claudish 7.20.1 → 7.22.0

package/dist/index.js

@@ -651,7 +651,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "7.20.1";
+var VERSION = "7.22.0";
 
 // src/logger.ts
 var exports_logger = {};
@@ -3654,7 +3654,10 @@ var require_sdk = __commonJS((exports) => {
 var exports_onepassword = {};
 __export(exports_onepassword, {
   withSdkRetry: () => withSdkRetry,
+  wasOpAuthorizationDenied: () => wasOpAuthorizationDenied,
   valueTail: () => valueTail,
+  setScreenLockProbe: () => setScreenLockProbe,
+  setLockRetryTiming: () => setLockRetryTiming,
   resolveSecretsPartial: () => resolveSecretsPartial,
   resolveSecrets: () => resolveSecrets,
   resolveSdkAuth: () => resolveSdkAuth,
@@ -3663,7 +3666,10 @@ __export(exports_onepassword, {
   resolveGlobImport: () => resolveGlobImport,
   resolveDesktopAccount: () => resolveDesktopAccount,
   resetSdkClientCache: () => resetSdkClientCache,
+  resetOpFailures: () => resetOpFailures,
+  renderOpFailureNotice: () => renderOpFailureNotice,
   recordOpHydratedVars: () => recordOpHydratedVars,
+  recordOpFailure: () => recordOpFailure,
   readEnvironment: () => readEnvironment,
   parseOpFlag: () => parseOpFlag,
   parseGlobImport: () => parseGlobImport,
@@ -3671,16 +3677,20 @@ __export(exports_onepassword, {
   listVaults: () => listVaults,
   listItems: () => listItems,
   isTransientSdkError: () => isTransientSdkError,
+  isScreenLocked: () => isScreenLocked,
   isOpReference: () => isOpReference,
   isOpHydratedVar: () => isOpHydratedVar,
+  isLockedDenial: () => isLockedDenial,
   isGlobImport: () => isGlobImport,
   globToRegExp: () => globToRegExp,
+  getOpFailures: () => getOpFailures,
   filterGlobFields: () => filterGlobFields,
   envNameFromOpRef: () => envNameFromOpRef,
   discoverItemFieldsById: () => discoverItemFieldsById,
   discoverItemFields: () => discoverItemFields,
   detectSdkAuth: () => detectSdkAuth,
   defaultSdkClientFactory: () => defaultSdkClientFactory,
+  defaultScreenLockProbe: () => defaultScreenLockProbe,
   defaultOpAccountLister: () => defaultOpAccountLister,
   collectConfigImports: () => collectConfigImports,
   buildAuthError: () => buildAuthError,
@@ -3700,6 +3710,43 @@ function recordOpHydratedVars(names) {
 function isOpHydratedVar(name) {
   return !!name && opHydratedVars.has(name);
 }
+function recordOpFailure(failure) {
+  const dup = opSourceFailures.some((f) => f.kind === failure.kind && f.source === failure.source && f.message === failure.message);
+  if (!dup)
+    opSourceFailures.push(failure);
+}
+function getOpFailures() {
+  return opSourceFailures;
+}
+function resetOpFailures() {
+  opSourceFailures.length = 0;
+}
+function wasOpAuthorizationDenied() {
+  return opSourceFailures.some((f) => /denied authorization/i.test(f.message));
+}
+function renderOpFailureNotice(envVar) {
+  if (opSourceFailures.length === 0)
+    return [];
+  const lines = [`1Password was consulted for ${envVar} this run and failed:`];
+  for (const f of opSourceFailures) {
+    const where = f.source ? `${f.kind} ${f.source}` : f.kind;
+    lines.push(`  ${where} \u2014 ${f.message.split(`
+`)[0]}`);
+  }
+  lines.push("");
+  if (wasOpAuthorizationDenied()) {
+    lines.push("  The 1Password desktop app declined to release secrets. This happens when");
+    lines.push("  the approval prompt was dismissed, or when your Mac is locked and the");
+    lines.push("  prompt cannot be shown at all.");
+    lines.push("");
+    lines.push("  Fix: unlock the Mac, approve the 1Password prompt, and re-run.");
+    lines.push("  Headless (no desktop app): export OP_SERVICE_ACCOUNT_TOKEN='ops_...'");
+  } else {
+    lines.push("  Fix: check the reference resolves \u2014 claudish config \u2192 1Password tab.");
+    lines.push("  Headless (no desktop app): export OP_SERVICE_ACCOUNT_TOKEN='ops_...'");
+  }
+  return lines;
+}
 function buildAuthError(detail) {
   return new Error(`${detail}
 Set OP_SERVICE_ACCOUNT_TOKEN (service account, headless) or OP_ACCOUNT (your 1Password account URL, e.g. my-team.1password.com) for the desktop app \u2014 or set \`onepasswordAccount\` in ~/.claudish/config.json.`);
@@ -4035,7 +4082,97 @@ function runSdkExclusive(op, label = "op:sdk-op", meta) {
 function sdkSleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function setLockRetryTiming(opts) {
+  lockRetrySeconds = opts?.seconds ?? LOCK_RETRY_SECONDS;
+  lockTickMs = opts?.tickMs ?? 1000;
+}
+function setScreenLockProbe(probe) {
+  screenLockProbe = probe ?? defaultScreenLockProbe;
+}
+function isScreenLocked() {
+  return screenLockProbe();
+}
+function isLockedDenial(err, env = process.env) {
+  const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
+  if (!msg.includes("denied authorization"))
+    return false;
+  if (env.OP_SERVICE_ACCOUNT_TOKEN)
+    return false;
+  return isScreenLocked();
+}
+async function countdownForUnlock(round, rounds) {
+  const ttyOut = process.stderr.isTTY === true;
+  const ttyIn = process.stdin.isTTY === true;
+  let cancelled = false;
+  if (round === 1) {
+    process.stderr.write(`
+${bold("\uD83D\uDD10 1Password needs your OK \u2014 but your Mac is locked, so it can't ask.")}
+   Unlock your Mac and approve the popup. Claudish picks it up from there.
+
+`);
+  }
+  let restoreInput = () => {};
+  if (ttyIn) {
+    const onKey = (buf) => {
+      const k = buf.toString();
+      if (k === "\x1B" || k === "q" || k === "\x03")
+        cancelled = true;
+    };
+    const wasRaw = process.stdin.isRaw === true;
+    try {
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.on("data", onKey);
+      restoreInput = () => {
+        process.stdin.off("data", onKey);
+        process.stdin.setRawMode(wasRaw);
+        process.stdin.pause();
+      };
+    } catch {
+      restoreInput = () => {};
+    }
+  }
+  const stop = ttyIn ? "Esc to stop waiting" : "Ctrl-C to stop waiting";
+  const line = (secs) => dim(`   waiting ${secs}s \xB7 try ${round} of ${rounds} \xB7 ${stop}`);
+  if (!ttyOut)
+    process.stderr.write(`${line(lockRetrySeconds)}
+`);
+  try {
+    for (let remaining = lockRetrySeconds;remaining > 0; remaining--) {
+      if (cancelled)
+        break;
+      if (!isScreenLocked())
+        break;
+      if (ttyOut)
+        process.stderr.write(`\r\x1B[2K${line(remaining)}`);
+      await sdkSleep(lockTickMs);
+    }
+  } finally {
+    restoreInput();
+    if (ttyOut)
+      process.stderr.write("\r\x1B[2K");
+  }
+  if (cancelled) {
+    process.stderr.write(`   OK, not waiting. You can unlock and re-run any time.
+`);
+    return "cancel";
+  }
+  return "retry";
+}
 async function withSdkRetry(op, label = "op:sdk-op") {
+  for (let round = 1;; round++) {
+    try {
+      return await withSdkTransientRetry(op, label);
+    } catch (err) {
+      if (round > LOCK_RETRY_ROUNDS || !isLockedDenial(err))
+        throw err;
+      if (await countdownForUnlock(round, LOCK_RETRY_ROUNDS) === "cancel")
+        throw err;
+      resetSdkClientCache();
+    }
+  }
+}
+async function withSdkTransientRetry(op, label) {
   const MAX_ATTEMPTS = 3;
   let lastErr;
   for (let attempt = 1;attempt <= MAX_ATTEMPTS; attempt++) {
@@ -4211,7 +4348,7 @@ async function readEnvironment(environmentId, opts = {}) {
   }
   return out;
 }
-var OP_REF_RE, opHydratedVars, ENV_VAR_NAME_RE, sdkClientCache, defaultSdkClientFactory = async (auth) => {
+var OP_REF_RE, opHydratedVars, opSourceFailures, ENV_VAR_NAME_RE, sdkClientCache, defaultSdkClientFactory = async (auth) => {
   const key = sdkAuthCacheKey(auth);
   const cached = sdkClientCache.get(key);
   if (cached)
@@ -4232,7 +4369,21 @@ var OP_REF_RE, opHydratedVars, ENV_VAR_NAME_RE, sdkClientCache, defaultSdkClient
   sdkClientCache.set(key, build);
   build.catch(() => sdkClientCache.delete(key));
   return build;
-}, sdkQueue, defaultOpAccountLister = () => {
+}, sdkQueue, LOCK_RETRY_ROUNDS = 3, LOCK_RETRY_SECONDS = 10, lockRetrySeconds, lockTickMs = 1000, styled = (code, s) => process.stderr.isTTY === true ? `\x1B[${code}m${s}\x1B[0m` : s, bold = (s) => styled("1", s), dim = (s) => styled("2", s), defaultScreenLockProbe = () => {
+  if (process.platform !== "darwin")
+    return false;
+  try {
+    const res = spawnSync("ioreg", ["-n", "Root", "-d1", "-a"], {
+      encoding: "utf-8",
+      timeout: 2000
+    });
+    if (res.status !== 0 || typeof res.stdout !== "string")
+      return false;
+    return /CGSSessionScreenIsLocked<\/key>\s*(?:<true\/>|<integer>1<\/integer>)/.test(res.stdout);
+  } catch {
+    return false;
+  }
+}, screenLockProbe, defaultOpAccountLister = () => {
   try {
     const res = spawnSync("op", ["account", "list", "--format=json"], { encoding: "utf-8" });
     if (res.error || res.status !== 0)
@@ -4263,9 +4414,12 @@ var init_onepassword = __esm(() => {
   init_startup_trace();
   OP_REF_RE = /^op:\/\/[^\s]+$/;
   opHydratedVars = new Set;
+  opSourceFailures = [];
   ENV_VAR_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
   sdkClientCache = new Map;
   sdkQueue = Promise.resolve();
+  lockRetrySeconds = LOCK_RETRY_SECONDS;
+  screenLockProbe = defaultScreenLockProbe;
 });
 
