claudish 7.11.0 → 7.12.0

package/dist/index.js

@@ -581,7 +581,527 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "7.11.0";
+var VERSION = "7.12.0";
+
+// src/logger.ts
+var exports_logger = {};
+__export(exports_logger, {
+  truncateContent: () => truncateContent,
+  structuralRedact: () => structuralRedact,
+  setStderrQuiet: () => setStderrQuiet,
+  setLogLevel: () => setLogLevel,
+  setDiagOutput: () => setDiagOutput,
+  maskCredential: () => maskCredential,
+  logStructured: () => logStructured,
+  logStderr: () => logStderr,
+  log: () => log,
+  isLoggingEnabled: () => isLoggingEnabled,
+  initLogger: () => initLogger,
+  getLogLevel: () => getLogLevel,
+  getLogFilePath: () => getLogFilePath,
+  getAlwaysOnLogPath: () => getAlwaysOnLogPath
+});
+import { appendFile, existsSync as existsSync2, mkdirSync, readdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+function flushLogBuffer() {
+  if (!logFilePath || logBuffer.length === 0)
+    return;
+  const toWrite = logBuffer.join("");
+  logBuffer = [];
+  appendFile(logFilePath, toWrite, (err) => {
+    if (err) {
+      console.error(`[claudish] Warning: Failed to write to log file: ${err.message}`);
+    }
+  });
+}
+function flushAlwaysOnBuffer() {
+  if (!alwaysOnLogPath || alwaysOnBuffer.length === 0)
+    return;
+  const toWrite = alwaysOnBuffer.join("");
+  alwaysOnBuffer = [];
+  appendFile(alwaysOnLogPath, toWrite, () => {});
+}
+function scheduleFlush() {
+  if (flushTimer)
+    return;
+  flushTimer = setInterval(() => {
+    flushLogBuffer();
+    flushAlwaysOnBuffer();
+  }, FLUSH_INTERVAL_MS);
+  process.on("exit", () => {
+    if (flushTimer) {
+      clearInterval(flushTimer);
+      flushTimer = null;
+    }
+    if (logFilePath && logBuffer.length > 0) {
+      writeFileSync2(logFilePath, logBuffer.join(""), { flag: "a" });
+      logBuffer = [];
+    }
+    if (alwaysOnLogPath && alwaysOnBuffer.length > 0) {
+      writeFileSync2(alwaysOnLogPath, alwaysOnBuffer.join(""), { flag: "a" });
+      alwaysOnBuffer = [];
+    }
+  });
+}
+function rotateOldLogs(dir, keep) {
+  try {
+    const files = readdirSync(dir).filter((f) => f.startsWith("claudish_") && f.endsWith(".log")).sort().reverse();
+    for (const file of files.slice(keep)) {
+      try {
+        unlinkSync(join2(dir, file));
+      } catch {}
+    }
+  } catch {}
+}
+function structuralRedact(jsonStr) {
+  try {
+    const obj = JSON.parse(jsonStr);
+    return JSON.stringify(redactDeep(obj));
+  } catch {
+    return jsonStr.replace(/"[^"]{20,}"/g, (m) => `"<${m.length - 2} chars>"`);
+  }
+}
+function redactDeep(val, key) {
+  if (val === null || val === undefined)
+    return val;
+  if (typeof val === "boolean" || typeof val === "number")
+    return val;
+  if (typeof val === "string") {
+    if (key && CONTENT_KEYS.has(key)) {
+      return `<${val.length} chars>`;
+    }
+    return val.length <= 20 ? val : `<${val.length} chars>`;
+  }
+  if (Array.isArray(val))
+    return val.map((v) => redactDeep(v));
+  if (typeof val === "object") {
+    const result = {};
+    for (const [k, v] of Object.entries(val)) {
+      result[k] = redactDeep(v, k);
+    }
+    return result;
+  }
+  return val;
+}
+function isStructuralLogWorthy(msg) {
+  return msg.startsWith("[SSE:") || msg.startsWith("[Proxy]") || msg.startsWith("[Fallback]") || msg.startsWith("[Streaming] ===") || msg.startsWith("[Streaming] Chunk:") || msg.startsWith("[Streaming] Received") || msg.startsWith("[Streaming] Text-based tool calls") || msg.startsWith("[Streaming] Final usage") || msg.startsWith("[Streaming] Sending") || msg.startsWith("[AnthropicSSE] Stream complete") || msg.startsWith("[AnthropicSSE] Tool use:") || msg.includes("Response status:") || msg.includes("Error") || msg.includes("error") || msg.includes("[Auto-route]");
+}
+function redactLogLine(message, timestamp) {
+  if (message.startsWith("[SSE:")) {
+    const prefixEnd = message.indexOf("] ") + 2;
+    const prefix = message.substring(0, prefixEnd);
+    const payload = message.substring(prefixEnd);
+    return `[${timestamp}] ${prefix}${structuralRedact(payload)}
+`;
+  }
+  return `[${timestamp}] ${message}
+`;
+}
+function initLogger(debugMode, level = "info", noLogs = false) {
+  if (!noLogs) {
+    const logsDir = join2(homedir2(), ".claudish", "logs");
+    if (!existsSync2(logsDir)) {
+      mkdirSync(logsDir, { recursive: true });
+    }
+    const timestamp = new Date().toISOString().replace(/[:.]/g, "-").split("T").join("_").slice(0, -5);
+    alwaysOnLogPath = join2(logsDir, `claudish_${timestamp}.log`);
+    writeFileSync2(alwaysOnLogPath, `Claudish Session Log - ${new Date().toISOString()}
+Mode: structural (content redacted)
+${"=".repeat(60)}
+
+`);
+    rotateOldLogs(logsDir, 20);
+    scheduleFlush();
+  }
+  if (debugMode) {
+    logLevel = level;
+    const logsDir = join2(process.cwd(), "logs");
+    if (!existsSync2(logsDir)) {
+      mkdirSync(logsDir, { recursive: true });
+    }
+    const timestamp = new Date().toISOString().replace(/[:.]/g, "-").split("T").join("_").slice(0, -5);
+    logFilePath = join2(logsDir, `claudish_${timestamp}.log`);
+    writeFileSync2(logFilePath, `Claudish Debug Log - ${new Date().toISOString()}
+Log Level: ${level}
+${"=".repeat(80)}
+
+`);
+    scheduleFlush();
+  } else {
+    logFilePath = null;
+    if (noLogs && flushTimer) {
+      clearInterval(flushTimer);
+      flushTimer = null;
+    }
+  }
+}
+function log(message, forceConsole = false) {
+  const timestamp = new Date().toISOString();
+  const logLine = `[${timestamp}] ${message}
+`;
+  if (logFilePath) {
+    logBuffer.push(logLine);
+    if (logBuffer.length >= MAX_BUFFER_SIZE) {
+      flushLogBuffer();
+    }
+  }
+  if (alwaysOnLogPath && isStructuralLogWorthy(message)) {
+    const redactedLine = redactLogLine(message, timestamp);
+    alwaysOnBuffer.push(redactedLine);
+    if (alwaysOnBuffer.length >= MAX_BUFFER_SIZE) {
+      flushAlwaysOnBuffer();
+    }
+  }
+  if (forceConsole) {
+    console.log(message);
+  }
+}
+function logStderr(message) {
+  if (diagOutput) {
+    diagOutput.write(message);
+  } else if (!stderrQuiet) {
+    process.stderr.write(`[claudish] ${message}
+`);
+  }
+  log(message);
+}
+function setDiagOutput(output) {
+  diagOutput = output;
+}
+function setStderrQuiet(quiet) {
+  stderrQuiet = quiet;
+}
+function getLogFilePath() {
+  return logFilePath;
+}
+function getAlwaysOnLogPath() {
+  return alwaysOnLogPath;
+}
+function isLoggingEnabled() {
+  return logFilePath !== null || alwaysOnLogPath !== null;
+}
+function maskCredential(credential) {
+  if (!credential || credential.length <= 8) {
+    return "***";
+  }
+  return `${credential.substring(0, 4)}...${credential.substring(credential.length - 4)}`;
+}
+function setLogLevel(level) {
+  logLevel = level;
+  if (logFilePath) {
+    log(`[Logger] Log level changed to: ${level}`);
+  }
+}
+function getLogLevel() {
+  return logLevel;
+}
+function truncateContent(content, maxLength = 200) {
+  if (content === undefined || content === null)
+    return "[empty]";
+  const str = typeof content === "string" ? content : JSON.stringify(content) ?? "[empty]";
+  if (str.length <= maxLength) {
+    return str;
+  }
+  return `${str.substring(0, maxLength)}... [truncated ${str.length - maxLength} chars]`;
+}
+function logStructured(label, data) {
+  if (!logFilePath)
+    return;
+  if (logLevel === "minimal") {
+    log(`[${label}]`);
+    return;
+  }
+  if (logLevel === "info") {
+    const structured = {};
+    for (const [key, value] of Object.entries(data)) {
+      if (typeof value === "string" || typeof value === "object") {
+        structured[key] = truncateContent(value, 150);
+      } else {
+        structured[key] = value;
+      }
+    }
+    log(`[${label}] ${JSON.stringify(structured, null, 2)}`);
+    return;
+  }
+  log(`[${label}] ${JSON.stringify(data, null, 2)}`);
+}
+var logFilePath = null, logLevel = "info", stderrQuiet = false, diagOutput = null, logBuffer, flushTimer = null, FLUSH_INTERVAL_MS = 100, MAX_BUFFER_SIZE = 50, alwaysOnLogPath = null, alwaysOnBuffer, CONTENT_KEYS;
+var init_logger = __esm(() => {
+  logBuffer = [];
+  alwaysOnBuffer = [];
+  CONTENT_KEYS = new Set([
+    "content",
+    "reasoning_content",
+    "text",
+    "thinking",
+    "partial_json",
+    "arguments",
+    "input"
+  ]);
+});
+
+// src/startup-trace.ts
+import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join3 } from "path";
+function defaultSeams() {
+  return {
+    now: () => performance.now(),
+    outPath: STARTUP_METRICS_FILE,
+    env: process.env,
+    stderr: (line) => {
+      process.stderr.write(`${line}
+`);
+    },
+    maxLines: STARTUP_METRICS_MAX_LINES,
+    slowThresholdMs: SLOW_START_THRESHOLD_MS
+  };
+}
+function round1(n) {
+  return Math.round(n * 10) / 10;
+}
+function safeNow() {
+  try {
+    return seams.now();
+  } catch {
+    return 0;
+  }
+}
+function traceModeOn() {
+  try {
+    return seams.env.CLAUDISH_STARTUP_TRACE === "1";
+  } catch {
+    return false;
+  }
+}
+function errorMeta(err) {
+  let msg;
+  try {
+    msg = err instanceof Error ? err.message : String(err);
+  } catch {
+    msg = "unknown";
+  }
+  const firstLine = msg.split(`
+`)[0] ?? "";
+  return { error: true, errorMsg: firstLine.slice(0, 120) };
+}
+function record(name, startMs, meta) {
+  try {
+    const span = {
+      name,
+      startMs: round1(startMs),
+      durMs: round1(safeNow() - startMs),
+      ...meta && Object.keys(meta).length > 0 ? { meta } : {}
+    };
+    if (terminalSuppressed) {
+      try {
+        suppressedLogSink?.(`[startup-trace] ${formatSpanLine(span)}`);
+      } catch {}
+      if (spans.length < MAX_BUFFERED_SPANS)
+        spans.push(span);
+      return;
+    }
+    if (finalized) {
+      if (traceModeOn())
+        seams.stderr(`[startup-trace] ${formatSpanLine(span)}`);
+      return;
+    }
+    if (spans.length >= MAX_BUFFERED_SPANS)
+      return;
+    spans.push(span);
+  } catch {}
+}
+function isThenable(v) {
+  return !!v && (typeof v === "object" || typeof v === "function") && typeof v.then === "function";
+}
+function traceSpan(name, fn, meta) {
+  const start = safeNow();
+  let result;
+  try {
+    result = fn();
+  } catch (err) {
+    record(name, start, { ...meta, ...errorMeta(err) });
+    throw err;
+  }
+  if (isThenable(result)) {
+    return result.then((value) => {
+      record(name, start, meta);
+      return value;
+    }, (err) => {
+      record(name, start, { ...meta, ...errorMeta(err) });
+      throw err;
+    });
+  }
+  record(name, start, meta);
+  return result;
+}
+function beginSpan(name, meta) {
+  const start = safeNow();
+  let ended = false;
+  return (extraMeta) => {
+    if (ended)
+      return;
+    ended = true;
+    record(name, start, { ...meta, ...extraMeta });
+  };
+}
+function beginQueuedSpan(name, meta) {
+  const enqueuedAt = safeNow();
+  let startedAt;
+  let ended = false;
+  return {
+    start() {
+      if (startedAt === undefined)
+        startedAt = safeNow();
+    },
+    end(extraMeta) {
+      if (ended)
+        return;
+      ended = true;
+      const endAt = safeNow();
+      const startAt = startedAt ?? endAt;
+      record(name, enqueuedAt, {
+        ...meta,
+        ...extraMeta,
+        waitMs: round1(startAt - enqueuedAt),
+        execMs: round1(endAt - startAt)
+      });
+    }
+  };
+}
+function addSpanMeta(name, meta) {
+  try {
+    if (finalized)
+      return;
+    for (let i = spans.length - 1;i >= 0; i--) {
+      if (spans[i].name === name) {
+        spans[i].meta = { ...spans[i].meta, ...meta };
+        return;
+      }
+    }
+  } catch {}
+}
+function suppressStartupTraceTerminalOutput(opts = {}) {
+  try {
+    terminalSuppressed = true;
+    if (opts.logSink) {
+      suppressedLogSink = opts.logSink;
+      return;
+    }
+    Promise.resolve().then(() => (init_logger(), exports_logger)).then((logger) => {
+      suppressedLogSink = (line) => {
+        if (logger.getLogFilePath())
+          logger.log(line);
+      };
+    }).catch(() => {});
+  } catch {}
+}
+function setStartupAuthKind(kind) {
+  try {
+    if (!finalized)
+      authKind = kind;
+  } catch {}
+}
+function fmtDur(ms) {
+  if (!Number.isFinite(ms))
+    return "?";
+  if (ms >= 1000)
+    return `${(ms / 1000).toFixed(1)}s`;
+  return `${Math.round(ms)}ms`;
+}
+function fmtWaitExec(meta) {
+  if (typeof meta?.waitMs !== "number" || typeof meta?.execMs !== "number")
+    return "";
+  return ` (wait ${fmtDur(meta.waitMs)} + exec ${fmtDur(meta.execMs)})`;
+}
+function fmtExtraMeta(meta) {
+  if (!meta)
+    return "";
+  const parts = Object.entries(meta).filter(([k]) => k !== "waitMs" && k !== "execMs").map(([k, v]) => `${k}=${v}`);
+  return parts.length > 0 ? `  ${parts.join(" ")}` : "";
+}
+function formatSpanLine(span) {
+  return `${span.name} ${fmtDur(span.durMs)}${fmtWaitExec(span.meta)}${fmtExtraMeta(span.meta)}`;
+}
+function displayPath(p) {
+  try {
+    const home = homedir3();
+    return p.startsWith(home) ? `~${p.slice(home.length)}` : p;
+  } catch {
+    return p;
+  }
+}
+function writeJsonlCapped(payload) {
+  const path = seams.outPath;
+  const line = JSON.stringify(payload);
+  try {
+    mkdirSync2(dirname(path), { recursive: true });
+  } catch {}
+  let existing;
+  try {
+    existing = readFileSync2(path, "utf-8").split(`
+`).filter((l) => l.trim() !== "");
+  } catch {
+    existing = undefined;
+  }
+  if (existing && existing.length + 1 > seams.maxLines) {
+    const kept = [...existing, line].slice(-seams.maxLines);
+    writeFileSync3(path, `${kept.join(`
+`)}
+`);
+  } else {
+    appendFileSync(path, `${line}
+`);
+  }
+}
+function printSlowLine(payload) {
+  const top = [...payload.spans].sort((a, b) => b.durMs - a.durMs).slice(0, 3).map((s) => `${s.name} ${fmtDur(s.durMs)}${fmtWaitExec(s.meta)}`);
+  const detail = top.length > 0 ? ` \u2014 ${top.join(", ")}` : "";
+  seams.stderr(`[claudish] slow start ${fmtDur(payload.totalMs)}${detail} \u2026 full data: ` + `${displayPath(seams.outPath)} (CLAUDISH_STARTUP_TRACE=1 for live detail)`);
+}
+function printTable(payload) {
+  seams.stderr(`[claudish] startup trace (${payload.argvKind}) \u2014 total ${fmtDur(payload.totalMs)}` + ` \xB7 auth ${payload.authKind} \xB7 v${payload.version}`);
+  seams.stderr("  start        dur  span");
+  for (const s of payload.spans) {
+    const start = fmtDur(s.startMs).padStart(7);
+    const dur = fmtDur(s.durMs).padStart(9);
+    seams.stderr(`  ${start}  ${dur}  ${s.name}${fmtWaitExec(s.meta)}${fmtExtraMeta(s.meta)}`);
+  }
+  seams.stderr(`  metrics: ${displayPath(seams.outPath)}`);
+}
+function finalizeStartupTrace(context, opts = {}) {
+  try {
+    if (finalized)
+      return;
+    const totalMs = safeNow();
+    const payload = {
+      ts: new Date().toISOString(),
+      version: VERSION,
+      argvKind: context,
+      totalMs: round1(totalMs),
+      authKind,
+      spans
+    };
+    finalized = true;
+    try {
+      writeJsonlCapped(payload);
+    } catch {}
+    try {
+      if (terminalSuppressed) {} else if (traceModeOn()) {
+        printTable(payload);
+      } else if (totalMs > seams.slowThresholdMs && !opts.quiet) {
+        printSlowLine(payload);
+      }
+    } catch {}
+  } catch {}
+}
+var STARTUP_METRICS_FILE, STARTUP_METRICS_MAX_LINES = 500, SLOW_START_THRESHOLD_MS = 8000, MAX_BUFFERED_SPANS = 500, seams, spans, finalized = false, authKind = "none", terminalSuppressed = false, suppressedLogSink;
+var init_startup_trace = __esm(() => {
+  STARTUP_METRICS_FILE = join3(homedir3(), ".claudish", "startup-metrics.jsonl");
+  seams = defaultSeams();
+  spans = [];
+});
 
