diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2adda6b2..cf1cc90c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,12 @@ jobs:
       - name: Install dependencies
         run: npm ci || npm install
 
+      # The same CLI version the Dockerfile pins: test/llm-bridge-contract.test.js drives the
+      # real binary through the provider bridge against a fake OpenAI endpoint (no key, no
+      # network) and self-skips only when the binary is missing — this keeps it from skipping.
+      - name: Install Claude Code CLI (pinned)
+        run: npm install -g @anthropic-ai/claude-code@2.1.281
+
       # APP_DIR / CCS_DESKTOP repoint the data directory and turn the auth wall
       # off. Nothing sets them on a runner, but the suites are written to be run
       # without them and this keeps CI identical to the documented local command.
@@ -38,6 +44,7 @@ jobs:
       - name: Syntax check every entry point
         run: |
           for f in server.js auth.js claude-cli.js claude-ssh.js claude-interactive.js \
-                   claude-code-manager.js agent-dag.js config-resolve.js terminal-bridge.js; do
+                   claude-code-manager.js agent-dag.js config-resolve.js terminal-bridge.js \
+                   providers.js providers-store.js providers-catalog.js llm-bridge/*.js; do
             [ -f "$f" ] && node -c "$f"
           done
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a70b8321..726570f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,47 @@
 # Changelog
 
+## Unreleased
+
+### Providers: any model, any mode (not only Claude)
+
+The studio could reach exactly one endpoint — whatever `ANTHROPIC_BASE_URL` said at boot —
+and offered four hardcoded aliases. It now keeps a list of **providers** and every run picks
+its own: chat, multi-agent, rooms, `@@bots`, Kanban tasks, schedules, Telegram and the
+utility calls. Every run is still the `claude` CLI (tools, MCP, hooks, resume, compaction
+unchanged); `llm-bridge/` translates for OpenAI-compatible endpoints. See `docs/providers.md`.
+
+- **Types:** the CLI login (Claude subscription), Anthropic API, Anthropic-compatible
+  endpoints (gateways, DeepSeek/Kimi/GLM/MiniMax), OpenAI-compatible endpoints (OpenAI,
+  OpenRouter, Gemini, Qwen, Groq, Mistral, xAI, Ollama, LM Studio…), with presets.
+- **Nothing to migrate by hand.** `ANTHROPIC_BASE_URL` becomes the default provider on first
+  start; a bare `sonnet` in an existing row keeps meaning what it meant.
+- **A model is one string** (`provider::model`), so it travels through every existing column,
+  WS frame, MCP tool and plan file.
+- **UI:** a Providers section (test before save, catalogue import, capabilities and prices,
+  probe, utility model, 30-day usage); a `⋯` model picker next to the toolbar chips; the bot
+  editor, Kanban and Schedule list every provider's models; Telegram `/model` and `/effort`.
+- **Every parameter reaches the model:** role models for the CLI's own background calls and
+  sub-agents, the real context window (compaction), the output cap, effort taken from the
+  run (the CLI sends "high" by itself), images inside tool results, reasoning echo, tool
+  schema sanitising, stop reasons, cached-token usage, error mapping the CLI understands.
+- **Keys never enter the agent's environment** — the CLI gets a short-lived run token for a
+  loopback bridge. Cost and context % off Anthropic come from the bridge's usage ledger.
+- **Found on the way:** the Subscription engine now honours `--effort` and a bot's model on a
+  task; its spawn script unsets provider variables tmux could hand the pane; `/api/translate`
+  no longer inherits server secrets; `set_ui_state` knows `fable`; Dispatch and Telegram send
+  the chat's effort; a routing refusal stops the turn instead of burning the auto-continues.
+- **No engine dial.** The toolbar's API/Subscription switch (and ★ default), the mobile one,
+  Kanban's, Schedule's and the bot editor's are gone: the chosen model's provider decides —
+  the CLI login ("Claude (CLI login)", marked *subscription*) runs on tmux, every other
+  provider (marked *API*, e.g. the "Claude API" preset with an Anthropic key) headless. A
+  one-time boot migration turns every explicit "Subscription" into a `claude::<model>` pin,
+  and the `defaultEngine` setting / `PUT /api/default-engine` are removed.
+- **Bot editor:** one Model button with the toolbar's picker ("Same as chat" on top); the
+  starter-prompt templates (Analyst, Writer, Reviewer, Explainer) are gone — they overwrote
+  the bot's own prompt.
+- The Claude Code CLI is pinned (`CLAUDE_CODE_VERSION=2.1.281`) and CI runs a contract test
+  that drives the real binary through the bridge.
+
 ## 7.17.0
 
 ### Add project from a Git URL (#94)
diff --git a/CLAUDE.md b/CLAUDE.md
index fd18ba1d..1632dea1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -81,7 +81,7 @@ Environment (`.env`, see `.env.example`):
 - `MULTI_AGENT_CONCURRENCY` — max `claude` subprocesses alive at once inside one wave,
   default 3. A wave still runs every member; this only bounds how many at a time.
 
-**Models** — the UI exposes four choices: `haiku`, `sonnet` (default), `opus`, `fable`. The short aliases are mapped in `claude-cli.js` (`MODEL_MAP`, lines 81-89) and passed to the `claude` CLI **as-is** (`opus`→`opus`, `sonnet`→`sonnet`, `haiku`→`haiku`, `fable`→`fable`); the CLI resolves each alias internally. `server.js` defines no model map — it defers to `claude-cli.js`. Dated model IDs are kept commented out in `MODEL_MAP` and are not used.
+**Models** — a model is ONE string: a bare alias (`haiku`, `sonnet` (default), `opus`, `fable`, or an old gateway id) resolved on the **default provider**, or a provider ref `provider::model` (`deepseek::deepseek-chat`). The toolbar's one model button opens a picker that sends a bare alias for the default provider's aliases and a ref for everything else. `providers.js` resolves a value per run (`resolveModel`), `server.js resolveRunTarget()` turns that into the child's `--model` + environment, and `claude-cli.js` asks it through `setRunTargetHook` on EVERY `send()` — do not add a second routing path. See **Providers & LLM bridge** below and `docs/providers.md`.
 
 ## MCP & Skills
 
@@ -135,8 +135,9 @@ splice the room's rounds into the thread the bot uses when mentioned normally.
 Not built: the room's artifact is not yet consumed by a DAG node (roadmap item 6b).
 
 ### Engines
-- `api` (default) — headless `claude -p` via `runCliSingle` in server.js
-- `subscription` — persistent interactive tmux session (one per chat) via `claude-interactive.js`, billed on the Claude Max subscription (UI button "Subscription"). MCP servers passed via `--mcp-config` at spawn; systemPrompt via `--append-system-prompt` at spawn; config changes (skills/mode/MCP/model) auto-respawn the tmux session with `--resume` — verified to keep writing to the same transcript jsonl. Image attachments saved to temp files, paths appended to the prompt. maxTurns is not applicable. Choice persisted per session in `sessions.run_engine` (the `engine` column belongs to telegram-bot.js — do not reuse it).
+Which engine a run uses is decided by its MODEL's provider (`runEngineFor`, see Providers below) — there is no engine button.
