Merge upstream/main into fix/anthropic-schema-format

2026-04-02 15:42:28 +02:00
parent 0c88dea247 1514220ee7
commit 6319df02f0
71 changed files with 6989 additions and 931 deletions
--- a/src/utils/auth.ts
+++ b/src/utils/auth.ts
@@ -117,7 +117,8 @@ export function isAnthropicAuthEnabled(): boolean {
    isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX) ||
    isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY) ||
    isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI) ||
-    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI)
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)

  // Check if user has configured an external API key source
  // This allows externally-provided API keys to work (without requiring proxy configuration)
@@ -1731,14 +1732,15 @@ export function getSubscriptionName(): string {
  }
 }

-/** Check if using third-party services (Bedrock or Vertex or Foundry or OpenAI-compatible or Gemini) */
+/** Check if using third-party services (Bedrock or Vertex or Foundry or OpenAI-compatible or Gemini or GitHub Models) */
 export function isUsing3PServices(): boolean {
  return !!(
    isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK) ||
    isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX) ||
    isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY) ||
    isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI) ||
-    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI)
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
  )
 }

--- a/src/utils/autoUpdater.ts
+++ b/src/utils/autoUpdater.ts
@@ -9,6 +9,7 @@ import {
  logEvent,
 } from 'src/services/analytics/index.js'
 import { type ReleaseChannel, saveGlobalConfig } from './config.js'
+import { getAPIProvider } from './model/providers.js'
 import { logForDebugging } from './debug.js'
 import { env } from './env.js'
 import { getClaudeConfigHomeDir } from './envUtils.js'
@@ -72,6 +73,12 @@ export async function assertMinVersion(): Promise<void> {
    return
  }

+  // Skip version check for third-party providers — the min version
+  // kill-switch is Anthropic-specific and should not block 3P users
+  if (getAPIProvider() !== 'firstParty') {
+    return
+  }
+
  try {
    const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT<{
      minVersion: string
--- a/src/utils/context.ts
+++ b/src/utils/context.ts
@@ -74,10 +74,9 @@ export function getContextWindowForModel(

  // OpenAI-compatible provider — use known context windows for the model
  if (
-    process.env.CLAUDE_CODE_USE_OPENAI === '1' ||
-    process.env.CLAUDE_CODE_USE_OPENAI === 'true' ||
-    process.env.CLAUDE_CODE_USE_GEMINI === '1' ||
-    process.env.CLAUDE_CODE_USE_GEMINI === 'true'
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
  ) {
    const openaiWindow = getOpenAIContextWindow(model)
    if (openaiWindow !== undefined) {
@@ -178,10 +177,9 @@ export function getModelMaxOutputTokens(model: string): {

  // OpenAI-compatible provider — use known output limits to avoid 400 errors
  if (
-    process.env.CLAUDE_CODE_USE_OPENAI === '1' ||
-    process.env.CLAUDE_CODE_USE_OPENAI === 'true' ||
-    process.env.CLAUDE_CODE_USE_GEMINI === '1' ||
-    process.env.CLAUDE_CODE_USE_GEMINI === 'true'
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
  ) {
    const openaiMax = getOpenAIMaxOutputTokens(model)
    if (openaiMax !== undefined) {
--- a/src/utils/effort.ts
+++ b/src/utils/effort.ts
@@ -17,6 +17,14 @@ export const EFFORT_LEVELS = [
  'max',
 ] as const satisfies readonly EffortLevel[]

+export const OPENAI_EFFORT_LEVELS = [
+  'low',
+  'medium',
+  'high',
+  'xhigh',
+] as const
+
+export type OpenAIEffortLevel = typeof OPENAI_EFFORT_LEVELS[number]
 export type EffortValue = EffortLevel | number

 // @[MODEL LAUNCH]: Add the new model to the allowlist if it supports the effort parameter.
@@ -68,6 +76,46 @@ export function isEffortLevel(value: string): value is EffortLevel {
  return (EFFORT_LEVELS as readonly string[]).includes(value)
 }

+export function isOpenAIEffortLevel(value: string): value is OpenAIEffortLevel {
+  return (OPENAI_EFFORT_LEVELS as readonly string[]).includes(value)
+}
+
+export function modelUsesOpenAIEffort(model: string): boolean {
+  const provider = getAPIProvider()
+  return provider === 'openai' || provider === 'codex'
+}
+
+export function getAvailableEffortLevels(model: string): EffortLevel[] | OpenAIEffortLevel[] {
+  if (modelUsesOpenAIEffort(model)) {
+    return [...OPENAI_EFFORT_LEVELS] as OpenAIEffortLevel[]
+  }
+  const levels: EffortLevel[] = ['low', 'medium', 'high']
+  if (modelSupportsMaxEffort(model)) {
+    levels.push('max')
+  }
+  return levels
+}
+
+export function getEffortLevelLabel(level: EffortLevel | OpenAIEffortLevel): string {
+  if (level === 'xhigh') return 'Extra High'
+  if (level === 'max') return 'Max'
+  return capitalize(level)
+}
+
+export function openAIEffortToStandard(level: OpenAIEffortLevel): EffortLevel {
+  if (level === 'xhigh') return 'max'
+  return level
+}
+
+export function standardEffortToOpenAI(level: EffortLevel): OpenAIEffortLevel {
+  if (level === 'max') return 'xhigh'
+  return level as OpenAIEffortLevel
+}
+
+function capitalize(s: string): string {
+  return s.charAt(0).toUpperCase() + s.slice(1)
+}
+
 export function parseEffortValue(value: unknown): EffortValue | undefined {
  if (value === undefined || value === null || value === '') {
    return undefined
@@ -221,7 +269,7 @@ export function convertEffortValueToLevel(value: EffortValue): EffortLevel {
 * @param level The effort level to describe
 * @returns Human-readable description
 */
-export function getEffortLevelDescription(level: EffortLevel): string {
+export function getEffortLevelDescription(level: EffortLevel | OpenAIEffortLevel): string {
  switch (level) {
    case 'low':
      return 'Quick, straightforward implementation with minimal overhead'
@@ -231,6 +279,8 @@ export function getEffortLevelDescription(level: EffortLevel): string {
      return 'Comprehensive implementation with extensive testing and documentation'
    case 'max':
      return 'Maximum capability with deepest reasoning (Opus 4.6 only)'
+    case 'xhigh':
+      return 'Extra high reasoning effort for complex tasks (OpenAI/Codex)'
  }
 }

