Merge origin/main into provider-setup-wizard

src/utils/auth.ts

@@ -117,7 +117,8 @@ export function isAnthropicAuthEnabled(): boolean {
     isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX) ||
     isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY) ||
     isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI) ||
-    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI)
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
 
   // Check if user has configured an external API key source
   // This allows externally-provided API keys to work (without requiring proxy configuration)
@@ -1731,14 +1732,15 @@ export function getSubscriptionName(): string {
   }
 }
 
-/** Check if using third-party services (Bedrock or Vertex or Foundry or OpenAI-compatible or Gemini) */
+/** Check if using third-party services (Bedrock or Vertex or Foundry or OpenAI-compatible or Gemini or GitHub Models) */
 export function isUsing3PServices(): boolean {
   return !!(
     isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK) ||
     isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX) ||
     isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY) ||
     isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI) ||
-    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI)
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI) ||
+    isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
   )
 }
 

src/utils/autoUpdater.ts

@@ -9,6 +9,7 @@ import {
   logEvent,
 } from 'src/services/analytics/index.js'
 import { type ReleaseChannel, saveGlobalConfig } from './config.js'
+import { getAPIProvider } from './model/providers.js'
 import { logForDebugging } from './debug.js'
 import { env } from './env.js'
 import { getClaudeConfigHomeDir } from './envUtils.js'
@@ -72,6 +73,12 @@ export async function assertMinVersion(): Promise<void> {
     return
   }
 
+  // Skip version check for third-party providers — the min version
+  // kill-switch is Anthropic-specific and should not block 3P users
+  if (getAPIProvider() !== 'firstParty') {
+    return
+  }
+
   try {
     const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT<{
       minVersion: string

src/utils/context.ts

@@ -77,7 +77,9 @@ export function getContextWindowForModel(
     process.env.CLAUDE_CODE_USE_OPENAI === '1' ||
     process.env.CLAUDE_CODE_USE_OPENAI === 'true' ||
     process.env.CLAUDE_CODE_USE_GEMINI === '1' ||
-    process.env.CLAUDE_CODE_USE_GEMINI === 'true'
+    process.env.CLAUDE_CODE_USE_GEMINI === 'true' ||
+    process.env.CLAUDE_CODE_USE_GITHUB === '1' ||
+    process.env.CLAUDE_CODE_USE_GITHUB === 'true'
   ) {
     const openaiWindow = getOpenAIContextWindow(model)
     if (openaiWindow !== undefined) {
@@ -181,7 +183,9 @@ export function getModelMaxOutputTokens(model: string): {
     process.env.CLAUDE_CODE_USE_OPENAI === '1' ||
     process.env.CLAUDE_CODE_USE_OPENAI === 'true' ||
     process.env.CLAUDE_CODE_USE_GEMINI === '1' ||
-    process.env.CLAUDE_CODE_USE_GEMINI === 'true'
+    process.env.CLAUDE_CODE_USE_GEMINI === 'true' ||
+    process.env.CLAUDE_CODE_USE_GITHUB === '1' ||
+    process.env.CLAUDE_CODE_USE_GITHUB === 'true'
   ) {
     const openaiMax = getOpenAIMaxOutputTokens(model)
     if (openaiMax !== undefined) {