 // src/providers/onepassword-wasm.ts
 var exports_onepassword_wasm = {};
@@ -595,17 +1115,17 @@ __export(exports_onepassword_wasm, {
   SDK_CORE_INTEGRITY: () => SDK_CORE_INTEGRITY
 });
 import { createHash } from "crypto";
-import { copyFileSync, existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
 import { gunzipSync } from "zlib";
 function tarballUrl() {
   return `https://registry.npmjs.org/@1password/sdk-core/-/sdk-core-${SDK_CORE_VERSION}.tgz`;
 }
 function cacheWasmPath() {
-  const root = cacheRootOverride ?? join2(homedir2(), ".claudish");
-  return join2(root, "cache", "1password", WASM_FILENAME);
+  const root = cacheRootOverride ?? join4(homedir4(), ".claudish");
+  return join4(root, "cache", "1password", WASM_FILENAME);
 }
 function verifyIntegrity(bytes) {
   const [algo, expected] = SDK_CORE_INTEGRITY.split("-", 2);
@@ -641,12 +1161,12 @@ function installReadFileSyncIntercept() {
   fs.readFileSync = (path, ...rest) => {
     if (typeof path === "string" && path.endsWith(WASM_FILENAME)) {
       const cached = cacheWasmPath();
-      if (existsSync2(cached)) {
+      if (existsSync3(cached)) {
         return original(cached);
       }
-      if (existsSync2(path)) {
+      if (existsSync3(path)) {
         try {
-          mkdirSync(dirname(cached), { recursive: true });
+          mkdirSync3(dirname2(cached), { recursive: true });
           copyFileSync(path, cached);
         } catch {}
       }
@@ -669,9 +1189,9 @@ async function downloadAndCacheWasm() {
   if (!wasm) {
     throw new Error(`1Password runtime archive did not contain ${WASM_TARBALL_ENTRY}`);
   }
-  mkdirSync(dirname(cached), { recursive: true });
+  mkdirSync3(dirname2(cached), { recursive: true });
   const tmp = `${cached}.tmp`;
-  writeFileSync2(tmp, wasm);
+  writeFileSync4(tmp, wasm);
   createRequire(import.meta.url)("node:fs").renameSync(tmp, cached);
   process.stderr.write(`[claudish] 1Password runtime cached.
 `);
@@ -683,7 +1203,7 @@ function ensureOpWasmAvailable() {
     return ensured;
   ensured = (async () => {
     installReadFileSyncIntercept();
-    if (existsSync2(cacheWasmPath()))
+    if (existsSync3(cacheWasmPath()))
       return;
     if (seedCacheFromNearbyWasm())
       return;
@@ -702,8 +1222,8 @@ function resolveNearbyWasmPath() {
   try {
     const require2 = createRequire(import.meta.url);
     const coreJs = require2.resolve("@1password/sdk-core/nodejs/core.js");
-    const wasm = join2(dirname(coreJs), WASM_FILENAME);
-    return existsSync2(wasm) ? wasm : null;
+    const wasm = join4(dirname2(coreJs), WASM_FILENAME);
+    return existsSync3(wasm) ? wasm : null;
   } catch {
     return null;
   }
@@ -714,7 +1234,7 @@ function seedCacheFromNearbyWasm() {
     return false;
   try {
     const cached = cacheWasmPath();
-    mkdirSync(dirname(cached), { recursive: true });
+    mkdirSync3(dirname2(cached), { recursive: true });
     copyFileSync(real, cached);
     return true;
   } catch {
@@ -3065,9 +3585,11 @@ var exports_onepassword = {};
 __export(exports_onepassword, {
   withSdkRetry: () => withSdkRetry,
   valueTail: () => valueTail,
+  resolveSecretsPartial: () => resolveSecretsPartial,
   resolveSecrets: () => resolveSecrets,
   resolveSdkAuth: () => resolveSdkAuth,
   resolveGlobImportForEnvVars: () => resolveGlobImportForEnvVars,
+  resolveGlobImportAll: () => resolveGlobImportAll,
   resolveGlobImport: () => resolveGlobImport,
   resolveDesktopAccount: () => resolveDesktopAccount,
   resetSdkClientCache: () => resetSdkClientCache,
@@ -3160,7 +3682,7 @@ function globToRegExp(glob) {
 async function discoverItemFields(vault, item, opts = {}) {
   const warn = opts.warn ?? ((m) => console.error(m));
   const client = await acquireSdkClient(opts, `1Password item discovery for '${item}'`);
-  const vaults = await client.vaults.list();
+  const vaults = await traceSpan("op:vaults.list", () => client.vaults.list());
   const vaultMatches = vaults.filter((v) => v.title === vault);
   if (vaultMatches.length === 0) {
     throw new Error(`1Password vault '${vault}' not found. ` + `Available vaults: ${vaults.map((v) => v.title).join(", ") || "(none)"}.`);
@@ -3169,7 +3691,7 @@ async function discoverItemFields(vault, item, opts = {}) {
     warn(`[claudish] multiple 1Password vaults titled '${vault}'; using the first ` + `(id ${vaultMatches[0].id}).`);
   }
   const vaultId = vaultMatches[0].id;
-  const items = await client.items.list(vaultId);
+  const items = await traceSpan("op:items.list", () => client.items.list(vaultId), { vault });
   const itemMatches = items.filter((i) => i.title === item);
   if (itemMatches.length === 0) {
     throw new Error(`1Password item '${item}' not found in vault '${vault}'. ` + `Available items: ${items.map((i) => i.title).slice(0, 12).join(", ") || "(none)"}.`);
@@ -3178,7 +3700,10 @@ async function discoverItemFields(vault, item, opts = {}) {
     warn(`[claudish] multiple 1Password items titled '${item}' in vault '${vault}'; ` + `using the first (id ${itemMatches[0].id}).`);
   }
   const itemId = itemMatches[0].id;
-  const full = await client.items.get(vaultId, itemId);
+  const full = await traceSpan("op:items.get", () => client.items.get(vaultId, itemId), {
+    vault,
+    item
+  });
   const out = [];
   for (const field of full.fields) {
     if (typeof field.title !== "string")
@@ -3198,7 +3723,10 @@ async function discoverItemFields(vault, item, opts = {}) {
 }
 async function discoverItemFieldsById(vaultId, itemId, vaultTitle, itemTitle, opts = {}) {
   const client = await acquireSdkClient(opts, `1Password item discovery for '${itemTitle}'`);
-  const full = await client.items.get(vaultId, itemId);
+  const full = await traceSpan("op:items.get", () => client.items.get(vaultId, itemId), {
+    vault: vaultTitle,
+    item: itemTitle
+  });
   const out = [];
   for (const field of full.fields) {
     if (typeof field.title !== "string")
@@ -3218,11 +3746,11 @@ async function discoverItemFieldsById(vaultId, itemId, vaultTitle, itemTitle, op
 }
 async function listVaults(opts = {}) {
   const client = await acquireSdkClient(opts, "1Password vault listing");
-  return client.vaults.list();
+  return traceSpan("op:vaults.list", () => client.vaults.list());
 }
 async function listItems(vaultId, opts = {}) {
   const client = await acquireSdkClient(opts, "1Password item listing");
-  return client.items.list(vaultId);
+  return traceSpan("op:items.list", () => client.items.list(vaultId));
 }
 function sectionLabel(item, sectionId) {
   if (!sectionId)
@@ -3279,6 +3807,34 @@ async function resolveGlobImport(opPath, opts = {}) {
     env: opts.env
   });
 }
+async function resolveGlobImportAll(opPath, opts = {}) {
+  const warn = opts.warn ?? ((m) => console.error(m));
+  const glob = parseGlobImport(opPath);
+  const fields = await discoverItemFields(glob.vault, glob.item, {
+    sdkFactory: opts.sdkFactory,
+    auth: opts.auth,
+    env: opts.env,
+    warn
+  });
+  const matches = filterGlobFields(fields, glob);
+  const refMap = {};
+  for (const m of matches) {
+    if (!m.valid)
+      continue;
+    refMap[m.envName] = m.field.reference;
+  }
+  if (Object.keys(refMap).length === 0)
+    return {};
+  const { resolved, failures } = await resolveSecretsPartial(refMap, {
+    sdkFactory: opts.sdkFactory,
+    auth: opts.auth,
+    env: opts.env
+  });
+  for (const f of failures) {
+    warn(`[claudish] 1Password glob field could not be resolved (skipped): ${f}`);
+  }
+  return resolved;
+}
 async function resolveGlobImportForEnvVars(opPath, envNames, opts = {}) {
   const wanted = new Set(envNames);
   if (wanted.size === 0)
@@ -3399,8 +3955,15 @@ function isTransientSdkError(err) {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
   return msg.includes("ipc operation failed") || msg.includes("ipc operation") || msg.includes("-4") || msg.includes("denied") || msg.includes("broken pipe") || msg.includes("connection") || msg.includes("invalid client id") || msg.includes("invalid client") || msg.includes("invalid session") || msg.includes("session expired") || msg.includes("session not found") || msg.includes("unauthorized") || msg.includes("token expired") || msg.includes("not authenticated");
 }
-function runSdkExclusive(op) {
-  const run = sdkQueue.then(op, op);
+function runSdkExclusive(op, label = "op:sdk-op", meta) {
+  const span = beginQueuedSpan(label, meta);
+  const timedOp = () => {
+    span.start();
+    return op();
+  };
+  const run = sdkQueue.then(timedOp, timedOp);
+  run.then(() => span.end(), (err) => span.end({ error: true, errorMsg: String(err).split(`
+`)[0].slice(0, 120) }));
   sdkQueue = run.then(() => {
     return;
   }, () => {
@@ -3411,16 +3974,22 @@ function runSdkExclusive(op) {
 function sdkSleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function withSdkRetry(op) {
+async function withSdkRetry(op, label = "op:sdk-op") {
   const MAX_ATTEMPTS = 3;
   let lastErr;
   for (let attempt = 1;attempt <= MAX_ATTEMPTS; attempt++) {
     try {
-      return await runSdkExclusive(op);
+      const result = await runSdkExclusive(op, label, { attempt });
+      if (attempt > 1)
+        addSpanMeta(label, { attempts: attempt, retried: true, cacheReset: true });
+      return result;
     } catch (err) {
       lastErr = err;
-      if (!isTransientSdkError(err) || attempt === MAX_ATTEMPTS)
+      if (!isTransientSdkError(err) || attempt === MAX_ATTEMPTS) {
+        if (attempt > 1)
+          addSpanMeta(label, { attempts: attempt, retried: true, cacheReset: true });
         throw err;
+      }
       resetSdkClientCache();
       await sdkSleep(150 * attempt);
     }
@@ -3446,7 +4015,7 @@ function resolveDesktopAccount(opts = {}) {
     return { accountName: configAccount };
   const lister = opts.opAccountLister ?? defaultOpAccountLister;
   const accounts = lister();
-  const remediation = "Set OP_ACCOUNT to your account URL (e.g. my-team.1password.com) or `onepasswordAccount` in ~/.claudish/config.json.";
+  const remediation = "Set OP_ACCOUNT to your account URL (e.g. my-team.1password.com) or " + "`onepasswordAccount` in ~/.claudish/config.json.";
   if (!accounts || accounts.length === 0) {
     return {
       error: `Could not determine which 1Password account to use (no service-account token, and \`op account list\` is unavailable). ${remediation}`
@@ -3500,17 +4069,18 @@ async function acquireSdkClient(opts, context) {
   if (!auth) {
     throw buildAuthError(`1Password SDK auth is required for ${context}, but neither OP_SERVICE_ACCOUNT_TOKEN nor a 1Password account (OP_ACCOUNT / onepasswordAccount config) is available.`);
   }
+  setStartupAuthKind(auth.kind);
   const sdkFactory = opts.sdkFactory ?? defaultSdkClientFactory;
   return sdkFactory(auth);
 }
-function mapSdkResolveAll(refs, response) {
+function mapSdkResolveAllPartial(refs, response) {
   const responses = response.individualResponses ?? {};
-  const out = {};
+  const resolved = {};
   const failures = [];
   for (const [envVar, ref] of Object.entries(refs)) {
     const entry = responses[ref];
     if (entry?.content && typeof entry.content.secret === "string") {
-      out[envVar] = entry.content.secret;
+      resolved[envVar] = entry.content.secret;
       continue;
     }
     if (entry?.error !== undefined) {
@@ -3519,12 +4089,16 @@ function mapSdkResolveAll(refs, response) {
     }
     failures.push(`${envVar} (${ref}): no value returned`);
   }
+  return { resolved, failures };
+}
+function mapSdkResolveAll(refs, response) {
+  const { resolved, failures } = mapSdkResolveAllPartial(refs, response);
   if (failures.length > 0) {
     throw new Error(`1Password SDK could not resolve secret reference(s):
   ${failures.join(`
   `)}`);
   }
-  return out;
+  return resolved;
 }
 function describeSdkError(error) {
   if (error && typeof error === "object") {
@@ -3545,9 +4119,17 @@ async function resolveSecrets(refs, opts = {}) {
   if (keys.length === 0)
     return {};
   const client = await acquireSdkClient(opts, "resolving 1Password secret reference(s)");
-  const response = await client.secrets.resolveAll(keys.map((k) => refs[k]));
+  const response = await traceSpan("op:secrets.resolveAll", () => client.secrets.resolveAll(keys.map((k) => refs[k])), { refs: keys.length });
   return mapSdkResolveAll(refs, response);
 }
+async function resolveSecretsPartial(refs, opts = {}) {
+  const keys = Object.keys(refs);
+  if (keys.length === 0)
+    return { resolved: {}, failures: [] };
+  const client = await acquireSdkClient(opts, "resolving 1Password secret reference(s)");
+  const response = await traceSpan("op:secrets.resolveAll", () => client.secrets.resolveAll(keys.map((k) => refs[k])), { refs: keys.length });
+  return mapSdkResolveAllPartial(refs, response);
+}
 async function readEnvironment(environmentId, opts = {}) {
   const id = (environmentId ?? "").trim();
   if (id === "") {
@@ -3555,9 +4137,9 @@ async function readEnvironment(environmentId, opts = {}) {
   }
   const client = await acquireSdkClient(opts, `1Password Environment '${id}'`);
   if (!client.environments || typeof client.environments.getVariables !== "function") {
-    throw new Error("1Password Environments require @1password/sdk 0.4.1-beta.1 or later (the stable 0.4.0 has no environments API). Install: `bun add @1password/sdk@0.4.1-beta.1`.");
+    throw new Error("1Password Environments require @1password/sdk 0.4.1-beta.1 or later (the " + "stable 0.4.0 has no environments API). Install: " + "`bun add @1password/sdk@0.4.1-beta.1`.");
   }
-  const { variables } = await client.environments.getVariables(id);
+  const { variables } = await traceSpan("op:environments.getVariables", () => client.environments.getVariables(id));
   if (!Array.isArray(variables) || variables.length === 0) {
     throw new Error(`1Password Environment '${id}' resolved to no variables. Check that the Environment ID is correct and contains entries.`);
   }
@@ -3574,14 +4156,16 @@ var OP_REF_RE, opHydratedVars, ENV_VAR_NAME_RE, sdkClientCache, defaultSdkClient
   if (cached)
     return cached;
   const build = (async () => {
-    const { ensureOpWasmAvailable: ensureOpWasmAvailable2 } = await Promise.resolve().then(() => (init_onepassword_wasm(), exports_onepassword_wasm));
-    await ensureOpWasmAvailable2();
-    const { createClient, DesktopAuth } = await Promise.resolve().then(() => __toESM(require_sdk(), 1));
-    const client = await createClient({
+    const { createClient, DesktopAuth } = await traceSpan("op:sdk-wasm-import", async () => {
+      const { ensureOpWasmAvailable: ensureOpWasmAvailable2 } = await Promise.resolve().then(() => (init_onepassword_wasm(), exports_onepassword_wasm));
+      await ensureOpWasmAvailable2();
+      return Promise.resolve().then(() => __toESM(require_sdk(), 1));
+    });
+    const client = await traceSpan("op:client-handshake", () => createClient({
       auth: auth.kind === "token" ? auth.token : new DesktopAuth(auth.accountName),
       integrationName: "claudish",
       integrationVersion: VERSION || "1.0.0"
-    });
+    }), { mayIncludeUserPrompt: true, authKind: auth.kind });
     return client;
   })();
   sdkClientCache.set(key, build);
@@ -3615,6 +4199,7 @@ var OP_REF_RE, opHydratedVars, ENV_VAR_NAME_RE, sdkClientCache, defaultSdkClient
   }
 };
 var init_onepassword = __esm(() => {
+  init_startup_trace();
   OP_REF_RE = /^op:\/\/[^\s]+$/;
   opHydratedVars = new Set;
   ENV_VAR_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
@@ -3623,9 +4208,9 @@ var init_onepassword = __esm(() => {
 });
 
 // src/auth/credentials/op-source.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 function saveAccount(accountUrl, scope) {
   try {
     saveOnepasswordAccount(accountUrl, scope);
@@ -3680,7 +4265,7 @@ async function getSdkAuth(allowPrompt) {
     const { resolveSdkAuth: resolveSdkAuth2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
     const interactive = allowPrompt && Boolean(process.stdout.isTTY) && !process.argv.includes("--stdin");
     try {
-      const auth = await resolveSdkAuth2({
+      const auth = await traceSpan("op:auth-resolve", () => resolveSdkAuth2({
         configAccount: readOnepasswordAccount(),
         interactive,
         onNeedsPicker: async (accounts) => {
@@ -3691,7 +4276,7 @@ async function getSdkAuth(allowPrompt) {
           }
           return chosen;
         }
-      });
+      }), { mayIncludeUserPrompt: true, interactive });
       cachedSdkAuth = auth;
       sdkAuthResolved = true;
       return auth;
@@ -3708,11 +4293,13 @@ function resolveExplicitFlagAuth() {
   return getSdkAuth(true);
 }
 function readConfigRaw() {
+  if (testSeams?.config)
+    return testSeams.config;
   try {
-    const configPath = join3(homedir3(), ".claudish", "config.json");
-    if (!existsSync3(configPath))
+    const configPath = join5(homedir5(), ".claudish", "config.json");
+    if (!existsSync4(configPath))
       return {};
-    return JSON.parse(readFileSync2(configPath, "utf-8"));
+    return JSON.parse(readFileSync3(configPath, "utf-8"));
   } catch {
     return {};
   }
@@ -3753,8 +4340,21 @@ function computeHasOpSources() {
   }
   return false;
 }
-function runOpExclusive(op) {
-  const run = opQueue.then(op, op);
+function runOpExclusive(op, label = "op:resolve", meta) {
+  const span = beginQueuedSpan(label, meta);
+  let extraMeta = {};
+  const ctx = {
+    addMeta(m) {
+      extraMeta = { ...extraMeta, ...m };
+    }
+  };
+  const timedOp = () => {
+    span.start();
+    return op(ctx);
+  };
+  const run = opQueue.then(timedOp, timedOp);
+  run.then(() => span.end(extraMeta), (err) => span.end({ ...extraMeta, error: true, errorMsg: String(err).split(`
+`)[0].slice(0, 120) }));
   opQueue = run.then(() => {
     return;
   }, () => {
@@ -3762,6 +4362,48 @@ function runOpExclusive(op) {
   });
   return run;
 }
+function maskGlobForTrace(globPath) {
+  const body = globPath.startsWith("op://") ? globPath.slice("op://".length) : globPath;
+  const segments = body.split("/");
+  if (segments.length < 2)
+    return globPath.slice(0, 48);
+  const [vault, item, ...rest] = segments;
+  const maskedItem = item.length > 20 ? `${item.slice(0, 12)}\u2026${item.slice(-4)}` : item;
+  return `op://${vault}/${maskedItem}/${rest.join("/")}`;
+}
+async function resolveGlobShared(globPath, auth) {
+  const existing = globResolutions.get(globPath);
+  if (existing)
+    return { resolved: await existing, cacheHit: true };
+  const spanName = `op:glob-resolve(${maskGlobForTrace(globPath)})`;
+  const promise = (async () => {
+    const { resolveGlobImportAll: resolveGlobImportAll2, recordOpHydratedVars: recordOpHydratedVars2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+    const resolved = await traceSpan(spanName, () => resolveGlobImportAll2(globPath, {
+      auth,
+      sdkFactory: testSeams?.sdkFactory,
+      warn: (m) => console.error(m)
+    }));
+    addSpanMeta(spanName, { vars: Object.keys(resolved).length });
+    for (const [k, v] of Object.entries(resolved)) {
+      resolvedCache.set(k, v);
+      globResolvedVars.add(k);
+    }
+    recordOpHydratedVars2(Object.keys(resolved));
+    return resolved;
+  })();
+  globResolutions.set(globPath, promise);
+  promise.catch(() => {
+    if (globResolutions.get(globPath) === promise)
+      globResolutions.delete(globPath);
+  });
+  return { resolved: await promise, cacheHit: false };
+}
+function invalidateOpResolutionCache() {
+  resolvedCache.clear();
+  globResolutions.clear();
+  globResolvedVars.clear();
+  sniffed = undefined;
+}
 async function resolveOpKeyForEnvVars(wanted, opts = {}) {
   if (wanted.size === 0)
     return {};
@@ -3776,27 +4418,34 @@ async function resolveOpKeyForEnvVars(wanted, opts = {}) {
   }
   if (stillWanted.size === 0)
     return cached;
-  return runOpExclusive(async () => {
+  const label = `op:resolve(${[...stillWanted].sort().join(",")})`;
+  return runOpExclusive(async (span) => {
     const out = { ...cached };
     const wantNow = new Set;
+    let servedFromGlob = false;
     for (const w of stillWanted) {
       const hit = resolvedCache.get(w);
-      if (hit !== undefined)
+      if (hit !== undefined) {
         out[w] = hit;
-      else
+        if (globResolvedVars.has(w))
+          servedFromGlob = true;
+      } else {
         wantNow.add(w);
+      }
     }
+    if (servedFromGlob)
+      span.addMeta({ globCacheHit: true });
     if (wantNow.size === 0)
       return out;
-    const resolved = await resolveOpKeyForEnvVarsInner(wantNow, opts);
+    const resolved = await resolveOpKeyForEnvVarsInner(wantNow, opts, span);
     for (const [k, v] of Object.entries(resolved)) {
       resolvedCache.set(k, v);
       out[k] = v;
     }
     return out;
-  });
+  }, label);
 }
-async function resolveOpKeyForEnvVarsInner(wanted, opts = {}) {
+async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
   if (wanted.size === 0)
     return {};
   if (!hasOpSources())
@@ -3804,21 +4453,20 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}) {
   const onAuthFailure = opts.onAuthFailure ?? "skip";
   const allowPrompt = opts.allowPrompt ?? false;
   let auth;
-  try {
-    auth = await getSdkAuth(allowPrompt);
-  } catch (err) {
-    if (err instanceof OpAuthError && onAuthFailure === "skip") {
-      console.error(`[claudish] 1Password auth unavailable, skipping op:// keys: ${err.message}`);
-      return {};
+  if (testSeams?.auth) {
+    auth = testSeams.auth;
+  } else {
+    try {
+      auth = await getSdkAuth(allowPrompt);
+    } catch (err) {
+      if (err instanceof OpAuthError && onAuthFailure === "skip") {
+        console.error(`[claudish] 1Password auth unavailable, skipping op:// keys: ${err.message}`);
+        return {};
+      }
+      throw err;
     }
-    throw err;
   }
-  const {
-    collectConfigImports: collectConfigImports2,
-    resolveSecrets: resolveSecrets2,
-    resolveGlobImportForEnvVars: resolveGlobImportForEnvVars2,
-    recordOpHydratedVars: recordOpHydratedVars2
-  } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+  const { collectConfigImports: collectConfigImports2, resolveSecrets: resolveSecrets2, recordOpHydratedVars: recordOpHydratedVars2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
   const cfg = readConfigRaw();
   const out = {};
   try {
@@ -3831,7 +4479,10 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}) {
         wantedRefs[envVar] = ref;
     }
     if (Object.keys(wantedRefs).length > 0) {
-      const resolved = await resolveSecrets2(wantedRefs, { auth });
+      const resolved = await resolveSecrets2(wantedRefs, {
+        auth,
+        sdkFactory: testSeams?.sdkFactory
+      });
       Object.assign(out, resolved);
     }
     const stillWanted = new Set([...wanted].filter((w) => !(w in out)));
@@ -3839,13 +4490,15 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}) {
       if (stillWanted.size === 0)
         break;
       try {
-        const resolved = await resolveGlobImportForEnvVars2(globPath, stillWanted, {
-          auth,
-          warn: () => {}
-        });
-        for (const [k, v] of Object.entries(resolved)) {
-          out[k] = v;
-          stillWanted.delete(k);
+        const { resolved, cacheHit } = await resolveGlobShared(globPath, auth);
+        if (cacheHit)
+          span?.addMeta({ globCacheHit: true });
+        for (const w of [...stillWanted]) {
+          const v = resolved[w];
+          if (v !== undefined) {
+            out[w] = v;
+            stillWanted.delete(w);
+          }
         }
       } catch (globErr) {
         const m = globErr instanceof Error ? globErr.message : String(globErr);
@@ -3865,7 +4518,10 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}) {
           customRefs[envVar] = apiKey;
       }
       if (Object.keys(customRefs).length > 0) {
-        const resolved = await resolveSecrets2(customRefs, { auth });
+        const resolved = await resolveSecrets2(customRefs, {
+          auth,
+          sdkFactory: testSeams?.sdkFactory
+        });
         Object.assign(out, resolved);
       }
     }
@@ -3883,9 +4539,10 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}) {
     recordOpHydratedVars2(Object.keys(out));
   return out;
 }
-var OpAuthError, cachedSdkAuth, sdkAuthResolved = false, authInFlight, sniffed, opQueue, resolvedCache;
+var OpAuthError, cachedSdkAuth, sdkAuthResolved = false, authInFlight, testSeams, sniffed, opQueue, resolvedCache, globResolutions, globResolvedVars;
 var init_op_source = __esm(() => {
   init_onepassword_config();
+  init_startup_trace();
   OpAuthError = class OpAuthError extends Error {
     constructor(message) {
       super(message);
@@ -3894,6 +4551,8 @@ var init_op_source = __esm(() => {
   };
   opQueue = Promise.resolve();
   resolvedCache = new Map;
+  globResolutions = new Map;
+  globResolvedVars = new Set;
 });
 