--- a/src/utils/githubModelsCredentials.hydrate.test.ts
+++ b/src/utils/githubModelsCredentials.hydrate.test.ts
@@ -0,0 +1,66 @@
+/**
+ * Hydrate tests live in a separate file with no static import of
+ * githubModelsCredentials so Bun's mock.module can replace secureStorage
+ * before that module is first loaded.
+ */
+import { afterEach, describe, expect, mock, test } from 'bun:test'
+
+describe('hydrateGithubModelsTokenFromSecureStorage', () => {
+  const orig = {
+    CLAUDE_CODE_USE_GITHUB: process.env.CLAUDE_CODE_USE_GITHUB,
+    GITHUB_TOKEN: process.env.GITHUB_TOKEN,
+    GH_TOKEN: process.env.GH_TOKEN,
+    CLAUDE_CODE_SIMPLE: process.env.CLAUDE_CODE_SIMPLE,
+  }
+
+  afterEach(() => {
+    mock.restore()
+    for (const [k, v] of Object.entries(orig)) {
+      if (v === undefined) {
+        delete process.env[k as keyof typeof orig]
+      } else {
+        process.env[k as keyof typeof orig] = v
+      }
+    }
+  })
+
+  test('sets GITHUB_TOKEN from secure storage when USE_GITHUB and env token empty', async () => {
+    process.env.CLAUDE_CODE_USE_GITHUB = '1'
+    delete process.env.GITHUB_TOKEN
+    delete process.env.GH_TOKEN
+    delete process.env.CLAUDE_CODE_SIMPLE
+
+    mock.module('./secureStorage/index.js', () => ({
+      getSecureStorage: () => ({
+        read: () => ({
+          githubModels: { accessToken: 'stored-secret' },
+        }),
+      }),
+    }))
+
+    const { hydrateGithubModelsTokenFromSecureStorage } = await import(
+      './githubModelsCredentials.js'
+    )
+    hydrateGithubModelsTokenFromSecureStorage()
+    expect(process.env.GITHUB_TOKEN).toBe('stored-secret')
+  })
+
+  test('does not override existing GITHUB_TOKEN', async () => {
+    process.env.CLAUDE_CODE_USE_GITHUB = '1'
+    process.env.GITHUB_TOKEN = 'already'
+
+    mock.module('./secureStorage/index.js', () => ({
+      getSecureStorage: () => ({
+        read: () => ({
+          githubModels: { accessToken: 'stored-secret' },
+        }),
+      }),
+    }))
+
+    const { hydrateGithubModelsTokenFromSecureStorage } = await import(
+      './githubModelsCredentials.js'
+    )
+    hydrateGithubModelsTokenFromSecureStorage()
+    expect(process.env.GITHUB_TOKEN).toBe('already')
+  })
+})
--- a/src/utils/githubModelsCredentials.test.ts
+++ b/src/utils/githubModelsCredentials.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, test } from 'bun:test'
+
+import {
+  clearGithubModelsToken,
+  readGithubModelsToken,
+  saveGithubModelsToken,
+} from './githubModelsCredentials.js'
+
+describe('readGithubModelsToken', () => {
+  test('returns undefined in bare mode', () => {
+    const prev = process.env.CLAUDE_CODE_SIMPLE
+    process.env.CLAUDE_CODE_SIMPLE = '1'
+    expect(readGithubModelsToken()).toBeUndefined()
+    if (prev === undefined) {
+      delete process.env.CLAUDE_CODE_SIMPLE
+    } else {
+      process.env.CLAUDE_CODE_SIMPLE = prev
+    }
+  })
+})
+
+describe('saveGithubModelsToken / clearGithubModelsToken', () => {
+  test('save returns failure in bare mode', () => {
+    const prev = process.env.CLAUDE_CODE_SIMPLE
+    process.env.CLAUDE_CODE_SIMPLE = '1'
+    const r = saveGithubModelsToken('abc')
+    expect(r.success).toBe(false)
+    expect(r.warning).toContain('Bare mode')
+    if (prev === undefined) {
+      delete process.env.CLAUDE_CODE_SIMPLE
+    } else {
+      process.env.CLAUDE_CODE_SIMPLE = prev
+    }
+  })
+
+  test('clear succeeds in bare mode', () => {
+    const prev = process.env.CLAUDE_CODE_SIMPLE
+    process.env.CLAUDE_CODE_SIMPLE = '1'
+    expect(clearGithubModelsToken().success).toBe(true)
+    if (prev === undefined) {
+      delete process.env.CLAUDE_CODE_SIMPLE
+    } else {
+      process.env.CLAUDE_CODE_SIMPLE = prev
+    }
+  })
+})
+
--- a/src/utils/githubModelsCredentials.ts
+++ b/src/utils/githubModelsCredentials.ts
@@ -0,0 +1,73 @@
+import { isBareMode, isEnvTruthy } from './envUtils.js'
+import { getSecureStorage } from './secureStorage/index.js'
+
+/** JSON key in the shared OpenClaude secure storage blob. */
+export const GITHUB_MODELS_STORAGE_KEY = 'githubModels' as const
+
+export type GithubModelsCredentialBlob = {
+  accessToken: string
+}
+
+export function readGithubModelsToken(): string | undefined {
+  if (isBareMode()) return undefined
+  try {
+    const data = getSecureStorage().read() as
+      | ({ githubModels?: GithubModelsCredentialBlob } & Record<string, unknown>)
+      | null
+    const t = data?.githubModels?.accessToken?.trim()
+    return t || undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * If GitHub Models mode is on and no token is in the environment, copy the
+ * stored token into process.env so the OpenAI shim and validation see it.
+ */
+export function hydrateGithubModelsTokenFromSecureStorage(): void {
+  if (!isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)) {
+    return
+  }
+  if (process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()) {
+    return
+  }
+  if (isBareMode()) {
+    return
+  }
+  const t = readGithubModelsToken()
+  if (t) {
+    process.env.GITHUB_TOKEN = t
+  }
+}
+
+export function saveGithubModelsToken(token: string): {
+  success: boolean
+  warning?: string
+} {
+  if (isBareMode()) {
+    return { success: false, warning: 'Bare mode: secure storage is disabled.' }
+  }
+  const trimmed = token.trim()
+  if (!trimmed) {
+    return { success: false, warning: 'Token is empty.' }
+  }
+  const secureStorage = getSecureStorage()
+  const prev = secureStorage.read() || {}
+  const merged = {
+    ...(prev as Record<string, unknown>),
+    [GITHUB_MODELS_STORAGE_KEY]: { accessToken: trimmed },
+  }
+  return secureStorage.update(merged as typeof prev)
+}
+
+export function clearGithubModelsToken(): { success: boolean; warning?: string } {
+  if (isBareMode()) {
+    return { success: true }
+  }
+  const secureStorage = getSecureStorage()
+  const prev = secureStorage.read() || {}
+  const next = { ...(prev as Record<string, unknown>) }
+  delete next[GITHUB_MODELS_STORAGE_KEY]
+  return secureStorage.update(next as typeof prev)
+}
--- a/src/utils/managedEnvConstants.ts
+++ b/src/utils/managedEnvConstants.ts
@@ -18,6 +18,7 @@ const PROVIDER_MANAGED_ENV_VARS = new Set([
  'CLAUDE_CODE_USE_BEDROCK',
  'CLAUDE_CODE_USE_VERTEX',
  'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GITHUB',
  // Endpoint config (base URLs, project/resource identifiers)
  'ANTHROPIC_BASE_URL',
  'ANTHROPIC_BEDROCK_BASE_URL',
@@ -147,6 +148,7 @@ export const SAFE_ENV_VARS = new Set([
  'CLAUDE_CODE_SUBAGENT_MODEL',
  'CLAUDE_CODE_USE_BEDROCK',
  'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GITHUB',
  'CLAUDE_CODE_USE_VERTEX',
  'DISABLE_AUTOUPDATER',
  'DISABLE_BUG_COMMAND',
--- a/src/utils/model/aliases.ts
+++ b/src/utils/model/aliases.ts
@@ -6,8 +6,6 @@ export const MODEL_ALIASES = [
  'sonnet[1m]',
  'opus[1m]',
  'opusplan',
-  'codexplan',
-  'codexspark',
 ] as const
 export type ModelAlias = (typeof MODEL_ALIASES)[number]

--- a/src/utils/model/model.ts
+++ b/src/utils/model/model.ts
@@ -123,6 +123,10 @@ export function getDefaultOpusModel(): ModelName {
  if (getAPIProvider() === 'openai') {
    return process.env.OPENAI_MODEL || 'gpt-4o'
  }
+  // Codex provider: use user-specified model or default to gpt-5.4
+  if (getAPIProvider() === 'codex') {
+    return process.env.OPENAI_MODEL || 'gpt-5.4'
+  }
  // 3P providers (Bedrock, Vertex, Foundry) — kept as a separate branch
  // even when values match, since 3P availability lags firstParty and
  // these will diverge again at the next model launch.
@@ -145,6 +149,10 @@ export function getDefaultSonnetModel(): ModelName {
  if (getAPIProvider() === 'openai') {
    return process.env.OPENAI_MODEL || 'gpt-4o'
  }
+  // Codex provider
+  if (getAPIProvider() === 'codex') {
+    return process.env.OPENAI_MODEL || 'gpt-5.4'
+  }
  // Default to Sonnet 4.5 for 3P since they may not have 4.6 yet
  if (getAPIProvider() !== 'firstParty') {
    return getModelStrings().sonnet45
@@ -165,6 +173,10 @@ export function getDefaultHaikuModel(): ModelName {
  if (getAPIProvider() === 'openai') {
    return process.env.OPENAI_MODEL || 'gpt-4o-mini'
  }
+  // Codex provider
+  if (getAPIProvider() === 'codex') {
+    return process.env.OPENAI_MODEL || 'gpt-5.4'
+  }

  // Haiku 4.5 is available on all platforms (first-party, Foundry, Bedrock, Vertex)
  return getModelStrings().haiku45
@@ -217,6 +229,10 @@ export function getDefaultMainLoopModelSetting(): ModelName | ModelAlias {
  if (getAPIProvider() === 'openai') {
    return process.env.OPENAI_MODEL || 'gpt-4o'
  }
+  // Codex provider: always use the configured Codex model (default gpt-5.4)
+  if (getAPIProvider() === 'codex') {
+    return process.env.OPENAI_MODEL || 'gpt-5.4'
+  }

  // Ants default to defaultModel from flag config, or Opus 1M if not configured
  if (process.env.USER_TYPE === 'ant') {
@@ -343,12 +359,6 @@ export function renderDefaultModelSetting(
  if (setting === 'opusplan') {
    return 'Opus 4.6 in plan mode, else Sonnet 4.6'
  }
-  if (setting === 'codexplan') {
-    return 'Codex Plan (GPT-5.4 high reasoning)'
-  }
-  if (setting === 'codexspark') {
-    return 'Codex Spark (GPT-5.3 Codex Spark)'
-  }
  return renderModelName(parseUserSpecifiedModel(setting))
 }