src/utils/githubModelsCredentials.hydrate.test.ts

@@ -0,0 +1,66 @@
+/**
+ * Hydrate tests live in a separate file with no static import of
+ * githubModelsCredentials so Bun's mock.module can replace secureStorage
+ * before that module is first loaded.
+ */
+import { afterEach, describe, expect, mock, test } from 'bun:test'
+
+describe('hydrateGithubModelsTokenFromSecureStorage', () => {
+  const orig = {
+    CLAUDE_CODE_USE_GITHUB: process.env.CLAUDE_CODE_USE_GITHUB,
+    GITHUB_TOKEN: process.env.GITHUB_TOKEN,
+    GH_TOKEN: process.env.GH_TOKEN,
+    CLAUDE_CODE_SIMPLE: process.env.CLAUDE_CODE_SIMPLE,
+  }
+
+  afterEach(() => {
+    mock.restore()
+    for (const [k, v] of Object.entries(orig)) {
+      if (v === undefined) {
+        delete process.env[k as keyof typeof orig]
+      } else {
+        process.env[k as keyof typeof orig] = v
+      }
+    }
+  })
+
+  test('sets GITHUB_TOKEN from secure storage when USE_GITHUB and env token empty', async () => {
+    process.env.CLAUDE_CODE_USE_GITHUB = '1'
+    delete process.env.GITHUB_TOKEN
+    delete process.env.GH_TOKEN
+    delete process.env.CLAUDE_CODE_SIMPLE
+
+    mock.module('./secureStorage/index.js', () => ({
+      getSecureStorage: () => ({
+        read: () => ({
+          githubModels: { accessToken: 'stored-secret' },
+        }),
+      }),
+    }))
+
+    const { hydrateGithubModelsTokenFromSecureStorage } = await import(
+      './githubModelsCredentials.js'
+    )
+    hydrateGithubModelsTokenFromSecureStorage()
+    expect(process.env.GITHUB_TOKEN).toBe('stored-secret')
+  })
+
+  test('does not override existing GITHUB_TOKEN', async () => {
+    process.env.CLAUDE_CODE_USE_GITHUB = '1'
+    process.env.GITHUB_TOKEN = 'already'
+
+    mock.module('./secureStorage/index.js', () => ({
+      getSecureStorage: () => ({
+        read: () => ({
+          githubModels: { accessToken: 'stored-secret' },
+        }),
+      }),
+    }))
+
+    const { hydrateGithubModelsTokenFromSecureStorage } = await import(
+      './githubModelsCredentials.js'
+    )
+    hydrateGithubModelsTokenFromSecureStorage()
+    expect(process.env.GITHUB_TOKEN).toBe('already')
+  })
+})

src/utils/githubModelsCredentials.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from 'bun:test'
+
+import {
+  clearGithubModelsToken,
+  readGithubModelsToken,
+  saveGithubModelsToken,
+} from './githubModelsCredentials.js'
+
+describe('readGithubModelsToken', () => {
+  test('returns undefined in bare mode', () => {
+    const prev = process.env.CLAUDE_CODE_SIMPLE
+    process.env.CLAUDE_CODE_SIMPLE = '1'
+    expect(readGithubModelsToken()).toBeUndefined()
+    if (prev === undefined) {
+      delete process.env.CLAUDE_CODE_SIMPLE
+    } else {
+      process.env.CLAUDE_CODE_SIMPLE = prev
+    }
+  })
+})
+
+describe('saveGithubModelsToken / clearGithubModelsToken', () => {
+  test('save returns failure in bare mode', () => {
+    const prev = process.env.CLAUDE_CODE_SIMPLE
+    process.env.CLAUDE_CODE_SIMPLE = '1'
+    const r = saveGithubModelsToken('abc')
+    expect(r.success).toBe(false)
+    expect(r.warning).toContain('Bare mode')
+    if (prev === undefined) {
+      delete process.env.CLAUDE_CODE_SIMPLE
+    } else {
+      process.env.CLAUDE_CODE_SIMPLE = prev
+    }
+  })
+
+  test('clear succeeds in bare mode', () => {
+    const prev = process.env.CLAUDE_CODE_SIMPLE
+    process.env.CLAUDE_CODE_SIMPLE = '1'
+    expect(clearGithubModelsToken().success).toBe(true)
+    if (prev === undefined) {
+      delete process.env.CLAUDE_CODE_SIMPLE
+    } else {
+      process.env.CLAUDE_CODE_SIMPLE = prev
+    }
+  })
+})
+