 // src/onepassword-command.ts
@@ -15889,7 +16548,7 @@ function tuple(items, _paramsOrRest, _params) {
     ...exports_util.normalizeParams(params)
   });
 }
-function record(keyType, valueType, params) {
+function record2(keyType, valueType, params) {
   return new ZodRecord({
     type: "record",
     keyType,
@@ -16088,7 +16747,7 @@ function _instanceof(cls, params = {
 }
 function json(params) {
   const jsonSchema = lazy(() => {
-    return union([string2(params), number2(), boolean2(), _null3(), array(jsonSchema), record(string2(), jsonSchema)]);
+    return union([string2(params), number2(), boolean2(), _null3(), array(jsonSchema), record2(string2(), jsonSchema)]);
   });
   return jsonSchema;
 }
@@ -16764,7 +17423,7 @@ __export(exports_external, {
   regexes: () => exports_regexes,
   regex: () => _regex,
   refine: () => refine,
-  record: () => record,
+  record: () => record2,
   readonly: () => readonly,
   property: () => _property,
   promise: () => promise,
@@ -17091,7 +17750,7 @@ var init_types = __esm(() => {
   });
   FormElicitationCapabilitySchema = intersection(object2({
     applyDefaults: boolean2().optional()
-  }), record(string2(), unknown()));
+  }), record2(string2(), unknown()));
   ElicitationCapabilitySchema = preprocess((value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
       if (Object.keys(value).length === 0) {
@@ -17102,7 +17761,7 @@ var init_types = __esm(() => {
   }, intersection(object2({
     form: FormElicitationCapabilitySchema.optional(),
     url: AssertObjectSchema.optional()
-  }), record(string2(), unknown()).optional()));
+  }), record2(string2(), unknown()).optional()));
   ClientTasksCapabilitySchema = looseObject({
     list: AssertObjectSchema.optional(),
     cancel: AssertObjectSchema.optional(),
@@ -17125,7 +17784,7 @@ var init_types = __esm(() => {
     }).optional()
   });
   ClientCapabilitiesSchema = object2({
-    experimental: record(string2(), AssertObjectSchema).optional(),
+    experimental: record2(string2(), AssertObjectSchema).optional(),
     sampling: object2({
       context: AssertObjectSchema.optional(),
       tools: AssertObjectSchema.optional()
@@ -17146,7 +17805,7 @@ var init_types = __esm(() => {
     params: InitializeRequestParamsSchema
   });
   ServerCapabilitiesSchema = object2({
-    experimental: record(string2(), AssertObjectSchema).optional(),
+    experimental: record2(string2(), AssertObjectSchema).optional(),
     logging: AssertObjectSchema.optional(),
     completions: AssertObjectSchema.optional(),
     prompts: object2({
@@ -17246,7 +17905,7 @@ var init_types = __esm(() => {
   ResourceContentsSchema = object2({
     uri: string2(),
     mimeType: optional(string2()),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   TextResourceContentsSchema = ResourceContentsSchema.extend({
     text: string2()
@@ -17350,7 +18009,7 @@ var init_types = __esm(() => {
   });
   GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
     name: string2(),
-    arguments: record(string2(), string2()).optional()
+    arguments: record2(string2(), string2()).optional()
   });
   GetPromptRequestSchema = RequestSchema.extend({
     method: literal("prompts/get"),
@@ -17360,34 +18019,34 @@ var init_types = __esm(() => {
     type: literal("text"),
     text: string2(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   ImageContentSchema = object2({
     type: literal("image"),
     data: Base64Schema,
     mimeType: string2(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   AudioContentSchema = object2({
     type: literal("audio"),
     data: Base64Schema,
     mimeType: string2(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   ToolUseContentSchema = object2({
     type: literal("tool_use"),
     name: string2(),
     id: string2(),
-    input: record(string2(), unknown()),
-    _meta: record(string2(), unknown()).optional()
+    input: record2(string2(), unknown()),
+    _meta: record2(string2(), unknown()).optional()
   });
   EmbeddedResourceSchema = object2({
     type: literal("resource"),
     resource: union([TextResourceContentsSchema, BlobResourceContentsSchema]),
     annotations: AnnotationsSchema.optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   ResourceLinkSchema = ResourceSchema.extend({
     type: literal("resource_link")
@@ -17427,17 +18086,17 @@ var init_types = __esm(() => {
     description: string2().optional(),
     inputSchema: object2({
       type: literal("object"),
-      properties: record(string2(), AssertObjectSchema).optional(),
+      properties: record2(string2(), AssertObjectSchema).optional(),
       required: array(string2()).optional()
     }).catchall(unknown()),
     outputSchema: object2({
       type: literal("object"),
-      properties: record(string2(), AssertObjectSchema).optional(),
+      properties: record2(string2(), AssertObjectSchema).optional(),
       required: array(string2()).optional()
     }).catchall(unknown()).optional(),
     annotations: ToolAnnotationsSchema.optional(),
     execution: ToolExecutionSchema.optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   ListToolsRequestSchema = PaginatedRequestSchema.extend({
     method: literal("tools/list")
@@ -17447,7 +18106,7 @@ var init_types = __esm(() => {
   });
   CallToolResultSchema = ResultSchema.extend({
     content: array(ContentBlockSchema).default([]),
-    structuredContent: record(string2(), unknown()).optional(),
+    structuredContent: record2(string2(), unknown()).optional(),
     isError: boolean2().optional()
   });
   CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
@@ -17455,7 +18114,7 @@ var init_types = __esm(() => {
   }));
   CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     name: string2(),
-    arguments: record(string2(), unknown()).optional()
+    arguments: record2(string2(), unknown()).optional()
   });
   CallToolRequestSchema = RequestSchema.extend({
     method: literal("tools/call"),
@@ -17504,7 +18163,7 @@ var init_types = __esm(() => {
     content: array(ContentBlockSchema).default([]),
     structuredContent: object2({}).loose().optional(),
     isError: boolean2().optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]);
   SamplingMessageContentBlockSchema = discriminatedUnion("type", [
@@ -17517,7 +18176,7 @@ var init_types = __esm(() => {
   SamplingMessageSchema = object2({
     role: RoleSchema,
     content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     messages: array(SamplingMessageSchema),
@@ -17630,7 +18289,7 @@ var init_types = __esm(() => {
     message: string2(),
     requestedSchema: object2({
       type: literal("object"),
-      properties: record(string2(), PrimitiveSchemaDefinitionSchema),
+      properties: record2(string2(), PrimitiveSchemaDefinitionSchema),
       required: array(string2()).optional()
     })
   });
@@ -17654,7 +18313,7 @@ var init_types = __esm(() => {
   });
   ElicitResultSchema = ResultSchema.extend({
     action: _enum2(["accept", "decline", "cancel"]),
-    content: preprocess((val) => val === null ? undefined : val, record(string2(), union([string2(), number2(), boolean2(), array(string2())])).optional())
+    content: preprocess((val) => val === null ? undefined : val, record2(string2(), union([string2(), number2(), boolean2(), array(string2())])).optional())
   });
   ResourceTemplateReferenceSchema = object2({
     type: literal("ref/resource"),
@@ -17671,7 +18330,7 @@ var init_types = __esm(() => {
       value: string2()
     }),
     context: object2({
-      arguments: record(string2(), string2()).optional()
+      arguments: record2(string2(), string2()).optional()
     }).optional()
   });
   CompleteRequestSchema = RequestSchema.extend({
@@ -17688,7 +18347,7 @@ var init_types = __esm(() => {
   RootSchema = object2({
     uri: string2().startsWith("file://"),
     name: string2().optional(),
-    _meta: record(string2(), unknown()).optional()
+    _meta: record2(string2(), unknown()).optional()
   });
   ListRootsRequestSchema = RequestSchema.extend({
     method: literal("roots/list"),
@@ -23041,11 +23700,11 @@ var require_core3 = __commonJS((exports) => {
   Ajv.ValidationError = validation_error_1.default;
   Ajv.MissingRefError = ref_error_1.default;
   exports.default = Ajv;
-  function checkOptions(checkOpts, options, msg, log = "error") {
+  function checkOptions(checkOpts, options, msg, log2 = "error") {
     for (const key in checkOpts) {
       const opt = key;
       if (opt in options)
-        this.logger[log](`${msg}: option ${key}. ${checkOpts[opt]}`);
+        this.logger[log2](`${msg}: option ${key}. ${checkOpts[opt]}`);
     }
   }
   function getSchEnv(keyRef) {
@@ -25944,7 +26603,7 @@ var init_stdio2 = __esm(() => {
 });
 
 // src/channel/diagnostics.ts
-import { appendFileSync } from "fs";
+import { appendFileSync as appendFileSync2 } from "fs";
 function traceEnabled() {
   return process.env[TRACE_ENV] === "1";
 }
@@ -25955,7 +26614,7 @@ function emit(line) {
   const filePath = process.env[TRACE_FILE_ENV];
   if (filePath) {
     try {
-      appendFileSync(filePath, formatted);
+      appendFileSync2(filePath, formatted);
     } catch {}
   }
 }
@@ -26195,9 +26854,9 @@ var init_signal_watcher = __esm(() => {
 // src/channel/session-manager.ts
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { createWriteStream, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { createWriteStream, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 
 class SessionManager {
   sessions = new Map;
@@ -26217,10 +26876,10 @@ class SessionManager {
     const sessionId = randomUUID().slice(0, 8);
     const timeout = Math.min(opts.timeoutSeconds ?? DEFAULT_TIMEOUT, MAX_TIMEOUT);
     const startedAt = new Date().toISOString();
-    const sessionDir = join4(homedir4(), ".claudish", "sessions", sessionId);
-    mkdirSync2(sessionDir, { recursive: true });
+    const sessionDir = join6(homedir6(), ".claudish", "sessions", sessionId);
+    mkdirSync4(sessionDir, { recursive: true });
     if (opts.prompt) {
-      writeFileSync3(join4(sessionDir, "prompt.md"), opts.prompt, "utf-8");
+      writeFileSync5(join6(sessionDir, "prompt.md"), opts.prompt, "utf-8");
     }
     const args = ["--model", opts.model, "-y", "--stdin", "--quiet", ...opts.claudishFlags ?? []];
     const proc = spawn("claudish", args, {
@@ -26247,7 +26906,7 @@ class SessionManager {
         });
       }
     });
-    const outputLogStream = createWriteStream(join4(sessionDir, "output.log"));
+    const outputLogStream = createWriteStream(join6(sessionDir, "output.log"));
     const entry = {
       info: {
         sessionId,
@@ -26294,9 +26953,9 @@ class SessionManager {
       watcher.processExited(code);
       outputLogStream.end();
       if (entry.stderr) {
-        writeFileSync3(join4(sessionDir, "stderr.log"), entry.stderr, "utf-8");
+        writeFileSync5(join6(sessionDir, "stderr.log"), entry.stderr, "utf-8");
       }
-      writeFileSync3(join4(sessionDir, "meta.json"), JSON.stringify(entry.info, null, 2), "utf-8");
+      writeFileSync5(join6(sessionDir, "meta.json"), JSON.stringify(entry.info, null, 2), "utf-8");
       this.cleanupSigint();
     });
     proc.on("error", (err) => {
@@ -26469,9 +27128,9 @@ var init_cache_ttl = __esm(() => {
 });
 
 // src/model-loader.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join7 } from "path";
 function groupRecommendedModels(entries) {
   const byId = new Map;
   for (const entry of entries) {
@@ -26567,9 +27226,9 @@ async function getRecommendedModels(opts = {}) {
   if (!forceRefresh && _cachedRecommendedModels) {
     return _cachedRecommendedModels;
   }
-  if (!forceRefresh && existsSync4(RECOMMENDED_MODELS_CACHE_PATH)) {
+  if (!forceRefresh && existsSync5(RECOMMENDED_MODELS_CACHE_PATH)) {
     try {
-      const cacheData = JSON.parse(readFileSync3(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
+      const cacheData = JSON.parse(readFileSync4(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
       if (cacheData.models && cacheData.models.length > 0 && isFreshEnough(cacheData)) {
         _cachedRecommendedModels = cacheData;
         return cacheData;
@@ -26585,9 +27244,9 @@ async function getRecommendedModels(opts = {}) {
       if (data.models && data.models.length > 0) {
         _cachedRecommendedModels = data;
         try {
-          const cacheDir = join5(homedir5(), ".claudish");
-          mkdirSync3(cacheDir, { recursive: true });
-          writeFileSync4(RECOMMENDED_MODELS_CACHE_PATH, JSON.stringify(data), "utf-8");
+          const cacheDir = join7(homedir7(), ".claudish");
+          mkdirSync5(cacheDir, { recursive: true });
+          writeFileSync6(RECOMMENDED_MODELS_CACHE_PATH, JSON.stringify(data), "utf-8");
         } catch {}
         return data;
       }
@@ -26598,9 +27257,9 @@ async function getRecommendedModels(opts = {}) {
 function getRecommendedModelsSync() {
   if (_cachedRecommendedModels)
     return _cachedRecommendedModels;
-  if (existsSync4(RECOMMENDED_MODELS_CACHE_PATH)) {
+  if (existsSync5(RECOMMENDED_MODELS_CACHE_PATH)) {
     try {
-      const cacheData = JSON.parse(readFileSync3(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
+      const cacheData = JSON.parse(readFileSync4(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
       if (cacheData.models && cacheData.models.length > 0 && isFreshEnough(cacheData)) {
         _cachedRecommendedModels = cacheData;
         return cacheData;
@@ -26724,7 +27383,7 @@ var _cachedModelInfo = null, _cachedModelIds = null, _cachedRecommendedModels =
 var init_model_loader = __esm(() => {
   init_cache_ttl();
   FIREBASE_RECOMMENDED_URL = `${FIREBASE_BASE_URL}?catalog=recommended`;
-  RECOMMENDED_MODELS_CACHE_PATH = join5(homedir5(), ".claudish", "recommended-models-cache.json");
+  RECOMMENDED_MODELS_CACHE_PATH = join7(homedir7(), ".claudish", "recommended-models-cache.json");
   FIREBASE_SLUG_TO_PROVIDER_NAME = {
     openai: "openai",
     google: "google",
@@ -26806,21 +27465,21 @@ __export(exports_profile_config, {
   configExistsForScope: () => configExistsForScope,
   configExists: () => configExists
 });
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname2, join as join6, parse as parse6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname3, join as join8, parse as parse6 } from "path";
 function ensureConfigDir() {
-  if (!existsSync5(CONFIG_DIR)) {
-    mkdirSync4(CONFIG_DIR, { recursive: true });
+  if (!existsSync6(CONFIG_DIR)) {
+    mkdirSync6(CONFIG_DIR, { recursive: true });
   }
 }
 function loadConfig() {
   ensureConfigDir();
-  if (!existsSync5(CONFIG_FILE)) {
+  if (!existsSync6(CONFIG_FILE)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const content = readFileSync4(CONFIG_FILE, "utf-8");
+    const content = readFileSync5(CONFIG_FILE, "utf-8");
     const config2 = JSON.parse(content);
     const merged = {
       version: config2.version || DEFAULT_CONFIG.version,
@@ -26871,43 +27530,43 @@ function loadConfig() {
 }
 function saveConfig(config2) {
   ensureConfigDir();
-  writeFileSync5(CONFIG_FILE, JSON.stringify(config2, null, 2), "utf-8");
+  writeFileSync7(CONFIG_FILE, JSON.stringify(config2, null, 2), "utf-8");
 }
 function configExists() {
-  return existsSync5(CONFIG_FILE);
+  return existsSync6(CONFIG_FILE);
 }
 function getConfigPath() {
   return CONFIG_FILE;
 }
 function getLocalConfigPath() {
-  const home = homedir6();
+  const home = homedir8();
   let dir = process.cwd();
   const root = parse6(dir).root;
   while (dir !== root && dir !== home) {
-    const candidate = join6(dir, LOCAL_CONFIG_FILENAME);
-    if (existsSync5(candidate))
+    const candidate = join8(dir, LOCAL_CONFIG_FILENAME);
+    if (existsSync6(candidate))
       return candidate;
-    if (existsSync5(join6(dir, ".git"))) {
+    if (existsSync6(join8(dir, ".git"))) {
       return candidate;
     }
-    dir = dirname2(dir);
+    dir = dirname3(dir);
   }
-  return join6(process.cwd(), LOCAL_CONFIG_FILENAME);
+  return join8(process.cwd(), LOCAL_CONFIG_FILENAME);
 }
 function localConfigExists() {
-  return existsSync5(getLocalConfigPath());
+  return existsSync6(getLocalConfigPath());
 }
 function isProjectDirectory() {
   const cwd = process.cwd();
-  return [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".claudish.json"].some((f) => existsSync5(join6(cwd, f)));
+  return [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".claudish.json"].some((f) => existsSync6(join8(cwd, f)));
 }
 function loadLocalConfig() {
   const localPath = getLocalConfigPath();
-  if (!existsSync5(localPath)) {
+  if (!existsSync6(localPath)) {
     return null;
   }
   try {
-    const content = readFileSync4(localPath, "utf-8");
+    const content = readFileSync5(localPath, "utf-8");
     const config2 = JSON.parse(content);
     return {
       ...config2,
@@ -26925,7 +27584,7 @@ function saveLocalConfig(config2) {
   if (toWrite.routing !== undefined && Object.keys(toWrite.routing).length === 0) {
     delete toWrite.routing;
   }
-  writeFileSync5(getLocalConfigPath(), JSON.stringify(toWrite, null, 2), "utf-8");
+  writeFileSync7(getLocalConfigPath(), JSON.stringify(toWrite, null, 2), "utf-8");
 }
 function loadConfigForScope(scope) {
   if (scope === "local") {
@@ -27166,8 +27825,8 @@ function disableLocalProvider(providerName) {
 }
 var CONFIG_DIR, CONFIG_FILE, LOCAL_CONFIG_FILENAME = ".claudish.json", DEFAULT_CONFIG;
 var init_profile_config = __esm(() => {
-  CONFIG_DIR = join6(homedir6(), ".claudish");
-  CONFIG_FILE = join6(CONFIG_DIR, "config.json");
+  CONFIG_DIR = join8(homedir8(), ".claudish");
+  CONFIG_FILE = join8(CONFIG_DIR, "config.json");
   DEFAULT_CONFIG = {
     version: "1.0.0",
     defaultProfile: "default",
@@ -30093,264 +30752,6 @@ var cors = (options) => {
 };
 var init_cors = () => {};
 
