claudish 7.65.0 → 7.66.0

package/dist/index.js

@@ -731,7 +731,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "7.65.0";
+var VERSION = "7.66.0";
 
 // src/logger.ts
 var exports_logger = {};
@@ -27554,6 +27554,7 @@ __export(exports_profile_config, {
   getModelMapping: () => getModelMapping,
   getProfile: () => getProfile,
   getProfileNames: () => getProfileNames,
+  isKeychainEnabled: () => isKeychainEnabled,
   isLocalProviderEnabled: () => isLocalProviderEnabled,
   isProjectDirectory: () => isProjectDirectory,
   listAllProfiles: () => listAllProfiles,
@@ -27569,6 +27570,7 @@ __export(exports_profile_config, {
   setConfigFileOverride: () => setConfigFileOverride,
   setDefaultProfile: () => setDefaultProfile,
   setEndpoint: () => setEndpoint,
+  setKeychainEnabled: () => setKeychainEnabled,
   setProfile: () => setProfile
 });
 import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
@@ -27621,6 +27623,9 @@ function loadConfig() {
     if (config2.onepasswordEnvironments !== undefined) {
       merged.onepasswordEnvironments = config2.onepasswordEnvironments;
     }
+    if (config2.keychain !== undefined) {
+      merged.keychain = config2.keychain;
+    }
     if (config2.anthropicApiBilling !== undefined) {
       merged.anthropicApiBilling = config2.anthropicApiBilling;
     }
@@ -27910,6 +27915,20 @@ function removeApiKey(envVar) {
     saveConfig(config2);
   }
 }
+function isKeychainEnabled() {
+  try {
+    return loadConfig().keychain?.enabled === true;
+  } catch {
+    return false;
+  }
+}
+function setKeychainEnabled(enabled) {
+  const config2 = loadConfig();
+  if (!config2.keychain)
+    config2.keychain = {};
+  config2.keychain.enabled = enabled;
+  saveConfig(config2);
+}
 function getEndpoint(name) {
   const config2 = loadConfig();
   return config2.endpoints?.[name];
@@ -31940,13 +31959,20 @@ function defaultDeleteStore() {
 function defaultRunAgyRefresh() {
   const agy = locateAgyBinary();
   if (!agy)
-    return;
+    return { kind: "not-installed" };
   try {
     execFileSync(agy, ["models"], {
-      stdio: ["ignore", "ignore", "ignore"],
+      stdio: ["ignore", "ignore", "pipe"],
+      encoding: "utf8",
       timeout: AGY_REFRESH_TIMEOUT_MS
     });
-  } catch {} finally {
+    return { kind: "ran" };
+  } catch (err) {
+    const e = err;
+    if (e.code === "ETIMEDOUT" || e.signal === "SIGTERM")
+      return { kind: "timeout" };
+    return { kind: "failed", detail: (e.stderr ?? "").trim().slice(0, 300) };
+  } finally {
     invalidateReadStoreMemo();
   }
 }
@@ -32019,13 +32045,25 @@ async function resolveValidToken(deps) {
     return rec.token.access_token;
   }
   log("[Antigravity] Access token expired/near-expiry \u2014 asking the Antigravity CLI to refresh.");
-  deps.runAgyRefresh();
+  const outcome = deps.runAgyRefresh();
   const refreshedRec = parseRecord(deps.readStore());
   if (refreshedRec && !needsRefresh(refreshedRec.token, deps.now())) {
     log("[Antigravity] Shared token refreshed by the Antigravity CLI.");
     return refreshedRec.token.access_token;
   }
-  throw new Error("[Antigravity] Antigravity session expired and couldn't be refreshed. " + "Run `claudish login antigravity` (installs/authenticates the Antigravity CLI).");
+  throw new Error(`[Antigravity] ${describeRefreshFailure(outcome)}`);
+}
+function describeRefreshFailure(outcome) {
+  switch (outcome.kind) {
+    case "not-installed":
+      return "The Antigravity CLI (`agy`) is not installed, so the expired session could not be " + "refreshed. Run `claudish login antigravity` \u2014 it installs and authenticates it.";
+    case "timeout":
+      return `The Antigravity CLI did not finish within ${Math.round(AGY_REFRESH_TIMEOUT_MS / 1000)}s, ` + "so the session could not be refreshed. `agy` auto-updates itself (a large download) " + "and is unusably slow while it does \u2014 this usually clears on its own. Try again in a " + "minute; run `agy models` to see what it is doing. You are most likely still signed in.";
+    case "failed":
+      return "The Antigravity CLI could not refresh the session" + (outcome.detail ? `: ${outcome.detail}` : ".") + " If it reports being signed out, run `claudish login antigravity`.";
+    default:
+      return "The Antigravity session is expired and the Antigravity CLI refreshed it without " + "producing a valid token \u2014 the session has most likely been revoked. " + "Run `claudish login antigravity`.";
+  }
 }
 function getValidAntigravityAccessToken(deps = defaultDeps) {
   if (inFlight)
@@ -32065,7 +32103,7 @@ function _resetAntigravityTokenState() {
   cachedHasToken = null;
   invalidateReadStoreMemo();
 }
-var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 40000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
+var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
 var init_antigravity_token = __esm(() => {
   init_logger();
   defaultDeps = {
@@ -32081,6 +32119,7 @@ var init_antigravity_token = __esm(() => {
 var exports_antigravity_user = {};
 __export(exports_antigravity_user, {
   _resetAntigravityServedModelsCache: () => _resetAntigravityServedModelsCache,
+  antigravityHost: () => antigravityHost,
   buildAntigravityUserAgent: () => buildAntigravityUserAgent,
   getAntigravityTierDisplayName: () => getAntigravityTierDisplayName,
   getAntigravityTierFullName: () => getAntigravityTierFullName,
@@ -32089,6 +32128,13 @@ __export(exports_antigravity_user, {
   retrieveUserQuota: () => retrieveUserQuota,
   setupAntigravityUser: () => setupAntigravityUser
 });
+function antigravityHost() {
+  const override = process.env.AICODE_ENDPOINT_URL?.trim();
+  return override ? override.replace(/\/+$/, "") : ANTIGRAVITY_DEFAULT_HOST;
+}
+function apiBase() {
+  return `${antigravityHost()}/v1internal`;
+}
 function makeTerminalSetupError(message) {
   const err = new Error(message);
   err.terminal = true;
@@ -32105,7 +32151,7 @@ function resetAntigravityUserCache() {
   agServedCacheAt = 0;
 }
 async function callLoadCodeAssistAntigravity(accessToken) {
-  const res = await fetch(`${ANTIGRAVITY_API_BASE}:loadCodeAssist`, {
+  const res = await fetch(`${apiBase()}:loadCodeAssist`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${accessToken}`,
@@ -32153,7 +32199,7 @@ function getAntigravityTierFullName() {
 }
 async function retrieveUserQuota(accessToken, projectId) {
   try {
-    const res = await fetch(`${ANTIGRAVITY_API_BASE}:retrieveUserQuota`, {
+    const res = await fetch(`${apiBase()}:retrieveUserQuota`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -32178,7 +32224,7 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
     return agServedCache;
   }
   try {
-    const res = await fetch(`${ANTIGRAVITY_API_BASE}:fetchAvailableModels`, {
+    const res = await fetch(`${apiBase()}:fetchAvailableModels`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -32206,7 +32252,26 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
           }
           meta3[id] = entry;
         }
-        agServedCache = { servedIds, defaultId, meta: meta3 };
+        const excludedIds = new Set;
+        for (const [id, record4] of Object.entries(data.models ?? {})) {
+          if (record4?.isInternal === true)
+            excludedIds.add(id);
+        }
+        for (const list of [
+          data.tabModelIds,
+          data.imageGenerationModelIds,
+          data.audioTranscriptionModelIds
+        ]) {
+          for (const id of list ?? [])
+            excludedIds.add(id);
+        }
+        const deprecatedReplacements = {};
+        for (const [oldId, info] of Object.entries(data.deprecatedModelIds ?? {})) {
+          excludedIds.add(oldId);
+          if (info?.newModelId)
+            deprecatedReplacements[oldId] = info.newModelId;
+        }
+        agServedCache = { servedIds, defaultId, meta: meta3, excludedIds, deprecatedReplacements };
         agServedCacheAt = now;
         return agServedCache;
       }
@@ -32224,7 +32289,7 @@ function _resetAntigravityServedModelsCache() {
   agServedCache = null;
   agServedCacheAt = 0;
 }
-var ANTIGRAVITY_API_BASE = "https://cloudcode-pa.googleapis.com/v1internal", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, agServedCache = null, agServedCacheAt = 0;
+var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, agServedCache = null, agServedCacheAt = 0;
 var init_antigravity_user = __esm(() => {
   init_logger();
   SERVED_MODELS_TTL_MS = 10 * 60 * 1000;
@@ -35277,6 +35342,9 @@ var init_gemini_queue = __esm(() => {
 
 // src/providers/transport/antigravity.ts
 import { randomUUID } from "crypto";
+function antigravityEndpoint() {
+  return `${antigravityHost()}/v1internal:streamGenerateContent?alt=sse`;
+}
 function rankReasoningSuffix(suffix) {
   const rank = REASONING_TIER_RANK[suffix.toLowerCase()];
   return rank === undefined ? Number.MAX_SAFE_INTEGER : rank;
@@ -35343,7 +35411,12 @@ function classify429(responseBody) {
         return { terminal: false, retryDelayMs: retryDelayMs ?? 60000, reason };
       }
     }
-    return { terminal: false, retryDelayMs, reason };
+    return {
+      terminal: false,
+      retryDelayMs,
+      reason,
+      unattributed: reason === undefined && retryDelayMs === undefined
+    };
   } catch {
     return null;
   }
@@ -35389,7 +35462,7 @@ class AntigravityProviderTransport {
     return this._activeModelName;
   }
   getEndpoint() {
-    return ANTIGRAVITY_ENDPOINT;
+    return antigravityEndpoint();
   }
   async getHeaders() {
     if (this.cachedAuth)
@@ -35477,8 +35550,8 @@ class AntigravityProviderTransport {
         return await this.explainTerminalQuota(response, bodyText, classification.reason);
       }
       if (attempt < MAX_RETRY_ATTEMPTS) {
-        const delay = classification.retryDelayMs ?? DEFAULT_RATE_LIMIT_DELAY_MS;
-        logStderr(`[Antigravity] Rate limited (${classification.reason || "unknown"}), retrying in ${(delay / 1000).toFixed(1)}s (attempt ${attempt}/${MAX_RETRY_ATTEMPTS})`);
+        const delay = classification.retryDelayMs ?? (classification.unattributed ? UNATTRIBUTED_RETRY_DELAY_MS : DEFAULT_RATE_LIMIT_DELAY_MS);
+        logStderr(`[Antigravity] Rate limited (${classification.reason || "unattributed \u2014 server gave no reason or retry delay"}), retrying in ${(delay / 1000).toFixed(1)}s (attempt ${attempt}/${MAX_RETRY_ATTEMPTS})`);
         if (attempt === 1) {
           await this.logQuotaInfo();
         }
@@ -35665,7 +35738,7 @@ ${lines.join(`
     }
   }
 }
-var ANTIGRAVITY_BASE = "https://cloudcode-pa.googleapis.com", ANTIGRAVITY_ENDPOINT, MAX_RETRY_ATTEMPTS = 3, DEFAULT_RATE_LIMIT_DELAY_MS = 1e4, QUOTA_CHECK_TIMEOUT_MS = 3000, REASONING_TIER_RANK;
+var MAX_RETRY_ATTEMPTS = 3, DEFAULT_RATE_LIMIT_DELAY_MS = 1e4, UNATTRIBUTED_RETRY_DELAY_MS = 1000, QUOTA_CHECK_TIMEOUT_MS = 3000, REASONING_TIER_RANK;
 var init_antigravity2 = __esm(() => {
   init_model_catalog();
   init_antigravity_token();
@@ -35673,7 +35746,6 @@ var init_antigravity2 = __esm(() => {
   init_authority();
   init_gemini_queue();
   init_logger();
-  ANTIGRAVITY_ENDPOINT = `${ANTIGRAVITY_BASE}/v1internal:streamGenerateContent?alt=sse`;
   REASONING_TIER_RANK = {
     high: 0,
     medium: 1,
@@ -35731,6 +35803,257 @@ var init_antigravity_credential = __esm(() => {
   init_antigravity_user();
 });
 
+// src/providers/keychain.ts
+function syncRun(args, stdin) {
+  try {
+    const proc = Bun.spawnSync([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: SPAWN_TIMEOUT_MS
+    });
+    return normalizeResult(proc.exitCode, proc.signalCode, decode3(proc.stdout), decode3(proc.stderr));
+  } catch (err) {
+    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function asyncRun(args, stdin) {
+  try {
+    const proc = Bun.spawn([SECURITY_BIN, ...args], {
+      stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: SPAWN_TIMEOUT_MS
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    return normalizeResult(exitCode, proc.signalCode, stdout, stderr);
+  } catch (err) {
+    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+function decode3(buf) {
+  return buf ? new TextDecoder().decode(buf) : "";
+}
+function normalizeResult(exitCode, signalCode, stdout, stderr) {
+  if (typeof exitCode === "number")
+    return { code: exitCode, stdout, stderr };
+  const detail = signalCode ? `killed by ${signalCode}` : "terminated without an exit code";
+  return { code: -1, stdout, stderr: stderr.trim() || `security ${detail}` };
+}
+function invalidateKeychainCache() {
+  listMemo = null;
+  valueMemo.clear();
+}
+function now() {
+  return Date.now();
+}
+function isValidKeychainVarName(name) {
+  return ENV_VAR_NAME.test(name);
+}
+function describeUnstorableValue(value) {
+  if (value.length === 0)
+    return "value is empty";
+  if (CONTROL_CHARS.test(value)) {
+    return "value contains control characters (tab/newline/etc), which the keychain read path cannot represent unambiguously";
+  }
+  return null;
+}
+function isKeychainSupported() {
+  return deps.platform() === "darwin";
+}
+function keychainUnavailableReason() {
+  if (!isKeychainSupported()) {
+    return `the macOS Keychain is only available on macOS (this is ${deps.platform()})`;
+  }
+  return null;
+}
+function stripOneTrailingNewline(out) {
+  return out.endsWith(`
+`) ? out.slice(0, -1) : out;
+}
+function keychainFileArgs() {
+  const file2 = process.env.CLAUDISH_KEYCHAIN_FILE;
+  return file2 ? [file2] : [];
+}
+function findArgs(envVar) {
+  return [
+    "find-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    envVar,
+    "-w",
+    ...keychainFileArgs()
+  ];
+}
+function interpretRead(envVar, res) {
+  if (res.code === 0) {
+    const value = stripOneTrailingNewline(res.stdout);
+    return value.length > 0 ? value : null;
+  }
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return null;
+  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+}
+function readKeychainSecret(envVar) {
+  if (!isKeychainSupported())
+    return null;
+  const cached2 = valueMemo.get(envVar);
+  const at = now();
+  if (cached2 && at - cached2.at < MEMO_TTL_MS)
+    return cached2.value;
+  const value = interpretRead(envVar, deps.run(findArgs(envVar)));
+  valueMemo.set(envVar, { at, value });
+  return value;
+}
+async function readKeychainSecretAsync(envVar) {
+  if (!isKeychainSupported())
+    return null;
+  const cached2 = valueMemo.get(envVar);
+  const at = now();
+  if (cached2 && at - cached2.at < MEMO_TTL_MS)
+    return cached2.value;
+  const value = interpretRead(envVar, await deps.runAsync(findArgs(envVar)));
+  valueMemo.set(envVar, { at, value });
+  return value;
+}
+function enumerateKeychainVars() {
+  if (!isKeychainSupported())
+    return { names: [], failed: false };
+  const at = now();
+  if (listMemo && at - listMemo.at < MEMO_TTL_MS)
+    return listMemo.value;
+  const res = deps.run(["dump-keychain", ...keychainFileArgs()]);
+  const value = res.code === 0 ? { names: parseDumpAccounts(res.stdout), failed: false } : {
+    names: [],
+    failed: true,
+    error: res.stderr.trim() || `security exited ${res.code}`
+  };
+  listMemo = { at, value };
+  return value;
+}
+function listKeychainVars() {
+  return enumerateKeychainVars().names;
+}
+function parseDumpAccounts(dump) {
+  const found = new Set;
+  for (const block of dump.split(/\nkeychain: /)) {
+    if (!block.includes(SVCE_MATCH))
+      continue;
+    const m = block.match(ACCT_ATTR);
+    if (m?.[1] && isValidKeychainVarName(m[1]))
+      found.add(m[1]);
+  }
+  return Array.from(found).sort();
+}
+function lookupKeychainVar(envVar) {
+  if (!isKeychainSupported())
+    return { present: false, failed: false };
+  const cached2 = valueMemo.get(envVar);
+  if (cached2 && now() - cached2.at < MEMO_TTL_MS && cached2.value !== null) {
+    return { present: true, failed: false };
+  }
+  const listed = enumerateKeychainVars();
+  return { present: listed.names.includes(envVar), failed: listed.failed };
+}
+function toHex(value) {
+  return Buffer.from(value, "utf8").toString("hex");
+}
+function quoteForStdin(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function writeKeychainSecret(envVar, value) {
+  const unsupported2 = keychainUnavailableReason();
+  if (unsupported2)
+    throw new KeychainError(`Cannot write ${envVar}: ${unsupported2}`);
+  if (!isValidKeychainVarName(envVar)) {
+    throw new KeychainError(`Cannot write "${envVar}": not a valid environment variable name`);
+  }
+  const unstorable = describeUnstorableValue(value);
+  if (unstorable)
+    throw new KeychainError(`Cannot store ${envVar}: ${unstorable}`);
+  invalidateKeychainCache();
+  const cmd = [
+    "add-generic-password",
+    "-s",
+    quoteForStdin(KEYCHAIN_SERVICE),
+    "-a",
+    quoteForStdin(envVar),
+    "-l",
+    quoteForStdin(`${KEYCHAIN_SERVICE}: ${envVar}`),
+    "-D",
+    quoteForStdin("application password"),
+    "-j",
+    quoteForStdin("Stored by claudish"),
+    "-X",
+    quoteForStdin(toHex(value)),
+    "-U",
+    "-T",
+    quoteForStdin(SECURITY_BIN),
+    ...keychainFileArgs().map(quoteForStdin)
+  ].join(" ");
+  const res = deps.run(["-i"], `${cmd}
+`);
+  if (res.code !== 0) {
+    throw new KeychainError(`Failed to store ${envVar} in the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+  }
+  invalidateKeychainCache();
+  const readBack = readKeychainSecret(envVar);
+  if (readBack !== value) {
+    throw new KeychainError(`Keychain write for ${envVar} did not round-trip \u2014 the stored value differs from what was written. ` + "The item may exceed the keychain's size limit; nothing should be assumed saved.");
+  }
+}
+function deleteKeychainSecret(envVar) {
+  if (!isKeychainSupported())
+    return false;
+  invalidateKeychainCache();
+  const res = deps.run([
+    "delete-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    envVar,
+    ...keychainFileArgs()
+  ]);
+  invalidateKeychainCache();
+  if (res.code === 0)
+    return true;
+  if (res.code === EXIT_ITEM_NOT_FOUND)
+    return false;
+  throw new KeychainError(`Failed to delete ${envVar} from the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+}
+function valueTail2(value) {
+  if (value.length <= 6)
+    return "\u2022\u2022\u2022\u2022";
+  return `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
+}
+var KEYCHAIN_SERVICE = "claudish", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, defaultDeps2, deps, listMemo = null, valueMemo, CONTROL_CHARS, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH;
+var init_keychain = __esm(() => {
+  KeychainError = class KeychainError extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+      super(message);
+      this.exitCode = exitCode;
+      this.name = "KeychainError";
+    }
+  };
+  defaultDeps2 = {
+    platform: () => process.platform,
+    run: syncRun,
+    runAsync: asyncRun
+  };
+  deps = defaultDeps2;
+  valueMemo = new Map;
+  CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
+  ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+  ACCT_ATTR = /"acct"<blob>=(?:0x[0-9A-Fa-f]*\s+)?"([^"]*)"/;
+  SVCE_MATCH = `"svce"<blob>="${KEYCHAIN_SERVICE}"`;
+});
+
 // src/auth/credentials/local-api-key.ts
 function resolveLocalApiKey(q) {
   return realValue(process.env[q.envVar]) || (q.aliases ?? []).map((a) => realValue(process.env[a])).find((v) => !!v) || realValue(getApiKey(q.envVar));
@@ -35747,6 +36070,108 @@ var init_local_api_key = __esm(() => {
   init_profile_config();
 });
 