@@ -383,11 +393,12 @@ export function renderModelSetting(setting: ModelName | ModelAlias): string {
  if (setting === 'opusplan') {
    return 'Opus Plan'
  }
+  // Handle Codex models - show actual model name + resolved model
  if (setting === 'codexplan') {
-    return 'Codex Plan'
+    return 'codexplan (gpt-5.4)'
  }
  if (setting === 'codexspark') {
-    return 'Codex Spark'
+    return 'codexspark (gpt-5.3-codex-spark)'
  }
  if (isModelAlias(setting)) {
    return capitalize(setting)
@@ -401,8 +412,8 @@ export function renderModelSetting(setting: ModelName | ModelAlias): string {
 * if the model is not recognized as a public model.
 */
 export function getPublicModelDisplayName(model: ModelName): string | null {
-  // For OpenAI/Gemini providers, show the actual model name not a Claude alias
-  if (getAPIProvider() === 'openai' || getAPIProvider() === 'gemini') {
+  // For OpenAI/Gemini/Codex providers, show the actual model name not a Claude alias
+  if (getAPIProvider() === 'openai' || getAPIProvider() === 'gemini' || getAPIProvider() === 'codex') {
    return null
  }
  switch (model) {
@@ -517,10 +528,6 @@ export function parseUserSpecifiedModel(

  if (isModelAlias(modelString)) {
    switch (modelString) {
-      case 'codexplan':
-        return modelInputTrimmed
-      case 'codexspark':
-        return modelInputTrimmed
      case 'opusplan':
        return getDefaultSonnetModel() + (has1mTag ? '[1m]' : '') // Sonnet is default, Opus in plan mode
      case 'sonnet':
@@ -535,6 +542,14 @@ export function parseUserSpecifiedModel(
    }
  }

+  // Handle Codex aliases - map to actual model names
+  if (modelString === 'codexplan') {
+    return 'gpt-5.4'
+  }
+  if (modelString === 'codexspark') {
+    return 'gpt-5.3-codex-spark'
+  }
+
  // Opus 4/4.1 are no longer available on the first-party API (same as
  // Claude.ai) — silently remap to the current Opus default. The 'opus'
  // alias already resolves to 4.6, so the only users on these explicit
--- a/src/utils/model/modelOptions.ts
+++ b/src/utils/model/modelOptions.ts
@@ -268,20 +268,65 @@ function getOpusPlanOption(): ModelOption {

 function getCodexPlanOption(): ModelOption {
  return {
-    value: 'codexplan',
-    label: 'Codex Plan',
+    value: 'gpt-5.4',
+    label: 'gpt-5.4',
    description: 'GPT-5.4 on the Codex backend with high reasoning',
  }
 }

 function getCodexSparkOption(): ModelOption {
  return {
-    value: 'codexspark',
-    label: 'Codex Spark',
+    value: 'gpt-5.3-codex-spark',
+    label: 'gpt-5.3-codex-spark',
    description: 'GPT-5.3 Codex Spark on the Codex backend for fast tool loops',
  }
 }

+function getCodexModelOptions(): ModelOption[] {
+  return [
+    {
+      value: 'gpt-5.4',
+      label: 'gpt-5.4',
+      description: 'GPT-5.4 with high reasoning',
+    },
+    {
+      value: 'gpt-5.3-codex',
+      label: 'gpt-5.3-codex',
+      description: 'GPT-5.3 Codex with high reasoning',
+    },
+    {
+      value: 'gpt-5.3-codex-spark',
+      label: 'gpt-5.3-codex-spark',
+      description: 'GPT-5.3 Codex Spark for fast tool loops',
+    },
+    {
+      value: 'codexspark',
+      label: 'codexspark',
+      description: 'GPT-5.3 Codex Spark alias for fast tool loops',
+    },
+    {
+      value: 'gpt-5.2-codex',
+      label: 'gpt-5.2-codex',
+      description: 'GPT-5.2 Codex with high reasoning',
+    },
+    {
+      value: 'gpt-5.1-codex-max',
+      label: 'gpt-5.1-codex-max',
+      description: 'GPT-5.1 Codex Max for deep reasoning',
+    },
+    {
+      value: 'gpt-5.1-codex-mini',
+      label: 'gpt-5.1-codex-mini',
+      description: 'GPT-5.1 Codex Mini - faster, cheaper',
+    },
+    {
+      value: 'gpt-5.4-mini',
+      label: 'gpt-5.4-mini',
+      description: 'GPT-5.4 Mini - faster, cheaper',
+    },
+  ]
+}
+
 // @[MODEL LAUNCH]: Update the model picker lists below to include/reorder options for the new model.
 // Each user tier (ant, Max/Team Premium, Pro/Team Standard/Enterprise, PAYG 1P, PAYG 3P) has its own list.
 function getModelOptionsBase(fastMode = false): ModelOption[] {
@@ -360,8 +405,9 @@ function getModelOptionsBase(fastMode = false): ModelOption[] {
  // PAYG 3P: Default (Sonnet 4.5) + Sonnet (3P custom) or Sonnet 4.6/1M + Opus (3P custom) or Opus 4.1/Opus 4.6/Opus1M + Haiku + Opus 4.1
  const payg3pOptions = [getDefaultOptionForUser(fastMode)]

-  if (getAPIProvider() === 'openai') {
-    payg3pOptions.push(getCodexPlanOption(), getCodexSparkOption())
+  // Add Codex models for openai and codex providers
+  if (getAPIProvider() === 'openai' || getAPIProvider() === 'codex') {
+    payg3pOptions.push(...getCodexModelOptions())
  }

  const customSonnet = getCustomSonnetOption()
@@ -517,9 +563,9 @@ export function getModelOptions(fastMode = false): ModelOption[] {
    return filterModelOptionsByAllowlist(options)
  } else if (customModel === 'opusplan') {
    return filterModelOptionsByAllowlist([...options, getOpusPlanOption()])
-  } else if (customModel === 'codexplan') {
+  } else if (customModel === 'gpt-5.4') {
    return filterModelOptionsByAllowlist([...options, getCodexPlanOption()])
-  } else if (customModel === 'codexspark') {
+  } else if (customModel === 'gpt-5.3-codex-spark') {
    return filterModelOptionsByAllowlist([...options, getCodexSparkOption()])
  } else if (customModel === 'opus' && getAPIProvider() === 'firstParty') {
    return filterModelOptionsByAllowlist([
@@ -554,11 +600,23 @@ export function getModelOptions(fastMode = false): ModelOption[] {
 */
 function filterModelOptionsByAllowlist(options: ModelOption[]): ModelOption[] {
  const settings = getSettings_DEPRECATED() || {}
-  if (!settings.availableModels) {
-    return options // No restrictions
-  }
-  return options.filter(
+  const filtered = !settings.availableModels
+    ? options // No restrictions
+    : options.filter(
    opt =>
      opt.value === null || (opt.value !== null && isModelAllowed(opt.value)),
  )
+
+  // Select state uses option values as identity keys. If two entries share the
+  // same value (e.g. provider-specific aliases collapsing to one model ID),
+  // navigation/focus can become inconsistent and appear as duplicate rendering.
+  const seen = new Set<string>()
+  return filtered.filter(opt => {
+    const key = String(opt.value)
+    if (seen.has(key)) {
+      return false
+    }
+    seen.add(key)
+    return true
+  })
 }
--- a/src/utils/model/modelStrings.ts
+++ b/src/utils/model/modelStrings.ts
@@ -23,9 +23,12 @@ export type ModelStrings = Record<ModelKey, string>
 const MODEL_KEYS = Object.keys(ALL_MODEL_CONFIGS) as ModelKey[]

 function getBuiltinModelStrings(provider: APIProvider): ModelStrings {
+  // Codex piggybacks on the OpenAI provider transport for Anthropic tier aliases.
+  // Reuse OpenAI mappings so model string lookups never return undefined.
+  const providerKey = provider === 'codex' ? 'openai' : provider
  const out = {} as ModelStrings
  for (const key of MODEL_KEYS) {
-    out[key] = ALL_MODEL_CONFIGS[key][provider]
+    out[key] = ALL_MODEL_CONFIGS[key][providerKey]
  }
  return out
 }
--- a/src/utils/model/openaiContextWindows.ts
+++ b/src/utils/model/openaiContextWindows.ts
@@ -44,6 +44,11 @@ const OPENAI_CONTEXT_WINDOWS: Record<string, number> = {
  'google/gemini-2.0-flash':1_048_576,
  'google/gemini-2.5-pro':  1_048_576,

+  // Google (native via CLAUDE_CODE_USE_GEMINI)
+  'gemini-2.0-flash':       1_048_576,
+  'gemini-2.5-pro':         1_048_576,
+  'gemini-2.5-flash':       1_048_576,
+
  // Ollama local models
  'llama3.3:70b':               8_192,
  'llama3.1:8b':                8_192,
@@ -94,7 +99,12 @@ const OPENAI_MAX_OUTPUT_TOKENS: Record<string, number> = {

  // Google (via OpenRouter)
  'google/gemini-2.0-flash':   8_192,
-  'google/gemini-2.5-pro':    32_768,
+  'google/gemini-2.5-pro':    65_536,
+
+  // Google (native via CLAUDE_CODE_USE_GEMINI)
+  'gemini-2.0-flash':          8_192,
+  'gemini-2.5-pro':           65_536,
+  'gemini-2.5-flash':         65_536,