-// src/logger.ts
-var exports_logger = {};
-__export(exports_logger, {
-  truncateContent: () => truncateContent,
-  structuralRedact: () => structuralRedact,
-  setStderrQuiet: () => setStderrQuiet,
-  setLogLevel: () => setLogLevel,
-  setDiagOutput: () => setDiagOutput,
-  maskCredential: () => maskCredential,
-  logStructured: () => logStructured,
-  logStderr: () => logStderr,
-  log: () => log,
-  isLoggingEnabled: () => isLoggingEnabled,
-  initLogger: () => initLogger,
-  getLogLevel: () => getLogLevel,
-  getLogFilePath: () => getLogFilePath,
-  getAlwaysOnLogPath: () => getAlwaysOnLogPath
-});
-import { appendFile, existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
-function flushLogBuffer() {
-  if (!logFilePath || logBuffer.length === 0)
-    return;
-  const toWrite = logBuffer.join("");
-  logBuffer = [];
-  appendFile(logFilePath, toWrite, (err) => {
-    if (err) {
-      console.error(`[claudish] Warning: Failed to write to log file: ${err.message}`);
-    }
-  });
-}
-function flushAlwaysOnBuffer() {
-  if (!alwaysOnLogPath || alwaysOnBuffer.length === 0)
-    return;
-  const toWrite = alwaysOnBuffer.join("");
-  alwaysOnBuffer = [];
-  appendFile(alwaysOnLogPath, toWrite, () => {});
-}
-function scheduleFlush() {
-  if (flushTimer)
-    return;
-  flushTimer = setInterval(() => {
-    flushLogBuffer();
-    flushAlwaysOnBuffer();
-  }, FLUSH_INTERVAL_MS);
-  process.on("exit", () => {
-    if (flushTimer) {
-      clearInterval(flushTimer);
-      flushTimer = null;
-    }
-    if (logFilePath && logBuffer.length > 0) {
-      writeFileSync6(logFilePath, logBuffer.join(""), { flag: "a" });
-      logBuffer = [];
-    }
-    if (alwaysOnLogPath && alwaysOnBuffer.length > 0) {
-      writeFileSync6(alwaysOnLogPath, alwaysOnBuffer.join(""), { flag: "a" });
-      alwaysOnBuffer = [];
-    }
-  });
-}
-function rotateOldLogs(dir, keep) {
-  try {
-    const files = readdirSync(dir).filter((f) => f.startsWith("claudish_") && f.endsWith(".log")).sort().reverse();
-    for (const file2 of files.slice(keep)) {
-      try {
-        unlinkSync(join7(dir, file2));
-      } catch {}
-    }
-  } catch {}
-}
-function structuralRedact(jsonStr) {
-  try {
-    const obj = JSON.parse(jsonStr);
-    return JSON.stringify(redactDeep(obj));
-  } catch {
-    return jsonStr.replace(/"[^"]{20,}"/g, (m) => `"<${m.length - 2} chars>"`);
-  }
-}
-function redactDeep(val, key) {
-  if (val === null || val === undefined)
-    return val;
-  if (typeof val === "boolean" || typeof val === "number")
-    return val;
-  if (typeof val === "string") {
-    if (key && CONTENT_KEYS.has(key)) {
-      return `<${val.length} chars>`;
-    }
-    return val.length <= 20 ? val : `<${val.length} chars>`;
-  }
-  if (Array.isArray(val))
-    return val.map((v) => redactDeep(v));
-  if (typeof val === "object") {
-    const result = {};
-    for (const [k, v] of Object.entries(val)) {
-      result[k] = redactDeep(v, k);
-    }
-    return result;
-  }
-  return val;
-}
-function isStructuralLogWorthy(msg) {
-  return msg.startsWith("[SSE:") || msg.startsWith("[Proxy]") || msg.startsWith("[Fallback]") || msg.startsWith("[Streaming] ===") || msg.startsWith("[Streaming] Chunk:") || msg.startsWith("[Streaming] Received") || msg.startsWith("[Streaming] Text-based tool calls") || msg.startsWith("[Streaming] Final usage") || msg.startsWith("[Streaming] Sending") || msg.startsWith("[AnthropicSSE] Stream complete") || msg.startsWith("[AnthropicSSE] Tool use:") || msg.includes("Response status:") || msg.includes("Error") || msg.includes("error") || msg.includes("[Auto-route]");
-}
-function redactLogLine(message, timestamp) {
-  if (message.startsWith("[SSE:")) {
-    const prefixEnd = message.indexOf("] ") + 2;
-    const prefix = message.substring(0, prefixEnd);
-    const payload = message.substring(prefixEnd);
-    return `[${timestamp}] ${prefix}${structuralRedact(payload)}
-`;
-  }
-  return `[${timestamp}] ${message}
-`;
-}
-function initLogger(debugMode, level = "info", noLogs = false) {
-  if (!noLogs) {
-    const logsDir = join7(homedir7(), ".claudish", "logs");
-    if (!existsSync6(logsDir)) {
-      mkdirSync5(logsDir, { recursive: true });
-    }
-    const timestamp = new Date().toISOString().replace(/[:.]/g, "-").split("T").join("_").slice(0, -5);
-    alwaysOnLogPath = join7(logsDir, `claudish_${timestamp}.log`);
-    writeFileSync6(alwaysOnLogPath, `Claudish Session Log - ${new Date().toISOString()}
-Mode: structural (content redacted)
-${"=".repeat(60)}
-
-`);
-    rotateOldLogs(logsDir, 20);
-    scheduleFlush();
-  }
-  if (debugMode) {
-    logLevel = level;
-    const logsDir = join7(process.cwd(), "logs");
-    if (!existsSync6(logsDir)) {
-      mkdirSync5(logsDir, { recursive: true });
-    }
-    const timestamp = new Date().toISOString().replace(/[:.]/g, "-").split("T").join("_").slice(0, -5);
-    logFilePath = join7(logsDir, `claudish_${timestamp}.log`);
-    writeFileSync6(logFilePath, `Claudish Debug Log - ${new Date().toISOString()}
-Log Level: ${level}
-${"=".repeat(80)}
-
-`);
-    scheduleFlush();
-  } else {
-    logFilePath = null;
-    if (noLogs && flushTimer) {
-      clearInterval(flushTimer);
-      flushTimer = null;
-    }
-  }
-}
-function log(message, forceConsole = false) {
-  const timestamp = new Date().toISOString();
-  const logLine = `[${timestamp}] ${message}
-`;
-  if (logFilePath) {
-    logBuffer.push(logLine);
-    if (logBuffer.length >= MAX_BUFFER_SIZE) {
-      flushLogBuffer();
-    }
-  }
-  if (alwaysOnLogPath && isStructuralLogWorthy(message)) {
-    const redactedLine = redactLogLine(message, timestamp);
-    alwaysOnBuffer.push(redactedLine);
-    if (alwaysOnBuffer.length >= MAX_BUFFER_SIZE) {
-      flushAlwaysOnBuffer();
-    }
-  }
-  if (forceConsole) {
-    console.log(message);
-  }
-}
-function logStderr(message) {
-  if (diagOutput) {
-    diagOutput.write(message);
-  } else if (!stderrQuiet) {
-    process.stderr.write(`[claudish] ${message}
-`);
-  }
-  log(message);
-}
-function setDiagOutput(output) {
-  diagOutput = output;
-}
-function setStderrQuiet(quiet) {
-  stderrQuiet = quiet;
-}
-function getLogFilePath() {
-  return logFilePath;
-}
-function getAlwaysOnLogPath() {
-  return alwaysOnLogPath;
-}
-function isLoggingEnabled() {
-  return logFilePath !== null || alwaysOnLogPath !== null;
-}
-function maskCredential(credential) {
-  if (!credential || credential.length <= 8) {
-    return "***";
-  }
-  return `${credential.substring(0, 4)}...${credential.substring(credential.length - 4)}`;
-}
-function setLogLevel(level) {
-  logLevel = level;
-  if (logFilePath) {
-    log(`[Logger] Log level changed to: ${level}`);
-  }
-}
-function getLogLevel() {
-  return logLevel;
-}
-function truncateContent(content, maxLength = 200) {
-  if (content === undefined || content === null)
-    return "[empty]";
-  const str = typeof content === "string" ? content : JSON.stringify(content) ?? "[empty]";
-  if (str.length <= maxLength) {
-    return str;
-  }
-  return `${str.substring(0, maxLength)}... [truncated ${str.length - maxLength} chars]`;
-}
-function logStructured(label, data) {
-  if (!logFilePath)
-    return;
-  if (logLevel === "minimal") {
-    log(`[${label}]`);
-    return;
-  }
-  if (logLevel === "info") {
-    const structured = {};
-    for (const [key, value] of Object.entries(data)) {
-      if (typeof value === "string" || typeof value === "object") {
-        structured[key] = truncateContent(value, 150);
-      } else {
-        structured[key] = value;
-      }
-    }
-    log(`[${label}] ${JSON.stringify(structured, null, 2)}`);
-    return;
-  }
-  log(`[${label}] ${JSON.stringify(data, null, 2)}`);
-}
-var logFilePath = null, logLevel = "info", stderrQuiet = false, diagOutput = null, logBuffer, flushTimer = null, FLUSH_INTERVAL_MS = 100, MAX_BUFFER_SIZE = 50, alwaysOnLogPath = null, alwaysOnBuffer, CONTENT_KEYS;
-var init_logger = __esm(() => {
-  logBuffer = [];
-  alwaysOnBuffer = [];
-  CONTENT_KEYS = new Set([
-    "content",
-    "reasoning_content",
-    "text",
-    "thinking",
-    "partial_json",
-    "arguments",
-    "input"
-  ]);
-});
-
 // src/handlers/shared/remote-provider-types.ts
 function registerDynamicPricingLookup(fn) {
   _dynamicLookup = fn;
@@ -30396,15 +30797,15 @@ var init_remote_provider_types = __esm(() => {
 });
 
 // src/providers/all-models-cache.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname3, join as join8 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname4, join as join9 } from "path";
 function readAllModelsCache(path = ALL_MODELS_CACHE_PATH) {
   if (!existsSync7(path))
     return null;
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync5(path, "utf-8"));
+    raw2 = JSON.parse(readFileSync6(path, "utf-8"));
   } catch {
     return null;
   }
@@ -30429,12 +30830,12 @@ function writeAllModelsCache(data, path = ALL_MODELS_CACHE_PATH) {
     entries: data.entries ?? existing?.entries ?? [],
     models: data.models ?? existing?.models ?? []
   };
-  mkdirSync6(dirname3(path), { recursive: true });
-  writeFileSync7(path, JSON.stringify(merged), "utf-8");
+  mkdirSync7(dirname4(path), { recursive: true });
+  writeFileSync8(path, JSON.stringify(merged), "utf-8");
 }
 var ALL_MODELS_CACHE_PATH;
 var init_all_models_cache = __esm(() => {
-  ALL_MODELS_CACHE_PATH = join8(homedir8(), ".claudish", "all-models.json");
+  ALL_MODELS_CACHE_PATH = join9(homedir9(), ".claudish", "all-models.json");
 });
 
 // src/adapters/model-catalog.ts
@@ -32629,10 +33030,13 @@ var init_grok_model_dialect = __esm(() => {
     }
     effortToReasoningEffort(effort) {
       const model = this.modelId.toLowerCase();
-      if (model.includes("non-reasoning") || model.includes("grok-2") || this.isOriginalGrok4()) {
+      const isMini = model.includes("mini");
+      const isGrok43 = /grok-4\.3(\b|[-.]|$)/.test(model);
+      const isFastReasoning = model.includes("fast-reasoning");
+      if (!(isMini || isGrok43 || isFastReasoning)) {
         return;
       }
-      if (model.includes("mini")) {
+      if (isMini) {
         switch (effort) {
           case "high":
           case "xhigh":
@@ -32650,20 +33054,10 @@ var init_grok_model_dialect = __esm(() => {
           return "low";
         case "medium":
           return "medium";
-        case "high":
-        case "xhigh":
-        case "max":
-          return "high";
         default:
           return "high";
       }
     }
-    isOriginalGrok4() {
-      const model = this.modelId.toLowerCase();
-      if (model.includes("fast") || model.includes("mini"))
-        return false;
-      return /grok-4(?![.\d])/.test(model);
-    }
     parseXmlParameters(xmlContent) {
       const params = {};
       const paramPattern = /<xai:parameter name="([^"]+)">([^<]*)<\/xai:parameter>/g;
@@ -33351,8 +33745,8 @@ ${text}`;
 
 // src/auth/credentials/api-key-credential.ts
 import { existsSync as existsSync8 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 
 class ApiKeyCredentialProvider {
   catalogName;
@@ -33370,7 +33764,7 @@ class ApiKeyCredentialProvider {
     this.aliases = descriptor.aliases ?? [];
     this.authScheme = descriptor.authScheme ?? "bearer";
     this.staticHeaders = descriptor.staticHeaders ?? {};
-    this.publicKeyFallback = descriptor.publicKeyFallback ?? false;
+    this.publicKeyFallback = descriptor.publicKeyFallback;
     this.oauthFallback = descriptor.oauthFallback;
   }
   resolveFromEnvConfig() {
@@ -33380,7 +33774,7 @@ class ApiKeyCredentialProvider {
     if (!this.oauthFallback)
       return false;
     try {
-      return existsSync8(join9(homedir9(), ".claudish", this.oauthFallback));
+      return existsSync8(join10(homedir10(), ".claudish", this.oauthFallback));
     } catch {
       return false;
     }
@@ -33434,7 +33828,7 @@ class ApiKeyCredentialProvider {
     this.resolving = undefined;
   }
   async getRequestAuth(ctx) {
-    const key = await this.resolveKey({ allowOpPrompt: ctx.allowOpPrompt });
+    const key = await this.resolveKey({ allowOpPrompt: ctx.allowOpPrompt }) || this.publicKeyFallback || "";
     let headers;
     if (this.authScheme === "x-api-key") {
       headers = { "x-api-key": key, ...this.staticHeaders };
@@ -33454,10 +33848,10 @@ var init_api_key_credential = __esm(() => {
 // src/auth/codex-oauth.ts
 import { exec } from "child_process";
 import { createHash as createHash2, randomBytes } from "crypto";
-import { closeSync, existsSync as existsSync9, openSync, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeSync } from "fs";
+import { closeSync, existsSync as existsSync9, openSync, readFileSync as readFileSync7, unlinkSync as unlinkSync2, writeSync } from "fs";
 import { createServer as createServer2 } from "http";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join11 } from "path";
 import { promisify } from "util";
 
 class CodexOAuth {
@@ -33483,8 +33877,8 @@ class CodexOAuth {
     return this.credentials !== null && !!this.credentials.refresh_token;
   }
   getCredentialsPath() {
-    const claudishDir = join10(homedir10(), ".claudish");
-    return join10(claudishDir, "codex-oauth.json");
+    const claudishDir = join11(homedir11(), ".claudish");
+    return join11(claudishDir, "codex-oauth.json");
   }
   async login() {
     log("[CodexOAuth] Starting OAuth login flow");
@@ -33592,7 +33986,7 @@ Details: ${e.message}`);
       return null;
     }
     try {
-      const data = readFileSync6(credPath, "utf-8");
+      const data = readFileSync7(credPath, "utf-8");
       const credentials = JSON.parse(data);
       if (!credentials.access_token || !credentials.refresh_token || !credentials.expires_at) {
         log("[CodexOAuth] Invalid credentials file structure");
@@ -33607,10 +34001,10 @@ Details: ${e.message}`);
   }
   saveCredentials(credentials) {
     const credPath = this.getCredentialsPath();
-    const claudishDir = join10(homedir10(), ".claudish");
+    const claudishDir = join11(homedir11(), ".claudish");
     if (!existsSync9(claudishDir)) {
-      const { mkdirSync: mkdirSync7 } = __require("fs");
-      mkdirSync7(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync8 } = __require("fs");
+      mkdirSync8(claudishDir, { recursive: true });
     }
     const fd = openSync(credPath, "w", 384);
     try {
@@ -33918,10 +34312,10 @@ var init_codex_credential = __esm(() => {
 // src/auth/gemini-oauth.ts
 import { exec as exec2 } from "child_process";
 import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
-import { closeSync as closeSync2, existsSync as existsSync10, openSync as openSync2, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync10, openSync as openSync2, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
 import { createServer as createServer3 } from "http";
-import { homedir as homedir11 } from "os";
-import { join as join11 } from "path";
+import { homedir as homedir12 } from "os";
+import { join as join12 } from "path";
 import { promisify as promisify2 } from "util";
 
 class GeminiOAuth {
@@ -33947,8 +34341,8 @@ class GeminiOAuth {
     return this.credentials !== null && !!this.credentials.refresh_token;
   }
   getCredentialsPath() {
-    const claudishDir = join11(homedir11(), ".claudish");
-    return join11(claudishDir, "gemini-oauth.json");
+    const claudishDir = join12(homedir12(), ".claudish");
+    return join12(claudishDir, "gemini-oauth.json");
   }
   async login() {
     log("[GeminiOAuth] Starting OAuth login flow");
@@ -34050,7 +34444,7 @@ Details: ${e.message}`);
       return null;
     }
     try {
-      const data = readFileSync7(credPath, "utf-8");
+      const data = readFileSync8(credPath, "utf-8");
       const credentials = JSON.parse(data);
       if (!credentials.access_token || !credentials.refresh_token || !credentials.expires_at) {
         log("[GeminiOAuth] Invalid credentials file structure");
@@ -34065,10 +34459,10 @@ Details: ${e.message}`);
   }
   saveCredentials(credentials) {
     const credPath = this.getCredentialsPath();
-    const claudishDir = join11(homedir11(), ".claudish");
+    const claudishDir = join12(homedir12(), ".claudish");
     if (!existsSync10(claudishDir)) {
-      const { mkdirSync: mkdirSync7 } = __require("fs");
-      mkdirSync7(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync8 } = __require("fs");
+      mkdirSync8(claudishDir, { recursive: true });
     }
     const fd = openSync2(credPath, "w", 384);
     try {
@@ -34429,18 +34823,18 @@ var init_gemini_oauth = __esm(() => {
 });
 
