claudish 7.36.0 → 7.37.0

package/dist/index.js

@@ -523,6 +523,68 @@ function scanConfigFlag(argv) {
 }
 var SUPPRESSED_PROJECT_CONFIG = "", overridePath = null;
 
+// src/providers/op-source-entry.ts
+function trimmed(v) {
+  return typeof v === "string" && v.trim() ? v.trim() : undefined;
+}
+function parseOpSourceEntry(raw, valueKey) {
+  const bare = trimmed(raw);
+  if (bare)
+    return { value: bare };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return;
+  const obj = raw;
+  const value = trimmed(obj[valueKey]);
+  if (!value)
+    return;
+  const account = trimmed(obj.account);
+  return account ? { value, account } : { value };
+}
+function parseOpSourceEntries(raw, valueKey) {
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  for (const item of raw) {
+    const parsed = parseOpSourceEntry(item, valueKey);
+    if (parsed)
+      out.push(parsed);
+  }
+  return out;
+}
+function serializeOpSourceEntry(entry, valueKey) {
+  if (!entry.account)
+    return entry.value;
+  return { [valueKey]: entry.value, account: entry.account };
+}
+function dedupeOpSourceEntries(entries) {
+  const seen = new Set;
+  const out = [];
+  for (const e of entries) {
+    if (seen.has(e.value))
+      continue;
+    seen.add(e.value);
+    out.push(e);
+  }
+  return out;
+}
+function groupEntriesByAccount(entries, resolveAccount) {
+  const byAccount = new Map;
+  const undeclared = [];
+  for (const entry of entries) {
+    const account = resolveAccount(entry);
+    if (!account) {
+      undeclared.push(entry);
+      continue;
+    }
+    const bucket = byAccount.get(account);
+    if (bucket)
+      bucket.push(entry);
+    else
+      byAccount.set(account, [entry]);
+  }
+  return { byAccount, undeclared };
+}
+
 // src/providers/onepassword-config.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
@@ -580,60 +642,76 @@ function clearOnepasswordAccount(scope, paths = defaultOpConfigPaths) {
 }
 function readStringList(scope, key, paths) {
   const cfg = readRawConfig(pathFor(scope, paths));
-  const raw = cfg[key];
-  if (!Array.isArray(raw))
-    return [];
-  return raw.filter((v) => typeof v === "string");
+  const valueKey = key === "onepassword" ? "ref" : "id";
+  return parseOpSourceEntries(cfg[key], valueKey).map((e) => e.value);
 }
-function addToStringList(scope, key, entry, paths) {
+function addToStringList(scope, key, entry, paths, account) {
   const value = entry.trim();
   if (!value)
     return;
+  const valueKey = key === "onepassword" ? "ref" : "id";
+  const declared = account?.trim();
   mutateConfig(scope, paths, (cfg) => {
-    const list = Array.isArray(cfg[key]) ? cfg[key].filter((v) => typeof v === "string") : [];
-    if (!list.includes(value))
-      list.push(value);
-    cfg[key] = list;
+    const existing = parseOpSourceEntries(cfg[key], valueKey);
+    const match = existing.find((e) => e.value === value);
+    if (match) {
+      if (declared && !match.account)
+        match.account = declared;
+    } else {
+      existing.push(declared ? { value, account: declared } : { value });
+    }
+    cfg[key] = existing.map((e) => serializeOpSourceEntry(e, valueKey));
   });
 }
 function removeFromStringList(scope, key, entry, paths) {
   const value = entry.trim();
+  if (!value)
+    return;
+  const valueKey = key === "onepassword" ? "ref" : "id";
   mutateConfig(scope, paths, (cfg) => {
-    const list = Array.isArray(cfg[key]) ? cfg[key].filter((v) => typeof v === "string") : [];
-    const next = list.filter((v) => v !== value);
-    if (next.length === 0)
+    const kept = parseOpSourceEntries(cfg[key], valueKey).filter((e) => e.value !== value);
+    if (kept.length === 0)
       delete cfg[key];
     else
-      cfg[key] = next;