 // src/auth/credentials/op-source.ts
@@ -4571,12 +4725,14 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
     } catch (err) {
       if (err instanceof OpAuthError && onAuthFailure === "skip") {
         console.error(`[claudish] 1Password auth unavailable, skipping op:// keys: ${err.message}`);
+        const { recordOpFailure: recordOpFailure3 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+        recordOpFailure3({ kind: "auth", message: err.message });
         return {};
       }
       throw err;
     }
   }
-  const { collectConfigImports: collectConfigImports2, resolveSecrets: resolveSecrets2, recordOpHydratedVars: recordOpHydratedVars2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+  const { collectConfigImports: collectConfigImports2, resolveSecrets: resolveSecrets2, recordOpHydratedVars: recordOpHydratedVars2, recordOpFailure: recordOpFailure2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
   const cfg = readConfigRaw();
   const out = {};
   try {
@@ -4613,6 +4769,7 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
       } catch (globErr) {
         const m = globErr instanceof Error ? globErr.message : String(globErr);
         console.error(`[claudish] 1Password import skipped: ${m}`);
+        recordOpFailure2({ kind: "import", source: globPath, message: m });
       }
     }
     if (cfg.customEndpoints && typeof cfg.customEndpoints === "object") {
@@ -4654,16 +4811,19 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
         } catch (envErr) {
           const m = envErr instanceof Error ? envErr.message : String(envErr);
           console.error(`[claudish] 1Password environment skipped: ${m}`);
+          recordOpFailure2({ kind: "environment", source: envId, message: m });
         }
       }
     }
   } catch (err) {
     if (err instanceof OpAuthError && onAuthFailure === "skip") {
       console.error(`[claudish] 1Password resolution skipped: ${err.message}`);
+      recordOpFailure2({ kind: "auth", message: err.message });
       return out;
     }
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[claudish] 1Password secret resolution failed: ${message}`);
+    recordOpFailure2({ kind: "reference", message });
     if (onAuthFailure === "throw")
       throw err;
   }
@@ -37305,6 +37465,140 @@ var init_connection_error = __esm(() => {
   BUN_CONNECT_MESSAGE = /unable to connect\. is the computer able to access the url\?/i;
 });
 