+- `api` — headless `claude -p` via `runCliSingle` in server.js; every provider except the CLI login
+- `subscription` — persistent interactive tmux session (one per chat) via `claude-interactive.js`, billed on the Claude Max subscription; the models of the CLI-login provider when tmux exists. MCP servers passed via `--mcp-config` at spawn; systemPrompt via `--append-system-prompt` at spawn; config changes (skills/mode/MCP/model) auto-respawn the tmux session with `--resume` — verified to keep writing to the same transcript jsonl. Image attachments saved to temp files, paths appended to the prompt. maxTurns is not applicable. The engine of the last turn is recorded in `sessions.run_engine` (the `engine` column belongs to telegram-bot.js — do not reuse it).
 
 **Interactive prompts (#20).** A subscription turn can stop on a blocking select
 widget (permission question, plan approval, AskUserQuestion). `paneAwaitingInput()`
@@ -204,7 +205,7 @@ shrink its xterm to that pane. The user saw a 46-column strip and nothing else.
   can pin deterministically.
 
 
-**Platform support — capability-checked, not OS-sniffed.** `/api/version` returns `tmuxAvailable` (server runs `tmux -V` once at boot); the UI disables the "Subscription" button when false. Works on macOS / Linux / Docker (tmux in Dockerfile) / Windows-via-WSL or Git-Bash. Native Windows without tmux → button disabled, user stays on `api`. There is intentionally no Windows special-casing — the capability flag covers every case.
+**Platform support — capability-checked, not OS-sniffed.** `/api/version` returns `tmuxAvailable` (server runs `tmux -V` once at boot); without tmux the CLI-login models run headless (`runEngineFor`, `engineOfModel` in the SPA). Works on macOS / Linux / Docker (tmux in Dockerfile) / Windows-via-WSL or Git-Bash. Native Windows without tmux → every run is `api`. There is intentionally no Windows special-casing — the capability flag covers every case.
 
 ### WebSocket Protocol — Do Not Break
 The entire UI depends on this exact message contract:
@@ -245,7 +246,20 @@ sonnet
 haiku
 fable
 ```
-These short aliases are exactly what `claude-cli.js` (`MODEL_MAP`) passes to the CLI — pass them through **as-is**; the `claude` binary resolves each one internally. Do not use dated model-ID suffixes in CLI flags (the dated IDs are kept commented out in `MODEL_MAP`).
+On a provider that serves Claude (the CLI login, Anthropic, a Claude gateway) these aliases are passed to the CLI **as-is** and the `claude` binary resolves them. On any other provider they map through that provider's roles (`haiku→fast`, `sonnet/fable→main`, `opus→strong`) — `providers.resolveModel()` does it, nothing else should. Do not use dated model-ID suffixes in CLI flags.
+
+### Providers & LLM bridge
+
+`providers.js` (pure rules) · `providers-store.js` (SQLite: `providers`, `provider_models`, `provider_settings`, `llm_usage`) · `providers-catalog.js` (GET /models) · `llm-bridge/` (a separate `node` process on 127.0.0.1, spawned like the MCP helpers). Full picture: `docs/providers.md`.
+
+- **One choke point.** `ClaudeCLI.send()` calls the routing hook for every headless run; `/api/translate` (the only raw spawn) asks the same hook. A new call site that spawns `claude` some other way skips routing, the bridge token and the usage ledger.
+- **The child never sees a provider key.** A bridge run gets `ANTHROPIC_BASE_URL=<bridge>` and a short-lived `ccsr_` run token; `buildRunEnv()` strips every inherited `ANTHROPIC_*` first. Keep new provider variables in `PROVIDER_ENV_VARS` or they leak from the server env.
+- **The engine is the model's provider, never a dial.** `server.js runEngineFor(model)` (`providers.engineForModel`) is the one rule for chats, tasks, bots and Telegram: the CLI-login provider (`claude-subscription`, marked *subscription* in every list) runs on the tmux engine when tmux exists, everything else headless. Do not reintroduce an engine field — `sessions.run_engine` only records the last turn's engine, `tasks`/`bots.run_engine` are no longer read (boot migration `migrateEngineDial`). The spawn script unsets every provider variable because tmux hands a pane its SERVER's environment.
+- **A test server that drives runs through a fake headless `claude` spreads `test/_api-provider-env.js` into its env.** With no gateway the default provider is the CLI login, and in CI (tmux installed, no `ANTHROPIC_BASE_URL`) its models go to the tmux engine — the suite then passes on a developer box whose shell exports `ANTHROPIC_BASE_URL` and fails only in CI.
+- **Effort comes from the run, not the request.** The CLI sends `effort: "high"` even with no flag, so the bridge takes `RunCtx.effort`; `Auto` reaches it as `'auto'` (send none).
+- **A routing refusal is a stop, not a retry.** `auth-errors.js` classifies it (`provider_unavailable`, `provider_key`) so the auto-continue ladders stop at once.
+- **Cost and window off Anthropic come from the ledger**, not from the CLI (it prices unknown ids with its Claude table and assumes 200K): `withProviderUsage()`.
+- **The CLI version is pinned** (Dockerfile `CLAUDE_CODE_VERSION`, CI). `test/llm-bridge-contract.test.js` drives the real binary through the bridge; bump the pin and that test together.
 
 ### Remote shell environment (issue #59)
 
@@ -610,9 +624,10 @@ user had just picked in the modal — and silent about a bot's model, which OVER
 the session's inside the runner. `kbRunBadges()` in `public/kanban.html` replaces it.
 
 - **The card mirrors `startTask`, it does not re-derive.** Model is
-  `taskBot?.model || session?.model || task.model || 'sonnet'`; effort and engine come
-  off the TASK row (`task.effort`, `task.run_engine`), which is the #79 rule that those
-  dials drive every run regardless of which session the task uses. The two live in
+  `taskBot?.model || session?.model || task.model || 'sonnet'`; effort comes off the
+  TASK row (`task.effort`), which is the #79 rule that it drives every run regardless of
+  which session the task uses; the engine is derived from that same model
+  (`runEngineFor` ↔ `kbEngineOf`) — `task.run_engine` is no longer read. The two live in
   different files, so `test/kanban-run-badges.test.js` pins the runner's expression as
   source text as well as the helper's behaviour — a reorder there makes the card lie
   and nothing else notices.
@@ -629,11 +644,11 @@ the session's inside the runner. `kbRunBadges()` in `public/kanban.html` replace
   run is exactly the thing a silent badge would hide.
 - **The chain card (`renderChainCard`) still shows `chain.model` alone.** Deliberately
   out of scope; a chain has no bot and no per-task engine.
-- **Choosing a non-Claude PROVIDER per task is NOT this.** The Kanban worker parses
-  `claude`'s `stream-json`, and external agents (`config.externalAgents`) reach the
-  studio only through `/api/delegate` and the terminal, which is fire-and-forget with
-  no turn budget, no retry and no session resume. Wiring one into `taskWorker` is a new
-  execution backend, not a dropdown.
+- **External agents are still NOT a task backend.** A task can run any provider's model
+  (the model picker), but external agents (`config.externalAgents`) reach the studio only
+  through `/api/delegate` and the terminal, which is fire-and-forget with no turn budget,
+  no retry and no session resume. Wiring one into `taskWorker` is a new execution
+  backend, not a dropdown.
 
 ### Add project from a Git URL (issue #94)
 
diff --git a/Dockerfile b/Dockerfile
index 5282be05..1f87d177 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,8 +5,12 @@ RUN apt-get update && apt-get install -y \
     git curl python3 python3-pip build-essential tmux \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Claude Code CLI globally
-RUN npm install -g @anthropic-ai/claude-code
+# Install Claude Code CLI globally — PINNED. The provider bridge (llm-bridge/) translates
+# the requests this exact CLI sends; an unpinned install lets any rebuild pull a CLI whose
+# request shape nobody has run the contract test against (test/llm-bridge-contract.test.js).