+// src/auth/credentials/keychain-source.ts
+function warnOnce2(message) {
+  if (warnedMessages2.has(message))
+    return;
+  warnedMessages2.add(message);
+  console.error(message);
+}
+function recordKeychainHydratedVar(envVar) {
+  hydratedVars.add(envVar);
+}
+function isKeychainHydratedVar(envVar) {
+  return hydratedVars.has(envVar);
+}
+function hasKeychainSource() {
+  if (process.env.CLAUDISH_DISABLE_KEYCHAIN === "1")
+    return false;
+  if (!isKeychainSupported())
+    return false;
+  return isKeychainEnabled();
+}
+function resolveKeychainKeyForEnvVars(wanted) {
+  if (!hasKeychainSource())
+    return { failed: false };
+  let failed = false;
+  try {
+    for (const name of wanted) {
+      if (!name)
+        continue;
+      const { present, failed: lookupFailed } = lookupKeychainVar(name);
+      if (lookupFailed)
+        failed = true;
+      if (!present)
+        continue;
+      const value = readKeychainSecret(name);
+      if (value)
+        return { value, failed: false };
+    }
+  } catch (err) {
+    warnOnce2(`[claudish] macOS Keychain lookup skipped: ${err instanceof KeychainError ? err.message : String(err)}`);
+    return { failed: true };
+  }
+  if (failed) {
+    warnOnce2("[claudish] macOS Keychain could not be enumerated \u2014 treating this provider as unresolved rather than uncredentialed.");
+  }
+  return { failed };
+}
+async function hydrateKeychainIntoEnv() {
+  if (!hasKeychainSource())
+    return 0;
+  let names;
+  try {
+    const listed = enumerateKeychainVars();
+    if (listed.failed) {
+      warnOnce2(`[claudish] macOS Keychain enumeration skipped: ${listed.error ?? "unknown error"}`);
+      return 0;
+    }
+    names = listed.names;
+  } catch (err) {
+    warnOnce2(`[claudish] macOS Keychain enumeration skipped: ${String(err)}`);
+    return 0;
+  }
+  const missing = names.filter((n) => !resolveLocalApiKey({ envVar: n }));
+  if (missing.length === 0)
+    return 0;
+  const results = await Promise.all(missing.map(async (name) => {
+    try {
+      return { name, value: await readKeychainSecretAsync(name) };
+    } catch (err) {
+      warnOnce2(`[claudish] macOS Keychain read for ${name} skipped: ${err instanceof KeychainError ? err.message : String(err)}`);
+      return { name, value: null };
+    }
+  }));
+  let hydrated = 0;
+  for (const { name, value } of results) {
+    if (!value || resolveLocalApiKey({ envVar: name }))
+      continue;
+    process.env[name] = value;
+    recordKeychainHydratedVar(name);
+    hydrated++;
+  }
+  return hydrated;
+}
+function keychainHasAnyOf(names) {
+  if (!hasKeychainSource())
+    return false;
+  try {
+    for (const name of names) {
+      if (name && lookupKeychainVar(name).present)
+        return true;
+    }
+  } catch {}
+  return false;
+}
+var warnedMessages2, hydratedVars;
+var init_keychain_source = __esm(() => {
+  init_profile_config();
+  init_keychain();
+  init_local_api_key();
+  warnedMessages2 = new Set;
+  hydratedVars = new Set;
+});
+
 // src/auth/credentials/api-key-credential.ts
 import { existsSync as existsSync12 } from "fs";
 import { homedir as homedir18 } from "os";
@@ -35758,7 +36183,6 @@ class ApiKeyCredentialProvider {
   aliases;
   authScheme;
   staticHeaders;
-  publicKeyFallback;
   oauthFallback;
   declaredKey;
   cachedKey;
@@ -35769,7 +36193,6 @@ class ApiKeyCredentialProvider {
     this.aliases = descriptor.aliases ?? [];
     this.authScheme = descriptor.authScheme ?? "bearer";
     this.staticHeaders = descriptor.staticHeaders ?? {};
-    this.publicKeyFallback = descriptor.publicKeyFallback;
     this.oauthFallback = descriptor.oauthFallback;
     this.declaredKey = descriptor.declaredKey;
   }
@@ -35803,6 +36226,17 @@ class ApiKeyCredentialProvider {
         this.cachedKey = local;
         return local;
       }
+      let keychainFailed = false;
+      if (hasKeychainSource()) {
+        const kc = resolveKeychainKeyForEnvVars([this.envVar, ...this.aliases]);
+        if (kc.value) {
+          process.env[this.envVar] = kc.value;
+          recordKeychainHydratedVar(this.envVar);
+          this.cachedKey = kc.value;
+          return kc.value;
+        }
+        keychainFailed = kc.failed;
+      }
       if (hasOpSources()) {
         const wanted = new Set([this.envVar, ...this.aliases]);
         const resolved = await resolveOpKeyForEnvVars(wanted, {
@@ -35817,7 +36251,8 @@ class ApiKeyCredentialProvider {
         }
         return "";
       }
-      this.cachedKey = "";
+      if (!keychainFailed)
+        this.cachedKey = "";
       return "";
     })();
     try {
@@ -35829,8 +36264,6 @@ class ApiKeyCredentialProvider {
   async isAvailable(opts) {
     if (this.authScheme === "none")
       return true;
-    if (this.publicKeyFallback)
-      return true;
     if (this.resolveFromEnvConfig())
       return true;
     if (this.hasOauthFallbackFile())
@@ -35846,7 +36279,7 @@ class ApiKeyCredentialProvider {
     if (this.authScheme === "none") {
       return { headers: { ...this.staticHeaders } };
     }
-    const key = await this.resolveKey({ allowOpPrompt: ctx.allowOpPrompt }) || this.publicKeyFallback || "";
+    const key = await this.resolveKey({ allowOpPrompt: ctx.allowOpPrompt });
     let headers;
     if (this.authScheme === "x-api-key") {
       headers = { "x-api-key": key, ...this.staticHeaders };
@@ -35860,6 +36293,7 @@ class ApiKeyCredentialProvider {
 }
 var init_api_key_credential = __esm(() => {
   init_env_placeholder();
+  init_keychain_source();
   init_local_api_key();
   init_op_source();
 });
@@ -37112,7 +37546,6 @@ class CredentialAuthority {
         envVar: def.apiKeyEnvVar,
         aliases: def.apiKeyAliases,
         authScheme: normalizeAuthScheme(def.authScheme),
-        publicKeyFallback: def.publicKeyFallback,
         oauthFallback: def.oauthFallback
       }), [def.name, ...RUNTIME_NAME_ALIASES[def.name] ?? []]);
     }
@@ -37528,8 +37961,8 @@ async function fetchDevinAllowedUids(apiKey) {
   return uids;
 }
 async function getServedDevinModels(opts) {
-  const now = Date.now();
-  if (!opts?.force && rosterCache && now - rosterCacheAt < ROSTER_TTL_MS)
+  const now2 = Date.now();
+  if (!opts?.force && rosterCache && now2 - rosterCacheAt < ROSTER_TTL_MS)
     return rosterCache;
   const apiKey = opts?.apiKey ?? readDevinApiKey();
   if (!apiKey)
@@ -37547,7 +37980,7 @@ async function getServedDevinModels(opts) {
       log("[Devin] entitlement unknown \u2014 using the full config list (superset)");
     }
     rosterCache = served;
-    rosterCacheAt = now;
+    rosterCacheAt = now2;
     return served;
   } catch (err) {
     log(`[Devin] served-model discovery error: ${err}`);
@@ -37575,12 +38008,12 @@ function nonEmpty(value) {
 function groupKeyOf(entry) {
   return nonEmpty(entry.groupLabel) ?? nonEmpty(entry.family) ?? entry.wireId;
 }
-function offerIsLive(offer, now = Date.now()) {
+function offerIsLive(offer, now2 = Date.now()) {
   if (!offer)
     return false;
   if (offer.expiresAt === undefined)
     return true;
-  return offer.expiresAt * 1000 > now;
+  return offer.expiresAt * 1000 > now2;
 }
 
 // src/providers/model-resolvers/devin.ts
@@ -37815,6 +38248,9 @@ async function fetchDevinRoster() {
     return { id: wireId, ...rest };
   });
 }
+function isUndeclaredEditorInternal(id) {
+  return id.startsWith("tab_");
+}
 async function fetchAntigravityRoster() {
   const { getValidAntigravityAccessToken: getValidAntigravityAccessToken2 } = await Promise.resolve().then(() => (init_antigravity_token(), exports_antigravity_token));
   const { setupAntigravityUser: setupAntigravityUser2, getServedAntigravityModels: getServedAntigravityModels2 } = await Promise.resolve().then(() => (init_antigravity_user(), exports_antigravity_user));
@@ -37822,10 +38258,12 @@ async function fetchAntigravityRoster() {
   if (!token)
     return [];
   const { projectId } = await setupAntigravityUser2(token);
-  const { servedIds, meta: meta3 } = await getServedAntigravityModels2(token, projectId);
-  return servedIds.map((id) => {
+  const { servedIds, meta: meta3, excludedIds } = await getServedAntigravityModels2(token, projectId);
+  const declaredExcluded = excludedIds ?? new Set;
+  const selectable = servedIds.filter((id) => !declaredExcluded.has(id) && !isUndeclaredEditorInternal(id));
+  return selectable.map((id) => {
     const m = meta3[id];
-    return m?.contextWindow ? { id, contextWindow: m.contextWindow } : { id };
+    return m?.contextWindow ? { id, contextWindow: m.contextWindow, ignoreCatalogReleaseDate: true } : { id, ignoreCatalogReleaseDate: true };
   });
 }
 async function fetchOllamaRoster() {
@@ -38752,13 +39190,6 @@ var init_vision_proxy = __esm(() => {
 });
 
 // src/providers/model-parser.ts
-function warnGoAliasDeprecatedOnce() {
-  if (_goDeprecationWarned)
-    return;
-  _goDeprecationWarned = true;
-  process.stderr.write(`[claudish] go@ is deprecated \u2014 use ag@<model> (Antigravity). Routing there.
-`);
-}
 function parseModelChain(modelSpec) {
   const parts = modelSpec.split(MODEL_CHAIN_SEPARATOR).map((s) => s.trim()).filter(Boolean);
   return parts.length > 0 ? parts : [modelSpec];
@@ -38785,8 +39216,6 @@ function parseModelSpec(modelSpec) {
       concurrency = Number.parseInt(concurrencyMatch[2], 10);
     }
     const provider = PROVIDER_SHORTCUTS[providerPart] || providerPart;
-    if (providerPart === "go")
-      warnGoAliasDeprecatedOnce();
     return {
       provider,
       model: modelPart,
@@ -38800,8 +39229,6 @@ function parseModelSpec(modelSpec) {
   for (const { prefix, provider, stripPrefix } of LEGACY_PREFIX_PATTERNS) {
     if (lowerSpec.startsWith(prefix)) {
       const model = stripPrefix ? modelSpec.slice(prefix.length) : modelSpec;
-      if (prefix === "go/")
-        warnGoAliasDeprecatedOnce();
       let concurrency;
       let modelName = model;
       if (LOCAL_PROVIDERS.has(provider)) {
@@ -38862,7 +39289,7 @@ function getLegacySyntaxWarning(parsed) {
   return `Deprecation warning: "${parsed.original}" uses legacy prefix syntax.
 ` + `  Consider using: ${newSyntax}`;
 }
-var PROVIDER_SHORTCUTS, _goDeprecationWarned = false, LOCAL_PROVIDERS, NATIVE_MODEL_PATTERNS, LEGACY_PREFIX_PATTERNS, MODEL_CHAIN_SEPARATOR = "+";
+var PROVIDER_SHORTCUTS, LOCAL_PROVIDERS, NATIVE_MODEL_PATTERNS, LEGACY_PREFIX_PATTERNS, MODEL_CHAIN_SEPARATOR = "+";
 var init_model_parser = __esm(() => {
   init_provider_definitions();
   PROVIDER_SHORTCUTS = getShortcuts();
@@ -39707,9 +40134,9 @@ function showMonthlyBanner() {
       return;
     const profileConfig = loadConfig();
     const consent2 = profileConfig.stats;
-    const now = Date.now();
+    const now2 = Date.now();
     const lastPrompt = consent2?.lastMonthlyPrompt ? new Date(consent2.lastMonthlyPrompt).getTime() : 0;
-    const timeSincePrompt = now - lastPrompt;
+    const timeSincePrompt = now2 - lastPrompt;
     const isFirstRun = !consent2?.lastMonthlyPrompt;
     const isMonthlyInterval = timeSincePrompt >= MONTHLY_INTERVAL_MS;
     if (!isFirstRun && !isMonthlyInterval)
@@ -39877,7 +40304,7 @@ function statusToErrorType(status) {
   }
 }
 function sanitizeErrorMessage(message, maxLength = MAX_ERROR_MESSAGE_LENGTH) {
-  const flattened = String(message ?? "").replace(ANSI_ESCAPE, "").replace(CONTROL_CHARS, " ").replace(/\s+/g, " ").trim();
+  const flattened = String(message ?? "").replace(ANSI_ESCAPE, "").replace(CONTROL_CHARS2, " ").replace(/\s+/g, " ").trim();
   if (flattened.length <= maxLength)
     return flattened;
   return `${flattened.slice(0, maxLength - 1).trimEnd()}\u2026`;
@@ -39973,10 +40400,10 @@ function ensureAnthropicErrorFormat(status, body) {
   const errorType = body?.error?.type || body?.type || body?.code;
   return wrapAnthropicError(status, String(message), errorType);
 }
-var MAX_ERROR_MESSAGE_LENGTH = 600, ANSI_ESCAPE, CONTROL_CHARS;
+var MAX_ERROR_MESSAGE_LENGTH = 600, ANSI_ESCAPE, CONTROL_CHARS2;
 var init_anthropic_error = __esm(() => {
   ANSI_ESCAPE = /\x1B\[[0-?]*[ -/]*[@-~]|\x1B[@-Z\\-_]/g;
-  CONTROL_CHARS = /[\x00-\x1F\x7F]/g;
+  CONTROL_CHARS2 = /[\x00-\x1F\x7F]/g;
 });
 
 // src/handlers/shared/collect-sse-message.ts
@@ -43199,10 +43626,10 @@ class ComposedHandler {
   maybePollPlanUsage(adapter) {
     if (!adapter.poll)
       return;
-    const now = Date.now();
-    if (now - this.lastPlanPollAt < PLAN_POLL_INTERVAL_MS)
+    const now2 = Date.now();
+    if (now2 - this.lastPlanPollAt < PLAN_POLL_INTERVAL_MS)
       return;
-    this.lastPlanPollAt = now;
+    this.lastPlanPollAt = now2;
     adapter.poll({ modelId: this.bareModelName }).then((plan) => {
       if (plan)
         this.tokenTracker.setPlanUsage(plan);
@@ -43354,6 +43781,9 @@ function resolveApiKeyProvenance(envVar, aliases) {
       effectiveSource = configLayerLabel();
       layers[1].isActive = true;
       layers[2].isActive = false;
+    } else if (isKeychainHydratedVar(runtimeVar)) {
+      effectiveSource = "macOS Keychain";
+      layers[2].source = `process.env[${runtimeVar}] (from macOS Keychain)`;
     } else if (isOpHydratedVar(runtimeVar)) {
       effectiveSource = "1Password";
       layers[2].source = `process.env[${runtimeVar}] (from 1Password)`;
@@ -43403,6 +43833,7 @@ function readConfigKey(envVar) {
 }
 var import_dotenv;
 var init_api_key_provenance = __esm(() => {
+  init_keychain_source();
   init_onepassword();
   import_dotenv = __toESM(require_main(), 1);
 });
@@ -44513,16 +44944,15 @@ var init_provider_definitions = __esm(() => {
       apiKeyDescription: "Antigravity (shared OAuth token)",
       apiKeyUrl: "https://antigravity.google/",
       oauthLoginSlug: "antigravity",
-      shortcuts: ["ag", "antigravity", "go"],
+      shortcuts: ["ag", "antigravity"],
       shortestPrefix: "ag",
       legacyPrefixes: [
         { prefix: "ag/", stripPrefix: true },
-        { prefix: "antigravity/", stripPrefix: true },
-        { prefix: "go/", stripPrefix: true }
+        { prefix: "antigravity/", stripPrefix: true }
       ],
       modelDiscovery: { path: "", format: "antigravity" },
       isDirectApi: true,
-      description: "Antigravity subscription (ag@; go@ deprecated)"
+      description: "Antigravity subscription (ag@)"
     },
     {
       createHandler: devinHandler,
@@ -45138,7 +45568,7 @@ var init_provider_definitions = __esm(() => {
       legacyPrefixes: [{ prefix: "qp/", stripPrefix: true }],
       modelDiscovery: { path: "/compatible-mode/v1/models", format: "openai-models-list" },
       isDirectApi: true,
-      description: "Alibaba Model Studio pay-as-you-go (qp@)"
+      description: "Alibaba Model Studio API, pay-as-you-go (qp@)"
     },
     {
       createHandler: openaiHandler,
@@ -46068,10 +46498,10 @@ var init_predefined_catalog = __esm(() => {
 });
 