+// src/handlers/shared/stream-head-sniffer.ts
+function isRetryableStreamError(code, type, message) {
+  if (RETRYABLE_ERROR_CODES.has(code))
+    return true;
+  if (RETRYABLE_ERROR_TYPES.has(type))
+    return true;
+  return /overloaded|try again later|temporarily unavailable|please retry/i.test(message);
+}
+async function sniffResponsesStreamHead(response, opts = {}) {
+  const budgetMs = opts.budgetMs ?? DEFAULT_SNIFF_BUDGET_MS;
+  const logMsg = opts.log ?? (() => {});
+  if (!response.body)
+    return { kind: "clean", response };
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  const consumed = [];
+  let pending = "";
+  const deadline = Date.now() + budgetMs;
+  const replayResponse = () => {
+    const buffered = consumed.slice();
+    const body = new ReadableStream({
+      start: async (controller) => {
+        try {
+          for (const chunk of buffered)
+            controller.enqueue(chunk);
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+              break;
+            if (value)
+              controller.enqueue(value);
+          }
+          controller.close();
+        } catch (error46) {
+          try {
+            controller.error(error46);
+          } catch {}
+        }
+      },
+      cancel: () => {
+        reader.cancel().catch(() => {});
+      }
+    });
+    return new Response(body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  };
+  try {
+    while (true) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) {
+        logMsg(`[StreamSniff] budget ${budgetMs}ms elapsed with no verdict \u2014 streaming through`);
+        return { kind: "clean", response: replayResponse() };
+      }
+      let timer;
+      const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("timeout"), remaining);
+      });
+      let result;
+      try {
+        result = await Promise.race([reader.read(), timeout]);
+      } finally {
+        if (timer)
+          clearTimeout(timer);
+      }
+      if (result === "timeout") {
+        logMsg(`[StreamSniff] budget ${budgetMs}ms elapsed mid-read \u2014 streaming through`);
+        return { kind: "clean", response: replayResponse() };
+      }
+      if (result.done)
+        return { kind: "clean", response: replayResponse() };
+      if (!result.value)
+        continue;
+      consumed.push(result.value);
+      pending += decoder.decode(result.value, { stream: true });
+      const lines = pending.split(`
+`);
+      pending = lines.pop() ?? "";
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:"))
+          continue;
+        const payload = trimmed.slice(5).trim();
+        if (!payload || payload === "[DONE]")
+          continue;
+        let event;
+        try {
+          event = JSON.parse(payload);
+        } catch {
+          continue;
+        }
+        const type = String(event?.type ?? "");
+        if (PREAMBLE_EVENTS.has(type))
+          continue;
+        if (type === "error" || type === "response.failed") {
+          const err = event.error ?? event.response?.error ?? {};
+          const code = String(err.code ?? event.code ?? "");
+          const errType = String(err.type ?? event.error_type ?? "");
+          const message = String(err.message ?? event.message ?? "Unknown API error");
+          if (isRetryableStreamError(code, errType, message)) {
+            reader.cancel().catch(() => {});
+            return { kind: "retryable", code: code || errType || "unknown", message };
+          }
+          return { kind: "clean", response: replayResponse() };
+        }
+        return { kind: "clean", response: replayResponse() };
+      }
+    }
+  } catch (error46) {
+    logMsg(`[StreamSniff] read failed (${error46}) \u2014 handing stream to parser`);
+    return { kind: "clean", response: replayResponse() };
+  }
+}
+var DEFAULT_SNIFF_BUDGET_MS = 12000, PREAMBLE_EVENTS, RETRYABLE_ERROR_CODES, RETRYABLE_ERROR_TYPES;
+var init_stream_head_sniffer = __esm(() => {
+  PREAMBLE_EVENTS = new Set(["response.created", "response.in_progress"]);
+  RETRYABLE_ERROR_CODES = new Set([
+    "server_is_overloaded",
+    "server_error",
+    "internal_error",
+    "internal_server_error",
+    "rate_limit_exceeded",
+    "overloaded",
+    "slow_down"
+  ]);
+  RETRYABLE_ERROR_TYPES = new Set([
+    "service_unavailable_error",
+    "overloaded_error",
+    "api_error"
+  ]);
+});
+
 // src/handlers/shared/stream-parsers/anthropic-sse.ts
 function createAnthropicPassthroughStream(c, response, opts) {
   const encoder = new TextEncoder;
@@ -37970,6 +38264,11 @@ data: ${JSON.stringify(data)}
 `));
         }
       };
+      const safeClose = () => {
+        try {
+          controller.close();
+        } catch {}
+      };
       const closeReasoning = () => {
         if (reasoningIdx >= 0) {
           send("content_block_stop", { type: "content_block_stop", index: reasoningIdx });
@@ -38192,7 +38491,7 @@ data: ${JSON.stringify(data)}
                 }
                 if (opts.onTokenUpdate)
                   opts.onTokenUpdate(inputTokens, outputTokens);
-                controller.close();
+                safeClose();
                 return;
               }
             } catch (parseError) {
@@ -38220,7 +38519,7 @@ data: ${JSON.stringify(data)}
         isClosed = true;
         if (opts.onTokenUpdate)
           opts.onTokenUpdate(inputTokens, outputTokens);
-        controller.close();
+        safeClose();
       } catch (error46) {
         if (pingInterval) {
           clearInterval(pingInterval);
@@ -38256,9 +38555,7 @@ data: ${JSON.stringify(data)}
           isClosed = true;
           if (opts.onTokenUpdate)
             opts.onTokenUpdate(inputTokens, outputTokens);
-          try {
-            controller.close();
-          } catch {}
+          safeClose();
         }
       }
     },
@@ -38871,6 +39168,35 @@ class ComposedHandler {
     if (droppedParams.length > 0) {
       c.header("X-Dropped-Params", droppedParams.join(", "));
     }
+    if (this.resolveStreamFormat() === "openai-responses-sse") {
+      const settled = await this.settleResponsesStreamHead(response, () => this.provider.enqueueRequest ? this.provider.enqueueRequest(doFetch) : doFetch());
+      if (settled.kind === "exhausted") {
+        const waited = STREAM_RETRY_DELAYS_MS.slice(0, settled.attempts).reduce((sum, ms) => sum + ms, 0);
+        const surfaced = `${this.provider.displayName} is overloaded upstream (${settled.code}): ${settled.message} ` + `claudish retried ${settled.attempts}\xD7 over ${Math.round(waited / 1000)}s without success.`;
+        logStderr(`Error: ${surfaced}`);
+        try {
+          recordStats({
+            model_id: this.targetModel,
+            provider_name: this.provider.name,
+            stream_format: this.provider.streamFormat,
+            latency_ms: Math.round(performance.now() - startTime),
+            success: false,
+            http_status: 503,
+            error_class: "server_error",
+            error_code: settled.code,
+            token_strategy: this.options.tokenStrategy ?? "standard",
+            adapter_name: this.getActiveAdapterName(),
+            middleware_names: this.middlewareManager.getActiveNames(this.bareModelName),
+            fallback_used: fallbackMeta !== undefined,
+            fallback_chain: fallbackMeta?.chain,
+            fallback_attempts: fallbackMeta?.attempts,
+            invocation_mode: this.options.invocationMode ?? "auto-route"
+          });
+        } catch {}
+        return c.json(wrapAnthropicError(503, surfaced, "overloaded_error"), 503);
+      }
+      response = settled.response;
+    }
     latencyMs = Math.round(performance.now() - startTime);
     const httpStatus = response.status;
     let streamApiError = null;
@@ -38902,6 +39228,52 @@ class ComposedHandler {
       streamApiError = { code, message };
     });
   }
+  async settleResponsesStreamHead(initial, reissue) {
+    let response = initial;
+    for (let attempt = 0;; attempt++) {
+      const verdict = await sniffResponsesStreamHead(response, { log });
+      if (verdict.kind === "clean")
+        return { kind: "ok", response: verdict.response };
+      const delayMs = STREAM_RETRY_DELAYS_MS[attempt];
+      if (delayMs === undefined) {
+        log(`[${this.provider.displayName}] in-stream ${verdict.code} persisted after ` + `${attempt} retries \u2014 surfacing 503 so the client can retry`);
+        return {
+          kind: "exhausted",
+          code: verdict.code,
+          message: verdict.message,
+          attempts: attempt
+        };
+      }
+      log(`[${this.provider.displayName}] in-stream ${verdict.code} before any output \u2014 ` + `retry ${attempt + 1}/${STREAM_RETRY_DELAYS_MS.length} in ${delayMs / 1000}s`);
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+      let next;
+      try {
+        next = await reissue();
+      } catch (error46) {
+        log(`[${this.provider.displayName}] retry fetch failed: ${error46}`);
+        return {
+          kind: "exhausted",
+          code: verdict.code,
+          message: `${verdict.message} (retry could not reach the provider: ${error46})`,
+          attempts: attempt + 1
+        };
+      }
+      if (!next.ok) {
+        const body = await next.text().catch(() => "");
+        log(`[${this.provider.displayName}] retry returned HTTP ${next.status}`);
+        return {
+          kind: "exhausted",
+          code: `http_${next.status}`,
+          message: body.slice(0, 500) || `HTTP ${next.status}`,
+          attempts: attempt + 1
+        };
+      }
+      response = next;
+    }
+  }
+  resolveStreamFormat() {
+    return this.provider.overrideStreamFormat?.() ?? this.explicitAdapter?.getStreamFormat() ?? this.modelAdapter?.getStreamFormat() ?? this.getAdapter().getStreamFormat();
+  }
   handleStream(c, response, adapter, claudeRequest, toolNameMap, onComplete, onApiError) {
     let pendingOnComplete = onComplete;
     const onTokenUpdate = (input, output) => {
@@ -38927,7 +39299,7 @@ class ComposedHandler {
         pendingOnComplete = undefined;
       }
     };
-    const streamFormat = this.provider.overrideStreamFormat?.() ?? this.explicitAdapter?.getStreamFormat() ?? this.modelAdapter?.getStreamFormat() ?? this.getAdapter().getStreamFormat();
+    const streamFormat = this.resolveStreamFormat();
     const priorInputTokens = this.tokenTracker.getLastInputTokens();
     switch (streamFormat) {
       case "openai-sse":
@@ -39031,6 +39403,7 @@ function getRecoveryHint(status, errorText, providerName) {
   }
   return `Unexpected HTTP ${status} from ${providerName}.`;
 }
+var STREAM_RETRY_DELAYS_MS;
 var init_composed_handler = __esm(() => {
   init_dialect_manager();
   init_logger();
@@ -39043,6 +39416,7 @@ var init_composed_handler = __esm(() => {
   init_anthropic_error();
   init_connection_error();
   init_openai_compat();
+  init_stream_head_sniffer();
   init_anthropic_sse();
   init_gemini_sse();
   init_ollama_jsonl();
@@ -39050,6 +39424,7 @@ var init_composed_handler = __esm(() => {
   init_openai_responses_sse();
   init_openai_sse();
   init_token_tracker();
+  STREAM_RETRY_DELAYS_MS = [3000, 15000, 30000];
 });
 