+      cfg[key] = kept.map((e) => serializeOpSourceEntry(e, valueKey));
   });
 }
 function listOnepasswordImports(scope, paths = defaultOpConfigPaths) {
   return readStringList(scope, "onepassword", paths);
 }
-function addOnepasswordImport(entry, scope, paths = defaultOpConfigPaths) {
-  addToStringList(scope, "onepassword", entry, paths);
+function addOnepasswordImport(entry, scope, paths = defaultOpConfigPaths, account) {
+  addToStringList(scope, "onepassword", entry, paths, account);
 }
 function removeOnepasswordImport(entry, scope, paths = defaultOpConfigPaths) {
   removeFromStringList(scope, "onepassword", entry, paths);
 }
+function readEntryList(scope, key, valueKey, paths) {
+  const cfg = readRawConfig(pathFor(scope, paths));
+  return parseOpSourceEntries(cfg[key], valueKey);
+}
+function listOnepasswordImportEntries(scope, paths = defaultOpConfigPaths) {
+  return readEntryList(scope, "onepassword", "ref", paths);
+}
+function listOnepasswordEnvironmentEntries(scope, paths = defaultOpConfigPaths) {
+  return readEntryList(scope, "onepasswordEnvironments", "id", paths);
+}
+function readAllOnepasswordEnvironmentEntries(paths = defaultOpConfigPaths) {
+  return dedupeOpSourceEntries([
+    ...listOnepasswordEnvironmentEntries("project", paths),
+    ...listOnepasswordEnvironmentEntries("global", paths)
+  ]);
+}
+function readAllOnepasswordImportEntries(paths = defaultOpConfigPaths) {
+  return dedupeOpSourceEntries([
+    ...listOnepasswordImportEntries("project", paths),
+    ...listOnepasswordImportEntries("global", paths)
+  ]);
+}
 function listOnepasswordEnvironments(scope, paths = defaultOpConfigPaths) {
   return readStringList(scope, "onepasswordEnvironments", paths);
 }
-function readAllOnepasswordEnvironments(paths = defaultOpConfigPaths) {
-  const project = listOnepasswordEnvironments("project", paths);
-  const global2 = listOnepasswordEnvironments("global", paths);
-  const seen = new Set(project);
-  const out = [...project];
-  for (const id of global2) {
-    if (!seen.has(id)) {
-      seen.add(id);
-      out.push(id);
-    }
-  }
-  return out;
-}
-function addOnepasswordEnvironment(id, scope, paths = defaultOpConfigPaths) {
-  addToStringList(scope, "onepasswordEnvironments", id, paths);
+function addOnepasswordEnvironment(id, scope, paths = defaultOpConfigPaths, account) {
+  addToStringList(scope, "onepasswordEnvironments", id, paths, account);
 }
 function removeOnepasswordEnvironment(id, scope, paths = defaultOpConfigPaths) {
   removeFromStringList(scope, "onepasswordEnvironments", id, paths);
@@ -651,7 +729,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "7.36.0";
+var VERSION = "7.37.0";
 
 // src/logger.ts
 var exports_logger = {};
@@ -3856,7 +3934,6 @@ __export(exports_onepassword, {
   detectSdkAuth: () => detectSdkAuth,
   defaultSdkClientFactory: () => defaultSdkClientFactory,
   defaultScreenLockProbe: () => defaultScreenLockProbe,
-  defaultOpDefaultAccountProbe: () => defaultOpDefaultAccountProbe,
   defaultOpAccountLister: () => defaultOpAccountLister,
   defaultAppLockProbe: () => defaultAppLockProbe,
   currentLockCause: () => currentLockCause,
@@ -4193,25 +4270,25 @@ function collectApiKeyRefs(apiKeys, env, opRefs) {
 function collectOnepasswordEntry(entry, env, opRefs, globImports, warnings) {
   if (typeof entry !== "string")
     return;
-  const trimmed = entry.trim();
-  if (trimmed === "")
+  const trimmed2 = entry.trim();
+  if (trimmed2 === "")
     return;
-  if (isGlobImport(trimmed)) {
-    globImports.push(trimmed);
+  if (isGlobImport(trimmed2)) {
+    globImports.push(trimmed2);
     return;
   }
-  if (trimmed.startsWith("op://")) {
-    const name = envNameFromOpRef(trimmed);
+  if (trimmed2.startsWith("op://")) {
+    const name = envNameFromOpRef(trimmed2);