src/utils/githubModelsCredentials.ts

@@ -0,0 +1,73 @@
+import { isBareMode, isEnvTruthy } from './envUtils.js'
+import { getSecureStorage } from './secureStorage/index.js'
+
+/** JSON key in the shared OpenClaude secure storage blob. */
+export const GITHUB_MODELS_STORAGE_KEY = 'githubModels' as const
+
+export type GithubModelsCredentialBlob = {
+  accessToken: string
+}
+
+export function readGithubModelsToken(): string | undefined {
+  if (isBareMode()) return undefined
+  try {
+    const data = getSecureStorage().read() as
+      | ({ githubModels?: GithubModelsCredentialBlob } & Record<string, unknown>)
+      | null
+    const t = data?.githubModels?.accessToken?.trim()
+    return t || undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * If GitHub Models mode is on and no token is in the environment, copy the
+ * stored token into process.env so the OpenAI shim and validation see it.
+ */
+export function hydrateGithubModelsTokenFromSecureStorage(): void {
+  if (!isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)) {
+    return
+  }
+  if (process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()) {
+    return
+  }
+  if (isBareMode()) {
+    return
+  }
+  const t = readGithubModelsToken()
+  if (t) {
+    process.env.GITHUB_TOKEN = t
+  }
+}
+
+export function saveGithubModelsToken(token: string): {
+  success: boolean
+  warning?: string
+} {
+  if (isBareMode()) {
+    return { success: false, warning: 'Bare mode: secure storage is disabled.' }
+  }
+  const trimmed = token.trim()
+  if (!trimmed) {
+    return { success: false, warning: 'Token is empty.' }
+  }
+  const secureStorage = getSecureStorage()
+  const prev = secureStorage.read() || {}
+  const merged = {
+    ...(prev as Record<string, unknown>),
+    [GITHUB_MODELS_STORAGE_KEY]: { accessToken: trimmed },
+  }
+  return secureStorage.update(merged as typeof prev)
+}
+
+export function clearGithubModelsToken(): { success: boolean; warning?: string } {
+  if (isBareMode()) {
+    return { success: true }
+  }
+  const secureStorage = getSecureStorage()
+  const prev = secureStorage.read() || {}
+  const next = { ...(prev as Record<string, unknown>) }
+  delete next[GITHUB_MODELS_STORAGE_KEY]
+  return secureStorage.update(next as typeof prev)
+}

src/utils/gracefulShutdown.ts

@@ -56,7 +56,7 @@ import { profileReport } from './startupProfiler.js'
  * 3. Failing to disable leaves the terminal in a broken state
  */
 /* eslint-disable custom-rules/no-sync-fs -- must be sync to flush before process.exit */
-function cleanupTerminalModes(): void {
+function cleanupTerminalModes(skipUnmount: boolean = false): void {
   if (!process.stdout.isTTY) {
     return
   }
@@ -84,7 +84,7 @@ function cleanupTerminalModes(): void {
     // Calling unmount() now does the final render on the alt buffer,
     // unsubscribes from signal-exit, and writes 1049l exactly once.
     const inst = instances.get(process.stdout)
-    if (inst?.isAltScreenActive) {
+    if (!skipUnmount && inst?.isAltScreenActive) {
       try {
         inst.unmount()
       } catch {
@@ -92,6 +92,11 @@ function cleanupTerminalModes(): void {
         // so printResumeHint still hits the main buffer.
         writeSync(1, EXIT_ALT_SCREEN)
       }
+    } else if (skipUnmount && inst?.isAltScreenActive) {
+      // We already unmounted asynchronously in gracefulShutdown, but if we 
+      // fallback to manual alt-screen exit here just in case Ink didn't write it or is dead.
+      // Actually, AlternateScreen unmount writes EXIT_ALT_SCREEN, so if we awaited unmount,
+      // we shouldn't emit it again. So we just do nothing here.
     }
     // Catches events that arrived during the unmount tree-walk.
     // detachForShutdown() below also drains.
@@ -411,12 +416,17 @@ export async function gracefulShutdown(
   )
   const sessionEndTimeoutMs = getSessionEndHookTimeoutMs()
 
+  // Await one tick so React can flush pending updates from commands (e.g. hiding
+  // the autocomplete menu on /exit) before we detach Ink. This lets log-update
+  // erase floating UI elements from the terminal so they don't linger after exit.
+  await new Promise(r => setTimeout(r, 20))
+
   // Failsafe: guarantee process exits even if cleanup hangs (e.g., MCP connections).
   // Runs cleanupTerminalModes first so a hung cleanup doesn't leave the terminal dirty.
   // Budget = max(5s, hook budget + 3.5s headroom for cleanup + analytics flush).
   failsafeTimer = setTimeout(
     code => {
-      cleanupTerminalModes()
+      cleanupTerminalModes(true)
       printResumeHint()
       forceExit(code)
     },
@@ -433,7 +443,7 @@ export async function gracefulShutdown(
   // cleanup (e.g., SIGKILL during macOS reboot). Without this, the resume
   // hint would only appear after cleanup functions, hooks, and analytics
   // flush — which can take several seconds.
-  cleanupTerminalModes()
+  cleanupTerminalModes(true)
   printResumeHint()
 