 // src/auth/oauth-registry.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join13 } from "path";
 function hasValidOAuthCredentials(descriptor) {
-  const credPath = join12(homedir12(), ".claudish", descriptor.credentialFile);
+  const credPath = join13(homedir13(), ".claudish", descriptor.credentialFile);
   if (!existsSync11(credPath))
     return false;
   if (descriptor.validationMode === "file-exists") {
     return true;
   }
   try {
-    const data = JSON.parse(readFileSync8(credPath, "utf-8"));
+    const data = JSON.parse(readFileSync9(credPath, "utf-8"));
     if (!data.access_token)
       return false;
     if (data.refresh_token)
@@ -34550,9 +34944,9 @@ var init_gemini_credential = __esm(() => {
 // src/auth/kimi-oauth.ts
 import { exec as exec3 } from "child_process";
 import { randomBytes as randomBytes3 } from "crypto";
-import { closeSync as closeSync3, existsSync as existsSync12, openSync as openSync3, readFileSync as readFileSync9, unlinkSync as unlinkSync4, writeSync as writeSync3 } from "fs";
-import { homedir as homedir13, hostname as hostname3, platform, release } from "os";
-import { join as join13 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync12, openSync as openSync3, readFileSync as readFileSync10, unlinkSync as unlinkSync4, writeSync as writeSync3 } from "fs";
+import { homedir as homedir14, hostname as hostname3, platform, release } from "os";
+import { join as join14 } from "path";
 import { promisify as promisify3 } from "util";
 
 class KimiOAuth {
@@ -34580,23 +34974,23 @@ class KimiOAuth {
     return this.credentials !== null && !!this.credentials.refresh_token;
   }
   getCredentialsPath() {
-    const claudishDir = join13(homedir13(), ".claudish");
-    return join13(claudishDir, "kimi-oauth.json");
+    const claudishDir = join14(homedir14(), ".claudish");
+    return join14(claudishDir, "kimi-oauth.json");
   }
   getDeviceIdPath() {
-    const claudishDir = join13(homedir13(), ".claudish");
-    return join13(claudishDir, "kimi-device-id");
+    const claudishDir = join14(homedir14(), ".claudish");
+    return join14(claudishDir, "kimi-device-id");
   }
   loadOrCreateDeviceId() {
     const deviceIdPath = this.getDeviceIdPath();
-    const claudishDir = join13(homedir13(), ".claudish");
+    const claudishDir = join14(homedir14(), ".claudish");
     if (!existsSync12(claudishDir)) {
-      const { mkdirSync: mkdirSync7 } = __require("fs");
-      mkdirSync7(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync8 } = __require("fs");
+      mkdirSync8(claudishDir, { recursive: true });
     }
     if (existsSync12(deviceIdPath)) {
       try {
-        const deviceId2 = readFileSync9(deviceIdPath, "utf-8").trim();
+        const deviceId2 = readFileSync10(deviceIdPath, "utf-8").trim();
         if (deviceId2) {
           return deviceId2;
         }
@@ -34855,7 +35249,7 @@ Details: ${e.message}`);
       return null;
     }
     try {
-      const data = readFileSync9(credPath, "utf-8");
+      const data = readFileSync10(credPath, "utf-8");
       const credentials = JSON.parse(data);
       if (!credentials.access_token || !credentials.refresh_token || !credentials.expires_at || !credentials.scope || !credentials.token_type) {
         log("[KimiOAuth] Invalid credentials file structure");
@@ -34870,10 +35264,10 @@ Details: ${e.message}`);
   }
   saveCredentials(credentials) {
     const credPath = this.getCredentialsPath();
-    const claudishDir = join13(homedir13(), ".claudish");
+    const claudishDir = join14(homedir14(), ".claudish");
     if (!existsSync12(claudishDir)) {
-      const { mkdirSync: mkdirSync7 } = __require("fs");
-      mkdirSync7(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync8 } = __require("fs");
+      mkdirSync8(claudishDir, { recursive: true });
     }
     const fd = openSync3(credPath, "w", 384);
     try {
@@ -35046,8 +35440,8 @@ var init_native_anthropic_credential = __esm(() => {
 // src/auth/vertex-auth.ts
 import { exec as exec4 } from "child_process";
 import { existsSync as existsSync13 } from "fs";
-import { homedir as homedir14 } from "os";
-import { join as join14 } from "path";
+import { homedir as homedir15 } from "os";
+import { join as join15 } from "path";
 import { promisify as promisify4 } from "util";
 
 class VertexAuthManager {
@@ -35102,7 +35496,7 @@ class VertexAuthManager {
   }
   async tryADC() {
     try {
-      const adcPath = join14(homedir14(), ".config/gcloud/application_default_credentials.json");
+      const adcPath = join15(homedir15(), ".config/gcloud/application_default_credentials.json");
       if (!existsSync13(adcPath)) {
         log("[VertexAuth] ADC credentials file not found");
         return null;
@@ -35166,7 +35560,7 @@ function validateVertexOAuthConfig() {
 ` + `  export VERTEX_PROJECT='your-gcp-project-id'
 ` + "  export VERTEX_LOCATION='us-central1'  # optional";
   }
-  const adcPath = join14(homedir14(), ".config/gcloud/application_default_credentials.json");
+  const adcPath = join15(homedir15(), ".config/gcloud/application_default_credentials.json");
   const hasADC = existsSync13(adcPath);
   const hasServiceAccount = !!process.env.GOOGLE_APPLICATION_CREDENTIALS;
   if (!hasADC && !hasServiceAccount) {
@@ -35284,7 +35678,7 @@ class CredentialAuthority {
   static buildDefault() {
     const authority = new CredentialAuthority;
     authority.register(makeCodexCredential(), ["openai-codex"]);
-    authority.register(new GeminiCodeAssistCredentialProvider, ["gemini-codeassist", "google"]);
+    authority.register(new GeminiCodeAssistCredentialProvider, ["gemini-codeassist"]);
     authority.register(makeKimiCredential(), ["kimi"]);
     authority.register(makeKimiCodingCredential(), ["kimi-coding"]);
     authority.register(new VertexCredentialProvider, ["vertex"]);
@@ -35295,7 +35689,6 @@ class CredentialAuthority {
     const alreadyRegistered = new Set([
       "openai-codex",
       "gemini-codeassist",
-      "google",
       "kimi",
       "kimi-coding",
       "vertex",
@@ -35314,14 +35707,14 @@ class CredentialAuthority {
         envVar: def.apiKeyEnvVar,
         aliases: def.apiKeyAliases,
         authScheme: def.authScheme === "x-api-key" ? "x-api-key" : "bearer",
-        publicKeyFallback: !!def.publicKeyFallback,
+        publicKeyFallback: def.publicKeyFallback,
         oauthFallback: def.oauthFallback
-      }), [def.name]);
+      }), [def.name, ...RUNTIME_NAME_ALIASES[def.name] ?? []]);
     }
     return authority;
   }
 }
-var LOCAL_PROVIDER_NAMES, credentials;
+var LOCAL_PROVIDER_NAMES, RUNTIME_NAME_ALIASES, credentials;
 var init_authority = __esm(() => {
   init_provider_definitions();
   init_api_key_credential();
@@ -35332,6 +35725,9 @@ var init_authority = __esm(() => {
   init_native_anthropic_credential();
   init_vertex_credential();
   LOCAL_PROVIDER_NAMES = ["ollama", "lmstudio", "vllm", "mlx"];
+  RUNTIME_NAME_ALIASES = {
+    google: ["gemini"]
+  };
   credentials = CredentialAuthority.buildDefault();
 });
 
@@ -36010,24 +36406,24 @@ var init_model_parser = __esm(() => {
 // src/stats-buffer.ts
 import {
   existsSync as existsSync14,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync10,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync11,
   renameSync,
   unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "fs";
-import { homedir as homedir15 } from "os";
-import { join as join15 } from "path";
+import { homedir as homedir16 } from "os";
+import { join as join16 } from "path";
 function ensureDir() {
   if (!existsSync14(CLAUDISH_DIR)) {
-    mkdirSync7(CLAUDISH_DIR, { recursive: true });
+    mkdirSync8(CLAUDISH_DIR, { recursive: true });
   }
 }
 function readFromDisk() {
   try {
     if (!existsSync14(BUFFER_FILE))
       return [];
-    const raw2 = readFileSync10(BUFFER_FILE, "utf-8");
+    const raw2 = readFileSync11(BUFFER_FILE, "utf-8");
     const parsed = JSON.parse(raw2);
     if (!Array.isArray(parsed.events))
       return [];
@@ -36052,8 +36448,8 @@ function writeToDisk(events) {
     ensureDir();
     const trimmed = enforceSizeCap([...events]);
     const payload = { version: 1, events: trimmed };
-    const tmpFile = join15(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
-    writeFileSync8(tmpFile, JSON.stringify(payload, null, 2), "utf-8");
+    const tmpFile = join16(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
+    writeFileSync9(tmpFile, JSON.stringify(payload, null, 2), "utf-8");
     renameSync(tmpFile, BUFFER_FILE);
     memoryCache = trimmed;
   } catch {}
@@ -36125,8 +36521,8 @@ function syncFlushOnExit() {
 var BUFFER_MAX_BYTES, CLAUDISH_DIR, BUFFER_FILE, memoryCache = null, eventsSinceLastFlush = 0, flushScheduled = false;
 var init_stats_buffer = __esm(() => {
   BUFFER_MAX_BYTES = 64 * 1024;
-  CLAUDISH_DIR = join15(homedir15(), ".claudish");
-  BUFFER_FILE = join15(CLAUDISH_DIR, "stats-buffer.json");
+  CLAUDISH_DIR = join16(homedir16(), ".claudish");
+  BUFFER_FILE = join16(CLAUDISH_DIR, "stats-buffer.json");
   process.on("exit", syncFlushOnExit);
   process.on("SIGTERM", () => {
     try {
@@ -37010,12 +37406,12 @@ function statusToErrorType(status) {
       return "api_error";
   }
 }
-function wrapAnthropicError(status, message, errorType) {
+function wrapAnthropicError(status, message, errorType, upstreamStatus) {
   const type = errorType || statusToErrorType(status);
-  return {
-    type: "error",
-    error: { type, message }
-  };
+  const error46 = { type, message };
+  if (upstreamStatus !== undefined)
+    error46.upstream_status = upstreamStatus;
+  return { type: "error", error: error46 };
 }
 function extractProviderMessage(body) {
   if (body == null)
@@ -37334,7 +37730,7 @@ data: ${JSON.stringify(data)}
       };
       const msgId = `msg_${Date.now()}_${Math.random().toString(36).slice(2)}`;
       let usage = null;
-      let finalized = false;
+      let finalized2 = false;
       let textStarted = false;
       let textIdx = -1;
       let thinkingStarted = false;
@@ -37363,9 +37759,9 @@ data: ${JSON.stringify(data)}
         }
       }, 1000);
       const finalize = async (reason, err) => {
-        if (finalized)
+        if (finalized2)
           return;
-        finalized = true;
+        finalized2 = true;
         if (thinkingStarted) {
           send("content_block_stop", { type: "content_block_stop", index: thinkingIdx });
         }
@@ -37995,9 +38391,9 @@ var init_openai_responses_sse = __esm(() => {
 });
 
 // src/handlers/shared/token-tracker.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join16 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir17 } from "os";
+import { join as join17 } from "path";
 
 class TokenTracker {
   port;
@@ -38131,9 +38527,9 @@ class TokenTracker {
       if (this.quotaRemaining !== undefined) {
         data.quota_remaining = this.quotaRemaining;
       }
-      const claudishDir = join16(homedir16(), ".claudish");
-      mkdirSync8(claudishDir, { recursive: true });
-      writeFileSync9(join16(claudishDir, `tokens-${this.port}.json`), JSON.stringify(data), "utf-8");
+      const claudishDir = join17(homedir17(), ".claudish");
+      mkdirSync9(claudishDir, { recursive: true });
+      writeFileSync10(join17(claudishDir, `tokens-${this.port}.json`), JSON.stringify(data), "utf-8");
     } catch (e) {
       log(`[TokenTracker] Error writing token file: ${e}`);
     }
@@ -38563,7 +38959,7 @@ class ComposedHandler {
             hint,
             providerMessage: providerMsg
           });
-          return c.json(wrapAnthropicError(400, surfaced, "invalid_request_error"), 400);
+          return c.json(wrapAnthropicError(400, surfaced, "invalid_request_error", response.status), 400);
         }
         return c.json(ensureAnthropicErrorFormat(response.status, errorBody), response.status);
       }
@@ -39066,7 +39462,7 @@ var init_model_catalog_resolver = __esm(() => {
 });
 
 // src/handlers/native-handler-advisor.ts
-import { appendFileSync as appendFileSync2 } from "fs";
+import { appendFileSync as appendFileSync3 } from "fs";
 function loadAdvisorSwapConfig(cliModels, cliCollector) {
   return {
     enabled: process.env.CLAUDISH_SWAP_ADVISOR === "1" || (cliModels?.length ?? 0) > 0,
@@ -39121,7 +39517,7 @@ function logAdvisorEvent(cfg, event) {
   const line = `${JSON.stringify({ ts: new Date().toISOString(), ...event })}
 `;
   try {
-    appendFileSync2(cfg.logPath, line);
+    appendFileSync3(cfg.logPath, line);
   } catch {}
 }
 function recordAdvisorEventsFromChunk(cfg, chunkText) {
@@ -40720,9 +41116,9 @@ var init_ollama_api_format = __esm(() => {
 });
 
 // src/providers/api-key-provenance.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
-import { homedir as homedir17 } from "os";
-import { join as join17, resolve } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
+import { homedir as homedir18 } from "os";
+import { join as join18, resolve } from "path";
 function maskKey(key) {
   if (!key)
     return null;
@@ -40797,7 +41193,7 @@ function readDotenvKey(envVars) {
     const dotenvPath = resolve(".env");
     if (!existsSync15(dotenvPath))
       return null;
-    const parsed = import_dotenv.parse(readFileSync11(dotenvPath, "utf-8"));
+    const parsed = import_dotenv.parse(readFileSync12(dotenvPath, "utf-8"));
     for (const v of envVars) {
       if (parsed[v])
         return parsed[v];
@@ -40809,10 +41205,10 @@ function readDotenvKey(envVars) {
 }
 function readConfigKey(envVar) {
   try {
-    const configPath = join17(homedir17(), ".claudish", "config.json");
+    const configPath = join18(homedir18(), ".claudish", "config.json");
     if (!existsSync15(configPath))
       return null;
-    const cfg = JSON.parse(readFileSync11(configPath, "utf-8"));
+    const cfg = JSON.parse(readFileSync12(configPath, "utf-8"));
     return cfg.apiKeys?.[envVar] || null;
   } catch {
     return null;
@@ -41586,7 +41982,7 @@ var init_provider_profiles = __esm(() => {
   };
   openCodeZenProfile = {
     createHandler(ctx) {
-      const zenApiKey = ctx.apiKey || "public";
+      const zenApiKey = ctx.apiKey;
       const isGoProvider = ctx.provider.name === "opencode-zen-go";
       if (ctx.modelName.toLowerCase().includes("minimax")) {
         const transport2 = new AnthropicProviderTransport(ctx.provider, zenApiKey);
@@ -43148,9 +43544,9 @@ var init_poe = __esm(() => {
 });
 
 // src/services/pricing-cache.ts
-import { existsSync as existsSync16, readFileSync as readFileSync12, statSync as statSync2 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join18 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync13, statSync as statSync2 } from "fs";
+import { homedir as homedir19 } from "os";
+import { join as join19 } from "path";
 function prefixMatch(modelName) {
   for (const [key, pricing] of pricingMap) {
     if (modelName.startsWith(key))
@@ -43193,7 +43589,7 @@ function loadDiskCache() {
     const stat = statSync2(CACHE_FILE);
     const age = Date.now() - stat.mtimeMs;
     const isFresh = age < CACHE_TTL_MS2;
-    const raw2 = readFileSync12(CACHE_FILE, "utf-8");
+    const raw2 = readFileSync13(CACHE_FILE, "utf-8");
     const data = JSON.parse(raw2);
     for (const [key, pricing] of Object.entries(data)) {
       pricingMap.set(key, pricing);
@@ -43209,8 +43605,8 @@ var init_pricing_cache = __esm(() => {
   init_logger();
   init_catalog_query();
   pricingMap = new Map;
-  CACHE_DIR = join18(homedir18(), ".claudish");
-  CACHE_FILE = join18(CACHE_DIR, "pricing-cache.json");
+  CACHE_DIR = join19(homedir19(), ".claudish");
+  CACHE_FILE = join19(CACHE_DIR, "pricing-cache.json");
   CACHE_TTL_MS2 = 24 * 60 * 60 * 1000;
 });
 
@@ -43334,6 +43730,11 @@ async function createProxyServer(port, _openrouterApiKey, model, monitorMode = f
       }
       let apiKey = "";
       if (resolved.provider.apiKeyEnvVar) {
+        if (!credentials.get(resolved.provider.name)) {
+          console.error(`[Proxy] No credential provider registered for "${resolved.provider.name}" \u2014 treating as missing credential (authority registration gap)`);
+          log(`[Proxy] Credential authority has no provider registered under "${resolved.provider.name}"`);
+          return null;
+        }
         const auth = await credentials.getRequestAuth(resolved.provider.name, {
           model: resolved.modelName
         });
@@ -43658,12 +44059,12 @@ import { spawn as spawn2 } from "child_process";
 import {
   createWriteStream as createWriteStream2,
   existsSync as existsSync17,
-  mkdirSync as mkdirSync9,
-  readFileSync as readFileSync13,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync2,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "fs";
-import { join as join19, resolve as resolve2 } from "path";
+import { join as join20, resolve as resolve2 } from "path";
 function validateSessionPath(sessionPath) {
   const resolved = resolve2(sessionPath);
   const cwd = process.cwd();
@@ -43684,18 +44085,18 @@ function setupSession(sessionPath, models, input) {
   if (models.length === 0) {
     throw new Error("At least one model is required");
   }
-  if (existsSync17(join19(sessionPath, "manifest.json"))) {
+  if (existsSync17(join20(sessionPath, "manifest.json"))) {
     throw new Error(`Session already exists at ${sessionPath}. Use a new directory path or delete the existing session first.`);
   }
   const sentinels = models.filter(isSentinelModel);
   if (sentinels.length > 0) {
     throw new Error(`Invalid model(s) for team run: ${sentinels.join(", ")}. These are Claude Code agent selectors, not external model IDs. Use real external models (e.g., "gemini-2.0-flash", "gpt-4o", "or@deepseek/deepseek-r1"). For Claude models, use a Task agent instead of the team tool.`);
   }
-  mkdirSync9(join19(sessionPath, "work"), { recursive: true });
-  mkdirSync9(join19(sessionPath, "errors"), { recursive: true });
+  mkdirSync10(join20(sessionPath, "work"), { recursive: true });
+  mkdirSync10(join20(sessionPath, "errors"), { recursive: true });
   if (input !== undefined) {
-    writeFileSync10(join19(sessionPath, "input.md"), input, "utf-8");
-  } else if (!existsSync17(join19(sessionPath, "input.md"))) {
+    writeFileSync11(join20(sessionPath, "input.md"), input, "utf-8");
+  } else if (!existsSync17(join20(sessionPath, "input.md"))) {
     throw new Error(`No input.md found at ${sessionPath} and no input provided`);
   }
   const ids = models.map((_, i) => String(i + 1).padStart(2, "0"));
@@ -43712,9 +44113,9 @@ function setupSession(sessionPath, models, input) {
       model: models[i],
       assignedAt: now
     };
-    mkdirSync9(join19(sessionPath, "work", anonId), { recursive: true });
+    mkdirSync10(join20(sessionPath, "work", anonId), { recursive: true });
   }
-  writeFileSync10(join19(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+  writeFileSync11(join20(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
   const status = {
     startedAt: now,
     models: Object.fromEntries(Object.keys(manifest.models).map((id) => [
@@ -43728,19 +44129,19 @@ function setupSession(sessionPath, models, input) {
       }
     ]))
   };
-  writeFileSync10(join19(sessionPath, "status.json"), JSON.stringify(status, null, 2), "utf-8");
+  writeFileSync11(join20(sessionPath, "status.json"), JSON.stringify(status, null, 2), "utf-8");
   return manifest;
 }
 async function runModels(sessionPath, opts = {}) {
   const timeoutMs = (opts.timeout ?? 300) * 1000;
-  const manifest = JSON.parse(readFileSync13(join19(sessionPath, "manifest.json"), "utf-8"));
-  const statusPath = join19(sessionPath, "status.json");
-  const inputPath = join19(sessionPath, "input.md");
-  const inputContent = readFileSync13(inputPath, "utf-8");
-  const statusCache = JSON.parse(readFileSync13(statusPath, "utf-8"));
+  const manifest = JSON.parse(readFileSync14(join20(sessionPath, "manifest.json"), "utf-8"));
+  const statusPath = join20(sessionPath, "status.json");
+  const inputPath = join20(sessionPath, "input.md");
+  const inputContent = readFileSync14(inputPath, "utf-8");
+  const statusCache = JSON.parse(readFileSync14(statusPath, "utf-8"));
   function updateModelStatus(id, update) {
     statusCache.models[id] = { ...statusCache.models[id], ...update };
-    writeFileSync10(statusPath, JSON.stringify(statusCache, null, 2), "utf-8");
+    writeFileSync11(statusPath, JSON.stringify(statusCache, null, 2), "utf-8");
   }
   const processes = new Map;
   const sigintHandler = () => {
@@ -43753,8 +44154,8 @@ async function runModels(sessionPath, opts = {}) {
   process.on("SIGINT", sigintHandler);
   const completionPromises = [];
   for (const [anonId, entry] of Object.entries(manifest.models)) {
-    const outputPath = join19(sessionPath, `response-${anonId}.md`);
-    const errorLogPath = join19(sessionPath, "errors", `${anonId}.log`);
+    const outputPath = join20(sessionPath, `response-${anonId}.md`);
+    const errorLogPath = join20(sessionPath, "errors", `${anonId}.log`);
     const args = ["--model", entry.model, "-y", "--stdin", "--quiet", ...opts.claudeFlags ?? []];
     updateModelStatus(anonId, {
       state: "RUNNING",
@@ -43815,7 +44216,7 @@ async function runModels(sessionPath, opts = {}) {
           return;
         }
         if (stderr) {
-          writeFileSync10(errorLogPath, stderr, "utf-8");
+          writeFileSync11(errorLogPath, stderr, "utf-8");
         }
         exitCode = code;
         if (outputStream.destroyed) {
@@ -43860,23 +44261,23 @@ async function judgeResponses(sessionPath, opts = {}) {
   const responses = {};
   for (const file2 of responseFiles) {
     const id = file2.replace(/^response-/, "").replace(/\.md$/, "");
-    responses[id] = readFileSync13(join19(sessionPath, file2), "utf-8");
+    responses[id] = readFileSync14(join20(sessionPath, file2), "utf-8");
   }
-  const input = readFileSync13(join19(sessionPath, "input.md"), "utf-8");
+  const input = readFileSync14(join20(sessionPath, "input.md"), "utf-8");
   const judgePrompt = buildJudgePrompt(input, responses);
-  writeFileSync10(join19(sessionPath, "judge-prompt.md"), judgePrompt, "utf-8");
+  writeFileSync11(join20(sessionPath, "judge-prompt.md"), judgePrompt, "utf-8");
   const judgeModels = opts.judges ?? getDefaultJudgeModels(sessionPath);
-  const judgePath = join19(sessionPath, "judging");
-  mkdirSync9(judgePath, { recursive: true });
+  const judgePath = join20(sessionPath, "judging");
+  mkdirSync10(judgePath, { recursive: true });
   setupSession(judgePath, judgeModels, judgePrompt);
   await runModels(judgePath, { claudeFlags: opts.claudeFlags });
   const votes = parseJudgeVotes(judgePath, Object.keys(responses));
   const verdict = aggregateVerdict(votes, Object.keys(responses));
-  writeFileSync10(join19(sessionPath, "verdict.md"), formatVerdict(verdict, sessionPath), "utf-8");
+  writeFileSync11(join20(sessionPath, "verdict.md"), formatVerdict(verdict, sessionPath), "utf-8");
   return verdict;
 }
 function getStatus(sessionPath) {
-  return JSON.parse(readFileSync13(join19(sessionPath, "status.json"), "utf-8"));
+  return JSON.parse(readFileSync14(join20(sessionPath, "status.json"), "utf-8"));
 }
 function fisherYatesShuffle(arr) {
   for (let i = arr.length - 1;i > 0; i--) {
@@ -43886,7 +44287,7 @@ function fisherYatesShuffle(arr) {
   return arr;
 }
 function getDefaultJudgeModels(sessionPath) {
-  const manifest = JSON.parse(readFileSync13(join19(sessionPath, "manifest.json"), "utf-8"));
+  const manifest = JSON.parse(readFileSync14(join20(sessionPath, "manifest.json"), "utf-8"));
   return Object.values(manifest.models).map((e) => e.model);
 }
 function buildJudgePrompt(input, responses) {
@@ -43949,7 +44350,7 @@ function parseJudgeVotes(judgePath, responseIds) {
     const judgeId = file2.replace(/^response-/, "").replace(/\.md$/, "");
     let content;
     try {
-      content = readFileSync13(join19(judgePath, file2), "utf-8");
+      content = readFileSync14(join20(judgePath, file2), "utf-8");
     } catch {
       continue;
     }
@@ -44001,7 +44402,7 @@ function aggregateVerdict(votes, responseIds) {
 function formatVerdict(verdict, sessionPath) {
   let manifest = null;
   try {
-    manifest = JSON.parse(readFileSync13(join19(sessionPath, "manifest.json"), "utf-8"));
+    manifest = JSON.parse(readFileSync14(join20(sessionPath, "manifest.json"), "utf-8"));
   } catch {}
   let output = `# Team Verdict
 
