claudish 7.25.0 → 7.27.0

package/dist/index.js

@@ -651,7 +651,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "7.25.0";
+var VERSION = "7.27.0";
 
 // src/logger.ts
 var exports_logger = {};
@@ -1173,6 +1173,122 @@ var init_startup_trace = __esm(() => {
   spans = [];
 });
 
+// src/providers/onepassword-handshake-lock.ts
+import { closeSync, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync3, rmSync, statSync, writeSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
+function defaultLockPath() {
+  return join4(homedir4(), ".claudish", "op-handshake.lock");
+}
+function currentLockPath() {
+  return lockPath ?? defaultLockPath();
+}
+function trace(message) {
+  if (process.env.CLAUDISH_OP_LOCK_TRACE !== "1")
+    return;
+  console.error(`[op-lock] pid=${process.pid} ${message}`);
+}
+function readHolder(path) {
+  try {
+    const [pidRaw, atRaw] = readFileSync3(path, "utf-8").trim().split(/\s+/);
+    const pid = Number(pidRaw);
+    const at = Number(atRaw);
+    if (!Number.isInteger(pid) || pid <= 0)
+      return null;
+    return { pid, at: Number.isFinite(at) ? at : 0 };
+  } catch {
+    return null;
+  }
+}
+function holderAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+function isAbandoned(path) {
+  const holder = readHolder(path);
+  if (!holder) {
+    try {
+      return Date.now() - statSync(path).mtimeMs > timing.staleMs;
+    } catch {
+      return false;
+    }
+  }
+  if (holder.pid !== process.pid && !holderAlive(holder.pid))
+    return true;
+  return Date.now() - holder.at > timing.staleMs;
+}
+async function acquire(path) {
+  const deadline = Date.now() + timing.timeoutMs;
+  let madeDir = false;
+  for (;; ) {
+    try {
+      if (!madeDir) {
+        mkdirSync3(dirname2(path), { recursive: true });
+        madeDir = true;
+      }
+      const fd = openSync(path, "wx");
+      try {
+        writeSync(fd, `${process.pid} ${Date.now()}`);
+      } finally {
+        closeSync(fd);
+      }
+      return true;
+    } catch (err) {
+      if (err?.code !== "EEXIST")
+        return false;
+      if (isAbandoned(path)) {
+        try {
+          rmSync(path, { force: true });
+        } catch {}
+        continue;
+      }
+      if (Date.now() >= deadline)
+        return false;
+      await sleep(timing.pollMs + Math.floor(Math.random() * timing.pollMs));
+    }
+  }
+}
+function release(path) {
+  try {
+    if (readHolder(path)?.pid === process.pid)
+      rmSync(path, { force: true });
+  } catch {}
+}
+async function withHandshakeLock(handshake) {
+  if (process.env.CLAUDISH_NO_OP_HANDSHAKE_LOCK === "1") {
+    trace("bypassed (CLAUDISH_NO_OP_HANDSHAKE_LOCK=1)");
+    return handshake();
+  }
+  const path = currentLockPath();
+  const t0 = Date.now();
+  let held = false;
+  try {
+    held = await acquire(path);
+  } catch {
+    held = false;
+  }
+  trace(`${held ? "acquired" : "NOT held (timeout or unwritable)"} after ${Date.now() - t0}ms`);
+  try {
+    return await handshake();
+  } finally {
+    if (held)
+      release(path);
+    trace(`handshake done after ${Date.now() - t0}ms${held ? ", released" : ""}`);
+  }
+}
+var DEFAULT_STALE_MS = 120000, DEFAULT_TIMEOUT_MS = 45000, DEFAULT_POLL_MS = 60, timing, lockPath, sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var init_onepassword_handshake_lock = __esm(() => {
+  timing = {
+    staleMs: DEFAULT_STALE_MS,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+    pollMs: DEFAULT_POLL_MS
+  };
+});
+
 // src/providers/onepassword-wasm.ts
 var exports_onepassword_wasm = {};
 __export(exports_onepassword_wasm, {
@@ -1185,17 +1301,17 @@ __export(exports_onepassword_wasm, {
   SDK_CORE_INTEGRITY: () => SDK_CORE_INTEGRITY
 });
 import { createHash } from "crypto";
-import { copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
 import { createRequire } from "module";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname3, join as join5 } from "path";
 import { gunzipSync } from "zlib";
 function tarballUrl() {
   return `https://registry.npmjs.org/@1password/sdk-core/-/sdk-core-${SDK_CORE_VERSION}.tgz`;
 }
 function cacheWasmPath() {
-  const root = cacheRootOverride ?? join4(homedir4(), ".claudish");
-  return join4(root, "cache", "1password", WASM_FILENAME);
+  const root = cacheRootOverride ?? join5(homedir5(), ".claudish");
+  return join5(root, "cache", "1password", WASM_FILENAME);
 }
 function verifyIntegrity(bytes) {
   const [algo, expected] = SDK_CORE_INTEGRITY.split("-", 2);
@@ -1236,7 +1352,7 @@ function installReadFileSyncIntercept() {
       }
       if (existsSync3(path)) {
         try {
-          mkdirSync3(dirname2(cached), { recursive: true });
+          mkdirSync4(dirname3(cached), { recursive: true });
           copyFileSync(path, cached);
         } catch {}
       }
@@ -1259,7 +1375,7 @@ async function downloadAndCacheWasm() {
   if (!wasm) {
     throw new Error(`1Password runtime archive did not contain ${WASM_TARBALL_ENTRY}`);
   }
-  mkdirSync3(dirname2(cached), { recursive: true });
+  mkdirSync4(dirname3(cached), { recursive: true });
   const tmp = `${cached}.tmp`;
   writeFileSync4(tmp, wasm);
   createRequire(import.meta.url)("node:fs").renameSync(tmp, cached);
@@ -1292,7 +1408,7 @@ function resolveNearbyWasmPath() {
   try {
     const require2 = createRequire(import.meta.url);
     const coreJs = require2.resolve("@1password/sdk-core/nodejs/core.js");
-    const wasm = join4(dirname2(coreJs), WASM_FILENAME);
+    const wasm = join5(dirname3(coreJs), WASM_FILENAME);
     return existsSync3(wasm) ? wasm : null;
   } catch {
     return null;
@@ -1304,7 +1420,7 @@ function seedCacheFromNearbyWasm() {
     return false;
   try {
     const cached = cacheWasmPath();
-    mkdirSync3(dirname2(cached), { recursive: true });
+    mkdirSync4(dirname3(cached), { recursive: true });
     copyFileSync(real, cached);
     return true;
   } catch {
@@ -3658,6 +3774,7 @@ __export(exports_onepassword, {
   valueTail: () => valueTail,
   setScreenLockProbe: () => setScreenLockProbe,
   setLockRetryTiming: () => setLockRetryTiming,
+  setAppLockProbe: () => setAppLockProbe,
   resolveSecretsPartial: () => resolveSecretsPartial,
   resolveSecrets: () => resolveSecrets,
   resolveSdkAuth: () => resolveSdkAuth,
@@ -3682,6 +3799,7 @@ __export(exports_onepassword, {
   isOpHydratedVar: () => isOpHydratedVar,
   isLockedDenial: () => isLockedDenial,
   isGlobImport: () => isGlobImport,
+  isAppLocked: () => isAppLocked,
   globToRegExp: () => globToRegExp,
   getOpFailures: () => getOpFailures,
   filterGlobFields: () => filterGlobFields,
@@ -3692,8 +3810,12 @@ __export(exports_onepassword, {
   defaultSdkClientFactory: () => defaultSdkClientFactory,
   defaultScreenLockProbe: () => defaultScreenLockProbe,
   defaultOpAccountLister: () => defaultOpAccountLister,
+  defaultAppLockProbe: () => defaultAppLockProbe,
+  currentLockCause: () => currentLockCause,
   collectConfigImports: () => collectConfigImports,
+  classifyLockedDenial: () => classifyLockedDenial,
   buildAuthError: () => buildAuthError,
+  appLockedFromSettings: () => appLockedFromSettings,
   acquireSdkClient: () => acquireSdkClient,
   OP_REF_RE: () => OP_REF_RE
 });
@@ -3735,11 +3857,24 @@ function renderOpFailureNotice(envVar) {
   }
   lines.push("");
   if (wasOpAuthorizationDenied()) {
-    lines.push("  The 1Password desktop app declined to release secrets. This happens when");
-    lines.push("  the approval prompt was dismissed, or when your Mac is locked and the");
-    lines.push("  prompt cannot be shown at all.");
-    lines.push("");
-    lines.push("  Fix: unlock the Mac, approve the 1Password prompt, and re-run.");
+    const cause = currentLockCause();
+    if (cause === "screen") {
+      lines.push("  Your Mac is locked, so the 1Password approval prompt cannot be shown.");
+      lines.push("");
+      lines.push("  Fix: unlock the Mac, approve the prompt, and re-run.");
+    } else if (cause === "app") {
+      lines.push("  The 1Password app is LOCKED. With shared lock state (the default) a locked");
+      lines.push("  app refuses the SDK outright \u2014 no approval prompt is ever shown, which is");
+      lines.push("  why nothing appeared on screen.");
+      lines.push("");
+      lines.push("  Fix: unlock 1Password (Touch ID is enough) and re-run.");
+      lines.push("  To stop it re-locking mid-session, raise Settings \u2192 Security \u2192 auto-lock.");
+    } else {
+      lines.push("  The 1Password desktop app declined to release secrets. The approval prompt");
+      lines.push("  was most likely dismissed.");
+      lines.push("");
+      lines.push("  Fix: re-run and approve the 1Password prompt.");
+    }
     lines.push("  Headless (no desktop app): export OP_SERVICE_ACCOUNT_TOKEN='ops_...'");
   } else {
     lines.push("  Fix: check the reference resolves \u2014 claudish config \u2192 1Password tab.");
@@ -4092,25 +4227,57 @@ function setScreenLockProbe(probe) {
 function isScreenLocked() {
   return screenLockProbe();
 }
-function isLockedDenial(err, env = process.env) {
+function appLockedFromSettings(settings, nowSeconds) {
+  if (typeof settings !== "object" || settings === null)
+    return false;
+  const s = settings;
+  if (s["developers.sdkSharedLockState.enabled"] !== true)
+    return false;
+  const last = s["security.authenticatedUnlock.deviceBasedUnlock.lastUnlock"];
+  const after = s["security.authenticatedUnlock.deviceBasedUnlock.askUnlockAfter"];
+  if (typeof last !== "number" || typeof after !== "number")
+    return false;
+  return nowSeconds - last > after;
+}
+function setAppLockProbe(probe) {
+  appLockProbe = probe ?? defaultAppLockProbe;
+}
+function isAppLocked() {
+  return appLockProbe();
+}
+function currentLockCause() {
+  if (isScreenLocked())
+    return "screen";
+  if (isAppLocked())
+    return "app";
+  return null;
+}
+function classifyLockedDenial(err, env = process.env) {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
   if (!msg.includes("denied authorization"))
-    return false;
+    return null;
   if (env.OP_SERVICE_ACCOUNT_TOKEN)
-    return false;
-  return isScreenLocked();
+    return null;
+  return currentLockCause();
 }
-async function countdownForUnlock(round, rounds) {
+function isLockedDenial(err, env = process.env) {
+  return classifyLockedDenial(err, env) !== null;
+}
+async function countdownForUnlock(round, rounds, cause) {
   const ttyOut = process.stderr.isTTY === true;
   const ttyIn = process.stdin.isTTY === true;
   let cancelled = false;
   if (round === 1) {
+    const explain = cause === "screen" ? `${bold("\uD83D\uDD10 1Password needs your OK \u2014 but your Mac is locked, so it can't ask.")}
+   Unlock your Mac and approve the popup. Claudish picks it up from there.` : `${bold("\uD83D\uDD10 1Password is locked, so it turned claudish away without asking you.")}
+   Unlock 1Password (Touch ID is enough). Claudish retries on its own \u2014
+   no popup will appear until it's unlocked.`;
     process.stderr.write(`
-${bold("\uD83D\uDD10 1Password needs your OK \u2014 but your Mac is locked, so it can't ask.")}
-   Unlock your Mac and approve the popup. Claudish picks it up from there.
+${explain}
 
 `);
   }
+  const stillLocked = () => cause === "screen" ? isScreenLocked() : isAppLocked();
   let restoreInput = () => {};
   if (ttyIn) {
     const onKey = (buf) => {
@@ -4141,7 +4308,7 @@ ${bold("\uD83D\uDD10 1Password needs your OK \u2014 but your Mac is locked, so i
     for (let remaining = lockRetrySeconds;remaining > 0; remaining--) {
       if (cancelled)
         break;
-      if (!isScreenLocked())
+      if (!stillLocked())
         break;
       if (ttyOut)
         process.stderr.write(`\r\x1B[2K${line(remaining)}`);
@@ -4164,9 +4331,10 @@ async function withSdkRetry(op, label = "op:sdk-op") {
     try {
       return await withSdkTransientRetry(op, label);
     } catch (err) {
-      if (round > LOCK_RETRY_ROUNDS || !isLockedDenial(err))
+      const cause = classifyLockedDenial(err);
+      if (round > LOCK_RETRY_ROUNDS || cause === null)
         throw err;
-      if (await countdownForUnlock(round, LOCK_RETRY_ROUNDS) === "cancel")
+      if (await countdownForUnlock(round, LOCK_RETRY_ROUNDS, cause) === "cancel")
         throw err;
       resetSdkClientCache();
     }
@@ -4359,11 +4527,12 @@ var OP_REF_RE, opHydratedVars, opSourceFailures, ENV_VAR_NAME_RE, sdkClientCache
       await ensureOpWasmAvailable2();
       return Promise.resolve().then(() => __toESM(require_sdk(), 1));
     });
-    const client = await traceSpan("op:client-handshake", () => createClient({
+    const build2 = () => createClient({
       auth: auth.kind === "token" ? auth.token : new DesktopAuth(auth.accountName),
       integrationName: "claudish",
       integrationVersion: VERSION || "1.0.0"
-    }), { mayIncludeUserPrompt: true, authKind: auth.kind });
+    });
+    const client = await traceSpan("op:client-handshake", () => auth.kind === "token" ? build2() : withHandshakeLock(build2), { mayIncludeUserPrompt: true, authKind: auth.kind });
     return client;
   })();
   sdkClientCache.set(key, build);
@@ -4383,7 +4552,7 @@ var OP_REF_RE, opHydratedVars, opSourceFailures, ENV_VAR_NAME_RE, sdkClientCache
   } catch {
     return false;
   }
-}, screenLockProbe, defaultOpAccountLister = () => {
+}, screenLockProbe, defaultAppLockProbe = () => false, appLockProbe, defaultOpAccountLister = () => {
   try {
     const res = spawnSync("op", ["account", "list", "--format=json"], { encoding: "utf-8" });
     if (res.error || res.status !== 0)
@@ -4412,6 +4581,7 @@ var OP_REF_RE, opHydratedVars, opSourceFailures, ENV_VAR_NAME_RE, sdkClientCache
 };
 var init_onepassword = __esm(() => {
   init_startup_trace();
+  init_onepassword_handshake_lock();
   OP_REF_RE = /^op:\/\/[^\s]+$/;
   opHydratedVars = new Set;
   opSourceFailures = [];
@@ -4420,18 +4590,34 @@ var init_onepassword = __esm(() => {
   sdkQueue = Promise.resolve();
   lockRetrySeconds = LOCK_RETRY_SECONDS;
   screenLockProbe = defaultScreenLockProbe;
+  appLockProbe = defaultAppLockProbe;
 });
 