   // Flush session data first — this is the most critical cleanup. If the

src/utils/managedEnvConstants.ts

@@ -18,6 +18,7 @@ const PROVIDER_MANAGED_ENV_VARS = new Set([
   'CLAUDE_CODE_USE_BEDROCK',
   'CLAUDE_CODE_USE_VERTEX',
   'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GITHUB',
   // Endpoint config (base URLs, project/resource identifiers)
   'ANTHROPIC_BASE_URL',
   'ANTHROPIC_BEDROCK_BASE_URL',
@@ -147,6 +148,7 @@ export const SAFE_ENV_VARS = new Set([
   'CLAUDE_CODE_SUBAGENT_MODEL',
   'CLAUDE_CODE_USE_BEDROCK',
   'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GITHUB',
   'CLAUDE_CODE_USE_VERTEX',
   'DISABLE_AUTOUPDATER',
   'DISABLE_BUG_COMMAND',

src/utils/model/providers.test.ts

@@ -7,6 +7,7 @@ import {
 
 const originalEnv = {
   CLAUDE_CODE_USE_GEMINI: process.env.CLAUDE_CODE_USE_GEMINI,
+  CLAUDE_CODE_USE_GITHUB: process.env.CLAUDE_CODE_USE_GITHUB,
   CLAUDE_CODE_USE_OPENAI: process.env.CLAUDE_CODE_USE_OPENAI,
   CLAUDE_CODE_USE_BEDROCK: process.env.CLAUDE_CODE_USE_BEDROCK,
   CLAUDE_CODE_USE_VERTEX: process.env.CLAUDE_CODE_USE_VERTEX,
@@ -15,6 +16,7 @@ const originalEnv = {
 
 afterEach(() => {
   process.env.CLAUDE_CODE_USE_GEMINI = originalEnv.CLAUDE_CODE_USE_GEMINI
+  process.env.CLAUDE_CODE_USE_GITHUB = originalEnv.CLAUDE_CODE_USE_GITHUB
   process.env.CLAUDE_CODE_USE_OPENAI = originalEnv.CLAUDE_CODE_USE_OPENAI
   process.env.CLAUDE_CODE_USE_BEDROCK = originalEnv.CLAUDE_CODE_USE_BEDROCK
   process.env.CLAUDE_CODE_USE_VERTEX = originalEnv.CLAUDE_CODE_USE_VERTEX
@@ -23,6 +25,7 @@ afterEach(() => {
 
 function clearProviderEnv(): void {
   delete process.env.CLAUDE_CODE_USE_GEMINI
+  delete process.env.CLAUDE_CODE_USE_GITHUB
   delete process.env.CLAUDE_CODE_USE_OPENAI
   delete process.env.CLAUDE_CODE_USE_BEDROCK
   delete process.env.CLAUDE_CODE_USE_VERTEX
@@ -38,6 +41,7 @@ test('first-party provider keeps Anthropic account setup flow enabled', () => {
 
 test.each([
   ['CLAUDE_CODE_USE_OPENAI', 'openai'],
+  ['CLAUDE_CODE_USE_GITHUB', 'github'],
   ['CLAUDE_CODE_USE_GEMINI', 'gemini'],
   ['CLAUDE_CODE_USE_BEDROCK', 'bedrock'],
   ['CLAUDE_CODE_USE_VERTEX', 'vertex'],
@@ -52,3 +56,11 @@ test.each([
     expect(usesAnthropicAccountFlow()).toBe(false)
   },
 )
+
+test('GEMINI takes precedence over GitHub when both are set', () => {
+  clearProviderEnv()
+  process.env.CLAUDE_CODE_USE_GEMINI = '1'
+  process.env.CLAUDE_CODE_USE_GITHUB = '1'
+
+  expect(getAPIProvider()).toBe('gemini')
+})

src/utils/model/providers.ts

@@ -1,20 +1,29 @@
 import type { AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS } from '../../services/analytics/index.js'
 import { isEnvTruthy } from '../envUtils.js'
 