  // Ollama local models (conservative safe defaults)
  'llama3.3:70b':               4_096,
--- a/src/utils/model/providers.test.ts
+++ b/src/utils/model/providers.test.ts
@@ -7,6 +7,7 @@ import {

 const originalEnv = {
  CLAUDE_CODE_USE_GEMINI: process.env.CLAUDE_CODE_USE_GEMINI,
+  CLAUDE_CODE_USE_GITHUB: process.env.CLAUDE_CODE_USE_GITHUB,
  CLAUDE_CODE_USE_OPENAI: process.env.CLAUDE_CODE_USE_OPENAI,
  CLAUDE_CODE_USE_BEDROCK: process.env.CLAUDE_CODE_USE_BEDROCK,
  CLAUDE_CODE_USE_VERTEX: process.env.CLAUDE_CODE_USE_VERTEX,
@@ -15,6 +16,7 @@ const originalEnv = {

 afterEach(() => {
  process.env.CLAUDE_CODE_USE_GEMINI = originalEnv.CLAUDE_CODE_USE_GEMINI
+  process.env.CLAUDE_CODE_USE_GITHUB = originalEnv.CLAUDE_CODE_USE_GITHUB
  process.env.CLAUDE_CODE_USE_OPENAI = originalEnv.CLAUDE_CODE_USE_OPENAI
  process.env.CLAUDE_CODE_USE_BEDROCK = originalEnv.CLAUDE_CODE_USE_BEDROCK
  process.env.CLAUDE_CODE_USE_VERTEX = originalEnv.CLAUDE_CODE_USE_VERTEX
@@ -23,6 +25,7 @@ afterEach(() => {

 function clearProviderEnv(): void {
  delete process.env.CLAUDE_CODE_USE_GEMINI
+  delete process.env.CLAUDE_CODE_USE_GITHUB
  delete process.env.CLAUDE_CODE_USE_OPENAI
  delete process.env.CLAUDE_CODE_USE_BEDROCK
  delete process.env.CLAUDE_CODE_USE_VERTEX
@@ -38,6 +41,7 @@ test('first-party provider keeps Anthropic account setup flow enabled', () => {

 test.each([
  ['CLAUDE_CODE_USE_OPENAI', 'openai'],
+  ['CLAUDE_CODE_USE_GITHUB', 'github'],
  ['CLAUDE_CODE_USE_GEMINI', 'gemini'],
  ['CLAUDE_CODE_USE_BEDROCK', 'bedrock'],
  ['CLAUDE_CODE_USE_VERTEX', 'vertex'],
@@ -52,3 +56,11 @@ test.each([
    expect(usesAnthropicAccountFlow()).toBe(false)
  },
 )
+
+test('GEMINI takes precedence over GitHub when both are set', () => {
+  clearProviderEnv()
+  process.env.CLAUDE_CODE_USE_GEMINI = '1'
+  process.env.CLAUDE_CODE_USE_GITHUB = '1'
+
+  expect(getAPIProvider()).toBe('gemini')
+})
--- a/src/utils/model/providers.ts
+++ b/src/utils/model/providers.ts
@@ -1,25 +1,50 @@
 import type { AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS } from '../../services/analytics/index.js'
 import { isEnvTruthy } from '../envUtils.js'

-export type APIProvider = 'firstParty' | 'bedrock' | 'vertex' | 'foundry' | 'openai' | 'gemini'
+export type APIProvider =
+  | 'firstParty'
+  | 'bedrock'
+  | 'vertex'
+  | 'foundry'
+  | 'openai'
+  | 'gemini'
+  | 'github'
+  | 'codex'

 export function getAPIProvider(): APIProvider {
  return isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI)
    ? 'gemini'
-    : isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI)
-      ? 'openai'
-      : isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK)
-        ? 'bedrock'
-        : isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX)
-          ? 'vertex'
-          : isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY)
-            ? 'foundry'
-            : 'firstParty'
+    : isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
+      ? 'github'
+      : isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI)
+        ? isCodexModel()
+          ? 'codex'
+          : 'openai'
+        : isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK)
+          ? 'bedrock'
+          : isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX)
+            ? 'vertex'
+            : isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY)
+              ? 'foundry'
+              : 'firstParty'
 }

 export function usesAnthropicAccountFlow(): boolean {
  return getAPIProvider() === 'firstParty'
 }
+function isCodexModel(): boolean {
+  const model = (process.env.OPENAI_MODEL || '').toLowerCase()
+  return (
+    model === 'codexplan' ||
+    model === 'codexspark' ||
+    model === 'gpt-5.4' ||
+    model === 'gpt-5.3-codex' ||
+    model === 'gpt-5.3-codex-spark' ||
+    model === 'gpt-5.2-codex' ||
+    model === 'gpt-5.1-codex-max' ||
+    model === 'gpt-5.1-codex-mini'
+  )
+}

 export function getAPIProviderForStatsig(): AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS {
  return getAPIProvider() as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS
--- a/src/utils/providerDiscovery.ts
+++ b/src/utils/providerDiscovery.ts
@@ -0,0 +1,189 @@
+import type { OllamaModelDescriptor } from './providerRecommendation.ts'
+
+export const DEFAULT_OLLAMA_BASE_URL = 'http://localhost:11434'
+export const DEFAULT_ATOMIC_CHAT_BASE_URL = 'http://127.0.0.1:1337'
+
+function withTimeoutSignal(timeoutMs: number): {
+  signal: AbortSignal
+  clear: () => void
+} {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), timeoutMs)
+  return {
+    signal: controller.signal,
+    clear: () => clearTimeout(timeout),
+  }
+}
+
+function trimTrailingSlash(value: string): string {
+  return value.replace(/\/+$/, '')
+}
+
+export function getOllamaApiBaseUrl(baseUrl?: string): string {
+  const parsed = new URL(
+    baseUrl || process.env.OLLAMA_BASE_URL || DEFAULT_OLLAMA_BASE_URL,
+  )
+  const pathname = trimTrailingSlash(parsed.pathname)
+  parsed.pathname = pathname.endsWith('/v1')
+    ? pathname.slice(0, -3) || '/'
+    : pathname || '/'
+  parsed.search = ''
+  parsed.hash = ''
+  return trimTrailingSlash(parsed.toString())
+}
+
+export function getOllamaChatBaseUrl(baseUrl?: string): string {
+  return `${getOllamaApiBaseUrl(baseUrl)}/v1`
+}
+
+export function getAtomicChatApiBaseUrl(baseUrl?: string): string {
+  const parsed = new URL(
+    baseUrl || process.env.ATOMIC_CHAT_BASE_URL || DEFAULT_ATOMIC_CHAT_BASE_URL,
+  )
+  const pathname = trimTrailingSlash(parsed.pathname)
+  parsed.pathname = pathname.endsWith('/v1')
+    ? pathname.slice(0, -3) || '/'
+    : pathname || '/'
+  parsed.search = ''
+  parsed.hash = ''
+  return trimTrailingSlash(parsed.toString())
+}
+
+export function getAtomicChatChatBaseUrl(baseUrl?: string): string {
+  return `${getAtomicChatApiBaseUrl(baseUrl)}/v1`
+}
+
+export async function hasLocalOllama(baseUrl?: string): Promise<boolean> {
+  const { signal, clear } = withTimeoutSignal(1200)
+  try {
+    const response = await fetch(`${getOllamaApiBaseUrl(baseUrl)}/api/tags`, {
+      method: 'GET',
+      signal,
+    })
+    return response.ok
+  } catch {
+    return false
+  } finally {
+    clear()
+  }
+}
+
+export async function listOllamaModels(
+  baseUrl?: string,
+): Promise<OllamaModelDescriptor[]> {
+  const { signal, clear } = withTimeoutSignal(5000)
+  try {
+    const response = await fetch(`${getOllamaApiBaseUrl(baseUrl)}/api/tags`, {
+      method: 'GET',
+      signal,
+    })
+    if (!response.ok) {
+      return []
+    }
+
+    const data = (await response.json()) as {
+      models?: Array<{
+        name?: string
+        size?: number
+        details?: {
+          family?: string
+          families?: string[]
+          parameter_size?: string
+          quantization_level?: string
+        }
+      }>
+    }
+
+    return (data.models ?? [])
+      .filter(model => Boolean(model.name))
+      .map(model => ({
+        name: model.name!,
+        sizeBytes: typeof model.size === 'number' ? model.size : null,
+        family: model.details?.family ?? null,
+        families: model.details?.families ?? [],
+        parameterSize: model.details?.parameter_size ?? null,
+        quantizationLevel: model.details?.quantization_level ?? null,
+      }))
+  } catch {
+    return []
+  } finally {
+    clear()
+  }
+}
+
+export async function hasLocalAtomicChat(baseUrl?: string): Promise<boolean> {
+  const { signal, clear } = withTimeoutSignal(1200)
+  try {
+    const response = await fetch(`${getAtomicChatChatBaseUrl(baseUrl)}/models`, {
+      method: 'GET',
+      signal,
+    })
+    return response.ok
+  } catch {
+    return false
+  } finally {
+    clear()
+  }
+}
+
+export async function listAtomicChatModels(
+  baseUrl?: string,
+): Promise<string[]> {
+  const { signal, clear } = withTimeoutSignal(5000)
+  try {
+    const response = await fetch(`${getAtomicChatChatBaseUrl(baseUrl)}/models`, {
+      method: 'GET',
+      signal,
+    })
+    if (!response.ok) {
+      return []
+    }
+
+    const data = (await response.json()) as {
+      data?: Array<{ id?: string }>
+    }
+
+    return (data.data ?? [])
+      .filter(model => Boolean(model.id))
+      .map(model => model.id!)
+  } catch {
+    return []
+  } finally {
+    clear()
+  }
+}
+
+export async function benchmarkOllamaModel(
+  modelName: string,
+  baseUrl?: string,
+): Promise<number | null> {
+  const start = Date.now()
+  const { signal, clear } = withTimeoutSignal(20000)
+  try {
+    const response = await fetch(`${getOllamaApiBaseUrl(baseUrl)}/api/chat`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      signal,
+      body: JSON.stringify({
+        model: modelName,
+        stream: false,
+        messages: [{ role: 'user', content: 'Reply with OK.' }],
+        options: {
+          temperature: 0,
+          num_predict: 8,
+        },
+      }),
+    })
+    if (!response.ok) {
+      return null
+    }
+    await response.json()
+    return Date.now() - start
+  } catch {
+    return null
+  } finally {
+    clear()
+  }
+}
--- a/src/utils/providerProfile.test.ts
+++ b/src/utils/providerProfile.test.ts
@@ -1,15 +1,24 @@
 import assert from 'node:assert/strict'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import test from 'node:test'