 // src/auth/credentials/op-source.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
 function warnOnce(message) {
   if (warnedMessages.has(message))
     return;
   warnedMessages.add(message);
   console.error(message);
 }
+function recordOpUnavailableVars(names) {
+  for (const n of names) {
+    if (typeof n === "string" && n.length > 0)
+      opUnavailableVars.add(n);
+  }
+}
+function getOpUnavailableVars() {
+  return [...opUnavailableVars].sort();
+}
+function inheritedUnavailable() {
+  const raw = process.env[OP_UNAVAILABLE_ENV];
+  if (!raw)
+    return new Set;
+  return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
+}
 function saveAccount(accountUrl, scope) {
   try {
     saveOnepasswordAccount(accountUrl, scope);
@@ -4517,10 +4703,10 @@ function readConfigRaw() {
   if (testSeams?.config)
     return testSeams.config;
   try {
-    const configPath = activeGlobalConfigFile(join5(homedir5(), ".claudish", "config.json"));
+    const configPath = activeGlobalConfigFile(join6(homedir6(), ".claudish", "config.json"));
     if (!existsSync4(configPath))
       return {};
-    return JSON.parse(readFileSync3(configPath, "utf-8"));
+    return JSON.parse(readFileSync4(configPath, "utf-8"));
   } catch {
     return {};
   }
@@ -4623,12 +4809,12 @@ async function resolveGlobShared(globPath, auth) {
     return { resolved: await existing, cacheHit: true };
   const spanName = `op:glob-resolve(${maskGlobForTrace(globPath)})`;
   const promise = (async () => {
-    const { resolveGlobImportAll: resolveGlobImportAll2, recordOpHydratedVars: recordOpHydratedVars2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
-    const resolved = await traceSpan(spanName, () => resolveGlobImportAll2(globPath, {
+    const { resolveGlobImportAll: resolveGlobImportAll2, recordOpHydratedVars: recordOpHydratedVars2, withSdkRetry: withSdkRetry2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+    const resolved = await traceSpan(spanName, () => withSdkRetry2(() => resolveGlobImportAll2(globPath, {
       auth,
       sdkFactory: testSeams?.sdkFactory,
       warn: (m) => console.error(m)
-    }));
+    }), spanName));
     addSpanMeta(spanName, { vars: Object.keys(resolved).length });
     for (const [k, v] of Object.entries(resolved)) {
       resolvedCache.set(k, v);
@@ -4650,8 +4836,8 @@ async function resolveEnvironmentShared(envId, auth) {
     return { resolved: await existing, cacheHit: true };
   const spanName = `op:env-resolve(${envId})`;
   const promise = (async () => {
-    const { readEnvironment: readEnvironment2, recordOpHydratedVars: recordOpHydratedVars2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
-    const resolved = await traceSpan(spanName, () => readEnvironment2(envId, { auth, sdkFactory: testSeams?.sdkFactory }));
+    const { readEnvironment: readEnvironment2, recordOpHydratedVars: recordOpHydratedVars2, withSdkRetry: withSdkRetry2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+    const resolved = await traceSpan(spanName, () => withSdkRetry2(() => readEnvironment2(envId, { auth, sdkFactory: testSeams?.sdkFactory }), spanName));
     addSpanMeta(spanName, { vars: Object.keys(resolved).length });
     for (const [k, v] of Object.entries(resolved)) {
       resolvedCache.set(k, v);
@@ -4686,6 +4872,8 @@ async function resolveOpKeyForEnvVars(wanted, opts = {}) {
     else
       stillWanted.add(w);
   }
+  for (const skip of inheritedUnavailable())
+    stillWanted.delete(skip);
   if (stillWanted.size === 0)
     return cached;
   const label = `op:resolve(${[...stillWanted].sort().join(",")})`;
@@ -4712,6 +4900,7 @@ async function resolveOpKeyForEnvVars(wanted, opts = {}) {
       resolvedCache.set(k, v);
       out[k] = v;
     }
+    recordOpUnavailableVars([...wantNow].filter((w) => !(w in resolved)));
     return out;
   }, label);
 }
@@ -4738,7 +4927,13 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
       throw err;
     }
   }
-  const { collectConfigImports: collectConfigImports2, resolveSecrets: resolveSecrets2, recordOpHydratedVars: recordOpHydratedVars2, recordOpFailure: recordOpFailure2 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+  const {
+    collectConfigImports: collectConfigImports2,
+    resolveSecrets: resolveSecrets2,
+    recordOpHydratedVars: recordOpHydratedVars2,
+    recordOpFailure: recordOpFailure2,
+    withSdkRetry: withSdkRetry2
+  } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
   const cfg = readConfigRaw();
   const out = {};
   try {
@@ -4751,10 +4946,7 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
         wantedRefs[envVar] = ref;
     }
     if (Object.keys(wantedRefs).length > 0) {
-      const resolved = await resolveSecrets2(wantedRefs, {
-        auth,
-        sdkFactory: testSeams?.sdkFactory
-      });
+      const resolved = await withSdkRetry2(() => resolveSecrets2(wantedRefs, { auth, sdkFactory: testSeams?.sdkFactory }), "op:resolve-refs");
       Object.assign(out, resolved);
     }
     const stillWanted = new Set([...wanted].filter((w) => !(w in out)));
@@ -4791,10 +4983,7 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
           customRefs[envVar] = apiKey;
       }
       if (Object.keys(customRefs).length > 0) {
-        const resolved = await resolveSecrets2(customRefs, {
-          auth,
-          sdkFactory: testSeams?.sdkFactory
-        });
+        const resolved = await withSdkRetry2(() => resolveSecrets2(customRefs, { auth, sdkFactory: testSeams?.sdkFactory }), "op:resolve-custom-endpoint-refs");
         Object.assign(out, resolved);
       }
     }
@@ -4837,11 +5026,12 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
     recordOpHydratedVars2(Object.keys(out));
   return out;
 }
-var warnedMessages, OpAuthError, cachedSdkAuth, sdkAuthResolved = false, authInFlight, testSeams, sniffed, opQueue, resolvedCache, globResolutions, globResolvedVars, environmentResolutions;
+var warnedMessages, opUnavailableVars, OP_UNAVAILABLE_ENV = "CLAUDISH_OP_UNAVAILABLE", OpAuthError, cachedSdkAuth, sdkAuthResolved = false, authInFlight, testSeams, sniffed, opQueue, resolvedCache, globResolutions, globResolvedVars, environmentResolutions;
 var init_op_source = __esm(() => {
   init_onepassword_config();
   init_startup_trace();
   warnedMessages = new Set;
+  opUnavailableVars = new Set;
   OpAuthError = class OpAuthError extends Error {
     constructor(message) {
       super(message);
@@ -26938,15 +27128,15 @@ __export(exports_profile_config, {
   configExists: () => configExists,
   activeConfigFile: () => activeConfigFile
 });
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname3, join as join6, parse as parse6 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname4, join as join7, parse as parse6 } from "path";
 function activeConfigFile() {
   return activeGlobalConfigFile(CONFIG_FILE);
 }
 function ensureConfigDir() {
   if (!existsSync5(CONFIG_DIR)) {
-    mkdirSync4(CONFIG_DIR, { recursive: true });
+    mkdirSync5(CONFIG_DIR, { recursive: true });
   }
 }
 function loadConfig() {
@@ -26957,7 +27147,7 @@ function loadConfig() {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const content = readFileSync4(activeFile, "utf-8");
+    const content = readFileSync5(activeFile, "utf-8");
     const config2 = JSON.parse(content);
     const merged = {
       version: config2.version || DEFAULT_CONFIG.version,
@@ -27027,26 +27217,26 @@ function getConfigPath() {
   return CONFIG_FILE;
 }
 function getLocalConfigPath() {
-  const home = homedir6();
+  const home = homedir7();
   let dir = process.cwd();
   const root = parse6(dir).root;
   while (dir !== root && dir !== home) {
-    const candidate = join6(dir, LOCAL_CONFIG_FILENAME);
+    const candidate = join7(dir, LOCAL_CONFIG_FILENAME);
     if (existsSync5(candidate))
       return candidate;
-    if (existsSync5(join6(dir, ".git"))) {
+    if (existsSync5(join7(dir, ".git"))) {
       return candidate;
     }
-    dir = dirname3(dir);
+    dir = dirname4(dir);
   }
-  return join6(process.cwd(), LOCAL_CONFIG_FILENAME);
+  return join7(process.cwd(), LOCAL_CONFIG_FILENAME);
 }
 function localConfigExists() {
   return existsSync5(getLocalConfigPath());
 }
 function isProjectDirectory() {
   const cwd = process.cwd();
-  return [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".claudish.json"].some((f) => existsSync5(join6(cwd, f)));
+  return [".git", "package.json", "Cargo.toml", "go.mod", "pyproject.toml", ".claudish.json"].some((f) => existsSync5(join7(cwd, f)));
 }
 function loadLocalConfig() {
   if (getConfigFileOverride())
@@ -27056,7 +27246,7 @@ function loadLocalConfig() {
     return null;
   }
   try {
-    const content = readFileSync4(localPath, "utf-8");
+    const content = readFileSync5(localPath, "utf-8");
     const config2 = JSON.parse(content);
     return {
       ...config2,
@@ -27315,8 +27505,8 @@ function disableLocalProvider(providerName) {
 }
 var CONFIG_DIR, CONFIG_FILE, LOCAL_CONFIG_FILENAME = ".claudish.json", DEFAULT_CONFIG;
 var init_profile_config = __esm(() => {
-  CONFIG_DIR = join6(homedir6(), ".claudish");
-  CONFIG_FILE = join6(CONFIG_DIR, "config.json");
+  CONFIG_DIR = join7(homedir7(), ".claudish");
+  CONFIG_FILE = join7(CONFIG_DIR, "config.json");
   DEFAULT_CONFIG = {
     version: "1.0.0",
     defaultProfile: "default",
@@ -28043,8 +28233,8 @@ var init_provider_definitions = __esm(() => {
 
 // src/auth/credentials/api-key-credential.ts
 import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 function realValue(v) {
   if (!v)
     return;
@@ -28086,7 +28276,7 @@ class ApiKeyCredentialProvider {
     if (!this.oauthFallback)
       return false;
     try {
-      return existsSync6(join7(homedir7(), ".claudish", this.oauthFallback));
+      return existsSync6(join8(homedir8(), ".claudish", this.oauthFallback));
     } catch {
       return false;
     }
@@ -28162,10 +28352,10 @@ var init_api_key_credential = __esm(() => {
 // src/auth/codex-oauth.ts
 import { exec } from "child_process";
 import { createHash as createHash2, randomBytes } from "crypto";
-import { closeSync, existsSync as existsSync7, openSync, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeSync } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync7, openSync as openSync2, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeSync as writeSync2 } from "fs";
 import { createServer } from "http";
-import { homedir as homedir8 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
 import { promisify } from "util";
 
 class CodexOAuth {
@@ -28191,8 +28381,8 @@ class CodexOAuth {
     return this.credentials !== null && !!this.credentials.refresh_token;
   }
   getCredentialsPath() {
-    const claudishDir = join8(homedir8(), ".claudish");
-    return join8(claudishDir, "codex-oauth.json");
+    const claudishDir = join9(homedir9(), ".claudish");
+    return join9(claudishDir, "codex-oauth.json");
   }
   async login() {
     log("[CodexOAuth] Starting OAuth login flow");
@@ -28300,7 +28490,7 @@ Details: ${e.message}`);
       return null;
     }
     try {
-      const data = readFileSync5(credPath, "utf-8");
+      const data = readFileSync6(credPath, "utf-8");
       const credentials = JSON.parse(data);
       if (!credentials.access_token || !credentials.refresh_token || !credentials.expires_at) {
         log("[CodexOAuth] Invalid credentials file structure");
@@ -28315,17 +28505,17 @@ Details: ${e.message}`);
   }
   saveCredentials(credentials) {
     const credPath = this.getCredentialsPath();
-    const claudishDir = join8(homedir8(), ".claudish");
+    const claudishDir = join9(homedir9(), ".claudish");
     if (!existsSync7(claudishDir)) {
-      const { mkdirSync: mkdirSync5 } = __require("fs");
-      mkdirSync5(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync6 } = __require("fs");
+      mkdirSync6(claudishDir, { recursive: true });
     }
-    const fd = openSync(credPath, "w", 384);
+    const fd = openSync2(credPath, "w", 384);
     try {
       const data = JSON.stringify(credentials, null, 2);
-      writeSync(fd, data, 0, "utf-8");
+      writeSync2(fd, data, 0, "utf-8");
     } finally {
-      closeSync(fd);
+      closeSync2(fd);
     }
     log(`[CodexOAuth] Credentials saved to ${credPath}`);
   }
@@ -28626,10 +28816,10 @@ var init_codex_credential = __esm(() => {
 // src/auth/gemini-oauth.ts
 import { exec as exec2 } from "child_process";
 import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
-import { closeSync as closeSync2, existsSync as existsSync8, openSync as openSync2, readFileSync as readFileSync6, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync3, existsSync as existsSync8, openSync as openSync3, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeSync as writeSync3 } from "fs";
 import { createServer as createServer2 } from "http";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 import { promisify as promisify2 } from "util";
 
 class GeminiOAuth {
@@ -28655,8 +28845,8 @@ class GeminiOAuth {
     return this.credentials !== null && !!this.credentials.refresh_token;
   }
   getCredentialsPath() {
-    const claudishDir = join9(homedir9(), ".claudish");
-    return join9(claudishDir, "gemini-oauth.json");
+    const claudishDir = join10(homedir10(), ".claudish");
+    return join10(claudishDir, "gemini-oauth.json");
   }
   async login() {
     log("[GeminiOAuth] Starting OAuth login flow");
@@ -28758,7 +28948,7 @@ Details: ${e.message}`);
       return null;
     }
     try {
-      const data = readFileSync6(credPath, "utf-8");
+      const data = readFileSync7(credPath, "utf-8");
       const credentials = JSON.parse(data);
       if (!credentials.access_token || !credentials.refresh_token || !credentials.expires_at) {
         log("[GeminiOAuth] Invalid credentials file structure");
@@ -28773,17 +28963,17 @@ Details: ${e.message}`);
   }
   saveCredentials(credentials) {
     const credPath = this.getCredentialsPath();
-    const claudishDir = join9(homedir9(), ".claudish");
+    const claudishDir = join10(homedir10(), ".claudish");
     if (!existsSync8(claudishDir)) {
-      const { mkdirSync: mkdirSync5 } = __require("fs");
-      mkdirSync5(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync6 } = __require("fs");
+      mkdirSync6(claudishDir, { recursive: true });
     }
-    const fd = openSync2(credPath, "w", 384);
+    const fd = openSync3(credPath, "w", 384);
     try {
       const data = JSON.stringify(credentials, null, 2);
-      writeSync2(fd, data, 0, "utf-8");
+      writeSync3(fd, data, 0, "utf-8");
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
     log(`[GeminiOAuth] Credentials saved to ${credPath}`);
   }
@@ -29137,18 +29327,18 @@ var init_gemini_oauth = __esm(() => {
 });
 
 // src/auth/oauth-registry.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join11 } from "path";
 function hasValidOAuthCredentials(descriptor) {
-  const credPath = join10(homedir10(), ".claudish", descriptor.credentialFile);
+  const credPath = join11(homedir11(), ".claudish", descriptor.credentialFile);
   if (!existsSync9(credPath))
     return false;
   if (descriptor.validationMode === "file-exists") {
     return true;
   }
   try {
-    const data = JSON.parse(readFileSync7(credPath, "utf-8"));
+    const data = JSON.parse(readFileSync8(credPath, "utf-8"));
     if (!data.access_token)
       return false;
     if (data.refresh_token)
@@ -29258,9 +29448,9 @@ var init_gemini_credential = __esm(() => {
 // src/auth/kimi-oauth.ts
 import { exec as exec3 } from "child_process";
 import { randomBytes as randomBytes3 } from "crypto";
-import { closeSync as closeSync3, existsSync as existsSync10, openSync as openSync3, readFileSync as readFileSync8, unlinkSync as unlinkSync4, writeSync as writeSync3 } from "fs";
-import { homedir as homedir11, hostname as hostname3, platform, release } from "os";
-import { join as join11 } from "path";
+import { closeSync as closeSync4, existsSync as existsSync10, openSync as openSync4, readFileSync as readFileSync9, unlinkSync as unlinkSync4, writeSync as writeSync4 } from "fs";
+import { homedir as homedir12, hostname as hostname3, platform, release as release2 } from "os";
+import { join as join12 } from "path";
 import { promisify as promisify3 } from "util";
 
 class KimiOAuth {
@@ -29288,23 +29478,23 @@ class KimiOAuth {
     return this.credentials !== null && !!this.credentials.refresh_token;
   }
   getCredentialsPath() {
-    const claudishDir = join11(homedir11(), ".claudish");
-    return join11(claudishDir, "kimi-oauth.json");
+    const claudishDir = join12(homedir12(), ".claudish");
+    return join12(claudishDir, "kimi-oauth.json");
   }
   getDeviceIdPath() {
-    const claudishDir = join11(homedir11(), ".claudish");
-    return join11(claudishDir, "kimi-device-id");
+    const claudishDir = join12(homedir12(), ".claudish");
+    return join12(claudishDir, "kimi-device-id");
   }
   loadOrCreateDeviceId() {
     const deviceIdPath = this.getDeviceIdPath();
-    const claudishDir = join11(homedir11(), ".claudish");
+    const claudishDir = join12(homedir12(), ".claudish");
     if (!existsSync10(claudishDir)) {
-      const { mkdirSync: mkdirSync5 } = __require("fs");
-      mkdirSync5(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync6 } = __require("fs");
+      mkdirSync6(claudishDir, { recursive: true });
     }
     if (existsSync10(deviceIdPath)) {
       try {
-        const deviceId2 = readFileSync8(deviceIdPath, "utf-8").trim();
+        const deviceId2 = readFileSync9(deviceIdPath, "utf-8").trim();
         if (deviceId2) {
           return deviceId2;
         }
@@ -29314,11 +29504,11 @@ class KimiOAuth {
     }
     const deviceId = randomBytes3(16).toString("hex").replace(/(.{8})(.{4})(.{4})(.{4})(.{12})/, "$1-$2-$3-$4-$5");
     try {
-      const fd = openSync3(deviceIdPath, "w", 384);
+      const fd = openSync4(deviceIdPath, "w", 384);
       try {
-        writeSync3(fd, deviceId, 0, "utf-8");
+        writeSync4(fd, deviceId, 0, "utf-8");
       } finally {
-        closeSync3(fd);
+        closeSync4(fd);
       }
       log(`[KimiOAuth] New device ID created: ${deviceId}`);
     } catch (e) {
@@ -29335,7 +29525,7 @@ class KimiOAuth {
       "X-Msh-Version": this.getVersion(),
       "X-Msh-Device-Name": hostname3(),
       "X-Msh-Device-Model": `${platform()}-${process.arch}`,
-      "X-Msh-Os-Version": release(),
+      "X-Msh-Os-Version": release2(),
       "X-Msh-Device-Id": this.deviceId
     };
   }
@@ -29563,7 +29753,7 @@ Details: ${e.message}`);
       return null;
     }
     try {
-      const data = readFileSync8(credPath, "utf-8");
+      const data = readFileSync9(credPath, "utf-8");
       const credentials = JSON.parse(data);
       if (!credentials.access_token || !credentials.refresh_token || !credentials.expires_at || !credentials.scope || !credentials.token_type) {
         log("[KimiOAuth] Invalid credentials file structure");
@@ -29578,17 +29768,17 @@ Details: ${e.message}`);
   }
   saveCredentials(credentials) {
     const credPath = this.getCredentialsPath();
-    const claudishDir = join11(homedir11(), ".claudish");
+    const claudishDir = join12(homedir12(), ".claudish");
     if (!existsSync10(claudishDir)) {
-      const { mkdirSync: mkdirSync5 } = __require("fs");
-      mkdirSync5(claudishDir, { recursive: true });
+      const { mkdirSync: mkdirSync6 } = __require("fs");
+      mkdirSync6(claudishDir, { recursive: true });
     }
-    const fd = openSync3(credPath, "w", 384);
+    const fd = openSync4(credPath, "w", 384);
     try {
       const data = JSON.stringify(credentials, null, 2);
-      writeSync3(fd, data, 0, "utf-8");
+      writeSync4(fd, data, 0, "utf-8");
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
     log(`[KimiOAuth] Credentials saved to ${credPath}`);
   }
@@ -29754,8 +29944,8 @@ var init_native_anthropic_credential = __esm(() => {
 // src/auth/vertex-auth.ts
 import { exec as exec4 } from "child_process";
 import { existsSync as existsSync11 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir13 } from "os";
+import { join as join13 } from "path";
 import { promisify as promisify4 } from "util";
 