@@ -44050,14 +44451,14 @@ __export(exports_mcp_server, {
   runPromptViaProxy: () => runPromptViaProxy,
   parseAnthropicSse: () => parseAnthropicSse
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync14, readdirSync as readdirSync3, writeFileSync as writeFileSync11 } from "fs";
-import { homedir as homedir19 } from "os";
-import { dirname as dirname4, join as join20 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync11, readFileSync as readFileSync15, readdirSync as readdirSync3, writeFileSync as writeFileSync12 } from "fs";
+import { homedir as homedir20 } from "os";
+import { dirname as dirname5, join as join21 } from "path";
 import { fileURLToPath } from "url";
 async function loadAllModels(forceRefresh = false) {
   if (!forceRefresh && existsSync18(ALL_MODELS_CACHE_PATH2)) {
     try {
-      const cacheData = JSON.parse(readFileSync14(ALL_MODELS_CACHE_PATH2, "utf-8"));
+      const cacheData = JSON.parse(readFileSync15(ALL_MODELS_CACHE_PATH2, "utf-8"));
       const lastUpdated = new Date(cacheData.lastUpdated);
       const ageInDays = (Date.now() - lastUpdated.getTime()) / (1000 * 60 * 60 * 24);
       if (ageInDays <= CACHE_MAX_AGE_DAYS) {
@@ -44071,12 +44472,12 @@ async function loadAllModels(forceRefresh = false) {
       throw new Error(`API returned ${response.status}`);
     const data = await response.json();
     const models = data.data || [];
-    mkdirSync10(CLAUDISH_CACHE_DIR, { recursive: true });
-    writeFileSync11(ALL_MODELS_CACHE_PATH2, JSON.stringify({ lastUpdated: new Date().toISOString(), models }), "utf-8");
+    mkdirSync11(CLAUDISH_CACHE_DIR, { recursive: true });
+    writeFileSync12(ALL_MODELS_CACHE_PATH2, JSON.stringify({ lastUpdated: new Date().toISOString(), models }), "utf-8");
     return models;
   } catch {
     if (existsSync18(ALL_MODELS_CACHE_PATH2)) {
-      const cacheData = JSON.parse(readFileSync14(ALL_MODELS_CACHE_PATH2, "utf-8"));
+      const cacheData = JSON.parse(readFileSync15(ALL_MODELS_CACHE_PATH2, "utf-8"));
       return cacheData.models || [];
     }
     return [];
@@ -44640,7 +45041,7 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
       let stderrFull = stderr_snippet || "";
       if (error_log_path) {
         try {
-          stderrFull = readFileSync14(error_log_path, "utf-8");
+          stderrFull = readFileSync15(error_log_path, "utf-8");
         } catch {}
       }
       const sessionData = {};
@@ -44648,16 +45049,16 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
         const sp = session_path;
         for (const file2 of ["status.json", "manifest.json", "input.md"]) {
           try {
-            sessionData[file2] = readFileSync14(join20(sp, file2), "utf-8");
+            sessionData[file2] = readFileSync15(join21(sp, file2), "utf-8");
           } catch {}
         }
         try {
-          const errorDir = join20(sp, "errors");
+          const errorDir = join21(sp, "errors");
           if (existsSync18(errorDir)) {
             for (const f of readdirSync3(errorDir)) {
               if (f.endsWith(".log")) {
                 try {
-                  sessionData[`errors/${f}`] = readFileSync14(join20(errorDir, f), "utf-8");
+                  sessionData[`errors/${f}`] = readFileSync15(join21(errorDir, f), "utf-8");
                 } catch {}
               }
             }
@@ -44667,7 +45068,7 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
           for (const f of readdirSync3(sp)) {
             if (f.startsWith("response-") && f.endsWith(".md")) {
               try {
-                const content = readFileSync14(join20(sp, f), "utf-8");
+                const content = readFileSync15(join21(sp, f), "utf-8");
                 sessionData[f] = content.slice(0, 200) + (content.length > 200 ? "... (truncated)" : "");
               } catch {}
             }
@@ -44676,9 +45077,9 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
       }
       let version2 = "unknown";
       try {
-        const pkgPath = join20(__dirname2, "../package.json");
+        const pkgPath = join21(__dirname2, "../package.json");
         if (existsSync18(pkgPath)) {
-          version2 = JSON.parse(readFileSync14(pkgPath, "utf-8")).version;
+          version2 = JSON.parse(readFileSync15(pkgPath, "utf-8")).version;
         }
       } catch {}
       const report = {
@@ -45048,9 +45449,9 @@ var init_mcp_server = __esm(() => {
   import_dotenv2 = __toESM(require_main(), 1);
   import_dotenv2.config();
   __filename2 = fileURLToPath(import.meta.url);
-  __dirname2 = dirname4(__filename2);
-  CLAUDISH_CACHE_DIR = join20(homedir19(), ".claudish");
-  ALL_MODELS_CACHE_PATH2 = join20(CLAUDISH_CACHE_DIR, "all-models.json");
+  __dirname2 = dirname5(__filename2);
+  CLAUDISH_CACHE_DIR = join21(homedir20(), ".claudish");
+  ALL_MODELS_CACHE_PATH2 = join21(CLAUDISH_CACHE_DIR, "all-models.json");
   EVENT_TO_TASK_STATUS = new Map([
     ["starting", "working"],
     ["running", "working"],
@@ -45067,7 +45468,7 @@ var exports_serve_command = {};
 __export(exports_serve_command, {
   serveCommand: () => serveCommand
 });
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
 function parseServeArgs(args) {
   const out = {};
   for (let i = 0;i < args.length; i++) {
@@ -45091,7 +45492,7 @@ function loadModelMap(path) {
   }
   let raw2;
   try {
-    raw2 = readFileSync15(path, "utf-8");
+    raw2 = readFileSync16(path, "utf-8");
   } catch (e) {
     throw new Error(`failed to read --models file ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -56545,7 +56946,7 @@ var init_RemoveFileError = __esm(() => {
 
 // ../../node_modules/.bun/@inquirer+external-editor@2.0.1+04f2146be16c61ef/node_modules/@inquirer/external-editor/dist/index.js
 import { spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync16, unlinkSync as unlinkSync6, writeFileSync as writeFileSync12 } from "fs";
+import { readFileSync as readFileSync17, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "fs";
 import path from "path";
 import os from "os";
 import { randomUUID as randomUUID4 } from "crypto";
@@ -56654,14 +57055,14 @@ class ExternalEditor {
       if (Object.prototype.hasOwnProperty.call(this.fileOptions, "mode")) {
         opt.mode = this.fileOptions.mode;
       }
-      writeFileSync12(this.tempFile, this.text, opt);
+      writeFileSync13(this.tempFile, this.text, opt);
     } catch (createFileError) {
       throw new CreateFileError(createFileError);
     }
   }
   readTemporaryFile() {
     try {
-      const tempFileBuffer = readFileSync16(this.tempFile);
+      const tempFileBuffer = readFileSync17(this.tempFile);
       if (tempFileBuffer.length === 0) {
         this.text = "";
       } else {
@@ -57856,15 +58257,15 @@ async function geminiQuotaHandler() {
   }
 }
 async function codexQuotaHandler() {
-  const { readFileSync: readFileSync17, existsSync: existsSync20 } = await import("fs");
-  const { join: join21 } = await import("path");
-  const { homedir: homedir20 } = await import("os");
-  const credPath = join21(homedir20(), ".claudish", "codex-oauth.json");
+  const { readFileSync: readFileSync18, existsSync: existsSync20 } = await import("fs");
+  const { join: join22 } = await import("path");
+  const { homedir: homedir21 } = await import("os");
+  const credPath = join22(homedir21(), ".claudish", "codex-oauth.json");
   if (!existsSync20(credPath)) {
     console.error(`${RED}No Codex credentials found.${R} Run: ${B}claudish login codex${R}`);
     process.exit(1);
   }
-  const creds = JSON.parse(readFileSync17(credPath, "utf-8"));
+  const creds = JSON.parse(readFileSync18(credPath, "utf-8"));
   let email3 = "";
   try {
     const parts = creds.access_token.split(".");
@@ -57916,9 +58317,9 @@ async function codexQuotaHandler() {
   }
   let modelSlugs = [];
   try {
-    const modelsPath = join21(homedir20(), ".codex", "models_cache.json");
+    const modelsPath = join22(homedir21(), ".codex", "models_cache.json");
     if (existsSync20(modelsPath)) {
-      const cache = JSON.parse(readFileSync17(modelsPath, "utf-8"));
+      const cache = JSON.parse(readFileSync18(modelsPath, "utf-8"));
       modelSlugs = (cache.models || []).map((m) => m.slug || m.id).filter(Boolean);
     }
   } catch {}
@@ -59174,6 +59575,7 @@ async function probeLink(proxyUrl, link, timeoutMs) {
         system: "You are a helpful assistant.",
         messages: [{ role: "user", content: PROBE_PROMPT }],
         max_tokens: PROBE_MAX_TOKENS,
+        output_config: { effort: "minimal" },
         stream: true
       }),
       signal: AbortSignal.timeout(timeoutMs)
@@ -59234,14 +59636,27 @@ async function safeReadBody(response) {
     return "";
   }
 }
+function extractUpstreamStatus(body) {
+  if (!body)
+    return;
+  try {
+    const parsed = JSON.parse(body);
+    const status = parsed?.error?.upstream_status;
+    return typeof status === "number" ? status : undefined;
+  } catch {
+    return;
+  }
+}
 function classifyHttpError(status, body, latencyMs) {
   const lowered = body.toLowerCase();
-  if (status === 401 || status === 403) {
+  const upstream = status === 400 ? extractUpstreamStatus(body) : undefined;
+  if (status === 401 || status === 403 || upstream === 401 || upstream === 403) {
+    const authStatus = upstream ?? status;
     return {
       state: "auth-failed",
       latencyMs,
-      httpStatus: status,
-      errorMessage: extractErrorMessage(body) || `HTTP ${status}`
+      httpStatus: authStatus,
+      errorMessage: extractErrorMessage(body) || `HTTP ${authStatus}`
     };
   }
   if (status === 404 || /model[_ ]not[_ ]found|no such model|unknown model/.test(lowered)) {
@@ -59260,12 +59675,12 @@ function classifyHttpError(status, body, latencyMs) {
       errorMessage: extractErrorMessage(body) || "Rate limited"
     };
   }
-  if (status === 402) {
+  if (upstream === 429 || status === 402) {
     return {
-      state: "error",
+      state: "out-of-credit",
       latencyMs,
-      httpStatus: status,
-      errorMessage: extractErrorMessage(body) || "Payment required \u2014 subscription expired or no credit"
+      httpStatus: upstream ?? status,
+      errorMessage: extractErrorMessage(body) || "Out of credit \u2014 account balance or plan exhausted"
     };
   }
   if (status >= 500) {
@@ -59311,6 +59726,7 @@ async function consumeProbeStream(response, timeoutMs, startedAt) {
   let sawContent = false;
   let textChars = 0;
   let reportedTokens;
+  let stopReason;
   let errorVerdict = null;
   let completed = false;
   try {
@@ -59341,6 +59757,8 @@ async function consumeProbeStream(response, timeoutMs, startedAt) {
           textChars += acct.textChars;
         if (acct.outputTokens !== undefined)
           reportedTokens = acct.outputTokens;
+        if (acct.stopReason)
+          stopReason = acct.stopReason;
       }
       if (errorVerdict)
         break;
@@ -59360,6 +59778,14 @@ async function consumeProbeStream(response, timeoutMs, startedAt) {
     const tokens = reportedTokens ?? Math.max(1, Math.round(textChars / 4));
     return { state: "live", ttftMs, tokens, truncated: !completed };
   }
+  const truncationReason = stopReason === "max_tokens" || stopReason === "length" ? stopReason : undefined;
+  if (truncationReason || reportedTokens !== undefined && reportedTokens >= PROBE_MAX_TOKENS) {
+    const cause = truncationReason ? `finish: ${truncationReason}` : `${reportedTokens} tokens consumed, none visible`;
+    return {
+      state: "error",
+      errorMessage: `no visible output within probe budget (${cause})`
+    };
+  }
   return { state: "error", errorMessage: "stream ended without content" };
 }
 function accountStreamEvent(rawEvent) {
@@ -59388,10 +59814,12 @@ function accountStreamEvent(rawEvent) {
     contentDelta = true;
   }
   const outputTokens = parsed?.usage?.output_tokens ?? parsed?.message?.usage?.output_tokens ?? parsed?.usage?.completion_tokens;
+  const stopReason = parsed?.delta?.stop_reason ?? (Array.isArray(parsed?.choices) ? parsed.choices[0]?.finish_reason : undefined);
   return {
     contentDelta,
     textChars,
-    outputTokens: typeof outputTokens === "number" ? outputTokens : undefined
+    outputTokens: typeof outputTokens === "number" ? outputTokens : undefined,
+    stopReason: typeof stopReason === "string" ? stopReason : undefined
   };
 }
 function interpretSseEvent(rawEvent) {
@@ -59466,23 +59894,27 @@ function describeProbeState(result) {
       return `model not found \xB7 ${result.httpStatus ?? ""}${result.latencyMs ? ` \xB7 ${result.latencyMs}ms` : ""}`.trim();
     case "rate-limited":
       return `rate limited \xB7 ${result.latencyMs}ms`;
+    case "out-of-credit":
+      return `out of credit \xB7 ${result.httpStatus ?? ""}${result.latencyMs ? ` \xB7 ${result.latencyMs}ms` : ""}`.trim();
     case "server-error":
       return `server error \xB7 ${result.httpStatus ?? ""} \xB7 ${result.latencyMs}ms`;
     case "timeout":
       return `timeout \xB7 ${result.latencyMs}ms`;
     case "network-error":
       return `network error \xB7 ${result.latencyMs}ms`;
-    case "error":
-      return `error${result.httpStatus ? ` \xB7 ${result.httpStatus}` : ""}${result.latencyMs ? ` \xB7 ${result.latencyMs}ms` : ""}`;
+    case "error": {
+      const base = `error${result.httpStatus ? ` \xB7 ${result.httpStatus}` : ""}${result.latencyMs ? ` \xB7 ${result.latencyMs}ms` : ""}`;
+      return result.errorMessage ? `${base} \u2014 ${result.errorMessage}` : base;
+    }
   }
 }
 function isReadyState(state) {
   return state === "live";
 }
 function isFailureState(state) {
-  return state === "auth-failed" || state === "model-not-found" || state === "rate-limited" || state === "server-error" || state === "timeout" || state === "network-error" || state === "error";
+  return state === "auth-failed" || state === "model-not-found" || state === "rate-limited" || state === "out-of-credit" || state === "server-error" || state === "timeout" || state === "network-error" || state === "error";
 }
-var STREAM_MS_FLOOR = 50, OAUTH_PROVIDERS2, PROBE_PROMPT = "Count from one to twenty in words, one per line.", PROBE_MAX_TOKENS = 64;
+var STREAM_MS_FLOOR = 50, OAUTH_PROVIDERS2, PROBE_PROMPT = "Count from one to twenty in words, one per line.", PROBE_MAX_TOKENS = 512;
 var init_probe_live = __esm(() => {
   OAUTH_PROVIDERS2 = new Set(["vertex", "gemini-codeassist"]);
 });
@@ -59828,6 +60260,8 @@ function shortStatusLabel(probe, hasCreds, _hint) {
       return `${pc.red}\u2297 not found${pc.reset}`;
     case "rate-limited":
       return `${pc.red}\u2297 rate-limited${pc.reset}`;
+    case "out-of-credit":
+      return `${pc.red}\u2297 no credit${pc.reset}`;
     case "server-error":
       return `${pc.red}\u2297 server ${probe.httpStatus ?? ""}${pc.reset}`;
     case "timeout":
@@ -59836,8 +60270,9 @@ function shortStatusLabel(probe, hasCreds, _hint) {
       return `${pc.red}\u2297 network${pc.reset}`;
     case "error":
       return `${pc.red}\u2297 error${probe.httpStatus ? ` ${probe.httpStatus}` : ""}${pc.reset}`;
+    default:
+      return `${pc.red}\u2297 unknown${pc.reset}`;
   }
-  return `${pc.red}\u2297 unknown${pc.reset}`;
 }
 function renderBorderTop(title, summary, width) {
   const titleSeg = ` ${title} `;
@@ -61758,20 +62193,20 @@ __export(exports_cli, {
 import {
   copyFileSync as copyFileSync2,
   existsSync as existsSync20,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync17,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync18,
   readdirSync as readdirSync4,
   unlinkSync as unlinkSync7,
-  writeFileSync as writeFileSync13
+  writeFileSync as writeFileSync14
 } from "fs";
-import { homedir as homedir20 } from "os";
-import { dirname as dirname5, join as join21 } from "path";
+import { homedir as homedir21 } from "os";
+import { dirname as dirname6, join as join22 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getVersion3() {
   return VERSION;
 }
 function clearAllModelCaches() {
-  const cacheDir = join21(homedir20(), ".claudish");
+  const cacheDir = join22(homedir21(), ".claudish");
   if (!existsSync20(cacheDir))
     return;
   const cachePatterns = ["pricing-cache.json", "recommended-models-cache.json"];
@@ -61780,7 +62215,7 @@ function clearAllModelCaches() {
     const files = readdirSync4(cacheDir);
     for (const file2 of files) {
       if (cachePatterns.includes(file2)) {
-        unlinkSync7(join21(cacheDir, file2));
+        unlinkSync7(join22(cacheDir, file2));
         cleared++;
       }
     }
@@ -62167,15 +62602,15 @@ Usage:  claudish --models --provider <slug>`);
     });
     config3.resolvedDefaultProvider = resolved;
     if (resolved.legacyAutoPromoted && !config3.quiet) {
-      const markerFile = join21(homedir20(), ".claudish", ".legacy-litellm-hint-shown");
+      const markerFile = join22(homedir21(), ".claudish", ".legacy-litellm-hint-shown");
       if (!existsSync20(markerFile)) {
         const hint = buildLegacyHint(resolved);
         if (hint) {
           console.error(hint);
         }
         try {
-          mkdirSync11(dirname5(markerFile), { recursive: true });
-          writeFileSync13(markerFile, new Date().toISOString(), "utf-8");
+          mkdirSync12(dirname6(markerFile), { recursive: true });
+          writeFileSync14(markerFile, new Date().toISOString(), "utf-8");
         } catch {}
       }
     }
@@ -63223,8 +63658,8 @@ ${h("MORE INFO")}
 }
 function printAIAgentGuide() {
   try {
-    const guidePath = join21(__dirname3, "../AI_AGENT_GUIDE.md");
-    const guideContent = readFileSync17(guidePath, "utf-8");
+    const guidePath = join22(__dirname3, "../AI_AGENT_GUIDE.md");
+    const guideContent = readFileSync18(guidePath, "utf-8");
     console.log(guideContent);
   } catch (error46) {
     console.error("Error reading AI Agent Guide:");
@@ -63240,10 +63675,10 @@ async function initializeClaudishSkill() {
   console.log(`\uD83D\uDD27 Initializing Claudish skill in current project...
 `);
   const cwd = process.cwd();
-  const claudeDir = join21(cwd, ".claude");
-  const skillsDir = join21(claudeDir, "skills");
-  const claudishSkillDir = join21(skillsDir, "claudish-usage");
-  const skillFile = join21(claudishSkillDir, "SKILL.md");
+  const claudeDir = join22(cwd, ".claude");
+  const skillsDir = join22(claudeDir, "skills");
+  const claudishSkillDir = join22(skillsDir, "claudish-usage");
+  const skillFile = join22(claudishSkillDir, "SKILL.md");
   if (existsSync20(skillFile)) {
     console.log("\u2705 Claudish skill already installed at:");
     console.log(`   ${skillFile}
@@ -63251,7 +63686,7 @@ async function initializeClaudishSkill() {
     console.log("\uD83D\uDCA1 To reinstall, delete the file and run 'claudish --init' again.");
     return;
   }
-  const sourceSkillPath = join21(__dirname3, "../skills/claudish-usage/SKILL.md");
+  const sourceSkillPath = join22(__dirname3, "../skills/claudish-usage/SKILL.md");
   if (!existsSync20(sourceSkillPath)) {
     console.error("\u274C Error: Claudish skill file not found in installation.");
     console.error(`   Expected at: ${sourceSkillPath}`);
@@ -63262,15 +63697,15 @@ async function initializeClaudishSkill() {
   }
   try {
     if (!existsSync20(claudeDir)) {
-      mkdirSync11(claudeDir, { recursive: true });
+      mkdirSync12(claudeDir, { recursive: true });
       console.log("\uD83D\uDCC1 Created .claude/ directory");
     }
     if (!existsSync20(skillsDir)) {
-      mkdirSync11(skillsDir, { recursive: true });
+      mkdirSync12(skillsDir, { recursive: true });
       console.log("\uD83D\uDCC1 Created .claude/skills/ directory");
     }
     if (!existsSync20(claudishSkillDir)) {
-      mkdirSync11(claudishSkillDir, { recursive: true });
+      mkdirSync12(claudishSkillDir, { recursive: true });
       console.log("\uD83D\uDCC1 Created .claude/skills/claudish-usage/ directory");
     }
     copyFileSync2(sourceSkillPath, skillFile);
@@ -63342,7 +63777,7 @@ var init_cli = __esm(() => {
   init_routing_rules();
   init_provider_resolver();
   __filename3 = fileURLToPath2(import.meta.url);
-  __dirname3 = dirname5(__filename3);
+  __dirname3 = dirname6(__filename3);
 });
 