-export type APIProvider = 'firstParty' | 'bedrock' | 'vertex' | 'foundry' | 'openai' | 'gemini'
+export type APIProvider =
+  | 'firstParty'
+  | 'bedrock'
+  | 'vertex'
+  | 'foundry'
+  | 'openai'
+  | 'gemini'
+  | 'github'
 
 export function getAPIProvider(): APIProvider {
   return isEnvTruthy(process.env.CLAUDE_CODE_USE_GEMINI)
     ? 'gemini'
-    : isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI)
-      ? 'openai'
-      : isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK)
-        ? 'bedrock'
-        : isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX)
-          ? 'vertex'
-          : isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY)
-            ? 'foundry'
-            : 'firstParty'
+    : isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
+      ? 'github'
+      : isEnvTruthy(process.env.CLAUDE_CODE_USE_OPENAI)
+        ? 'openai'
+        : isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK)
+          ? 'bedrock'
+          : isEnvTruthy(process.env.CLAUDE_CODE_USE_VERTEX)
+            ? 'vertex'
+            : isEnvTruthy(process.env.CLAUDE_CODE_USE_FOUNDRY)
+              ? 'foundry'
+              : 'firstParty'
 }
 
 export function usesAnthropicAccountFlow(): boolean {

src/utils/providerDiscovery.ts

@@ -1,6 +1,7 @@
 import type { OllamaModelDescriptor } from './providerRecommendation.ts'
 
 export const DEFAULT_OLLAMA_BASE_URL = 'http://localhost:11434'
+export const DEFAULT_ATOMIC_CHAT_BASE_URL = 'http://127.0.0.1:1337'
 
 function withTimeoutSignal(timeoutMs: number): {
   signal: AbortSignal
@@ -35,6 +36,23 @@ export function getOllamaChatBaseUrl(baseUrl?: string): string {
   return `${getOllamaApiBaseUrl(baseUrl)}/v1`
 }
 
+export function getAtomicChatApiBaseUrl(baseUrl?: string): string {
+  const parsed = new URL(
+    baseUrl || process.env.ATOMIC_CHAT_BASE_URL || DEFAULT_ATOMIC_CHAT_BASE_URL,
+  )
+  const pathname = trimTrailingSlash(parsed.pathname)
+  parsed.pathname = pathname.endsWith('/v1')
+    ? pathname.slice(0, -3) || '/'
+    : pathname || '/'
+  parsed.search = ''
+  parsed.hash = ''
+  return trimTrailingSlash(parsed.toString())
+}
+
+export function getAtomicChatChatBaseUrl(baseUrl?: string): string {
+  return `${getAtomicChatApiBaseUrl(baseUrl)}/v1`
+}
+
 export async function hasLocalOllama(baseUrl?: string): Promise<boolean> {
   const { signal, clear } = withTimeoutSignal(1200)
   try {
@@ -93,6 +111,48 @@ export async function listOllamaModels(
   }
 }
 
+export async function hasLocalAtomicChat(baseUrl?: string): Promise<boolean> {
+  const { signal, clear } = withTimeoutSignal(1200)
+  try {
+    const response = await fetch(`${getAtomicChatChatBaseUrl(baseUrl)}/models`, {
+      method: 'GET',
+      signal,
+    })
+    return response.ok
+  } catch {
+    return false
+  } finally {
+    clear()
+  }
+}
+
+export async function listAtomicChatModels(
+  baseUrl?: string,
+): Promise<string[]> {
+  const { signal, clear } = withTimeoutSignal(5000)
+  try {
+    const response = await fetch(`${getAtomicChatChatBaseUrl(baseUrl)}/models`, {
+      method: 'GET',
+      signal,
+    })
+    if (!response.ok) {
+      return []
+    }
+
+    const data = (await response.json()) as {
+      data?: Array<{ id?: string }>
+    }
+
+    return (data.data ?? [])
+      .filter(model => Boolean(model.id))
+      .map(model => model.id!)
+  } catch {
+    return []
+  } finally {
+    clear()
+  }
+}
+
 export async function benchmarkOllamaModel(
   modelName: string,
   baseUrl?: string,

src/utils/providerProfile.test.ts

@@ -6,6 +6,7 @@ import test from 'node:test'
 