+# Bump deliberately, together with that test: docker build --build-arg CLAUDE_CODE_VERSION=…
+ARG CLAUDE_CODE_VERSION=2.1.281
+RUN npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}
 
 # Install opencode CLI globally — an externalAgents engine (config.json), so it
 # must be baked into the image rather than installed live: /app is an image
diff --git a/auth-errors.js b/auth-errors.js
index 013e397b..2039e35f 100644
--- a/auth-errors.js
+++ b/auth-errors.js
@@ -56,6 +56,10 @@ const AUTH_ERROR_RE = new RegExp([
   "run\\s+`?claude\\s+login`?\\s+to\\s+(?:re-?)?authenticate",
   "not\\s+logged\\s+in\\s+to\\s+claude",
   "credentials\\s+(?:are\\s+)?(?:invalid|expired)",
+  // The studio's own provider router refusing a run (server.js resolveRunTarget): the
+  // run never started, and retrying cannot start it — same class as a dead login.
+  "needs\\s+the\\s+llm\\s+bridge,\\s+which\\s+is\\s+not\\s+running",
+  "model\\s+\"[^\"\\n]{1,200}\"\\s+cannot\\s+run:",
 ].join('|'), 'i');
 
 /**
@@ -72,6 +76,21 @@ function isAuthError(text = '') {
 // Each carries the ACTION that resolves it, because "authentication failed" without
 // a next step is the complaint the issue was filed about.
 const AUTH_KINDS = [
+  {
+    kind: 'provider_unavailable',
+    re: /needs\s+the\s+llm\s+bridge,\s+which\s+is\s+not\s+running|model\s+"[^"\n]{1,200}"\s+cannot\s+run:/i,
+    label: 'The chat\'s model cannot run right now',
+    hint: 'Open Providers in the sidebar: the provider needs the LLM bridge or has no model enabled — or pick a model of another provider.',
+  },
+  {
+    // A provider from the registry, reached through llm-bridge: the bridge prefixes every
+    // upstream error with `provider "<label>": `, so this is the key of THAT provider —
+    // `claude login` would change nothing.
+    kind: 'provider_key',
+    re: /provider\s+"[^"\n]{1,60}"\s*:\s*(?:invalid\s+api\s+key|invalid\s+bearer\s+token|authentication)/i,
+    label: 'The provider rejected its API key',
+    hint: 'Open Providers in the sidebar and check that provider\'s API key — or switch the chat to a model of another provider.',
+  },
   {
     kind: 'oauth_refresh_failed',
     re: /oauth\s+session\s+expired|could\s+not\s+be\s+refreshed|failed\s+to\s+refresh\s+(?:the\s+)?(?:oauth\s+)?(?:access\s+)?token|refresh\s+token\s+(?:is\s+)?(?:missing|expired|invalid|revoked)|oauth\s+token\s+(?:has\s+)?expired/i,
@@ -150,7 +169,11 @@ function detectAuthError({ texts = [], subtype, isError } = {}) {
  * @returns {string}
  */
 function authErrorNotice(info) {
-  return `\n\n---\n🔐 **${info.label}.** ${info.hint}\n\nThis is not retried: re-authentication needs a human, so retrying would only repeat the same failure.\n\n> ${info.message}\n\n`;
+  // A provider stop is a configuration choice, not a login — say which human action it needs.
+  const why = (info.kind === 'provider_unavailable' || info.kind === 'provider_key')
+    ? 'This is not retried: the provider setup needs a human, so retrying would only repeat the same failure.'
+    : 'This is not retried: re-authentication needs a human, so retrying would only repeat the same failure.';
+  return `\n\n---\n🔐 **${info.label}.** ${info.hint}\n\n${why}\n\n> ${info.message}\n\n`;
 }
 
 module.exports = {
diff --git a/bots.js b/bots.js
index f35e4c89..97141e02 100644
--- a/bots.js
+++ b/bots.js
@@ -4,6 +4,9 @@
 // unit tested the way rate-limit-utils.js, multi-agent-result.js and
 // terminal-session.js are. The side effects live in server.js.
 
+// providers.js is pure too: its model-ref grammar is what a bot's model is written in.
+const { toClaudeRef } = require('./providers');
+
 // A handle must be safe to type after '@' and safe to use as a primary key.
 // A trailing '-' or '_' is rejected on purpose: '@bot-' followed by a space would
 // not match the mention regex's word boundary, so such a handle could be created
@@ -351,9 +354,12 @@ function planBotImport({ incoming, live, reserved, overwrite } = {}) {
       active_mcp: normList(raw?.active_mcp ?? raw?.activeMcp),
       avatar: typeof raw?.avatar === 'string' ? raw.avatar : '',
       is_global: (raw?.is_global ?? raw?.isGlobal) ? 1 : 0,
-      run_engine: normalizeBotEngine(raw?.run_engine ?? raw?.runEngine) || null,
+      // A file from before the engine dial went away may say "subscription": the model's
+      // provider decides the engine now, so that bot's model is pinned to the CLI login.
+      run_engine: null,
       room_tools: normalizeRoomTools(raw?.room_tools ?? raw?.roomTools) || null,
     };
+    if (normalizeBotEngine(raw?.run_engine ?? raw?.runEngine) === 'subscription') row.model = toClaudeRef(row.model);
     (liveSet.has(handle) ? replace : create).push(row);
   }
   return { create, overwrite: replace, skipped };
@@ -432,15 +438,10 @@ function botsAvailability({ remote, runEngine } = {}) {
 }
 
 // ─── Per-bot engine ──────────────────────────────────────────────────
-// A bot may pin its own billing engine, so one bot (a planner) can run on the Claude
-// subscription while the chat, and every other bot, stays on `api`. `null` is "as the
-// chat", which is what every existing bot has.
-//
-// The override is honoured only where the caller says so (`enabled`): the web chat owns a
-// WebSocket the interactive pane streams into; Telegram hands the bot runner a stand-in
-// socket, and a tmux pane must not be started behind it. And only while tmux exists —
-// the subscription engine is a tmux pane, so without one the bot quietly follows the chat
-// rather than failing every turn.
+// A bot's engine follows its MODEL now (server.js runEngineFor): a model of the CLI login
+// runs on the subscription, any other provider headless. `run_engine` is the column the
+// old per-bot dial wrote; it is only still parsed so an older client or export file that
+// says "subscription" can be turned into a `claude::` model (toClaudeRef).
 const BOT_ENGINES = ['api', 'subscription'];
 
 /** A stored/submitted value as it is kept: 'api', 'subscription' or null. undefined stays undefined. */
@@ -462,16 +463,12 @@ const CLAUDE_MODEL_RE = /^[A-Za-z0-9._-]+$/;
 function botModel(bot, engine, chatModel) {
   const own = bot && typeof bot.model === 'string' ? bot.model : '';
   if (!own) return chatModel;
-  if (engine === 'subscription' && !CLAUDE_MODEL_RE.test(own)) return chatModel;
-  return own;
-}
-
-/** The engine one bot's turn runs on: the bot's own choice, else the chat's. */
-function botEngine(bot, chatEngine, { enabled = false, tmux = true } = {}) {
-  const chat = chatEngine === 'subscription' ? 'subscription' : 'api';
-  const own = bot && BOT_ENGINES.includes(bot.run_engine) ? bot.run_engine : null;
-  if (!own || !enabled) return chat;
-  if (own === 'subscription' && !tmux) return chat;
+  if (engine === 'subscription') {
+    // A provider ref to the CLI-login row ("claude::opus", providers.js) IS a Claude
+    // model; the tmux engine takes it without the prefix. Any other ref is not.