 // src/providers/predefined-endpoints.ts
-function warnOnce2(message) {
-  if (warnedMessages2.has(message))
+function warnOnce3(message) {
+  if (warnedMessages3.has(message))
     return;
-  warnedMessages2.add(message);
+  warnedMessages3.add(message);
   console.error(message);
 }
 function activeCatalog() {
@@ -46088,7 +46518,7 @@ function readOptOut(config2) {
     if (result.success) {
       parsed = result.data;
     } else {
-      warnOnce2("[claudish] config 'predefinedEndpoints' is not valid and was ignored: " + result.error.issues.map((i) => `${i.path.join(".") || "(root)"} ${i.message}`).join(", "));
+      warnOnce3("[claudish] config 'predefinedEndpoints' is not valid and was ignored: " + result.error.issues.map((i) => `${i.path.join(".") || "(root)"} ${i.message}`).join(", "));
     }
   }
   return {
@@ -46135,7 +46565,7 @@ function loadPredefinedEndpoints(config2, opts = {}) {
   const noteStale = (entry, name, reason) => {
     if (!ownRegistrations.has(name) || !runtime.has(entry.name))
       return;
-    warnOnce2(`[claudish] predefined endpoint '${entry.name}' is no longer eligible (${reason}) but stays ` + "registered for the rest of this process \u2014 runtime provider registration cannot be " + "undone. Restart claudish to apply the change.");
+    warnOnce3(`[claudish] predefined endpoint '${entry.name}' is no longer eligible (${reason}) but stays ` + "registered for the rest of this process \u2014 runtime provider registration cannot be " + "undone. Restart claudish to apply the change.");
   };
   if (optOut.disabled) {
     for (const entry of catalog) {
@@ -46155,7 +46585,7 @@ function loadPredefinedEndpoints(config2, opts = {}) {
       noteStale(entry, name, reason);
     };
     if (seen.has(name)) {
-      warnOnce2(`[claudish] predefined endpoint '${entry.name}' appears more than once in the bundled ` + "catalog. The first row wins; the later one is ignored.");
+      warnOnce3(`[claudish] predefined endpoint '${entry.name}' appears more than once in the bundled ` + "catalog. The first row wins; the later one is ignored.");
       skip("duplicate row");
       continue;
     }
@@ -46163,19 +46593,19 @@ function loadPredefinedEndpoints(config2, opts = {}) {
     const owner = reserved.get(name);
     if (owner) {
       const reason = `'${entry.name}' is already claimed by builtin provider '${owner}' ` + "(as its name, a shortcut, or a legacy prefix)";
-      warnOnce2(`[claudish] predefined endpoint '${entry.name}' skipped: ${reason}. ` + "The builtin wins; the bundled entry is inactive.");
+      warnOnce3(`[claudish] predefined endpoint '${entry.name}' skipped: ${reason}. ` + "The builtin wins; the bundled entry is inactive.");
       recordEndpointUnavailable(entry.name, `bundled endpoint was skipped because ${reason}`);
       skip("collides with builtin");
       continue;
     }
     if (runtime.has(entry.name) && !ownRegistrations.has(name)) {
-      warnOnce2(`[claudish] predefined endpoint '${entry.name}' skipped: a provider named ` + `'${entry.name}' is already registered for this process.`);
+      warnOnce3(`[claudish] predefined endpoint '${entry.name}' skipped: a provider named ` + `'${entry.name}' is already registered for this process.`);
       skip("already registered");
       continue;
     }
     if (userEndpoints.has(name)) {
       if (hasLocalApiKey({ envVar: entry.apiKeyEnvVar })) {
-        warnOnce2(`[claudish] customEndpoints['${entry.name}'] replaces the bundled entry entirely; ` + `${entry.apiKeyEnvVar} no longer applies to it. Add ` + `"apiKey": "\${${entry.apiKeyEnvVar}}" to that entry to keep using it.`);
+        warnOnce3(`[claudish] customEndpoints['${entry.name}'] replaces the bundled entry entirely; ` + `${entry.apiKeyEnvVar} no longer applies to it. Add ` + `"apiKey": "\${${entry.apiKeyEnvVar}}" to that entry to keep using it.`);
       }
       skipStale("replaced by customEndpoints");
       continue;
@@ -46185,7 +46615,7 @@ function loadPredefinedEndpoints(config2, opts = {}) {
       continue;
     }
     const { envVar, aliases } = credentialEnvVars(entry);
-    const permitted = optOut.enable.has(name) || hasLocalApiKey({ envVar, aliases });
+    const permitted = optOut.enable.has(name) || hasLocalApiKey({ envVar, aliases }) || keychainHasAnyOf([envVar, ...aliases ?? []]);
     if (!permitted) {
       skipStale("no local credential");
       continue;
@@ -46193,7 +46623,7 @@ function loadPredefinedEndpoints(config2, opts = {}) {
     const resolvedUrl = classifyEndpointBaseUrl(entry.baseUrl, entry.baseUrlEnvVars);
     if (!resolvedUrl.ok) {
       const detail = describeBadBaseUrlOverride(resolvedUrl, entry.baseUrl);
-      warnOnce2(`[claudish] predefined endpoint '${entry.name}' skipped: ${detail}`);
+      warnOnce3(`[claudish] predefined endpoint '${entry.name}' skipped: ${detail}`);
       recordEndpointUnavailable(entry.name, detail);
       skipStale("invalid base URL override");
       continue;
@@ -46203,14 +46633,15 @@ function loadPredefinedEndpoints(config2, opts = {}) {
       ownRegistrations.add(name);
       result.registered.push(entry.name);
     } catch (err) {
-      warnOnce2(`[claudish] predefined endpoint '${entry.name}' skipped: ` + `${err instanceof Error ? err.message : String(err)}`);
+      warnOnce3(`[claudish] predefined endpoint '${entry.name}' skipped: ` + `${err instanceof Error ? err.message : String(err)}`);
       skip("invalid catalog row");
     }
   }
   return result;
 }
-var KILL_SWITCH_ENV = "CLAUDISH_NO_PREDEFINED_ENDPOINTS", warnedMessages2, ownRegistrations, catalogOverride = null;
+var KILL_SWITCH_ENV = "CLAUDISH_NO_PREDEFINED_ENDPOINTS", warnedMessages3, ownRegistrations, catalogOverride = null;
 var init_predefined_endpoints = __esm(() => {
+  init_keychain_source();
   init_local_api_key();
   init_config_schema();
   init_custom_endpoints_loader();
@@ -46218,7 +46649,7 @@ var init_predefined_endpoints = __esm(() => {
   init_predefined_catalog();
   init_reserved_namespace();
   init_runtime_providers();
-  warnedMessages2 = new Set;
+  warnedMessages3 = new Set;
   ownRegistrations = new Set;
 });
 
@@ -46258,7 +46689,7 @@ function reportCustomEndpoints(result) {
     logStderr(`customEndpoints['${name}'] failed validation: ${message}`);
   }
   for (const { name, reason } of result.refused) {
-    warnOnce3(`customEndpoints['${name}'] skipped: ${reason}. The builtin wins. ` + `Rename your entry (e.g. '${name}-custom') to use it.`);
+    warnOnce4(`customEndpoints['${name}'] skipped: ${reason}. The builtin wins. ` + `Rename your entry (e.g. '${name}-custom') to use it.`);
   }
 }
 function warnOnProjectScopedEndpoints() {
@@ -46267,26 +46698,26 @@ function warnOnProjectScopedEndpoints() {
     const names = Object.keys(local?.customEndpoints ?? {});
     if (names.length === 0)
       return;
-    warnOnce3(`.claudish.json declares customEndpoints (${names.join(", ")}) but they are ` + "read from the GLOBAL config only, so they are being ignored. Move them to " + "~/.claudish/config.json.");
+    warnOnce4(`.claudish.json declares customEndpoints (${names.join(", ")}) but they are ` + "read from the GLOBAL config only, so they are being ignored. Move them to " + "~/.claudish/config.json.");
   } catch {}
 }
-function warnOnce3(message) {
-  if (warnedMessages3.has(message))
+function warnOnce4(message) {
+  if (warnedMessages4.has(message))
     return;
-  warnedMessages3.add(message);
+  warnedMessages4.add(message);
   logStderr(message);
 }
 function invalidateEndpointRegistration() {
   registered = false;
 }
-var registered = false, lastCustomResult, warnedMessages3;
+var registered = false, lastCustomResult, warnedMessages4;
 var init_endpoint_registration = __esm(() => {
   init_logger();
   init_profile_config();
   init_custom_endpoints_loader();
   init_predefined_endpoints();
   lastCustomResult = { registered: 0, errors: [], refused: [] };
-  warnedMessages3 = new Set;
+  warnedMessages4 = new Set;
 });
 
 // src/providers/provider-registry.ts
@@ -48045,8 +48476,8 @@ function readProjectCwd(dirName) {
   }
   return null;
 }
-function isActive(row, now = Date.now()) {
-  return now - row.mtimeMs < ACTIVE_WINDOW_MS;
+function isActive(row, now2 = Date.now()) {
+  return now2 - row.mtimeMs < ACTIVE_WINDOW_MS;
 }
 function discoverWorktreeGroups(repo) {
   const rootSlug = slugForPath(repo.root);
@@ -48661,9 +49092,9 @@ function setupSession(sessionPath, models, input) {
   }
   const ids = models.map((_, i) => String(i + 1).padStart(2, "0"));
   const shuffled = fisherYatesShuffle([...ids]);
-  const now = new Date().toISOString();
+  const now2 = new Date().toISOString();
   const manifest = {
-    created: now,
+    created: now2,
     models: {},
     shuffleOrder: shuffled
   };
@@ -48671,13 +49102,13 @@ function setupSession(sessionPath, models, input) {
     const anonId = shuffled[i];
     manifest.models[anonId] = {
       model: models[i],
-      assignedAt: now
+      assignedAt: now2
     };
     mkdirSync11(join28(sessionPath, "work", anonId), { recursive: true });
   }
   writeFileSync11(join28(sessionPath, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
   const status = {
-    startedAt: now,
+    startedAt: now2,
     models: Object.fromEntries(Object.keys(manifest.models).map((id) => [
       id,
       {
@@ -48958,9 +49389,9 @@ async function runModels(sessionPath, opts = {}) {
     return Math.max(0, Date.now() - s.updated_at);
   };
   const graceStartedAt = new Map;
-  const graceUsedMs = (id, now) => {
+  const graceUsedMs = (id, now2) => {
     const start = graceStartedAt.get(id);
-    return start === undefined ? 0 : Math.max(0, now - start);
+    return start === undefined ? 0 : Math.max(0, now2 - start);
   };
   const runningIds = () => [...processes.keys()].filter((id) => statusCache.models[id]?.state === "RUNNING");
   const timeoutModel = async (id, why) => {
@@ -49013,10 +49444,10 @@ async function runModels(sessionPath, opts = {}) {
       if (running.length === 0)
         return;
       const extended = [];
-      const now = Date.now();
+      const now2 = Date.now();
       for (const id of running) {
         const idleMs = idleMsFor(id);
-        const usedGrace = graceUsedMs(id, now);
+        const usedGrace = graceUsedMs(id, now2);
         if (!graceEnabled) {
           await timeoutModel(id, "deadline reached (grace extension disabled)");
         } else if (usedGrace >= maxGraceMs) {
@@ -49027,7 +49458,7 @@ async function runModels(sessionPath, opts = {}) {
           await timeoutModel(id, `no measurable progress for ${Math.round(idleMs / 1000)}s`);
         } else {
           if (!graceStartedAt.has(id))
-            graceStartedAt.set(id, now);
+            graceStartedAt.set(id, now2);
           extended.push(id);
         }
       }
@@ -50269,6 +50700,9 @@ function extractVersionParts(modelId) {
         break;
       continue;
     }
+    if (!started && /^\d+b$/.test(token) && Number.parseInt(match[0], 10) > 10) {
+      continue;
+    }
     if (!started) {
       started = true;
       for (const part of match[0].split(".")) {
@@ -54277,8 +54711,8 @@ class OpenRouterRequestQueue {
     }
   }
   async waitForNextSlot() {
-    const now = Date.now();
-    const timeSinceLastRequest = now - this.rateLimitState.lastRequestTime;
+    const now2 = Date.now();
+    const timeSinceLastRequest = now2 - this.rateLimitState.lastRequestTime;
     const delayMs = this.calculateDelay();
     this.rateLimitState.currentDelayMs = delayMs;
     if (timeSinceLastRequest < delayMs) {
@@ -54306,8 +54740,8 @@ class OpenRouterRequestQueue {
       }
     }
     if (this.rateLimitState.resetTime !== null && this.rateLimitState.remainingRequests !== null) {
-      const now = Date.now() / 1000;
-      const timeUntilReset = this.rateLimitState.resetTime - now;
+      const now2 = Date.now() / 1000;
+      const timeUntilReset = this.rateLimitState.resetTime - now2;
       if (timeUntilReset > 0 && this.rateLimitState.remainingRequests > 0) {
         const optimalDelay = timeUntilReset * 1000 / Math.max(this.rateLimitState.remainingRequests, 1);
         delayMs = Math.max(delayMs, Math.min(optimalDelay, this.maxDelayMs));
@@ -56491,11 +56925,15 @@ __export(exports_theme_mode, {
   classifyOscBackground: () => classifyOscBackground,
   detectAndSetThemeMode: () => detectAndSetThemeMode,
   detectAndSetThemeModeSync: () => detectAndSetThemeModeSync,
+  getTerminalBackground: () => getTerminalBackground,
+  getTerminalBackgroundHex: () => getTerminalBackgroundHex,
   getThemeMode: () => getThemeMode,
   onThemeModeChange: () => onThemeModeChange,
+  parseOscBackgroundHex: () => parseOscBackgroundHex,
   queryTerminalThemeMode: () => queryTerminalThemeMode,
   relativeLuminance: () => relativeLuminance,
   resetThemeModeForTests: () => resetThemeModeForTests,
+  setTerminalBackgroundHex: () => setTerminalBackgroundHex,
   setThemeMode: () => setThemeMode,
   themeModeFromColorFgBg: () => themeModeFromColorFgBg,
   themeModeOverride: () => themeModeOverride
@@ -56514,6 +56952,7 @@ function onThemeModeChange(cb) {
 }
 function resetThemeModeForTests() {
   setThemeMode(null);
+  background = null;
 }
 function themeModeOverride(env = process.env) {
   const raw2 = env.CLAUDISH_THEME?.trim().toLowerCase();
@@ -56550,6 +56989,31 @@ function classifyOscBackground(reply) {
   const lum = relativeLuminance(channel(m[1]), channel(m[2]), channel(m[3]));
   return lum >= MID_SRGB_LUMINANCE ? "light" : "dark";
 }
+function parseOscBackgroundHex(reply) {
+  const m = reply.match(/\]11;rgb:([0-9a-fA-F]{1,4})\/([0-9a-fA-F]{1,4})\/([0-9a-fA-F]{1,4})/);
+  if (!m)
+    return null;
+  const byte = (hex3) => {
+    const max = 16 ** hex3.length - 1;
+    const v = Math.round(Number.parseInt(hex3, 16) / max * 255);
+    return v.toString(16).padStart(2, "0");
+  };
+  return `#${byte(m[1])}${byte(m[2])}${byte(m[3])}`;
+}
+function getTerminalBackgroundHex() {
+  return background?.hex ?? null;
+}
+function getTerminalBackground() {
+  return background;
+}
+function setTerminalBackgroundHex(hex3) {
+  if (!hex3) {
+    background = null;
+    return;
+  }
+  const mode = classifyOscBackground(`]11;rgb:${hex3.slice(1, 3)}/${hex3.slice(3, 5)}/${hex3.slice(5, 7)}`);
+  background = mode ? { hex: hex3, mode } : null;
+}
 async function queryTerminalThemeMode(timeoutMs = 150) {
   const stdin = process.stdin;
   const stdout = process.stdout;
@@ -56577,7 +57041,10 @@ async function queryTerminalThemeMode(timeoutMs = 150) {
     const onData = (chunk) => {
       buffer += chunk.toString("latin1");
       if (/\]11;[^\x07\x1b]*(\x07|\x1b\\)/.test(buffer)) {
-        finish(classifyOscBackground(buffer));
+        const mode = classifyOscBackground(buffer);
+        const hex3 = parseOscBackgroundHex(buffer);
+        background = hex3 && mode ? { hex: hex3, mode } : null;
+        finish(mode);
       }
     };
     const timer = setTimeout(() => finish(null), timeoutMs);
@@ -56595,17 +57062,18 @@ async function queryTerminalThemeMode(timeoutMs = 150) {
 async function detectAndSetThemeMode() {
   const override = themeModeOverride();
   if (override) {
+    setTerminalBackgroundHex(null);
     setThemeMode(override);
     return override;
   }
-  const fromEnv = themeModeFromColorFgBg();
-  if (fromEnv) {
-    setThemeMode(fromEnv);
-    return fromEnv;
+  const fromOsc = await queryTerminalThemeMode(150);
+  if (fromOsc) {
+    setThemeMode(fromOsc);
+    return fromOsc;
   }
-  const fromOsc = await queryTerminalThemeMode();
-  setThemeMode(fromOsc);
-  return fromOsc;
+  const fromEnv = themeModeFromColorFgBg();
+  setThemeMode(fromEnv);
+  return fromEnv;
 }
 function detectAndSetThemeModeSync() {
   const mode = themeModeOverride() ?? themeModeFromColorFgBg();
@@ -56613,7 +57081,7 @@ function detectAndSetThemeModeSync() {
     setThemeMode(mode);
   return mode ?? detected;
 }
-var detected = null, listeners, MID_SRGB_LUMINANCE;
+var detected = null, listeners, MID_SRGB_LUMINANCE, background = null;
 var init_theme_mode = __esm(() => {
   listeners = [];
   MID_SRGB_LUMINANCE = relativeLuminance(0.5, 0.5, 0.5);
@@ -57352,8 +57820,6 @@ function describeSourceSync(p, config3) {
     return "env";
   if (hasCfg)
     return "cfg";
-  if (p.publicKeyFallback)
-    return "public";
   return null;
 }
 async function describeSource(p, config3) {
@@ -57394,7 +57860,6 @@ function toProviderDef(def) {
     defaultEndpoint: def.baseUrl || undefined,
     aliases: def.apiKeyAliases,
     isLocal: def.isLocal,
-    publicKeyFallback: !!def.publicKeyFallback,
     oauthSlug: def.oauthLoginSlug
   };
 }
@@ -68585,7 +69050,7 @@ var require_lib3 = __commonJS(function(exports, module) {
     var trail = encoder.end();
     return trail && trail.length > 0 ? Buffer2.concat([res, trail]) : res;
   };
-  iconv.decode = function decode3(buf, encoding, options) {
+  iconv.decode = function decode4(buf, encoding, options) {
     if (typeof buf === "string") {
       if (!iconv.skipDecodeWarning) {
         console.error("Iconv-lite warning: decode()-ing strings is deprecated. Refer to https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding");
@@ -69841,6 +70306,420 @@ var init_dist16 = __esm(() => {
   init_dist15();
 });
 