     if (name === null) {
-      warnings.push(`[claudish] skipped 1Password ref '${trimmed}' from onepassword[] (its trailing field label is not a valid env var name)`);
+      warnings.push(`[claudish] skipped 1Password ref '${trimmed2}' from onepassword[] (its trailing field label is not a valid env var name)`);
       return;
     }
     if (!env[name]) {
-      opRefs[name] = trimmed;
+      opRefs[name] = trimmed2;
     }
     return;
   }
-  warnings.push(`[claudish] skipped 1Password entry '${trimmed}' from onepassword[] (not a glob import or op:// reference)`);
+  warnings.push(`[claudish] skipped 1Password entry '${trimmed2}' from onepassword[] (not a glob import or op:// reference)`);
 }
 function parseOpFlag(argv) {
   let glob;
@@ -4444,17 +4521,10 @@ function resolveDesktopAccount(opts = {}) {
   if (opts.interactive) {
     return { needsPicker: accounts };
   }
-  const probe = opts.opDefaultAccountProbe ?? defaultOpDefaultAccountProbe;
-  const defaultUuid = probe();
-  if (defaultUuid) {
-    const match = accounts.find((a) => a.account_uuid === defaultUuid);
-    if (match)
-      return { accountName: match.url };
-  }
   const listing = accounts.map((a) => `  - ${a.url}${a.email ? ` (${a.email})` : ""}`).join(`
 `);
   return {
-    error: `Multiple 1Password accounts are available, this is a non-interactive session, and \`op\` could not name a default account. ${remediation}
+    error: `Multiple 1Password accounts are available and none is configured, so claudish cannot tell which one holds your keys. ${remediation}
 Accounts:
 ${listing}`
   };
@@ -4468,8 +4538,7 @@ async function resolveSdkAuth(opts = {}) {
     env,
     configAccount: opts.configAccount,
     interactive: opts.interactive,
-    opAccountLister: opts.opAccountLister,
-    opDefaultAccountProbe: opts.opDefaultAccountProbe
+    opAccountLister: opts.opAccountLister
   });
   if ("accountName" in result) {
     return { kind: "desktop", accountName: result.accountName };
@@ -4613,7 +4682,7 @@ var OP_REF_RE, opHydratedVars, opSourceFailures, ENV_VAR_NAME_RE, sdkClientCache
   }
 }, screenLockProbe, defaultAppLockProbe = () => false, appLockProbe, OP_PROBE_TIMEOUT_MS = 5000, defaultOpAccountLister = () => {
   try {
-    const res = spawnSync("op", ["account", "list", "--format=json"], {
+    const res = spawnSync("op", ["--cache=false", "account", "list", "--format=json"], {
       encoding: "utf-8",
       timeout: OP_PROBE_TIMEOUT_MS
     });
@@ -4640,19 +4709,6 @@ var OP_REF_RE, opHydratedVars, opSourceFailures, ENV_VAR_NAME_RE, sdkClientCache
   } catch {
     return null;
   }
-}, defaultOpDefaultAccountProbe = () => {
-  try {
-    const res = spawnSync("op", ["account", "get", "--format=json"], {
-      encoding: "utf-8",
-      timeout: OP_PROBE_TIMEOUT_MS
-    });
-    if (res.error || res.status !== 0)
-      return null;
-    const parsed = JSON.parse(res.stdout ?? "");
-    return typeof parsed.id === "string" && parsed.id ? parsed.id : null;
-  } catch {
-    return null;
-  }
 };
 var init_onepassword = __esm(() => {
   init_env_placeholder();
@@ -4740,8 +4796,11 @@ async function pickOnepasswordAccount(accounts) {
   return accounts[idx - 1].url;
 }
 async function getSdkAuth(allowPrompt) {
-  if (sdkAuthResolved)
+  if (sdkAuthResolved) {
+    if (cachedAuthError)
+      throw cachedAuthError;
     return cachedSdkAuth;
+  }
   if (authInFlight)
     return authInFlight;
   authInFlight = (async () => {
@@ -4765,13 +4824,25 @@ async function getSdkAuth(allowPrompt) {
       return auth;
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      throw new OpAuthError(message);
+      cachedAuthError = new OpAuthError(message);
+      sdkAuthResolved = true;
+      throw cachedAuthError;
     } finally {
       authInFlight = undefined;
