claudish 14.18.1 → 14.18.3

package/dist/index.js

@@ -5494,7 +5494,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "14.18.1";
+var VERSION = "14.18.3";
 
 // src/redact.ts
 function isPlaceholder(value) {
@@ -26401,6 +26401,7 @@ var version2 = null, readForToken = null;
 
 // src/auth/antigravity-token.ts
 import { execFileSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync11 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join12 } from "path";
@@ -26408,6 +26409,8 @@ function invalidateReadStoreMemo() {
   cachedRawStore = null;
 }
 function defaultReadStore() {
+  if (process.env.CLAUDISH_DISABLE_KEYCHAIN === "1")
+    return null;
   if (process.platform !== "darwin") {
     logStderr("[Antigravity] Shared token store is macOS-only for now (other keyring backends are a follow-up).");
     return null;
@@ -26549,7 +26552,7 @@ function encodeRecord(rec) {
   return PREFIX + Buffer.from(JSON.stringify(rec), "utf8").toString("base64");
 }
 function readSharedAntigravityToken(deps = defaultDeps3) {
-  const rec = parseRecord2(deps.readStore());
+  const rec = readObservedRecord(deps);
   return rec ? rec.token : null;
 }
 function hasSharedAntigravityToken(deps = defaultDeps3) {
@@ -26596,11 +26599,44 @@ function captureAgyClientVersion(accessToken, deps) {
     log("[Antigravity] Could not read the agy version" + (kept ? `; keeping ${kept}.` : "; using the fallback version."));
   }
 }
+function antigravityTokenLineageMaterial(token) {
+  if (token.refresh_token)
+    return `refresh:${token.refresh_token}`;
+  if (token.access_token)
+    return `access:${token.access_token}`;
+  return;
+}
+function sha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function observeLineage(token) {
+  const material = token ? antigravityTokenLineageMaterial(token) : undefined;
+  observedLineage = material ? sha256(material) : null;
+  if (!observedLineage || !token?.access_token)
+    return;
+  const key = sha256(token.access_token);
+  lineageByAccessToken.delete(key);
+  lineageByAccessToken.set(key, observedLineage);
+  if (lineageByAccessToken.size > MAX_TRACKED_ACCESS_TOKENS) {
+    lineageByAccessToken.delete(lineageByAccessToken.keys().next().value);
+  }
+}
+function readObservedRecord(deps) {
+  const rec = parseRecord2(deps.readStore());
+  observeLineage(rec ? rec.token : null);
+  return rec;
+}
+function currentAntigravityTokenLineage() {
+  return observedLineage;
+}
+function lineageForAntigravityAccessToken(accessToken) {
+  return lineageByAccessToken.get(sha256(accessToken)) ?? null;
+}
 async function resolveValidToken(deps) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
-  const rec = parseRecord2(deps.readStore());
+  const rec = readObservedRecord(deps);
   if (!rec) {
     throw terminalCredentialError("[Antigravity] No Antigravity session found. Sign in with `claudish login antigravity`, " + "or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
@@ -26610,7 +26646,7 @@ async function resolveValidToken(deps) {
   }
   log("[Antigravity] Access token expired/near-expiry \u2014 asking the Antigravity CLI to refresh.");
   const outcome = deps.runAgyRefresh();
-  const refreshedRec = parseRecord2(deps.readStore());
+  const refreshedRec = readObservedRecord(deps);
   if (refreshedRec && !needsRefresh(refreshedRec.token, deps.now())) {
     log("[Antigravity] Shared token refreshed by the Antigravity CLI.");
     captureAgyClientVersion(refreshedRec.token.access_token, deps);
@@ -26647,8 +26683,8 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
-  _resetAntigravityTokenState();
-  const rec = parseRecord2(deps.readStore());
+  resetObservedTokenState();
+  const rec = readObservedRecord(deps);
   if (!rec) {
     throw terminalCredentialError("[Antigravity] No Antigravity session found. Sign in with `claudish login antigravity`, " + "or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
@@ -26656,7 +26692,7 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   log("[Antigravity] Upstream rejected the current token \u2014 asking the Antigravity CLI to re-mint.");
   writeSharedAntigravityToken({ ...original, expiry: new Date(deps.now() - 1000).toISOString() }, deps);
   const outcome = deps.runAgyRefresh();
-  const refreshed = parseRecord2(deps.readStore());
+  const refreshed = readObservedRecord(deps);
   const token = refreshed?.token;
   if (token && token.access_token !== original.access_token && !needsRefresh(token, deps.now())) {
     log("[Antigravity] Shared token re-minted by the Antigravity CLI.");
@@ -26666,7 +26702,7 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   if (!refreshed || refreshed.token.access_token === original.access_token) {
     writeSharedAntigravityToken(original, deps);
   }
-  _resetAntigravityTokenState();
+  resetObservedTokenState();
   if (outcome.kind === "timeout" || outcome.kind === "failed") {
     const message = `[Antigravity] ${describeRefreshFailure(outcome)}`;
     if (outcome.kind === "timeout") {
@@ -26680,11 +26716,16 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   throw terminalCredentialError("[Antigravity] The Antigravity session was rejected upstream and could not be re-minted. " + "Run `claudish login antigravity` to sign in again.");
 }
 function _resetAntigravityTokenState() {
+  resetObservedTokenState();
+  lineageByAccessToken.clear();
+}
+function resetObservedTokenState() {
   inFlight = null;
   cachedHasToken = null;
+  observedLineage = null;
   invalidateReadStoreMemo();
 }
-var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps3, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
+var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps3, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null, observedLineage = null, MAX_TRACKED_ACCESS_TOKENS = 8, lineageByAccessToken;
 var init_antigravity_token = __esm(() => {
   init_logger();
   init_keychain();
@@ -26697,6 +26738,7 @@ var init_antigravity_token = __esm(() => {
     now: () => Date.now()
   };
   KEYCHAIN_LOCKED_EXIT_CODES = new Set([36, 51, 128]);
+  lineageByAccessToken = new Map;
 });
 