+// src/keychain-command.ts
+var exports_keychain_command = {};
+__export(exports_keychain_command, {
+  keychainCommand: () => keychainCommand
+});
+function ok(text) {
+  const c = cliAnsi();
+  return `${c.GREEN}${text}${c.RESET}`;
+}
+function warn(text) {
+  const c = cliAnsi();
+  return `${c.YELLOW}${text}${c.RESET}`;
+}
+function bad(text) {
+  const c = cliAnsi();
+  return `${c.RED}${text}${c.RESET}`;
+}
+function dim3(text) {
+  const c = cliAnsi();
+  return `${c.GRAY}${text}${c.RESET}`;
+}
+function strong(text) {
+  const c = cliAnsi();
+  return `${c.BOLD}${text}${c.RESET}`;
+}
+function requireKeychain() {
+  const reason = keychainUnavailableReason();
+  if (!reason)
+    return true;
+  console.error(bad(`Keychain unavailable: ${reason}`));
+  console.error(dim3("claudish's keychain backend uses the macOS Security framework via /usr/bin/security."));
+  return false;
+}
+function catalogEnvVars() {
+  const names = new Set;
+  for (const p of getAllProviders()) {
+    if (p.apiKeyEnvVar)
+      names.add(p.apiKeyEnvVar);
+    for (const alias of p.apiKeyAliases ?? [])
+      names.add(alias);
+  }
+  return Array.from(names).sort();
+}
+function keychainStatus() {
+  const supported = isKeychainSupported();
+  const enabled2 = isKeychainEnabled();
+  console.log(strong("macOS Keychain backend"));
+  console.log(`  platform    ${supported ? ok("supported") : bad(`unsupported (${process.platform})`)}`);
+  console.log(`  backend     ${enabled2 ? ok("enabled") : dim3("disabled")}`);
+  console.log(`  service     ${dim3(KEYCHAIN_SERVICE)}`);
+  if (!supported)
+    return;
+  const listed = enumerateKeychainVars();
+  if (listed.failed) {
+    console.log(`  stored keys ${bad("could not read the keychain")}`);
+    console.log();
+    console.log(bad(listed.error ?? "unknown error"));
+    console.log(dim3("The keychain may be locked, or access may have been denied."));
+    process.exitCode = 1;
+    return;
+  }
+  const stored = listed.names;
+  console.log(`  stored keys ${stored.length > 0 ? ok(String(stored.length)) : dim3("0")}`);
+  if (!enabled2 && stored.length > 0) {
+    console.log();
+    console.log(warn(`${stored.length} key(s) are in the keychain but the backend is disabled, so claudish will not read them.`));
+    console.log(dim3("  Enable with: claudish keychain enable"));
+  }
+  if (enabled2 && stored.length === 0) {
+    console.log();
+    console.log(dim3("Nothing stored yet. Copy your existing keys in with:"));
+    console.log(dim3("  claudish keychain import"));
+  }
+  console.log();
+  console.log(dim3("Resolution order: env var \u2192 alias \u2192 config.json \u2192 macOS Keychain \u2192 1Password"));
+}
+function keychainList() {
+  if (!requireKeychain())
+    return;
+  const listed = enumerateKeychainVars();
+  if (listed.failed) {
+    console.error(bad(`Could not read the keychain: ${listed.error ?? "unknown error"}`));
+    console.error(dim3("The keychain may be locked, or access may have been denied."));
+    process.exitCode = 1;
+    return;
+  }
+  const stored = listed.names;
+  if (stored.length === 0) {
+    console.log(dim3("No keys stored in the keychain."));
+    console.log(dim3("Copy your existing keys in with: claudish keychain import"));
+    return;
+  }
+  const width = Math.max(...stored.map((n) => n.length));
+  for (const name of stored) {
+    let tail;
+    try {
+      const value = readKeychainSecret(name);
+      tail = value ? dim3(valueTail2(value)) : bad("unreadable");
+    } catch (err) {
+      tail = bad(err instanceof KeychainError ? "denied" : "error");
+    }
+    const shadowed = process.env[name] ? warn("  (shadowed by an env var)") : "";
+    console.log(`  ${name.padEnd(width)}  ${tail}${shadowed}`);
+  }
+  if (!isKeychainEnabled()) {
+    console.log();
+    console.log(warn("The keychain backend is disabled \u2014 claudish will not read these."));
+    console.log(dim3("  Enable with: claudish keychain enable"));
+  }
+}
+async function collectImportPlan(opts) {
+  const wanted = opts.only ?? catalogEnvVars();
+  const listed = enumerateKeychainVars();
+  if (listed.failed) {
+    throw new KeychainError(`Cannot read the keychain to plan this import: ${listed.error ?? "unknown error"}. ` + "Refusing to continue \u2014 without knowing what is already stored, an import could " + "silently replace existing keys.");
+  }
+  const stored = new Set(listed.names);
+  const plan = new Map;
+  const classify = (envVar, value, origin) => {
+    const problem = describeUnstorableValue(value) ?? undefined;
+    let action = stored.has(envVar) ? "overwrite" : "new";
+    if (action === "overwrite") {
+      try {
+        if (readKeychainSecret(envVar) === value)
+          action = "unchanged";
+      } catch {}
+    }
+    plan.set(envVar, { envVar, value, origin, action, problem });
+  };
+  if (opts.from === "env" || opts.from === "all") {
+    for (const envVar of wanted) {
+      const value = process.env[envVar];
+      if (value)
+        classify(envVar, value, "environment");
+    }
+  }
+  if ((opts.from === "1password" || opts.from === "all") && hasOpSources()) {
+    const missing = wanted.filter((n) => !plan.has(n));
+    if (missing.length > 0) {
+      const resolved = await resolveOpKeyForEnvVars(new Set(missing), {
+        onAuthFailure: "throw",
+        allowPrompt: true
+      });
+      for (const [envVar, value] of Object.entries(resolved)) {
+        if (value)
+          classify(envVar, value, "1Password");
+      }
+    }
+  }
+  return Array.from(plan.values()).sort((a, b) => a.envVar.localeCompare(b.envVar));
+}
+function renderPlan(plan) {
+  const width = Math.max(...plan.map((e) => e.envVar.length));
+  for (const e of plan) {
+    if (e.problem) {
+      console.log(`  ${bad("skip")}       ${e.envVar.padEnd(width)}  ${bad(e.problem)}`);
+      continue;
+    }
+    const label = e.action === "new" ? ok("new") : e.action === "overwrite" ? warn("overwrite") : dim3("unchanged");
+    const pad = " ".repeat(Math.max(0, 10 - (e.action === "new" ? 3 : e.action.length)));
+    console.log(`  ${label}${pad} ${e.envVar.padEnd(width)}  ${dim3(valueTail2(e.value))} ${dim3(`from ${e.origin}`)}`);
+  }
+}
+function writeImportEntries(entries) {
+  let written = 0;
+  const failures = [];
+  for (const entry of entries) {
+    try {
+      writeKeychainSecret(entry.envVar, entry.value);
+      written++;
+    } catch (err) {
+      failures.push(`${entry.envVar}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { written, failures };
+}
+function reportImportResult(written, failures) {
+  if (written > 0 && !isKeychainEnabled()) {
+    setKeychainEnabled(true);
+    console.log(ok("Keychain backend enabled."));
+  }
+  console.log(ok(`Stored ${written} key(s) in the keychain.`));
+  if (failures.length > 0) {
+    console.error(bad(`${failures.length} key(s) failed:`));
+    for (const f of failures)
+      console.error(`  ${f}`);
+    process.exitCode = 1;
+  }
+}
+async function keychainImport(opts) {
+  if (!requireKeychain())
+    return;
+  let plan;
+  try {
+    plan = await collectImportPlan(opts);
+  } catch (err) {
+    console.error(bad(`Could not build the import plan: ${err instanceof Error ? err.message : String(err)}`));
+    process.exitCode = 1;
+    return;
+  }
+  if (plan.length === 0) {
+    console.log(dim3("Nothing to import \u2014 no matching keys found in the requested sources."));
+    if (opts.from === "1password" && !hasOpSources()) {
+      console.log(dim3("No 1Password source is configured. See: claudish config \u2192 1Password tab"));
+    }
+    return;
+  }
+  const writable = plan.filter((e) => !e.problem && e.action !== "unchanged");
+  const overwrites = writable.filter((e) => e.action === "overwrite");
+  console.log(strong(`Import plan \u2014 ${plan.length} key(s) considered`));
+  renderPlan(plan);
+  console.log();
+  if (writable.length === 0) {
+    console.log(dim3("Everything is already stored with the same value. Nothing to do."));
+    return;
+  }
+  if (overwrites.length > 0) {
+    console.log(warn(`${overwrites.length} existing keychain item(s) will be REPLACED. The previous values cannot be recovered.`));
+  }
+  if (opts.dryRun) {
+    console.log(dim3("--dry-run: nothing was written."));
+    return;
+  }
+  if (!opts.yes) {
+    const { confirm } = await Promise.resolve().then(() => (init_dist16(), exports_dist));
+    const proceed = await confirm({
+      message: `Store ${writable.length} key(s) in the macOS Keychain?`,
+      default: overwrites.length === 0
+    });
+    if (!proceed) {
+      console.log(dim3("Cancelled \u2014 nothing was written."));
+      return;
+    }
+  }
+  const { written, failures } = writeImportEntries(writable);
+  reportImportResult(written, failures);
+  const skipped = plan.filter((e) => e.problem);
+  if (skipped.length > 0) {
+    console.log(warn(`${skipped.length} key(s) skipped \u2014 see the plan above.`));
+  }
+}
+async function readSecretInteractively(envVar) {
+  if (!process.stdin.isTTY) {
+    const piped = await new Response(Bun.stdin.stream()).text();
+    const value2 = piped.replace(/\r?\n$/, "");
+    return value2.length > 0 ? value2 : null;
+  }
+  const { password } = await Promise.resolve().then(() => (init_dist16(), exports_dist));
+  const value = await password({ message: `Value for ${envVar}:`, mask: "\u2022" });
+  return value.length > 0 ? value : null;
+}
+async function keychainSet(envVar) {
+  if (!requireKeychain())
+    return;
+  if (!envVar) {
+    console.error(bad("Usage: claudish keychain set <ENV_VAR>"));
+    process.exitCode = 1;
+    return;
+  }
+  if (!isValidKeychainVarName(envVar)) {
+    console.error(bad(`"${envVar}" is not a valid environment variable name.`));
+    process.exitCode = 1;
+    return;
+  }
+  const value = await readSecretInteractively(envVar);
+  if (!value) {
+    console.log(dim3("Aborted \u2014 no value given."));
+    return;
+  }
+  try {
+    writeKeychainSecret(envVar, value);
+  } catch (err) {
+    console.error(bad(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+    return;
+  }
+  if (!isKeychainEnabled())
+    setKeychainEnabled(true);
+  console.log(ok(`Stored ${envVar} ${dim3(valueTail2(value))} in the macOS Keychain.`));
+  if (process.env[envVar]) {
+    console.log(warn(`Note: ${envVar} is also set in this shell, and an env var takes precedence at runtime.`));
+  }
+}
+function keychainRemove(envVar) {
+  if (!requireKeychain())
+    return;
+  if (!envVar) {
+    console.error(bad("Usage: claudish keychain rm <ENV_VAR>"));
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const removed = deleteKeychainSecret(envVar);
+    console.log(removed ? ok(`Removed ${envVar} from the macOS Keychain.`) : dim3(`${envVar} was not in the keychain \u2014 nothing to remove.`));
+  } catch (err) {
+    console.error(bad(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+  }
+}
+function keychainToggle(enabled2) {
+  if (enabled2 && !requireKeychain())
+    return;
+  setKeychainEnabled(enabled2);
+  invalidateKeychainCache();
+  console.log(enabled2 ? ok("Keychain backend enabled \u2014 claudish will now read keys from the macOS Keychain.") : ok("Keychain backend disabled. Stored items were left untouched."));
+  if (!enabled2) {
+    console.log(dim3("Remove the items themselves with: claudish keychain rm <ENV_VAR>"));
+  }
+}
+function usage() {
+  console.log(`${strong("claudish keychain")} \u2014 macOS Keychain credential backend
+
+  ${strong("status")}                  Backend state and how many keys are stored (default)
+  ${strong("list")}                    Stored variables, with ${dim3("\u2022\u2022\u2022\u20221234")} identification tails
+  ${strong("import")} [options]        Copy secrets from env vars / 1Password into the keychain
+  ${strong("set")} <ENV_VAR>           Store one secret (prompted, or piped on stdin)
+  ${strong("rm")} <ENV_VAR>            Remove one secret
+  ${strong("enable")} | ${strong("disable")}        Turn the backend on/off (moves no secrets)
+
+${strong("import options")}
+  --from env|1password|all   Source to copy from (default: all)
+  --only VAR,VAR             Restrict to these variables
+  --dry-run                  Show the plan and stop
+  --yes                      Skip the confirmation
+
+Resolution order: ${dim3("env var \u2192 alias \u2192 config.json \u2192 macOS Keychain \u2192 1Password")}
+`);
+}
+function parseOnly(args) {
+  const idx = args.findIndex((a) => a === "--only" || a.startsWith("--only="));
+  if (idx === -1)
+    return;
+  const raw2 = args[idx].includes("=") ? args[idx].split("=").slice(1).join("=") : args[idx + 1];
+  if (!raw2)
+    return;
+  const names = raw2.split(",").map((n) => n.trim()).filter(Boolean);
+  return names.length > 0 ? names : undefined;
+}
+function parseFrom(args) {
+  const idx = args.findIndex((a) => a === "--from" || a.startsWith("--from="));
+  if (idx === -1)
+    return "all";
+  const raw2 = (args[idx].includes("=") ? args[idx].split("=").slice(1).join("=") : args[idx + 1])?.trim().toLowerCase();
+  if (raw2 === "env" || raw2 === "1password" || raw2 === "all")
+    return raw2;
+  if (raw2 === "op")
+    return "1password";
+  return "all";
+}
+function positionalArgs(args) {
+  const out = [];
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("-")) {
+      if (VALUE_FLAGS.has(arg))
+        i++;
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
+async function keychainCommand(args) {
+  const positional = positionalArgs(args);
+  const sub = positional[0] ?? "status";
+  switch (sub) {
+    case "status":
+      keychainStatus();
+      return;
+    case "list":
+    case "ls":
+      keychainList();
+      return;
+    case "import":
+      await keychainImport({
+        from: parseFrom(args),
+        only: parseOnly(args),
+        dryRun: args.includes("--dry-run"),
+        yes: args.includes("--yes") || args.includes("-y")
+      });
+      return;
+    case "set":
+      await keychainSet(positional[1]);
+      return;
+    case "rm":
+    case "remove":
+    case "delete":
+      keychainRemove(positional[1]);
+      return;
+    case "enable":
+      keychainToggle(true);
+      return;
+    case "disable":
+      keychainToggle(false);
+      return;
+    case "help":
+      usage();
+      return;
+    default:
+      console.error(bad(`Unknown subcommand: ${sub}`));
+      usage();
+      process.exitCode = 1;
+  }
+}
+var VALUE_FLAGS;
+var init_keychain_command = __esm(() => {
+  init_ansi();
+  init_op_source();
+  init_profile_config();
+  init_keychain();
+  init_provider_definitions();
+  VALUE_FLAGS = new Set(["--config", "--from", "--only"]);
+});
+
 // src/auth/antigravity-oauth.ts
 import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync26, unlinkSync as unlinkSync7 } from "fs";
@@ -69881,16 +70760,16 @@ function defaultRunAgyAuth(agyPath, interactive) {
     spawnSync3(agyPath, ["-p", "hello", "--print-timeout", "3m"], { stdio: "inherit" });
   }
 }
-async function pollForToken(deps) {
-  const deadline = deps.now() + deps.timing.graceMs;
+async function pollForToken(deps2) {
+  const deadline = deps2.now() + deps2.timing.graceMs;
   for (;; ) {
-    const tok = deps.readToken();
+    const tok = deps2.readToken();
     if (tok)
       return tok;
-    if (deps.now() >= deadline)
+    if (deps2.now() >= deadline)
       return null;
-    const remaining = deadline - deps.now();
-    await deps.sleep(Math.min(deps.timing.intervalMs, Math.max(0, remaining)));
+    const remaining = deadline - deps2.now();
+    await deps2.sleep(Math.min(deps2.timing.intervalMs, Math.max(0, remaining)));
   }
 }
 
@@ -69904,67 +70783,67 @@ class AntigravityOAuth {
   }
   constructor() {}
   async login(depsOverride = {}) {
-    const deps = { ...defaultLoginDeps, ...depsOverride };
+    const deps2 = { ...defaultLoginDeps, ...depsOverride };
     log("[AntigravityOAuth] Starting agy-delegated login");
-    if (deps.hasToken()) {
-      console.log(`\u2705 Already authenticated with Antigravity. Use: claudish --model ag@${await (deps.suggestModel ?? defaultSuggestModel)()}`);
-      return deps.exit(0);
+    if (deps2.hasToken()) {
+      console.log(`\u2705 Already authenticated with Antigravity. Use: claudish --model ag@${await (deps2.suggestModel ?? defaultSuggestModel)()}`);
+      return deps2.exit(0);
     }
-    let agyPath = deps.locateAgy();
+    let agyPath = deps2.locateAgy();
     if (!agyPath) {
       console.log("\nThe Antigravity CLI (`agy`) is required to sign in to Antigravity.");
       console.log(`claudish delegates Antigravity sign-in to agy \u2014 agy holds the current OAuth secret
 ` + "and writes the session to the shared keychain store that claudish reads.");
-      if (!deps.isInteractive()) {
+      if (!deps2.isInteractive()) {
         printManualInstall();
-        return deps.exit(0);
+        return deps2.exit(0);
       }
-      const proceed = await deps.confirmInstall();
+      const proceed = await deps2.confirmInstall();
       if (!proceed) {
         printManualInstall();
-        return deps.exit(0);
+        return deps2.exit(0);
       }
       console.log(`
 Installing the Antigravity CLI\u2026
 `);
-      if (!deps.runInstall()) {
+      if (!deps2.runInstall()) {
         console.log(`
 \u274C Antigravity CLI installation failed.`);
         printManualInstall();
-        return deps.exit(0);
+        return deps2.exit(0);
       }
-      agyPath = deps.locateAgy();
+      agyPath = deps2.locateAgy();
       if (!agyPath) {
         console.log(`
 \u274C Antigravity CLI still not found after install.`);
         printManualInstall();
-        return deps.exit(0);
+        return deps2.exit(0);
       }
     }
     console.log(`
 Launching the Antigravity CLI to sign in \u2014 complete the sign-in in your browser.
 ` + `claudish will detect the session automatically.
 `);
-    deps.runAgyAuth(agyPath, false);
-    let token = await pollForToken(deps);
+    deps2.runAgyAuth(agyPath, false);
+    let token = await pollForToken(deps2);
     if (!token) {
       console.log(`
 No session detected yet. Starting the Antigravity CLI interactively \u2014
 ` + "sign in, then exit agy (its `/quit` command or Ctrl-C) to return here.\n");
-      deps.runAgyAuth(agyPath, true);
-      token = await pollForToken(deps);
+      deps2.runAgyAuth(agyPath, true);
+      token = await pollForToken(deps2);
     }
     if (token) {
-      deps.onAuthenticated();
+      deps2.onAuthenticated();
       console.log(`
-\u2705 Authenticated with Antigravity. Use: claudish --model ag@${await (deps.suggestModel ?? defaultSuggestModel)()}`);
-      return deps.exit(0);
+\u2705 Authenticated with Antigravity. Use: claudish --model ag@${await (deps2.suggestModel ?? defaultSuggestModel)()}`);
+      return deps2.exit(0);
     }
     console.log("\nNo Antigravity session detected. Run `agy` and sign in, then retry `claudish login antigravity`.");
-    return deps.exit(0);
+    return deps2.exit(0);
   }
-  async logout(deps) {
-    deleteSharedAntigravityToken(deps);
+  async logout(deps2) {
+    deleteSharedAntigravityToken(deps2);
     try {
       const tokenFile = join36(homedir31(), ".gemini", "antigravity-cli", "antigravity-oauth-token");
       if (existsSync26(tokenFile))
@@ -70166,7 +71045,7 @@ async function quotaCommand(provider) {
 `);
     return;
   }
-  renderPlan(adapter, plan);
+  renderPlan2(adapter, plan);
 }
 function resolveAdapterFromInput(input) {
   const raw2 = input.toLowerCase().replace(/@+$/, "");
@@ -70196,7 +71075,7 @@ async function promptForAdapter() {
   });
   return select({ message: "Select provider:", choices });
 }
-function renderPlan(adapter, plan) {
+function renderPlan2(adapter, plan) {
   console.log("");
   boxTop(plan.label);
   boxRow("Provider", adapter.providerId);
@@ -70407,11 +71286,11 @@ function readSlimCacheWithFreshness(reader) {
   const stale = !Number.isFinite(lastUpdatedMs) || ageMs > FIREBASE_CACHE_TTL_MS;
   return { entries: cache3.entries ?? [], stale };
 }
-function createCatalogClient(deps = {}) {
-  const _getModelsByProvider = deps.getModelsByProvider ?? getModelsByProvider;
-  const _getModelByIdFromFirebase = deps.getModelByIdFromFirebase ?? getModelByIdFromFirebase;
-  const _searchModels = deps.searchModels ?? searchModels;
-  const _readSlimCache = deps.readSlimCache ?? readAllModelsCache;
+function createCatalogClient(deps2 = {}) {
+  const _getModelsByProvider = deps2.getModelsByProvider ?? getModelsByProvider;
+  const _getModelByIdFromFirebase = deps2.getModelByIdFromFirebase ?? getModelByIdFromFirebase;
+  const _searchModels = deps2.searchModels ?? searchModels;
+  const _readSlimCache = deps2.readSlimCache ?? readAllModelsCache;
   return {
     async modelsByVendor(vendorSlug) {
       const slug = vendorSlug.toLowerCase();
@@ -70595,6 +71474,8 @@ function resolveDiscoveredContextLength(m) {
   }
 }
 function resolveDiscoveredReleaseDate(m) {
+  if (m.ignoreCatalogReleaseDate)
+    return m.releaseDate;
   try {
     const catalogDate = lookupModel(m.id)?.releaseDate;
     if (catalogDate)
@@ -71408,10 +72289,42 @@ function registerPaletteRefresher(fn) {
   paletteRefreshers.push(fn);
   fn();
 }
+function hexChannels(hex3) {
+  const m = /^#([0-9a-f]{6})$/i.exec(hex3.trim());
+  if (!m)
+    return null;
+  const n = Number.parseInt(m[1], 16);
+  return [n >> 16 & 255, n >> 8 & 255, n & 255];
+}
+function channelsToHex(c) {
+  const hex3 = c.map((v) => Math.max(0, Math.min(255, Math.round(v))).toString(16).padStart(2, "0")).join("");
+  return `#${hex3}`;
+}
+function retintSurfaces(palette, pageHex) {
+  const paletteBg = hexChannels(palette.bg);
+  const page = hexChannels(pageHex);
+  if (!paletteBg || !page)
+    return;
+  for (const token of SURFACE_TOKENS) {
+    const original = hexChannels(palette[token]);
+    if (!original)
+      continue;
+    C[token] = channelsToHex([
+      page[0] + (original[0] - paletteBg[0]),
+      page[1] + (original[1] - paletteBg[1]),
+      page[2] + (original[2] - paletteBg[2])
+    ]);
+  }
+}
 function applyTuiTheme(mode) {
   const palette = mode === "light" ? LIGHT2 : DARK;
   activeLatencyBuckets = mode === "light" ? LATENCY_BUCKETS_LIGHT : LATENCY_BUCKETS_DARK;
   Object.assign(C, palette);
+  const terminalBg = getTerminalBackground();
+  if (terminalBg && terminalBg.mode === mode) {
+    C.bg = terminalBg.hex;
+    retintSurfaces(palette, terminalBg.hex);
+  }
   Object.assign(STAGE_BG, mode === "light" ? STAGE_BG_LIGHT : STAGE_BG_DARK);
   STAGE_BG_ANSI.network = hexToAnsiBg(STAGE_BG.network);
   STAGE_BG_ANSI.server = hexToAnsiBg(STAGE_BG.server);
@@ -71488,7 +72401,7 @@ function tokBarCells(tokensPerSec, maxTokPerSec, tokWidth) {
   const raw2 = Math.round(tokWidth * Math.max(0, tokensPerSec) / denom);
   return Math.min(tokWidth, Math.max(0, raw2));
 }
-var DARK, LIGHT2, C, bold3, A, LATENCY_BUCKETS_DARK, LATENCY_BUCKETS_LIGHT, activeLatencyBuckets, latencyFg = "#ffffff", LATENCY_FG_ANSI = "\x1B[38;2;255;255;255m", ANSI_RESET = "\x1B[0m", STAGE_BG_DARK, STAGE_BG_LIGHT, STAGE_BG, STAGE_FG, STAGE_BG_ANSI, paletteRefreshers;
+var DARK, LIGHT2, C, bold3, A, LATENCY_BUCKETS_DARK, LATENCY_BUCKETS_LIGHT, activeLatencyBuckets, latencyFg = "#ffffff", LATENCY_FG_ANSI = "\x1B[38;2;255;255;255m", ANSI_RESET = "\x1B[0m", STAGE_BG_DARK, STAGE_BG_LIGHT, STAGE_BG, STAGE_FG, STAGE_BG_ANSI, paletteRefreshers, SURFACE_TOKENS;
 var init_theme2 = __esm(() => {
   init_theme_mode();
   DARK = {
@@ -71598,6 +72511,7 @@ var init_theme2 = __esm(() => {
     streaming: hexToAnsiBg(STAGE_BG.streaming)
   };
   paletteRefreshers = [];
+  SURFACE_TOKENS = ["bgAlt", "border", "tabInactiveBg", "chipKeyBg", "chipLabelBg"];
   onThemeModeChange(applyTuiTheme);
 });
 