 // src/handlers/fallback-handler.ts
@@ -42454,7 +42829,12 @@ function getMissingKeyError(resolution) {
   const lines = [];
   lines.push(`Error: ${resolution.apiKeyDescription} is required for model "${resolution.fullModelId}"`);
   lines.push("");
-  lines.push("Set it with:");
+  const opNotice = renderOpFailureNotice(resolution.requiredApiKeyEnvVar);
+  if (opNotice.length > 0) {
+    lines.push(...opNotice);
+    lines.push("");
+  }
+  lines.push(opNotice.length > 0 ? "Or set the key directly:" : "Set it with:");
   lines.push(`  export ${resolution.requiredApiKeyEnvVar}='your-key-here'`);
   if (resolution.apiKeyUrl) {
     lines.push("");
@@ -42533,6 +42913,7 @@ var init_provider_resolver = __esm(() => {
   init_provider_definitions();
   init_provider_registry();
   init_remote_provider_registry();
+  init_onepassword();
   init_routing_hints();
   API_KEY_INFO = new Proxy({}, {
     get(_target, prop) {
@@ -60138,7 +60519,7 @@ function tokBarCells(tokensPerSec, maxTokPerSec, tokWidth) {
   const raw2 = Math.round(tokWidth * Math.max(0, tokensPerSec) / denom);
   return Math.min(tokWidth, Math.max(0, raw2));
 }
-var C, bold, A, LATENCY_BUCKETS, latencyFg = "#ffffff", LATENCY_FG_ANSI = "\x1B[38;2;255;255;255m", ANSI_RESET = "\x1B[0m", STAGE_BG, STAGE_FG, STAGE_BG_ANSI;
+var C, bold2, A, LATENCY_BUCKETS, latencyFg = "#ffffff", LATENCY_FG_ANSI = "\x1B[38;2;255;255;255m", ANSI_RESET = "\x1B[0m", STAGE_BG, STAGE_FG, STAGE_BG_ANSI;
 var init_theme2 = __esm(() => {
   C = {
     bg: "#000000",
@@ -60169,10 +60550,10 @@ var init_theme2 = __esm(() => {
     chipKeyBg: "#3a3a3a",
     chipLabelBg: "#222222"
   };
-  bold = createTextAttributes({ bold: true });
+  bold2 = createTextAttributes({ bold: true });
   A = {
-    bold,
-    boldIf: (enabled) => enabled ? bold : undefined
+    bold: bold2,
+    boldIf: (enabled) => enabled ? bold2 : undefined
   };
   LATENCY_BUCKETS = [
     { maxMs: 500, hex: "#1f8f3b" },
@@ -63508,99 +63889,99 @@ async function probeModelRouting(models, jsonOutput, options = { live: true, tim
 function printHelp() {
   const useColor = !!process.stdout.isTTY && !process.env.NO_COLOR;
   const c = (code) => (s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s;
-  const bold2 = c("1");
-  const dim = c("2");
+  const bold3 = c("1");
+  const dim2 = c("2");
   const cyan = c("36");
   const green = c("32");
   const yellow = c("33");
   const magenta = c("35");
   const blue = c("34");
-  const h = (title) => bold2(cyan(`\u258C ${title}`));
+  const h = (title) => bold3(cyan(`\u258C ${title}`));
   console.log(`
-${bold2("claudish")} ${dim("\xB7")} Run Claude Code with any AI model
-${dim("OpenRouter \xB7 Gemini \xB7 OpenAI \xB7 xAI \xB7 MiniMax \xB7 Kimi \xB7 GLM \xB7 Z.AI \xB7 Sakana \xB7 Poe \xB7 LiteLLM \xB7 Local")}
+${bold3("claudish")} ${dim2("\xB7")} Run Claude Code with any AI model
+${dim2("OpenRouter \xB7 Gemini \xB7 OpenAI \xB7 xAI \xB7 MiniMax \xB7 Kimi \xB7 GLM \xB7 Z.AI \xB7 Sakana \xB7 Poe \xB7 LiteLLM \xB7 Local")}
 
 ${h("USAGE")}
-  ${green("claudish")}                                ${dim("# Interactive mode (default, model selector)")}
-  ${green("claudish")} ${yellow("[OPTIONS] <claude-args...>")}     ${dim("# Single-shot mode (requires --model)")}
-  ${green("claudish")} ${green("--team")} ${yellow("a,b,c")} ${yellow('"prompt"')}          ${dim("# Run models in parallel (magmux grid)")}
-  ${green("claudish")} ${green("--team")} ${yellow("a,b,c")} ${green("-f")} ${yellow("input.md")}       ${dim("# Team mode with file input")}
+  ${green("claudish")}                                ${dim2("# Interactive mode (default, model selector)")}
+  ${green("claudish")} ${yellow("[OPTIONS] <claude-args...>")}     ${dim2("# Single-shot mode (requires --model)")}
+  ${green("claudish")} ${green("--team")} ${yellow("a,b,c")} ${yellow('"prompt"')}          ${dim2("# Run models in parallel (magmux grid)")}
+  ${green("claudish")} ${green("--team")} ${yellow("a,b,c")} ${green("-f")} ${yellow("input.md")}       ${dim2("# Team mode with file input")}
 