 // src/auth/antigravity-user.ts
@@ -26749,6 +26791,26 @@ function resetAntigravityUserCache() {
   agServedCache = null;
   agServedCacheAt = 0;
   agServedCacheVersion = null;
+  cachedAgLineage = null;
+}
+function syncAccountCaches() {
+  const lineage = currentAntigravityTokenLineage();
+  if (lineage === cachedAgLineage)
+    return;
+  if (cachedAgProjectId || agServedCache) {
+    log("[Antigravity] Token lineage changed; dropping the cached project, tier and models.");
+  }
+  resetAntigravityUserCache();
+  cachedAgLineage = lineage;
+}
+function lineageOfToken(accessToken) {
+  return lineageForAntigravityAccessToken(accessToken) ?? currentAntigravityTokenLineage();
+}
+function mayPublishFor(lineage) {
+  if (currentAntigravityTokenLineage() !== lineage)
+    return false;
+  syncAccountCaches();
+  return true;
 }
 async function callLoadCodeAssistAntigravity(accessToken) {
   const res = await fetch(`${apiBase()}:loadCodeAssist`, {
@@ -26766,7 +26828,9 @@ async function callLoadCodeAssistAntigravity(accessToken) {
   return await res.json();
 }
 async function setupAntigravityUser(accessToken) {
-  if (cachedAgProjectId && cachedAgTierId) {
+  syncAccountCaches();
+  const lineage = lineageOfToken(accessToken);
+  if (lineage === cachedAgLineage && cachedAgProjectId && cachedAgTierId) {
     return { projectId: cachedAgProjectId, tierId: cachedAgTierId };
   }
   const loadRes = await callLoadCodeAssistAntigravity(accessToken);
@@ -26776,13 +26840,18 @@ async function setupAntigravityUser(accessToken) {
   if (!projectId) {
     throw makeTerminalSetupError("Antigravity did not return a project for this account. Sign in to Antigravity " + "(`claudish login antigravity`) and try again, or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
-  cachedAgProjectId = projectId;
-  cachedAgTierId = resolvedTier;
-  cachedAgTierName = loadRes.paidTier?.name || null;
+  if (mayPublishFor(lineage)) {
+    cachedAgProjectId = projectId;
+    cachedAgTierId = resolvedTier;
+    cachedAgTierName = loadRes.paidTier?.name || null;
+  } else {
+    log("[Antigravity] Token lineage changed during setup; the result is not cached.");
+  }
   log(`[Antigravity] User set up, project: ${projectId}, tier: ${resolvedTier}`);
   return { projectId, tierId: resolvedTier };
 }
 function getAntigravityTierDisplayName() {
+  syncAccountCaches();
   if (!cachedAgTierName && !cachedAgTierId)
     return "Antigravity";
   const id = cachedAgTierId || "";
@@ -26872,6 +26941,9 @@ async function fetchAntigravityAvailableModelsRaw(accessToken, projectId, opts)
   }
 }
 async function getServedAntigravityModels(accessToken, projectId, opts) {
+  syncAccountCaches();
+  const lineage = lineageOfToken(accessToken);
+  const ownList = lineage === cachedAgLineage;
   const now = Date.now();
   const version = antigravityClientVersion();
   if (agServedCache && agServedCacheVersion !== version) {
@@ -26879,9 +26951,10 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
     agServedCache = null;
     agServedCacheAt = 0;
   }
-  if (!opts?.force && agServedCache && now - agServedCacheAt < SERVED_MODELS_TTL_MS) {
+  if (!opts?.force && ownList && agServedCache && now - agServedCacheAt < SERVED_MODELS_TTL_MS) {
     return agServedCache;
   }
+  const prior = ownList ? agServedCache : null;
   try {
     const raw = await fetchAntigravityAvailableModelsRaw(accessToken, projectId);
     if (raw.kind === "unreachable") {
@@ -26929,7 +27002,7 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
             deprecatedReplacements[oldId] = info.newModelId;
         }
         const agentModelIds = flattenAgentModelSorts(data.agentModelSorts);
-        agServedCache = {
+        const served = {
           servedIds,
           defaultId,
           meta,
@@ -26937,26 +27010,34 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
           deprecatedReplacements,
           ...agentModelIds ? { agentModelIds } : {}
         };
+        if (!mayPublishFor(lineage)) {
+          log("[Antigravity] Token lineage changed during discovery; the result is not cached.");
+          return served;
+        }
+        agServedCache = served;
         agServedCacheAt = now;
         agServedCacheVersion = raw.clientVersion;
-        return agServedCache;
+        return served;
       }
     }
   } catch (err) {
     log(`[Antigravity] fetchAvailableModels error: ${err}`);
   }
-  if (agServedCache)
-    return agServedCache;
+  if (prior)
+    return prior;
   return { servedIds: [], defaultId: null, meta: {} };
 }
 function peekServedAntigravityModels() {
   if (!agServedCache || agServedCacheVersion !== antigravityClientVersion())
     return null;
+  if (cachedAgLineage !== currentAntigravityTokenLineage())
+    return null;
   return agServedCache;
 }
-var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", AGY_FALLBACK_CLIENT_VERSION = "1.1.9", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, agServedCache = null, agServedCacheAt = 0, agServedCacheVersion = null;
+var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", AGY_FALLBACK_CLIENT_VERSION = "1.1.9", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, cachedAgLineage = null, agServedCache = null, agServedCacheAt = 0, agServedCacheVersion = null;
 var init_antigravity_user = __esm(() => {
   init_logger();
+  init_antigravity_token();
   SERVED_MODELS_TTL_MS = 10 * 60 * 1000;
 });
 
@@ -27318,7 +27399,7 @@ var init_credential_file = __esm(() => {
 
 // src/auth/oauth-manager.ts
 import { exec as exec2 } from "child_process";
-import { createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes5 } from "crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync10, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join13 } from "path";
@@ -27421,7 +27502,7 @@ class OAuthManager {
     return randomBytes5(64).toString("base64url");
   }
   generateCodeChallenge(verifier) {
-    return createHash3("sha256").update(verifier).digest("base64url");
+    return createHash4("sha256").update(verifier).digest("base64url");
   }
   async openBrowser(url, message) {
     try {
@@ -28787,9 +28868,9 @@ var init_registry2 = __esm(() => {
 });
 
 // src/code-mode/ids.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function sha256Hex(input) {
-  return createHash4("sha256").update(input).digest("hex");
+  return createHash5("sha256").update(input).digest("hex");
 }
 function accountKeyFromBinding(binding) {
   const auth = binding?.auth;
@@ -28827,8 +28908,8 @@ function decodeNestedId(id) {
   return { execKey: match[1], seq: Number(match[2]) };
 }
 function uuidV5(namespace, name) {
-  const ns = createHash4("sha256").update(namespace).digest().subarray(0, 16);
-  const hash = createHash4("sha1").update(ns).update(name).digest();
+  const ns = createHash5("sha256").update(namespace).digest().subarray(0, 16);
+  const hash = createHash5("sha1").update(ns).update(name).digest();
   const bytes = Buffer.from(hash.subarray(0, 16));
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
@@ -29190,7 +29271,7 @@ var init_exec_tool = __esm(() => {
 });
 