@@ -75057,7 +75971,7 @@ function printHelp2() {
   const A2 = cliAnsi();
   const c = (esc2) => (s) => useColor && esc2 ? `${esc2}${s}${A2.RESET}` : s;
   const bold4 = c(A2.BOLD);
-  const dim3 = c(A2.DIM);
+  const dim4 = c(A2.DIM);
   const cyan = c(A2.CYAN);
   const green2 = c(A2.GREEN);
   const yellow2 = c(A2.YELLOW);
@@ -75065,89 +75979,89 @@ function printHelp2() {
   const blue = c(A2.BLUE);
   const h = (title) => bold4(cyan(`\u258C ${title}`));
   console.log(`
-${bold4("claudish")} ${dim3("\xB7")} Run Claude Code with any AI model
-${dim3("OpenRouter \xB7 Gemini \xB7 OpenAI \xB7 xAI \xB7 MiniMax \xB7 Kimi \xB7 GLM \xB7 Z.AI \xB7 Sakana \xB7 Poe \xB7 LiteLLM \xB7 Local")}
+${bold4("claudish")} ${dim4("\xB7")} Run Claude Code with any AI model
+${dim4("OpenRouter \xB7 Gemini \xB7 OpenAI \xB7 xAI \xB7 MiniMax \xB7 Kimi \xB7 GLM \xB7 Z.AI \xB7 Sakana \xB7 Poe \xB7 LiteLLM \xB7 Local")}
 
 ${h("USAGE")}
-  ${green2("claudish")}                                ${dim3("# Interactive mode (default, model selector)")}
-  ${green2("claudish")} ${yellow2("[OPTIONS] <claude-args...>")}     ${dim3("# Single-shot mode (requires --model)")}
-  ${green2("claudish")} ${green2("--team")} ${yellow2("a,b,c")} ${yellow2('"prompt"')}          ${dim3("# Run models in parallel (magmux grid)")}
-  ${green2("claudish")} ${green2("--team")} ${yellow2("a,b,c")} ${green2("-f")} ${yellow2("input.md")}       ${dim3("# Team mode with file input")}
+  ${green2("claudish")}                                ${dim4("# Interactive mode (default, model selector)")}
+  ${green2("claudish")} ${yellow2("[OPTIONS] <claude-args...>")}     ${dim4("# Single-shot mode (requires --model)")}
+  ${green2("claudish")} ${green2("--team")} ${yellow2("a,b,c")} ${yellow2('"prompt"')}          ${dim4("# Run models in parallel (magmux grid)")}
+  ${green2("claudish")} ${green2("--team")} ${yellow2("a,b,c")} ${green2("-f")} ${yellow2("input.md")}       ${dim4("# Team mode with file input")}
 
 ${h("MODEL ROUTING")}
   ${bold4("New syntax:")} ${yellow2("provider@model[:concurrency]")}
-    ${magenta("google@gemini-3-pro")}              ${dim3("Direct Google API (explicit)")}
-    ${magenta("openrouter@google/gemini-3-pro")}   ${dim3("OpenRouter (explicit)")}
-    ${magenta("oai@gpt-5.3")}                      ${dim3("Direct OpenAI API (shortcut)")}
-    ${magenta("ollama@llama3.2:3")}                ${dim3("Local Ollama, 3 concurrent requests")}
-    ${magenta("ollama@llama3.2:0")}                ${dim3("Local Ollama, no limits")}
+    ${magenta("google@gemini-3-pro")}              ${dim4("Direct Google API (explicit)")}
+    ${magenta("openrouter@google/gemini-3-pro")}   ${dim4("OpenRouter (explicit)")}
+    ${magenta("oai@gpt-5.3")}                      ${dim4("Direct OpenAI API (shortcut)")}
+    ${magenta("ollama@llama3.2:3")}                ${dim4("Local Ollama, 3 concurrent requests")}
+    ${magenta("ollama@llama3.2:0")}                ${dim4("Local Ollama, no limits")}
 
   ${bold4("Provider shortcuts:")}
-    ${magenta("g, gemini")}      ${dim3("->")} Google Gemini       ${dim3("google@gemini-3-pro")}
-    ${magenta("oai")}            ${dim3("->")} OpenAI Direct       ${dim3("oai@gpt-5.3")}
-    ${magenta("cx, codex")}      ${dim3("->")} OpenAI Codex        ${dim3("cx@gpt-5.3 (Responses API)")}
-    ${magenta("or")}             ${dim3("->")} OpenRouter          ${dim3("or@openai/gpt-5.3")}
-    ${magenta("x-ai, xai, grok")} ${dim3("->")} xAI / Grok         ${dim3("x-ai@grok-3")}
-    ${magenta("mm, mmax")}       ${dim3("->")} MiniMax Direct      ${dim3("mm@MiniMax-M2.1")}
-    ${magenta("mmc")}            ${dim3("->")} MiniMax Coding      ${dim3("mmc@MiniMax-M2.1")}
-    ${magenta("kimi, moon")}     ${dim3("->")} Kimi Direct         ${dim3("kimi@kimi-k2-thinking-turbo")}
-    ${magenta("kc")}             ${dim3("->")} Kimi Coding         ${dim3("kc@kimi-k2-thinking-turbo")}
-    ${magenta("glm, zhipu")}     ${dim3("->")} GLM Direct          ${dim3("glm@glm-4.7")}
-    ${magenta("gc")}             ${dim3("->")} GLM Coding          ${dim3("gc@glm-4.7")}
-    ${magenta("z-ai, zai")}      ${dim3("->")} Z.AI Direct         ${dim3("z-ai@glm-4.7")}
-    ${magenta("oc, llama, lc, meta")} ${dim3("->")} OllamaCloud    ${dim3("oc@llama-3.1")}
-    ${magenta("zen")}            ${dim3("->")} OpenCode Zen        ${dim3("zen@grok-code")}
-    ${magenta("zengo, zgo")}     ${dim3("->")} OpenCode Zen Go     ${dim3("zengo@grok-code")}
-    ${magenta("v, vertex")}      ${dim3("->")} Vertex AI           ${dim3("v@gemini-2.5-flash")}
-    ${magenta("poe")}            ${dim3("->")} Poe                 ${dim3("poe@GPT-4o")}
-    ${magenta("litellm, ll")}    ${dim3("->")} LiteLLM             ${dim3("ll@gpt-4o (needs LITELLM_BASE_URL)")}
-    ${magenta("ds")}             ${dim3("->")} DeepSeek            ${dim3("ds@deepseek-chat")}
-    ${magenta("sakana, fugu")}   ${dim3("->")} Sakana Fugu         ${dim3("fugu@fugu-ultra")}
-    ${magenta("sc")}             ${dim3("->")} Sakana Subscription ${dim3("sc@fugu-ultra")}
-    ${magenta("ollama")}         ${dim3("->")} Ollama (local)      ${dim3("ollama@llama3.2")}
-    ${magenta("lms, lmstudio")}  ${dim3("->")} LM Studio (local)   ${dim3("lms@qwen")}
-    ${magenta("vllm")}           ${dim3("->")} vLLM (local)        ${dim3("vllm@model")}
-    ${magenta("mlx")}            ${dim3("->")} MLX (local)         ${dim3("mlx@model")}
-
-  ${bold4("Native auto-detection")} ${dim3("(when no provider specified):")}
-    ${yellow2("google/*, gemini-*")}      ${dim3("->")} Google API
-    ${yellow2("openai/*, gpt-*, o1-*")}   ${dim3("->")} OpenAI API
-    ${yellow2("x-ai/*, grok-*")}          ${dim3("->")} xAI
-    ${yellow2("meta-llama/*, llama-*")}   ${dim3("->")} OllamaCloud
-    ${yellow2("minimax/*, abab-*")}       ${dim3("->")} MiniMax API
-    ${yellow2("moonshot/*, kimi-*")}      ${dim3("->")} Kimi API
-    ${yellow2("zhipu/*, glm-*")}          ${dim3("->")} GLM API
-    ${yellow2("sakana/*, fugu-*")}        ${dim3("->")} Sakana Fugu
-    ${yellow2("poe:*")}                   ${dim3("->")} Poe
-    ${yellow2("anthropic/*, claude-*")}   ${dim3("->")} Native Anthropic
-    ${yellow2("(unknown vendor/)")}       ${dim3("->")} Error (use openrouter@vendor/model)
-
-  ${dim3("A defaultProvider (config / --default-provider) catches bare names that match no rule.")}
+    ${magenta("g, gemini")}      ${dim4("->")} Google Gemini       ${dim4("google@gemini-3-pro")}
+    ${magenta("oai")}            ${dim4("->")} OpenAI Direct       ${dim4("oai@gpt-5.3")}
+    ${magenta("cx, codex")}      ${dim4("->")} OpenAI Codex        ${dim4("cx@gpt-5.3 (Responses API)")}
+    ${magenta("or")}             ${dim4("->")} OpenRouter          ${dim4("or@openai/gpt-5.3")}
+    ${magenta("x-ai, xai, grok")} ${dim4("->")} xAI / Grok         ${dim4("x-ai@grok-3")}
+    ${magenta("mm, mmax")}       ${dim4("->")} MiniMax Direct      ${dim4("mm@MiniMax-M2.1")}
+    ${magenta("mmc")}            ${dim4("->")} MiniMax Coding      ${dim4("mmc@MiniMax-M2.1")}
+    ${magenta("kimi, moon")}     ${dim4("->")} Kimi Direct         ${dim4("kimi@kimi-k2-thinking-turbo")}
+    ${magenta("kc")}             ${dim4("->")} Kimi Coding         ${dim4("kc@kimi-k2-thinking-turbo")}
+    ${magenta("glm, zhipu")}     ${dim4("->")} GLM Direct          ${dim4("glm@glm-4.7")}
+    ${magenta("gc")}             ${dim4("->")} GLM Coding          ${dim4("gc@glm-4.7")}
+    ${magenta("z-ai, zai")}      ${dim4("->")} Z.AI Direct         ${dim4("z-ai@glm-4.7")}
+    ${magenta("oc, llama, lc, meta")} ${dim4("->")} OllamaCloud    ${dim4("oc@llama-3.1")}
+    ${magenta("zen")}            ${dim4("->")} OpenCode Zen        ${dim4("zen@grok-code")}
+    ${magenta("zengo, zgo")}     ${dim4("->")} OpenCode Zen Go     ${dim4("zengo@grok-code")}
+    ${magenta("v, vertex")}      ${dim4("->")} Vertex AI           ${dim4("v@gemini-2.5-flash")}
+    ${magenta("poe")}            ${dim4("->")} Poe                 ${dim4("poe@GPT-4o")}
+    ${magenta("litellm, ll")}    ${dim4("->")} LiteLLM             ${dim4("ll@gpt-4o (needs LITELLM_BASE_URL)")}
+    ${magenta("ds")}             ${dim4("->")} DeepSeek            ${dim4("ds@deepseek-chat")}
+    ${magenta("sakana, fugu")}   ${dim4("->")} Sakana Fugu         ${dim4("fugu@fugu-ultra")}
+    ${magenta("sc")}             ${dim4("->")} Sakana Subscription ${dim4("sc@fugu-ultra")}
+    ${magenta("ollama")}         ${dim4("->")} Ollama (local)      ${dim4("ollama@llama3.2")}
+    ${magenta("lms, lmstudio")}  ${dim4("->")} LM Studio (local)   ${dim4("lms@qwen")}
+    ${magenta("vllm")}           ${dim4("->")} vLLM (local)        ${dim4("vllm@model")}
+    ${magenta("mlx")}            ${dim4("->")} MLX (local)         ${dim4("mlx@model")}
+
+  ${bold4("Native auto-detection")} ${dim4("(when no provider specified):")}
+    ${yellow2("google/*, gemini-*")}      ${dim4("->")} Google API
+    ${yellow2("openai/*, gpt-*, o1-*")}   ${dim4("->")} OpenAI API
+    ${yellow2("x-ai/*, grok-*")}          ${dim4("->")} xAI
+    ${yellow2("meta-llama/*, llama-*")}   ${dim4("->")} OllamaCloud
+    ${yellow2("minimax/*, abab-*")}       ${dim4("->")} MiniMax API
+    ${yellow2("moonshot/*, kimi-*")}      ${dim4("->")} Kimi API
+    ${yellow2("zhipu/*, glm-*")}          ${dim4("->")} GLM API
+    ${yellow2("sakana/*, fugu-*")}        ${dim4("->")} Sakana Fugu
+    ${yellow2("poe:*")}                   ${dim4("->")} Poe
+    ${yellow2("anthropic/*, claude-*")}   ${dim4("->")} Native Anthropic
+    ${yellow2("(unknown vendor/)")}       ${dim4("->")} Error (use openrouter@vendor/model)
+
+  ${dim4("A defaultProvider (config / --default-provider) catches bare names that match no rule.")}
 
 ${h("OPTIONS")}
   ${green2("-i, --interactive")}        Run in interactive mode (default when no prompt given)
   ${green2("-m, --model")} ${yellow2("<model>")}      Model to use (required for single-shot mode)
   ${green2("--profile")} ${yellow2("<name>")}         Use named profile for model mapping (default profile if omitted)
   ${green2("--default-provider")} ${yellow2("<name>")} Fallback provider for bare model names (builtin or customEndpoints key)
-                           ${dim3("Precedence: this flag > CLAUDISH_DEFAULT_PROVIDER env > config.json")}
+                           ${dim4("Precedence: this flag > CLAUDISH_DEFAULT_PROVIDER env > config.json")}
   ${green2("--anthropic-api-billing")}  Use your real ANTHROPIC_API_KEY for native Claude models
-                           ${dim3("(metered API billing). Default: the key is hidden so Claude Code")}
-                           ${dim3("uses your claude.ai subscription. Env: CLAUDISH_ANTHROPIC_API_BILLING")}
-                           ${dim3("Config: anthropicApiBilling: true")}
+                           ${dim4("(metered API billing). Default: the key is hidden so Claude Code")}
+                           ${dim4("uses your claude.ai subscription. Env: CLAUDISH_ANTHROPIC_API_BILLING")}
+                           ${dim4("Config: anthropicApiBilling: true")}
   ${green2("--config")} ${yellow2("<file>")}          Use THIS config file for the run, fully replacing the machine
-                           ${dim3("global (~/.claudish/config.json) AND project (.claudish.json).")}
-                           ${dim3("A file naming no op:// source never touches 1Password (no prompt).")}
-                           ${dim3("Env vars still resolve first. Env: CLAUDISH_CONFIG")}
+                           ${dim4("global (~/.claudish/config.json) AND project (.claudish.json).")}
+                           ${dim4("A file naming no op:// source never touches 1Password (no prompt).")}
+                           ${dim4("Env vars still resolve first. Env: CLAUDISH_CONFIG")}
   ${green2("--op")} ${yellow2("<op://glob>")}         Load API keys from a 1Password item glob (SDK-based, no op CLI)
   ${green2("--op")} ${yellow2("<glob>")} ${green2("--list")}      Preview which fields the glob would import (names only, no values)
   ${green2("--op-env")} ${yellow2("<id>")}            Load env vars from a 1Password Environment (highest priority)
   ${green2("--port")} ${yellow2("<port>")}            Proxy server port (default: random)
   ${green2("-d, --debug-claudish")}     Enable claudish debug logging to file (logs/claudish_*.log)
-                           ${dim3('Always-on: CLAUDISH_DEBUG=1 env var or "debug": true in config.json')}
+                           ${dim4('Always-on: CLAUDISH_DEBUG=1 env var or "debug": true in config.json')}
   ${green2("--no-debug-claudish")}      Force debug logging off for this run (when globally enabled)
   ${green2("--log-off")}                Disable always-on structural logging (~/.claudish/logs/)
   ${green2("--log-diag")} ${yellow2("<mode>")}        Diagnostic output: auto (default), logfile, off
-                           ${dim3('Also: CLAUDISH_DIAG_MODE env var or "diagMode" in config.json')}
+                           ${dim4('Also: CLAUDISH_DIAG_MODE env var or "diagMode" in config.json')}
   ${green2("--log-level")} ${yellow2("<level>")}      Log verbosity: debug (full), info (truncated), minimal (labels)
   ${green2("-q, --quiet")}              Suppress [claudish] log messages (default in single-shot mode)
   ${green2("-v, --verbose")}            Show [claudish] log messages (default in interactive mode)
@@ -75171,13 +76085,13 @@ ${h("OPTIONS")}
 ${h("MODEL DISCOVERY")}
   ${green2("--models")}                              Top 100 ranked (Firebase + local providers)
   ${green2("--models --provider")} ${yellow2("<slug>")}                Filter the catalog to one provider
-                                          ${dim3("e.g. --provider opencode-zen, anthropic, openai")}
+                                          ${dim4("e.g. --provider opencode-zen, anthropic, openai")}
   ${green2("--providers")}                           Every provider + active-model count
   ${green2("-s, --models-search")} ${yellow2("<query>")}             Fuzzy search: id, brand synonyms (chatgpt,
-                                          ${dim3("claude, grok), gateways (zen, oc, codex), caps")}
+                                          ${dim4("claude, grok), gateways (zen, oc, codex), caps")}
   ${green2("--models-top")}                          Curated recommended models (flagship + fast)
   ${green2("--probe")} ${yellow2("<models...>")}                    Probe each provider in the fallback chain with
-                                          ${dim3("a real 1-token request (may incur tiny cost)")}
+                                          ${dim4("a real 1-token request (may incur tiny cost)")}
   ${green2("--no-probe")}                            Skip live requests, show static chain only
   ${green2("--probe-timeout")} ${yellow2("<secs>")}                 Per-link timeout for live probes (default: 40)
   ${green2("--models-refresh")}                      Force refresh the slim model catalog from Firebase
@@ -75186,11 +76100,11 @@ ${h("MODEL DISCOVERY")}
 