 ${h("MODEL ROUTING")}
-  ${bold2("New syntax:")} ${yellow("provider@model[:concurrency]")}
-    ${magenta("google@gemini-3-pro")}              ${dim("Direct Google API (explicit)")}
-    ${magenta("openrouter@google/gemini-3-pro")}   ${dim("OpenRouter (explicit)")}
-    ${magenta("oai@gpt-5.3")}                      ${dim("Direct OpenAI API (shortcut)")}
-    ${magenta("ollama@llama3.2:3")}                ${dim("Local Ollama, 3 concurrent requests")}
-    ${magenta("ollama@llama3.2:0")}                ${dim("Local Ollama, no limits")}
-
-  ${bold2("Provider shortcuts:")}
-    ${magenta("g, gemini")}      ${dim("->")} Google Gemini       ${dim("google@gemini-3-pro")}
-    ${magenta("oai")}            ${dim("->")} OpenAI Direct       ${dim("oai@gpt-5.3")}
-    ${magenta("cx, codex")}      ${dim("->")} OpenAI Codex        ${dim("cx@gpt-5.3 (Responses API)")}
-    ${magenta("or")}             ${dim("->")} OpenRouter          ${dim("or@openai/gpt-5.3")}
-    ${magenta("x-ai, xai, grok")} ${dim("->")} xAI / Grok         ${dim("x-ai@grok-3")}
-    ${magenta("mm, mmax")}       ${dim("->")} MiniMax Direct      ${dim("mm@MiniMax-M2.1")}
-    ${magenta("mmc")}            ${dim("->")} MiniMax Coding      ${dim("mmc@MiniMax-M2.1")}
-    ${magenta("kimi, moon")}     ${dim("->")} Kimi Direct         ${dim("kimi@kimi-k2-thinking-turbo")}
-    ${magenta("kc")}             ${dim("->")} Kimi Coding         ${dim("kc@kimi-k2-thinking-turbo")}
-    ${magenta("glm, zhipu")}     ${dim("->")} GLM Direct          ${dim("glm@glm-4.7")}
-    ${magenta("gc")}             ${dim("->")} GLM Coding          ${dim("gc@glm-4.7")}
-    ${magenta("z-ai, zai")}      ${dim("->")} Z.AI Direct         ${dim("z-ai@glm-4.7")}
-    ${magenta("oc, llama, lc, meta")} ${dim("->")} OllamaCloud    ${dim("oc@llama-3.1")}
-    ${magenta("zen")}            ${dim("->")} OpenCode Zen        ${dim("zen@grok-code")}
-    ${magenta("zengo, zgo")}     ${dim("->")} OpenCode Zen Go     ${dim("zengo@grok-code")}
-    ${magenta("v, vertex")}      ${dim("->")} Vertex AI           ${dim("v@gemini-2.5-flash")}
-    ${magenta("go")}             ${dim("->")} Gemini Code Assist  ${dim("go@gemini-2.5-flash")}
-    ${magenta("poe")}            ${dim("->")} Poe                 ${dim("poe@GPT-4o")}
-    ${magenta("litellm, ll")}    ${dim("->")} LiteLLM             ${dim("ll@gpt-4o (needs LITELLM_BASE_URL)")}
-    ${magenta("ds")}             ${dim("->")} DeepSeek            ${dim("ds@deepseek-chat")}
-    ${magenta("sakana, fugu")}   ${dim("->")} Sakana Fugu         ${dim("fugu@fugu-ultra")}
-    ${magenta("sc")}             ${dim("->")} Sakana Subscription ${dim("sc@fugu-ultra")}
-    ${magenta("ollama")}         ${dim("->")} Ollama (local)      ${dim("ollama@llama3.2")}
-    ${magenta("lms, lmstudio")}  ${dim("->")} LM Studio (local)   ${dim("lms@qwen")}
-    ${magenta("vllm")}           ${dim("->")} vLLM (local)        ${dim("vllm@model")}
-    ${magenta("mlx")}            ${dim("->")} MLX (local)         ${dim("mlx@model")}
-
-  ${bold2("Native auto-detection")} ${dim("(when no provider specified):")}
-    ${yellow("google/*, gemini-*")}      ${dim("->")} Google API
-    ${yellow("openai/*, gpt-*, o1-*")}   ${dim("->")} OpenAI API
-    ${yellow("x-ai/*, grok-*")}          ${dim("->")} xAI
-    ${yellow("meta-llama/*, llama-*")}   ${dim("->")} OllamaCloud
-    ${yellow("minimax/*, abab-*")}       ${dim("->")} MiniMax API
-    ${yellow("moonshot/*, kimi-*")}      ${dim("->")} Kimi API
-    ${yellow("zhipu/*, glm-*")}          ${dim("->")} GLM API
-    ${yellow("sakana/*, fugu-*")}        ${dim("->")} Sakana Fugu
-    ${yellow("poe:*")}                   ${dim("->")} Poe
-    ${yellow("anthropic/*, claude-*")}   ${dim("->")} Native Anthropic
-    ${yellow("(unknown vendor/)")}       ${dim("->")} Error (use openrouter@vendor/model)
-
-  ${dim("A defaultProvider (config / --default-provider) catches bare names that match no rule.")}
+  ${bold3("New syntax:")} ${yellow("provider@model[:concurrency]")}
+    ${magenta("google@gemini-3-pro")}              ${dim2("Direct Google API (explicit)")}
+    ${magenta("openrouter@google/gemini-3-pro")}   ${dim2("OpenRouter (explicit)")}
+    ${magenta("oai@gpt-5.3")}                      ${dim2("Direct OpenAI API (shortcut)")}
+    ${magenta("ollama@llama3.2:3")}                ${dim2("Local Ollama, 3 concurrent requests")}
+    ${magenta("ollama@llama3.2:0")}                ${dim2("Local Ollama, no limits")}
+
+  ${bold3("Provider shortcuts:")}
+    ${magenta("g, gemini")}      ${dim2("->")} Google Gemini       ${dim2("google@gemini-3-pro")}
+    ${magenta("oai")}            ${dim2("->")} OpenAI Direct       ${dim2("oai@gpt-5.3")}
+    ${magenta("cx, codex")}      ${dim2("->")} OpenAI Codex        ${dim2("cx@gpt-5.3 (Responses API)")}
+    ${magenta("or")}             ${dim2("->")} OpenRouter          ${dim2("or@openai/gpt-5.3")}
+    ${magenta("x-ai, xai, grok")} ${dim2("->")} xAI / Grok         ${dim2("x-ai@grok-3")}
+    ${magenta("mm, mmax")}       ${dim2("->")} MiniMax Direct      ${dim2("mm@MiniMax-M2.1")}
+    ${magenta("mmc")}            ${dim2("->")} MiniMax Coding      ${dim2("mmc@MiniMax-M2.1")}
+    ${magenta("kimi, moon")}     ${dim2("->")} Kimi Direct         ${dim2("kimi@kimi-k2-thinking-turbo")}
+    ${magenta("kc")}             ${dim2("->")} Kimi Coding         ${dim2("kc@kimi-k2-thinking-turbo")}
+    ${magenta("glm, zhipu")}     ${dim2("->")} GLM Direct          ${dim2("glm@glm-4.7")}
+    ${magenta("gc")}             ${dim2("->")} GLM Coding          ${dim2("gc@glm-4.7")}
+    ${magenta("z-ai, zai")}      ${dim2("->")} Z.AI Direct         ${dim2("z-ai@glm-4.7")}
+    ${magenta("oc, llama, lc, meta")} ${dim2("->")} OllamaCloud    ${dim2("oc@llama-3.1")}
+    ${magenta("zen")}            ${dim2("->")} OpenCode Zen        ${dim2("zen@grok-code")}
+    ${magenta("zengo, zgo")}     ${dim2("->")} OpenCode Zen Go     ${dim2("zengo@grok-code")}
+    ${magenta("v, vertex")}      ${dim2("->")} Vertex AI           ${dim2("v@gemini-2.5-flash")}
+    ${magenta("go")}             ${dim2("->")} Gemini Code Assist  ${dim2("go@gemini-2.5-flash")}
+    ${magenta("poe")}            ${dim2("->")} Poe                 ${dim2("poe@GPT-4o")}
+    ${magenta("litellm, ll")}    ${dim2("->")} LiteLLM             ${dim2("ll@gpt-4o (needs LITELLM_BASE_URL)")}
+    ${magenta("ds")}             ${dim2("->")} DeepSeek            ${dim2("ds@deepseek-chat")}
+    ${magenta("sakana, fugu")}   ${dim2("->")} Sakana Fugu         ${dim2("fugu@fugu-ultra")}
+    ${magenta("sc")}             ${dim2("->")} Sakana Subscription ${dim2("sc@fugu-ultra")}
+    ${magenta("ollama")}         ${dim2("->")} Ollama (local)      ${dim2("ollama@llama3.2")}
+    ${magenta("lms, lmstudio")}  ${dim2("->")} LM Studio (local)   ${dim2("lms@qwen")}
+    ${magenta("vllm")}           ${dim2("->")} vLLM (local)        ${dim2("vllm@model")}
+    ${magenta("mlx")}            ${dim2("->")} MLX (local)         ${dim2("mlx@model")}
+
+  ${bold3("Native auto-detection")} ${dim2("(when no provider specified):")}
+    ${yellow("google/*, gemini-*")}      ${dim2("->")} Google API
+    ${yellow("openai/*, gpt-*, o1-*")}   ${dim2("->")} OpenAI API
+    ${yellow("x-ai/*, grok-*")}          ${dim2("->")} xAI
+    ${yellow("meta-llama/*, llama-*")}   ${dim2("->")} OllamaCloud
+    ${yellow("minimax/*, abab-*")}       ${dim2("->")} MiniMax API
+    ${yellow("moonshot/*, kimi-*")}      ${dim2("->")} Kimi API
+    ${yellow("zhipu/*, glm-*")}          ${dim2("->")} GLM API
+    ${yellow("sakana/*, fugu-*")}        ${dim2("->")} Sakana Fugu
+    ${yellow("poe:*")}                   ${dim2("->")} Poe
+    ${yellow("anthropic/*, claude-*")}   ${dim2("->")} Native Anthropic
+    ${yellow("(unknown vendor/)")}       ${dim2("->")} Error (use openrouter@vendor/model)
+
+  ${dim2("A defaultProvider (config / --default-provider) catches bare names that match no rule.")}
 
 ${h("OPTIONS")}
   ${green("-i, --interactive")}        Run in interactive mode (default when no prompt given)
   ${green("-m, --model")} ${yellow("<model>")}      Model to use (required for single-shot mode)
   ${green("--profile")} ${yellow("<name>")}         Use named profile for model mapping (default profile if omitted)
   ${green("--default-provider")} ${yellow("<name>")} Fallback provider for bare model names (builtin or customEndpoints key)
-                           ${dim("Precedence: this flag > CLAUDISH_DEFAULT_PROVIDER env > config.json")}
+                           ${dim2("Precedence: this flag > CLAUDISH_DEFAULT_PROVIDER env > config.json")}
   ${green("--anthropic-api-billing")}  Use your real ANTHROPIC_API_KEY for native Claude models
-                           ${dim("(metered API billing). Default: the key is hidden so Claude Code")}
-                           ${dim("uses your claude.ai subscription. Env: CLAUDISH_ANTHROPIC_API_BILLING")}
-                           ${dim("Config: anthropicApiBilling: true")}
+                           ${dim2("(metered API billing). Default: the key is hidden so Claude Code")}
+                           ${dim2("uses your claude.ai subscription. Env: CLAUDISH_ANTHROPIC_API_BILLING")}
+                           ${dim2("Config: anthropicApiBilling: true")}
   ${green("--config")} ${yellow("<file>")}          Use THIS config file for the run, fully replacing the machine
-                           ${dim("global (~/.claudish/config.json) AND project (.claudish.json).")}
-                           ${dim("A file naming no op:// source never touches 1Password (no prompt).")}
-                           ${dim("Env vars still resolve first. Env: CLAUDISH_CONFIG")}
+                           ${dim2("global (~/.claudish/config.json) AND project (.claudish.json).")}
+                           ${dim2("A file naming no op:// source never touches 1Password (no prompt).")}
+                           ${dim2("Env vars still resolve first. Env: CLAUDISH_CONFIG")}
   ${green("--op")} ${yellow("<op://glob>")}         Load API keys from a 1Password item glob (SDK-based, no op CLI)
   ${green("--op")} ${yellow("<glob>")} ${green("--list")}      Preview which fields the glob would import (names only, no values)
   ${green("--op-env")} ${yellow("<id>")}            Load env vars from a 1Password Environment (highest priority)
   ${green("--port")} ${yellow("<port>")}            Proxy server port (default: random)
   ${green("-d, --debug-claudish")}     Enable claudish debug logging to file (logs/claudish_*.log)
-                           ${dim('Always-on: CLAUDISH_DEBUG=1 env var or "debug": true in config.json')}
+                           ${dim2('Always-on: CLAUDISH_DEBUG=1 env var or "debug": true in config.json')}
   ${green("--no-debug-claudish")}      Force debug logging off for this run (when globally enabled)
   ${green("--log-off")}                Disable always-on structural logging (~/.claudish/logs/)
   ${green("--log-diag")} ${yellow("<mode>")}        Diagnostic output: auto (default), logfile, off
-                           ${dim('Also: CLAUDISH_DIAG_MODE env var or "diagMode" in config.json')}
+                           ${dim2('Also: CLAUDISH_DIAG_MODE env var or "diagMode" in config.json')}
   ${green("--log-level")} ${yellow("<level>")}      Log verbosity: debug (full), info (truncated), minimal (labels)
   ${green("-q, --quiet")}              Suppress [claudish] log messages (default in single-shot mode)
   ${green("-v, --verbose")}            Show [claudish] log messages (default in interactive mode)
@@ -63624,13 +64005,13 @@ ${h("OPTIONS")}
 ${h("MODEL DISCOVERY")}
   ${green("--models")}                              Top 100 ranked (Firebase + local providers)
   ${green("--models --provider")} ${yellow("<slug>")}                Filter the catalog to one provider
-                                          ${dim("e.g. --provider opencode-zen, anthropic, openai")}
+                                          ${dim2("e.g. --provider opencode-zen, anthropic, openai")}
   ${green("--providers")}                           Every provider + active-model count
   ${green("-s, --models-search")} ${yellow("<query>")}             Fuzzy search: id, brand synonyms (chatgpt,
-                                          ${dim("claude, grok), gateways (zen, oc, codex), caps")}
+                                          ${dim2("claude, grok), gateways (zen, oc, codex), caps")}
   ${green("--models-top")}                          Curated recommended models (flagship + fast)
   ${green("--probe")} ${yellow("<models...>")}                    Probe each provider in the fallback chain with
-                                          ${dim("a real 1-token request (may incur tiny cost)")}
+                                          ${dim2("a real 1-token request (may incur tiny cost)")}
   ${green("--no-probe")}                            Skip live requests, show static chain only
   ${green("--probe-timeout")} ${yellow("<secs>")}                 Per-link timeout for live probes (default: 40)
   ${green("--models-refresh")}                      Force refresh the slim model catalog from Firebase
@@ -63639,11 +64020,11 @@ ${h("MODEL DISCOVERY")}
 