 // src/update-checker.ts
@@ -63353,24 +63788,24 @@ __export(exports_update_checker, {
   clearCache: () => clearCache,
   checkForUpdates: () => checkForUpdates
 });
-import { existsSync as existsSync21, mkdirSync as mkdirSync12, readFileSync as readFileSync18, unlinkSync as unlinkSync8, writeFileSync as writeFileSync14 } from "fs";
-import { homedir as homedir21, platform as platform2, tmpdir } from "os";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync13, readFileSync as readFileSync19, unlinkSync as unlinkSync8, writeFileSync as writeFileSync15 } from "fs";
+import { homedir as homedir22, platform as platform2, tmpdir } from "os";
+import { join as join23 } from "path";
 function getCacheFilePath() {
   let cacheDir;
   if (isWindows) {
-    const localAppData = process.env.LOCALAPPDATA || join22(homedir21(), "AppData", "Local");
-    cacheDir = join22(localAppData, "claudish");
+    const localAppData = process.env.LOCALAPPDATA || join23(homedir22(), "AppData", "Local");
+    cacheDir = join23(localAppData, "claudish");
   } else {
-    cacheDir = join22(homedir21(), ".cache", "claudish");
+    cacheDir = join23(homedir22(), ".cache", "claudish");
   }
   try {
     if (!existsSync21(cacheDir)) {
-      mkdirSync12(cacheDir, { recursive: true });
+      mkdirSync13(cacheDir, { recursive: true });
     }
-    return join22(cacheDir, "update-check.json");
+    return join23(cacheDir, "update-check.json");
   } catch {
-    return join22(tmpdir(), "claudish-update-check.json");
+    return join23(tmpdir(), "claudish-update-check.json");
   }
 }
 function readCache() {
@@ -63379,7 +63814,7 @@ function readCache() {
     if (!existsSync21(cachePath)) {
       return null;
     }
-    const data = JSON.parse(readFileSync18(cachePath, "utf-8"));
+    const data = JSON.parse(readFileSync19(cachePath, "utf-8"));
     return data;
   } catch {
     return null;
@@ -63392,7 +63827,7 @@ function writeCache(latestVersion) {
       lastCheck: Date.now(),
       latestVersion
     };
-    writeFileSync14(cachePath, JSON.stringify(data), "utf-8");
+    writeFileSync15(cachePath, JSON.stringify(data), "utf-8");
   } catch {}
 }
 function isCacheValid(cache) {
@@ -64228,15 +64663,15 @@ var init_local_liveness = __esm(() => {
 });
 
 // src/providers/probe-catalog.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "fs";
-import { homedir as homedir22 } from "os";
-import { dirname as dirname6, join as join23 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir23 } from "os";
+import { dirname as dirname7, join as join24 } from "path";
 function readProbeModelsCache(path2 = PROBE_MODELS_CACHE_PATH) {
   if (!existsSync22(path2))
     return null;
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync19(path2, "utf-8"));
+    raw2 = JSON.parse(readFileSync20(path2, "utf-8"));
   } catch {
     return null;
   }
@@ -64245,8 +64680,8 @@ function readProbeModelsCache(path2 = PROBE_MODELS_CACHE_PATH) {
   return raw2;
 }
 function writeProbeModelsCache(data, path2 = PROBE_MODELS_CACHE_PATH) {
-  mkdirSync13(dirname6(path2), { recursive: true });
-  writeFileSync15(path2, JSON.stringify(data), "utf-8");
+  mkdirSync14(dirname7(path2), { recursive: true });
+  writeFileSync16(path2, JSON.stringify(data), "utf-8");
 }
 function isCacheFresh(data, ttlMs = CACHE_TTL_MS3) {
   if (!data?.generatedAt)
@@ -64365,7 +64800,7 @@ function isValidResponse(raw2) {
 var PROBE_MODELS_URL = "https://us-central1-claudish-6da10.cloudfunctions.net/probeModels", CACHE_TTL_MS3, FETCH_TIMEOUT_MS2 = 15000, PROBE_MODELS_CACHE_PATH, _inFlight = null;
 var init_probe_catalog = __esm(() => {
   CACHE_TTL_MS3 = 60 * 60 * 1000;
-  PROBE_MODELS_CACHE_PATH = join23(homedir22(), ".claudish", "probe-models.json");
+  PROBE_MODELS_CACHE_PATH = join24(homedir23(), ".claudish", "probe-models.json");
 });
 
 // src/tui/constants.ts
@@ -66778,6 +67213,23 @@ function ProviderDetail({
             fg: C.green,
             children: displayKey
           }, undefined, false, undefined, this),
+          !hasKey && !selectedProvider.isLocal && selectedProvider.apiKeyEnvVar && /* @__PURE__ */ jsxDEV11(Fragment7, {
+            children: [
+              /* @__PURE__ */ jsxDEV11("span", {
+                fg: C.dim,
+                children: "   "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV11("span", {
+                fg: C.blue,
+                attributes: A.bold,
+                children: "Env: "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV11("span", {
+                fg: C.yellow,
+                children: [selectedProvider.apiKeyEnvVar, ...selectedProvider.aliases ?? []].join(" | ")
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this),
           hasKey && selectedProvider.isLocal && /* @__PURE__ */ jsxDEV11(Fragment7, {
             children: [
               /* @__PURE__ */ jsxDEV11("span", {
@@ -69058,7 +69510,7 @@ function App({ requestLogin } = {}) {
         try {
           const auth = await acquireOpAuth();
           const parsed = parseGlobImport(g.value);
-          const fields = await withSdkRetry(() => discoverItemFields(parsed.vault, parsed.item, { auth }));
+          const fields = await withSdkRetry(() => discoverItemFields(parsed.vault, parsed.item, { auth }), "tui:glob-expand");
           const keys = filterGlobFields(fields, parsed).filter((m) => m.valid).map((m) => ({ name: m.envName, tail: m.field.valueTail }));
           setOpExpansions((prev) => ({ ...prev, [g.value]: { status: "ready", keys } }));
         } catch (err) {
@@ -69129,15 +69581,15 @@ function App({ requestLogin } = {}) {
       if (entry.kind === "account") {
         note = "account ok";
       } else if (entry.kind === "environment") {
-        const vars = await withSdkRetry(() => readEnvironment(entry.value, { auth }));
+        const vars = await withSdkRetry(() => readEnvironment(entry.value, { auth }), "tui:test-entry");
         note = `${Object.keys(vars).length} vars`;
       } else if (entry.kind === "glob" || isGlobImport(entry.value)) {
         const g = parseGlobImport(entry.value);
-        const fields = await withSdkRetry(() => discoverItemFields(g.vault, g.item, { auth }));
+        const fields = await withSdkRetry(() => discoverItemFields(g.vault, g.item, { auth }), "tui:test-entry");
         const matches = filterGlobFields(fields, g).filter((m) => m.valid);
         note = `${matches.length} fields`;
       } else {
-        const r = await withSdkRetry(() => resolveSecrets({ T: entry.value }, { auth }));
+        const r = await withSdkRetry(() => resolveSecrets({ T: entry.value }, { auth }), "tui:test-entry");
         note = maskSecret(r.T);
       }
       setOpTestResults((prev) => ({
@@ -69206,22 +69658,23 @@ function App({ requestLogin } = {}) {
           }
         };
         if (kind === "environment") {
-          const vars = await withSdkRetry(() => readEnvironment(value, { auth }));
+          const vars = await withSdkRetry(() => readEnvironment(value, { auth }), "tui:confirm-add");
           apply(vars);
           setStatusMsg(`1Password environment saved (${scope}) \u2192 ${Object.keys(vars).length} vars, ${hydrated} applied.`);
         } else if (isGlob) {
-          const resolved = await withSdkRetry(() => resolveGlobImport(value, { auth }));
+          const resolved = await withSdkRetry(() => resolveGlobImport(value, { auth }), "tui:confirm-add");
           apply(resolved);
           const names = Object.keys(resolved).slice(0, 3).join(", ");
           const n = Object.keys(resolved).length;
           setStatusMsg(n > 0 ? `1Password set saved (${scope}) \u2192 ${n} key${n === 1 ? "" : "s"} applied (${names})` : `1Password set saved (${scope}) \u2014 but it matched no importable fields right now.`);
         } else {
-          const r = await withSdkRetry(() => resolveSecrets({ T: value }, { auth }));
+          const r = await withSdkRetry(() => resolveSecrets({ T: value }, { auth }), "tui:confirm-add");
           const name = envNameFromOpRef(value);
           if (name)
             apply({ [name]: r.T });
           setStatusMsg(`1Password key saved (${scope}) \u2192 ${name ?? "?"} = ${maskSecret(r.T)}${hydrated ? " (applied)" : ""}`);
         }
+        invalidateOpResolutionCache();
         invalidateProbeProxyHandlers();
         refreshConfig();
       } catch (testErr) {
@@ -69248,7 +69701,7 @@ function App({ requestLogin } = {}) {
     setMode("pick_op_vault");
     try {
       const auth = await acquireOpAuth();
-      const vaults = await withSdkRetry(() => listVaults({ auth }));
+      const vaults = await withSdkRetry(() => listVaults({ auth }), "tui:list-vaults");
       setOpVaults(vaults);
       setStatusMsg(`1Password: ${vaults.length} vault${vaults.length === 1 ? "" : "s"}.`);
     } catch (err) {
@@ -69270,7 +69723,7 @@ function App({ requestLogin } = {}) {
     setMode("pick_op_item");
     try {
       const auth = await acquireOpAuth();
-      const items = await withSdkRetry(() => listItems(vaultId, { auth }));
+      const items = await withSdkRetry(() => listItems(vaultId, { auth }), "tui:list-items");
       setOpItems(items);
       setStatusMsg(`1Password: ${items.length} item${items.length === 1 ? "" : "s"}.`);
     } catch (err) {
@@ -69298,7 +69751,7 @@ function App({ requestLogin } = {}) {
     setStatusMsg(`1Password: loading fields for '${itemTitle}'\u2026`);
     try {
       const auth = await acquireOpAuth();
-      const fields = await withSdkRetry(() => discoverItemFieldsById(vaultId, itemId, vaultTitle, itemTitle, { auth }));
+      const fields = await withSdkRetry(() => discoverItemFieldsById(vaultId, itemId, vaultTitle, itemTitle, { auth }), "tui:load-fields");
       opFieldsCache.current.set(cacheKey2, fields);
       setOpFields(fields);
       setStatusMsg(`1Password: ${fields.length} field${fields.length === 1 ? "" : "s"}.`);
@@ -69315,7 +69768,7 @@ function App({ requestLogin } = {}) {
     setStatusMsg("1Password: reading environment\u2026");
     try {
       const auth = await acquireOpAuth();
-      const vars = await withSdkRetry(() => readEnvironment(id, { auth }));
+      const vars = await withSdkRetry(() => readEnvironment(id, { auth }), "tui:preview-environment");
       const names = Object.keys(vars);
       setOpEnvPreview(names);
       setStatusMsg(`1Password environment \u2192 ${names.length} var${names.length === 1 ? "" : "s"}. Enter to save.`);
@@ -70507,6 +70960,7 @@ function App({ requestLogin } = {}) {
   }, undefined, true, undefined, this);
 }
 var init_App = __esm(() => {
+  init_op_source();
   init_profile_config();
   init_default_routing_rules();
   init_local_liveness();
@@ -70619,20 +71073,23 @@ var init_tui = __esm(() => {
 var exports_claude_runner = {};
 __export(exports_claude_runner, {
   runClaudeWithProxy: () => runClaudeWithProxy,
-  checkClaudeInstalled: () => checkClaudeInstalled
+  managedSettingsForcesClaudeAi: () => managedSettingsForcesClaudeAi,
+  isProxyAuthMode: () => isProxyAuthMode,
+  checkClaudeInstalled: () => checkClaudeInstalled,
+  buildClaudishSettingsOverlay: () => buildClaudishSettingsOverlay
 });
 import { spawn as spawn4 } from "child_process";
 import {
   closeSync as closeSync4,
   existsSync as existsSync23,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync15,
   openSync as openSync4,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   unlinkSync as unlinkSync9,
-  writeFileSync as writeFileSync16
+  writeFileSync as writeFileSync17
 } from "fs";
-import { homedir as homedir23, tmpdir as tmpdir2 } from "os";
-import { join as join24 } from "path";
+import { homedir as homedir24, tmpdir as tmpdir2 } from "os";
+import { join as join25 } from "path";
 import { isatty } from "tty";
 function hasNativeAnthropicMapping(config3) {
   const models = [
@@ -70644,14 +71101,35 @@ function hasNativeAnthropicMapping(config3) {
   ];
   return models.some((m) => m && parseModelSpec(m).provider === "native-anthropic");
 }
+function isProxyAuthMode(config3) {
+  return !config3.monitor && !hasNativeAnthropicMapping(config3);
+}
+function managedSettingsPath() {
+  if (isWindows2()) {
+    return join25(process.env.PROGRAMDATA || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
+  }
+  if (process.platform === "darwin") {
+    return "/Library/Application Support/ClaudeCode/managed-settings.json";
+  }
+  return "/etc/claude-code/managed-settings.json";
+}
+function managedSettingsForcesClaudeAi(readFile = readFileSync21) {
+  try {
+    const raw2 = readFile(managedSettingsPath(), "utf-8");
+    const parsed = JSON.parse(raw2);
+    return parsed.forceLoginMethod === "claudeai";
+  } catch {
+    return false;
+  }
+}
 function isWindows2() {
   return process.platform === "win32";
 }
 function createStatusLineScript(tokenFilePath) {
   const homeDir = process.env.HOME || process.env.USERPROFILE || tmpdir2();
-  const claudishDir = join24(homeDir, ".claudish");
+  const claudishDir = join25(homeDir, ".claudish");
   const timestamp = Date.now();
-  const scriptPath = join24(claudishDir, `status-${timestamp}.js`);
+  const scriptPath = join25(claudishDir, `status-${timestamp}.js`);
   const escapedTokenPath = tokenFilePath.replace(/\\/g, "\\\\");
   const script = `
 const fs = require('fs');
@@ -70743,18 +71221,18 @@ process.stdin.on('end', () => {
   }
 });
 `;
-  writeFileSync16(scriptPath, script, "utf-8");
+  writeFileSync17(scriptPath, script, "utf-8");
   return scriptPath;
 }
-function createTempSettingsFile(_modelDisplay, port) {
+function createTempSettingsFile(_modelDisplay, port, proxyAuthMode) {
   const homeDir = process.env.HOME || process.env.USERPROFILE || tmpdir2();
-  const claudishDir = join24(homeDir, ".claudish");
+  const claudishDir = join25(homeDir, ".claudish");
   try {
-    mkdirSync14(claudishDir, { recursive: true });
+    mkdirSync15(claudishDir, { recursive: true });
   } catch {}
   const timestamp = Date.now();
-  const tempPath = join24(claudishDir, `settings-${timestamp}.json`);
-  const tokenFilePath = join24(claudishDir, `tokens-${port}.json`);
+  const tempPath = join25(claudishDir, `settings-${timestamp}.json`);
+  const tokenFilePath = join25(claudishDir, `tokens-${port}.json`);
   let statusCommand;
   if (isWindows2()) {
     const scriptPath = createStatusLineScript(tokenFilePath);
@@ -70775,11 +71253,18 @@ function createTempSettingsFile(_modelDisplay, port) {
     command: statusCommand,
     padding: 0
   };
-  const settings = { statusLine, disableClaudeAiConnectors: true };
-  writeFileSync16(tempPath, JSON.stringify(settings, null, 2), "utf-8");
+  const settings = buildClaudishSettingsOverlay(statusLine, proxyAuthMode);
+  writeFileSync17(tempPath, JSON.stringify(settings, null, 2), "utf-8");
   return { path: tempPath, statusLine };
 }
-function mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine) {
+function buildClaudishSettingsOverlay(statusLine, proxyAuthMode) {
+  const settings = { statusLine, disableClaudeAiConnectors: true };
+  if (proxyAuthMode) {
+    settings.forceLoginMethod = "console";
+  }
+  return settings;
+}
+function mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine, proxyAuthMode) {
   const idx = config3.claudeArgs.indexOf("--settings");
   if (idx === -1 || !config3.claudeArgs[idx + 1]) {
     return;
@@ -70790,14 +71275,17 @@ function mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine) {
     if (userSettingsValue.trimStart().startsWith("{")) {
       userSettings = JSON.parse(userSettingsValue);
     } else {
-      const rawUserSettings = readFileSync20(userSettingsValue, "utf-8");
+      const rawUserSettings = readFileSync21(userSettingsValue, "utf-8");
       userSettings = JSON.parse(rawUserSettings);
     }
     userSettings.statusLine = statusLine;
     if (!("disableClaudeAiConnectors" in userSettings)) {
       userSettings.disableClaudeAiConnectors = true;
     }
-    writeFileSync16(tempSettingsPath, JSON.stringify(userSettings, null, 2), "utf-8");
+    if (proxyAuthMode && !("forceLoginMethod" in userSettings)) {
+      userSettings.forceLoginMethod = "console";
+    }
+    writeFileSync17(tempSettingsPath, JSON.stringify(userSettings, null, 2), "utf-8");
   } catch {
     if (!config3.quiet) {
       console.warn(`[claudish] Warning: could not merge user settings: ${userSettingsValue}`);
@@ -70810,8 +71298,16 @@ async function runClaudeWithProxy(config3, proxyUrl, onCleanup) {
   const modelId = config3.model || (hasProfileMappings || config3.monitor ? undefined : "unknown");
   const portMatch = proxyUrl.match(/:(\d+)/);
   const port = portMatch ? portMatch[1] : "unknown";
-  const { path: tempSettingsPath, statusLine } = createTempSettingsFile(modelId ?? "default", port);
-  mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine);
+  const proxyAuthMode = isProxyAuthMode(config3);
+  if (proxyAuthMode && managedSettingsForcesClaudeAi()) {
+    console.error("[claudish] Error: your organization's managed Claude Code settings force the " + `claude.ai login method (forceLoginMethod: "claudeai").
+` + "  claudish routes Claude Code through its local proxy using API-key auth, which " + `that policy blocks at startup, and managed settings cannot be overridden.
+` + "  Ask your Claude Code administrator to relax this policy, or run a native " + "Anthropic model (which uses your real claude.ai subscription).");
+    onCleanup?.();
+    return 1;
+  }
+  const { path: tempSettingsPath, statusLine } = createTempSettingsFile(modelId ?? "default", port, proxyAuthMode);
+  mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine, proxyAuthMode);
   const claudeArgs = [];
   claudeArgs.push("--settings", tempSettingsPath);
   if (config3.interactive) {
@@ -70885,8 +71381,8 @@ async function runClaudeWithProxy(config3, proxyUrl, onCleanup) {
     console.error("Install it from: https://claude.com/claude-code");
     console.error(`
 Or set CLAUDE_PATH to your custom installation:`);
-    const home = homedir23();
-    const localPath = isWindows2() ? join24(home, ".claude", "local", "claude.exe") : join24(home, ".claude", "local", "claude");
+    const home = homedir24();
+    const localPath = isWindows2() ? join25(home, ".claude", "local", "claude.exe") : join25(home, ".claude", "local", "claude");
     console.error(`  export CLAUDE_PATH=${localPath}`);
     process.exit(1);
   }
@@ -70963,16 +71459,16 @@ async function findClaudeBinary() {
       return process.env.CLAUDE_PATH;
     }
   }
-  const home = homedir23();
-  const localPath = isWindows3 ? join24(home, ".claude", "local", "claude.exe") : join24(home, ".claude", "local", "claude");
+  const home = homedir24();
+  const localPath = isWindows3 ? join25(home, ".claude", "local", "claude.exe") : join25(home, ".claude", "local", "claude");
   if (existsSync23(localPath)) {
     return localPath;
   }
   if (isWindows3) {
     const windowsPaths = [
-      join24(home, "AppData", "Roaming", "npm", "claude.cmd"),
-      join24(home, ".npm-global", "claude.cmd"),
-      join24(home, "node_modules", ".bin", "claude.cmd")
+      join25(home, "AppData", "Roaming", "npm", "claude.cmd"),
+      join25(home, ".npm-global", "claude.cmd"),
+      join25(home, "node_modules", ".bin", "claude.cmd")
     ];
     for (const path2 of windowsPaths) {
       if (existsSync23(path2)) {
@@ -70983,11 +71479,11 @@ async function findClaudeBinary() {
     const commonPaths = [
       "/usr/local/bin/claude",
       "/opt/homebrew/bin/claude",
-      join24(home, ".npm-global/bin/claude"),
-      join24(home, ".local/bin/claude"),
-      join24(home, "node_modules/.bin/claude"),
+      join25(home, ".npm-global/bin/claude"),
+      join25(home, ".local/bin/claude"),
+      join25(home, "node_modules/.bin/claude"),
       "/data/data/com.termux/files/usr/bin/claude",
-      join24(home, "../usr/bin/claude")
+      join25(home, "../usr/bin/claude")
     ];
     for (const path2 of commonPaths) {
       if (existsSync23(path2)) {
@@ -71040,18 +71536,18 @@ __export(exports_diag_output, {
   NullDiagOutput: () => NullDiagOutput,
   LogFileDiagOutput: () => LogFileDiagOutput
 });
-import { createWriteStream as createWriteStream3, mkdirSync as mkdirSync15, unlinkSync as unlinkSync10, writeFileSync as writeFileSync17 } from "fs";
-import { homedir as homedir24 } from "os";
-import { join as join25 } from "path";
+import { createWriteStream as createWriteStream3, mkdirSync as mkdirSync16, unlinkSync as unlinkSync10, writeFileSync as writeFileSync18 } from "fs";
+import { homedir as homedir25 } from "os";
+import { join as join26 } from "path";
 function getClaudishDir() {
-  const dir = join25(homedir24(), ".claudish");
+  const dir = join26(homedir25(), ".claudish");
   try {
-    mkdirSync15(dir, { recursive: true });
+    mkdirSync16(dir, { recursive: true });
   } catch {}
   return dir;
 }
 function getDiagLogPath() {
-  return join25(getClaudishDir(), `diag-${process.pid}.log`);
+  return join26(getClaudishDir(), `diag-${process.pid}.log`);
 }
 