 // src/code-mode/hashes.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function withoutCacheMarkers(value) {
   if (Array.isArray(value))
     return value.map(withoutCacheMarkers);
@@ -29213,7 +29294,7 @@ function canonicalJson(value) {
   return `{${body}}`;
 }
 function inputHash(input) {
-  return createHash5("sha256").update(canonicalJson(input ?? {})).digest("hex");
+  return createHash6("sha256").update(canonicalJson(input ?? {})).digest("hex");
 }
 function compareIds(a, b) {
   const da = decodeNestedId(a);
@@ -29224,7 +29305,7 @@ function compareIds(a, b) {
 }
 function batchHash(entries) {
   const ordered = [...entries].sort((a, b) => compareIds(a.toolUseId, b.toolUseId));
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   for (const entry of ordered) {
     const canonical = entry.result ? canonicalJson([
       entry.toolUseId,
@@ -29238,7 +29319,7 @@ function batchHash(entries) {
   return hash.digest("hex");
 }
 function completionKey(batchHashes) {
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   for (const h of batchHashes) {
     hash.update(h);
     hash.update(`
@@ -33371,9 +33452,9 @@ var init_prelude = __esm(() => {
 });
 
 // src/code-mode/sandbox/script-runtime.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function seedNumber(seed) {
-  return createHash6("sha256").update(seed).digest().readUInt32BE(0);
+  return createHash7("sha256").update(seed).digest().readUInt32BE(0);
 }
 function utf8Bytes2(text) {
   return Buffer.byteLength(text, "utf8");
@@ -33919,9 +34000,9 @@ var init_script_runtime = __esm(() => {
 });
 
 // src/code-mode/turn-records.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function sha256Hex2(text) {
-  return createHash7("sha256").update(text).digest("hex");
+  return createHash8("sha256").update(text).digest("hex");
 }
 function recordKey(sessionKey, anchor) {
   return `${sessionKey}\x00${anchor}`;
@@ -34758,9 +34839,9 @@ var init_tool_results = __esm(() => {
 });
 
 // src/code-mode/transliterate.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function transliteratedCallId(firstToolUseId) {
-  return `call_${createHash8("sha256").update(firstToolUseId).digest("hex").slice(0, 32)}`;
+  return `call_${createHash9("sha256").update(firstToolUseId).digest("hex").slice(0, 32)}`;
 }
 function callExpression(use, names) {
   const name = typeof use.name === "string" ? use.name : "";
@@ -34834,12 +34915,12 @@ function relayNestedInput(block, repair) {
 }
 
 // src/code-mode/input-builder.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function blocksOf2(message) {
   return message && Array.isArray(message.content) ? message.content : [];
 }
 function sha256Hex3(text) {
-  return createHash9("sha256").update(text).digest("hex");
+  return createHash10("sha256").update(text).digest("hex");
 }
 function reasoningKey(item) {
   if (typeof item.id === "string" && item.id)
@@ -35590,7 +35671,7 @@ var init_stores = __esm(() => {
 });
 
 // src/code-mode/request.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 function isLiteFallbackActive(model, now = Date.now()) {
   const until = liteFallbackUntil.get(model.toLowerCase());
   if (until === undefined)
@@ -35633,7 +35714,7 @@ function applyCodeModeToPayload(payload, ctx) {
   if (shape === "lite") {
     const reasoning = liteReasoning(payload, ctx.modelInfo);
     if (reasoning) {
-      const toolsHash = createHash10("sha256").update(JSON.stringify(ctx.execTool)).digest("hex");
+      const toolsHash = createHash11("sha256").update(JSON.stringify(ctx.execTool)).digest("hex");
       payload.reasoning = reasoning;
       delete payload.tools;
       delete payload.instructions;
@@ -37911,7 +37992,7 @@ var init_output_capture = __esm(() => {
 });
 
 // src/hooks/telemetry/aggregate.ts
-import { createHash as createHash11, randomBytes as randomBytes6 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes6 } from "crypto";
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
 import { homedir as homedir19 } from "os";
 import { dirname as dirname11, join as join19 } from "path";
@@ -37935,7 +38016,7 @@ function contextFillPct(peakTokens, window2 = enforcedContextWindow) {
   return Math.min(100, Math.max(0, Math.round(peakTokens / window2 * 100)));
 }
 function hashSessionId(rawSessionId, model) {
-  return createHash11("sha256").update(`${SESSION_SALT}:${rawSessionId}:${model}`).digest("hex");
+  return createHash12("sha256").update(`${SESSION_SALT}:${rawSessionId}:${model}`).digest("hex");
 }
 function setTelemetryConsent(value) {
   consent = value;
@@ -42128,7 +42209,7 @@ class AntigravityCredentialProvider {
     const token = readSharedAntigravityToken();
     if (!token)
       return;
-    const lineage = token.refresh_token ? `refresh:${token.refresh_token}` : token.access_token ? `access:${token.access_token}` : undefined;
+    const lineage = antigravityTokenLineageMaterial(token);
     return lineage ? `${lineage}
 ${antigravityHost()}` : undefined;
   }
@@ -44741,7 +44822,7 @@ var init_dist12 = __esm(() => {
 
 // src/auth/codex-pkce.ts
 import { exec as exec4 } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash13, randomBytes as randomBytes7 } from "crypto";
 import { createServer } from "http";
 import { promisify as promisify3 } from "util";
 function loginClaims(idToken) {
@@ -44853,7 +44934,7 @@ function waitForCallback(options, deps) {
 async function loginCodexPkce(deps = {}) {
   log("[CodexOAuth] Starting OAuth login flow");
   const verifier = randomBytes7(64).toString("base64url");
-  const challenge = createHash12("sha256").update(verifier).digest("base64url");
+  const challenge = createHash13("sha256").update(verifier).digest("base64url");
   const state = randomBytes7(32).toString("base64url");
   const options = {
     port: 1455,
@@ -48533,10 +48614,6 @@ var init_dynamic_models_catalog_store = __esm(() => {
 
 // src/providers/dynamic-models-catalog.ts
 import { createHmac as createHmac2, randomBytes as randomBytes11 } from "crypto";
-function isPersistedListProvider(provider) {
-  const def = getProviderByName(provider);
-  return def !== undefined && def.modelDiscovery !== undefined && !def.isLocal && (def.tier === "subscription" || def.tier === "dynamic-subscription");
-}
 function nowOf2(opts) {
   return opts?.now ? opts.now() : Date.now();
 }
@@ -48740,6 +48817,7 @@ var init_dynamic_models_catalog = __esm(() => {
   inFlight4 = new Map;
   listeners = new Set;
   credentials.onInvalidate((name) => {
+    invalidateModelDiscovery(name);
     if (name) {
       identityMemo.delete(name);
       liveMemory.delete(name);
@@ -50183,6 +50261,7 @@ var init_devin_request = __esm(() => {
 });
 