 import {
   buildStartupEnvFromProfile,
+  buildAtomicChatProfileEnv,
   buildCodexProfileEnv,
   buildGeminiProfileEnv,
   buildLaunchEnv,
@@ -529,3 +530,72 @@ test('auto profile falls back to openai when no viable ollama model exists', ()
   assert.equal(selectAutoProfile(null), 'openai')
   assert.equal(selectAutoProfile('qwen2.5-coder:7b'), 'ollama')
 })
+
+// ── Atomic Chat profile tests ────────────────────────────────────────────────
+
+test('atomic-chat profiles never persist openai api keys', () => {
+  const env = buildAtomicChatProfileEnv('some-local-model', {
+    getAtomicChatChatBaseUrl: () => 'http://127.0.0.1:1337/v1',
+  })
+
+  assert.deepEqual(env, {
+    OPENAI_BASE_URL: 'http://127.0.0.1:1337/v1',
+    OPENAI_MODEL: 'some-local-model',
+  })
+  assert.equal('OPENAI_API_KEY' in env, false)
+})
+
+test('atomic-chat profiles respect custom base url', () => {
+  const env = buildAtomicChatProfileEnv('my-model', {
+    baseUrl: 'http://192.168.1.100:1337',
+    getAtomicChatChatBaseUrl: (baseUrl?: string) =>
+      baseUrl ? `${baseUrl}/v1` : 'http://127.0.0.1:1337/v1',
+  })
+
+  assert.equal(env.OPENAI_BASE_URL, 'http://192.168.1.100:1337/v1')
+  assert.equal(env.OPENAI_MODEL, 'my-model')
+})
+
+test('matching persisted atomic-chat env is reused for atomic-chat launch', async () => {
+  const env = await buildLaunchEnv({
+    profile: 'atomic-chat',
+    persisted: profile('atomic-chat', {
+      OPENAI_BASE_URL: 'http://127.0.0.1:1337/v1',
+      OPENAI_MODEL: 'llama-3.1-8b',
+    }),
+    goal: 'balanced',
+    processEnv: {},
+    getAtomicChatChatBaseUrl: () => 'http://127.0.0.1:1337/v1',
+    resolveAtomicChatDefaultModel: async () => 'other-model',
+  })
+
+  assert.equal(env.OPENAI_BASE_URL, 'http://127.0.0.1:1337/v1')
+  assert.equal(env.OPENAI_MODEL, 'llama-3.1-8b')
+  assert.equal(env.OPENAI_API_KEY, undefined)
+  assert.equal(env.CODEX_API_KEY, undefined)
+})
+
+test('atomic-chat launch ignores mismatched persisted openai env', async () => {
+  const env = await buildLaunchEnv({
+    profile: 'atomic-chat',
+    persisted: profile('openai', {
+      OPENAI_BASE_URL: 'https://api.openai.com/v1',
+      OPENAI_MODEL: 'gpt-4o',
+      OPENAI_API_KEY: 'sk-persisted',
+    }),
+    goal: 'balanced',
+    processEnv: {
+      OPENAI_API_KEY: 'sk-live',
+      CODEX_API_KEY: 'codex-live',
+      CHATGPT_ACCOUNT_ID: 'acct_live',
+    },
+    getAtomicChatChatBaseUrl: () => 'http://127.0.0.1:1337/v1',
+    resolveAtomicChatDefaultModel: async () => 'local-model',
+  })
+
+  assert.equal(env.OPENAI_BASE_URL, 'http://127.0.0.1:1337/v1')
+  assert.equal(env.OPENAI_MODEL, 'local-model')
+  assert.equal(env.OPENAI_API_KEY, undefined)
+  assert.equal(env.CODEX_API_KEY, undefined)
+  assert.equal(env.CHATGPT_ACCOUNT_ID, undefined)
+})

src/utils/providerProfile.ts

@@ -44,7 +44,7 @@ const SECRET_ENV_KEYS = [
   'GOOGLE_API_KEY',
 ] as const
 
-export type ProviderProfile = 'openai' | 'ollama' | 'codex' | 'gemini'
+export type ProviderProfile = 'openai' | 'ollama' | 'codex' | 'gemini' | 'atomic-chat'
 
 export type ProfileEnv = {
   OPENAI_BASE_URL?: string
@@ -89,7 +89,8 @@ export function isProviderProfile(value: unknown): value is ProviderProfile {
     value === 'openai' ||
     value === 'ollama' ||
     value === 'codex' ||
-    value === 'gemini'
+    value === 'gemini' ||
+    value === 'atomic-chat'
   )
 }
 