 ${h("TEAM MODE")}
   ${green2("--team")} ${yellow2("<models>")}           Run multiple models in parallel (comma-separated)
-                           ${dim3('Example: --team minimax-m2.5,kimi-k2.5 "prompt"')}
+                           ${dim4('Example: --team minimax-m2.5,kimi-k2.5 "prompt"')}
   ${green2("--mode")} ${yellow2("<mode>")}             Team mode: default (grid), interactive, json
   ${green2("-f, --file")} ${yellow2("<path>")}         Read prompt from file (use with --team or single-shot)
 
-${h("MODEL MAPPING")} ${dim3("(per-role override)")}
+${h("MODEL MAPPING")} ${dim4("(per-role override)")}
   ${green2("--model-opus")} ${yellow2("<model>")}      Model for Opus role (planning, complex tasks)
   ${green2("--model-sonnet")} ${yellow2("<model>")}    Model for Sonnet role (default coding)
   ${green2("--model-haiku")} ${yellow2("<model>")}     Model for Haiku role (fast tasks, background)
@@ -75198,7 +76112,7 @@ ${h("MODEL MAPPING")} ${dim3("(per-role override)")}
 
 ${h("SUBCOMMANDS")}
   ${green2("claudish config")}                        Open the interactive config TUI (profiles,
-                                          ${dim3("providers, routing, 1Password)")}
+                                          ${dim4("providers, routing, 1Password)")}
   ${green2("claudish providers")} ${yellow2("[--json]")}             Show provider credential status (no key material)
   ${green2("claudish quota")} ${yellow2("[provider]")}              Show remaining quota/usage (alias: usage)
   ${green2("claudish serve")} ${yellow2("--port <n> --models <p>")}  Run the Claude Desktop redirect gateway
@@ -75212,39 +76126,50 @@ ${h("SUBCOMMANDS")}
     ${green2("claudish profile use")} ${yellow2("[name] [scope]")}     Set default profile
     ${green2("claudish profile show")} ${yellow2("[name] [scope]")}    Show profile details
     ${green2("claudish profile edit")} ${yellow2("[name] [scope]")}    Edit a profile
-    ${dim3("scope = --local (.claudish.json) | --global (~/.claudish/config.json) | (prompted)")}
+    ${dim4("scope = --local (.claudish.json) | --global (~/.claudish/config.json) | (prompted)")}
 
   ${bold4("Authentication:")}
     ${green2("claudish login")} ${yellow2("[provider]")}              Login to an OAuth provider (interactive if omitted)
     ${green2("claudish logout")} ${yellow2("[provider]")}             Clear OAuth credentials
-    ${dim3("Providers: gemini, kimi")}
+    ${dim4("Providers: gemini, kimi")}
 
-${h("1PASSWORD")} ${dim3("(SDK-based \u2014 no op CLI needed for secrets)")}
-  ${dim3("Auth via OP_SERVICE_ACCOUNT_TOKEN, or OP_ACCOUNT / onepasswordAccount config (DesktopAuth).")}
+${h("1PASSWORD")} ${dim4("(SDK-based \u2014 no op CLI needed for secrets)")}
+  ${dim4("Auth via OP_SERVICE_ACCOUNT_TOKEN, or OP_ACCOUNT / onepasswordAccount config (DesktopAuth).")}
   ${green2("--op")} ${yellow2("<glob> --list")}        Preview which fields a glob would import (names only)
   ${green2("--op")} ${yellow2("<glob>")} ${yellow2("[...args]")}      Resolve a glob into env vars, then run a session
-                           ${dim3("Inline op import requires a GLOB (self-names via field labels)")}
-                           ${dim3('Example: claudish --op "op://Jack/Keys/**" --model gpt-4o "task"')}
+                           ${dim4("Inline op import requires a GLOB (self-names via field labels)")}
+                           ${dim4('Example: claudish --op "op://Jack/Keys/**" --model gpt-4o "task"')}
   ${green2("--op-env")} ${yellow2("<id>")}             Load a 1Password Environment (highest-priority source)
-  ${dim3("Persistent setup (single refs, sets, environments, account): claudish config -> 1Password tab")}
+  ${dim4("Persistent setup (single refs, sets, environments, account): claudish config -> 1Password tab")}
+
+${h("MACOS KEYCHAIN")} ${dim4("(local, encrypted at rest, no desktop-app handshake)")}
+  ${green2("claudish keychain status")}          Backend state and how many keys are stored
+  ${green2("claudish keychain list")}            Stored variables, with ${dim4("\u2022\u2022\u2022\u20221234")} identification tails
+  ${green2("claudish keychain import")}          Copy keys from env vars / 1Password into the keychain
+                           ${dim4("--from env|1password|all   --only VAR,VAR   --dry-run   --yes")}
+  ${green2("claudish keychain set")} ${yellow2("<ENV_VAR>")}    Store one key (prompted, or piped on stdin \u2014 never in argv)
+  ${green2("claudish keychain rm")} ${yellow2("<ENV_VAR>")}     Remove one key
+  ${green2("claudish keychain enable")}${dim4("|")}${green2("disable")}  Turn the backend on/off (moves no secrets)
+  ${dim4("Resolution order: env var -> alias -> config.json -> macOS Keychain -> 1Password")}
+  ${dim4("The config TUI's Providers tab writes to the keychain by default on macOS.")}
 
 ${h("CLAUDE CODE FLAG PASSTHROUGH")}
-  ${dim3("Any unrecognized flag is forwarded to Claude Code. Claudish flags can appear in any order.")}
-    ${green2("claudish")} --model grok ${yellow2("--agent test")} ${yellow2('"task"')}        ${dim3("# --agent passes through")}
-    ${green2("claudish")} --model grok ${yellow2("--effort high")} --stdin ${yellow2('"task"')}  ${dim3("# --effort passes, --stdin stays")}
-    ${green2("claudish")} --model grok ${yellow2("--permission-mode plan")} -i   ${dim3("# works in interactive too")}
-  ${dim3("Use -- when a Claude Code flag value starts with '-':")}
+  ${dim4("Any unrecognized flag is forwarded to Claude Code. Claudish flags can appear in any order.")}
+    ${green2("claudish")} --model grok ${yellow2("--agent test")} ${yellow2('"task"')}        ${dim4("# --agent passes through")}
+    ${green2("claudish")} --model grok ${yellow2("--effort high")} --stdin ${yellow2('"task"')}  ${dim4("# --effort passes, --stdin stays")}
+    ${green2("claudish")} --model grok ${yellow2("--permission-mode plan")} -i   ${dim4("# works in interactive too")}
+  ${dim4("Use -- when a Claude Code flag value starts with '-':")}
     ${green2("claudish")} --model grok ${green2("--")} ${yellow2('--system-prompt "-verbose mode" "task"')}
 
 ${h("CUSTOM MODELS & ENDPOINTS")}
-  ${dim3("Claudish accepts ANY valid model ID from the Firebase catalog, even if not in --models:")}
+  ${dim4("Claudish accepts ANY valid model ID from the Firebase catalog, even if not in --models:")}
     ${green2("claudish")} --model ${yellow2("openrouter@your_provider/custom-model-123")} ${yellow2('"task"')}
-  ${dim3("Named custom endpoints live in ~/.claudish/config.json under 'customEndpoints' and route via @:")}
+  ${dim4("Named custom endpoints live in ~/.claudish/config.json under 'customEndpoints' and route via @:")}
     ${green2("claudish")} --model ${yellow2("my-vllm@llama3.1-70b")} ${yellow2('"task"')}
 
 ${h("MODES")}
-  ${green2("\u2022")} ${bold4("Interactive")} ${dim3("(default):")} shows model selector, starts a persistent session
-  ${green2("\u2022")} ${bold4("Single-shot")} ${dim3("(--model):")} runs one task headless and exits
+  ${green2("\u2022")} ${bold4("Interactive")} ${dim4("(default):")} shows model selector, starts a persistent session
+  ${green2("\u2022")} ${bold4("Single-shot")} ${dim4("(--model):")} runs one task headless and exits
 
 ${h("NOTES")}
   ${yellow2("\u2022")} Permission prompts are ${bold4("ENABLED")} by default (normal Claude Code behavior)
@@ -75253,35 +76178,35 @@ ${h("NOTES")}
   ${yellow2("\u2022")} ${green2("--dangerous")} disables the sandbox \u2014 use with extreme caution
 
 ${h("ENVIRONMENT VARIABLES")}
-  ${dim3("Claudish auto-loads a .env file from the current directory.")}
+  ${dim4("Claudish auto-loads a .env file from the current directory.")}
 
   ${bold4("Claude Code installation:")}
   ${blue("CLAUDE_PATH")}                     Custom path to Claude Code binary
-                                  ${dim3("Search: CLAUDE_PATH -> ~/.claude/local/claude -> PATH")}
+                                  ${dim4("Search: CLAUDE_PATH -> ~/.claude/local/claude -> PATH")}
 
-  ${bold4("API keys")} ${dim3("(at least one required for cloud models):")}
+  ${bold4("API keys")} ${dim4("(at least one required for cloud models):")}
   ${blue("OPENROUTER_API_KEY")}              OpenRouter (default backend)
-  ${blue("GEMINI_API_KEY")}                  Google Gemini ${dim3("(g@, gemini@; alias GOOGLE_API_KEY)")}
-  ${blue("OPENAI_API_KEY")}                  OpenAI ${dim3("(oai@)")}
-  ${blue("OPENAI_CODEX_API_KEY")}            OpenAI Codex / Responses API ${dim3("(cx@, codex@)")}
-  ${blue("XAI_API_KEY")}                     xAI / Grok ${dim3("(x-ai@, grok@)")}
-  ${blue("MINIMAX_API_KEY")}                 MiniMax ${dim3("(mm@, mmax@)")}
-  ${blue("MINIMAX_CODING_API_KEY")}          MiniMax Coding Plan ${dim3("(mmc@)")}
-  ${blue("MOONSHOT_API_KEY")}                Kimi / Moonshot ${dim3("(kimi@, moon@; alias KIMI_API_KEY)")}
-  ${blue("KIMI_CODING_API_KEY")}             Kimi Coding Plan ${dim3("(kc@)")}
-  ${blue("ZHIPU_API_KEY")}                   GLM / Zhipu ${dim3("(glm@, zhipu@; alias GLM_API_KEY)")}
-  ${blue("GLM_CODING_API_KEY")}              GLM Coding Plan ${dim3("(gc@; alias ZAI_CODING_API_KEY)")}
-  ${blue("ZAI_API_KEY")}                     Z.AI ${dim3("(z-ai@, zai@)")}
-  ${blue("DEEPSEEK_API_KEY")}                DeepSeek ${dim3("(ds@)")}
-  ${blue("SAKANA_API_KEY")}                  Sakana Fugu ${dim3("(sakana@, fugu@)")}
-  ${blue("SAKANA_SUBSCRIPTION_API_KEY")}     Sakana Fugu Subscription ${dim3("(sc@; separate subscription key)")}
-  ${blue("OLLAMA_API_KEY")}                  OllamaCloud ${dim3("(oc@, llama@)")}
-  ${blue("OPENCODE_API_KEY")}                OpenCode Zen ${dim3("(zen@)")}
-  ${blue("POE_API_KEY")}                     Poe ${dim3("(poe@)")}
-  ${blue("LITELLM_API_KEY")}                 LiteLLM ${dim3("(litellm@, ll@; needs LITELLM_BASE_URL)")}
-  ${blue("VERTEX_API_KEY")}                  Vertex AI Express ${dim3("(v@)")}
-  ${blue("VERTEX_PROJECT")}                  Vertex AI project ID ${dim3("(OAuth mode, v@)")}
-  ${blue("VERTEX_LOCATION")}                 Vertex AI region ${dim3("(default: us-central1)")}
+  ${blue("GEMINI_API_KEY")}                  Google Gemini ${dim4("(g@, gemini@; alias GOOGLE_API_KEY)")}
+  ${blue("OPENAI_API_KEY")}                  OpenAI ${dim4("(oai@)")}
+  ${blue("OPENAI_CODEX_API_KEY")}            OpenAI Codex / Responses API ${dim4("(cx@, codex@)")}
+  ${blue("XAI_API_KEY")}                     xAI / Grok ${dim4("(x-ai@, grok@)")}
+  ${blue("MINIMAX_API_KEY")}                 MiniMax ${dim4("(mm@, mmax@)")}
+  ${blue("MINIMAX_CODING_API_KEY")}          MiniMax Coding Plan ${dim4("(mmc@)")}
+  ${blue("MOONSHOT_API_KEY")}                Kimi / Moonshot ${dim4("(kimi@, moon@; alias KIMI_API_KEY)")}
+  ${blue("KIMI_CODING_API_KEY")}             Kimi Coding Plan ${dim4("(kc@)")}
+  ${blue("ZHIPU_API_KEY")}                   GLM / Zhipu ${dim4("(glm@, zhipu@; alias GLM_API_KEY)")}
+  ${blue("GLM_CODING_API_KEY")}              GLM Coding Plan ${dim4("(gc@; alias ZAI_CODING_API_KEY)")}
+  ${blue("ZAI_API_KEY")}                     Z.AI ${dim4("(z-ai@, zai@)")}
+  ${blue("DEEPSEEK_API_KEY")}                DeepSeek ${dim4("(ds@)")}
+  ${blue("SAKANA_API_KEY")}                  Sakana Fugu ${dim4("(sakana@, fugu@)")}
+  ${blue("SAKANA_SUBSCRIPTION_API_KEY")}     Sakana Fugu Subscription ${dim4("(sc@; separate subscription key)")}
+  ${blue("OLLAMA_API_KEY")}                  OllamaCloud ${dim4("(oc@, llama@)")}
+  ${blue("OPENCODE_API_KEY")}                OpenCode Zen ${dim4("(zen@)")}
+  ${blue("POE_API_KEY")}                     Poe ${dim4("(poe@)")}
+  ${blue("LITELLM_API_KEY")}                 LiteLLM ${dim4("(litellm@, ll@; needs LITELLM_BASE_URL)")}
+  ${blue("VERTEX_API_KEY")}                  Vertex AI Express ${dim4("(v@)")}
+  ${blue("VERTEX_PROJECT")}                  Vertex AI project ID ${dim4("(OAuth mode, v@)")}
+  ${blue("VERTEX_LOCATION")}                 Vertex AI region ${dim4("(default: us-central1)")}
   ${blue("ANTHROPIC_API_KEY")}               Placeholder (prevents Claude Code dialog)
   ${blue("ANTHROPIC_AUTH_TOKEN")}            Placeholder (prevents Claude Code login screen)
 
@@ -75289,27 +76214,27 @@ ${h("ENVIRONMENT VARIABLES")}
   ${blue("GEMINI_BASE_URL")}                 Custom Gemini endpoint
   ${blue("OPENAI_BASE_URL")}                 Custom OpenAI / Azure endpoint
   ${blue("MINIMAX_BASE_URL")}                Custom MiniMax endpoint
-  ${blue("MOONSHOT_BASE_URL")}               Custom Kimi / Moonshot endpoint ${dim3("(alias KIMI_BASE_URL)")}
-  ${blue("ZHIPU_BASE_URL")}                  Custom GLM / Zhipu endpoint ${dim3("(alias GLM_BASE_URL)")}
-  ${blue("SAKANA_BASE_URL")}                 Custom Sakana endpoint ${dim3("(default: https://api.sakana.ai)")}
-  ${blue("LITELLM_BASE_URL")}                LiteLLM gateway base URL ${dim3("(required for ll@)")}
-  ${blue("OLLAMACLOUD_BASE_URL")}            OllamaCloud ${dim3("(default: https://ollama.com)")}
-  ${blue("OPENCODE_BASE_URL")}               OpenCode Zen ${dim3("(default: https://opencode.ai/zen)")}
+  ${blue("MOONSHOT_BASE_URL")}               Custom Kimi / Moonshot endpoint ${dim4("(alias KIMI_BASE_URL)")}
+  ${blue("ZHIPU_BASE_URL")}                  Custom GLM / Zhipu endpoint ${dim4("(alias GLM_BASE_URL)")}
+  ${blue("SAKANA_BASE_URL")}                 Custom Sakana endpoint ${dim4("(default: https://api.sakana.ai)")}
+  ${blue("LITELLM_BASE_URL")}                LiteLLM gateway base URL ${dim4("(required for ll@)")}
+  ${blue("OLLAMACLOUD_BASE_URL")}            OllamaCloud ${dim4("(default: https://ollama.com)")}
+  ${blue("OPENCODE_BASE_URL")}               OpenCode Zen ${dim4("(default: https://opencode.ai/zen)")}
 
   ${bold4("Local providers:")}
-  ${blue("OLLAMA_BASE_URL")}                 Ollama server ${dim3("(default: http://localhost:11434; alias OLLAMA_HOST)")}
-  ${blue("LMSTUDIO_BASE_URL")}               LM Studio server ${dim3("(default: http://localhost:1234)")}
-  ${blue("VLLM_BASE_URL")}                   vLLM server ${dim3("(default: http://localhost:8000)")}
-  ${blue("MLX_BASE_URL")}                    MLX server ${dim3("(default: http://127.0.0.1:8080)")}
+  ${blue("OLLAMA_BASE_URL")}                 Ollama server ${dim4("(default: http://localhost:11434; alias OLLAMA_HOST)")}
+  ${blue("LMSTUDIO_BASE_URL")}               LM Studio server ${dim4("(default: http://localhost:1234)")}
+  ${blue("VLLM_BASE_URL")}                   vLLM server ${dim4("(default: http://localhost:8000)")}
+  ${blue("MLX_BASE_URL")}                    MLX server ${dim4("(default: http://127.0.0.1:8080)")}
 