+    const bare = own.startsWith('claude::') ? own.slice('claude::'.length) : own;
+    return CLAUDE_MODEL_RE.test(bare) ? bare : chatModel;
+  }
   return own;
 }
 
@@ -841,7 +838,7 @@ module.exports = {
   HANDLE_RE, EVIDENCE_CLAUSE, ROSTER_MAX, IMPORT_MAX,
   isValidHandle, handleFromLabel, uniqueHandle,
   parseMentions, renderRoster, languageClause, buildBotSystemPrompt, planDispatch, planBotImport,
-  MAX_TASK_CHARS, clipTask, inheritBotId, botsAvailability, BOT_ENGINES, normalizeBotEngine, botEngine, botModel,
+  MAX_TASK_CHARS, clipTask, inheritBotId, botsAvailability, BOT_ENGINES, normalizeBotEngine, botModel,
   stripReportFormat, ROOM_TOOL_SCOPES, normalizeRoomTools, roomToolScope,
   planInboxDelivery, INBOX_MAX_DELIVER, INBOX_TTL_MS,
   planRoom, seatPlanner, PLANNER_HANDLE, PLAN_INTENT_RE, parseRoomReply, roomShouldContinue,
diff --git a/chat-defaults.js b/chat-defaults.js
index bf254f62..635281d3 100644
--- a/chat-defaults.js
+++ b/chat-defaults.js
@@ -19,6 +19,8 @@
 // the validation can be unit-tested without booting anything.
 'use strict';
 
+const { isQualifiedRef } = require('./providers');
+
 /** The five dials, in the order the toolbar shows them. */
 const KEYS = ['mode', 'agent', 'model', 'effort', 'turns'];
 
@@ -70,6 +72,10 @@ function coerce(key, raw) {
     return { ok: true, value: Math.trunc(n) };
   }
   const v = String(raw);
+  // Beyond the four aliases a model may be any provider ref ("deepseek::deepseek-chat",
+  // providers.js). Only the SHAPE is checked here — this module stays pure; whether the
+  // provider still exists is the resolver's business (it falls back and says so).
+  if (key === 'model' && isQualifiedRef(v)) return { ok: true, value: v };
   if (!CHOICES[key].includes(v)) return { ok: false, error: 'invalid_choice' };
   return { ok: true, value: v };
 }
diff --git a/claude-cli.js b/claude-cli.js
index 0c823af5..d619e581 100644
--- a/claude-cli.js
+++ b/claude-cli.js
@@ -140,6 +140,20 @@ const MODEL_MAP = {
   'fable':  'fable',
 };
 
+// ─── Provider routing (providers.js; wired by server.js) ─────────────────────
+// Every headless run asks this hook where it goes: which model id the CLI gets, which
+// ANTHROPIC_* the child sees (the local llm-bridge + a run token, or the CLI's own
+// login), and extra flags. One choke point on purpose — chat, bots, rooms, multi-agent,
+// tasks and the utility calls all reach the CLI through send(), so none of them can
+// forget to route. null = the pre-registry behaviour (inherit the server's env).
+let _runTargetHook = null;
+function setRunTargetHook(fn) { _runTargetHook = typeof fn === 'function' ? fn : null; }
+function resolveRunTarget(req) {
+  if (!_runTargetHook) return null;
+  try { return _runTargetHook(req) || null; }
+  catch (e) { return { error: `provider routing failed: ${e.message}` }; }
+}
+
 // ─── MCP config file cache ──────────────────────────────────────────────────
 // Reuses temp files by content hash instead of creating/deleting per request.
 // Key: SHA-256 hash of JSON content → { path, refCount }
@@ -184,6 +198,30 @@ process.on('exit', () => {
   }
 });
 
+/** Same shape providers.applyRunEnv() uses; kept local so this file needs no registry. */
+function applyRunEnvTo(env, runEnv) {
+  for (const k of runEnv.unset || []) delete env[k];
+  for (const [k, v] of Object.entries(runEnv.set || {})) { if (v != null && v !== '') env[k] = String(v); }
+  return env;
+}
+
+/** A run that never starts: the caller still gets its onError and exactly one onDone,
+ *  on a later tick so the handlers it chains after send() are attached. */
+function failedHandle(message) {
+  const h = {};
+  setImmediate(() => {
+    try { if (h.onError) h.onError(String(message)); } catch {}
+    try { if (h.onDone) h.onDone(null); } catch {}
+  });
+  const self = {
+    onText() { return self; }, onTool() { return self; }, onThinking() { return self; }, onRateLimit() { return self; },
+    onResult() { return self; }, onUsage() { return self; }, onSessionId() { return self; },
+    onError(fn) { h.onError = fn; return self; }, onDone(fn) { h.onDone = fn; return self; },
+    process: null, runTarget: null,
+  };
+  return self;
+}
+
 class ClaudeCLI {
   constructor(options = {}) {
     // A POSIX-absolute cwd on Windows is almost always a REMOTE path that leaked into a
@@ -200,7 +238,23 @@ class ClaudeCLI {
     this.claudeBin = options.claudeBin || CLAUDE_BIN;
   }
 
-  send({ prompt, contentBlocks, sessionId, model, maxTurns, mcpServers, systemPrompt, allowedTools, tools, abortController, settingSources, forkSession, addDirs, extraEnv, extraSettings, name, effort, jsonSchema }) {
+  send(opts = {}) {
+    // Where this run goes. An unresolvable choice fails the run the normal way (onError
+    // then onDone, asynchronously) instead of silently falling back to some other model.
+    const target = resolveRunTarget({ model: opts.model, effort: opts.effort, engine: 'api', meta: opts.runMeta || {} });
+    this.lastRunTarget = target && !target.error ? (target.info || null) : null;
+    if (target && target.error) return failedHandle(target.error);
+    try {
+      return this._send(opts, target);
+    } catch (e) {
+      // Anything that throws before the child exists — spawn() refuses a prompt holding a
+      // NUL byte, a temp write can fail — would otherwise leave the run token valid forever.
+      if (target && typeof target.release === 'function') { try { target.release(); } catch {} }
+      throw e;
+    }
+  }
+
+  _send({ prompt, contentBlocks, sessionId, model, maxTurns, mcpServers, systemPrompt, allowedTools, tools, abortController, settingSources, forkSession, addDirs, extraEnv, extraSettings, name, effort, jsonSchema }, target) {
     const args = ['--print'];
 
     // --setting-sources: control which setting sources to load (user, project, local)
@@ -226,7 +280,13 @@ class ClaudeCLI {
       console.warn('[claude-cli] rejected non-UUID sessionId for --resume:', typeof sessionId, String(sessionId).substring(0, 60));
     }
 
-    if (model) args.push('--model', MODEL_MAP[model] || model);
+    // With a routing target the CLI gets the provider's own model id (a bare alias on a
+    // provider that serves no Claude has already been mapped through its roles). A run
+    // on the CLI login with no model chosen keeps passing no flag, as before.