     }
   })();
   return authInFlight;
 }
+async function authForEntry(entry, allowPrompt) {
+  const token = process.env.OP_SERVICE_ACCOUNT_TOKEN?.trim();
+  if (token)
+    return { kind: "token", token };
+  if (entry.account)
+    return { kind: "desktop", accountName: entry.account };
+  if (testSeams?.auth)
+    return testSeams.auth;
+  return getSdkAuth(allowPrompt);
+}
 function resolveExplicitFlagAuth() {
   return getSdkAuth(true);
 }
@@ -4863,12 +4934,27 @@ function flagEnvironmentIds() {
   return ids;
 }
 function configEnvironmentIds() {
-  if (testSeams?.config)
-    return testSeams.config.onepasswordEnvironments ?? [];
-  return readAllOnepasswordEnvironments();
+  return configEnvironmentEntries().map((e) => e.value);
+}
+function configEnvironmentEntries() {
+  if (testSeams?.config) {
+    return parseOpSourceEntries(testSeams.config.onepasswordEnvironments ?? [], "id");
+  }
+  return readAllOnepasswordEnvironmentEntries();
 }
-function registeredEnvironmentIds() {
-  return [...new Set([...configEnvironmentIds(), ...flagEnvironmentIds()])];
+function registeredEnvironmentEntries() {
+  const seen = new Set;
+  const out = [];
+  for (const entry of [
+    ...configEnvironmentEntries(),
+    ...flagEnvironmentIds().map((value) => ({ value }))
+  ]) {
+    if (seen.has(entry.value))
+      continue;
+    seen.add(entry.value);
+    out.push(entry);
+  }
+  return out;
 }
 function maskGlobForTrace(globPath) {
   const body = globPath.startsWith("op://") ? globPath.slice("op://".length) : globPath;
@@ -4980,6 +5066,34 @@ async function resolveOpKeyForEnvVars(wanted, opts = {}) {
     return out;
   }, label);
 }
+function hasNonEnvironmentOpSources() {
+  const cfg = testSeams?.config ?? readConfigRaw();
+  if (cfg.apiKeys) {
+    for (const v of Object.values(cfg.apiKeys)) {
+      if (typeof v === "string" && v.startsWith("op://"))
+        return true;
+    }
+  }
+  if (Array.isArray(cfg.onepassword) && cfg.onepassword.length > 0)
+    return true;
+  if (cfg.customEndpoints && typeof cfg.customEndpoints === "object") {
+    for (const raw of Object.values(cfg.customEndpoints)) {
+      if (raw && typeof raw === "object") {
+        const apiKey = raw.apiKey;
+        if (typeof apiKey === "string" && apiKey.startsWith("op://"))
+          return true;
+      }
+    }
+  }
+  return false;
+}
+function importAccountLookup() {
+  const entries = testSeams?.config ? parseOpSourceEntries(testSeams.config.onepassword ?? [], "ref") : readAllOnepasswordImportEntries();
+  const out = new Map;
+  for (const e of entries)
+    out.set(e.value, e.account);
+  return out;
+}
 async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
   if (wanted.size === 0)
     return {};
@@ -4987,20 +5101,35 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
     return {};
   const onAuthFailure = opts.onAuthFailure ?? "skip";
   const allowPrompt = opts.allowPrompt ?? false;
+  let ambientFailure;
+  const ambientAuth = async () => {
+    if (testSeams?.auth)
+      return testSeams.auth;
+    if (ambientFailure)
+      throw ambientFailure;
+    try {
+      return await getSdkAuth(allowPrompt);
+    } catch (err) {
+      if (err instanceof OpAuthError)
+        ambientFailure = err;
+      throw err;
+    }
+  };
+  const reportAuthFailure = async (err) => {
+    if (!(err instanceof OpAuthError) || onAuthFailure !== "skip")
+      throw err;
+    warnOnce(`[claudish] 1Password auth unavailable, skipping op:// keys: ${err.message}`);
+    const { recordOpFailure: recordOpFailure3 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
+    recordOpFailure3({ kind: "auth", message: err.message });
+  };
   let auth;
   if (testSeams?.auth) {
     auth = testSeams.auth;
-  } else {