 ${h("TEAM MODE")}
   ${green("--team")} ${yellow("<models>")}           Run multiple models in parallel (comma-separated)
-                           ${dim('Example: --team minimax-m2.5,kimi-k2.5 "prompt"')}
+                           ${dim2('Example: --team minimax-m2.5,kimi-k2.5 "prompt"')}
   ${green("--mode")} ${yellow("<mode>")}             Team mode: default (grid), interactive, json
   ${green("-f, --file")} ${yellow("<path>")}         Read prompt from file (use with --team or single-shot)
 
-${h("MODEL MAPPING")} ${dim("(per-role override)")}
+${h("MODEL MAPPING")} ${dim2("(per-role override)")}
   ${green("--model-opus")} ${yellow("<model>")}      Model for Opus role (planning, complex tasks)
   ${green("--model-sonnet")} ${yellow("<model>")}    Model for Sonnet role (default coding)
   ${green("--model-haiku")} ${yellow("<model>")}     Model for Haiku role (fast tasks, background)
@@ -63651,13 +64032,13 @@ ${h("MODEL MAPPING")} ${dim("(per-role override)")}
 
 ${h("SUBCOMMANDS")}
   ${green("claudish config")}                        Open the interactive config TUI (profiles,
-                                          ${dim("providers, routing, 1Password)")}
+                                          ${dim2("providers, routing, 1Password)")}
   ${green("claudish providers")} ${yellow("[--json]")}             Show provider credential status (no key material)
   ${green("claudish quota")} ${yellow("[provider]")}              Show remaining quota/usage (alias: usage)
   ${green("claudish serve")} ${yellow("--port <n> --models <p>")}  Run the Claude Desktop redirect gateway
   ${green("claudish update")}                        Check for updates and install the latest version
 
-  ${bold2("Profiles:")}
+  ${bold3("Profiles:")}
     ${green("claudish init")} ${yellow("[--local|--global]")}        Setup wizard - create config + first profile
     ${green("claudish profile list")} ${yellow("[scope]")}          List all profiles (both scopes by default)
     ${green("claudish profile add")} ${yellow("[scope]")}           Add a new profile
@@ -63665,104 +64046,104 @@ ${h("SUBCOMMANDS")}
     ${green("claudish profile use")} ${yellow("[name] [scope]")}     Set default profile
     ${green("claudish profile show")} ${yellow("[name] [scope]")}    Show profile details
     ${green("claudish profile edit")} ${yellow("[name] [scope]")}    Edit a profile
-    ${dim("scope = --local (.claudish.json) | --global (~/.claudish/config.json) | (prompted)")}
+    ${dim2("scope = --local (.claudish.json) | --global (~/.claudish/config.json) | (prompted)")}
 
-  ${bold2("Authentication:")}
+  ${bold3("Authentication:")}
     ${green("claudish login")} ${yellow("[provider]")}              Login to an OAuth provider (interactive if omitted)
     ${green("claudish logout")} ${yellow("[provider]")}             Clear OAuth credentials
-    ${dim("Providers: gemini, kimi")}
+    ${dim2("Providers: gemini, kimi")}
 
-${h("1PASSWORD")} ${dim("(SDK-based \u2014 no op CLI needed for secrets)")}
-  ${dim("Auth via OP_SERVICE_ACCOUNT_TOKEN, or OP_ACCOUNT / onepasswordAccount config (DesktopAuth).")}
+${h("1PASSWORD")} ${dim2("(SDK-based \u2014 no op CLI needed for secrets)")}
+  ${dim2("Auth via OP_SERVICE_ACCOUNT_TOKEN, or OP_ACCOUNT / onepasswordAccount config (DesktopAuth).")}
   ${green("--op")} ${yellow("<glob> --list")}        Preview which fields a glob would import (names only)
   ${green("--op")} ${yellow("<glob>")} ${yellow("[...args]")}      Resolve a glob into env vars, then run a session
-                           ${dim("Inline op import requires a GLOB (self-names via field labels)")}
-                           ${dim('Example: claudish --op "op://Jack/Keys/**" --model gpt-4o "task"')}
+                           ${dim2("Inline op import requires a GLOB (self-names via field labels)")}
+                           ${dim2('Example: claudish --op "op://Jack/Keys/**" --model gpt-4o "task"')}
   ${green("--op-env")} ${yellow("<id>")}             Load a 1Password Environment (highest-priority source)
-  ${dim("Persistent setup (single refs, sets, environments, account): claudish config -> 1Password tab")}
+  ${dim2("Persistent setup (single refs, sets, environments, account): claudish config -> 1Password tab")}
 
 ${h("CLAUDE CODE FLAG PASSTHROUGH")}
-  ${dim("Any unrecognized flag is forwarded to Claude Code. Claudish flags can appear in any order.")}
-    ${green("claudish")} --model grok ${yellow("--agent test")} ${yellow('"task"')}        ${dim("# --agent passes through")}
-    ${green("claudish")} --model grok ${yellow("--effort high")} --stdin ${yellow('"task"')}  ${dim("# --effort passes, --stdin stays")}
-    ${green("claudish")} --model grok ${yellow("--permission-mode plan")} -i   ${dim("# works in interactive too")}
-  ${dim("Use -- when a Claude Code flag value starts with '-':")}
+  ${dim2("Any unrecognized flag is forwarded to Claude Code. Claudish flags can appear in any order.")}
+    ${green("claudish")} --model grok ${yellow("--agent test")} ${yellow('"task"')}        ${dim2("# --agent passes through")}
+    ${green("claudish")} --model grok ${yellow("--effort high")} --stdin ${yellow('"task"')}  ${dim2("# --effort passes, --stdin stays")}
+    ${green("claudish")} --model grok ${yellow("--permission-mode plan")} -i   ${dim2("# works in interactive too")}
+  ${dim2("Use -- when a Claude Code flag value starts with '-':")}
     ${green("claudish")} --model grok ${green("--")} ${yellow('--system-prompt "-verbose mode" "task"')}
 
 ${h("CUSTOM MODELS & ENDPOINTS")}
-  ${dim("Claudish accepts ANY valid model ID from the Firebase catalog, even if not in --models:")}
+  ${dim2("Claudish accepts ANY valid model ID from the Firebase catalog, even if not in --models:")}
     ${green("claudish")} --model ${yellow("openrouter@your_provider/custom-model-123")} ${yellow('"task"')}
-  ${dim("Named custom endpoints live in ~/.claudish/config.json under 'customEndpoints' and route via @:")}
+  ${dim2("Named custom endpoints live in ~/.claudish/config.json under 'customEndpoints' and route via @:")}
     ${green("claudish")} --model ${yellow("my-vllm@llama3.1-70b")} ${yellow('"task"')}
 
 ${h("MODES")}
-  ${green("\u2022")} ${bold2("Interactive")} ${dim("(default):")} shows model selector, starts a persistent session
-  ${green("\u2022")} ${bold2("Single-shot")} ${dim("(--model):")} runs one task headless and exits
+  ${green("\u2022")} ${bold3("Interactive")} ${dim2("(default):")} shows model selector, starts a persistent session
+  ${green("\u2022")} ${bold3("Single-shot")} ${dim2("(--model):")} runs one task headless and exits
 