+    const cliModel = target
+      ? ((model || target.routing !== 'oauth') ? target.cliModel : null)
+      : (model ? (MODEL_MAP[model] || model) : null);
+    if (cliModel) args.push('--model', cliModel);
     if (maxTurns) args.push('--max-turns', String(maxTurns));
 
     // --effort: thinking-effort dial for the current session.
@@ -309,6 +369,10 @@ class ClaudeCLI {
       args.push('--settings', JSON.stringify(extraSettings));
     }
 
+    // Provider-specific flags (e.g. `--disallowedTools WebSearch` off Anthropic, where the
+    // server-side search tool does not exist and the nested call answers without searching).
+    if (target && Array.isArray(target.extraArgs) && target.extraArgs.length) args.push(...target.extraArgs);
+
     // CRITICAL: bypass permission prompts in non-interactive mode
     args.push('--dangerously-skip-permissions');
 
@@ -362,6 +426,10 @@ class ClaudeCLI {
     // Unset CLAUDECODE to allow nested invocation from dev environment.
     const env = { ...process.env, ...(extraEnv || {}) };
     delete env.CLAUDECODE;
+    // The provider decision: every inherited ANTHROPIC_* is stripped first, then the
+    // run's own set (bridge URL + run token, role models, window/output caps). A routed
+    // run therefore never sees the server's long-lived gateway token.
+    if (target && target.runEnv) applyRunEnvTo(env, target.runEnv);
     // The child runs with Bash on a prompt an untrusted document can steer, so it must
     // not inherit this server's own credentials — none of them are its to use. Deleted
     // AFTER the extraEnv spread so a caller cannot re-introduce one by accident.
@@ -405,6 +473,14 @@ class ClaudeCLI {
     // Track temp attachment files + parent dir for cleanup
     let attFiles = _tempFiles.slice();
     let attDir = _tempDir;
+    // The run token dies with the process (the bridge keeps a short grace for the
+    // CLI's last in-flight request).
+    let targetReleased = false;
+    const releaseTarget = () => {
+      if (targetReleased || !target || typeof target.release !== 'function') return;
+      targetReleased = true;
+      try { target.release(); } catch {}
+    };
 
     // ─── Watchdog timers ─────────────────────────────────────────────────────
     // Escalate to SIGKILL 3 s after SIGTERM if the process ignores it (Unix only —
@@ -526,6 +602,7 @@ class ClaudeCLI {
         }
       }
       releaseMcpConfig(mcpHash); mcpHash = null;
+      releaseTarget();
       for (const f of attFiles) { try { fs.unlinkSync(f); } catch {} }
       if (attDir) { try { fs.rmSync(attDir, { recursive: true, force: true }); } catch {} attDir = null; }
       attFiles = [];
@@ -556,6 +633,7 @@ class ClaudeCLI {
       if (sigkillTimer) { clearTimeout(sigkillTimer); sigkillTimer = null; }
       // Clean up MCP config and temp attachments even when the process fails to start
       releaseMcpConfig(mcpHash); mcpHash = null;
+      releaseTarget();
       for (const f of attFiles) { try { fs.unlinkSync(f); } catch {} }
       if (attDir) { try { fs.rmSync(attDir, { recursive: true, force: true }); } catch {} attDir = null; }
       attFiles = [];
@@ -583,6 +661,7 @@ class ClaudeCLI {
       onResult(fn) { h.onResult = fn; return this; },
       onUsage(fn) { h.onUsage = fn; return this; },
       process: proc,
+      runTarget: this.lastRunTarget,
     };
   }
 
@@ -670,3 +749,6 @@ class ClaudeCLI {
 module.exports = ClaudeCLI;
 module.exports.findClaudeBin = findClaudeBin;
 module.exports.claudeCliStatus = claudeCliStatus;
+module.exports.setRunTargetHook = setRunTargetHook;
+module.exports.resolveRunTarget = resolveRunTarget;
+module.exports.SERVER_ONLY_ENV = SERVER_ONLY_ENV;
diff --git a/claude-interactive.js b/claude-interactive.js
index 34e4d514..dabfd10e 100644
--- a/claude-interactive.js
+++ b/claude-interactive.js
@@ -31,6 +31,7 @@ const crypto = require('node:crypto');
 
 const { findClaudeBin } = require('./claude-cli');
 const { agentsMdPreamble } = require('./agents-md');
+const { PROVIDER_ENV_VARS } = require('./providers');
 // ONE definition of the socket name, imported — never a second copy of the string.
 const { TMUX_SOCKET } = require('./terminal-bridge');
 
@@ -279,8 +280,19 @@ function spawnScriptDir() {
 
 // Full `claude` invocation for the interactive engine. Pure — the prompt is inline
 // here on purpose: this string becomes the script body, i.e. the child's argv.
-function buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath }) {
-  let cmd = `env -u CLAUDECODE ${shq(claudeBin)} ${idFlag} --model ${shq(modelAlias)} --dangerously-skip-permissions`;
+//
+// Every provider variable is unset HERE, in the script, and not only in the spawn env
+// below: tmux builds a pane's environment from its SERVER's global environment, not
+// from the client that ran `new-session`. The ccstudio tmux server is often started
+// first by terminal-bridge.js, which keeps the server's ANTHROPIC_* — so deleting them
+// from our spawn env alone could still hand this pane the gateway token, and `claude`
+// ranks a token above the stored OAuth login (the Subscription engine's whole point).
+const PANE_UNSET_ENV = ['CLAUDECODE', ...PROVIDER_ENV_VARS];
+const EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
+function buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath, effort }) {
+  const unset = PANE_UNSET_ENV.map(v => `-u ${v}`).join(' ');
+  let cmd = `env ${unset} ${shq(claudeBin)} ${idFlag} --model ${shq(modelAlias)} --dangerously-skip-permissions`;
+  if (EFFORTS.includes(effort)) cmd += ` --effort ${effort}`;
   if (sp) cmd += ` --append-system-prompt ${shq(sp)}`;
   if (mcpPath) cmd += ` --mcp-config ${shq(mcpPath)}`;
   return cmd;
@@ -353,7 +365,7 @@ function killInteractiveTmux(localSessionId) {
 // mode, ws, sessionId, abortController, claudeSessionId, workdir, tabId; ignores the rest.
 // Returns { cid, completed, resultMeta, fullText, fullThinking, toolEvents }.
 async function runInteractiveSingle(params) {
-  const { prompt, systemPrompt, model, mode, ws, sessionId, abortController, claudeSessionId, workdir, tabId, mcpServers, userContent, drainInterrupts, markInterruptsDelivered, requeueInterrupts, fanout, agent } = params;
+  const { prompt, systemPrompt, model, mode, ws, sessionId, abortController, claudeSessionId, workdir, tabId, mcpServers, userContent, drainInterrupts, markInterruptsDelivered, requeueInterrupts, fanout, agent, effort } = params;
   const start = Date.now();
   // `agent` tags every frame with which bot produced it — set only when this call is one
   // seat in a bots room/multi turn, not a plain single-agent chat. Without it the UI has
@@ -400,11 +412,18 @@ async function runInteractiveSingle(params) {
     // project without AGENTS.md keeps its previous hash and does NOT respawn.
     const agentsMd = agentsMdPreamble(workdir || process.cwd());
     const sp = [(mp + (systemPrompt || '')).trim(), agentsMd].filter(Boolean).join('\n\n');
-    const modelAlias = /^[a-zA-Z0-9._-]+$/.test(String(model || '')) ? model : 'sonnet';
+    // A ref to the CLI-login provider ("claude::opus", providers.js) is a plain Claude
+    // model here. The router never sends another provider's ref to this engine
+    // (providers.effectiveEngine); if one slips through, it still becomes `sonnet`.