 class VertexAuthManager {
@@ -29810,7 +30000,7 @@ class VertexAuthManager {
   }
   async tryADC() {
     try {
-      const adcPath = join12(homedir12(), ".config/gcloud/application_default_credentials.json");
+      const adcPath = join13(homedir13(), ".config/gcloud/application_default_credentials.json");
       if (!existsSync11(adcPath)) {
         log("[VertexAuth] ADC credentials file not found");
         return null;
@@ -29874,7 +30064,7 @@ function validateVertexOAuthConfig() {
 ` + `  export VERTEX_PROJECT='your-gcp-project-id'
 ` + "  export VERTEX_LOCATION='us-central1'  # optional";
   }
-  const adcPath = join12(homedir12(), ".config/gcloud/application_default_credentials.json");
+  const adcPath = join13(homedir13(), ".config/gcloud/application_default_credentials.json");
   const hasADC = existsSync11(adcPath);
   const hasServiceAccount = !!process.env.GOOGLE_APPLICATION_CREDENTIALS;
   if (!hasADC && !hasServiceAccount) {
@@ -30422,15 +30612,15 @@ var init_routing_hints = __esm(() => {
 });
 
 // src/providers/all-models-cache.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir13 } from "os";
-import { dirname as dirname4, join as join13 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir14 } from "os";
+import { dirname as dirname5, join as join14 } from "path";
 function readAllModelsCache(path = ALL_MODELS_CACHE_PATH) {
   if (!existsSync12(path))
     return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync9(path, "utf-8"));
+    raw = JSON.parse(readFileSync10(path, "utf-8"));
   } catch {
     return null;
   }
@@ -30455,12 +30645,12 @@ function writeAllModelsCache(data, path = ALL_MODELS_CACHE_PATH) {
     entries: data.entries ?? existing?.entries ?? [],
     models: data.models ?? existing?.models ?? []
   };
-  mkdirSync5(dirname4(path), { recursive: true });
+  mkdirSync6(dirname5(path), { recursive: true });
   writeFileSync6(path, JSON.stringify(merged), "utf-8");
 }
 var ALL_MODELS_CACHE_PATH;
 var init_all_models_cache = __esm(() => {
-  ALL_MODELS_CACHE_PATH = join13(homedir13(), ".claudish", "all-models.json");
+  ALL_MODELS_CACHE_PATH = join14(homedir14(), ".claudish", "all-models.json");
 });
 
 // src/adapters/model-catalog.ts
@@ -31287,10 +31477,21 @@ async function prehydrateCredentialsForSpawn(models) {
     return;
   try {
     await validateApiKeysForModels(wanted);
+    publishOpSkipList();
   } catch {}
 }
+function publishOpSkipList() {
+  if (getOpFailures().length > 0)
+    return;
+  const unavailable = getOpUnavailableVars();
+  if (unavailable.length === 0)
+    return;
+  process.env[OP_UNAVAILABLE_ENV] = unavailable.join(",");
+}
 var init_prehydrate = __esm(() => {
+  init_onepassword();
   init_provider_resolver();
+  init_op_source();
 });
 
 // src/channel/diagnostics.ts
@@ -31545,9 +31746,9 @@ var init_signal_watcher = __esm(() => {
 // src/channel/session-manager.ts
 import { spawn } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { createWriteStream, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir14 } from "os";
-import { join as join14 } from "path";
+import { createWriteStream, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir15 } from "os";
+import { join as join15 } from "path";
 
 class SessionManager {
   sessions = new Map;
@@ -31567,10 +31768,10 @@ class SessionManager {
     const sessionId = randomUUID2().slice(0, 8);
     const timeout = Math.min(opts.timeoutSeconds ?? DEFAULT_TIMEOUT, MAX_TIMEOUT);
     const startedAt = new Date().toISOString();
-    const sessionDir = join14(homedir14(), ".claudish", "sessions", sessionId);
-    mkdirSync6(sessionDir, { recursive: true });
+    const sessionDir = join15(homedir15(), ".claudish", "sessions", sessionId);
+    mkdirSync7(sessionDir, { recursive: true });
     if (opts.prompt) {
-      writeFileSync7(join14(sessionDir, "prompt.md"), opts.prompt, "utf-8");
+      writeFileSync7(join15(sessionDir, "prompt.md"), opts.prompt, "utf-8");
     }
     const args = ["--model", opts.model, "-y", "--stdin", "--quiet", ...opts.claudishFlags ?? []];
     const proc = spawn("claudish", args, {
@@ -31597,7 +31798,7 @@ class SessionManager {
         });
       }
     });
-    const outputLogStream = createWriteStream(join14(sessionDir, "output.log"));
+    const outputLogStream = createWriteStream(join15(sessionDir, "output.log"));
     const entry = {
       info: {
         sessionId,
@@ -31644,9 +31845,9 @@ class SessionManager {
       watcher.processExited(code);
       outputLogStream.end();
       if (entry.stderr) {
-        writeFileSync7(join14(sessionDir, "stderr.log"), entry.stderr, "utf-8");
+        writeFileSync7(join15(sessionDir, "stderr.log"), entry.stderr, "utf-8");
       }
-      writeFileSync7(join14(sessionDir, "meta.json"), JSON.stringify(entry.info, null, 2), "utf-8");
+      writeFileSync7(join15(sessionDir, "meta.json"), JSON.stringify(entry.info, null, 2), "utf-8");
       this.cleanupSigint();
     });
     proc.on("error", (err) => {
@@ -31819,9 +32020,9 @@ var init_cache_ttl = __esm(() => {
 });
 
 // src/model-loader.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir15 } from "os";
-import { join as join15 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir16 } from "os";
+import { join as join16 } from "path";
 function groupRecommendedModels(entries) {
   const byId = new Map;
   for (const entry of entries) {
@@ -31919,7 +32120,7 @@ async function getRecommendedModels(opts = {}) {
   }
   if (!forceRefresh && existsSync13(RECOMMENDED_MODELS_CACHE_PATH)) {
     try {
-      const cacheData = JSON.parse(readFileSync10(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
+      const cacheData = JSON.parse(readFileSync11(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
       if (cacheData.models && cacheData.models.length > 0 && isFreshEnough(cacheData)) {
         _cachedRecommendedModels = cacheData;
         return cacheData;
@@ -31935,8 +32136,8 @@ async function getRecommendedModels(opts = {}) {
       if (data.models && data.models.length > 0) {
         _cachedRecommendedModels = data;
         try {
-          const cacheDir = join15(homedir15(), ".claudish");
-          mkdirSync7(cacheDir, { recursive: true });
+          const cacheDir = join16(homedir16(), ".claudish");
+          mkdirSync8(cacheDir, { recursive: true });
           writeFileSync8(RECOMMENDED_MODELS_CACHE_PATH, JSON.stringify(data), "utf-8");
         } catch {}
         return data;
@@ -31950,7 +32151,7 @@ function getRecommendedModelsSync() {
     return _cachedRecommendedModels;
   if (existsSync13(RECOMMENDED_MODELS_CACHE_PATH)) {
     try {
-      const cacheData = JSON.parse(readFileSync10(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
+      const cacheData = JSON.parse(readFileSync11(RECOMMENDED_MODELS_CACHE_PATH, "utf-8"));
       if (cacheData.models && cacheData.models.length > 0 && isFreshEnough(cacheData)) {
         _cachedRecommendedModels = cacheData;
         return cacheData;
@@ -32074,7 +32275,7 @@ var _cachedModelInfo = null, _cachedModelIds = null, _cachedRecommendedModels =
 var init_model_loader = __esm(() => {
   init_cache_ttl();
   FIREBASE_RECOMMENDED_URL = `${FIREBASE_BASE_URL}?catalog=recommended`;
-  RECOMMENDED_MODELS_CACHE_PATH = join15(homedir15(), ".claudish", "recommended-models-cache.json");
+  RECOMMENDED_MODELS_CACHE_PATH = join16(homedir16(), ".claudish", "recommended-models-cache.json");
   FIREBASE_SLUG_TO_PROVIDER_NAME = {
     openai: "openai",
     google: "google",
@@ -32122,6 +32323,44 @@ async function isPortAvailable(port) {
 }
 var init_port_manager = () => {};
 
+// src/redact.ts
+function isPlaceholder(value) {
+  return PLACEHOLDER.test(value.trim());
+}
+function redactSecrets(text) {
+  if (!text)
+    return "";
+  let out = text;
+  out = out.replace(ASSIGNMENT_RE, (match, lhs, value) => isPlaceholder(value) ? match : `${lhs}${MASK}`);
+  for (const { re } of TOKEN_PATTERNS) {
+    out = out.replace(re, (match) => {
+      const scheme = /^(Bearer|Basic|Token)\s/.exec(match);
+      return scheme ? `${scheme[1]} ${MASK}` : MASK;
+    });
+  }
+  return out;
+}
+function sanitizeForReport(text) {
+  if (!text)
+    return "";
+  return redactSecrets(text).replace(/\/Users\/[^/\s]+/g, "/Users/***").replace(/\/home\/[^/\s]+/g, "/home/***").replace(/[A-Z]:\\Users\\[^\\\s]+/gi, "C:\\Users\\***").replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, "***@***.***");
+}
+var MASK = "***REDACTED***", PLACEHOLDER, ASSIGNMENT_RE, TOKEN_PATTERNS;
+var init_redact = __esm(() => {
+  PLACEHOLDER = /^(['"`]?)(your[-_a-z0-9]*|<[^>]*>|\.\.\.|x{3,}|\*{3,}|REDACTED|CHANGEME|TODO|\$\{[^}]*\}|)(['"`]?)$/i;
+  ASSIGNMENT_RE = /(["']?\b[A-Z][A-Z0-9_]*(?:_API_KEY|_KEY|_TOKEN|_SECRET|_PASSWORD)\b["']?\s*[:=]\s*)(["'`]?\$\{[^}]*\}["'`]?|["'`]?[^\s"'`,}]+["'`]?)/g;
+  TOKEN_PATTERNS = [
+    { name: "sk", re: /\bsk-[A-Za-z0-9_-]{16,}/g },
+    { name: "google", re: /\bAIza[A-Za-z0-9_-]{20,}/g },
+    { name: "xai", re: /\bxai-[A-Za-z0-9_-]{16,}/g },
+    { name: "github", re: /\bgh[posur]_[A-Za-z0-9]{20,}/g },
+    { name: "aws", re: /\bAKIA[0-9A-Z]{12,}/g },
+    { name: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g },
+    { name: "zhipu", re: /\b[0-9a-f]{32}\.[A-Za-z0-9]{16}\b/g },
+    { name: "bearer", re: /\b(?:Bearer|Basic|Token)\s+[A-Za-z0-9_.\-+/=]{12,}/g }
+  ];
+});
+
 // ../../node_modules/.bun/hono@4.10.6/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
@@ -34115,9 +34354,12 @@ function transformOpenAIToClaude(claudeRequestInput) {
 var init_transform = () => {};
 
 // src/handlers/shared/format/openai-tools.ts
+function emptyParamsSchema() {
+  return { type: "object", properties: {} };
+}
 function sanitizeSchemaForOpenAI(schema) {
   if (!schema || typeof schema !== "object") {
-    return removeUriFormat(schema);
+    return emptyParamsSchema();
   }
   let root = { ...schema };
   const combinerKey = ["oneOf", "anyOf", "allOf"].find((k) => Array.isArray(root[k]) && root[k].length > 0);
@@ -34159,8 +34401,8 @@ function summarizeToolDescription(name, description) {
   return firstSentence;
 }
 function summarizeToolParameters(schema) {
-  if (!schema)
-    return schema;
+  if (!schema || typeof schema !== "object")
+    return emptyParamsSchema();
   const summarized = sanitizeSchemaForOpenAI({ ...schema });
   if (summarized.properties) {
     for (const prop of Object.values(summarized.properties)) {
@@ -35122,7 +35364,21 @@ function createStreamingState() {
     accumulatedText: ""
   };
 }
-function createStreamingResponseHandler(c, response, adapter, target, middlewareManager, onTokenUpdate, toolSchemas, toolNameMap, priorInputTokens) {
+function createStreamingResponseHandler(c, response, adapter, target, middlewareManager, onTokenUpdate, toolSchemas, toolNameMap, priorInputTokens, behavior) {
+  const repairArgs = (toolName, argsJson) => {
+    if (!behavior?.onToolCall)
+      return argsJson;
+    try {
+      const repaired = behavior.onToolCall(toolName, argsJson);
+      if (typeof repaired === "string" && repaired !== argsJson) {
+        log(`[Streaming] tool call repaired by behavior layer: ${toolName}`);
+        return repaired;
+      }
+    } catch (err) {
+      log(`[Streaming] behavior onToolCall threw for ${toolName}: ${err}`);
+    }
+    return argsJson;
+  };
   log(`[Streaming] ===== HANDLER STARTED for ${target} =====`);
   let isClosed = false;
   let ping = null;
@@ -35187,7 +35443,10 @@ data: ${JSON.stringify(d)}
             send("content_block_delta", {
               type: "content_block_delta",
               index: toolIdx,
-              delta: { type: "input_json_delta", partial_json: JSON.stringify(tc.arguments) }
+              delta: {
+                type: "input_json_delta",
+                partial_json: repairArgs(tc.name, JSON.stringify(tc.arguments))
+              }
             });
             send("content_block_stop", { type: "content_block_stop", index: toolIdx });
           }
@@ -35203,7 +35462,7 @@ data: ${JSON.stringify(d)}
             if (toolSchemas && toolSchemas.length > 0) {
               const validation = validateToolArguments(t.name, t.arguments, toolSchemas, state.accumulatedText);
               if (validation.valid || validation.repaired && validation.repairedArgs) {
-                const argsJson = JSON.stringify(validation.repaired ? validation.repairedArgs : validation.parsedArgs);
+                const argsJson = repairArgs(t.name, JSON.stringify(validation.repaired ? validation.repairedArgs : validation.parsedArgs));
                 log(`[Streaming] Sending buffered tool call (finish_reason!=tool_calls): ${t.name} with args: ${argsJson}`);
                 send("content_block_start", {
                   type: "content_block_start",
@@ -35226,7 +35485,7 @@ data: ${JSON.stringify(d)}
                 t.closed = true;
               }
             } else {
-              const argsJson = t.arguments || "{}";
+              const argsJson = repairArgs(t.name, t.arguments || "{}");
               log(`[Streaming] Sending buffered tool call (no validation): ${t.name} with args: ${argsJson}`);
               send("content_block_start", {
                 type: "content_block_start",
@@ -35423,7 +35682,7 @@ data: ${JSON.stringify(d)}
                           started: false,
                           closed: false,
                           arguments: "",
-                          buffered: !!toolSchemas && toolSchemas.length > 0
+                          buffered: !!toolSchemas && toolSchemas.length > 0 || behavior?.shouldBufferTool?.(restoredName) === true
                         };
                         state.tools.set(idx, t);
                         if (isWebSearchToolCall(restoredName)) {
@@ -35462,7 +35721,7 @@ data: ${JSON.stringify(d)}
                       const validation = validateToolArguments(t.name, t.arguments, toolSchemas, state.accumulatedText);
                       if (validation.repaired && validation.repairedArgs) {
                         log(`[Streaming] Tool call ${t.name} was repaired with inferred parameters`);
-                        const repairedJson = JSON.stringify(validation.repairedArgs);
+                        const repairedJson = repairArgs(t.name, JSON.stringify(validation.repairedArgs));
                         log(`[Streaming] Sending repaired tool call: ${t.name} with args: ${repairedJson}`);
                         if (t.buffered && !t.started) {
                           send("content_block_start", {
@@ -35538,7 +35797,7 @@ data: ${JSON.stringify(d)}
                         continue;
                       }
                       if (t.buffered && !t.started) {
-                        const argsJson = JSON.stringify(validation.parsedArgs);
+                        const argsJson = repairArgs(t.name, JSON.stringify(validation.parsedArgs));
                         send("content_block_start", {
                           type: "content_block_start",
                           index: t.blockIndex,
@@ -37720,7 +37979,7 @@ var init_openai = __esm(() => {
 });
 