 // src/providers/devin/devin-models.ts
+import { createHash as createHash14 } from "crypto";
 function unaryMetadata(apiKey) {
   return msg(bytes(1, "chisel"), bytes(2, DEVIN_CLI_VERSION), bytes(3, apiKey), bytes(4, "en"), bytes(5, process.platform), bytes(7, DEVIN_CLI_VERSION));
 }
@@ -50370,20 +50449,25 @@ function decodeAllowedUids(body) {
   }
   return uids;
 }
+function hashApiKey(apiKey) {
+  return createHash14("sha256").update(apiKey).digest("hex");
+}
 async function getServedDevinModels(opts) {
   const now = Date.now();
-  if (!opts?.force && modelsCatalogCache && now - modelsCatalogCacheAt < MODELS_CATALOG_TTL_MS)
-    return modelsCatalogCache;
   const apiKey = opts?.apiKey ?? readDevinApiKey();
   if (!apiKey)
-    return modelsCatalogCache ?? [];
+    return [];
+  const keyHash = hashApiKey(apiKey);
+  const sameKeyCache = modelsCatalogCacheKeyHash === keyHash ? modelsCatalogCache : null;
+  if (!opts?.force && sameKeyCache && now - modelsCatalogCacheAt < MODELS_CATALOG_TTL_MS)
+    return sameKeyCache;
   try {
     const [configs, allowed] = await Promise.all([
       fetchDevinModelConfigs(apiKey),
       fetchDevinAllowedUids(apiKey)
     ]);
     if (configs.length === 0)
-      return modelsCatalogCache ?? [];
+      return sameKeyCache ?? [];
     const entitled = new Set(allowed);
     const served = configs.filter((config) => config.contextWindow > 0 && (entitled.size === 0 || entitled.has(config.uid)));
     if (entitled.size === 0) {
@@ -50391,13 +50475,14 @@ async function getServedDevinModels(opts) {
     }
     modelsCatalogCache = served;
     modelsCatalogCacheAt = now;
+    modelsCatalogCacheKeyHash = keyHash;
     return served;
   } catch (err) {
     log(`[Devin] served-model discovery error: ${err}`);
-    return modelsCatalogCache ?? [];
+    return sameKeyCache ?? [];
   }
 }
-var MODEL_CONFIGS_PATH = "/exa.api_server_pb.ApiServerService/GetCliModelConfigs", TEAM_SETTINGS_PATH = "/exa.seat_management_pb.SeatManagementService/GetCliTeamSettings", MODELS_CATALOG_TTL_MS, UNARY_TIMEOUT_MS = 1e4, modelsCatalogCache = null, modelsCatalogCacheAt = 0;
+var MODEL_CONFIGS_PATH = "/exa.api_server_pb.ApiServerService/GetCliModelConfigs", TEAM_SETTINGS_PATH = "/exa.seat_management_pb.SeatManagementService/GetCliTeamSettings", MODELS_CATALOG_TTL_MS, UNARY_TIMEOUT_MS = 1e4, modelsCatalogCache = null, modelsCatalogCacheAt = 0, modelsCatalogCacheKeyHash = null;
 var init_devin_models = __esm(() => {
   init_logger();
   init_devin_credentials();
@@ -50863,6 +50948,7 @@ var init_model_discovery_builtins = __esm(() => {
 });
 
 // src/providers/model-discovery.ts
+import { createHash as createHash15 } from "crypto";
 function toModelsCatalogEntry(model) {
   const { id, ...rest } = model;
   return { wireId: id, ...rest };
@@ -50873,6 +50959,10 @@ function registerModelDiscoveryFetcher(format, fetcher) {
 function getModelDiscoveryFetcher(format) {
   return _fetchers.get(format);
 }
+async function accountFingerprint(providerName) {
+  const identity = await credentials.accountIdentity(providerName, { allowOpPrompt: false });
+  return identity ? createHash15("sha256").update(identity).digest("hex") : undefined;
+}
 function recordFailure(failure) {
   _failures.set(failure.provider, failure);
   log(`[model-discovery:${failure.provider}] ${describeDiscoveryFailure(failure)}`);
@@ -50910,15 +51000,20 @@ function describeDiscoveryFailure(failure) {
       return `the endpoint answered${at} but listed no models`;
   }
 }
+function invalidationCount(providerName) {
+  return invalidationsOfAll + (invalidationsByProvider.get(providerName) ?? 0);
+}
 function invalidateModelDiscovery(provider) {
   if (provider) {
     _cache2.delete(provider);
     _failures.delete(provider);
     coldRefreshes.delete(provider);
+    invalidationsByProvider.set(provider, (invalidationsByProvider.get(provider) ?? 0) + 1);
   } else {
     _cache2.clear();
     _failures.clear();
     coldRefreshes.clear();
+    invalidationsOfAll++;
   }
 }
 function registryModelsEndpoint(providerName, def) {
@@ -51041,7 +51136,6 @@ async function discoverViaFetcher(providerName, format) {
   }
   _failures.delete(providerName);
   log(`[model-discovery:${providerName}] discovered ${models.length} models`);
-  _cache2.set(providerName, { models, expiresAt: Date.now() + CACHE_TTL_MS2 });
   return { kind: "served", models };
 }
 async function discoverProviderModelsCatalog(providerName) {
@@ -51075,9 +51169,32 @@ function peekDiscoveredModels(providerName) {
   return cached && cached.expiresAt > Date.now() ? cached.models : undefined;
 }
 async function discoverEveryServedModel(providerName) {
+  if (!getProviderByName(providerName)?.modelDiscovery) {
+    return { kind: "unsupported", reason: "no-descriptor" };
+  }
+  const invalidationsBefore = invalidationCount(providerName);
+  const perAccount = isPersistedListProvider(providerName);
+  const accountBefore = perAccount ? await accountFingerprint(providerName) : undefined;
   const cached = _cache2.get(providerName);
-  if (cached && cached.expiresAt > Date.now())
+  if (cached && cached.expiresAt > Date.now() && cached.account === accountBefore) {
     return { kind: "served", models: cached.models };
+  }
+  const outcome = await fetchServedModels(providerName);
+  if (outcome.kind !== "served")
+    return outcome;
+  const accountAfter = perAccount ? await accountFingerprint(providerName) : undefined;
+  if (accountBefore && accountAfter && accountBefore !== accountAfter)
+    return outcome;
+  if (invalidationCount(providerName) !== invalidationsBefore)
+    return outcome;
+  _cache2.set(providerName, {
+    models: outcome.models,
+    expiresAt: Date.now() + CACHE_TTL_MS2,
+    account: accountAfter ?? accountBefore
+  });
+  return outcome;
+}
+async function fetchServedModels(providerName) {
   const def = getProviderByName(providerName);
   const descriptor = def?.modelDiscovery;
   if (!def || !descriptor)
@@ -51171,7 +51288,6 @@ async function discoverEveryServedModel(providerName) {
   const models = parsed.models;
   _failures.delete(providerName);
   log(`[model-discovery:${providerName}] discovered ${models.length} models from ${endpoint}: ` + models.map((m) => `${m.id}(${m.contextWindow ?? "?"})`).join(", "));
-  _cache2.set(providerName, { models, expiresAt: Date.now() + CACHE_TTL_MS2 });
   return { kind: "served", models };
 }
 async function discoverProviderModels(providerName) {
@@ -51234,7 +51350,7 @@ function rankDiscoveredModels(models) {
     return diff !== 0 ? diff : compareByReleaseDateDesc(a, b);
   });
 }
-var _fetchers, CACHE_TTL_MS2, FETCH_TIMEOUT_MS3 = 5000, _cache2, _failures, coldRefreshes, MIN_CREATED_SECONDS = 946684800, MAX_CREATED_SECONDS = 4102444800, CONTINUATION_FIELDS, LIVE_DISCOVERY_BOUND_MS = 2000;
+var _fetchers, CACHE_TTL_MS2, FETCH_TIMEOUT_MS3 = 5000, _cache2, _failures, coldRefreshes, invalidationsByProvider, invalidationsOfAll = 0, MIN_CREATED_SECONDS = 946684800, MAX_CREATED_SECONDS = 4102444800, CONTINUATION_FIELDS, LIVE_DISCOVERY_BOUND_MS = 2000;
 var init_model_discovery = __esm(() => {
   init_authority();
   init_logger();
@@ -51245,6 +51361,7 @@ var init_model_discovery = __esm(() => {
   _cache2 = new Map;
   _failures = new Map;
   coldRefreshes = new Map;
+  invalidationsByProvider = new Map;
   CONTINUATION_FIELDS = ["has_more", "next", "next_page", "next_page_token"];
 });
 
