0] === "models" && positionals[1] === "antigravity";
+  const flagsOk = flags.length === 2 && flags.includes("--raw") && flags.includes("--json");
+  return positionalsOk && flagsOk ? { ok: true, provider: "antigravity" } : { ok: false };
+}
+function addSecret(secrets, value) {
+  if (typeof value === "string" && value.length > 0)
+    secrets.values.add(value);
+}
+function buildEnvelope(facts, failure, body) {
+  return {
+    schema: SUBSCRIPTION_MODEL_LIST_SCHEMA,
+    ...facts.provider !== undefined ? { provider: facts.provider } : {},
+    claudishVersion: VERSION,
+    ...facts.fetchedAt !== undefined ? { fetchedAt: facts.fetchedAt } : {},
+    ...facts.sourceUrl !== undefined ? { sourceUrl: facts.sourceUrl } : {},
+    ...facts.clientVersion !== undefined ? { clientVersion: facts.clientVersion } : {},
+    ...facts.clientVersionSource !== undefined ? { clientVersionSource: facts.clientVersionSource } : {},
+    tokenRefreshed: facts.tokenRefreshed,
+    ...facts.httpStatus !== undefined ? { httpStatus: facts.httpStatus } : {},
+    ...failure ? { failure } : {},
+    ...body !== undefined ? { body } : {}
+  };
+}
+function failureOf2(cls, code, httpStatus) {
+  return { class: cls, code, ...httpStatus !== undefined ? { httpStatus } : {} };
+}
+function stripUserinfo(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]*@/i, "$1");
+  }
+}
+function storeReadFailure(read) {
+  switch (read.kind) {
+    case "absent":
+      return failureOf2("credential_missing", "keychain_item_absent");
+    case "locked":
+      return failureOf2("keychain_locked", "keychain_locked");
+    case "timeout":
+      return failureOf2("keychain_locked", "keychain_read_timeout");
+    default:
+      return failureOf2("keychain_locked", "keychain_read_failed");
+  }
+}
+function tokenFailure(refreshCalled, outcome) {
+  if (!refreshCalled)
+    return failureOf2("credential_missing", "token_unparseable");
+  switch (outcome?.kind) {
+    case "not-installed":
+      return failureOf2("mint_failed", "agy_missing");
+    case "timeout":
+      return failureOf2("mint_failed", "agy_refresh_timeout");
+    case "ran":
+      return failureOf2("mint_failed", "agy_refresh_no_valid_token");
+    default:
+      return failureOf2("mint_failed", "agy_refresh_failed");
+  }
+}
+function loadCodeAssistFailure(err) {
+  const fields = err ?? {};
+  const status = typeof fields.upstreamStatus === "number" ? fields.upstreamStatus : undefined;
+  if (status !== undefined) {
+    if (status === 429)
+      return failureOf2("network", "load_code_assist_429", status);
+    if (status >= 500 && status <= 599)
+      return failureOf2("network", "load_code_assist_5xx", status);
+    return failureOf2("mint_failed", "load_code_assist_4xx", status);
+  }
+  if (err instanceof SyntaxError)
+    return failureOf2("mint_failed", "load_code_assist_bad_body");
+  if (fields.terminal === true)
+    return failureOf2("mint_failed", "load_code_assist_no_project");
+  return failureOf2("network", "load_code_assist_network_error");
+}
+function listFailure(value, status) {
+  const models = value !== null && typeof value === "object" && !Array.isArray(value) ? value.models : undefined;
+  if (models === null || typeof models !== "object" || Array.isArray(models)) {
+    return failureOf2("list_incomplete", "models_absent", status);
+  }
+  if (Object.keys(models).length === 0) {
+    return failureOf2("list_incomplete", "models_empty", status);
+  }
+  return null;
+}
+async function raceTimeout(work, ms) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), ms);
+  });
+  work.catch(() => {});
+  try {