+  } else if (hasNonEnvironmentOpSources()) {
     try {
-      auth = await getSdkAuth(allowPrompt);
+      auth = await ambientAuth();
     } catch (err) {
-      if (err instanceof OpAuthError && onAuthFailure === "skip") {
-        warnOnce(`[claudish] 1Password auth unavailable, skipping op:// keys: ${err.message}`);
-        const { recordOpFailure: recordOpFailure3 } = await Promise.resolve().then(() => (init_onepassword(), exports_onepassword));
-        recordOpFailure3({ kind: "auth", message: err.message });
-        return {};
-      }
-      throw err;
+      await reportAuthFailure(err);
     }
   }
   const {
@@ -5013,7 +5142,11 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
   const cfg = readConfigRaw();
   const out = {};
   try {
-    const collected = collectConfigImports2({ apiKeys: cfg.apiKeys, onepassword: cfg.onepassword }, process.env);
+    const importAccounts = importAccountLookup();
+    const collected = collectConfigImports2({
+      apiKeys: cfg.apiKeys,
+      onepassword: parseOpSourceEntries(cfg.onepassword ?? [], "ref").map((e) => e.value)
+    }, process.env);
     for (const w of collected.warnings)
       console.error(w);
     const wantedRefs = {};
@@ -5022,15 +5155,38 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
         wantedRefs[envVar] = ref;
     }
     if (Object.keys(wantedRefs).length > 0) {
-      const resolved = await withSdkRetry2(() => resolveSecrets2(wantedRefs, { auth, sdkFactory: testSeams?.sdkFactory }), "op:resolve-refs");
-      Object.assign(out, resolved);
+      const refEntries = Object.entries(wantedRefs).map(([envVar, ref]) => ({
+        value: envVar,
+        ...importAccounts.get(ref) ? { account: importAccounts.get(ref) } : {}
+      }));
+      const { byAccount, undeclared } = groupEntriesByAccount(refEntries, (e) => e.account);
+      const batches = [];
+      for (const [account, entries] of byAccount) {
+        batches.push({
+          auth: { kind: "desktop", accountName: account },
+          names: entries.map((e) => e.value)
+        });
+      }
+      if (undeclared.length > 0)
+        batches.push({ auth, names: undeclared.map((e) => e.value) });
+      for (const batch of batches) {
+        const refs = {};
+        for (const n of batch.names)
+          refs[n] = wantedRefs[n];
+        const resolved = await withSdkRetry2(() => resolveSecrets2(refs, { auth: batch.auth, sdkFactory: testSeams?.sdkFactory }), "op:resolve-refs");
+        Object.assign(out, resolved);
+      }
     }
     const stillWanted = new Set([...wanted].filter((w) => !(w in out)));
     for (const globPath of collected.globImports) {
       if (stillWanted.size === 0)
         break;
       try {
-        const { resolved, cacheHit } = await resolveGlobShared(globPath, auth);
+        const globAuth = await authForEntry({
+          value: globPath,
+          ...importAccounts.get(globPath) ? { account: importAccounts.get(globPath) } : {}
+        }, allowPrompt);
+        const { resolved, cacheHit } = await resolveGlobShared(globPath, globAuth);
         if (cacheHit)
           span?.addMeta({ globCacheHit: true });
         for (const w of [...stillWanted]) {
@@ -5065,11 +5221,13 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
     }
     const stillWantedEnv = new Set([...wanted].filter((w) => !(w in out)));
     if (stillWantedEnv.size > 0) {
-      for (const envId of registeredEnvironmentIds()) {
+      for (const envEntry of registeredEnvironmentEntries()) {
         if (stillWantedEnv.size === 0)
           break;
+        const envId = envEntry.value;
         try {
-          const { resolved, cacheHit } = await resolveEnvironmentShared(envId, auth);
+          const envAuth = await authForEntry(envEntry, allowPrompt);