 import {
+  buildStartupEnvFromProfile,
+  buildAtomicChatProfileEnv,
  buildCodexProfileEnv,
  buildGeminiProfileEnv,
  buildLaunchEnv,
  buildOllamaProfileEnv,
  buildOpenAIProfileEnv,
+  createProfileFile,
+  maskSecretForDisplay,
+  loadProfileFile,
+  PROFILE_FILE_NAME,
+  redactSecretValueForDisplay,
+  saveProfileFile,
+  sanitizeProviderConfigValue,
  selectAutoProfile,
  type ProfileFile,
 } from './providerProfile.ts'
@@ -359,6 +368,112 @@ test('gemini profiles require a key', () => {
  assert.equal(env, null)
 })

+test('saveProfileFile writes a profile that loadProfileFile can read back', () => {
+  const cwd = mkdtempSync(join(tmpdir(), 'openclaude-profile-file-'))
+
+  try {
+    const persisted = createProfileFile('openai', {
+      OPENAI_API_KEY: 'sk-test',
+      OPENAI_MODEL: 'gpt-4o',
+    })
+
+    const filePath = saveProfileFile(persisted, { cwd })
+
+    assert.equal(filePath, join(cwd, PROFILE_FILE_NAME))
+    assert.equal(
+      JSON.parse(readFileSync(filePath, 'utf8')).profile,
+      'openai',
+    )
+    assert.deepEqual(loadProfileFile({ cwd }), persisted)
+  } finally {
+    rmSync(cwd, { recursive: true, force: true })
+  }
+})
+
+test('buildStartupEnvFromProfile applies persisted gemini settings when no provider is explicitly selected', async () => {
+  const env = await buildStartupEnvFromProfile({
+    persisted: profile('gemini', {
+      GEMINI_API_KEY: 'gem-test',
+      GEMINI_MODEL: 'gemini-2.5-flash',
+    }),
+    processEnv: {},
+  })
+
+  assert.equal(env.CLAUDE_CODE_USE_GEMINI, '1')
+  assert.equal(env.CLAUDE_CODE_USE_OPENAI, undefined)
+  assert.equal(env.GEMINI_API_KEY, 'gem-test')
+  assert.equal(env.GEMINI_MODEL, 'gemini-2.5-flash')
+})
+
+test('buildStartupEnvFromProfile leaves explicit provider selections untouched', async () => {
+  const processEnv = {
+    CLAUDE_CODE_USE_GEMINI: '1',
+    GEMINI_API_KEY: 'gem-live',
+    GEMINI_MODEL: 'gemini-2.0-flash',
+  }
+
+  const env = await buildStartupEnvFromProfile({
+    persisted: profile('openai', {
+      OPENAI_API_KEY: 'sk-persisted',
+      OPENAI_MODEL: 'gpt-4o',
+    }),
+    processEnv,
+  })
+
+  assert.equal(env, processEnv)
+  assert.equal(env.CLAUDE_CODE_USE_GEMINI, '1')
+  assert.equal(env.OPENAI_API_KEY, undefined)
+})
+
+test('buildStartupEnvFromProfile treats explicit falsey provider flags as user intent', async () => {
+  const processEnv = {
+    CLAUDE_CODE_USE_OPENAI: '0',
+  }
+
+  const env = await buildStartupEnvFromProfile({
+    persisted: profile('gemini', {
+      GEMINI_API_KEY: 'gem-persisted',
+      GEMINI_MODEL: 'gemini-2.5-flash',
+    }),
+    processEnv,
+  })
+
+  assert.equal(env, processEnv)
+  assert.equal(env.CLAUDE_CODE_USE_OPENAI, '0')
+  assert.equal(env.GEMINI_API_KEY, undefined)
+})
+
+test('maskSecretForDisplay preserves only a short prefix and suffix', () => {
+  assert.equal(maskSecretForDisplay('sk-secret-12345678'), 'sk-...5678')
+  assert.equal(maskSecretForDisplay('AIzaSecret12345678'), 'AIza...5678')
+})
+
+test('redactSecretValueForDisplay masks poisoned display fields that equal configured secrets', () => {
+  const apiKey = 'sk-secret-12345678'
+
+  assert.equal(
+    redactSecretValueForDisplay(apiKey, { OPENAI_API_KEY: apiKey }),
+    'sk-...5678',
+  )
+  assert.equal(
+    redactSecretValueForDisplay('gpt-4o', { OPENAI_API_KEY: apiKey }),
+    'gpt-4o',
+  )
+})
+
+test('sanitizeProviderConfigValue drops secret-like poisoned values', () => {
+  const apiKey = 'sk-secret-12345678'
+
+  assert.equal(
+    sanitizeProviderConfigValue(apiKey, { OPENAI_API_KEY: apiKey }),
+    undefined,
+  )
+  assert.equal(
+    sanitizeProviderConfigValue('gpt-4o', { OPENAI_API_KEY: apiKey }),
+    'gpt-4o',
+  )
+})
+
 test('openai profiles ignore codex shell transport hints', () => {
  const env = buildOpenAIProfileEnv({
    goal: 'balanced',
@@ -377,7 +492,110 @@ test('openai profiles ignore codex shell transport hints', () => {
  })
 })