+    return await Promise.race([work, timedOut]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function fail(facts, failure) {
+  return { envelope: buildEnvelope(facts, failure), exitCode: exitCodeFor(failure) };
+}
+function lineOf(envelope) {
+  return `${JSON.stringify(envelope)}
+`;
+}
+function containsSecret(secrets, ...texts) {
+  for (const secret of secrets.values) {
+    if (texts.some((text) => text?.includes(secret)))
+      return true;
+  }
+  return false;
+}
+function safeStderr(deps, line) {
+  try {
+    deps.writeStderr(line);
+  } catch {}
+}
+async function writeInternalFailure(deps, facts, code, stderrLine, secrets) {
+  const failure = failureOf2("internal", code);
+  safeStderr(deps, `${stderrLine}
+`);
+  const line = lineOf(buildEnvelope(facts, failure));
+  if (!secrets || !containsSecret(secrets, line)) {
+    try {
+      await deps.writeStdout(line);
+    } catch {}
+  }
+  return exitCodeFor(failure);
+}
+async function reportSubscriptionInternalError(deps) {
+  let resolved;
+  try {
+    resolved = deps ?? defaultSubscriptionModelsDeps();
+  } catch {
+    process.stderr.write(`${INTERNAL_ERROR_MESSAGE}
+`);
+    return EXIT.internal;
+  }
+  return writeInternalFailure(resolved, { tokenRefreshed: false }, "internal_error", INTERNAL_ERROR_MESSAGE);
+}
+async function obtainAccessToken(deps, facts, secrets, preRaw) {
+  const base = deps.tokenDeps();
+  let firstRead = true;
+  let refreshCalled = false;
+  let refreshOutcome = null;
+  const laterReads = [];
+  const observed = {
+    ...base,
+    readStore: () => {
+      if (firstRead) {
+        firstRead = false;
+        return preRaw;
+      }
+      const raw = base.readStore();
+      if (raw)
+        laterReads.push(raw);
+      return raw;
+    },
+    runAgyRefresh: () => {
+      refreshCalled = true;
+      facts.tokenRefreshed = true;
+      refreshOutcome = base.runAgyRefresh();
+      return refreshOutcome;
+    }
+  };
+  let accessToken;
+  try {
+    accessToken = await getValidAntigravityAccessToken(observed);
+  } catch {
+    return { ok: false, result: fail(facts, tokenFailure(refreshCalled, refreshOutcome)) };
+  }
+  addSecret(secrets, accessToken);
+  for (const raw of [preRaw, ...laterReads]) {
+    addSecret(secrets, raw);
+    addSecret(secrets, readSharedAntigravityToken({ ...base, readStore: () => raw })?.refresh_token);
+  }
+  return { ok: true, accessToken };
+}
+function classifyAvailableModels(facts, raw, timedOut) {
+  facts.sourceUrl = stripUserinfo(raw.url);
+  facts.clientVersion = raw.clientVersion;
+  facts.clientVersionSource = raw.clientVersionSource;
+  const networkCode = timedOut ? "fetch_available_models_timeout" : "fetch_available_models_network_error";
+  if (raw.kind === "unreachable")
+    return fail(facts, failureOf2("network", networkCode));
+  facts.fetchedAt = raw.fetchedAt;
+  facts.httpStatus = raw.status;
+  if (raw.status < 200 || raw.status >= 300) {
+    return { envelope: buildEnvelope(facts), exitCode: EXIT.ok };
+  }
+  switch (raw.body.kind) {
+    case "json": {
+      const incomplete = listFailure(raw.body.value, raw.status);
+      if (incomplete)
+        return fail(facts, incomplete);
+      return {
+        envelope: buildEnvelope(facts, undefined, raw.body.text),
+        exitCode: EXIT.ok,
+        bodyText: raw.body.text
+      };
+    }
+    case "not-json":
+      return fail(facts, failureOf2("list_incomplete", "body_not_json", raw.status));
+    default:
+      return fail(facts, failureOf2("network", networkCode, raw.status));
+  }
+}
+async function determine(deps, secrets, facts) {
+  if (deps.platform() !== "darwin") {