+          const { resolved, cacheHit } = await resolveEnvironmentShared(envId, envAuth);
           if (cacheHit)
             span?.addMeta({ globCacheHit: true });
           for (const w of [...stillWantedEnv]) {
@@ -5102,7 +5260,7 @@ async function resolveOpKeyForEnvVarsInner(wanted, opts = {}, span) {
     recordOpHydratedVars2(Object.keys(out));
   return out;
 }
-var warnedMessages, opUnavailableVars, OP_UNAVAILABLE_ENV = "CLAUDISH_OP_UNAVAILABLE", OpAuthError, cachedSdkAuth, sdkAuthResolved = false, authInFlight, testSeams, sniffed, opQueue, resolvedCache, globResolutions, globResolvedVars, environmentResolutions;
+var warnedMessages, opUnavailableVars, OP_UNAVAILABLE_ENV = "CLAUDISH_OP_UNAVAILABLE", OpAuthError, cachedSdkAuth, cachedAuthError, sdkAuthResolved = false, authInFlight, testSeams, sniffed, opQueue, resolvedCache, globResolutions, globResolvedVars, environmentResolutions;
 var init_op_source = __esm(() => {
   init_onepassword_config();
   init_startup_trace();
@@ -5174,8 +5332,8 @@ async function opPreviewCommand(globPath, opts = {}) {
       continue;
     }
     importable++;
-    const trimmed = m.field.label !== m.envName;
-    const detail = trimmed ? `(trimmed from '${m.field.label}')` : m.field.section ? `(section: ${m.field.section})` : "(top-level field)";
+    const trimmed2 = m.field.label !== m.envName;
+    const detail = trimmed2 ? `(trimmed from '${m.field.label}')` : m.field.section ? `(section: ${m.field.section})` : "(top-level field)";
     console.log(`  ${name}  \u2713  ${detail}`);
   }
   console.log(`${importable} importable, ${skipped} skipped`);
@@ -7359,8 +7517,8 @@ var init_schemas = __esm(() => {
     $ZodStringFormat.init(inst, def);
     inst._zod.check = (payload) => {
       try {
-        const trimmed = payload.value.trim();
-        const url = new URL(trimmed);
+        const trimmed2 = payload.value.trim();
+        const url = new URL(trimmed2);
         if (def.hostname) {
           def.hostname.lastIndex = 0;
           if (!def.hostname.test(url.hostname)) {
@@ -7392,7 +7550,7 @@ var init_schemas = __esm(() => {
         if (def.normalize) {
           payload.value = url.href;
         } else {
-          payload.value = trimmed;
+          payload.value = trimmed2;
         }
         return;
       } catch (_) {
@@ -28358,8 +28516,8 @@ function defaultReadStore() {
   }
   try {
     const out = execFileSync("security", ["find-generic-password", "-s", KC_SERVICE, "-a", KC_ACCOUNT, "-w"], { encoding: "utf8" });
-    const trimmed = out.trim();
-    return trimmed.length > 0 ? trimmed : null;
+    const trimmed2 = out.trim();
+    return trimmed2.length > 0 ? trimmed2 : null;
   } catch {
     return null;
   }
@@ -37257,24 +37415,24 @@ CRITICAL INSTRUCTION FOR OUTPUT FORMAT:
       const cleanedLines = [];
       let wasFiltered = false;
       for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed) {
+        const trimmed2 = line.trim();
+        if (!trimmed2) {
           cleanedLines.push(line);
           continue;
         }
-        if (this.isReasoningLine(trimmed)) {
-          log(`[GeminiAPIFormat] Filtered reasoning: "${trimmed.substring(0, 50)}..."`);
+        if (this.isReasoningLine(trimmed2)) {
+          log(`[GeminiAPIFormat] Filtered reasoning: "${trimmed2.substring(0, 50)}..."`);
           wasFiltered = true;
           this.inReasoningBlock = true;
           this.reasoningBlockDepth++;
           continue;
         }
-        if (this.inReasoningBlock && this.isReasoningContinuation(trimmed)) {
-          log(`[GeminiAPIFormat] Filtered reasoning continuation: "${trimmed.substring(0, 50)}..."`);
+        if (this.inReasoningBlock && this.isReasoningContinuation(trimmed2)) {
+          log(`[GeminiAPIFormat] Filtered reasoning continuation: "${trimmed2.substring(0, 50)}..."`);