@@ -202,6 +203,19 @@ export function buildOllamaProfileEnv(
   }
 }
 
+export function buildAtomicChatProfileEnv(
+  model: string,
+  options: {
+    baseUrl?: string | null
+    getAtomicChatChatBaseUrl: (baseUrl?: string) => string
+  },
+): ProfileEnv {
+  return {
+    OPENAI_BASE_URL: options.getAtomicChatChatBaseUrl(options.baseUrl ?? undefined),
+    OPENAI_MODEL: model,
+  }
+}
+
 export function buildGeminiProfileEnv(options: {
   model?: string | null
   baseUrl?: string | null
@@ -385,6 +399,7 @@ export function hasExplicitProviderSelection(
 ): boolean {
   return (
     processEnv.CLAUDE_CODE_USE_OPENAI !== undefined ||
+    processEnv.CLAUDE_CODE_USE_GITHUB !== undefined ||
     processEnv.CLAUDE_CODE_USE_GEMINI !== undefined ||
     processEnv.CLAUDE_CODE_USE_BEDROCK !== undefined ||
     processEnv.CLAUDE_CODE_USE_VERTEX !== undefined ||
@@ -405,6 +420,8 @@ export async function buildLaunchEnv(options: {
   processEnv?: NodeJS.ProcessEnv
   getOllamaChatBaseUrl?: (baseUrl?: string) => string
   resolveOllamaDefaultModel?: (goal: RecommendationGoal) => Promise<string>
+  getAtomicChatChatBaseUrl?: (baseUrl?: string) => string
+  resolveAtomicChatDefaultModel?: () => Promise<string | null>
 }): Promise<NodeJS.ProcessEnv> {
   const processEnv = options.processEnv ?? process.env
   const persistedEnv =
@@ -456,6 +473,7 @@ export async function buildLaunchEnv(options: {
     }
 
     delete env.CLAUDE_CODE_USE_OPENAI
+    delete env.CLAUDE_CODE_USE_GITHUB
 
     env.GEMINI_MODEL =
       shellGeminiModel ||
@@ -490,6 +508,7 @@ export async function buildLaunchEnv(options: {
   }
 
   delete env.CLAUDE_CODE_USE_GEMINI
+  delete env.CLAUDE_CODE_USE_GITHUB
   delete env.GEMINI_API_KEY
   delete env.GEMINI_MODEL
   delete env.GEMINI_BASE_URL
@@ -514,6 +533,26 @@ export async function buildLaunchEnv(options: {
     return env
   }
 
+  if (options.profile === 'atomic-chat') {
+    const getAtomicChatBaseUrl =
+      options.getAtomicChatChatBaseUrl ?? (() => 'http://127.0.0.1:1337/v1')
+    const resolveModel =
+      options.resolveAtomicChatDefaultModel ?? (async () => null as string | null)
+
+    env.OPENAI_BASE_URL = persistedEnv.OPENAI_BASE_URL || getAtomicChatBaseUrl()
+    env.OPENAI_MODEL =
+      persistedEnv.OPENAI_MODEL ||
+      (await resolveModel()) ||
+      ''
+
+    delete env.OPENAI_API_KEY
+    delete env.CODEX_API_KEY
+    delete env.CHATGPT_ACCOUNT_ID
+    delete env.CODEX_ACCOUNT_ID
+
+    return env
+  }
+
   if (options.profile === 'codex') {
     env.OPENAI_BASE_URL =
       persistedOpenAIBaseUrl && isCodexBaseUrl(persistedOpenAIBaseUrl)

src/utils/swarm/spawnUtils.ts

@@ -99,6 +99,18 @@ const TEAMMATE_ENV_VARS = [
   'CLAUDE_CODE_USE_BEDROCK',
   'CLAUDE_CODE_USE_VERTEX',
   'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GITHUB',
+  'CLAUDE_CODE_USE_GEMINI',
+  'CLAUDE_CODE_USE_OPENAI',
+  'GITHUB_TOKEN',
+  'GH_TOKEN',
+  'OPENAI_API_KEY',
+  'OPENAI_BASE_URL',
+  'OPENAI_MODEL',
+  'GEMINI_API_KEY',
+  'GEMINI_BASE_URL',
+  'GEMINI_MODEL',
+  'GOOGLE_API_KEY',
   // Custom API endpoint
   'ANTHROPIC_BASE_URL',
   // Config directory override