@@ -59790,12 +59907,12 @@ var init_ollamacloud = __esm(() => {
 });
 
 // src/providers/transport/conversation-key.ts
-import { createHash as createHash13, randomBytes as randomBytes13 } from "crypto";
+import { createHash as createHash16, randomBytes as randomBytes13 } from "crypto";
 function conversationKey(claudeRequest) {
   const sessionId = extractSessionId(claudeRequest);
   if (!sessionId)
     return `claudish_${FALLBACK_CONVERSATION_KEY}`;
-  return `claudish_${createHash13("sha256").update(sessionId).digest("hex").slice(0, 32)}`;
+  return `claudish_${createHash16("sha256").update(sessionId).digest("hex").slice(0, 32)}`;
 }
 var FALLBACK_CONVERSATION_KEY;
 var init_conversation_key = __esm(() => {
@@ -61315,6 +61432,10 @@ function getProviderByName(name) {
     return builtin;
   return getRuntimeProviders().get(name);
 }
+function isPersistedListProvider(provider) {
+  const def = getProviderByName(provider);
+  return def !== undefined && def.modelDiscovery !== undefined && !def.isLocal && (def.tier === "subscription" || def.tier === "dynamic-subscription");
+}
 function getApiKeyInfo(providerName) {
   const def = getProviderByName(providerName);
   if (!def)
@@ -74653,14 +74774,14 @@ var init_prehydrate = __esm(() => {
 });
 
 // src/auth/claude-code-facts.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { homedir as homedir33 } from "os";
 import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 function defaultConfigDir(env) {
   return resolve4(env.HOME || homedir33(), ".claude");
 }
 function configDirHash(configDir) {
-  return createHash14("sha256").update(configDir).digest("hex").slice(0, 8);
+  return createHash17("sha256").update(configDir).digest("hex").slice(0, 8);
 }
 function claudeCodeKeychainService(env = process.env) {
   const raw = env.CLAUDE_CONFIG_DIR?.trim();
@@ -92966,8 +93087,29 @@ function bodyToForward(c, payload) {
   const inbound = c.get(INBOUND_BODY_KEY);
   return inbound !== undefined && inbound.canonical === serialized ? inbound.raw : serialized;
 }
-var ALLOWED_NAMES, HOP_BY_HOP, INTERNAL_PREFIX = "x-claudish-", ALLOWED_QUERY_NAMES, INBOUND_BODY_KEY = "inboundBody";
+async function buildForwardRequest(c, payload, endpoint, fallbackKey) {
+  const headers = {
+    ...requestHeadersToForward(c.req.raw.headers),
+    ...inboundAuthHeaders(c.req.raw.headers)
+  };
+  if (headers.authorization && CLAUDE_LOGIN_BEARER.test(headers.authorization)) {
+    delete headers["x-api-key"];
+  }
+  headers["content-type"] = "application/json";
+  if (!headers["anthropic-version"])
+    headers["anthropic-version"] = "2023-06-01";
+  if (!headers.authorization && !headers["x-api-key"]) {
+    const key = await fallbackKey();
+    if (key)
+      headers["x-api-key"] = key;
+  }
+  const url = `${endpoint}${forwardedSearch(c)}`;
+  addSigningSecrets(c, credentialValuesFromRequest(headers, url));
+  return { headers, url, body: bodyToForward(c, payload) };
+}
+var ALLOWED_NAMES, HOP_BY_HOP, INTERNAL_PREFIX = "x-claudish-", ALLOWED_QUERY_NAMES, INBOUND_BODY_KEY = "inboundBody", CLAUDE_LOGIN_BEARER;
 var init_anthropic_forward = __esm(() => {
+  init_call_context();
   ALLOWED_NAMES = new Set([
     "authorization",
     "x-api-key",
@@ -93003,6 +93145,7 @@ var init_anthropic_forward = __esm(() => {
     "content-length"
   ]);
   ALLOWED_QUERY_NAMES = new Set(["beta"]);
+  CLAUDE_LOGIN_BEARER = /^Bearer\s+sk-ant-oat\d+-/i;
 });
 