 // src/providers/catalog-query.ts
-import { statSync } from "fs";
+import { statSync as statSync2 } from "fs";
 function project(entry) {
   return {
     modelId: entry.modelId,
@@ -37733,7 +37992,7 @@ function project(entry) {
 function getCachedEntries() {
   let mtimeMs;
   try {
-    mtimeMs = statSync(ALL_MODELS_CACHE_PATH).mtimeMs;
+    mtimeMs = statSync2(ALL_MODELS_CACHE_PATH).mtimeMs;
   } catch {
     return null;
   }
@@ -37908,24 +38167,24 @@ var init_vision_proxy = __esm(() => {
 // src/stats-buffer.ts
 import {
   existsSync as existsSync14,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync11,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync12,
   renameSync,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync9
 } from "fs";
-import { homedir as homedir16 } from "os";
-import { join as join16 } from "path";
+import { homedir as homedir17 } from "os";
+import { join as join17 } from "path";
 function ensureDir() {
   if (!existsSync14(CLAUDISH_DIR)) {
-    mkdirSync8(CLAUDISH_DIR, { recursive: true });
+    mkdirSync9(CLAUDISH_DIR, { recursive: true });
   }
 }
 function readFromDisk() {
   try {
     if (!existsSync14(BUFFER_FILE))
       return [];
-    const raw2 = readFileSync11(BUFFER_FILE, "utf-8");
+    const raw2 = readFileSync12(BUFFER_FILE, "utf-8");
     const parsed = JSON.parse(raw2);
     if (!Array.isArray(parsed.events))
       return [];
@@ -37950,7 +38209,7 @@ function writeToDisk(events) {
     ensureDir();
     const trimmed = enforceSizeCap([...events]);
     const payload = { version: 1, events: trimmed };
-    const tmpFile = join16(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
+    const tmpFile = join17(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
     writeFileSync9(tmpFile, JSON.stringify(payload, null, 2), "utf-8");
     renameSync(tmpFile, BUFFER_FILE);
     memoryCache = trimmed;
@@ -38023,8 +38282,8 @@ function syncFlushOnExit() {
 var BUFFER_MAX_BYTES, CLAUDISH_DIR, BUFFER_FILE, memoryCache = null, eventsSinceLastFlush = 0, flushScheduled = false;
 var init_stats_buffer = __esm(() => {
   BUFFER_MAX_BYTES = 64 * 1024;
-  CLAUDISH_DIR = join16(homedir16(), ".claudish");
-  BUFFER_FILE = join16(CLAUDISH_DIR, "stats-buffer.json");
+  CLAUDISH_DIR = join17(homedir17(), ".claudish");
+  BUFFER_FILE = join17(CLAUDISH_DIR, "stats-buffer.json");
   process.on("exit", syncFlushOnExit);
   process.on("SIGTERM", () => {
     try {
@@ -39206,6 +39465,70 @@ var init_stream_head_sniffer = __esm(() => {
 });
 
 // src/handlers/shared/stream-parsers/anthropic-sse.ts
+function createToolRepairInterceptor(opts) {
+  const heldTools = new Map;
+  const flush = (index, stopFrame) => {
+    const held = heldTools.get(index);
+    if (!held)
+      return stopFrame;
+    heldTools.delete(index);
+    let finalArgs = held.args;
+    try {
+      const repaired = opts.repairToolArgs?.(held.name, finalArgs);
+      if (typeof repaired === "string" && repaired !== finalArgs) {
+        log(`[AnthropicSSE] tool call repaired: ${held.name}`);
+        finalArgs = repaired;
+      }
+    } catch (err) {
+      log(`[AnthropicSSE] repairToolArgs threw for ${held.name}: ${err}`);
+    }
+    const deltaFrame = `event: content_block_delta
+data: ${JSON.stringify({
+      type: "content_block_delta",
+      index,
+      delta: { type: "input_json_delta", partial_json: finalArgs }
+    })}
+
+`;
+    return `${deltaFrame}${stopFrame}`;
+  };
+  const noteToolStart = (data) => {
+    if (data.content_block?.type !== "tool_use")
+      return;
+    const name = data.content_block.name;
+    if (typeof name !== "string")
+      return;
+    if (!opts.shouldBufferTool?.(name))
+      return;
+    heldTools.set(data.index, { name, args: "" });
+  };
+  const absorbFragment = (data) => {
+    if (data.delta?.type !== "input_json_delta")
+      return false;
+    const held = heldTools.get(data.index);
+    if (!held)
+      return false;
+    held.args += data.delta.partial_json ?? "";
+    return true;
+  };
+  return (data, line) => {
+    const asIs = `${line}
+`;
+    if (!opts.repairToolArgs || !opts.shouldBufferTool)
+      return asIs;
+    switch (data?.type) {
+      case "content_block_start":
+        noteToolStart(data);
+        return asIs;
+      case "content_block_delta":
+        return absorbFragment(data) ? null : asIs;
+      case "content_block_stop":
+        return heldTools.has(data.index) ? flush(data.index, asIs) : asIs;
+      default:
+        return asIs;
+    }
+  };
+}
 function createAnthropicPassthroughStream(c, response, opts) {
   const encoder = new TextEncoder;
   const decoder = new TextDecoder;
@@ -39213,6 +39536,14 @@ function createAnthropicPassthroughStream(c, response, opts) {
   let lastActivity = Date.now();
   let pingInterval = null;
   const filterThinking = opts.adapter?.shouldFilterThinking() ?? false;
+  const interceptToolFrame = createToolRepairInterceptor(opts);
+  const enqueueData = (controller, data, line) => {
+    if (isClosed)
+      return;
+    const out = interceptToolFrame(data, line);
+    if (out !== null)
+      controller.enqueue(encoder.encode(out));
+  };
   return c.body(new ReadableStream({
     async start(controller) {
       const sendPing = () => {
@@ -39295,10 +39626,7 @@ data: ${JSON.stringify({
 `));
                   }
                 } else {
-                  if (!isClosed) {
-                    controller.enqueue(encoder.encode(`${line}
-`));
-                  }
+                  enqueueData(controller, data, line);
                 }
               } catch {
                 if (!isClosed) {
@@ -39330,10 +39658,7 @@ data: ${JSON.stringify({
                     }
                     return;
                   }
-                  if (!isClosed) {
-                    controller.enqueue(encoder.encode(`${line}
-`));
-                  }
+                  enqueueData(controller, data, line);
                   if (data.message?.usage) {
                     inputTokens = data.message.usage.input_tokens || inputTokens;
                     outputTokens = data.message.usage.output_tokens || outputTokens;
@@ -39628,7 +39953,18 @@ data: ${JSON.stringify(data)}
                     const toolIdx = toolCalls.size;
                     const toolId = `toolu_${Date.now()}_${toolIdx}`;
                     const blockIndex = curIdx++;
-                    const args = JSON.stringify(part.functionCall.args || {});
+                    let args = JSON.stringify(part.functionCall.args || {});
+                    if (opts.repairToolArgs) {
+                      try {
+                        const repaired = opts.repairToolArgs(part.functionCall.name, args);
+                        if (typeof repaired === "string" && repaired !== args) {
+                          log(`[GeminiSSE] tool call repaired: ${part.functionCall.name}`);
+                          args = repaired;
+                        }
+                      } catch (err) {
+                        log(`[GeminiSSE] repairToolArgs threw for ${part.functionCall.name}: ${err}`);
+                      }
+                    }
                     const t = {
                       id: toolId,
                       name: part.functionCall.name,
@@ -40227,9 +40563,9 @@ var init_openai_responses_sse = __esm(() => {
 });
 
 // src/handlers/shared/token-tracker.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
-import { homedir as homedir17 } from "os";
-import { join as join17 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir18 } from "os";
+import { dirname as dirname6, join as join18 } from "path";
 
 class TokenTracker {
   port;
@@ -40372,9 +40708,10 @@ class TokenTracker {
       if (this.quotaRemaining !== undefined) {
         data.quota_remaining = this.quotaRemaining;
       }
-      const claudishDir = join17(homedir17(), ".claudish");
-      mkdirSync9(claudishDir, { recursive: true });
-      writeFileSync10(join17(claudishDir, `tokens-${this.port}.json`), JSON.stringify(data), "utf-8");
+      const override = process.env.CLAUDISH_TOKEN_FILE;
+      const outPath = override || join18(homedir18(), ".claudish", `tokens-${this.port}.json`);
+      mkdirSync10(dirname6(outPath), { recursive: true });
+      writeFileSync10(outPath, JSON.stringify(data), "utf-8");
     } catch (e) {
       log(`[TokenTracker] Error writing token file: ${e}`);
     }
@@ -40960,7 +41297,10 @@ class ComposedHandler {
     const priorInputTokens = this.tokenTracker.getLastInputTokens();
     switch (streamFormat) {
       case "openai-sse":
-        return createStreamingResponseHandler(c, response, adapter, this.bareModelName, this.middlewareManager, onTokenUpdate, claudeRequest.tools, toolNameMap, priorInputTokens);
+        return createStreamingResponseHandler(c, response, adapter, this.bareModelName, this.middlewareManager, onTokenUpdate, claudeRequest.tools, toolNameMap, priorInputTokens, behaviorSession && {
+          shouldBufferTool: (name) => behaviorSession.interceptsTool(name),
+          onToolCall: (name, argsJson) => behaviorSession.repairToolCall(name, argsJson)
+        });
       case "openai-responses-sse":
         return createResponsesStreamHandler(c, response, {
           modelName: this.bareModelName,
@@ -40977,7 +41317,9 @@ class ComposedHandler {
         return createAnthropicPassthroughStream(c, response, {
           modelName: this.bareModelName,
           onTokenUpdate,
-          adapter
+          adapter,
+          shouldBufferTool: (name) => behaviorSession?.interceptsTool(name) ?? false,
+          repairToolArgs: (name, argsJson) => behaviorSession?.repairToolCall(name, argsJson) ?? null
         });
       case "gemini-sse": {
         const onToolCall = (toolId, name, thoughtSignature) => {
@@ -40991,6 +41333,7 @@ class ComposedHandler {
           middlewareManager: this.middlewareManager,
           onTokenUpdate,
           onToolCall,
+          repairToolArgs: (name, argsJson) => behaviorSession?.repairToolCall(name, argsJson) ?? null,
           unwrapResponse: this.options.unwrapGeminiResponse,
           priorInputTokens
         });
@@ -42871,11 +43214,11 @@ var init_ollama_api_format = __esm(() => {
 });
 
 // src/providers/api-key-provenance.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir18 } from "os";
-import { join as join18, resolve as resolve2 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir19 } from "os";
+import { join as join19, resolve as resolve2 } from "path";
 function activeConfigPath() {
-  return activeGlobalConfigFile(join18(homedir18(), ".claudish", "config.json"));
+  return activeGlobalConfigFile(join19(homedir19(), ".claudish", "config.json"));
 }
 function configLayerLabel() {
   return getConfigFileOverride() ? activeConfigPath() : "~/.claudish/config.json";
@@ -42954,7 +43297,7 @@ function readDotenvKey(envVars) {
     const dotenvPath = resolve2(".env");
     if (!existsSync15(dotenvPath))
       return null;
-    const parsed = import_dotenv.parse(readFileSync12(dotenvPath, "utf-8"));
+    const parsed = import_dotenv.parse(readFileSync13(dotenvPath, "utf-8"));
     for (const v of envVars) {
       if (parsed[v])
         return parsed[v];
@@ -42969,7 +43312,7 @@ function readConfigKey(envVar) {
     const configPath = activeConfigPath();
     if (!existsSync15(configPath))
       return null;
-    const cfg = JSON.parse(readFileSync12(configPath, "utf-8"));
+    const cfg = JSON.parse(readFileSync13(configPath, "utf-8"));
     return cfg.apiKeys?.[envVar] || null;
   } catch {
     return null;
@@ -44527,9 +44870,9 @@ var init_poe = __esm(() => {
 });
 
 // src/services/pricing-cache.ts
-import { existsSync as existsSync16, readFileSync as readFileSync13, statSync as statSync2 } from "fs";
-import { homedir as homedir19 } from "os";
-import { join as join19 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14, statSync as statSync3 } from "fs";
+import { homedir as homedir20 } from "os";
+import { join as join20 } from "path";
 function prefixMatch(modelName) {
   for (const [key, pricing] of pricingMap) {
     if (modelName.startsWith(key))
@@ -44569,10 +44912,10 @@ function loadDiskCache() {
   try {
     if (!existsSync16(CACHE_FILE))
       return false;
-    const stat = statSync2(CACHE_FILE);
+    const stat = statSync3(CACHE_FILE);
     const age = Date.now() - stat.mtimeMs;
     const isFresh = age < CACHE_TTL_MS2;
-    const raw2 = readFileSync13(CACHE_FILE, "utf-8");
+    const raw2 = readFileSync14(CACHE_FILE, "utf-8");
     const data = JSON.parse(raw2);
     for (const [key, pricing] of Object.entries(data)) {
       pricingMap.set(key, pricing);
@@ -44588,8 +44931,8 @@ var init_pricing_cache = __esm(() => {
   init_logger();
   init_catalog_query();
   pricingMap = new Map;
-  CACHE_DIR = join19(homedir19(), ".claudish");
-  CACHE_FILE = join19(CACHE_DIR, "pricing-cache.json");
+  CACHE_DIR = join20(homedir20(), ".claudish");
+  CACHE_FILE = join20(CACHE_DIR, "pricing-cache.json");
   CACHE_TTL_MS2 = 24 * 60 * 60 * 1000;
 });
 
@@ -45045,6 +45388,175 @@ var init_proxy_server = __esm(() => {
   };
 });
 