+test('openai profiles ignore poisoned shell model and base url values', () => {
+  const env = buildOpenAIProfileEnv({
+    goal: 'balanced',
+    apiKey: 'sk-live',
+    processEnv: {
+      OPENAI_BASE_URL: 'sk-live',
+      OPENAI_MODEL: 'sk-live',
+      OPENAI_API_KEY: 'sk-live',
+    },
+  })
+
+  assert.deepEqual(env, {
+    OPENAI_BASE_URL: 'https://api.openai.com/v1',
+    OPENAI_MODEL: 'gpt-4o',
+    OPENAI_API_KEY: 'sk-live',
+  })
+})
+
+test('startup env ignores poisoned persisted openai model and base url', async () => {
+  const env = await buildStartupEnvFromProfile({
+    persisted: profile('openai', {
+      OPENAI_API_KEY: 'sk-live',
+      OPENAI_MODEL: 'sk-live',
+      OPENAI_BASE_URL: 'sk-live',
+    }),
+    processEnv: {},
+  })
+
+  assert.equal(env.CLAUDE_CODE_USE_OPENAI, '1')
+  assert.equal(env.OPENAI_API_KEY, 'sk-live')
+  assert.equal(env.OPENAI_MODEL, 'gpt-4o')
+  assert.equal(env.OPENAI_BASE_URL, 'https://api.openai.com/v1')
+})
+
 test('auto profile falls back to openai when no viable ollama model exists', () => {
  assert.equal(selectAutoProfile(null), 'openai')
  assert.equal(selectAutoProfile('qwen2.5-coder:7b'), 'ollama')
 })
+
+// ── Atomic Chat profile tests ────────────────────────────────────────────────
+
+test('atomic-chat profiles never persist openai api keys', () => {
+  const env = buildAtomicChatProfileEnv('some-local-model', {
+    getAtomicChatChatBaseUrl: () => 'http://127.0.0.1:1337/v1',
+  })
+
+  assert.deepEqual(env, {
+    OPENAI_BASE_URL: 'http://127.0.0.1:1337/v1',
+    OPENAI_MODEL: 'some-local-model',
+  })
+  assert.equal('OPENAI_API_KEY' in env, false)
+})
+
+test('atomic-chat profiles respect custom base url', () => {
+  const env = buildAtomicChatProfileEnv('my-model', {
+    baseUrl: 'http://192.168.1.100:1337',
+    getAtomicChatChatBaseUrl: (baseUrl?: string) =>
+      baseUrl ? `${baseUrl}/v1` : 'http://127.0.0.1:1337/v1',
+  })
+
+  assert.equal(env.OPENAI_BASE_URL, 'http://192.168.1.100:1337/v1')
+  assert.equal(env.OPENAI_MODEL, 'my-model')
+})
+
+test('matching persisted atomic-chat env is reused for atomic-chat launch', async () => {
+  const env = await buildLaunchEnv({
+    profile: 'atomic-chat',
+    persisted: profile('atomic-chat', {
+      OPENAI_BASE_URL: 'http://127.0.0.1:1337/v1',
+      OPENAI_MODEL: 'llama-3.1-8b',
+    }),
+    goal: 'balanced',
+    processEnv: {},
+    getAtomicChatChatBaseUrl: () => 'http://127.0.0.1:1337/v1',
+    resolveAtomicChatDefaultModel: async () => 'other-model',
+  })
+
+  assert.equal(env.OPENAI_BASE_URL, 'http://127.0.0.1:1337/v1')
+  assert.equal(env.OPENAI_MODEL, 'llama-3.1-8b')
+  assert.equal(env.OPENAI_API_KEY, undefined)
+  assert.equal(env.CODEX_API_KEY, undefined)
+})
+
+test('atomic-chat launch ignores mismatched persisted openai env', async () => {
+  const env = await buildLaunchEnv({
+    profile: 'atomic-chat',
+    persisted: profile('openai', {
+      OPENAI_BASE_URL: 'https://api.openai.com/v1',
+      OPENAI_MODEL: 'gpt-4o',
+      OPENAI_API_KEY: 'sk-persisted',
+    }),
+    goal: 'balanced',
+    processEnv: {
+      OPENAI_API_KEY: 'sk-live',
+      CODEX_API_KEY: 'codex-live',
+      CHATGPT_ACCOUNT_ID: 'acct_live',
+    },
+    getAtomicChatChatBaseUrl: () => 'http://127.0.0.1:1337/v1',
+    resolveAtomicChatDefaultModel: async () => 'local-model',
+  })
+
+  assert.equal(env.OPENAI_BASE_URL, 'http://127.0.0.1:1337/v1')
+  assert.equal(env.OPENAI_MODEL, 'local-model')
+  assert.equal(env.OPENAI_API_KEY, undefined)
+  assert.equal(env.CODEX_API_KEY, undefined)
+  assert.equal(env.CHATGPT_ACCOUNT_ID, undefined)
+})
--- a/src/utils/providerProfile.ts
+++ b/src/utils/providerProfile.ts
@@ -1,3 +1,5 @@
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
 import {
  DEFAULT_CODEX_BASE_URL,
  DEFAULT_OPENAI_BASE_URL,
@@ -7,13 +9,42 @@ import {
 } from '../services/api/providerConfig.ts'
 import {
  getGoalDefaultOpenAIModel,
+  normalizeRecommendationGoal,
  type RecommendationGoal,
 } from './providerRecommendation.ts'
+import { getOllamaChatBaseUrl } from './providerDiscovery.ts'

-const DEFAULT_GEMINI_BASE_URL = 'https://generativelanguage.googleapis.com/v1beta/openai'
-const DEFAULT_GEMINI_MODEL = 'gemini-2.0-flash'
+export const PROFILE_FILE_NAME = '.openclaude-profile.json'
+export const DEFAULT_GEMINI_BASE_URL =
+  'https://generativelanguage.googleapis.com/v1beta/openai'
+export const DEFAULT_GEMINI_MODEL = 'gemini-2.0-flash'

-export type ProviderProfile = 'openai' | 'ollama' | 'codex' | 'gemini'
+const PROFILE_ENV_KEYS = [
+  'CLAUDE_CODE_USE_OPENAI',
+  'CLAUDE_CODE_USE_GEMINI',
+  'CLAUDE_CODE_USE_BEDROCK',
+  'CLAUDE_CODE_USE_VERTEX',
+  'CLAUDE_CODE_USE_FOUNDRY',
+  'OPENAI_BASE_URL',
+  'OPENAI_MODEL',
+  'OPENAI_API_KEY',
+  'CODEX_API_KEY',
+  'CHATGPT_ACCOUNT_ID',
+  'CODEX_ACCOUNT_ID',
+  'GEMINI_API_KEY',
+  'GEMINI_MODEL',
+  'GEMINI_BASE_URL',
+  'GOOGLE_API_KEY',
+] as const
+
+const SECRET_ENV_KEYS = [
+  'OPENAI_API_KEY',
+  'CODEX_API_KEY',
+  'GEMINI_API_KEY',
+  'GOOGLE_API_KEY',
+] as const
+
+export type ProviderProfile = 'openai' | 'ollama' | 'codex' | 'gemini' | 'atomic-chat'

 export type ProfileEnv = {
  OPENAI_BASE_URL?: string
@@ -33,6 +64,36 @@ export type ProfileFile = {
  createdAt: string
 }

+type SecretValueSource = Partial<
+  Pick<
+    NodeJS.ProcessEnv & ProfileEnv,
+    (typeof SECRET_ENV_KEYS)[number]
+  >
+>
+
+type ProfileFileLocation = {
+  cwd?: string
+  filePath?: string
+}
+
+function resolveProfileFilePath(options?: ProfileFileLocation): string {
+  if (options?.filePath) {
+    return options.filePath
+  }
+
+  return resolve(options?.cwd ?? process.cwd(), PROFILE_FILE_NAME)
+}
+
+export function isProviderProfile(value: unknown): value is ProviderProfile {
+  return (
+    value === 'openai' ||
+    value === 'ollama' ||
+    value === 'codex' ||
+    value === 'gemini' ||
+    value === 'atomic-chat'
+  )
+}
+
 export function sanitizeApiKey(
  key: string | null | undefined,
 ): string | undefined {
@@ -40,6 +101,95 @@ export function sanitizeApiKey(
  return key
 }

+function looksLikeSecretValue(value: string): boolean {
+  const trimmed = value.trim()
+  if (!trimmed) return false
+
+  if (trimmed.startsWith('sk-') || trimmed.startsWith('sk-ant-')) {
+    return true
+  }
+
+  if (trimmed.startsWith('AIza')) {
+    return true
+  }
+
+  return false
+}
+
+function collectSecretValues(
+  sources: Array<SecretValueSource | null | undefined>,
+): string[] {
+  const values = new Set<string>()
+
+  for (const source of sources) {
+    if (!source) continue
+
+    for (const key of SECRET_ENV_KEYS) {
+      const value = sanitizeApiKey(source[key])
+      if (value) {
+        values.add(value)
+      }
+    }
+  }
+
+  return [...values]
+}
+
+export function maskSecretForDisplay(
+  value: string | null | undefined,
+): string | undefined {
+  const sanitized = sanitizeApiKey(value)
+  if (!sanitized) return undefined
+
+  if (sanitized.length <= 8) {
+    return 'configured'
+  }
+
+  if (sanitized.startsWith('sk-')) {
+    return `${sanitized.slice(0, 3)}...${sanitized.slice(-4)}`
+  }
+
+  if (sanitized.startsWith('AIza')) {
+    return `${sanitized.slice(0, 4)}...${sanitized.slice(-4)}`
+  }
+
+  return `${sanitized.slice(0, 2)}...${sanitized.slice(-4)}`
+}
+
+export function redactSecretValueForDisplay(
+  value: string | null | undefined,
+  ...sources: Array<SecretValueSource | null | undefined>
+): string | undefined {
+  if (!value) return undefined
+
+  const trimmed = value.trim()
+  if (!trimmed) return trimmed
+
+  const secretValues = collectSecretValues(sources)
+  if (secretValues.includes(trimmed) || looksLikeSecretValue(trimmed)) {
+    return maskSecretForDisplay(trimmed) ?? 'configured'
+  }
+
+  return trimmed
+}
+
+export function sanitizeProviderConfigValue(
+  value: string | null | undefined,
+  ...sources: Array<SecretValueSource | null | undefined>
+): string | undefined {
+  if (!value) return undefined
+
+  const trimmed = value.trim()
+  if (!trimmed) return undefined
+
+  const secretValues = collectSecretValues(sources)
+  if (secretValues.includes(trimmed) || looksLikeSecretValue(trimmed)) {
+    return undefined
+  }
+
+  return trimmed
+}
+
 export function buildOllamaProfileEnv(
  model: string,
  options: {
@@ -53,6 +203,19 @@ export function buildOllamaProfileEnv(
  }
 }