 ${h("NOTES")}
-  ${yellow("\u2022")} Permission prompts are ${bold2("ENABLED")} by default (normal Claude Code behavior)
+  ${yellow("\u2022")} Permission prompts are ${bold3("ENABLED")} by default (normal Claude Code behavior)
   ${yellow("\u2022")} Use ${green("-y")} / ${green("--auto-approve")} to skip permission prompts
   ${yellow("\u2022")} Model selector appears ONLY in interactive mode when ${green("--model")} not specified
   ${yellow("\u2022")} ${green("--dangerous")} disables the sandbox \u2014 use with extreme caution
 
 ${h("ENVIRONMENT VARIABLES")}
-  ${dim("Claudish auto-loads a .env file from the current directory.")}
+  ${dim2("Claudish auto-loads a .env file from the current directory.")}
 
-  ${bold2("Claude Code installation:")}
+  ${bold3("Claude Code installation:")}
   ${blue("CLAUDE_PATH")}                     Custom path to Claude Code binary
-                                  ${dim("Search: CLAUDE_PATH -> ~/.claude/local/claude -> PATH")}
+                                  ${dim2("Search: CLAUDE_PATH -> ~/.claude/local/claude -> PATH")}
 
-  ${bold2("API keys")} ${dim("(at least one required for cloud models):")}
+  ${bold3("API keys")} ${dim2("(at least one required for cloud models):")}
   ${blue("OPENROUTER_API_KEY")}              OpenRouter (default backend)
-  ${blue("GEMINI_API_KEY")}                  Google Gemini ${dim("(g@, gemini@; alias GOOGLE_API_KEY)")}
-  ${blue("OPENAI_API_KEY")}                  OpenAI ${dim("(oai@)")}
-  ${blue("OPENAI_CODEX_API_KEY")}            OpenAI Codex / Responses API ${dim("(cx@, codex@)")}
-  ${blue("XAI_API_KEY")}                     xAI / Grok ${dim("(x-ai@, grok@)")}
-  ${blue("MINIMAX_API_KEY")}                 MiniMax ${dim("(mm@, mmax@)")}
-  ${blue("MINIMAX_CODING_API_KEY")}          MiniMax Coding Plan ${dim("(mmc@)")}
-  ${blue("MOONSHOT_API_KEY")}                Kimi / Moonshot ${dim("(kimi@, moon@; alias KIMI_API_KEY)")}
-  ${blue("KIMI_CODING_API_KEY")}             Kimi Coding Plan ${dim("(kc@)")}
-  ${blue("ZHIPU_API_KEY")}                   GLM / Zhipu ${dim("(glm@, zhipu@; alias GLM_API_KEY)")}
-  ${blue("GLM_CODING_API_KEY")}              GLM Coding Plan ${dim("(gc@; alias ZAI_CODING_API_KEY)")}
-  ${blue("ZAI_API_KEY")}                     Z.AI ${dim("(z-ai@, zai@)")}
-  ${blue("DEEPSEEK_API_KEY")}                DeepSeek ${dim("(ds@)")}
-  ${blue("SAKANA_API_KEY")}                  Sakana Fugu ${dim("(sakana@, fugu@)")}
-  ${blue("SAKANA_SUBSCRIPTION_API_KEY")}     Sakana Fugu Subscription ${dim("(sc@; separate subscription key)")}
-  ${blue("OLLAMA_API_KEY")}                  OllamaCloud ${dim("(oc@, llama@)")}
-  ${blue("OPENCODE_API_KEY")}                OpenCode Zen ${dim("(zen@; optional - free models work without it)")}
-  ${blue("POE_API_KEY")}                     Poe ${dim("(poe@)")}
-  ${blue("LITELLM_API_KEY")}                 LiteLLM ${dim("(litellm@, ll@; needs LITELLM_BASE_URL)")}
-  ${blue("VERTEX_API_KEY")}                  Vertex AI Express ${dim("(v@)")}
-  ${blue("VERTEX_PROJECT")}                  Vertex AI project ID ${dim("(OAuth mode, v@)")}
-  ${blue("VERTEX_LOCATION")}                 Vertex AI region ${dim("(default: us-central1)")}
+  ${blue("GEMINI_API_KEY")}                  Google Gemini ${dim2("(g@, gemini@; alias GOOGLE_API_KEY)")}
+  ${blue("OPENAI_API_KEY")}                  OpenAI ${dim2("(oai@)")}
+  ${blue("OPENAI_CODEX_API_KEY")}            OpenAI Codex / Responses API ${dim2("(cx@, codex@)")}
+  ${blue("XAI_API_KEY")}                     xAI / Grok ${dim2("(x-ai@, grok@)")}
+  ${blue("MINIMAX_API_KEY")}                 MiniMax ${dim2("(mm@, mmax@)")}
+  ${blue("MINIMAX_CODING_API_KEY")}          MiniMax Coding Plan ${dim2("(mmc@)")}
+  ${blue("MOONSHOT_API_KEY")}                Kimi / Moonshot ${dim2("(kimi@, moon@; alias KIMI_API_KEY)")}
+  ${blue("KIMI_CODING_API_KEY")}             Kimi Coding Plan ${dim2("(kc@)")}
+  ${blue("ZHIPU_API_KEY")}                   GLM / Zhipu ${dim2("(glm@, zhipu@; alias GLM_API_KEY)")}
+  ${blue("GLM_CODING_API_KEY")}              GLM Coding Plan ${dim2("(gc@; alias ZAI_CODING_API_KEY)")}
+  ${blue("ZAI_API_KEY")}                     Z.AI ${dim2("(z-ai@, zai@)")}
+  ${blue("DEEPSEEK_API_KEY")}                DeepSeek ${dim2("(ds@)")}
+  ${blue("SAKANA_API_KEY")}                  Sakana Fugu ${dim2("(sakana@, fugu@)")}
+  ${blue("SAKANA_SUBSCRIPTION_API_KEY")}     Sakana Fugu Subscription ${dim2("(sc@; separate subscription key)")}
+  ${blue("OLLAMA_API_KEY")}                  OllamaCloud ${dim2("(oc@, llama@)")}
+  ${blue("OPENCODE_API_KEY")}                OpenCode Zen ${dim2("(zen@; optional - free models work without it)")}
+  ${blue("POE_API_KEY")}                     Poe ${dim2("(poe@)")}
+  ${blue("LITELLM_API_KEY")}                 LiteLLM ${dim2("(litellm@, ll@; needs LITELLM_BASE_URL)")}
+  ${blue("VERTEX_API_KEY")}                  Vertex AI Express ${dim2("(v@)")}
+  ${blue("VERTEX_PROJECT")}                  Vertex AI project ID ${dim2("(OAuth mode, v@)")}
+  ${blue("VERTEX_LOCATION")}                 Vertex AI region ${dim2("(default: us-central1)")}
   ${blue("ANTHROPIC_API_KEY")}               Placeholder (prevents Claude Code dialog)
   ${blue("ANTHROPIC_AUTH_TOKEN")}            Placeholder (prevents Claude Code login screen)
 