+// src/team-stats.ts
+import { existsSync as existsSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync11 } from "fs";
+import { join as join21 } from "path";
+function statsDir(sessionPath) {
+  return join21(sessionPath, "stats");
+}
+function tokenFileFor(sessionPath, anonId) {
+  return join21(statsDir(sessionPath), `${anonId}.json`);
+}
+function readTokenStats(sessionPath, anonId) {
+  const path = tokenFileFor(sessionPath, anonId);
+  if (!existsSync17(path))
+    return null;
+  try {
+    return JSON.parse(readFileSync15(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function fmtTokens(n) {
+  if (!n || n <= 0)
+    return "0";
+  if (n < 1000)
+    return String(n);
+  if (n < 1e6)
+    return `${(n / 1000).toFixed(1)}k`;
+  return `${(n / 1e6).toFixed(1)}M`;
+}
+function fmtCost(cost, isFree) {
+  if (isFree)
+    return "free";
+  if (cost === undefined || cost <= 0)
+    return "$0";
+  return `$${cost.toFixed(3)}`;
+}
+function fmtBytes(n) {
+  if (n <= 0)
+    return "0B";
+  if (n < 1024)
+    return `${n}B`;
+  if (n < 1024 * 1024)
+    return `${(n / 1024).toFixed(1)}KB`;
+  return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+}
+function fmtState(state) {
+  switch (state) {
+    case "COMPLETED":
+      return "done";
+    case "RUNNING":
+      return "run ";
+    case "FAILED":
+      return "FAIL";
+    case "TIMEOUT":
+      return "TIME";
+    case "EMPTY":
+      return "EMPT";
+    case "PENDING":
+      return "wait";
+    default:
+      return "?   ";
+  }
+}
+function renderTeamStats(sessionPath, manifest, status, opts) {
+  const nameWidth = opts.modelNameWidth ?? 18;
+  const ids = Object.keys(manifest.models).sort();
+  let done = 0;
+  let running = 0;
+  let failed = 0;
+  let totalTokens = 0;
+  let totalCost = 0;
+  let anyFree = false;
+  const rows = [];
+  for (const id of ids) {
+    const m = status.models[id];
+    if (!m)
+      continue;
+    const model = manifest.models[id]?.model ?? "unknown";
+    const stats = readTokenStats(sessionPath, id);
+    if (m.state === "COMPLETED")
+      done++;
+    else if (m.state === "RUNNING" || m.state === "PENDING")
+      running++;
+    else
+      failed++;
+    const inTok = stats?.input_tokens ?? 0;
+    const outTok = stats?.output_tokens ?? 0;
+    totalTokens += stats?.total_tokens ?? inTok + outTok;
+    totalCost += stats?.total_cost ?? 0;
+    if (stats?.is_free)
+      anyFree = true;
+    const name = model.length > nameWidth ? `${model.slice(0, nameWidth - 1)}\u2026` : model;
+    const bytes = m.outputSize > 0 ? fmtBytes(m.outputSize) : "";
+    const tokens = stats ? `${fmtTokens(inTok)}/${outTok > 0 ? fmtTokens(outTok) : "-"}` : "";
+    const cost = stats ? fmtCost(stats.total_cost, stats.is_free) : "";
+    rows.push(`  ${id} ${name.padEnd(nameWidth)} ${fmtState(m.state)} ` + `${bytes.padStart(7)} ${tokens.padStart(12)} ${cost.padStart(7)}`.trimEnd());
+  }
+  const parts = [`${ids.length} models`];
+  if (done)
+    parts.push(`${done} done`);
+  if (running)
+    parts.push(`${running} running`);
+  if (failed)
+    parts.push(`${failed} failed`);
+  parts.push(`${Math.round(opts.elapsedSeconds)}s`);
+  if (totalTokens > 0)
+    parts.push(`${fmtTokens(totalTokens)} tok`);
+  if (totalCost > 0 || anyFree)
+    parts.push(fmtCost(totalCost, anyFree && totalCost === 0));
+  return [`team: ${parts.join(", ")}`, ...rows].join(`
+`);
+}
+function renderTeamStatsCompact(sessionPath, manifest, status, opts) {
+  const ids = Object.keys(manifest.models).sort();
+  let done = 0;
+  let running = 0;
+  let failed = 0;
+  let totalTokens = 0;
+  let totalCost = 0;
+  const segs = [];
+  for (const id of ids) {
+    const m = status.models[id];
+    if (!m)
+      continue;
+    const model = manifest.models[id]?.model ?? "unknown";
+    const stats = readTokenStats(sessionPath, id);
+    if (m.state === "COMPLETED")
+      done++;
+    else if (m.state === "RUNNING" || m.state === "PENDING")
+      running++;
+    else
+      failed++;
+    totalTokens += stats?.total_tokens ?? 0;
+    totalCost += stats?.total_cost ?? 0;
+    const bits = [id, model, fmtState(m.state).trim()];
+    if (m.outputSize > 0)
+      bits.push(fmtBytes(m.outputSize));
+    else if (stats?.total_tokens)
+      bits.push(`${fmtTokens(stats.total_tokens)} tok`);
+    segs.push(bits.join(" "));
+  }
+  const counts = [];
+  if (done)
+    counts.push(`${done} done`);
+  if (running)
+    counts.push(`${running} run`);
+  if (failed)
+    counts.push(`${failed} fail`);
+  const head = [`team ${ids.length}: ${counts.join(" ") || "starting"}`];
+  head.push(`${Math.round(opts.elapsedSeconds)}s`);
+  if (totalTokens > 0)
+    head.push(`${fmtTokens(totalTokens)} tok`);
+  if (totalCost > 0)
+    head.push(fmtCost(totalCost));
+  let line1 = head.join(" \xB7 ");
+  if (line1.length > CHANNEL_LINE_BUDGET) {
+    line1 = line1.replace(/^team \d+: /, `t${ids.length}: `);
+  }
+  return `${line1}
+${segs.join(" \xB7 ")}`;
+}
+function writeStatusFile(sessionPath, manifest, status, opts) {
+  try {
+    writeFileSync11(join21(sessionPath, "status.txt"), `${renderTeamStats(sessionPath, manifest, status, opts)}
+`, "utf-8");
+  } catch {}
+}
+var CHANNEL_LINE_BUDGET = 58;
+var init_team_stats = () => {};
+
 // src/team-orchestrator.ts
 var exports_team_orchestrator = {};
 __export(exports_team_orchestrator, {
@@ -45055,19 +45567,62 @@ __export(exports_team_orchestrator, {
   judgeResponses: () => judgeResponses,
   getStatus: () => getStatus,
   fisherYatesShuffle: () => fisherYatesShuffle,
+  classifyRunOutput: () => classifyRunOutput,
   buildJudgePrompt: () => buildJudgePrompt,
-  aggregateVerdict: () => aggregateVerdict
+  aggregateVerdict: () => aggregateVerdict,
+  STDOUT_TAIL_LIMIT: () => STDOUT_TAIL_LIMIT,
+  DEFAULT_MIN_OUTPUT_BYTES: () => DEFAULT_MIN_OUTPUT_BYTES
 });
 import { spawn as spawn2 } from "child_process";
 import {
   createWriteStream as createWriteStream2,
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync10,
-  readFileSync as readFileSync14,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync16,
   readdirSync as readdirSync2,
-  writeFileSync as writeFileSync11
+  writeFileSync as writeFileSync12
 } from "fs";
-import { join as join20, resolve as resolve3 } from "path";
+import { join as join22, resolve as resolve3 } from "path";
+function classifyRunOutput(opts) {
+  const { outputSize, stdoutTail, stderr, minOutputBytes } = opts;
+  const apiError = API_ERROR_RE.exec(stdoutTail);
+  if (apiError) {
+    return {
+      reason: "api_error",
+      detail: `Child exited 0 but stdout carries an API error: ${apiError[1]?.trim() || "unknown"}`
+    };
+  }
+  const bgCeiling = BG_CEILING_RE.exec(stderr);
+  if (bgCeiling) {
+    return {
+      reason: "background_task_ceiling",
+      detail: `Claude Code terminated the turn after ${bgCeiling[1]}s waiting on background tasks, ` + `flushing only partial output. Set CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 in the child ` + `environment to wait indefinitely, or tell the model not to spawn background work.`
+    };
+  }
+  const tailIsWholeOutput = outputSize <= STDOUT_TAIL_LIMIT;
+  if (outputSize === 0 || tailIsWholeOutput && stdoutTail.trim().length === 0) {
+    return {
+      reason: "empty_output",
+      detail: `Child exited 0 but produced no non-whitespace output (${outputSize} B).`
+    };
+  }
+  if (minOutputBytes > 0 && outputSize < minOutputBytes) {
+    return {
+      reason: "empty_output",
+      detail: `Child exited 0 but produced only ${outputSize} B of stdout ` + `(caller required at least ${minOutputBytes} B).`
+    };
+  }
+  return null;
+}
+function persistErrorLog(errorLogPath, header, stderr, stdoutTail) {
+  const parts = [`=== ${redactSecrets(header)} ===`, ""];
+  parts.push("--- stderr ---", stderr.trim() ? redactSecrets(stderr) : "(empty)", "");
+  parts.push("--- stdout (tail) ---", stdoutTail.trim() ? redactSecrets(stdoutTail) : "(empty)", "");
+  try {
+    writeFileSync12(errorLogPath, parts.join(`
+`), "utf-8");
+  } catch {}
+}
 function validateSessionPath(sessionPath) {
   const resolved = resolve3(sessionPath);
   const cwd = process.cwd();
@@ -45088,18 +45643,18 @@ function setupSession(sessionPath, models, input) {
   if (models.length === 0) {
     throw new Error("At least one model is required");
   }
-  if (existsSync17(join20(sessionPath, "manifest.json"))) {
+  if (existsSync18(join22(sessionPath, "manifest.json"))) {
     throw new Error(`Session already exists at ${sessionPath}. Use a new directory path or delete the existing session first.`);
   }
   const sentinels = models.filter(isSentinelModel);
   if (sentinels.length > 0) {
     throw new Error(`Invalid model(s) for team run: ${sentinels.join(", ")}. These are Claude Code agent selectors, not external model IDs. Use real external models (e.g., "gemini-2.0-flash", "gpt-4o", "or@deepseek/deepseek-r1"). For Claude models, use a Task agent instead of the team tool.`);
   }
-  mkdirSync10(join20(sessionPath, "work"), { recursive: true });
-  mkdirSync10(join20(sessionPath, "errors"), { recursive: true });
+  mkdirSync11(join22(sessionPath, "work"), { recursive: true });
+  mkdirSync11(join22(sessionPath, "errors"), { recursive: true });
   if (input !== undefined) {
-    writeFileSync11(join20(sessionPath, "input.md"), input, "utf-8");
-  } else if (!existsSync17(join20(sessionPath, "input.md"))) {
+    writeFileSync12(join22(sessionPath, "input.md"), input, "utf-8");
+  } else if (!existsSync18(join22(sessionPath, "input.md"))) {
     throw new Error(`No input.md found at ${sessionPath} and no input provided`);
   }
   const ids = models.map((_, i) => String(i + 1).padStart(2, "0"));
@@ -45116,9 +45671,9 @@ function setupSession(sessionPath, models, input) {
       model: models[i],
       assignedAt: now
     };
-    mkdirSync10(join20(sessionPath, "work", anonId), { recursive: true });
+    mkdirSync11(join22(sessionPath, "work", anonId), { recursive: true });
   }
-  writeFileSync11(join20(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+  writeFileSync12(join22(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
   const status = {
     startedAt: now,
     models: Object.fromEntries(Object.keys(manifest.models).map((id) => [
@@ -45132,22 +45687,25 @@ function setupSession(sessionPath, models, input) {
       }
     ]))
   };
-  writeFileSync11(join20(sessionPath, "status.json"), JSON.stringify(status, null, 2), "utf-8");
+  writeFileSync12(join22(sessionPath, "status.json"), JSON.stringify(status, null, 2), "utf-8");
   return manifest;
 }
 async function runModels(sessionPath, opts = {}) {
   const timeoutMs = (opts.timeout ?? 300) * 1000;
-  const manifest = JSON.parse(readFileSync14(join20(sessionPath, "manifest.json"), "utf-8"));
-  const statusPath = join20(sessionPath, "status.json");
-  const inputPath = join20(sessionPath, "input.md");
-  const inputContent = readFileSync14(inputPath, "utf-8");
+  const manifest = JSON.parse(readFileSync16(join22(sessionPath, "manifest.json"), "utf-8"));
+  const statusPath = join22(sessionPath, "status.json");
+  const inputPath = join22(sessionPath, "input.md");
+  const inputContent = readFileSync16(inputPath, "utf-8");
   await prehydrateCredentialsForSpawn(Object.values(manifest.models).map((m) => m.model));
-  const statusCache = JSON.parse(readFileSync14(statusPath, "utf-8"));
+  const statusCache = JSON.parse(readFileSync16(statusPath, "utf-8"));
   function updateModelStatus(id, update) {
     statusCache.models[id] = { ...statusCache.models[id], ...update };
-    writeFileSync11(statusPath, JSON.stringify(statusCache, null, 2), "utf-8");
+    writeFileSync12(statusPath, JSON.stringify(statusCache, null, 2), "utf-8");
   }
+  const minOutputBytes = opts.minOutputBytes ?? DEFAULT_MIN_OUTPUT_BYTES;
+  mkdirSync11(statsDir(sessionPath), { recursive: true });
   const processes = new Map;
+  const runtimes = new Map;
   const sigintHandler = () => {
     for (const [, proc] of processes) {
       if (!proc.killed)
@@ -45158,8 +45716,8 @@ async function runModels(sessionPath, opts = {}) {
   process.on("SIGINT", sigintHandler);
   const completionPromises = [];
   for (const [anonId, entry] of Object.entries(manifest.models)) {
-    const outputPath = join20(sessionPath, `response-${anonId}.md`);
-    const errorLogPath = join20(sessionPath, "errors", `${anonId}.log`);
+    const outputPath = join22(sessionPath, `response-${anonId}.md`);
+    const errorLogPath = join22(sessionPath, "errors", `${anonId}.log`);
     const args = ["--model", entry.model, "-y", "--stdin", "--quiet", ...opts.claudeFlags ?? []];
     updateModelStatus(anonId, {
       state: "RUNNING",
@@ -45167,11 +45725,17 @@ async function runModels(sessionPath, opts = {}) {
     });
     const proc = spawn2("claudish", args, {
       stdio: ["pipe", "pipe", "pipe"],
-      shell: false
+      shell: false,
+      env: {
+        ...process.env,
+        CLAUDISH_TOKEN_FILE: tokenFileFor(sessionPath, anonId)
+      }
     });
     let byteCount = 0;
+    let stdoutTail = "";
     proc.stdout?.on("data", (chunk) => {
       byteCount += chunk.length;
+      stdoutTail = (stdoutTail + chunk.toString()).slice(-STDOUT_TAIL_LIMIT);
     });
     const outputStream = createWriteStream2(outputPath);
     proc.stdout?.pipe(outputStream);
@@ -45179,6 +45743,14 @@ async function runModels(sessionPath, opts = {}) {
     proc.stderr?.on("data", (chunk) => {
       stderr += chunk.toString();
     });
+    const command = `claudish ${args.join(" ")}`;
+    runtimes.set(anonId, {
+      command,
+      errorLogPath,
+      getStderr: () => stderr,
+      getStdoutTail: () => stdoutTail,
+      getByteCount: () => byteCount
+    });
     proc.stdin?.write(inputContent);
     proc.stdin?.end();
     const completionPromise = new Promise((resolve4) => {
@@ -45194,20 +45766,39 @@ async function runModels(sessionPath, opts = {}) {
         }
         resolved = true;
         const outputSize = byteCount;
-        const failed = exitCode !== 0;
-        updateModelStatus(anonId, {
-          state: failed ? "FAILED" : "COMPLETED",
-          exitCode: exitCode ?? 1,
-          completedAt: new Date().toISOString(),
-          outputSize,
-          error: failed ? {
-            model: anonId,
-            command: `claudish ${args.join(" ")}`,
-            stderrSnippet: stderr ? stderr.slice(-2000) : undefined,
-            errorLogPath,
-            workDir: sessionPath
-          } : undefined
-        });
+        const crashed = exitCode !== 0;
+        const degraded = crashed ? null : classifyRunOutput({ outputSize, stdoutTail, stderr, minOutputBytes });
+        const failed = crashed || degraded !== null;
+        const state = crashed ? "FAILED" : degraded ? "EMPTY" : "COMPLETED";
+        if (failed) {
+          const reason = crashed ? "nonzero_exit" : degraded.reason;
+          const detail = crashed ? `Child exited with code ${exitCode}.` : degraded.detail;
+          persistErrorLog(errorLogPath, `${state}: ${detail}`, stderr, stdoutTail);
+          updateModelStatus(anonId, {
+            state,
+            exitCode: exitCode ?? 1,
+            completedAt: new Date().toISOString(),
+            outputSize,
+            error: {
+              model: anonId,
+              command,
+              reason,
+              detail,
+              stderrSnippet: stderr ? redactSecrets(stderr).slice(-2000) : undefined,
+              stdoutSnippet: stdoutTail ? redactSecrets(stdoutTail).slice(-2000) : undefined,
+              errorLogPath,
+              workDir: sessionPath
+            }
+          });
+        } else {
+          updateModelStatus(anonId, {
+            state,
+            exitCode: exitCode ?? 0,
+            completedAt: new Date().toISOString(),
+            outputSize,
+            error: undefined
+          });
+        }
         opts.onStatusChange?.(anonId, statusCache.models[anonId]);
         resolve4();
       };
@@ -45220,7 +45811,7 @@ async function runModels(sessionPath, opts = {}) {
           return;
         }
         if (stderr) {
-          writeFileSync11(errorLogPath, stderr, "utf-8");
+          writeFileSync12(errorLogPath, redactSecrets(stderr), "utf-8");
         }
         exitCode = code;
         if (outputStream.destroyed) {
@@ -45231,6 +45822,36 @@ async function runModels(sessionPath, opts = {}) {
     processes.set(anonId, proc);
     completionPromises.push(completionPromise);
   }
+  const runStartedMs = Date.now();
+  const POLL_MS = 2000;
+  const heartbeatMs = (opts.heartbeatSeconds ?? 60) * 1000;
+  let lastSignature = "";
+  let lastEmitMs = 0;
+  const stateSignature = () => Object.entries(statusCache.models).sort(([a], [b]) => a.localeCompare(b)).map(([id, m]) => `${id}:${m.state}:${m.outputSize}`).join("|");
+  const emitProgress = (phase = "running") => {
+    const elapsedSeconds = (Date.now() - runStartedMs) / 1000;
+    writeStatusFile(sessionPath, manifest, statusCache, { elapsedSeconds });
+    if (!opts.onProgress)
+      return;
+    const signature = stateSignature();
+    const changed = signature !== lastSignature;
+    const heartbeatDue = Date.now() - lastEmitMs >= heartbeatMs;
+    if (phase !== "settled" && !changed && !heartbeatDue)
+      return;
+    lastSignature = signature;
+    lastEmitMs = Date.now();
+    try {
+      const models = Object.values(statusCache.models);
+      opts.onProgress({
+        rendered: renderTeamStatsCompact(sessionPath, manifest, statusCache, { elapsedSeconds }),
+        phase,
+        allFailed: models.length > 0 && models.every((m) => m.state !== "COMPLETED")
+      });
+    } catch {}
+  };
+  emitProgress();
+  const progressHandle = setInterval(() => emitProgress("running"), POLL_MS);
+  progressHandle.unref?.();
   let timeoutHandle = null;
   await Promise.race([
     Promise.all(completionPromises),
@@ -45241,9 +45862,27 @@ async function runModels(sessionPath, opts = {}) {
           if (current.state === "RUNNING") {
             if (!proc.killed)
               proc.kill("SIGTERM");
+            const rt = runtimes.get(id);
+            const stderr = rt?.getStderr() ?? "";
+            const stdoutTail = rt?.getStdoutTail() ?? "";
+            const bytes = rt?.getByteCount() ?? 0;
+            const detail = `Killed by the orchestrator after ${timeoutMs / 1000}s with ${bytes} B of stdout. ` + `In --quiet print mode the child emits its answer only at the end, so 0 B means ` + `"did not finish", not "produced nothing".`;
+            if (rt)
+              persistErrorLog(rt.errorLogPath, `TIMEOUT: ${detail}`, stderr, stdoutTail);
             updateModelStatus(id, {
               state: "TIMEOUT",
-              completedAt: new Date().toISOString()
+              completedAt: new Date().toISOString(),
+              outputSize: bytes,
+              error: rt ? {
+                model: id,
+                command: rt.command,
+                reason: "timeout",
+                detail,
+                stderrSnippet: stderr ? redactSecrets(stderr).slice(-2000) : undefined,
+                stdoutSnippet: stdoutTail ? redactSecrets(stdoutTail).slice(-2000) : undefined,
+                errorLogPath: rt.errorLogPath,
+                workDir: sessionPath
+              } : undefined
             });
             opts.onStatusChange?.(id, statusCache.models[id]);
           }
@@ -45254,6 +45893,8 @@ async function runModels(sessionPath, opts = {}) {
   ]);
   if (timeoutHandle !== null)
     clearTimeout(timeoutHandle);
+  clearInterval(progressHandle);
+  emitProgress("settled");
   process.off("SIGINT", sigintHandler);
   return statusCache;
 }
@@ -45265,23 +45906,23 @@ async function judgeResponses(sessionPath, opts = {}) {
   const responses = {};
   for (const file2 of responseFiles) {
     const id = file2.replace(/^response-/, "").replace(/\.md$/, "");
-    responses[id] = readFileSync14(join20(sessionPath, file2), "utf-8");
+    responses[id] = readFileSync16(join22(sessionPath, file2), "utf-8");
   }
-  const input = readFileSync14(join20(sessionPath, "input.md"), "utf-8");
+  const input = readFileSync16(join22(sessionPath, "input.md"), "utf-8");
   const judgePrompt = buildJudgePrompt(input, responses);
-  writeFileSync11(join20(sessionPath, "judge-prompt.md"), judgePrompt, "utf-8");
+  writeFileSync12(join22(sessionPath, "judge-prompt.md"), judgePrompt, "utf-8");
   const judgeModels = opts.judges ?? getDefaultJudgeModels(sessionPath);
-  const judgePath = join20(sessionPath, "judging");
-  mkdirSync10(judgePath, { recursive: true });
+  const judgePath = join22(sessionPath, "judging");
+  mkdirSync11(judgePath, { recursive: true });
   setupSession(judgePath, judgeModels, judgePrompt);
   await runModels(judgePath, { claudeFlags: opts.claudeFlags });
   const votes = parseJudgeVotes(judgePath, Object.keys(responses));
   const verdict = aggregateVerdict(votes, Object.keys(responses));
-  writeFileSync11(join20(sessionPath, "verdict.md"), formatVerdict(verdict, sessionPath), "utf-8");
+  writeFileSync12(join22(sessionPath, "verdict.md"), formatVerdict(verdict, sessionPath), "utf-8");
   return verdict;
 }
 function getStatus(sessionPath) {
-  return JSON.parse(readFileSync14(join20(sessionPath, "status.json"), "utf-8"));
+  return JSON.parse(readFileSync16(join22(sessionPath, "status.json"), "utf-8"));
 }
 function fisherYatesShuffle(arr) {
   for (let i = arr.length - 1;i > 0; i--) {
@@ -45291,7 +45932,7 @@ function fisherYatesShuffle(arr) {
   return arr;
 }
 function getDefaultJudgeModels(sessionPath) {
-  const manifest = JSON.parse(readFileSync14(join20(sessionPath, "manifest.json"), "utf-8"));
+  const manifest = JSON.parse(readFileSync16(join22(sessionPath, "manifest.json"), "utf-8"));
   return Object.values(manifest.models).map((e) => e.model);
 }
 function buildJudgePrompt(input, responses) {
@@ -45354,7 +45995,7 @@ function parseJudgeVotes(judgePath, responseIds) {
     const judgeId = file2.replace(/^response-/, "").replace(/\.md$/, "");
     let content;
     try {
-      content = readFileSync14(join20(judgePath, file2), "utf-8");
+      content = readFileSync16(join22(judgePath, file2), "utf-8");
     } catch {
       continue;
     }
@@ -45406,7 +46047,7 @@ function aggregateVerdict(votes, responseIds) {
 function formatVerdict(verdict, sessionPath) {
   let manifest = null;
   try {
-    manifest = JSON.parse(readFileSync14(join20(sessionPath, "manifest.json"), "utf-8"));
+    manifest = JSON.parse(readFileSync16(join22(sessionPath, "manifest.json"), "utf-8"));
   } catch {}
   let output = `# Team Verdict
 