           wasFiltered = true;
           continue;
         }
-        if (this.inReasoningBlock && trimmed.length > 20 && !this.isReasoningContinuation(trimmed)) {
+        if (this.inReasoningBlock && trimmed2.length > 20 && !this.isReasoningContinuation(trimmed2)) {
           this.inReasoningBlock = false;
           this.reasoningBlockDepth = 0;
         }
@@ -38357,10 +38515,10 @@ function extractAvailableSkills(systemText) {
   const body = systemText.slice(start.index + start[0].length);
   for (const line of body.split(`
 `)) {
-    const trimmed = line.trim();
-    if (!trimmed)
+    const trimmed2 = line.trim();
+    if (!trimmed2)
       continue;
-    const m = SKILL_LINE.exec(trimmed);
+    const m = SKILL_LINE.exec(trimmed2);
     if (!m) {
       if (out.length > 0)
         break;
@@ -40204,12 +40362,12 @@ function writeToDisk(events) {
     if (events.length === 0)
       return;
     ensureDir();
-    const trimmed = enforceSizeCap([...events]);
-    const payload = { version: 1, events: trimmed };
+    const trimmed2 = enforceSizeCap([...events]);
+    const payload = { version: 1, events: trimmed2 };
     const tmpFile = join22(CLAUDISH_DIR, `stats-buffer.tmp.${process.pid}.json`);
     writeFileSync9(tmpFile, JSON.stringify(payload, null, 2), "utf-8");
     renameSync(tmpFile, BUFFER_FILE);
-    memoryCache = trimmed;
+    memoryCache = trimmed2;
   } catch {}
 }
 function flushToDisk() {
@@ -40585,8 +40743,8 @@ function enforceReportSize(report) {
   let msg = report.error_message_template;
   while (serialized.length > MAX_REPORT_BYTES && msg.length > 0) {
     msg = msg.slice(0, Math.max(0, msg.length - 50));
-    const trimmed = { ...report, error_message_template: `${msg}...` };
-    serialized = JSON.stringify(trimmed);
+    const trimmed2 = { ...report, error_message_template: `${msg}...` };
+    serialized = JSON.stringify(trimmed2);
   }
   return serialized.length <= MAX_REPORT_BYTES ? serialized : null;
 }
@@ -41230,8 +41388,8 @@ function buildSurfacedErrorMessage(opts) {
     parts[0] = `${head}: ${hint}`;
   const detail = (providerMessage || "").trim();
   if (detail && !parts[0].includes(detail)) {
-    const trimmed = detail.length > 600 ? `${detail.slice(0, 600)}\u2026` : detail;
-    parts.push(`\u2014 ${trimmed}`);
+    const trimmed2 = detail.length > 600 ? `${detail.slice(0, 600)}\u2026` : detail;
+    parts.push(`\u2014 ${trimmed2}`);
   }
   return parts.join(" ");
 }
@@ -41463,10 +41621,10 @@ async function sniffResponsesStreamHead(response, opts = {}) {
 `);
       pending = lines.pop() ?? "";
       for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed.startsWith("data:"))
+        const trimmed2 = line.trim();
+        if (!trimmed2.startsWith("data:"))
           continue;
-        const payload = trimmed.slice(5).trim();
+        const payload = trimmed2.slice(5).trim();
         if (!payload || payload === "[DONE]")
           continue;
         let event;
@@ -63637,15 +63795,15 @@ async function promptForProfileName(existing = []) {
   const name = await dist_default5({
     message: "Enter profile name:",
     validate: (value) => {
-      const trimmed = value.trim();
-      if (!trimmed) {
+      const trimmed2 = value.trim();
+      if (!trimmed2) {
         return "Profile name cannot be empty";
       }
-      if (!/^[a-z0-9-_]+$/i.test(trimmed)) {
+      if (!/^[a-z0-9-_]+$/i.test(trimmed2)) {
         return "Profile name can only contain letters, numbers, hyphens, and underscores";
       }
-      if (existing.includes(trimmed)) {
-        return `Profile "${trimmed}" already exists`;
+      if (existing.includes(trimmed2)) {
+        return `Profile "${trimmed2}" already exists`;
       }
       return true;