+    const bareModel = String(model || '').startsWith('claude::') ? String(model).slice('claude::'.length) : String(model || '');
+    const modelAlias = /^[a-zA-Z0-9._-]+$/.test(bareModel) ? bareModel : 'sonnet';
+    // Effort used to be dropped on this engine; it is a spawn flag, so it joins cfgHash
+    // and changing it respawns the pane with --resume like a model change does.
+    const effortFlag = EFFORTS.includes(effort) ? effort : '';
     const mcpPath = mcpConfigPath(mcpServers);
     let mcpJson = '';
     if (mcpPath) { try { mcpJson = fs.readFileSync(mcpPath, 'utf8'); } catch {} }
-    const cfgHash = crypto.createHash('sha256').update(JSON.stringify([sp, mcpJson, modelAlias])).digest('hex').slice(0, 16);
+    const cfgHash = crypto.createHash('sha256').update(JSON.stringify(effortFlag ? [sp, mcpJson, modelAlias, effortFlag] : [sp, mcpJson, modelAlias])).digest('hex').slice(0, 16);
 
     // ── Spawn (or reuse) the tmux session ──────────────────────────────────
     // tmux alive but no recorded claude session id: without a cid we cannot
@@ -425,7 +444,7 @@ async function runInteractiveSingle(params) {
       const idFlag = resuming ? `--resume ${shq(cid)}` : `--session-id ${shq(cid)}`;
 
       const claudeBin = findClaudeBin();
-      const innerCmd = buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath });
+      const innerCmd = buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath, effort: effortFlag });
 
       const env = utf8Env();
       delete env.CLAUDECODE; // parent Claude Code session sets this and it confuses the child
@@ -437,9 +456,7 @@ async function runInteractiveSingle(params) {
       // routes every "Subscription" turn through that token instead — same
       // symptom as no subscription selection existing at all, just with an extra
       // layer of "why is this billing wrong" on top.
-      delete env.ANTHROPIC_API_KEY;
-      delete env.ANTHROPIC_AUTH_TOKEN;
-      delete env.ANTHROPIC_BASE_URL;
+      for (const v of PROVIDER_ENV_VARS) delete env[v];
       // stderr is PIPED, not ignored: `command too long` was the whole content of
       // issue #96 and it used to be discarded, leaving only the generic line below.
       let tmuxErr = '';
diff --git a/claude-ssh.js b/claude-ssh.js
index 2938c9c3..73d0b2f2 100644
--- a/claude-ssh.js
+++ b/claude-ssh.js
@@ -346,7 +346,10 @@ class ClaudeSSH {
             const cleanName = name.replace(/[\r\n\t]+/g, ' ').trim().slice(0, 100);
             if (cleanName) args.push('--name', cleanName);
           }
-          if (model) args.push('--model', MODEL_MAP[model] || model);
+          // A provider ref ("deepseek::deepseek-chat", providers.js) means nothing to the
+          // REMOTE claude: it runs on that host's own login/config, so it gets the bare id.
+          const bare = model && String(model).includes('::') ? String(model).slice(String(model).indexOf('::') + 2) : model;
+          if (bare) args.push('--model', MODEL_MAP[bare] || bare);
           if (maxTurns) args.push('--max-turns', String(maxTurns));
           if (typeof effort === 'string') {
             const e = effort.trim().toLowerCase();
diff --git a/config-resolve.js b/config-resolve.js
index 2a459d6a..b96a1a62 100644
--- a/config-resolve.js
+++ b/config-resolve.js
@@ -81,9 +81,8 @@ function isSecretKey(key, def) {
  */
 const SETTINGS = [
   // ── AI models & engine ────────────────────────────────────────────────────
-  { key: 'defaultEngine', section: 'engine', backing: 'config', merge: 'merged', path: 'defaultEngine',
-    type: 'enum', choices: ['api', 'subscription'], def: 'api', falsyFallsThrough: true,
-    src: 'server.js:loadMergedConfig' },
+  // No `defaultEngine` row any more: the engine follows the chosen model's provider
+  // (providers.engineForModel), so there is nothing left to default.
   { key: 'ANTHROPIC_BASE_URL', section: 'engine', backing: 'env', type: 'string', def: '', restart: true,
     src: '.env.example / claude-cli.js env passthrough' },
 
diff --git a/docker-compose.yml b/docker-compose.yml
index f90ac15a..b2f5feff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,12 +36,12 @@ services:
       # instead, so edits here land in the real source and a redeploy of hh
       # picks them up directly — chowned to uid/gid 1000 (this container's
       # `node` user) so it's actually writable, not just readable.
-      - /etc/easypanel/projects/hh/hh/code:/app/workspace/hh
+      - /etc/easypanel/projects/main/hh/code:/app/workspace/hh
       # hh's live runtime data (hh.ru sessions/tokens, resumes, etc.) — read-only:
       # letting an unrelated container write into it risks corrupting whatever
       # hh itself is concurrently reading/writing (e.g. a sqlite file), and
       # there's no reason this side needs write access to see it.
-      - /etc/easypanel/projects/hh/hh/volumes/hh-data:/app/workspace/hh-data:ro
+      - /etc/easypanel/projects/main/hh/volumes/hh-data:/app/workspace/hh-data:ro
     environment:
       - PORT=3000
       # Inside the container the app must listen on all interfaces, otherwise the
diff --git a/docs/bot-engine.md b/docs/bot-engine.md
index 77a670b7..41aef7a7 100644
--- a/docs/bot-engine.md
+++ b/docs/bot-engine.md
@@ -1,38 +1,49 @@
-# Per-bot engine
+# A bot's model and engine
 
-A bot can pin its own billing engine, independent of the chat:
+There is no engine setting — not on a chat, a task or a bot. **The model's provider decides the
+engine** (`server.js runEngineFor`, `providers.engineForModel`):
 
-| Bot setting | Runs on |
+| The model belongs to | Runs on |
 |---|---|
-| **Same as chat** (default) | the chat's engine: API or Claude subscription |
-| **API** | headless `claude -p` through `ANTHROPIC_BASE_URL` / the configured token |
-| **Claude subscription** | an interactive `claude` in a tmux pane, signed in with the server's Claude login |
+| **Claude (CLI login)** — the built-in provider, marked *subscription* | an interactive `claude` in a tmux pane, signed in with the server's Claude login (billed on the subscription) |
+| any other provider — an Anthropic key ("Claude API"), a gateway, anything OpenAI-compatible — marked *API* | headless `claude -p`, routed to that provider (see `docs/providers.md`) |
 
-The typical use is one bot (a planner) on the subscription while the chat and every other bot stay on the API.
+Without `tmux` on the server the CLI login still works, headless. Every list that offers a
+model — the toolbar picker, the bot editor, Kanban, Schedule, Telegram `/model`, the Providers
+sidebar — marks each provider *subscription* or *API*, so the choice of model is the choice of
+engine.
 
-## Where it applies
-
-- Web chat: `@@mentions` and the room (`conversation` mode). A pinned bot gets its own pane (`<chat>::room::<bot>` / `<chat>::<bot>`), killed right after its turn, exactly as in a subscription chat.