   ${bold4("Claudish settings:")}
-  ${blue("CLAUDISH_MODEL")}                  Default model ${dim3("(default: openai/gpt-5.3)")}
-  ${blue("CLAUDISH_DEFAULT_PROVIDER")}       Fallback provider for bare names ${dim3("(see --default-provider)")}
+  ${blue("CLAUDISH_MODEL")}                  Default model ${dim4("(default: openai/gpt-5.3)")}
+  ${blue("CLAUDISH_DEFAULT_PROVIDER")}       Fallback provider for bare names ${dim4("(see --default-provider)")}
   ${blue("CLAUDISH_PORT")}                   Default proxy port
   ${blue("CLAUDISH_CONTEXT_WINDOW")}         Override context window size
   ${blue("CLAUDISH_DIAG_MODE")}              Diagnostic output: auto / logfile / off
-  ${blue("CLAUDISH_DEBUG")}                  Always enable debug logging: 1 / true ${dim3("(same as -d)")}
-  ${blue("CLAUDISH_ANTHROPIC_API_BILLING")}  Bill native Claude to your API key ${dim3("(see --anthropic-api-billing)")}
+  ${blue("CLAUDISH_DEBUG")}                  Always enable debug logging: 1 / true ${dim4("(same as -d)")}
+  ${blue("CLAUDISH_ANTHROPIC_API_BILLING")}  Bill native Claude to your API key ${dim4("(see --anthropic-api-billing)")}
   ${blue("CLAUDISH_MCP_TOOLS")}              MCP tool gating: all / low-level / agentic / channel
   ${blue("CLAUDISH_MODEL_OPUS")}             Override model for Opus role
   ${blue("CLAUDISH_MODEL_SONNET")}           Override model for Sonnet role
@@ -75319,39 +76244,39 @@ ${h("ENVIRONMENT VARIABLES")}
 
   ${bold4("1Password auth:")}
   ${blue("OP_SERVICE_ACCOUNT_TOKEN")}        Service-account token (preferred for headless)
-  ${blue("OP_ACCOUNT")}                      Account URL for DesktopAuth ${dim3("(e.g. my-team.1password.com)")}
+  ${blue("OP_ACCOUNT")}                      Account URL for DesktopAuth ${dim4("(e.g. my-team.1password.com)")}
 
 ${h("EXAMPLES")}
-  ${dim3("# Interactive (default) - model selector")}
+  ${dim4("# Interactive (default) - model selector")}
   ${green2("claudish")}
-  ${green2("claudish")} --free                          ${dim3("# only FREE models")}
+  ${green2("claudish")} --free                          ${dim4("# only FREE models")}
 
-  ${dim3("# Explicit provider routing")}
+  ${dim4("# Explicit provider routing")}
   ${green2("claudish")} --model ${magenta("google@gemini-3-pro")} ${yellow2('"implement auth"')}
   ${green2("claudish")} --model ${magenta("oai@gpt-5.3")} ${yellow2('"add tests for login"')}
   ${green2("claudish")} --model ${magenta("openrouter@deepseek/deepseek-r1")} ${yellow2('"unknown vendor"')}
 
-  ${dim3("# Native auto-detection (provider inferred from model name)")}
+  ${dim4("# Native auto-detection (provider inferred from model name)")}
   ${green2("claudish")} --model ${yellow2("gpt-4o")} ${yellow2('"routes to OpenAI"')}
   ${green2("claudish")} --model ${yellow2("gemini-2.5-pro")} ${yellow2('"routes to Google"')}
 
-  ${dim3("# Per-role model mapping")}
+  ${dim4("# Per-role model mapping")}
   ${green2("claudish")} --model-opus ${magenta("oai@gpt-5.3")} --model-sonnet ${magenta("google@gemini-3-pro")}
 
-  ${dim3("# stdin for large prompts (diffs, code review)")}
-  ${dim3("git diff |")} ${green2("claudish")} --stdin --model ${magenta("oai@gpt-5.3")} ${yellow2('"Review these changes"')}
+  ${dim4("# stdin for large prompts (diffs, code review)")}
+  ${dim4("git diff |")} ${green2("claudish")} --stdin --model ${magenta("oai@gpt-5.3")} ${yellow2('"Review these changes"')}
 
-  ${dim3("# Local models with concurrency control")}
+  ${dim4("# Local models with concurrency control")}
   ${green2("claudish")} --model ${magenta("ollama@llama3.2:3")} ${yellow2('"3 concurrent requests"')}
   ${green2("claudish")} --model ${magenta("lms@qwen2.5-coder")} ${yellow2('"LM Studio shortcut"')}
   ${green2("claudish")} --model ${yellow2('"http://localhost:8000/mistral"')} ${yellow2('"any OpenAI-compatible URL"')}
 
-  ${dim3("# Autonomous (no prompts, no sandbox) \u2014 use with caution")}
+  ${dim4("# Autonomous (no prompts, no sandbox) \u2014 use with caution")}
   ${green2("claudish")} -y --dangerous ${yellow2('"refactor entire codebase"')}
 