@@ -45437,9 +46078,13 @@ function formatVerdict(verdict, sessionPath) {
   }
   return output;
 }
-var SENTINEL_MODELS;
+var STDOUT_TAIL_LIMIT = 4000, API_ERROR_RE, BG_CEILING_RE, DEFAULT_MIN_OUTPUT_BYTES = 0, SENTINEL_MODELS;
 var init_team_orchestrator = __esm(() => {
   init_prehydrate();
+  init_redact();
+  init_team_stats();
+  API_ERROR_RE = /\[API Error:\s*([^\]]{0,300})\]/i;
+  BG_CEILING_RE = /Background tasks still running after (\d+)s; terminating/i;
   SENTINEL_MODELS = new Set([
     "internal",
     "default",
@@ -45454,16 +46099,17 @@ var exports_mcp_server = {};
 __export(exports_mcp_server, {
   startMcpServer: () => startMcpServer,
   runPromptViaProxy: () => runPromptViaProxy,
-  parseAnthropicSse: () => parseAnthropicSse
+  parseAnthropicSse: () => parseAnthropicSse,
+  formatTeamResult: () => formatTeamResult
 });
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, readFileSync as readFileSync15, readdirSync as readdirSync3, writeFileSync as writeFileSync12 } from "fs";
-import { homedir as homedir20 } from "os";
-import { dirname as dirname5, join as join21 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync17, readdirSync as readdirSync3, writeFileSync as writeFileSync13 } from "fs";
+import { homedir as homedir21 } from "os";
+import { dirname as dirname7, join as join23 } from "path";
 import { fileURLToPath } from "url";
 async function loadAllModels(forceRefresh = false) {
-  if (!forceRefresh && existsSync18(ALL_MODELS_CACHE_PATH2)) {
+  if (!forceRefresh && existsSync19(ALL_MODELS_CACHE_PATH2)) {
     try {
-      const cacheData = JSON.parse(readFileSync15(ALL_MODELS_CACHE_PATH2, "utf-8"));
+      const cacheData = JSON.parse(readFileSync17(ALL_MODELS_CACHE_PATH2, "utf-8"));
       const lastUpdated = new Date(cacheData.lastUpdated);
       const ageInDays = (Date.now() - lastUpdated.getTime()) / (1000 * 60 * 60 * 24);
       if (ageInDays <= CACHE_MAX_AGE_DAYS) {
@@ -45477,12 +46123,12 @@ async function loadAllModels(forceRefresh = false) {
       throw new Error(`API returned ${response.status}`);
     const data = await response.json();
     const models = data.data || [];
-    mkdirSync11(CLAUDISH_CACHE_DIR, { recursive: true });
-    writeFileSync12(ALL_MODELS_CACHE_PATH2, JSON.stringify({ lastUpdated: new Date().toISOString(), models }), "utf-8");
+    mkdirSync12(CLAUDISH_CACHE_DIR, { recursive: true });
+    writeFileSync13(ALL_MODELS_CACHE_PATH2, JSON.stringify({ lastUpdated: new Date().toISOString(), models }), "utf-8");
     return models;
   } catch {
-    if (existsSync18(ALL_MODELS_CACHE_PATH2)) {
-      const cacheData = JSON.parse(readFileSync15(ALL_MODELS_CACHE_PATH2, "utf-8"));
+    if (existsSync19(ALL_MODELS_CACHE_PATH2)) {
+      const cacheData = JSON.parse(readFileSync17(ALL_MODELS_CACHE_PATH2, "utf-8"));
       return cacheData.models || [];
     }
     return [];
@@ -45578,63 +46224,53 @@ function fuzzyScore(text, query) {
   }
   return queryIndex === lowerQuery.length ? score / lowerText.length : 0;
 }
+function fmtSize(n) {
+  if (n <= 0)
+    return "0B";
+  if (n < 1024)
+    return `${n}B`;
+  if (n < 1024 * 1024)
+    return `${(n / 1024).toFixed(1)}KB`;
+  return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+}
 function formatTeamResult(status, sessionPath) {
-  const entries = Object.entries(status.models);
-  const failed = entries.filter(([, m]) => m.state === "FAILED" || m.state === "TIMEOUT");
+  const entries = Object.entries(status.models).sort(([a], [b]) => a.localeCompare(b));
+  const failed = entries.filter(([, m]) => m.state === "FAILED" || m.state === "TIMEOUT" || m.state === "EMPTY");
   const succeeded = entries.filter(([, m]) => m.state === "COMPLETED");
-  let result = JSON.stringify(status, null, 2);
+  const lines = [];
+  lines.push(`<<<TEAM_RESULT path="${sessionPath}">>>`);
+  lines.push(`status: ${failed.length === 0 ? "ok" : succeeded.length === 0 ? "all-failed" : "partial"}` + ` \u2014 ${succeeded.length}/${entries.length} succeeded`);
+  if (succeeded.length > 0) {
+    lines.push("succeeded:");
+    for (const [id, m] of succeeded) {
+      lines.push(`  ${id}  ${fmtSize(m.outputSize)}  response-${id}.md`);
+    }
+  }
   if (failed.length > 0) {
-    result += `
-
----
-## Failures Detected
-
-`;
-    result += `${succeeded.length}/${entries.length} models succeeded, ${failed.length} failed.
-
-`;
+    lines.push("failures:");
     for (const [id, m] of failed) {
-      result += `### Model ${id}: ${m.state}
-`;
-      if (m.error) {
-        result += `- **Model:** ${m.error.model}
-`;
-        result += `- **Command:** \`${m.error.command}\`
-`;
-        result += `- **Exit code:** ${m.exitCode}
-`;
-        if (m.error.stderrSnippet) {
-          result += `- **Error output:**
-\`\`\`
-${m.error.stderrSnippet}
-\`\`\`
-`;
-        }
-        result += `- **Full error log:** ${m.error.errorLogPath}
-`;
-        result += `- **Working directory:** ${m.error.workDir}
-`;
+      const reason = m.error?.reason ?? "unknown";
+      const next = NEXT_STEP[reason] ?? "read the evidence log";
+      lines.push(`  ${id}  ${m.state}  reason=${reason}`);
+      if (m.error?.detail)
+        lines.push(`      what: ${m.error.detail}`);
+      lines.push(`      next: ${next}`);
+      if (m.error?.errorLogPath) {
+        lines.push(`      evidence: ${m.error.errorLogPath}`);
+      } else {
+        lines.push("      evidence: NONE CAPTURED \u2014 orchestrator bug, report via report_error");
       }
-      result += `
-`;
     }
-    result += `---
-`;
-    result += "**To help claudish devs fix this**, use the `report_error` tool with:\n";
-    result += '- `error_type`: "provider_failure" or "team_failure"\n';
-    result += `- \`session_path\`: "${sessionPath}"
-`;
-    result += "- Copy the stderr snippet above into `stderr_snippet`\n";
-    result += "- Set `auto_send: true` to suggest enabling automatic reporting\n";
+    lines.push("actions:");
+    lines.push(`  full stderr/stdout for one failure  \u2192 Read the evidence path above`);
+    lines.push(`  machine-readable status             \u2192 team(mode="status", path="${sessionPath}")`);
+    lines.push(`  report a provider bug               \u2192 report_error(session_path="${sessionPath}")`);
   }
-  return result;
-}
-function sanitize(text) {
-  if (!text)
-    return "";
-  return text.replace(/sk-[a-zA-Z0-9_-]{10,}/g, "sk-***REDACTED***").replace(/Bearer [a-zA-Z0-9_.-]+/g, "Bearer ***REDACTED***").replace(/\/Users\/[^/\s]+/g, "/Users/***").replace(/\/home\/[^/\s]+/g, "/home/***").replace(/[A-Z_]+_API_KEY=[^\s]+/g, "***_API_KEY=REDACTED").replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, "***@***.***");
+  lines.push("<<<END_TEAM_RESULT>>>");
+  return lines.join(`
+`);
 }
-function defineTools(sessionManager) {
+function defineTools(sessionManager, notifyChannel) {
   const tools = [];
   tools.push({
     name: "run_prompt",
@@ -45965,12 +46601,25 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
         const input = args.input;
         const timeout = args.timeout;
         const resolved = validateSessionPath(path);
+        const teamSessionId = resolved.split("/").filter(Boolean).pop() ?? "team";
+        const teamCreatedAt = new Date().toISOString();
+        const runOpts = {
+          timeout,
+          onProgress: (u) => notifyChannel({
+            content: u.rendered,
+            sessionId: teamSessionId,
+            event: u.phase === "settled" ? u.allFailed ? "failed" : "completed" : "running",
+            model: "team",
+            elapsedSeconds: (Date.now() - Date.parse(teamCreatedAt)) / 1000,
+            createdAt: teamCreatedAt
+          })
+        };
         switch (mode) {
           case "run": {
             if (!models?.length)
               throw new Error("'models' is required for 'run' mode");
             setupSession(resolved, models, input);
-            const status = await runModels(resolved, { timeout });
+            const status = await runModels(resolved, runOpts);
             return {
               content: [{ type: "text", text: formatTeamResult(status, resolved) }]
             };
@@ -45983,7 +46632,7 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
             if (!models?.length)
               throw new Error("'models' is required for 'run-and-judge' mode");
             setupSession(resolved, models, input);
-            await runModels(resolved, { timeout });
+            await runModels(resolved, runOpts);
             const verdict = await judgeResponses(resolved, { judges });
             return { content: [{ type: "text", text: JSON.stringify(verdict, null, 2) }] };
           }
@@ -46046,7 +46695,7 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
       let stderrFull = stderr_snippet || "";
       if (error_log_path) {
         try {
-          stderrFull = readFileSync15(error_log_path, "utf-8");
+          stderrFull = readFileSync17(error_log_path, "utf-8");
         } catch {}
       }
       const sessionData = {};
@@ -46054,16 +46703,16 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
         const sp = session_path;
         for (const file2 of ["status.json", "manifest.json", "input.md"]) {
           try {
-            sessionData[file2] = readFileSync15(join21(sp, file2), "utf-8");
+            sessionData[file2] = readFileSync17(join23(sp, file2), "utf-8");
           } catch {}
         }
         try {
-          const errorDir = join21(sp, "errors");
-          if (existsSync18(errorDir)) {
+          const errorDir = join23(sp, "errors");
+          if (existsSync19(errorDir)) {
             for (const f of readdirSync3(errorDir)) {
               if (f.endsWith(".log")) {
                 try {
-                  sessionData[`errors/${f}`] = readFileSync15(join21(errorDir, f), "utf-8");
+                  sessionData[`errors/${f}`] = readFileSync17(join23(errorDir, f), "utf-8");
                 } catch {}
               }
             }
@@ -46073,7 +46722,7 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
           for (const f of readdirSync3(sp)) {
             if (f.startsWith("response-") && f.endsWith(".md")) {
               try {
-                const content = readFileSync15(join21(sp, f), "utf-8");
+                const content = readFileSync17(join23(sp, f), "utf-8");
                 sessionData[f] = content.slice(0, 200) + (content.length > 200 ? "... (truncated)" : "");
               } catch {}
             }
@@ -46082,9 +46731,9 @@ Use with: run_prompt(model="${results[0].model.id}", prompt="your prompt")`;
       }
       let version2 = "unknown";
       try {
-        const pkgPath = join21(__dirname2, "../package.json");
-        if (existsSync18(pkgPath)) {
-          version2 = JSON.parse(readFileSync15(pkgPath, "utf-8")).version;
+        const pkgPath = join23(__dirname2, "../package.json");
+        if (existsSync19(pkgPath)) {
+          version2 = JSON.parse(readFileSync17(pkgPath, "utf-8")).version;
         }
       } catch {}
       const report = {
@@ -46369,7 +47018,31 @@ To report this error, use the report_error tool with error_type: "provider_failu
       watchNotificationResult(result, { sessionId: sessionId2, eventType: event.type });
     })
   });
-  const allTools = defineTools(sessionManager);
+  const channelEnabled = enabledGroups.has("channel");
+  const notifyChannel = (p) => {
+    if (!channelEnabled)
+      return;
+    try {
+      const result = server.notification({
+        method: "notifications/claude/channel",
+        params: {
+          content: p.content,
+          meta: {
+            session_id: p.sessionId,
+            event: p.event,
+            model: p.model,
+            elapsed_seconds: String(Math.round(p.elapsedSeconds)),
+            task_id: p.sessionId,
+            status: mapEventToTaskStatus(p.event),
+            created_at: p.createdAt,
+            last_updated_at: new Date().toISOString()
+          }
+        }
+      });
+      watchNotificationResult(result, { sessionId: p.sessionId, eventType: p.event });
+    } catch {}
+  };
+  const allTools = defineTools(sessionManager, notifyChannel);
   const enabledTools = allTools.filter((t) => enabledGroups.has(t.group));
   const toolMap = new Map(enabledTools.map((t) => [t.name, t]));
   console.error(`[claudish] MCP server started (tools: ${toolMode}, ${enabledTools.length} tools)`);
@@ -46440,7 +47113,7 @@ When channel mode is active, you receive <channel source="claudish" ...> notific
 5. Use list_sessions to see all active/completed sessions.
 6. Use cancel_session to stop a running session.
 