-- **Not** Telegram: its bot runner has no WebSocket to stream a pane into, so a pinned bot follows the chat there.
-- Without `tmux` on the server a "Claude subscription" bot follows the chat instead of failing every turn.
-- The room's own headless calls (choosing who sits, the closing step's prompt) still follow the chat engine.
-
-## Things to know
+## The bot editor
 
-- The subscription engine removes `ANTHROPIC_BASE_URL`, `ANTHROPIC_AUTH_TOKEN` and `ANTHROPIC_API_KEY` from the pane's environment (`claude-interactive.js`), so it uses the stored login, not the gateway.
-- There is no headless call on the subscription, so `--json-schema` is unavailable to such a bot; give it an MCP tool that validates its input instead.
-- Tasks on the Kanban board have their own `run_engine`. A bot's setting does not change how its cards run, and a card created by a subscription task inherits that task's engine unless the creator sets one.
-- `model` is per bot too: on the subscription it is a real Claude model (`haiku`/`sonnet`/`opus`/`fable`), on the API it is whatever the gateway maps that alias to.
+One **Model** button opens the same picker as the chat toolbar, with **Same as chat** on top.
+"Same as chat" follows the chat the bot answers in; anything else pins that model (stored as the
+toolbar stores it: a bare alias of the default provider, or `provider::model`). The typical use
+is one bot (a planner) on `Claude (CLI login) · Opus` while the chat and every other bot stay
+on an API provider.
 
-API: `PUT /api/bots/:id { "runEngine": "subscription" | "api" | "" }` (`""` = same as chat; omitted = unchanged). Exported and imported with the bot as `run_engine`.
-
-## Model per bot
-
-The bot editor offers, next to the engine, a model list built from two sources:
+## Where it applies
 
-- **Claude aliases** (`haiku`, `sonnet`, `opus`, `fable`) — valid on both engines.
-- **Gateway models** — the catalogue of the gateway the `claude` CLI talks to (`GET /api/models`, read from `ANTHROPIC_BASE_URL/v1/models` with the server's own token, cached for 10 minutes). Shown for "API" and "Same as chat"; hidden for "Subscription". A model the gateway reports without `tools` is labelled as such (a bot without tools cannot read or write the project).
+- Web chat: `@@mentions` and the room (`conversation` mode). A bot on a subscription model gets
+  its own pane (`<chat>::room::<bot>` / `<chat>::<bot>`), killed right after its turn, exactly
+  as in a subscription chat.
+- **Not** Telegram: its bot runner has no WebSocket to stream a pane into, so there every bot
+  follows the chat's engine (a Claude model then runs headless on the CLI login).
+- The room's own headless calls (choosing who sits, the closing step's prompt) follow the chat.
 
-The `claude` CLI passes any `--model <id>` to the gateway unchanged, so pinning e.g. `poolside/laguna-s-2.1:free` really selects that model instead of whatever the gateway maps `sonnet` to.
+## Things to know
 
-A gateway id on a bot that ends up on the subscription (its own setting, or the chat's) is meaningless there: the turn uses the chat's model, and the header shows that model rather than the pinned one. If the gateway is unreachable the editor still opens with the aliases, and a stored model that is no longer offered stays selectable. `model` must match `[A-Za-z0-9._:/-]{1,100}`.
+- The subscription engine removes every provider variable (`ANTHROPIC_BASE_URL`, tokens, keys)
+  from the pane's environment (`claude-interactive.js`), so it uses the stored login.
+- There is no headless call on the subscription, so `--json-schema` is unavailable to such a
+  bot; give it an MCP tool that validates its input instead.
+- Kanban tasks follow the same rule with their own model chain
+  (`bot.model || session.model || task.model`), so a card run by that bot runs where the bot does.
+
+## Upgrading from the engine dial
+
+The old per-chat/task/bot "Subscription" choice is converted once at boot
+(`migrateEngineDial`, flag `engineDialMigrated` in `provider_settings`): where it was chosen,
+the model becomes `claude::<model>` (`providers.toClaudeRef`) and `tasks`/`bots.run_engine` is
+cleared. An older client or export file that still sends `runEngine: "subscription"` gets the
+same conversion on save/import. `sessions.run_engine` now records the engine the chat's last
+turn ran on (the session bar's Max badge and the engine-pane entry point read it).
diff --git a/docs/providers.md b/docs/providers.md
new file mode 100644
index 00000000..deeef583
--- /dev/null
+++ b/docs/providers.md
@@ -0,0 +1,127 @@
+# Providers and the LLM bridge
+
+Every run in the studio — chat, multi-agent, rooms, `@@bots`, Kanban tasks, schedules,
+Telegram, the utility calls (titles, compaction, translation) — is the `claude` CLI. The
+CLI is what gives each mode its tools, MCP servers, hooks, session resume and
+compaction. "Another provider" therefore means "another endpoint and model **for this
+run**": the registry decides it, the spawn applies it, and for anything that does not
+speak the Anthropic Messages API the **LLM bridge** translates.
+
+```
+chat / task / bot / room / Telegram
+        │ model = "deepseek::deepseek-chat" (or a bare alias like "sonnet")
+server.js  resolveRunTarget()  ← providers.js rules, providers-store.js rows
+        │ ANTHROPIC_BASE_URL = http://127.0.0.1:<bridge>   ANTHROPIC_AUTH_TOKEN = ccsr_<run token>
+claude CLI ─────────────► llm-bridge (separate node process, loopback only)
+                             ├─ passthrough → Anthropic API / Anthropic-compatible endpoints
+                             ├─ translate   → OpenAI-compatible endpoints (/chat/completions)
+                             └─ usage       → llm_usage (SQLite)
+Claude subscription (CLI login) never goes through the bridge.
+```
+
+## Provider types
+
+| Type | Reached by | Notes |
+|---|---|---|
+| `claude-subscription` | the CLI's own login (OAuth) | Built-in row `claude`, marked **subscription**: its models run on the tmux Subscription engine (headless without tmux). |
+| `anthropic` | bridge, passthrough | Anthropic API key. |
+| `anthropic-compatible` | bridge, passthrough | Any `/v1/messages` endpoint: a gateway such as kilo-gateway, or the Anthropic endpoints of DeepSeek, Kimi, GLM, MiniMax. For Claude Code these are more faithful than translation. |
+| `openai-compatible` | bridge, **translation** | `/chat/completions`: OpenAI, OpenRouter, Gemini, Qwen, Groq, Mistral, xAI, Ollama, LM Studio, vLLM… A **dialect** describes how effort, reasoning and the token limit are sent. |
+
+On first start the registry is seeded from the environment: `ANTHROPIC_BASE_URL` (+ its
+token) becomes provider `gateway`, the **default** — that is what every run used before,
+so a bare `sonnet` stored in an old row keeps landing on the same endpoint. An env-seeded
+row follows the env on later boots until it is edited in the UI.
+
+**Engine = the model's provider.** There is no engine dial anywhere: a model of the CLI login
+runs on the tmux Subscription engine, a model of any other provider (marked **API**) runs
+headless (`providers.engineForModel`, `server.js runEngineFor`). Two Claude providers can
+coexist — the CLI login (subscription) and an Anthropic key (preset "Claude API") — and the
+picker shows which is which. See `docs/bot-engine.md` for bots and the one-time migration.