+    return fail(facts, failureOf2("credential_missing", "platform_unsupported"));
+  }
+  const read = await deps.readStore(deps.keychainDeadlineMs);
+  if (read.kind !== "present")
+    return fail(facts, storeReadFailure(read));
+  addSecret(secrets, read.raw);
+  const token = await obtainAccessToken(deps, facts, secrets, read.raw);
+  if (!token.ok)
+    return token.result;
+  const version = resolveAntigravityClientVersion();
+  facts.clientVersion = version.version;
+  facts.clientVersionSource = version.source;
+  let projectId;
+  try {
+    const setup = await raceTimeout(setupAntigravityUser(token.accessToken), deps.httpTimeoutMs);
+    if (setup === TIMED_OUT)
+      return fail(facts, failureOf2("network", "load_code_assist_timeout"));
+    projectId = setup.projectId;
+  } catch (err) {
+    return fail(facts, loadCodeAssistFailure(err));
+  }
+  addSecret(secrets, projectId);
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), deps.httpTimeoutMs);
+  try {
+    const raw = await fetchAntigravityAvailableModelsRaw(token.accessToken, projectId, {
+      signal: controller.signal,
+      now: deps.now
+    });
+    return classifyAvailableModels(facts, raw, controller.signal.aborted);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function runAntigravityRawModelList(deps) {
+  const secrets = { values: new Set };
+  const facts = { provider: "antigravity", tokenRefreshed: false };
+  let line;
+  let exitCode;
+  let bodyText;
+  try {
+    const result = await determine(deps, secrets, facts);
+    line = lineOf(result.envelope);
+    exitCode = result.exitCode;
+    bodyText = result.bodyText;
+  } catch {
+    return writeInternalFailure(deps, { provider: facts.provider, tokenRefreshed: facts.tokenRefreshed }, "internal_error", INTERNAL_ERROR_MESSAGE, secrets);
+  }
+  if (containsSecret(secrets, line, bodyText)) {
+    return writeInternalFailure(deps, facts, "secret_guard", SECRET_GUARD_MESSAGE, secrets);
+  }
+  try {
+    await deps.writeStdout(line);
+  } catch {
+    safeStderr(deps, `${INTERNAL_ERROR_MESSAGE}
+`);
+    return EXIT.internal;
+  }
+  return exitCode;
+}
+async function subscriptionModelsCommand(argv, deps = defaultSubscriptionModelsDeps()) {
+  if (!parseSubscriptionModelsArgs(argv).ok) {
+    return writeInternalFailure(deps, { tokenRefreshed: false }, "usage", SUBSCRIPTION_MODELS_USAGE);
+  }
+  return runAntigravityRawModelList(deps);
+}
+var SUBSCRIPTION_MODEL_LIST_SCHEMA = "claudish.subscription-model-list.v1", FAILURE_CODES, EXIT, SUBSCRIPTION_MODELS_USAGE = "usage: claudish subscription models antigravity --raw --json", SECRET_GUARD_MESSAGE = "[claudish subscription] refused: output contained a credential value", INTERNAL_ERROR_MESSAGE = "[claudish subscription] internal error", TIMED_OUT;
+var init_subscription_models_command = __esm(() => {
+  init_antigravity_token();
+  init_antigravity_user();
+  FAILURE_CODES = {
+    credential_missing: ["platform_unsupported", "keychain_item_absent", "token_unparseable"],
+    keychain_locked: ["keychain_locked", "keychain_read_timeout", "keychain_read_failed"],
+    mint_failed: [
+      "agy_missing",
+      "agy_refresh_failed",
+      "agy_refresh_timeout",
+      "agy_refresh_no_valid_token",
+      "load_code_assist_4xx",
+      "load_code_assist_no_project",
+      "load_code_assist_bad_body"
+    ],
+    network: [
+      "load_code_assist_network_error",
+      "load_code_assist_429",
+      "load_code_assist_5xx",
+      "load_code_assist_timeout",
+      "fetch_available_models_network_error",
+      "fetch_available_models_timeout"
+    ],