+export function buildAtomicChatProfileEnv(
+  model: string,
+  options: {
+    baseUrl?: string | null
+    getAtomicChatChatBaseUrl: (baseUrl?: string) => string
+  },
+): ProfileEnv {
+  return {
+    OPENAI_BASE_URL: options.getAtomicChatChatBaseUrl(options.baseUrl ?? undefined),
+    OPENAI_MODEL: model,
+  }
+}
+
 export function buildGeminiProfileEnv(options: {
  model?: string | null
  baseUrl?: string | null
@@ -71,11 +234,23 @@ export function buildGeminiProfileEnv(options: {

  const env: ProfileEnv = {
    GEMINI_MODEL:
-      options.model || processEnv.GEMINI_MODEL || DEFAULT_GEMINI_MODEL,
+      sanitizeProviderConfigValue(options.model, { GEMINI_API_KEY: key }, processEnv) ||
+      sanitizeProviderConfigValue(
+        processEnv.GEMINI_MODEL,
+        { GEMINI_API_KEY: key },
+        processEnv,
+      ) ||
+      DEFAULT_GEMINI_MODEL,
    GEMINI_API_KEY: key,
  }

-  const baseUrl = options.baseUrl || processEnv.GEMINI_BASE_URL
+  const baseUrl =
+    sanitizeProviderConfigValue(options.baseUrl, { GEMINI_API_KEY: key }, processEnv) ||
+    sanitizeProviderConfigValue(
+      processEnv.GEMINI_BASE_URL,
+      { GEMINI_API_KEY: key },
+      processEnv,
+    )
  if (baseUrl) {
    env.GEMINI_BASE_URL = baseUrl
  }
@@ -97,21 +272,39 @@ export function buildOpenAIProfileEnv(options: {
  }

  const defaultModel = getGoalDefaultOpenAIModel(options.goal)
+  const shellOpenAIModel = sanitizeProviderConfigValue(
+    processEnv.OPENAI_MODEL,
+    { OPENAI_API_KEY: key },
+    processEnv,
+  )
+  const shellOpenAIBaseUrl = sanitizeProviderConfigValue(
+    processEnv.OPENAI_BASE_URL,
+    { OPENAI_API_KEY: key },
+    processEnv,
+  )
  const shellOpenAIRequest = resolveProviderRequest({
-    model: processEnv.OPENAI_MODEL,
-    baseUrl: processEnv.OPENAI_BASE_URL,
+    model: shellOpenAIModel,
+    baseUrl: shellOpenAIBaseUrl,
    fallbackModel: defaultModel,
  })
  const useShellOpenAIConfig = shellOpenAIRequest.transport === 'chat_completions'

  return {
    OPENAI_BASE_URL:
-      options.baseUrl ||
-      (useShellOpenAIConfig ? processEnv.OPENAI_BASE_URL : undefined) ||
+      sanitizeProviderConfigValue(
+        options.baseUrl,
+        { OPENAI_API_KEY: key },
+        processEnv,
+      ) ||
+      (useShellOpenAIConfig ? shellOpenAIBaseUrl : undefined) ||
      DEFAULT_OPENAI_BASE_URL,
    OPENAI_MODEL:
-      options.model ||
-      (useShellOpenAIConfig ? processEnv.OPENAI_MODEL : undefined) ||
+      sanitizeProviderConfigValue(
+        options.model,
+        { OPENAI_API_KEY: key },
+        processEnv,
+      ) ||
+      (useShellOpenAIConfig ? shellOpenAIModel : undefined) ||
      defaultModel,
    OPENAI_API_KEY: key,
  }
@@ -158,6 +351,62 @@ export function createProfileFile(
  }
 }

+export function loadProfileFile(options?: ProfileFileLocation): ProfileFile | null {
+  const filePath = resolveProfileFilePath(options)
+  if (!existsSync(filePath)) {
+    return null
+  }
+
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, 'utf8')) as Partial<ProfileFile>
+    if (!isProviderProfile(parsed.profile) || !parsed.env || typeof parsed.env !== 'object') {
+      return null
+    }
+
+    return {
+      profile: parsed.profile,
+      env: parsed.env,
+      createdAt:
+        typeof parsed.createdAt === 'string'
+          ? parsed.createdAt
+          : new Date().toISOString(),
+    }
+  } catch {
+    return null
+  }
+}
+
+export function saveProfileFile(
+  profileFile: ProfileFile,
+  options?: ProfileFileLocation,
+): string {
+  const filePath = resolveProfileFilePath(options)
+  writeFileSync(filePath, JSON.stringify(profileFile, null, 2), {
+    encoding: 'utf8',
+    mode: 0o600,
+  })
+  return filePath
+}
+
+export function deleteProfileFile(options?: ProfileFileLocation): string {
+  const filePath = resolveProfileFilePath(options)
+  rmSync(filePath, { force: true })
+  return filePath
+}
+
+export function hasExplicitProviderSelection(
+  processEnv: NodeJS.ProcessEnv = process.env,
+): boolean {
+  return (
+    processEnv.CLAUDE_CODE_USE_OPENAI !== undefined ||
+    processEnv.CLAUDE_CODE_USE_GITHUB !== undefined ||
+    processEnv.CLAUDE_CODE_USE_GEMINI !== undefined ||
+    processEnv.CLAUDE_CODE_USE_BEDROCK !== undefined ||
+    processEnv.CLAUDE_CODE_USE_VERTEX !== undefined ||
+    processEnv.CLAUDE_CODE_USE_FOUNDRY !== undefined
+  )
+}
+
 export function selectAutoProfile(
  recommendedOllamaModel: string | null,
 ): ProviderProfile {
@@ -171,12 +420,46 @@ export async function buildLaunchEnv(options: {
  processEnv?: NodeJS.ProcessEnv
  getOllamaChatBaseUrl?: (baseUrl?: string) => string
  resolveOllamaDefaultModel?: (goal: RecommendationGoal) => Promise<string>
+  getAtomicChatChatBaseUrl?: (baseUrl?: string) => string
+  resolveAtomicChatDefaultModel?: () => Promise<string | null>
 }): Promise<NodeJS.ProcessEnv> {
  const processEnv = options.processEnv ?? process.env
  const persistedEnv =
    options.persisted?.profile === options.profile
      ? options.persisted.env ?? {}
      : {}
+  const persistedOpenAIModel = sanitizeProviderConfigValue(
+    persistedEnv.OPENAI_MODEL,
+    persistedEnv,
+  )
+  const persistedOpenAIBaseUrl = sanitizeProviderConfigValue(
+    persistedEnv.OPENAI_BASE_URL,
+    persistedEnv,
+  )
+  const shellOpenAIModel = sanitizeProviderConfigValue(
+    processEnv.OPENAI_MODEL,
+    processEnv,
+  )
+  const shellOpenAIBaseUrl = sanitizeProviderConfigValue(
+    processEnv.OPENAI_BASE_URL,
+    processEnv,
+  )
+  const persistedGeminiModel = sanitizeProviderConfigValue(
+    persistedEnv.GEMINI_MODEL,
+    persistedEnv,
+  )
+  const persistedGeminiBaseUrl = sanitizeProviderConfigValue(
+    persistedEnv.GEMINI_BASE_URL,
+    persistedEnv,
+  )
+  const shellGeminiModel = sanitizeProviderConfigValue(
+    processEnv.GEMINI_MODEL,
+    processEnv,
+  )
+  const shellGeminiBaseUrl = sanitizeProviderConfigValue(
+    processEnv.GEMINI_BASE_URL,
+    processEnv,
+  )

  const shellGeminiKey = sanitizeApiKey(
    processEnv.GEMINI_API_KEY ?? processEnv.GOOGLE_API_KEY,
@@ -190,14 +473,15 @@ export async function buildLaunchEnv(options: {
    }

    delete env.CLAUDE_CODE_USE_OPENAI
+    delete env.CLAUDE_CODE_USE_GITHUB

    env.GEMINI_MODEL =
-      processEnv.GEMINI_MODEL ||
-      persistedEnv.GEMINI_MODEL ||
+      shellGeminiModel ||
+      persistedGeminiModel ||
      DEFAULT_GEMINI_MODEL
    env.GEMINI_BASE_URL =
-      processEnv.GEMINI_BASE_URL ||
-      persistedEnv.GEMINI_BASE_URL ||
+      shellGeminiBaseUrl ||
+      persistedGeminiBaseUrl ||
      DEFAULT_GEMINI_BASE_URL

    const geminiKey = shellGeminiKey || persistedGeminiKey
@@ -224,6 +508,7 @@ export async function buildLaunchEnv(options: {
  }

  delete env.CLAUDE_CODE_USE_GEMINI
+  delete env.CLAUDE_CODE_USE_GITHUB
  delete env.GEMINI_API_KEY
  delete env.GEMINI_MODEL
  delete env.GEMINI_BASE_URL
@@ -235,10 +520,30 @@ export async function buildLaunchEnv(options: {
    const resolveOllamaModel =
      options.resolveOllamaDefaultModel ?? (async () => 'llama3.1:8b')