-The session_id in the channel tag's meta attributes is the key for all tool calls.`, proxyInstance = null, proxyStarting = null, EVENT_TO_TASK_STATUS;
+The session_id in the channel tag's meta attributes is the key for all tool calls.`, proxyInstance = null, proxyStarting = null, NEXT_STEP, sanitize, EVENT_TO_TASK_STATUS;
 var init_mcp_server = __esm(() => {
   init_server2();
   init_stdio2();
@@ -46450,15 +47123,24 @@ var init_mcp_server = __esm(() => {
   init_channel();
   init_model_loader();
   init_port_manager();
+  init_redact();
   init_provider_definitions();
   init_proxy_server();
   init_team_orchestrator();
   import_dotenv2 = __toESM(require_main(), 1);
   import_dotenv2.config({ quiet: true });
   __filename2 = fileURLToPath(import.meta.url);
-  __dirname2 = dirname5(__filename2);
-  CLAUDISH_CACHE_DIR = join21(homedir20(), ".claudish");
-  ALL_MODELS_CACHE_PATH2 = join21(CLAUDISH_CACHE_DIR, "all-models.json");
+  __dirname2 = dirname7(__filename2);
+  CLAUDISH_CACHE_DIR = join23(homedir21(), ".claudish");
+  ALL_MODELS_CACHE_PATH2 = join23(CLAUDISH_CACHE_DIR, "all-models.json");
+  NEXT_STEP = {
+    nonzero_exit: "read the evidence log, then retry or drop the model",
+    timeout: "raise `timeout`, or pick a faster model",
+    api_error: "retry once, or route via a different provider (or@<model>)",
+    background_task_ceiling: "set CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 for children, or forbid background work in the prompt",
+    empty_output: "retry once; if it repeats, drop the model"
+  };
+  sanitize = sanitizeForReport;
   EVENT_TO_TASK_STATUS = new Map([
     ["starting", "working"],
     ["running", "working"],
@@ -46475,7 +47157,7 @@ var exports_serve_command = {};
 __export(exports_serve_command, {
   serveCommand: () => serveCommand
 });
-import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
 function parseServeArgs(args) {
   const out = {};
   for (let i = 0;i < args.length; i++) {
@@ -46494,12 +47176,12 @@ function parseServeArgs(args) {
   return out;
 }
 function loadModelMap(path) {
-  if (!existsSync19(path)) {
+  if (!existsSync20(path)) {
     throw new Error(`--models file not found: ${path}`);
   }
   let raw2;
   try {
-    raw2 = readFileSync16(path, "utf-8");
+    raw2 = readFileSync18(path, "utf-8");
   } catch (e) {
     throw new Error(`failed to read --models file ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -57971,7 +58653,7 @@ var init_RemoveFileError = __esm(() => {
 
 // ../../node_modules/.bun/@inquirer+external-editor@2.0.1+04f2146be16c61ef/node_modules/@inquirer/external-editor/dist/index.js
 import { spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync17, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "fs";
+import { readFileSync as readFileSync19, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "fs";
 import path from "path";
 import os from "os";
 import { randomUUID as randomUUID4 } from "crypto";
@@ -58080,14 +58762,14 @@ class ExternalEditor {
       if (Object.prototype.hasOwnProperty.call(this.fileOptions, "mode")) {
         opt.mode = this.fileOptions.mode;
       }
-      writeFileSync13(this.tempFile, this.text, opt);
+      writeFileSync14(this.tempFile, this.text, opt);
     } catch (createFileError) {
       throw new CreateFileError(createFileError);
     }
   }
   readTemporaryFile() {
     try {
-      const tempFileBuffer = readFileSync17(this.tempFile);
+      const tempFileBuffer = readFileSync19(this.tempFile);
       if (tempFileBuffer.length === 0) {
         this.text = "";
       } else {
@@ -59282,15 +59964,15 @@ async function geminiQuotaHandler() {
   }
 }
 async function codexQuotaHandler() {
-  const { readFileSync: readFileSync18, existsSync: existsSync20 } = await import("fs");
-  const { join: join22 } = await import("path");
-  const { homedir: homedir21 } = await import("os");
-  const credPath = join22(homedir21(), ".claudish", "codex-oauth.json");
-  if (!existsSync20(credPath)) {
+  const { readFileSync: readFileSync20, existsSync: existsSync21 } = await import("fs");
+  const { join: join24 } = await import("path");
+  const { homedir: homedir22 } = await import("os");
+  const credPath = join24(homedir22(), ".claudish", "codex-oauth.json");
+  if (!existsSync21(credPath)) {
     console.error(`${RED}No Codex credentials found.${R} Run: ${B}claudish login codex${R}`);
     process.exit(1);
   }
-  const creds = JSON.parse(readFileSync18(credPath, "utf-8"));
+  const creds = JSON.parse(readFileSync20(credPath, "utf-8"));
   let email3 = "";
   try {
     const parts = creds.access_token.split(".");
@@ -59342,9 +60024,9 @@ async function codexQuotaHandler() {
   }
   let modelSlugs = [];
   try {
-    const modelsPath = join22(homedir21(), ".codex", "models_cache.json");
-    if (existsSync20(modelsPath)) {
-      const cache2 = JSON.parse(readFileSync18(modelsPath, "utf-8"));
+    const modelsPath = join24(homedir22(), ".codex", "models_cache.json");
+    if (existsSync21(modelsPath)) {
+      const cache2 = JSON.parse(readFileSync20(modelsPath, "utf-8"));
       modelSlugs = (cache2.models || []).map((m) => m.slug || m.id).filter(Boolean);
     }
   } catch {}
@@ -60692,19 +61374,19 @@ async function probeLink(proxyUrl, link, timeoutMs) {
   }
   const streamResult = await consumeProbeStream(response, timeoutMs, startedAt);
   const totalMs = Date.now() - startedAt;
-  let timing;
+  let timing2;
   if (streamResult.state === "live" && streamResult.ttftMs !== undefined && !streamResult.truncated) {
     const ttftMs = streamResult.ttftMs;
     const tokens = streamResult.tokens ?? 0;
     const streamMs = Math.max(STREAM_MS_FLOOR, totalMs - ttftMs);
     const tokensPerSec = tokens > 0 ? tokens / streamMs * 1000 : 0;
-    timing = { ttfbMs, ttftMs, totalMs, tokens, tokensPerSec };
+    timing2 = { ttfbMs, ttftMs, totalMs, tokens, tokensPerSec };
   }
   const { ttftMs: _ttft, tokens: _tok, truncated: _trunc, ...rest } = streamResult;
   return annotateOAuthHint({
     ...rest,
     latencyMs: totalMs,
-    timing
+    timing: timing2
   }, link.provider, isOAuth);
 }
 function annotateOAuthHint(result, provider, isOAuth) {
@@ -61301,8 +61983,8 @@ function breakdownNum(ms) {
     return formatLatency(ms);
   return `${Math.round(Math.max(0, ms))}`;
 }
-function buildBarsLine(timing, scales, isFastest, usable) {
-  const t = timing;
+function buildBarsLine(timing2, scales, isFastest, usable) {
+  const t = timing2;
   const showTokBar = usable >= PRINTER_BARS_FULL_WIDTH;
   const showBreakdown = usable >= PRINTER_BARS_FULL_WIDTH || usable >= PRINTER_BARS_NOTOK_WIDTH;
   const barCells = timelineBarCells(t.totalMs, scales.maxTotalMs, PRINTER_BAR_WIDTH);
@@ -63307,22 +63989,22 @@ __export(exports_cli, {
 });
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync20,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync18,
+  existsSync as existsSync21,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync4,
   unlinkSync as unlinkSync7,
-  writeFileSync as writeFileSync14
+  writeFileSync as writeFileSync15
 } from "fs";
-import { homedir as homedir21 } from "os";
-import { dirname as dirname6, join as join22 } from "path";
+import { homedir as homedir22 } from "os";
+import { dirname as dirname8, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getVersion3() {
   return VERSION;
 }
 function clearAllModelCaches() {
-  const cacheDir = join22(homedir21(), ".claudish");
-  if (!existsSync20(cacheDir))
+  const cacheDir = join24(homedir22(), ".claudish");
+  if (!existsSync21(cacheDir))
     return;
   const cachePatterns = ["pricing-cache.json", "recommended-models-cache.json"];
   let cleared = 0;
@@ -63330,7 +64012,7 @@ function clearAllModelCaches() {
     const files = readdirSync4(cacheDir);
     for (const file2 of files) {
       if (cachePatterns.includes(file2)) {
-        unlinkSync7(join22(cacheDir, file2));
+        unlinkSync7(join24(cacheDir, file2));
         cleared++;
       }
     }
@@ -63740,15 +64422,15 @@ Usage:  claudish --models --provider <slug>`);
     });
     config3.resolvedDefaultProvider = resolved;
     if (resolved.legacyAutoPromoted && !config3.quiet) {
-      const markerFile = join22(homedir21(), ".claudish", ".legacy-litellm-hint-shown");
-      if (!existsSync20(markerFile)) {
+      const markerFile = join24(homedir22(), ".claudish", ".legacy-litellm-hint-shown");
+      if (!existsSync21(markerFile)) {
         const hint = buildLegacyHint(resolved);
         if (hint) {
           console.error(hint);
         }
         try {
-          mkdirSync12(dirname6(markerFile), { recursive: true });
-          writeFileSync14(markerFile, new Date().toISOString(), "utf-8");
+          mkdirSync13(dirname8(markerFile), { recursive: true });
+          writeFileSync15(markerFile, new Date().toISOString(), "utf-8");
         } catch {}
       }
     }
@@ -64808,8 +65490,8 @@ ${h("MORE INFO")}
 }
 function printAIAgentGuide() {
   try {
-    const guidePath = join22(__dirname3, "../AI_AGENT_GUIDE.md");
-    const guideContent = readFileSync18(guidePath, "utf-8");
+    const guidePath = join24(__dirname3, "../AI_AGENT_GUIDE.md");
+    const guideContent = readFileSync20(guidePath, "utf-8");
     console.log(guideContent);
   } catch (error46) {
     console.error("Error reading AI Agent Guide:");
@@ -64825,19 +65507,19 @@ async function initializeClaudishSkill() {
   console.log(`\uD83D\uDD27 Initializing Claudish skill in current project...
 `);
   const cwd = process.cwd();
-  const claudeDir = join22(cwd, ".claude");
-  const skillsDir = join22(claudeDir, "skills");
-  const claudishSkillDir = join22(skillsDir, "claudish-usage");
-  const skillFile = join22(claudishSkillDir, "SKILL.md");
-  if (existsSync20(skillFile)) {
+  const claudeDir = join24(cwd, ".claude");
+  const skillsDir = join24(claudeDir, "skills");
+  const claudishSkillDir = join24(skillsDir, "claudish-usage");
+  const skillFile = join24(claudishSkillDir, "SKILL.md");
+  if (existsSync21(skillFile)) {
     console.log("\u2705 Claudish skill already installed at:");
     console.log(`   ${skillFile}
 `);
     console.log("\uD83D\uDCA1 To reinstall, delete the file and run 'claudish --init' again.");
     return;
   }
-  const sourceSkillPath = join22(__dirname3, "../skills/claudish-usage/SKILL.md");
-  if (!existsSync20(sourceSkillPath)) {
+  const sourceSkillPath = join24(__dirname3, "../skills/claudish-usage/SKILL.md");
+  if (!existsSync21(sourceSkillPath)) {
     console.error("\u274C Error: Claudish skill file not found in installation.");
     console.error(`   Expected at: ${sourceSkillPath}`);
     console.error(`
@@ -64846,16 +65528,16 @@ async function initializeClaudishSkill() {
     process.exit(1);
   }
   try {
-    if (!existsSync20(claudeDir)) {
-      mkdirSync12(claudeDir, { recursive: true });
+    if (!existsSync21(claudeDir)) {
+      mkdirSync13(claudeDir, { recursive: true });
       console.log("\uD83D\uDCC1 Created .claude/ directory");
     }
-    if (!existsSync20(skillsDir)) {
-      mkdirSync12(skillsDir, { recursive: true });
+    if (!existsSync21(skillsDir)) {
+      mkdirSync13(skillsDir, { recursive: true });
       console.log("\uD83D\uDCC1 Created .claude/skills/ directory");
     }
-    if (!existsSync20(claudishSkillDir)) {
-      mkdirSync12(claudishSkillDir, { recursive: true });
+    if (!existsSync21(claudishSkillDir)) {
+      mkdirSync13(claudishSkillDir, { recursive: true });
       console.log("\uD83D\uDCC1 Created .claude/skills/claudish-usage/ directory");
     }
     copyFileSync2(sourceSkillPath, skillFile);
@@ -64927,7 +65609,7 @@ var init_cli = __esm(() => {
   init_routing_rules();
   init_provider_resolver();
   __filename3 = fileURLToPath2(import.meta.url);
-  __dirname3 = dirname6(__filename3);
+  __dirname3 = dirname8(__filename3);
 });
 
 // src/update-checker.ts
@@ -64939,33 +65621,33 @@ __export(exports_update_checker, {
   clearCache: () => clearCache,
   checkForUpdates: () => checkForUpdates
 });
-import { existsSync as existsSync21, mkdirSync as mkdirSync13, readFileSync as readFileSync19, unlinkSync as unlinkSync8, writeFileSync as writeFileSync15 } from "fs";
-import { homedir as homedir22, platform as platform2, tmpdir } from "os";
-import { join as join23 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync14, readFileSync as readFileSync21, unlinkSync as unlinkSync8, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir23, platform as platform2, tmpdir } from "os";
+import { join as join25 } from "path";
 function getCacheFilePath() {
   let cacheDir;
   if (isWindows) {
-    const localAppData = process.env.LOCALAPPDATA || join23(homedir22(), "AppData", "Local");
-    cacheDir = join23(localAppData, "claudish");
+    const localAppData = process.env.LOCALAPPDATA || join25(homedir23(), "AppData", "Local");
+    cacheDir = join25(localAppData, "claudish");
   } else {
-    cacheDir = join23(homedir22(), ".cache", "claudish");
+    cacheDir = join25(homedir23(), ".cache", "claudish");
   }
   try {
-    if (!existsSync21(cacheDir)) {
-      mkdirSync13(cacheDir, { recursive: true });
+    if (!existsSync22(cacheDir)) {
+      mkdirSync14(cacheDir, { recursive: true });
     }
-    return join23(cacheDir, "update-check.json");
+    return join25(cacheDir, "update-check.json");
   } catch {
-    return join23(tmpdir(), "claudish-update-check.json");
+    return join25(tmpdir(), "claudish-update-check.json");
   }
 }
 function readCache() {
   try {
     const cachePath = getCacheFilePath();
-    if (!existsSync21(cachePath)) {
+    if (!existsSync22(cachePath)) {
       return null;
     }
-    const data = JSON.parse(readFileSync19(cachePath, "utf-8"));
+    const data = JSON.parse(readFileSync21(cachePath, "utf-8"));
     return data;
   } catch {
     return null;
@@ -64978,7 +65660,7 @@ function writeCache(latestVersion) {
       lastCheck: Date.now(),
       latestVersion
     };
-    writeFileSync15(cachePath, JSON.stringify(data), "utf-8");
+    writeFileSync16(cachePath, JSON.stringify(data), "utf-8");
   } catch {}
 }
 function isCacheValid(cache2) {
@@ -64988,7 +65670,7 @@ function isCacheValid(cache2) {
 function clearCache() {
   try {
     const cachePath = getCacheFilePath();
-    if (existsSync21(cachePath)) {
+    if (existsSync22(cachePath)) {
       unlinkSync8(cachePath);
     }
   } catch {}
@@ -65867,15 +66549,15 @@ var init_local_liveness = __esm(() => {
 });
 
 // src/providers/probe-catalog.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "fs";
-import { homedir as homedir23 } from "os";
-import { dirname as dirname7, join as join24 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync17 } from "fs";
+import { homedir as homedir24 } from "os";
+import { dirname as dirname9, join as join26 } from "path";
 function readProbeModelsCache(path2 = PROBE_MODELS_CACHE_PATH) {
-  if (!existsSync22(path2))
+  if (!existsSync23(path2))
     return null;
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync20(path2, "utf-8"));
+    raw2 = JSON.parse(readFileSync22(path2, "utf-8"));
   } catch {
     return null;
   }
@@ -65884,8 +66566,8 @@ function readProbeModelsCache(path2 = PROBE_MODELS_CACHE_PATH) {
   return raw2;
 }
 function writeProbeModelsCache(data, path2 = PROBE_MODELS_CACHE_PATH) {
-  mkdirSync14(dirname7(path2), { recursive: true });
-  writeFileSync16(path2, JSON.stringify(data), "utf-8");
+  mkdirSync15(dirname9(path2), { recursive: true });
+  writeFileSync17(path2, JSON.stringify(data), "utf-8");
 }
 function isCacheFresh(data, ttlMs = CACHE_TTL_MS4) {
   if (!data?.generatedAt)
@@ -66004,7 +66686,7 @@ function isValidResponse(raw2) {
 var PROBE_MODELS_URL = "https://us-central1-claudish-6da10.cloudfunctions.net/probeModels", CACHE_TTL_MS4, FETCH_TIMEOUT_MS3 = 15000, PROBE_MODELS_CACHE_PATH, _inFlight = null;
 var init_probe_catalog = __esm(() => {
   CACHE_TTL_MS4 = 60 * 60 * 1000;
-  PROBE_MODELS_CACHE_PATH = join24(homedir23(), ".claudish", "probe-models.json");
+  PROBE_MODELS_CACHE_PATH = join26(homedir24(), ".claudish", "probe-models.json");
 });
 