 // src/handlers/shared/thinking-signature.ts
@@ -93095,36 +93238,26 @@ class NativeHandler {
   }
   async handle(c, incoming) {
     const payload = await this.applyRequestHooks(c, incoming);
-    const headers = {
-      ...requestHeadersToForward(c.req.raw.headers),
-      ...inboundAuthHeaders(c.req.raw.headers)
-    };
     const target = payload.model;
     const strippedThinking = stripUnsignedThinkingBlocks(payload.messages);
     if (strippedThinking > 0) {
       log(`[Native] stripped ${strippedThinking} unsigned thinking block(s) from history for ${target} (foreign-provider origin)`);
     }
     const advisorSwapped = c.get(ADVISOR_SWAPPED_CONTEXT_KEY) === true;
+    const inboundAuth = inboundAuthHeaders(c.req.raw.headers);
     log(`
 === [NATIVE] Claude Code \u2192 Anthropic API Request ===`);
-    log(`[Native] x-api-key: ${headers["x-api-key"] ? maskCredential(headers["x-api-key"]) : "(not set)"}`);
-    log(`[Native] authorization: ${headers.authorization ? maskCredential(headers.authorization) : "(not set)"}`);
+    log(`[Native] x-api-key: ${inboundAuth["x-api-key"] ? maskCredential(inboundAuth["x-api-key"]) : "(not set)"}`);
+    log(`[Native] authorization: ${inboundAuth.authorization ? maskCredential(inboundAuth.authorization) : "(not set)"}`);
     log(`Request body (Model: ${target}):`);
     log(`=== End Request ===
 `);
-    headers["content-type"] = "application/json";
-    if (!headers["anthropic-version"])
-      headers["anthropic-version"] = "2023-06-01";
-    if (!headers.authorization && !headers["x-api-key"]) {
-      let fallbackKey = this.apiKey;
-      if (!fallbackKey) {
-        const auth = await credentials.getRequestAuth("native-anthropic", { model: target });
-        fallbackKey = auth.headers["x-api-key"];
-      }
-      if (fallbackKey) {
-        headers["x-api-key"] = fallbackKey;
-      }
-    }
+    const { headers, url, body } = await buildForwardRequest(c, payload, `${this.baseUrl}/v1/messages`, async () => {
+      if (this.apiKey)
+        return this.apiKey;
+      const auth = await credentials.getRequestAuth("native-anthropic", { model: target });
+      return auth.headers["x-api-key"];
+    });
     const incomingBeta = headers["anthropic-beta"];
     if (incomingBeta && advisorSwapped) {
       const { stripped, changed } = stripAdvisorBeta(incomingBeta);
@@ -93141,9 +93274,6 @@ class NativeHandler {
       else
         delete headers["anthropic-beta"];
     }
-    const url = `${this.baseUrl}/v1/messages${forwardedSearch(c)}`;
-    addSigningSecrets(c, credentialValuesFromRequest(headers, url));
-    const body = bodyToForward(c, payload);
     try {
       const anthropicResponse = await fetch(url, {
         method: "POST",
@@ -93298,7 +93428,6 @@ var init_native_handler = __esm(() => {
   init_native_handler_advisor();
   init_anthropic_error();
   init_anthropic_forward();
-  init_call_context();
 });
 
 // src/hooks/seam-hooks.ts
@@ -94350,43 +94479,31 @@ ${plan.hint}` : `[Route] ${plan.reason}`;
   });
   app.post("/v1/messages/count_tokens", async (c) => {
     try {
-      const body = await c.req.json();
+      const rawBody = await c.req.text();
+      const body = JSON.parse(rawBody);
+      recordInboundBody(c, rawBody, body);
       if (typeof body?.model !== "string" || body.model.length === 0) {
         return c.json(wrapAnthropicError(400, "missing required field: model"), 400);
       }
       const handler = await getHandlerForRequest(body.model);
       if (handler instanceof NativeHandler) {
-        const inbound = c.req.header();
-        const headers = {
-          "Content-Type": "application/json",
-          "anthropic-version": inbound["anthropic-version"] || "2023-06-01"
-        };
-        if (inbound.authorization)
-          headers.authorization = inbound.authorization;
-        if (inbound["x-api-key"])
-          headers["x-api-key"] = inbound["x-api-key"];
-        if (inbound["anthropic-beta"])
-          headers["anthropic-beta"] = inbound["anthropic-beta"];
-        if (!inbound.authorization && !inbound["x-api-key"]) {
-          let fallbackKey = anthropicApiKey;
-          if (!fallbackKey) {
-            try {
-              const auth = await credentials.getRequestAuth("native-anthropic", {
-                model: body.model
-              });
-              fallbackKey = auth.headers["x-api-key"];
-            } catch (err) {
-              log(`[CountTokens] no resolvable Anthropic credential: ${err}`);
-            }
+        const forward = await buildForwardRequest(c, body, resolveUpstreamUrl("https://api.anthropic.com/v1/messages/count_tokens"), async () => {
+          if (anthropicApiKey)
+            return anthropicApiKey;
+          try {
+            const auth = await credentials.getRequestAuth("native-anthropic", {
+              model: body.model
+            });
+            return auth.headers["x-api-key"];
+          } catch (err) {
+            log(`[CountTokens] no resolvable Anthropic credential: ${err}`);
+            return;
           }
-          if (fallbackKey)
-            headers["x-api-key"] = fallbackKey;
-        }
-        addSigningSecrets(c, credentialValuesFromRequest(headers));
-        const res = await fetch(resolveUpstreamUrl("https://api.anthropic.com/v1/messages/count_tokens"), {
+        });
+        const res = await fetch(forward.url, {
           method: "POST",
-          headers,
-          body: JSON.stringify(body)
+          headers: forward.headers,
+          body: forward.body
         });
         if (res.status === 401 || res.status === 403) {
           log(`[CountTokens] upstream ${res.status} \u2014 falling back to the local estimate`);
@@ -96400,11 +96517,12 @@ function readProcessTable() {
   }
   return tableOf(stdout, spawnedAt);
 }
-function readProcessTableAsync() {
+function readProcessTableAsync(cancelAfterMs) {
+  const options = cancelAfterMs === undefined ? PS_OPTIONS : { ...PS_OPTIONS, timeout: cancelAfterMs, killSignal: "SIGKILL" };
   return new Promise((resolve) => {
     const spawnedAt = Date.now();
     try {
-      psSpawn.execFile("ps", PS_ARGS, PS_OPTIONS, (err, stdout) => resolve(tableOf(err ? null : String(stdout), spawnedAt)));
+      psSpawn.execFile("ps", PS_ARGS, options, (err, stdout) => resolve(tableOf(err ? null : String(stdout), spawnedAt)));
     } catch {
       resolve(tableOf(null, spawnedAt));
     }
@@ -96461,11 +96579,14 @@ function escapedDescendants(table, pgid, inGroup) {
   }
   return out;
 }
+function liveMembers(table, members) {
+  const keys = new Set(members.map((m) => `${m.pid} ${collapse(m.lstart)}`));
+  return table.filter((r) => keys.has(`${r.pid} ${r.lstart}`)).map((r) => r.pid);
+}
 function liveEscaped(table, snap) {
   if (!snap?.escaped?.length)
     return [];
-  const keys = new Set(snap.escaped.map((m) => `${m.pid} ${collapse(m.lstart)}`));
-  return table.filter((r) => keys.has(`${r.pid} ${r.lstart}`)).map((r) => r.pid);
+  return liveMembers(table, snap.escaped);
 }
 function mergeSnapshots(a, b, table) {
   if (!a)
@@ -97346,8 +97467,62 @@ function waitForExit(proc, ms) {
     t.unref?.();
   });
 }
+function descendantsOf(table, rootPid) {
+  const childrenOf = new Map;
+  for (const { pid, ppid, lstart } of table) {
+    const siblings = childrenOf.get(ppid);
+    if (siblings)
+      siblings.push({ pid, lstart });
+    else
+      childrenOf.set(ppid, [{ pid, lstart }]);
+  }
+  const seen = new Set([rootPid, process.pid]);
+  const out = [];
+  const queue = [rootPid];
+  for (let parent = queue.shift();parent !== undefined; parent = queue.shift()) {
+    for (const child of childrenOf.get(parent) ?? []) {
+      if (child.pid <= 1 || seen.has(child.pid))
+        continue;
+      seen.add(child.pid);
+      out.push(child);
+      queue.push(child.pid);
+    }
+  }
+  return out;
+}
+async function readTableWithin(budgetMs) {
+  let timer;
+  const table = await Promise.race([
+    readProcessTableAsync(budgetMs),
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(null), budgetMs);
+      timer.unref?.();
+    })
+  ]);
+  clearTimeout(timer);
+  return table;
+}
+async function snapshotDescendants(rootPid, budgetMs) {
+  const table = await readTableWithin(budgetMs);
+  return table ? descendantsOf(table, rootPid) : [];
+}
+async function killStillLiveMembers(members, budgetMs) {
+  if (members.length === 0)
+    return 0;
+  const table = await readTableWithin(budgetMs);
+  if (!table)
+    return 0;
+  const pids = liveMembers(table, members);
+  for (const pid of pids) {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {}
+  }
+  return pids.length;
+}
 var KILL_PROCESS_GROUP;
 var init_process_tree = __esm(() => {
+  init_process_identity();
   KILL_PROCESS_GROUP = process.platform !== "win32";
 });
 