-    env.OPENAI_BASE_URL = persistedEnv.OPENAI_BASE_URL || getOllamaBaseUrl()
+    env.OPENAI_BASE_URL = persistedOpenAIBaseUrl || getOllamaBaseUrl()
+    env.OPENAI_MODEL =
+      persistedOpenAIModel ||
+      (await resolveOllamaModel(options.goal))
+
+    delete env.OPENAI_API_KEY
+    delete env.CODEX_API_KEY
+    delete env.CHATGPT_ACCOUNT_ID
+    delete env.CODEX_ACCOUNT_ID
+
+    return env
+  }
+
+  if (options.profile === 'atomic-chat') {
+    const getAtomicChatBaseUrl =
+      options.getAtomicChatChatBaseUrl ?? (() => 'http://127.0.0.1:1337/v1')
+    const resolveModel =
+      options.resolveAtomicChatDefaultModel ?? (async () => null as string | null)
+
+    env.OPENAI_BASE_URL = persistedEnv.OPENAI_BASE_URL || getAtomicChatBaseUrl()
    env.OPENAI_MODEL =
      persistedEnv.OPENAI_MODEL ||
-      (await resolveOllamaModel(options.goal))
+      (await resolveModel()) ||
+      ''

    delete env.OPENAI_API_KEY
    delete env.CODEX_API_KEY
@@ -250,10 +555,10 @@ export async function buildLaunchEnv(options: {

  if (options.profile === 'codex') {
    env.OPENAI_BASE_URL =
-      persistedEnv.OPENAI_BASE_URL && isCodexBaseUrl(persistedEnv.OPENAI_BASE_URL)
-        ? persistedEnv.OPENAI_BASE_URL
+      persistedOpenAIBaseUrl && isCodexBaseUrl(persistedOpenAIBaseUrl)
+        ? persistedOpenAIBaseUrl
        : DEFAULT_CODEX_BASE_URL
-    env.OPENAI_MODEL = persistedEnv.OPENAI_MODEL || 'codexplan'
+    env.OPENAI_MODEL = persistedOpenAIModel || 'codexplan'
    delete env.OPENAI_API_KEY

    const codexKey =
@@ -284,27 +589,27 @@ export async function buildLaunchEnv(options: {

  const defaultOpenAIModel = getGoalDefaultOpenAIModel(options.goal)
  const shellOpenAIRequest = resolveProviderRequest({
-    model: processEnv.OPENAI_MODEL,
-    baseUrl: processEnv.OPENAI_BASE_URL,
+    model: shellOpenAIModel,
+    baseUrl: shellOpenAIBaseUrl,
    fallbackModel: defaultOpenAIModel,
  })
  const persistedOpenAIRequest = resolveProviderRequest({
-    model: persistedEnv.OPENAI_MODEL,
-    baseUrl: persistedEnv.OPENAI_BASE_URL,
+    model: persistedOpenAIModel,
+    baseUrl: persistedOpenAIBaseUrl,
    fallbackModel: defaultOpenAIModel,
  })
  const useShellOpenAIConfig = shellOpenAIRequest.transport === 'chat_completions'
  const usePersistedOpenAIConfig =
-    (!persistedEnv.OPENAI_MODEL && !persistedEnv.OPENAI_BASE_URL) ||
+    (!persistedOpenAIModel && !persistedOpenAIBaseUrl) ||
    persistedOpenAIRequest.transport === 'chat_completions'

  env.OPENAI_BASE_URL =
-    (useShellOpenAIConfig ? processEnv.OPENAI_BASE_URL : undefined) ||
-    (usePersistedOpenAIConfig ? persistedEnv.OPENAI_BASE_URL : undefined) ||
+    (useShellOpenAIConfig ? shellOpenAIBaseUrl : undefined) ||
+    (usePersistedOpenAIConfig ? persistedOpenAIBaseUrl : undefined) ||
    DEFAULT_OPENAI_BASE_URL
  env.OPENAI_MODEL =
-    (useShellOpenAIConfig ? processEnv.OPENAI_MODEL : undefined) ||
-    (usePersistedOpenAIConfig ? persistedEnv.OPENAI_MODEL : undefined) ||
+    (useShellOpenAIConfig ? shellOpenAIModel : undefined) ||
+    (usePersistedOpenAIConfig ? persistedOpenAIModel : undefined) ||
    defaultOpenAIModel
  env.OPENAI_API_KEY = processEnv.OPENAI_API_KEY || persistedEnv.OPENAI_API_KEY
  delete env.CODEX_API_KEY
@@ -312,3 +617,44 @@ export async function buildLaunchEnv(options: {
  delete env.CODEX_ACCOUNT_ID
  return env
 }
+
+export async function buildStartupEnvFromProfile(options?: {
+  persisted?: ProfileFile | null
+  goal?: RecommendationGoal
+  processEnv?: NodeJS.ProcessEnv
+  getOllamaChatBaseUrl?: (baseUrl?: string) => string
+  resolveOllamaDefaultModel?: (goal: RecommendationGoal) => Promise<string>
+}): Promise<NodeJS.ProcessEnv> {
+  const processEnv = options?.processEnv ?? process.env
+  if (hasExplicitProviderSelection(processEnv)) {
+    return processEnv
+  }
+
+  const persisted = options?.persisted ?? loadProfileFile()
+  if (!persisted) {
+    return processEnv
+  }
+
+  return buildLaunchEnv({
+    profile: persisted.profile,
+    persisted,
+    goal:
+      options?.goal ??
+      normalizeRecommendationGoal(processEnv.OPENCLAUDE_PROFILE_GOAL),
+    processEnv,
+    getOllamaChatBaseUrl:
+      options?.getOllamaChatBaseUrl ?? getOllamaChatBaseUrl,
+    resolveOllamaDefaultModel: options?.resolveOllamaDefaultModel,
+  })
+}
+
+export function applyProfileEnvToProcessEnv(
+  targetEnv: NodeJS.ProcessEnv,
+  nextEnv: NodeJS.ProcessEnv,
+): void {
+  for (const key of PROFILE_ENV_KEYS) {
+    delete targetEnv[key]
+  }
+
+  Object.assign(targetEnv, nextEnv)
+}
--- a/src/utils/status.tsx
+++ b/src/utils/status.tsx
--- a/src/utils/suggestions/commandSuggestions.ts
+++ b/src/utils/suggestions/commandSuggestions.ts
@@ -286,6 +286,25 @@ function createCommandSuggestionItem(
  }
 }

+/**
+ * Ensure suggestion IDs are unique for React keys and selection logic.
+ * If duplicates exist, append a stable numeric suffix to subsequent entries.
+ */
+function ensureUniqueSuggestionIds(items: SuggestionItem[]): SuggestionItem[] {
+  const counts = new Map<string, number>()
+  return items.map(item => {
+    const seen = counts.get(item.id) ?? 0
+    counts.set(item.id, seen + 1)
+    if (seen === 0) {
+      return item
+    }
+    return {
+      ...item,
+      id: `${item.id}#${seen + 1}`,
+    }
+  })
+}
+
 /**
 * Generate command suggestions based on input
 */
@@ -369,14 +388,14 @@ export function generateCommandSuggestions(

    // Combine with built-in commands prioritized after recently used,
    // so they remain visible even when many skills are installed
-    return [
+    return ensureUniqueSuggestionIds([
      ...recentlyUsed,
      ...builtinCommands,
      ...userCommands,
      ...projectCommands,
      ...policyCommands,
      ...otherCommands,
-    ].map(cmd => createCommandSuggestionItem(cmd))
+    ].map(cmd => createCommandSuggestionItem(cmd)))
  }

  // The Fuse index filters isHidden at build time and is keyed on the
@@ -491,10 +510,13 @@ export function generateCommandSuggestions(
  if (hiddenExact) {
    const hiddenId = getCommandId(hiddenExact)
    if (!fuseSuggestions.some(s => s.id === hiddenId)) {
-      return [createCommandSuggestionItem(hiddenExact), ...fuseSuggestions]
+      return ensureUniqueSuggestionIds([
+        createCommandSuggestionItem(hiddenExact),
+        ...fuseSuggestions,
+      ])
    }
  }
-  return fuseSuggestions
+  return ensureUniqueSuggestionIds(fuseSuggestions)
 }

 /**
--- a/src/utils/swarm/spawnUtils.ts
+++ b/src/utils/swarm/spawnUtils.ts
@@ -99,6 +99,18 @@ const TEAMMATE_ENV_VARS = [
  'CLAUDE_CODE_USE_BEDROCK',
  'CLAUDE_CODE_USE_VERTEX',
  'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GITHUB',
+  'CLAUDE_CODE_USE_GEMINI',
+  'CLAUDE_CODE_USE_OPENAI',
+  'GITHUB_TOKEN',
+  'GH_TOKEN',
+  'OPENAI_API_KEY',
+  'OPENAI_BASE_URL',
+  'OPENAI_MODEL',
+  'GEMINI_API_KEY',
+  'GEMINI_BASE_URL',
+  'GEMINI_MODEL',
+  'GOOGLE_API_KEY',
  // Custom API endpoint
  'ANTHROPIC_BASE_URL',
  // Config directory override