 class LogFileDiagOutput {
@@ -71060,7 +71556,7 @@ class LogFileDiagOutput {
   constructor() {
     this.logPath = getDiagLogPath();
     try {
-      writeFileSync17(this.logPath, `--- claudish diag session ${new Date().toISOString()} ---
+      writeFileSync18(this.logPath, `--- claudish diag session ${new Date().toISOString()} ---
 `);
     } catch {}
     this.stream = createWriteStream3(this.logPath, { flags: "a" });
@@ -71262,9 +71758,9 @@ __export(exports_team_grid, {
 });
 import { spawn as spawn5 } from "child_process";
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync24, readFileSync as readFileSync21, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync19 } from "fs";
 import { connect as netConnect } from "net";
-import { dirname as dirname7, join as join26 } from "path";
+import { dirname as dirname8, join as join27 } from "path";
 import { setTimeout as wait } from "timers/promises";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function resolveRouteInfo(modelId) {
@@ -71357,21 +71853,21 @@ function buildPaneHeader(model, prompt, bg) {
 }
 function findMagmuxBinary() {
   const thisFile = fileURLToPath3(import.meta.url);
-  const thisDir = dirname7(thisFile);
-  const pkgRoot = join26(thisDir, "..");
+  const thisDir = dirname8(thisFile);
+  const pkgRoot = join27(thisDir, "..");
   const platform3 = process.platform;
   const arch = process.arch;
-  const bundledMagmux = join26(pkgRoot, "native", `magmux-${platform3}-${arch}`);
+  const bundledMagmux = join27(pkgRoot, "native", `magmux-${platform3}-${arch}`);
   if (existsSync24(bundledMagmux))
     return bundledMagmux;
   try {
     const pkgName = `@claudish/magmux-${platform3}-${arch}`;
     let searchDir = pkgRoot;
     for (let i = 0;i < 5; i++) {
-      const candidate = join26(searchDir, "node_modules", pkgName, "bin", "magmux");
+      const candidate = join27(searchDir, "node_modules", pkgName, "bin", "magmux");
       if (existsSync24(candidate))
         return candidate;
-      const parent = dirname7(searchDir);
+      const parent = dirname8(searchDir);
       if (parent === searchDir)
         break;
       searchDir = parent;
@@ -71475,9 +71971,9 @@ async function runWithGrid(sessionPath, models, input, opts) {
   const keep = opts?.keep ?? false;
   const manifest = setupSession(sessionPath, models, input);
   const startedAt = new Date().toISOString();
-  const gridfilePath = join26(sessionPath, "gridfile.txt");
-  const prompt = readFileSync21(join26(sessionPath, "input.md"), "utf-8").replace(/'/g, "'\\''").replace(/\n/g, " ");
-  const rawPrompt = readFileSync21(join26(sessionPath, "input.md"), "utf-8");
+  const gridfilePath = join27(sessionPath, "gridfile.txt");
+  const prompt = readFileSync22(join27(sessionPath, "input.md"), "utf-8").replace(/'/g, "'\\''").replace(/\n/g, " ");
+  const rawPrompt = readFileSync22(join27(sessionPath, "input.md"), "utf-8");
   const usedBannerColors = new Set;
   const gridLines = Object.entries(manifest.models).map(([anonId]) => {
     const model = manifest.models[anonId].model;
@@ -71488,7 +71984,7 @@ async function runWithGrid(sessionPath, models, input, opts) {
     const header = buildPaneHeader(model, rawPrompt, bg);
     return `${header} claudish --model ${model} -y --quiet '${prompt}'`;
   });
-  writeFileSync18(gridfilePath, `${gridLines.join(`
+  writeFileSync19(gridfilePath, `${gridLines.join(`
 `)}
 `, "utf-8");
   const magmuxPath = findMagmuxBinary();
@@ -71508,8 +72004,8 @@ async function runWithGrid(sessionPath, models, input, opts) {
   });
   const [{ results }] = await Promise.all([subscription, procExit]);
   const status = buildTeamStatus(manifest, startedAt, results?.panes ?? null);
-  const statusPath = join26(sessionPath, "status.json");
-  writeFileSync18(statusPath, JSON.stringify(status, null, 2), "utf-8");
+  const statusPath = join27(sessionPath, "status.json");
+  writeFileSync19(statusPath, JSON.stringify(status, null, 2), "utf-8");
   return status;
 }
 var BANNER_BG_COLORS;
@@ -71531,10 +72027,40 @@ var init_team_grid = __esm(() => {
 // src/index.ts
 init_op_source();
 init_onepassword_config();
+init_startup_trace();
 var import_dotenv3 = __toESM(require_main(), 1);
-import { readFileSync as readFileSync22 } from "fs";
-import { join as join27 } from "path";
+import { readFileSync as readFileSync23 } from "fs";
+import { join as join28 } from "path";
 import_dotenv3.config({ quiet: true });
+function classifyStartupKind() {
+  const argv = process.argv.slice(2);
+  const first = argv.find((a) => !a.startsWith("-"));
+  if (first === "config")
+    return "config";
+  const management = new Set([
+    "update",
+    "init",
+    "profile",
+    "telemetry",
+    "stats",
+    "providers",
+    "login",
+    "logout",
+    "quota",
+    "usage"
+  ]);
+  if (first && management.has(first) || argv.includes("--mcp") || first === "serve") {
+    return "other";
+  }
+  return "run";
+}
+process.on("exit", () => {
+  const argv = process.argv.slice(2);
+  const longRunningServer = argv.includes("--mcp") || argv.find((a) => !a.startsWith("-")) === "serve";
+  if (longRunningServer)
+    return;
+  finalizeStartupTrace(classifyStartupKind(), { quiet: true });
+});
 async function applyOpEnvironment() {
   const argv = process.argv.slice(2);
   let flagEnvId;
@@ -71626,8 +72152,8 @@ async function applyOpImport() {
   }
   process.argv = [...head, ...rebuilt];
 }
-await applyOpEnvironment();
-await applyOpImport();
+await traceSpan("startup:op-env-flags", () => applyOpEnvironment());
+await traceSpan("startup:op-import-flag", () => applyOpImport());
 var isMcpMode = process.argv.includes("--mcp");
 function handlePromptExit(err) {
   if (err && typeof err === "object" && "name" in err && err.name === "ExitPromptError") {
@@ -71705,16 +72231,19 @@ if (isMcpMode) {
     return stats.handleStatsCommand(subcommand);
   });
 } else if (isConfigCommand) {
-  Promise.resolve().then(() => (init_tui(), exports_tui)).then(async (m) => {
+  traceSpan("startup:tui-import", () => Promise.resolve().then(() => (init_tui(), exports_tui))).then(async (m) => {
     const { credentials: credentials2 } = await Promise.resolve().then(() => (init_authority(), exports_authority));
     const { PROVIDERS: PROVIDERS2 } = await Promise.resolve().then(() => (init_providers(), exports_providers));
-    await Promise.all(PROVIDERS2.map((p) => credentials2.isAvailable(p.catalogName, { allowOpPrompt: true })));
+    await traceSpan("startup:credential-resolution", () => Promise.all(PROVIDERS2.map((p) => credentials2.isAvailable(p.catalogName, { allowOpPrompt: true }))), { providers: PROVIDERS2.length });
+    finalizeStartupTrace("config");
+    suppressStartupTraceTerminalOutput();
     return m.startConfigTui().catch(handlePromptExit);
   });
 } else {
   runCli();
 }
 async function runCli() {
+  const endImports = beginSpan("startup:cli-imports");
   const { checkClaudeInstalled: checkClaudeInstalled2, runClaudeWithProxy: runClaudeWithProxy2 } = await Promise.resolve().then(() => (init_claude_runner(), exports_claude_runner));
   const { parseArgs: parseArgs2, getVersion: getVersion4 } = await Promise.resolve().then(() => (init_cli(), exports_cli));
   const { DEFAULT_PORT_RANGE: DEFAULT_PORT_RANGE2 } = await Promise.resolve().then(() => (init_config(), exports_config));
@@ -71731,6 +72260,7 @@ async function runCli() {
   const { createProxyServer: createProxyServer2 } = await Promise.resolve().then(() => (init_proxy_server(), exports_proxy_server));
   const { checkForUpdates: checkForUpdates2 } = await Promise.resolve().then(() => (init_update_checker(), exports_update_checker));
   const { warmCatalogIfNeeded: warmCatalogIfNeeded2 } = await Promise.resolve().then(() => (init_catalog_warm(), exports_catalog_warm));
+  endImports();
   async function readStdin() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -71739,18 +72269,18 @@ async function runCli() {
     return Buffer.concat(chunks).toString("utf-8");
   }
   try {
-    const cliConfig = await parseArgs2(process.argv.slice(2));
+    const cliConfig = await traceSpan("startup:parse-args", () => parseArgs2(process.argv.slice(2)));
     if (cliConfig.team && cliConfig.team.length > 0) {
       let prompt = cliConfig.claudeArgs.join(" ");
       if (cliConfig.inputFile) {
-        prompt = readFileSync22(cliConfig.inputFile, "utf-8");
+        prompt = readFileSync23(cliConfig.inputFile, "utf-8");
       }
       if (!prompt.trim()) {
         console.error("Error: --team requires a prompt (positional args or -f <file>)");
         process.exit(1);
       }
       const mode = cliConfig.teamMode ?? "default";
-      const sessionPath = join27(process.cwd(), `.claudish-team-${Date.now()}`);
+      const sessionPath = join28(process.cwd(), `.claudish-team-${Date.now()}`);
       if (mode === "json") {
         const { setupSession: setupSession2, runModels: runModels2 } = await Promise.resolve().then(() => (init_team_orchestrator(), exports_team_orchestrator));
         setupSession2(sessionPath, cliConfig.team, prompt);
@@ -71760,9 +72290,9 @@ async function runCli() {
         });
         const result = { ...status2, responses: {} };
         for (const anonId of Object.keys(status2.models)) {
-          const responsePath = join27(sessionPath, `response-${anonId}.md`);
+          const responsePath = join28(sessionPath, `response-${anonId}.md`);
           try {
-            const raw2 = readFileSync22(responsePath, "utf-8").trim();
+            const raw2 = readFileSync23(responsePath, "utf-8").trim();
             try {
               result.responses[anonId] = JSON.parse(raw2);
             } catch {
@@ -71799,6 +72329,9 @@ Team Status`);
       try {
         const cfg = loadConfig2();
         if (!cfg.autoApproveConfirmedAt) {
+          const endConfirm = beginSpan("startup:first-run-confirm", {
+            mayIncludeUserPrompt: true
+          });
           const { createInterface: createInterface2 } = await import("readline");
           process.stderr.write(`
 [claudish] Auto-approve is enabled by default.
@@ -71826,6 +72359,7 @@ Team Status`);
           }
           cfg.autoApproveConfirmedAt = new Date().toISOString();
           saveConfig2(cfg);
+          endConfirm();
         }
       } catch {}
     }
@@ -71842,9 +72376,9 @@ Team Status`);
       }
     }
     if (cliConfig.interactive && !cliConfig.jsonOutput) {
-      await checkForUpdates2(getVersion4(), { quiet: cliConfig.quiet });
+      await traceSpan("startup:update-check", () => checkForUpdates2(getVersion4(), { quiet: cliConfig.quiet }));
     }
-    if (!await checkClaudeInstalled2()) {
+    if (!await traceSpan("startup:claude-detect", () => checkClaudeInstalled2())) {
       console.error("Error: Claude Code CLI not found");
       console.error("Install it from: https://claude.com/claude-code");
       console.error("");
@@ -71854,7 +72388,7 @@ Team Status`);
     }
     const hasProfileTiers = cliConfig.modelOpus || cliConfig.modelSonnet || cliConfig.modelHaiku || cliConfig.modelSubagent;
     if (cliConfig.interactive && !cliConfig.monitor && !cliConfig.model && !hasProfileTiers) {
-      cliConfig.model = await selectModel2({ freeOnly: cliConfig.freeOnly }).catch(handlePromptExit);
+      cliConfig.model = await traceSpan("startup:model-select", () => selectModel2({ freeOnly: cliConfig.freeOnly }).catch(handlePromptExit), { mayIncludeUserPrompt: true });
       console.log("");
     }
     if (!cliConfig.interactive && !cliConfig.monitor && !cliConfig.model && !hasProfileTiers) {
@@ -71872,7 +72406,7 @@ Team Status`);
         cliConfig.modelHaiku,
         cliConfig.modelSubagent
       ];
-      const resolutions = await validateApiKeysForModels2(modelsToValidate);
+      const resolutions = await traceSpan("startup:validate-api-keys", () => validateApiKeysForModels2(modelsToValidate), { models: modelsToValidate.filter((m) => typeof m === "string").length });
       const missingKeys = getMissingKeyResolutions2(resolutions);
       if (missingKeys.length > 0) {
         if (cliConfig.interactive) {
@@ -71918,16 +72452,16 @@ Team Status`);
       }
     }
     if (cliConfig.stdin) {
-      const stdinInput = await readStdin();
+      const stdinInput = await traceSpan("startup:stdin-read", () => readStdin());
       if (stdinInput.trim()) {
         cliConfig.claudeArgs = [stdinInput, ...cliConfig.claudeArgs];
       }
     }
-    const warmOutcome = await warmCatalogIfNeeded2(cliConfig);
+    const warmOutcome = await traceSpan("startup:catalog-warm", () => warmCatalogIfNeeded2(cliConfig));
     if (warmOutcome === "hard_fail") {
       process.exit(1);
     }
-    const port = cliConfig.port || await findAvailablePort2(DEFAULT_PORT_RANGE2.start, DEFAULT_PORT_RANGE2.end);
+    const port = cliConfig.port || await traceSpan("startup:find-port", () => findAvailablePort2(DEFAULT_PORT_RANGE2.start, DEFAULT_PORT_RANGE2.end));
     const explicitModel = typeof cliConfig.model === "string" ? cliConfig.model : undefined;
     const modelMap = {
       opus: cliConfig.modelOpus,
@@ -71935,13 +72469,13 @@ Team Status`);
       haiku: cliConfig.modelHaiku,
       subagent: cliConfig.modelSubagent
     };
-    const proxy = await createProxyServer2(port, cliConfig.monitor ? undefined : cliConfig.openrouterApiKey, cliConfig.monitor ? undefined : explicitModel, cliConfig.monitor, cliConfig.anthropicApiKey, modelMap, {
+    const proxy = await traceSpan("startup:proxy-start", () => createProxyServer2(port, cliConfig.monitor ? undefined : cliConfig.openrouterApiKey, cliConfig.monitor ? undefined : explicitModel, cliConfig.monitor, cliConfig.anthropicApiKey, modelMap, {
       summarizeTools: cliConfig.summarizeTools,
       quiet: cliConfig.quiet,
       isInteractive: cliConfig.interactive,
       advisorModels: cliConfig.advisorModels,
       advisorCollector: cliConfig.advisorCollector
-    });
+    }));
     const diag = createDiagOutput2({
       interactive: cliConfig.interactive,
       diagMode: cliConfig.diagMode
@@ -71949,6 +72483,7 @@ Team Status`);
     if (cliConfig.interactive) {
       setDiagOutput2(diag);
     }
+    finalizeStartupTrace("run", { quiet: cliConfig.quiet });
     let exitCode = 0;
     try {
       exitCode = await runClaudeWithProxy2(cliConfig, proxy.url, () => diag.cleanup());