+    list_incomplete: ["models_absent", "models_empty", "body_not_json"],
+    internal: ["usage", "secret_guard", "internal_error"]
+  };
+  EXIT = {
+    ok: 0,
+    internal: 1,
+    usage: 2,
+    credential_missing: 3,
+    keychain_locked: 4,
+    mint_failed: 5,
+    network: 6,
+    list_incomplete: 7
+  };
+  TIMED_OUT = Symbol("timed-out");
+});
+
 // src/auth/antigravity-oauth.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync39, unlinkSync as unlinkSync9 } from "fs";
@@ -89489,7 +89951,7 @@ class InteractiveDriver {
       try {
         this.binding.fireEnd(outcome);
       } catch {}
-      await raceTimeout(this.binding.endSettled?.() ?? Promise.resolve(), SESSION_END_WAIT_MS);
+      await raceTimeout2(this.binding.endSettled?.() ?? Promise.resolve(), SESSION_END_WAIT_MS);
       try {
         this.binding.sweepInbox?.();
       } catch {}
@@ -90132,7 +90594,7 @@ function fileSizeOf(path) {
     return 0;
   }
 }
-function raceTimeout(p, ms) {
+function raceTimeout2(p, ms) {
   return new Promise((resolve) => {
     const t = setTimeout(resolve, ms);
     p.then(() => {
@@ -91145,13 +91607,15 @@ function mergeUserSettingsIfPresent(config, tempSettingsPath, statusLine, proxyA
 async function resolveLocalContextWindow(spec, cachePath) {
   const parsed = parseModelSpec(spec);
   let provider = parsed.provider;
+  let wireId = parsed.model;
   if (!parsed.isExplicitProvider) {
     const plan = await route(spec);
     if (plan.kind !== "ok")
       return null;
     provider = plan.primary.provider;
+    wireId = parseModelSpec(plan.primary.modelSpec).model;
   }
-  const win = await discoverContextWindow(provider, parsed.model) ?? lookupModelForProvider(parsed.model, provider, cachePath);
+  const win = await discoverContextWindow(provider, wireId) ?? lookupModelForProvider(parsed.model, provider, cachePath) ?? (wireId !== parsed.model ? lookupModelForProvider(wireId, provider, cachePath) : null);
   return {
     modelId: parsed.model,
     window: typeof win === "number" && win > 0 ? win : null
@@ -94421,6 +94885,7 @@ function classifyStartupKind() {
     "stats",
     "providers",
     "keychain",
+    "subscription",
     "login",
     "logout",
     "quota",
@@ -94558,6 +95023,7 @@ var isConfigCommand = firstPositional === "config";
 var isServeCommand = firstPositional === "serve";
 var isProvidersCommand = firstPositional === "providers";
 var isKeychainCommand = firstPositional === "keychain";
+var isSubscriptionCommand = firstPositional === "subscription";
 var isHooksCommand = firstPositional === "hooks";
 var isTeamCommand = firstPositional === "team";
 var isLoginCommand = firstPositional === "login";
@@ -94603,6 +95069,14 @@ if (isMcpMode) {
     console.error(`[claudish keychain] ${e instanceof Error ? e.message : String(e)}`);
     process.exit(1);
   }));
+} else if (isSubscriptionCommand) {
+  const subscriptionArgIndex = args.indexOf("subscription");
+  const subscriptionModule = () => Promise.resolve().then(() => (init_subscription_models_command(), exports_subscription_models_command));
+  subscriptionModule().then((m) => m.subscriptionModelsCommand(args.slice(subscriptionArgIndex + 1))).catch(() => subscriptionModule().then((m) => m.reportSubscriptionInternalError()).catch(() => {
+    process.stderr.write(`[claudish subscription] internal error
+`);
+    return 1;
+  })).then((code) => process.exit(code));
 } else if (isLoginCommand) {
   const loginProviderArg = args.find((a, i) => i > args.indexOf("login") && !a.startsWith("-"));
   Promise.resolve().then(() => (init_auth_commands(), {})).then((m) => loginCommand(loginProviderArg).catch(handlePromptExit));