 // src/tui/constants.ts
@@ -72337,16 +73019,16 @@ __export(exports_claude_runner, {
 });
 import { spawn as spawn4 } from "child_process";
 import {
-  closeSync as closeSync4,
-  existsSync as existsSync23,
-  mkdirSync as mkdirSync15,
-  openSync as openSync4,
-  readFileSync as readFileSync21,
+  closeSync as closeSync5,
+  existsSync as existsSync24,
+  mkdirSync as mkdirSync16,
+  openSync as openSync5,
+  readFileSync as readFileSync23,
   unlinkSync as unlinkSync9,
-  writeFileSync as writeFileSync17
+  writeFileSync as writeFileSync18
 } from "fs";
-import { homedir as homedir24, tmpdir as tmpdir2 } from "os";
-import { join as join25 } from "path";
+import { homedir as homedir25, tmpdir as tmpdir2 } from "os";
+import { join as join27 } from "path";
 import { isatty } from "tty";
 function releaseTerminalIsolation() {
   if (!restoreTerminal)
@@ -72381,14 +73063,14 @@ function isProxyAuthMode(config3) {
 }
 function managedSettingsPath() {
   if (isWindows2()) {
-    return join25(process.env.PROGRAMDATA || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
+    return join27(process.env.PROGRAMDATA || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
   }
   if (process.platform === "darwin") {
     return "/Library/Application Support/ClaudeCode/managed-settings.json";
   }
   return "/etc/claude-code/managed-settings.json";
 }
-function managedSettingsForcesClaudeAi(readFile = readFileSync21) {
+function managedSettingsForcesClaudeAi(readFile = readFileSync23) {
   try {
     const raw2 = readFile(managedSettingsPath(), "utf-8");
     const parsed = JSON.parse(raw2);
@@ -72402,9 +73084,9 @@ function isWindows2() {
 }
 function createStatusLineScript(tokenFilePath) {
   const homeDir = process.env.HOME || process.env.USERPROFILE || tmpdir2();
-  const claudishDir = join25(homeDir, ".claudish");
+  const claudishDir = join27(homeDir, ".claudish");
   const timestamp = Date.now();
-  const scriptPath = join25(claudishDir, `status-${timestamp}.js`);
+  const scriptPath = join27(claudishDir, `status-${timestamp}.js`);
   const escapedTokenPath = tokenFilePath.replace(/\\/g, "\\\\");
   const script = `
 const fs = require('fs');
@@ -72496,18 +73178,18 @@ process.stdin.on('end', () => {
   }
 });
 `;
-  writeFileSync17(scriptPath, script, "utf-8");
+  writeFileSync18(scriptPath, script, "utf-8");
   return scriptPath;
 }
 function createTempSettingsFile(_modelDisplay, port, proxyAuthMode) {
   const homeDir = process.env.HOME || process.env.USERPROFILE || tmpdir2();
-  const claudishDir = join25(homeDir, ".claudish");
+  const claudishDir = join27(homeDir, ".claudish");
   try {
-    mkdirSync15(claudishDir, { recursive: true });
+    mkdirSync16(claudishDir, { recursive: true });
   } catch {}
   const timestamp = Date.now();
-  const tempPath = join25(claudishDir, `settings-${timestamp}.json`);
-  const tokenFilePath = join25(claudishDir, `tokens-${port}.json`);
+  const tempPath = join27(claudishDir, `settings-${timestamp}.json`);
+  const tokenFilePath = join27(claudishDir, `tokens-${port}.json`);
   let statusCommand;
   if (isWindows2()) {
     const scriptPath = createStatusLineScript(tokenFilePath);
@@ -72529,7 +73211,7 @@ function createTempSettingsFile(_modelDisplay, port, proxyAuthMode) {
     padding: 0
   };
   const settings = buildClaudishSettingsOverlay(statusLine, proxyAuthMode);
-  writeFileSync17(tempPath, JSON.stringify(settings, null, 2), "utf-8");
+  writeFileSync18(tempPath, JSON.stringify(settings, null, 2), "utf-8");
   return { path: tempPath, statusLine };
 }
 function buildClaudishSettingsOverlay(statusLine, proxyAuthMode) {
@@ -72550,7 +73232,7 @@ function mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine, proxy
     if (userSettingsValue.trimStart().startsWith("{")) {
       userSettings = JSON.parse(userSettingsValue);
     } else {
-      const rawUserSettings = readFileSync21(userSettingsValue, "utf-8");
+      const rawUserSettings = readFileSync23(userSettingsValue, "utf-8");
       userSettings = JSON.parse(rawUserSettings);
     }
     userSettings.statusLine = statusLine;
@@ -72560,7 +73242,7 @@ function mergeUserSettingsIfPresent(config3, tempSettingsPath, statusLine, proxy
     if (proxyAuthMode && !("forceLoginMethod" in userSettings)) {
       userSettings.forceLoginMethod = "console";
     }
-    writeFileSync17(tempSettingsPath, JSON.stringify(userSettings, null, 2), "utf-8");
+    writeFileSync18(tempSettingsPath, JSON.stringify(userSettings, null, 2), "utf-8");
   } catch {
     if (!config3.quiet) {
       console.warn(`[claudish] Warning: could not merge user settings: ${userSettingsValue}`);
@@ -72721,8 +73403,8 @@ async function runClaudeWithProxy(config3, proxyUrl, onCleanup) {
     console.error("Install it from: https://claude.com/claude-code");
     console.error(`
 Or set CLAUDE_PATH to your custom installation:`);
-    const home = homedir24();
-    const localPath = isWindows2() ? join25(home, ".claude", "local", "claude.exe") : join25(home, ".claude", "local", "claude");
+    const home = homedir25();
+    const localPath = isWindows2() ? join27(home, ".claude", "local", "claude.exe") : join27(home, ".claude", "local", "claude");
     console.error(`  export CLAUDE_PATH=${localPath}`);
     process.exit(1);
   }
@@ -72733,11 +73415,11 @@ Or set CLAUDE_PATH to your custom installation:`);
   const childWantsTty = config3.interactive && !process.stdout.isTTY && Boolean(process.stdin.isTTY);
   if (childWantsTty) {
     try {
-      const fd = openSync4("/dev/fd/0", "r+");
+      const fd = openSync5("/dev/fd/0", "r+");
       if (isatty(fd)) {
         ttyFd = fd;
       } else {
-        closeSync4(fd);
+        closeSync5(fd);
       }
     } catch {
       ttyFd = undefined;
@@ -72760,7 +73442,7 @@ Or set CLAUDE_PATH to your custom installation:`);
     const fdToClose = ttyFd;
     proc.on("spawn", () => {
       try {
-        closeSync4(fdToClose);
+        closeSync5(fdToClose);
       } catch {}
     });
   }
@@ -72802,23 +73484,23 @@ function setupSignalHandlers(proc, tempSettingsPath, quiet, onCleanup) {
 async function findClaudeBinary() {
   const isWindows3 = process.platform === "win32";
   if (process.env.CLAUDE_PATH) {
-    if (existsSync23(process.env.CLAUDE_PATH)) {
+    if (existsSync24(process.env.CLAUDE_PATH)) {
       return process.env.CLAUDE_PATH;
     }
   }
-  const home = homedir24();
-  const localPath = isWindows3 ? join25(home, ".claude", "local", "claude.exe") : join25(home, ".claude", "local", "claude");
-  if (existsSync23(localPath)) {
+  const home = homedir25();
+  const localPath = isWindows3 ? join27(home, ".claude", "local", "claude.exe") : join27(home, ".claude", "local", "claude");
+  if (existsSync24(localPath)) {
     return localPath;
   }
   if (isWindows3) {
     const windowsPaths = [
-      join25(home, "AppData", "Roaming", "npm", "claude.cmd"),
-      join25(home, ".npm-global", "claude.cmd"),
-      join25(home, "node_modules", ".bin", "claude.cmd")
+      join27(home, "AppData", "Roaming", "npm", "claude.cmd"),
+      join27(home, ".npm-global", "claude.cmd"),
+      join27(home, "node_modules", ".bin", "claude.cmd")
     ];
     for (const path2 of windowsPaths) {
-      if (existsSync23(path2)) {
+      if (existsSync24(path2)) {
         return path2;
       }
     }
@@ -72826,14 +73508,14 @@ async function findClaudeBinary() {
     const commonPaths = [
       "/usr/local/bin/claude",
       "/opt/homebrew/bin/claude",
-      join25(home, ".npm-global/bin/claude"),
-      join25(home, ".local/bin/claude"),
-      join25(home, "node_modules/.bin/claude"),
+      join27(home, ".npm-global/bin/claude"),
+      join27(home, ".local/bin/claude"),
+      join27(home, "node_modules/.bin/claude"),
       "/data/data/com.termux/files/usr/bin/claude",
-      join25(home, "../usr/bin/claude")
+      join27(home, "../usr/bin/claude")
     ];
     for (const path2 of commonPaths) {
-      if (existsSync23(path2)) {
+      if (existsSync24(path2)) {
         return path2;
       }
     }
@@ -72890,18 +73572,18 @@ __export(exports_diag_output, {
   NullDiagOutput: () => NullDiagOutput,
   LogFileDiagOutput: () => LogFileDiagOutput
 });
-import { createWriteStream as createWriteStream3, mkdirSync as mkdirSync16, unlinkSync as unlinkSync10, writeFileSync as writeFileSync18 } from "fs";
-import { homedir as homedir25 } from "os";
-import { join as join26 } from "path";
+import { createWriteStream as createWriteStream3, mkdirSync as mkdirSync17, unlinkSync as unlinkSync10, writeFileSync as writeFileSync19 } from "fs";
+import { homedir as homedir26 } from "os";
+import { join as join28 } from "path";
 function getClaudishDir() {
-  const dir = join26(homedir25(), ".claudish");
+  const dir = join28(homedir26(), ".claudish");
   try {
-    mkdirSync16(dir, { recursive: true });
+    mkdirSync17(dir, { recursive: true });
   } catch {}
   return dir;
 }
 function getDiagLogPath() {
-  return join26(getClaudishDir(), `diag-${process.pid}.log`);
+  return join28(getClaudishDir(), `diag-${process.pid}.log`);
 }
 
 class LogFileDiagOutput {
@@ -72910,7 +73592,7 @@ class LogFileDiagOutput {
   constructor() {
     this.logPath = getDiagLogPath();
     try {
-      writeFileSync18(this.logPath, `--- claudish diag session ${new Date().toISOString()} ---
+      writeFileSync19(this.logPath, `--- claudish diag session ${new Date().toISOString()} ---
 `);
     } catch {}
     this.stream = createWriteStream3(this.logPath, { flags: "a" });
@@ -73112,9 +73794,9 @@ __export(exports_team_grid, {
 });
 import { spawn as spawn5 } from "child_process";
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync24, writeFileSync as writeFileSync20 } from "fs";
 import { connect as netConnect } from "net";
-import { dirname as dirname8, join as join27 } from "path";
+import { dirname as dirname10, join as join29 } from "path";
 import { setTimeout as wait } from "timers/promises";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function resolveRouteInfo(modelId) {
@@ -73207,21 +73889,21 @@ function buildPaneHeader(model, prompt, bg) {
 }
 function findMagmuxBinary() {
   const thisFile = fileURLToPath3(import.meta.url);
-  const thisDir = dirname8(thisFile);
-  const pkgRoot = join27(thisDir, "..");
+  const thisDir = dirname10(thisFile);
+  const pkgRoot = join29(thisDir, "..");
   const platform3 = process.platform;
   const arch = process.arch;
-  const bundledMagmux = join27(pkgRoot, "native", `magmux-${platform3}-${arch}`);
-  if (existsSync24(bundledMagmux))
+  const bundledMagmux = join29(pkgRoot, "native", `magmux-${platform3}-${arch}`);
+  if (existsSync25(bundledMagmux))
     return bundledMagmux;
   try {
     const pkgName = `@claudish/magmux-${platform3}-${arch}`;
     let searchDir = pkgRoot;
     for (let i = 0;i < 5; i++) {
-      const candidate = join27(searchDir, "node_modules", pkgName, "bin", "magmux");
-      if (existsSync24(candidate))
+      const candidate = join29(searchDir, "node_modules", pkgName, "bin", "magmux");
+      if (existsSync25(candidate))
         return candidate;
-      const parent = dirname8(searchDir);
+      const parent = dirname10(searchDir);
       if (parent === searchDir)
         break;
       searchDir = parent;
@@ -73238,7 +73920,7 @@ function findMagmuxBinary() {
 async function subscribeToMagmux(sockPath, onEvent) {
   let client = null;
   for (let attempt = 0;attempt < 40; attempt++) {
-    if (existsSync24(sockPath)) {
+    if (existsSync25(sockPath)) {
       try {
         client = await new Promise((resolve4, reject) => {
           const s = netConnect(sockPath);
@@ -73325,9 +74007,9 @@ async function runWithGrid(sessionPath, models, input, opts) {
   const keep = opts?.keep ?? false;
   const manifest = setupSession(sessionPath, models, input);
   const startedAt = new Date().toISOString();
-  const gridfilePath = join27(sessionPath, "gridfile.txt");
-  const prompt = readFileSync22(join27(sessionPath, "input.md"), "utf-8").replace(/'/g, "'\\''").replace(/\n/g, " ");
-  const rawPrompt = readFileSync22(join27(sessionPath, "input.md"), "utf-8");
+  const gridfilePath = join29(sessionPath, "gridfile.txt");
+  const prompt = readFileSync24(join29(sessionPath, "input.md"), "utf-8").replace(/'/g, "'\\''").replace(/\n/g, " ");
+  const rawPrompt = readFileSync24(join29(sessionPath, "input.md"), "utf-8");
   const usedBannerColors = new Set;
   const gridLines = Object.entries(manifest.models).map(([anonId]) => {
     const model = manifest.models[anonId].model;
@@ -73338,7 +74020,7 @@ async function runWithGrid(sessionPath, models, input, opts) {
     const header = buildPaneHeader(model, rawPrompt, bg);
     return `${header} claudish --model ${model} -y --quiet '${prompt}'`;
   });
-  writeFileSync19(gridfilePath, `${gridLines.join(`
+  writeFileSync20(gridfilePath, `${gridLines.join(`
 `)}
 `, "utf-8");
   const magmuxPath = findMagmuxBinary();
@@ -73358,8 +74040,8 @@ async function runWithGrid(sessionPath, models, input, opts) {
   });
   const [{ results }] = await Promise.all([subscription, procExit]);
   const status = buildTeamStatus(manifest, startedAt, results?.panes ?? null);
-  const statusPath = join27(sessionPath, "status.json");
-  writeFileSync19(statusPath, JSON.stringify(status, null, 2), "utf-8");
+  const statusPath = join29(sessionPath, "status.json");
+  writeFileSync20(statusPath, JSON.stringify(status, null, 2), "utf-8");
   return status;
 }
 var BANNER_BG_COLORS;
@@ -73382,8 +74064,8 @@ var init_team_grid = __esm(() => {
 init_op_source();
 init_startup_trace();
 var import_dotenv3 = __toESM(require_main(), 1);
-import { existsSync as existsSync25, readFileSync as readFileSync23 } from "fs";
-import { join as join28, resolve as resolve4 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync25 } from "fs";
+import { join as join30, resolve as resolve4 } from "path";
 import_dotenv3.config({ quiet: true });
 function classifyStartupKind() {
   const argv = process.argv.slice(2);
@@ -73482,7 +74164,7 @@ async function applyConfigOverride() {
   const { planConfigOverride: planConfigOverride2, setConfigFileOverride: setConfigFileOverride2 } = await Promise.resolve().then(() => exports_config_override);
   const plan = planConfigOverride2(process.argv.slice(2), process.env, {
     resolve: resolve4,
-    exists: existsSync25
+    exists: existsSync26
   });
   if (plan.kind === "none")
     return;
@@ -73617,14 +74299,14 @@ async function runCli() {
     if (cliConfig.team && cliConfig.team.length > 0) {
       let prompt = cliConfig.claudeArgs.join(" ");
       if (cliConfig.inputFile) {
-        prompt = readFileSync23(cliConfig.inputFile, "utf-8");
+        prompt = readFileSync25(cliConfig.inputFile, "utf-8");
       }
       if (!prompt.trim()) {
         console.error("Error: --team requires a prompt (positional args or -f <file>)");
         process.exit(1);
       }
       const mode = cliConfig.teamMode ?? "default";
-      const sessionPath = join28(process.cwd(), `.claudish-team-${Date.now()}`);
+      const sessionPath = join30(process.cwd(), `.claudish-team-${Date.now()}`);
       if (mode === "json") {
         const { setupSession: setupSession2, runModels: runModels2 } = await Promise.resolve().then(() => (init_team_orchestrator(), exports_team_orchestrator));
         setupSession2(sessionPath, cliConfig.team, prompt);
@@ -73634,9 +74316,9 @@ async function runCli() {
         });
         const result = { ...status2, responses: {} };
         for (const anonId of Object.keys(status2.models)) {
-          const responsePath = join28(sessionPath, `response-${anonId}.md`);
+          const responsePath = join30(sessionPath, `response-${anonId}.md`);
           try {
-            const raw2 = readFileSync23(responsePath, "utf-8").trim();
+            const raw2 = readFileSync25(responsePath, "utf-8").trim();
             try {
               result.responses[anonId] = JSON.parse(raw2);
             } catch {