 ${h("MORE INFO")}
-  ${dim3("GitHub:")}     ${blue("https://github.com/MadAppGang/claude-code")}
-  ${dim3("OpenRouter:")} ${blue("https://openrouter.ai")}
+  ${dim4("GitHub:")}     ${blue("https://github.com/MadAppGang/claude-code")}
+  ${dim4("OpenRouter:")} ${blue("https://openrouter.ai")}
 `);
 }
 function printAIAgentGuide() {
@@ -76714,6 +77639,8 @@ function Footer({ activeTab, mode, probeMode, providerCaps }) {
       [C.blue, "\u2191\u2193", "navigate"],
       [C.green, "a", "add"],
       [C.cyan, "t", "test"],
+      [C.magenta, "c", "\u2192keychain"],
+      [C.magenta, "C", "all\u2192keychain"],
       [C.green, "o", "account"],
       [C.red, "x", "remove"],
       [C.blue, "Tab", "section"],
@@ -78885,8 +79812,6 @@ function resolveProviderDetailKeyDisplay(input) {
     return input.envKeyMask;
   if (input.hasCfgKey)
     return input.cfgKeyMask;
-  if (input.isPublicKey)
-    return "free";
   return "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500";
 }
 function ProviderDetail({
@@ -78900,7 +79825,9 @@ function ProviderDetail({
   hasKey,
   authSource,
   isOpKey,
-  isPublicKey,
+  isKcKey,
+  hasKcKey,
+  keySaveTarget,
   cfgKeyMask,
   envKeyMask,
   activeEndpoint,
@@ -78914,7 +79841,6 @@ function ProviderDetail({
     authSource,
     hasEnvKey,
     hasCfgKey,
-    isPublicKey,
     envKeyMask,
     cfgKeyMask
   });
@@ -78924,7 +79850,7 @@ function ProviderDetail({
       border: true,
       borderStyle: "single",
       borderColor: C.focusBorder,
-      title: ` Set ${mode === "input_key" ? "API Key" : "Endpoint"} \u2014 ${selectedProvider.displayName} `,
+      title: mode === "input_key" ? ` Set API Key \u2014 ${selectedProvider.displayName} \u2192 ${keySaveTarget} ` : ` Set Endpoint \u2014 ${selectedProvider.displayName} `,
       backgroundColor: C.bg,
       flexDirection: "column",
       paddingX: 1,
@@ -79058,7 +79984,7 @@ function ProviderDetail({
               })
             ]
           }),
-          hasKey && !selectedProvider.isLocal && isPublicKey && /* @__PURE__ */ jsxs10(Fragment7, {
+          hasKey && !selectedProvider.isLocal && isOAuth && /* @__PURE__ */ jsxs10(Fragment7, {
             children: [
               /* @__PURE__ */ jsx11("span", {
                 fg: C.dim,
@@ -79070,9 +79996,13 @@ function ProviderDetail({
                 children: "From: "
               }),
               /* @__PURE__ */ jsx11("span", {
-                fg: C.green,
+                fg: C.cyan,
                 attributes: A.bold,
-                children: "public key (free)"
+                children: "oauth"
+              }),
+              /* @__PURE__ */ jsx11("span", {
+                fg: C.fgMuted,
+                children: " (used)"
               })
             ]
           }),
@@ -79094,7 +80024,7 @@ function ProviderDetail({
               })
             ]
           }),
-          hasKey && !selectedProvider.isLocal && !isPublicKey && !isOAuth && /* @__PURE__ */ jsxs10(Fragment7, {
+          hasKey && !selectedProvider.isLocal && !isOAuth && /* @__PURE__ */ jsxs10(Fragment7, {
             children: [
               /* @__PURE__ */ jsx11("span", {
                 fg: C.dim,
@@ -79108,7 +80038,7 @@ function ProviderDetail({
               hasEnvKey && /* @__PURE__ */ jsx11("span", {
                 fg: C.green,
                 attributes: A.bold,
-                children: isOpKey ? "1Password" : "env"
+                children: isKcKey ? "keychain" : isOpKey ? "1Password" : "env"
               }),
               hasEnvKey && hasCfgKey && /* @__PURE__ */ jsx11("span", {
                 fg: C.fgMuted,
@@ -79126,6 +80056,18 @@ function ProviderDetail({
               hasCfgKey && /* @__PURE__ */ jsx11("span", {
                 fg: C.fgMuted,
                 children: hasEnvKey ? " (shadowed)" : " (used)"
+              }),
+              hasKcKey && !isKcKey && /* @__PURE__ */ jsxs10(Fragment7, {
+                children: [
+                  /* @__PURE__ */ jsx11("span", {
+                    fg: C.fgMuted,
+                    children: " + "
+                  }),
+                  /* @__PURE__ */ jsx11("span", {
+                    fg: C.fgMuted,
+                    children: "keychain (shadowed)"
+                  })
+                ]
               })
             ]
           })
@@ -79302,8 +80244,6 @@ function ProvidersContent({
       keyDisplay = "local";
     } else if (isOauthOnly) {
       keyDisplay = "oauth\xB7\xB7\xB7";
-    } else if (auth === "public") {
-      keyDisplay = "free";
     } else if (auth === "cfg") {
       keyDisplay = maskKey2(config3.apiKeys?.[p.apiKeyEnvVar]);
     } else if (auth === "env" || auth === "e+c") {
@@ -80734,18 +81674,18 @@ function useProfileWizard(args) {
       setEditProfileValue("");
       return;
     }
-    const now = new Date().toISOString();
+    const now2 = new Date().toISOString();
     if (profileScope === "project") {
       const localCfg = loadLocalConfig() ?? {
         version: "1.0.0",
         defaultProfile: "",
         profiles: {}
       };
-      localCfg.profiles[name] = { name, models: {}, createdAt: now, updatedAt: now };
+      localCfg.profiles[name] = { name, models: {}, createdAt: now2, updatedAt: now2 };
       saveLocalConfig(localCfg);
     } else {
       const cfg = loadConfig();
-      cfg.profiles[name] = { name, models: {}, createdAt: now, updatedAt: now };
+      cfg.profiles[name] = { name, models: {}, createdAt: now2, updatedAt: now2 };
       saveConfig(cfg);
     }
     refreshConfig();
@@ -81100,20 +82040,20 @@ function useRouteProbe(config3) {
             errorMessage: String(e instanceof Error ? e.message : e)
           }));
           const ms = Date.now() - startMs;
-          const ok = result.state === "live";
+          const ok2 = result.state === "live";
           setProbeResults((prev) => prev.map((e, idx) => {
             if (idx === i)
               return {
                 ...e,
-                status: ok ? "success" : "failed",
-                error: ok ? undefined : describeProbeState(result),
+                status: ok2 ? "success" : "failed",
+                error: ok2 ? undefined : describeProbeState(result),
                 ms
               };
-            if (idx > i && ok && e.status !== "no_key")
+            if (idx > i && ok2 && e.status !== "no_key")
               return { ...e, status: "skipped" };
             return e;
           }));
-          if (ok)
+          if (ok2)
             break;
         }
         setProbeMode("done");
@@ -81153,6 +82093,50 @@ var init_useRouteProbe = __esm(() => {
 import { useKeyboard as useKeyboard2, useRenderer, useTerminalDimensions as useTerminalDimensions2 } from "@opentui/react";
 import { useCallback as useCallback3, useEffect as useEffect4, useMemo as useMemo2, useRef as useRef4, useState as useState5 } from "react";
 import { jsx as jsx16, jsxs as jsxs15, Fragment as Fragment10 } from "@opentui/react/jsx-runtime";
+async function resolveOpEntrySecrets(entries, auth) {
+  const secrets = {};
+  for (const entry of entries) {
+    if (entry.kind === "environment") {
+      Object.assign(secrets, await withSdkRetry(() => readEnvironment(entry.value, { auth }), "tui:copy-keychain"));
+    } else if (entry.kind === "glob" || isGlobImport(entry.value)) {
+      Object.assign(secrets, await withSdkRetry(() => resolveGlobImport(entry.value, { auth }), "tui:copy-keychain"));
+    } else {
+      const r = await withSdkRetry(() => resolveSecrets({ T: entry.value }, { auth }), "tui:copy-keychain");
+      const name = envNameFromOpRef(entry.value);
+      if (name && r.T)
+        secrets[name] = r.T;
+    }
+  }
+  return secrets;
+}
+function writeSecretsToKeychain(secrets, alreadyStored) {
+  const outcome = { created: 0, replaced: 0, skipped: [] };
+  for (const [name, value] of Object.entries(secrets)) {
+    if (!value)
+      continue;
+    try {
+      writeKeychainSecret(name, value);
+      if (alreadyStored.has(name))
+        outcome.replaced++;
+      else
+        outcome.created++;
+    } catch {
+      outcome.skipped.push(name);
+    }
+  }
+  return outcome;
+}
+function describeCopyOutcome({ created, replaced, skipped }) {
+  if (created + replaced === 0) {
+    return `Nothing copied to the Keychain${skipped.length > 0 ? ` \u2014 ${skipped.length} could not be stored` : ""}.`;
+  }
+  const parts = [`${created} new`];
+  if (replaced > 0)
+    parts.push(`${replaced} replaced`);
+  if (skipped.length > 0)
+    parts.push(`${skipped.length} skipped (${skipped.join(", ")})`);
+  return `Copied to macOS Keychain: ${parts.join(" \xB7 ")}.`;
+}
 function App({ requestLogin } = {}) {
   const renderer = useRenderer();
   const { width, height: height2 } = useTerminalDimensions2();
@@ -81162,6 +82146,9 @@ function App({ requestLogin } = {}) {
   const [activeTab, setActiveTab] = useState5("providers");
   const [mode, setMode] = useState5("browse");
   const [inputValue, setInputValue] = useState5("");
+  const [keychainVars, setKeychainVars] = useState5(new Set);
+  const keychainSupported = useMemo2(() => isKeychainSupported(), []);
+  const inputTargetRef = useRef4(null);
   const [routingPattern, setRoutingPattern] = useState5("");
   const [chainSelected, setChainSelected] = useState5(new Set);
   const [chainOrder, setChainOrder] = useState5([]);
@@ -81249,6 +82236,36 @@ function App({ requestLogin } = {}) {
     setBufStats(getBufferStats());
     setOpTick((t) => t + 1);
   }, []);
+  const refreshKeychainVars = useCallback3(() => {
+    if (!hasKeychainSource()) {
+      setKeychainVars(new Set);
+      return;
+    }
+    try {
+      setKeychainVars(new Set(listKeychainVars()));
+    } catch {
+      setKeychainVars(new Set);
+    }
+  }, []);
+  useEffect4(() => {
+    if (!keychainSupported)
+      return;
+    let cancelled = false;
+    (async () => {
+      let hydrated = 0;
+      try {
+        hydrated = await hydrateKeychainIntoEnv();
+      } catch {}
+      if (cancelled)
+        return;
+      refreshKeychainVars();
+      if (hydrated > 0)
+        refreshConfig();
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [keychainSupported, refreshKeychainVars, refreshConfig]);
   const clearTestResult = useCallback3((provName) => {
     setTestResults((prev) => {
       if (!(provName in prev))
@@ -81264,11 +82281,12 @@ function App({ requestLogin } = {}) {
   const { editProfileValue, profileScope, suggestions, suggestionIndex, providerPickerIndex } = wizard;
   const hasCfgKey = !!config3.apiKeys?.[selectedProvider.apiKeyEnvVar];
   const hasEnvKey = !!process.env[selectedProvider.apiKeyEnvVar];
+  const providerKeychainVars = useMemo2(() => [selectedProvider.apiKeyEnvVar, ...selectedProvider.aliases ?? []].filter((n) => !!n && keychainVars.has(n)), [selectedProvider, keychainVars]);
+  const hasKcKey = providerKeychainVars.length > 0;
   const selectedAuthSource = providerAuthSource(selectedProvider, config3);
-  const selectedLocalRunning = selectedProviderIsLocal && localLiveness[selectedProvider.catalogName] === "running";
-  const hasKey = selectedAuthSource !== null || selectedLocalRunning;
-  const selectedPublicKey = selectedAuthSource === "public";
+  const hasKey = providerIsReadyForDisplay(selectedProvider, config3, localLiveness);
   const isOpKey = hasEnvKey && isOpHydratedVar(selectedProvider.apiKeyEnvVar);
+  const isKcKey = hasEnvKey && isKeychainHydratedVar(selectedProvider.apiKeyEnvVar);
   const cfgKeyMask = maskKey2(config3.apiKeys?.[selectedProvider.apiKeyEnvVar]);
   const envKeyMask = maskKey2(process.env[selectedProvider.apiKeyEnvVar]);
   const activeEndpointEnvVar = selectedProvider.endpointEnvVar;
@@ -81445,6 +82463,36 @@ function App({ requestLogin } = {}) {
       setOpBusy(false);
     }
   }, [acquireOpAuth]);
+  const copyOpToKeychain = useCallback3(async (entries, label) => {
+    if (!keychainSupported) {
+      setStatusMsg("macOS Keychain is only available on macOS.");
+      return;
+    }
+    const copyable = entries.filter((e) => e.kind !== "account");
+    if (copyable.length === 0) {
+      setStatusMsg("Nothing to copy \u2014 the account entry holds no secret.");
+      return;
+    }
+    setOpBusy(true);
+    setStatusMsg(`Resolving ${label} from 1Password\u2026`);
+    try {
+      const auth = await acquireOpAuth();
+      const secrets = await resolveOpEntrySecrets(copyable, auth);
+      const outcome = writeSecretsToKeychain(secrets, new Set(keychainVars));
+      if (outcome.created + outcome.replaced > 0) {
+        setKeychainEnabled(true);
+        refreshKeychainVars();
+        credentials.invalidate();
+        invalidateProbeProxyHandlers();
+        refreshConfig();
+      }
+      setStatusMsg(describeCopyOutcome(outcome));
+    } catch (err) {
+      setStatusMsg(err instanceof Error ? err.message : String(err));
+    } finally {
+      setOpBusy(false);
+    }
+  }, [acquireOpAuth, keychainSupported, keychainVars, refreshKeychainVars, refreshConfig]);
   const resetOpWizard = useCallback3(() => {
     setInputValue("");
     setOpPendingValue("");
@@ -81767,26 +82815,49 @@ function App({ requestLogin } = {}) {
           setMode("browse");
           return;
         }
+        const target = inputTargetRef.current ?? selectedProvider;
         if (mode === "input_key") {
-          if (!selectedProvider.apiKeyEnvVar) {
-            setStatusMsg(`${selectedProvider.displayName} has no apiKeyEnvVar \u2014 cannot save key.`);
+          if (!target.apiKeyEnvVar) {
+            setStatusMsg(`${target.displayName} has no apiKeyEnvVar \u2014 cannot save key.`);
           } else {
-            setApiKey(selectedProvider.apiKeyEnvVar, val);
-            process.env[selectedProvider.apiKeyEnvVar] = val;
-            setStatusMsg(`Key saved for ${selectedProvider.displayName} (${selectedProvider.apiKeyEnvVar}).`);
+            const envVar = target.apiKeyEnvVar;
+            let saved = false;
+            if (keychainSupported) {
+              try {
+                writeKeychainSecret(envVar, val);
+                setKeychainEnabled(true);
+                process.env[envVar] = val;
+                recordKeychainHydratedVar(envVar);
+                refreshKeychainVars();
+                setStatusMsg(`Key saved to macOS Keychain for ${target.displayName} (${envVar}).`);
+                saved = true;
+              } catch (err) {
+                setStatusMsg(`Keychain write failed (${err instanceof Error ? err.message : String(err)}) \u2014 saved to config.json instead.`);
+              }
+            }
+            if (!saved) {
+              setApiKey(envVar, val);
+              process.env[envVar] = val;
+              if (!keychainSupported) {
+                setStatusMsg(`Key saved for ${target.displayName} (${envVar}).`);
+              }
+            }
+            credentials.invalidate(target.catalogName);
+            invalidateProbeProxyHandlers(target.catalogName);
+            clearTestResult(target.name);
           }
         } else {
-          if (!selectedProvider.endpointEnvVar) {
-            setStatusMsg(`${selectedProvider.displayName} has no endpointEnvVar \u2014 cannot save URL.`);
+          if (!target.endpointEnvVar) {
+            setStatusMsg(`${target.displayName} has no endpointEnvVar \u2014 cannot save URL.`);
           } else {
-            setEndpoint(selectedProvider.endpointEnvVar, val);
-            process.env[selectedProvider.endpointEnvVar] = val;
-            setStatusMsg(`URL saved for ${selectedProvider.displayName} (${selectedProvider.endpointEnvVar}=${val}).`);
+            setEndpoint(target.endpointEnvVar, val);
+            process.env[target.endpointEnvVar] = val;
+            setStatusMsg(`URL saved for ${target.displayName} (${target.endpointEnvVar}=${val}).`);
           }
         }
-        invalidateProbeProxyHandlers(selectedProvider.catalogName);
-        invalidateProbeDiscovery(selectedProvider.catalogName);
-        clearTestResult(selectedProvider.name);
+        invalidateProbeProxyHandlers(target.catalogName);
+        invalidateProbeDiscovery(target.catalogName);
+        clearTestResult(target.name);
         refreshConfig();
         setInputValue("");
         setMode("browse");
@@ -82255,10 +83326,12 @@ function App({ requestLogin } = {}) {
         setStatusMsg(null);
       } else if (key.name === "s") {
         if (selectedProvider.apiKeyEnvVar) {
+          inputTargetRef.current = selectedProvider;
           setInputValue("");
           setStatusMsg(null);
           setMode("input_key");
         } else if (selectedProvider.endpointEnvVar) {
+          inputTargetRef.current = selectedProvider;
           setInputValue(activeEndpoint);
           setStatusMsg(null);
           setMode("input_endpoint");
@@ -82276,6 +83349,7 @@ function App({ requestLogin } = {}) {
           }
           refreshConfig();
         } else if (selectedProvider.endpointEnvVar) {
+          inputTargetRef.current = selectedProvider;
           setInputValue(activeEndpoint);
           setStatusMsg(null);
           setMode("input_endpoint");
@@ -82284,6 +83358,7 @@ function App({ requestLogin } = {}) {
         }
       } else if (key.name === "u") {
         if (selectedProvider.endpointEnvVar) {
+          inputTargetRef.current = selectedProvider;
           setInputValue(activeEndpoint);
           setStatusMsg(null);
           setMode("input_endpoint");
@@ -82292,24 +83367,43 @@ function App({ requestLogin } = {}) {
         }
       } else if (key.name === "x") {
         let changed = false;
+        const removedFrom = [];
+        let failureMsg = null;
         if (hasCfgKey) {
           removeApiKey(selectedProvider.apiKeyEnvVar);
+          removedFrom.push("config.json");
           changed = true;
         }
+        if (keychainSupported) {
+          for (const name of providerKeychainVars) {
+            try {
+              if (deleteKeychainSecret(name)) {
+                removedFrom.push(`macOS Keychain (${name})`);
+                changed = true;
+              }
+            } catch (err) {
+              failureMsg = `Keychain delete failed for ${name}: ${err instanceof Error ? err.message : String(err)}`;
+            }
+          }
+          if (providerKeychainVars.length > 0)
+            refreshKeychainVars();
+        }
+        if (changed && (isKcKey || isOpKey)) {
+          delete process.env[selectedProvider.apiKeyEnvVar];
+        }
         if (activeEndpointEnvVar && config3.endpoints?.[activeEndpointEnvVar]) {
           removeEndpoint(activeEndpointEnvVar);
           delete process.env[activeEndpointEnvVar];
           changed = true;
         }
         if (changed) {
+          credentials.invalidate(selectedProvider.catalogName);
           invalidateProbeProxyHandlers(selectedProvider.catalogName);
           invalidateProbeDiscovery(selectedProvider.catalogName);
           clearTestResult(selectedProvider.name);
           refreshConfig();
-          setStatusMsg(`Stored config removed for ${selectedProvider.displayName}.`);
-        } else {
-          setStatusMsg("No stored config to remove.");
         }
+        setStatusMsg(failureMsg ?? (changed ? removedFrom.length > 0 ? `Removed ${selectedProvider.displayName} key from ${removedFrom.join(" + ")}.` : `Stored config removed for ${selectedProvider.displayName}.` : "No stored config to remove."));
       } else if (key.name === "l") {
         const slug = selectedProvider.oauthSlug;
         if (!slug) {
@@ -82534,6 +83628,18 @@ function App({ requestLogin } = {}) {
         } else if (selectedOpEntry) {
           testOpEntry(selectedOpEntry);
         }
+      } else if (key.raw === "C") {
+        if (opEntries.length === 0) {
+          setStatusMsg("No 1Password entries to copy.");
+        } else {
+          copyOpToKeychain(opEntries, `all ${opEntries.length} entries`);
+        }
+      } else if (key.name === "c") {
+        if (opEntries.length === 0 || !selectedOpEntry) {
+          setStatusMsg("No 1Password entry to copy.");
+        } else {
+          copyOpToKeychain([selectedOpEntry], selectedOpEntry.envName ?? selectedOpEntry.value);
+        }
       } else if (key.name === "x") {
         if (opEntries.length === 0 || !selectedOpEntry) {
           setStatusMsg("No 1Password entry to remove.");
@@ -82670,7 +83776,9 @@ function App({ requestLogin } = {}) {
             hasKey,
             authSource: selectedAuthSource,
             isOpKey,
-            isPublicKey: selectedPublicKey,
+            isKcKey,
+            hasKcKey,
+            keySaveTarget: keychainSupported ? "macOS Keychain" : "config.json",
             cfgKeyMask,
             envKeyMask,
             activeEndpoint,
@@ -82798,10 +83906,13 @@ function App({ requestLogin } = {}) {
   });
 }
 var init_App = __esm(() => {
+  init_authority();
+  init_keychain_source();
   init_op_source();
   init_profile_config();
   init_default_routing_rules();
   init_endpoint_registration();
+  init_keychain();
   init_local_liveness();
   init_onepassword_config();
   init_onepassword();
@@ -83038,10 +84149,10 @@ function shouldHideIncidentalAnthropicKey(config3, env = process.env) {
     return false;
   return !wantsAnthropicApiBilling(config3, env);
 }
-function hasResolvableAnthropicAuth(deps = {}) {
-  const env = deps.env ?? process.env;
-  const fileExists = deps.fileExists ?? existsSync30;
-  const keychainProbe = deps.keychainProbe ?? defaultKeychainAnthropicProbe;
+function hasResolvableAnthropicAuth(deps2 = {}) {
+  const env = deps2.env ?? process.env;
+  const fileExists = deps2.fileExists ?? existsSync30;
+  const keychainProbe = deps2.keychainProbe ?? defaultKeychainAnthropicProbe;
   if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN)
     return true;
   if (fileExists(join40(homedir35(), ".claude", ".credentials.json")))
@@ -83233,7 +84344,7 @@ function initializeTokenFile(tokenFilePath) {
     log(`[claude-runner] Could not initialize token file ${tokenFilePath}: ${e}`);
   }
 }
-function cleanupStaleTokenFiles(dir, now = Date.now(), maxAgeMs = STALE_TOKEN_FILE_MS) {
+function cleanupStaleTokenFiles(dir, now2 = Date.now(), maxAgeMs = STALE_TOKEN_FILE_MS) {
   let removed = 0;
   let entries;
   try {
@@ -83241,7 +84352,7 @@ function cleanupStaleTokenFiles(dir, now = Date.now(), maxAgeMs = STALE_TOKEN_FI
   } catch {
     return 0;
   }
-  const cutoff = now - maxAgeMs;
+  const cutoff = now2 - maxAgeMs;
   let scanned = 0;
   for (const name of entries) {
     if (scanned >= MAX_TOKEN_FILES_SCANNED)
@@ -83855,7 +84966,7 @@ function shouldWarmCatalog(args) {
   }
   return true;
 }
-function classifyCatalogState(cache3, ttlHours, now) {
+function classifyCatalogState(cache3, ttlHours, now2) {
   if (cache3 === null)
     return "missing";
   if (cache3.entries.length === 0 && cache3.models.length === 0)
@@ -83863,7 +84974,7 @@ function classifyCatalogState(cache3, ttlHours, now) {
   const lastUpdatedMs = Date.parse(cache3.lastUpdated);
   if (Number.isNaN(lastUpdatedMs))
     return "missing";
-  const ageMs = now.getTime() - lastUpdatedMs;
+  const ageMs = now2.getTime() - lastUpdatedMs;
   const ttlMs = ttlHours * 3600000;
   return ageMs < ttlMs ? "fresh" : "stale";
 }
@@ -83920,9 +85031,9 @@ async function warmCatalogIfNeeded(config3, opts) {
   }
   const ttlHoursRaw = opts?.ttlHours ?? Number.parseFloat(process.env.CLAUDISH_CATALOG_TTL_HOURS ?? "24");
   const ttlHours = Number.isFinite(ttlHoursRaw) && ttlHoursRaw > 0 ? ttlHoursRaw : 24;
-  const now = opts?.now ?? new Date;
+  const now2 = opts?.now ?? new Date;
   const cache3 = readAllModelsCache();
-  const state = classifyCatalogState(cache3, ttlHours, now);
+  const state = classifyCatalogState(cache3, ttlHours, now2);
   if (state === "fresh" && !config3.forceUpdate) {
     return "ok";
   }
@@ -83941,14 +85052,14 @@ async function warmCatalogIfNeeded(config3, opts) {
     return "ok";
   }
   if (state === "stale") {
-    const ageMs = now.getTime() - Date.parse(cache3.lastUpdated);
+    const ageMs = now2.getTime() - Date.parse(cache3.lastUpdated);
     const ageStr = humanizeAge(ageMs);
     process.stderr.write(`WARNING: Catalog stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
 `);
     return "warned";
   }
   if (state === "fresh") {
-    const ageMs = now.getTime() - Date.parse(cache3.lastUpdated);
+    const ageMs = now2.getTime() - Date.parse(cache3.lastUpdated);
     const ageStr = humanizeAge(ageMs);
     process.stderr.write(`WARNING: Catalog refresh failed (cache age ${ageStr}). Using cached version.
 `);
@@ -85410,10 +86521,10 @@ function ResumePicker({ groups, onDone }) {
   const { fresh, stale, visibleGroups } = useMemo4(() => {
     const withSessions = groups.filter((g) => (listed.get(g.name)?.length ?? 0) > 0);
     const matching = filter ? withSessions.filter((g) => fuzzy(filter, g.name)) : withSessions;
-    const now = Date.now();
+    const now2 = Date.now();
     const byRecency = (a, b) => b.lastActiveMs - a.lastActiveMs;
-    const f = matching.filter((g) => g.current || now - g.lastActiveMs < STALE_MS).sort((a, b) => a.current !== b.current ? a.current ? -1 : 1 : byRecency(a, b));
-    const st = matching.filter((g) => !g.current && now - g.lastActiveMs >= STALE_MS).sort(byRecency);
+    const f = matching.filter((g) => g.current || now2 - g.lastActiveMs < STALE_MS).sort((a, b) => a.current !== b.current ? a.current ? -1 : 1 : byRecency(a, b));
+    const st = matching.filter((g) => !g.current && now2 - g.lastActiveMs >= STALE_MS).sort(byRecency);
     return { fresh: f, stale: st, visibleGroups: [...f, ...st] };
   }, [groups, filter, listed]);
   const group = visibleGroups[Math.min(wtCursor, visibleGroups.length - 1)];
@@ -86342,7 +87453,7 @@ function renderSessionSummary(input) {
   const W2 = cardWidth();
   const inner = W2 - CHROME;
   const out = [];
-  const dim3 = (s) => paint(s, tokens.subtle);
+  const dim4 = (s) => paint(s, tokens.subtle);
   const body = (s) => paint(s, tokens.text);
   const titleText = exitCode === 0 ? " session " : " session \xB7 failed ";
   const titleHex = exitCode === 0 ? tokens.accent : tokens.error;
@@ -86364,26 +87475,26 @@ function renderSessionSummary(input) {
   const gap = Math.max(1, inner - visibleWidth(left) - visibleWidth(right));
   row(left + " ".repeat(gap) + right);
   if (stats.providerName)
-    row(dim3(truncate3(stats.providerName, inner)));
+    row(dim4(truncate3(stats.providerName, inner)));
   blank();
   const VALUE_W = 24;
   const barW = Math.max(12, inner - LABEL_W - VALUE_W);
   const dataRow = (label, bar, values) => {
-    row(dim3(padTo(label, LABEL_W)) + bar + padVisible2(values, VALUE_W, "right"));
+    row(dim4(padTo(label, LABEL_W)) + bar + padVisible2(values, VALUE_W, "right"));
   };
   if (stats.contextUsed !== null && stats.contextWindow) {
     const pct = stats.contextUsed * 100;
-    dataRow("context", meter(pct, barW, ramps.load), body(padStartTo(`${Math.round(pct)}%`, 4)) + dim3(`  ${compact(stats.inputTokens)}/${compact(stats.contextWindow)}`));
+    dataRow("context", meter(pct, barW, ramps.load), body(padStartTo(`${Math.round(pct)}%`, 4)) + dim4(`  ${compact(stats.inputTokens)}/${compact(stats.contextWindow)}`));
   }
   dataRow("tokens", stackedBar([
     { value: stats.inputTokens, color: C.blue },
     { value: stats.outputTokens, color: C.cyan }
-  ], barW), dim3("in ") + body(compact(stats.inputTokens)) + dim3(" out ") + body(compact(stats.outputTokens)));
+  ], barW), dim4("in ") + body(compact(stats.inputTokens)) + dim4(" out ") + body(compact(stats.outputTokens)));
   if (!stats.isFree && stats.inputCostUsd + stats.outputCostUsd > 0) {
     dataRow("spend", stackedBar([
       { value: stats.inputCostUsd, color: C.blue },
       { value: stats.outputCostUsd, color: C.cyan }
-    ], barW), dim3("in ") + body(usd(stats.inputCostUsd)) + dim3(" out ") + body(usd(stats.outputCostUsd)));
+    ], barW), dim4("in ") + body(usd(stats.inputCostUsd)) + dim4(" out ") + body(usd(stats.outputCostUsd)));
   }
   if (stats.toolCallTotal > 0) {
     const toolCols = toolColors();
@@ -86393,27 +87504,27 @@ function renderSessionSummary(input) {
     const segs = shown.map((t, i) => ({ value: t.count, color: toolCols[i] }));
     if (rest > 0)
       segs.push({ value: rest, color: other });
-    dataRow("tools", stackedBar(segs, barW), body(padStartTo(String(stats.toolCallTotal), 4)) + dim3(" calls"));
+    dataRow("tools", stackedBar(segs, barW), body(padStartTo(String(stats.toolCallTotal), 4)) + dim4(" calls"));
     const legend = shown.map((t, i) => paint(`${t.name} ${t.count}`, toolCols[i])).concat(rest > 0 ? [paint(`other ${rest}`, other)] : []);
-    for (const line of wrapStyled(legend, dim3(" \xB7 "), inner - LABEL_W)) {
+    for (const line of wrapStyled(legend, dim4(" \xB7 "), inner - LABEL_W)) {
       row(" ".repeat(LABEL_W) + line);
     }
   }
   blank();
-  row(dim3(padTo("cost", LABEL_W)) + paint(stats.isFree ? "free" : usd(stats.costUsd), stats.isFree ? tokens.success : tokens.text, true) + (stats.isEstimated && !stats.isFree ? dim3("  estimated") : ""));
+  row(dim4(padTo("cost", LABEL_W)) + paint(stats.isFree ? "free" : usd(stats.costUsd), stats.isFree ? tokens.success : tokens.text, true) + (stats.isEstimated && !stats.isFree ? dim4("  estimated") : ""));
   for (const s of stats.savings) {
     const label = padTo(`vs ${s.label}`, LABEL_W);
     if (s.savedUsd >= 0) {
       const pct = s.baselineUsd > 0 ? s.savedUsd / s.baselineUsd * 100 : 0;
-      dataRow(label, meter(pct, barW, ramps.savings), paint(padStartTo(`${Math.round(pct)}%`, 4), tokens.success) + dim3(" saved ") + paint(usd(s.savedUsd), tokens.success));
+      dataRow(label, meter(pct, barW, ramps.savings), paint(padStartTo(`${Math.round(pct)}%`, 4), tokens.success) + dim4(" saved ") + paint(usd(s.savedUsd), tokens.success));
     } else {
-      dataRow(label, meter(0, barW, ramps.savings), dim3("over by ") + paint(usd(-s.savedUsd), tokens.error));
+      dataRow(label, meter(0, barW, ramps.savings), dim4("over by ") + paint(usd(-s.savedUsd), tokens.error));
     }
   }
   out.push(paint(`\u2570${"\u2500".repeat(W2 - 2)}\u256F`, tokens.border));
   if (resumeId) {
     out.push("");
-    out.push(dim3("Resume this session with:"));
+    out.push(dim4("Resume this session with:"));
     const modelFlag = resumeModelSpec ? `--model ${resumeModelSpec} ` : "";
     out.push(`claudish ${modelFlag}--resume ${resumeId}`);
   }
@@ -86471,6 +87582,7 @@ function classifyStartupKind() {
     "telemetry",
     "stats",
     "providers",
+    "keychain",
     "login",
     "logout",
     "quota",
@@ -86590,6 +87702,7 @@ var isStatsCommand = firstPositional === "stats";
 var isConfigCommand = firstPositional === "config";
 var isServeCommand = firstPositional === "serve";
 var isProvidersCommand = firstPositional === "providers";
+var isKeychainCommand = firstPositional === "keychain";
 var isBehaviorCommand = firstPositional === "behavior";
 var isTeamCommand = firstPositional === "team";
 var isLoginCommand = firstPositional === "login";
@@ -86629,6 +87742,12 @@ if (isMcpMode) {
     console.error(`[claudish providers] ${e instanceof Error ? e.message : String(e)}`);
     process.exit(1);
   }));
+} else if (isKeychainCommand) {
+  const keychainArgIndex = args.indexOf("keychain");
+  Promise.resolve().then(() => (init_keychain_command(), exports_keychain_command)).then((m) => m.keychainCommand(args.slice(keychainArgIndex + 1)).catch((e) => {
+    console.error(`[claudish keychain] ${e instanceof Error ? e.message : String(e)}`);
+    process.exit(1);
+  }));
 } else if (isLoginCommand) {
   const loginProviderArg = args.find((a, i) => i > args.indexOf("login") && !a.startsWith("-"));
   Promise.resolve().then(() => (init_auth_commands(), exports_auth_commands)).then((m) => m.loginCommand(loginProviderArg).catch(handlePromptExit));
@@ -86666,6 +87785,10 @@ if (isMcpMode) {
   });
 } else if (isConfigCommand) {
   traceSpan("startup:tui-import", () => Promise.resolve().then(() => (init_tui(), exports_tui))).then(async (m) => {
+    await traceSpan("startup:theme-detect", async () => {
+      const { detectAndSetThemeMode: detectAndSetThemeMode2 } = await Promise.resolve().then(() => (init_theme_mode(), exports_theme_mode));
+      await detectAndSetThemeMode2();
+    });
     const { credentials: credentials2 } = await Promise.resolve().then(() => (init_authority(), exports_authority));
     const { ensureEndpointsRegistered: ensureEndpointsRegistered2 } = await Promise.resolve().then(() => (init_endpoint_registration(), exports_endpoint_registration));
     ensureEndpointsRegistered2();