     }
@@ -64042,10 +64200,10 @@ function extractErrorMessage(body) {
       return msg.length > 160 ? `${msg.slice(0, 157)}...` : msg;
     }
   } catch {}
-  const trimmed = body.trim();
-  if (!trimmed)
+  const trimmed2 = body.trim();
+  if (!trimmed2)
     return;
-  return trimmed.length > 160 ? `${trimmed.slice(0, 157)}...` : trimmed;
+  return trimmed2.length > 160 ? `${trimmed2.slice(0, 157)}...` : trimmed2;
 }
 async function consumeProbeStream(response, timeoutMs, startedAt) {
   const body = response.body;
@@ -73820,6 +73978,7 @@ function App({ requestLogin } = {}) {
   const [opKindCursor, setOpKindCursor] = useState5(0);
   const [opAccountCursor, setOpAccountCursor] = useState5(0);
   const [opAccounts, setOpAccounts] = useState5([]);
+  const opActiveAccount = useRef4(undefined);
   const [opTestResults, setOpTestResults] = useState5({});
   const [opPendingKind, setOpPendingKind] = useState5("ref");
   const [opPendingValue, setOpPendingValue] = useState5("");
@@ -73996,7 +74155,7 @@ function App({ requestLogin } = {}) {
     setOpFieldCursor(idx < 0 ? 0 : idx);
   }, [opFieldOptionsFiltered, opFieldCursor, mode]);
   const acquireOpAuth = useCallback3(async () => {
-    return resolveSdkAuth({
+    const auth = await resolveSdkAuth({
       interactive: true,
       configAccount: readOnepasswordAccount(),
       onNeedsPicker: (accounts) => new Promise((resolve4) => {
@@ -74011,6 +74170,8 @@ function App({ requestLogin } = {}) {
         setMode("pick_op_account");
       })
     });
+    opActiveAccount.current = auth.kind === "desktop" ? auth.accountName : undefined;
+    return auth;
   }, []);
   const testOpEntry = useCallback3(async (entry) => {
     const key = `${entry.scope}:${entry.kind}:${entry.value}`;
@@ -74074,9 +74235,9 @@ function App({ requestLogin } = {}) {
       if (kind === "account") {
         saveOnepasswordAccount(value, scope);
       } else if (kind === "environment") {
-        addOnepasswordEnvironment(value, scope);
+        addOnepasswordEnvironment(value, scope, undefined, opActiveAccount.current);
       } else {
-        addOnepasswordImport(value, scope);
+        addOnepasswordImport(value, scope, undefined, opActiveAccount.current);
       }
       refreshConfig();
       const isGlob = kind === "glob" || isGlobImport(value);
@@ -75869,13 +76030,13 @@ function chainableCommandOf(statusLine) {
   const { type, command } = statusLine;
   if (type !== "command" || typeof command !== "string")
     return null;
-  const trimmed = command.trim();
-  if (!trimmed)
+  const trimmed2 = command.trim();
+  if (!trimmed2)
     return null;
-  if (trimmed.includes("CLAUDISH_ACTIVE_MODEL_NAME") || trimmed.includes("CLAUDISH_IS_LOCAL")) {
+  if (trimmed2.includes("CLAUDISH_ACTIVE_MODEL_NAME") || trimmed2.includes("CLAUDISH_IS_LOCAL")) {
     return null;
   }
-  return trimmed;
+  return trimmed2;
 }
 function buildChainedStatusCommand(userCommand, claudishBody, claudishSegment) {
   const quotedUser = `'${userCommand.replace(/'/g, `'\\''`)}'`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudish",
-  "version": "7.36.0",
+  "version": "7.37.0",
   "description": "Run Claude Code with any model - OpenRouter, Ollama, LM Studio & local models",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "ai"
   ],
   "optionalDependencies": {
-    "@claudish/magmux-darwin-arm64": "7.36.0",
-    "@claudish/magmux-darwin-x64": "7.36.0",
-    "@claudish/magmux-linux-arm64": "7.36.0",
-    "@claudish/magmux-linux-x64": "7.36.0"
+    "@claudish/magmux-darwin-arm64": "7.37.0",
+    "@claudish/magmux-darwin-x64": "7.37.0",
+    "@claudish/magmux-linux-arm64": "7.37.0",
+    "@claudish/magmux-linux-x64": "7.37.0"
   },
   "author": "Jack Rudenko <i@madappgang.com>",
   "license": "MIT",