@@ -98841,58 +99016,61 @@ Or set CLAUDE_PATH to your custom installation:`);
   }
   log(exitSignal ? `[Claude Code] Exited from ${exitSignal} (exit code ${exitCode})` : `[Claude Code] Exited with code ${exitCode}`);
   releaseTerminalIsolation();
-  try {
-    unlinkSync11(tempSettingsPath);
-  } catch {}
-  signalShutdown.launcherCleanupDone();
-  if (signalShutdown.started())
-    return new Promise(() => {});
-  return exitCode;
+  signalShutdown.removeSettingsFile();
+  await signalShutdown.claudeCodeStopped();
+  return signalShutdownExitCode() ?? exitCode;
 }
 function sessionOutcomeOf(exitCode) {
   return exitCode === 0 ? { state: "COMPLETED", reason: null, exitCode } : { state: "FAILED", reason: "child_exited", exitCode };
 }
-function delay(ms) {
-  return new Promise((resolve) => {
-    const t = setTimeout(resolve, Math.max(0, ms));
-    t.unref?.();
-  });
+function signalShutdownExitCode() {
+  return signalShutdownCode;
 }
 function setupSignalHandlers(proc, tempSettingsPath, quiet, onCleanup) {
   const signals = isWindows2() ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
   let shuttingDown = null;
-  let markLauncherCleanupDone = () => {};
-  const launcherCleanup = new Promise((resolve) => {
-    markLauncherCleanupDone = resolve;
-  });
-  const shutdown = async (signal) => {
-    const startedAt = Date.now();
+  let claudeCodeStopped = Promise.resolve();
+  let settingsFileRemoved = false;
+  const removeSettingsFile = () => {
+    if (settingsFileRemoved)
+      return;
+    settingsFileRemoved = true;
+    try {
+      unlinkSync11(tempSettingsPath);
+    } catch {}
+  };
+  const stopClaudeCode = async () => {
     try {
       proc.kill("SIGTERM");
-      if (!await waitForExit(proc, SIGNAL_CHILD_EXIT_GRACE_MS)) {
-        log(`[claudish] Claude Code did not exit within ${SIGNAL_CHILD_EXIT_GRACE_MS} ms of SIGTERM; sending SIGKILL`);
-        try {
-          proc.kill("SIGKILL");
-        } catch {}
-        await waitForExit(proc, SIGNAL_CHILD_KILL_WAIT_MS);
+      if (await waitForExit(proc, SIGNAL_CHILD_EXIT_GRACE_MS))
+        return;
+      log(`[claudish] Claude Code did not exit within ${SIGNAL_CHILD_EXIT_GRACE_MS} ms of SIGTERM; sending SIGKILL`);
+      const killStepStartedAt = Date.now();
+      const descendants = proc.pid ? await snapshotDescendants(proc.pid, SIGNAL_DESCENDANT_READ_MS) : [];
+      if (proc.exitCode !== null || proc.signalCode !== null)
+        return;
+      let killed = 0;
+      try {
+        proc.kill("SIGKILL");
+      } finally {
+        killed = await killStillLiveMembers(descendants, SIGNAL_DESCENDANT_READ_MS);
       }
-      await Promise.race([
-        launcherCleanup,
-        delay(SIGNAL_SHUTDOWN_BUDGET_MS - (Date.now() - startedAt))
-      ]);
+      log(`[claudish] Sent SIGKILL to Claude Code and ${killed} of ${descendants.length} descendants`);
+      await waitForExit(proc, SIGNAL_CHILD_KILL_WAIT_MS - (Date.now() - killStepStartedAt));
     } catch (err) {
       log(`[claudish] Signal shutdown error: ${err}`);
-    } finally {
-      if (onCleanup) {
-        try {
-          onCleanup();
-        } catch {}
-      }
+    }
+  };
+  const armDeadline = (code) => {
+    const deadline = setTimeout(() => {
+      log(`[claudish] Signal shutdown passed ${SIGNAL_SHUTDOWN_BUDGET_MS} ms; exiting`);
       try {
-        unlinkSync11(tempSettingsPath);
+        onCleanup?.();
       } catch {}
-      process.exit(signalExitCode(signal));
-    }
+      removeSettingsFile();
+      process.exit(code);
+    }, SIGNAL_SHUTDOWN_BUDGET_MS);
+    deadline.unref?.();
   };
   claimSignalExit();
   for (const signal of signals) {
@@ -98902,18 +99080,19 @@ function setupSignalHandlers(proc, tempSettingsPath, quiet, onCleanup) {
         return;
       }
       shuttingDown = signal;
+      const code = signalExitCode(signal);
+      signalShutdownCode = code;
+      process.exitCode = code;
+      armDeadline(code);
       releaseTerminalIsolation();
       if (!quiet) {
         console.error(`
 [claudish] Received ${signal}, shutting down...`);
       }
-      shutdown(signal);
+      claudeCodeStopped = stopClaudeCode();
     });
   }
-  return {
-    started: () => shuttingDown !== null,
-    launcherCleanupDone: () => markLauncherCleanupDone()
-  };
+  return { removeSettingsFile, claudeCodeStopped: () => claudeCodeStopped };
 }
 async function findClaudeBinary(env = process.env) {
   const isWindows = process.platform === "win32";
@@ -99014,7 +99193,7 @@ var restoreTerminal = null, macosKeychainAnthropicMemo, defaultKeychainAnthropic
   }
   macosKeychainAnthropicMemo.set(memoKey, found);