-  ${bold2("Custom / base-URL overrides:")}
+  ${bold3("Custom / base-URL overrides:")}
   ${blue("GEMINI_BASE_URL")}                 Custom Gemini endpoint
   ${blue("OPENAI_BASE_URL")}                 Custom OpenAI / Azure endpoint
   ${blue("MINIMAX_BASE_URL")}                Custom MiniMax endpoint
-  ${blue("MOONSHOT_BASE_URL")}               Custom Kimi / Moonshot endpoint ${dim("(alias KIMI_BASE_URL)")}
-  ${blue("ZHIPU_BASE_URL")}                  Custom GLM / Zhipu endpoint ${dim("(alias GLM_BASE_URL)")}
-  ${blue("SAKANA_BASE_URL")}                 Custom Sakana endpoint ${dim("(default: https://api.sakana.ai)")}
-  ${blue("LITELLM_BASE_URL")}                LiteLLM gateway base URL ${dim("(required for ll@)")}
-  ${blue("OLLAMACLOUD_BASE_URL")}            OllamaCloud ${dim("(default: https://ollama.com)")}
-  ${blue("OPENCODE_BASE_URL")}               OpenCode Zen ${dim("(default: https://opencode.ai/zen)")}
-
-  ${bold2("Local providers:")}
-  ${blue("OLLAMA_BASE_URL")}                 Ollama server ${dim("(default: http://localhost:11434; alias OLLAMA_HOST)")}
-  ${blue("LMSTUDIO_BASE_URL")}               LM Studio server ${dim("(default: http://localhost:1234)")}
-  ${blue("VLLM_BASE_URL")}                   vLLM server ${dim("(default: http://localhost:8000)")}
-  ${blue("MLX_BASE_URL")}                    MLX server ${dim("(default: http://127.0.0.1:8080)")}
-
-  ${bold2("Claudish settings:")}
-  ${blue("CLAUDISH_MODEL")}                  Default model ${dim("(default: openai/gpt-5.3)")}
-  ${blue("CLAUDISH_DEFAULT_PROVIDER")}       Fallback provider for bare names ${dim("(see --default-provider)")}
+  ${blue("MOONSHOT_BASE_URL")}               Custom Kimi / Moonshot endpoint ${dim2("(alias KIMI_BASE_URL)")}
+  ${blue("ZHIPU_BASE_URL")}                  Custom GLM / Zhipu endpoint ${dim2("(alias GLM_BASE_URL)")}
+  ${blue("SAKANA_BASE_URL")}                 Custom Sakana endpoint ${dim2("(default: https://api.sakana.ai)")}
+  ${blue("LITELLM_BASE_URL")}                LiteLLM gateway base URL ${dim2("(required for ll@)")}
+  ${blue("OLLAMACLOUD_BASE_URL")}            OllamaCloud ${dim2("(default: https://ollama.com)")}
+  ${blue("OPENCODE_BASE_URL")}               OpenCode Zen ${dim2("(default: https://opencode.ai/zen)")}
+
+  ${bold3("Local providers:")}
+  ${blue("OLLAMA_BASE_URL")}                 Ollama server ${dim2("(default: http://localhost:11434; alias OLLAMA_HOST)")}
+  ${blue("LMSTUDIO_BASE_URL")}               LM Studio server ${dim2("(default: http://localhost:1234)")}
+  ${blue("VLLM_BASE_URL")}                   vLLM server ${dim2("(default: http://localhost:8000)")}
+  ${blue("MLX_BASE_URL")}                    MLX server ${dim2("(default: http://127.0.0.1:8080)")}
+
+  ${bold3("Claudish settings:")}
+  ${blue("CLAUDISH_MODEL")}                  Default model ${dim2("(default: openai/gpt-5.3)")}
+  ${blue("CLAUDISH_DEFAULT_PROVIDER")}       Fallback provider for bare names ${dim2("(see --default-provider)")}
   ${blue("CLAUDISH_PORT")}                   Default proxy port
   ${blue("CLAUDISH_CONTEXT_WINDOW")}         Override context window size
   ${blue("CLAUDISH_DIAG_MODE")}              Diagnostic output: auto / logfile / off
-  ${blue("CLAUDISH_DEBUG")}                  Always enable debug logging: 1 / true ${dim("(same as -d)")}
-  ${blue("CLAUDISH_ANTHROPIC_API_BILLING")}  Bill native Claude to your API key ${dim("(see --anthropic-api-billing)")}
+  ${blue("CLAUDISH_DEBUG")}                  Always enable debug logging: 1 / true ${dim2("(same as -d)")}
+  ${blue("CLAUDISH_ANTHROPIC_API_BILLING")}  Bill native Claude to your API key ${dim2("(see --anthropic-api-billing)")}
   ${blue("CLAUDISH_MCP_TOOLS")}              MCP tool gating: all / low-level / agentic / channel
   ${blue("CLAUDISH_MODEL_OPUS")}             Override model for Opus role
   ${blue("CLAUDISH_MODEL_SONNET")}           Override model for Sonnet role
@@ -63770,41 +64151,41 @@ ${h("ENVIRONMENT VARIABLES")}
   ${blue("CLAUDISH_MODEL_SUBAGENT")}         Override model for sub-agents
   ${blue("NO_COLOR")}                        Set to disable colored output
 
-  ${bold2("1Password auth:")}
+  ${bold3("1Password auth:")}
   ${blue("OP_SERVICE_ACCOUNT_TOKEN")}        Service-account token (preferred for headless)
-  ${blue("OP_ACCOUNT")}                      Account URL for DesktopAuth ${dim("(e.g. my-team.1password.com)")}
+  ${blue("OP_ACCOUNT")}                      Account URL for DesktopAuth ${dim2("(e.g. my-team.1password.com)")}
 
 ${h("EXAMPLES")}
-  ${dim("# Interactive (default) - model selector")}
+  ${dim2("# Interactive (default) - model selector")}
   ${green("claudish")}
-  ${green("claudish")} --free                          ${dim("# only FREE models")}
+  ${green("claudish")} --free                          ${dim2("# only FREE models")}
 
-  ${dim("# Explicit provider routing")}
+  ${dim2("# Explicit provider routing")}
   ${green("claudish")} --model ${magenta("google@gemini-3-pro")} ${yellow('"implement auth"')}
   ${green("claudish")} --model ${magenta("oai@gpt-5.3")} ${yellow('"add tests for login"')}
   ${green("claudish")} --model ${magenta("openrouter@deepseek/deepseek-r1")} ${yellow('"unknown vendor"')}
 
-  ${dim("# Native auto-detection (provider inferred from model name)")}
+  ${dim2("# Native auto-detection (provider inferred from model name)")}
   ${green("claudish")} --model ${yellow("gpt-4o")} ${yellow('"routes to OpenAI"')}
   ${green("claudish")} --model ${yellow("gemini-2.5-pro")} ${yellow('"routes to Google"')}
 
-  ${dim("# Per-role model mapping")}
+  ${dim2("# Per-role model mapping")}
   ${green("claudish")} --model-opus ${magenta("oai@gpt-5.3")} --model-sonnet ${magenta("google@gemini-3-pro")}
 
-  ${dim("# stdin for large prompts (diffs, code review)")}
-  ${dim("git diff |")} ${green("claudish")} --stdin --model ${magenta("oai@gpt-5.3")} ${yellow('"Review these changes"')}
+  ${dim2("# stdin for large prompts (diffs, code review)")}
+  ${dim2("git diff |")} ${green("claudish")} --stdin --model ${magenta("oai@gpt-5.3")} ${yellow('"Review these changes"')}
 
-  ${dim("# Local models with concurrency control")}
+  ${dim2("# Local models with concurrency control")}
   ${green("claudish")} --model ${magenta("ollama@llama3.2:3")} ${yellow('"3 concurrent requests"')}
   ${green("claudish")} --model ${magenta("lms@qwen2.5-coder")} ${yellow('"LM Studio shortcut"')}
   ${green("claudish")} --model ${yellow('"http://localhost:8000/mistral"')} ${yellow('"any OpenAI-compatible URL"')}
 
-  ${dim("# Autonomous (no prompts, no sandbox) \u2014 use with caution")}
+  ${dim2("# Autonomous (no prompts, no sandbox) \u2014 use with caution")}
   ${green("claudish")} -y --dangerous ${yellow('"refactor entire codebase"')}
 
 ${h("MORE INFO")}
-  ${dim("GitHub:")}     ${blue("https://github.com/MadAppGang/claude-code")}
-  ${dim("OpenRouter:")} ${blue("https://openrouter.ai")}
+  ${dim2("GitHub:")}     ${blue("https://github.com/MadAppGang/claude-code")}
+  ${dim2("OpenRouter:")} ${blue("https://openrouter.ai")}
 `);
 }
 function printAIAgentGuide() {
@@ -71859,8 +72240,8 @@ var init_claude_runner = __esm(() => {
   init_model_catalog();
   init_config();
   init_logger();
-  init_model_discovery();
   init_profile_config();
+  init_model_discovery();
   init_model_parser();
   init_routing_rules();
   init_telemetry();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudish",
-  "version": "7.20.1",
+  "version": "7.22.0",
   "description": "Run Claude Code with any model - OpenRouter, Ollama, LM Studio & local models",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "ai"
   ],
   "optionalDependencies": {
-    "@claudish/magmux-darwin-arm64": "7.20.1",
-    "@claudish/magmux-darwin-x64": "7.20.1",
-    "@claudish/magmux-linux-arm64": "7.20.1",
-    "@claudish/magmux-linux-x64": "7.20.1"
+    "@claudish/magmux-darwin-arm64": "7.22.0",
+    "@claudish/magmux-darwin-x64": "7.22.0",
+    "@claudish/magmux-linux-arm64": "7.22.0",
+    "@claudish/magmux-linux-x64": "7.22.0"
   },
   "author": "Jack Rudenko <i@madappgang.com>",
   "license": "MIT",