   return found;
-}, CLAUDISH_PLACEHOLDER_API_KEY = "sk-ant-api03-placeholder-not-used-proxy-handles-auth-with-openrouter-key-xxxxxxxxxxxxxxxxxxxxx", CLAUDISH_PLACEHOLDER_AUTH_TOKEN = "placeholder-token-not-used-proxy-handles-auth", STALE_TOKEN_FILE_MS, MAX_TOKEN_FILES_SCANNED = 4000, CLAUDE_CODE_DEFAULT_MAX_CONTEXT = 200000, USER_STATUS_LINE_TIMEOUT_SECONDS = 3, MIN_AUTO_COMPACT_WINDOW = 200000, MAX_AUTO_COMPACT_WINDOW = 1e6, ADVISOR_TOOL_ENV_VAR = "CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL", CLAUDISH_CHILD_ADVISOR_MODEL = "sonnet", CHILD_STDERR_NOISE, SIGNAL_CHILD_EXIT_GRACE_MS = 3000, SIGNAL_CHILD_KILL_WAIT_MS = 500, SIGNAL_SHUTDOWN_BUDGET_MS = 4000;
+}, CLAUDISH_PLACEHOLDER_API_KEY = "sk-ant-api03-placeholder-not-used-proxy-handles-auth-with-openrouter-key-xxxxxxxxxxxxxxxxxxxxx", CLAUDISH_PLACEHOLDER_AUTH_TOKEN = "placeholder-token-not-used-proxy-handles-auth", STALE_TOKEN_FILE_MS, MAX_TOKEN_FILES_SCANNED = 4000, CLAUDE_CODE_DEFAULT_MAX_CONTEXT = 200000, USER_STATUS_LINE_TIMEOUT_SECONDS = 3, MIN_AUTO_COMPACT_WINDOW = 200000, MAX_AUTO_COMPACT_WINDOW = 1e6, ADVISOR_TOOL_ENV_VAR = "CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL", CLAUDISH_CHILD_ADVISOR_MODEL = "sonnet", CHILD_STDERR_NOISE, SIGNAL_CHILD_EXIT_GRACE_MS = 2000, SIGNAL_CHILD_KILL_WAIT_MS = 500, SIGNAL_DESCENDANT_READ_MS = 200, SIGNAL_SHUTDOWN_BUDGET_MS = 4500, signalShutdownCode = null;
 var init_claude_runner = __esm(() => {
   init_model_catalog();
   init_claude_code_facts();
@@ -122069,14 +122248,14 @@ function reportFetchFailure(state, cache, now) {
   if (state === "stale") {
     const ageMs = now.getTime() - Date.parse(cache.lastUpdated);
     const ageStr = humanizeAge(ageMs);
-    process.stderr.write(`WARNING: Catalog stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
+    process.stderr.write(`WARNING: The ${MODEL_CATALOG_NAME} is stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
 `);
     return "warned";
   }
   if (state === "fresh") {
     const ageMs = now.getTime() - Date.parse(cache.lastUpdated);
     const ageStr = humanizeAge(ageMs);
-    process.stderr.write(`WARNING: Catalog refresh failed (cache age ${ageStr}). Using cached version.
+    process.stderr.write(`WARNING: Could not refresh the ${MODEL_CATALOG_NAME} (cache age ${ageStr}). Using cached version.
 `);
     return "warned";
   }
@@ -125166,11 +125345,18 @@ Team Status`);
     }
     finalizeStartupTrace("run", { quiet: cliConfig.quiet });
     let exitCode = 0;
+    let diagCleaned = false;
+    const cleanupDiag = () => {
+      if (diagCleaned)
+        return;
+      diagCleaned = true;
+      diag.cleanup();
+    };
     try {
-      exitCode = await runClaudeWithProxy(cliConfig, proxy.url, () => diag.cleanup());
+      exitCode = await runClaudeWithProxy(cliConfig, proxy.url, cleanupDiag);
     } finally {
       setDiagOutput(null);
-      diag.cleanup();
+      cleanupDiag();
       if (!cliConfig.quiet) {
         const write = cliConfig.interactive ? console.log : console.error;
         write(`
@@ -125210,8 +125396,9 @@ Team Status`);
         console.error(`[claudish] session summary unavailable: ${e}`);
       }
     }
+    exitCode = signalShutdownExitCode() ?? exitCode;
     const sessionLogPath = getAlwaysOnLogPath();
-    const quitBySignal = exitCode === 130 || exitCode === 143;
+    const quitBySignal = exitCode === 130 || exitCode === 143 || signalShutdownExitCode() !== null;
     if (exitCode !== 0 && !quitBySignal && sessionLogPath && !cliConfig.quiet) {
       console.error(`
 [claudish] Session ended with errors (exit code ${exitCode}).`);
@@ -125226,6 +125413,6 @@ Team Status`);
   } catch (error) {
     console.error("[claudish] Fatal error:", error);
     console.error("[claudish] Stack:", error instanceof Error ? error.stack : "no stack");
-    process.exit(1);
+    process.exit(signalShutdownExitCode() ?? 1);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudish",
-  "version": "14.18.1",
+  "version": "14.18.3",
   "description": "Run Claude Code with any model - OpenRouter, Ollama, LM Studio & local models",
   "type": "module",
   "main": "./dist/index.js",
@@ -71,10 +71,10 @@
     "ai"
   ],
   "optionalDependencies": {
-    "@claudish/magmux-darwin-arm64": "14.18.1",
-    "@claudish/magmux-darwin-x64": "14.18.1",
-    "@claudish/magmux-linux-arm64": "14.18.1",
-    "@claudish/magmux-linux-x64": "14.18.1"
+    "@claudish/magmux-darwin-arm64": "14.18.3",
+    "@claudish/magmux-darwin-x64": "14.18.3",
+    "@claudish/magmux-linux-arm64": "14.18.3",
+    "@claudish/magmux-linux-x64": "14.18.3"
   },
   "author": "Jack Rudenko <i@madappgang.com>",
   "license": "MIT",