+
+## Model references
+
+One string, everywhere a model already travelled (`sessions.model`, `tasks.model`,
+`bots.model`, WS frames, MCP `create_task`, plan files, bot exports):
+
+- `provider::model` — e.g. `deepseek::deepseek-chat`, `kilo::z-ai/glm-5:free`;
+- a bare value — `sonnet`, or an old gateway id — resolved on the **default** provider.
+
+On a provider that does not serve Claude, an alias maps through its **roles**:
+`haiku → fast`, `sonnet`/`fable → main`, `opus → strong`. A chat pinned to a provider that
+was deleted or switched off runs on the default and says so (`provider_notice`).
+
+## What reaches the CLI per run
+
+`providers.buildRunEnv()` first strips every provider variable the server itself inherited,
+then sets the run's own:
+
+| Variable / flag | Value | Why |
+|---|---|---|
+| `ANTHROPIC_BASE_URL`, `ANTHROPIC_AUTH_TOKEN` | bridge URL, run token | the real key never enters the agent's environment |
+| `ANTHROPIC_DEFAULT_{HAIKU,SONNET,OPUS,FABLE}_MODEL`, `ANTHROPIC_SMALL_FAST_MODEL` | provider roles | the CLI's own background calls and sub-agents ask for Claude aliases |
+| `CLAUDE_CODE_SUBAGENT_MODEL` | role `subagent` if set | Task sub-agents |
+| `CLAUDE_CODE_MAX_CONTEXT_TOKENS` | model context window | for an unknown id the CLI assumes 200K and compacts on that |
+| `CLAUDE_CODE_MAX_OUTPUT_TOKENS` | `min(maxOutput, 32000)` | the CLI asks for 32–128K |
+| `CLAUDE_CODE_DISABLE_THINKING` | model cannot reason | |
+| `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` | OpenAI-compatible, or `stripBetas` | fewer fields a foreign backend does not know |
+| `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` | non-Anthropic (unless `quietCli: false`) | no traffic around the bridge |
+| `API_TIMEOUT_MS` | provider option | slow reasoning models |
+| `--disallowedTools WebSearch` | non-Anthropic | an Anthropic server tool; the `web` MCP server (SearXNG) replaces it |
+
+The bridge takes **effort** from the run (the toolbar's dial), not from the request: the
+CLI sends `effort: "high"` even when no `--effort` was given. `Auto` means "send none".
+
+## What the bridge maps (OpenAI-compatible)
+
+System blocks → one system message (the per-request billing header dropped for prompt
+caching) · text / images (vision-gated) / PDFs (file parts or a placeholder) · `tool_use` →
+`tool_calls` · `tool_result` → `role: tool` (images move to a following user message,
+`is_error` is labelled) · reasoning echoed back per dialect (`reasoning_content` /
+`reasoning_details`) via the thinking-block signature · tool schemas sanitised, long tool
+names mapped · `tool_choice`, parallel calls · `max_tokens` / `max_completion_tokens`
+clamped · sampling params per dialect · `metadata.user_id` hashed · streaming with pings
+every 15 s, tool calls buffered so interleaved deltas cannot mix, broken argument JSON
+repaired · `stop_reason`, usage with cached tokens · errors canonicalised: context overflow →
+`prompt is too long` (the CLI compacts), a spent balance → `credit balance is too low`
+(the task pauses, no retries), 429 with `Retry-After`, 5xx/transport → 529 (the CLI retries).
+
+## Security model
+
+- Keys are encrypted at rest with the SSH-host key (`data/hosts.key`, AES-256-GCM); the API
+  answers `hasKey` and masks secret-looking header values.
+- The CLI sees only a run token, valid on 127.0.0.1 for the run's lifetime (+5 s).
+- **Limit, stated:** the agent runs with a shell in the same container as the studio, so a
+  determined agent can still read the data directory. The run token closes accidental
+  leaks (a key printed to a log, committed, sent in a report), not deliberate extraction —
+  the same boundary SSH host passwords and the Telegram token already live behind.
+
+## Operating it
+
+- **Sidebar → Providers**: add (presets), test before saving, default ★, per-model
+  capabilities and prices, a probe (a forced tool call + a short reply through the bridge),
+  the utility model, 30-day usage.
+- **Toolbar**: one model button; its picker lists every provider's models (the default
+  provider first), each provider marked *subscription* or *API* — that mark is the engine.
+  Effort is off for a model that cannot reason. The bot editor, Kanban and Schedule use the
+  same marks.
+- **Telegram**: `/model`, `/effort`.
+- `GET /api/llm-bridge/log` — the last 200 bridge requests (no content).
+- `CCS_BRIDGE=off` disables the bridge (Anthropic-type providers then run with their key in
+  the CLI env, as before this registry; OpenAI-compatible ones cannot run).
+- `CCS_BRIDGE_PORT` pins the bridge port (default: ephemeral, reused across child restarts).
+
+## Upgrading the CLI
+
+The Dockerfile pins `@anthropic-ai/claude-code` (`CLAUDE_CODE_VERSION`) and CI installs the
+same version so `test/llm-bridge-contract.test.js` drives the real binary through the bridge.
+Bump both together, and look at the captured request fixture in
+`test/fixtures/llm-bridge/` when a new CLI changes its request shape.
+
+## Not covered yet
+
+- SSH projects: the remote `claude` runs on that host's own login/config; a provider ref is
+  passed as its bare model id.
+- The tmux Subscription engine runs Claude's own login only — which is exactly the provider
+  marked *subscription*.
+- External agents (`externalAgents`, delegation) keep their own CLIs and credentials.
diff --git a/electron-builder.yml b/electron-builder.yml
index cb2d7227..7b9c99e4 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -27,6 +27,9 @@ asarUnpack:
   # level deeper than the entry point: mcp-bots.js unpacked fine and still died on
   # `Cannot find module './bots.js'`. Pinned by test/asar-helpers.test.js.
   - "bots.js"
+  # The LLM bridge child (server.js spawns llm-bridge/child.js with the plain `node`).
+  # It requires only its own directory and Node core modules.
+  - "llm-bridge/**"
 
 files:
   - "**/*"
diff --git a/llm-bridge/child.js b/llm-bridge/child.js
new file mode 100644
index 00000000..4d4409a8
--- /dev/null
+++ b/llm-bridge/child.js
@@ -0,0 +1,128 @@
+'use strict';
+// The bridge child process: runs createBridgeServer, supervised by host.js over Node IPC.
+// A separate process so a translator bug, a runaway upstream or a memory spike cannot take the
+// studio down with it — the host restarts us on the same port and re-sends the live runs.
+//
+// IPC, host -> child:  init {port, host, runs, options} | run {ctx} | release {token}
+//                      providers {map} | lookup-reply {id, ctx} | recent-log {id} | stop
+// IPC, child -> host:  ready {port, pid} | fatal {error} | usage {record} | lookup {id, token}
+//                      recent-log-reply {id, entries}
+// Logs go to stderr as "[level] message" lines; the host forwards them to its own log.
+//
+// Unknown token: the host's registry is the source of truth, so the child ASKS (lookup) instead
+// of answering 401 — registerRun() returns synchronously and the CLI may connect before the
+// `run` message was processed here. Whichever arrives first, the answer is the same.
+
+const { createBridgeServer } = require('./server');
+
+const TOKEN_RE = /^ccsr_[0-9a-f]{48}$/;
+const LOOKUP_TIMEOUT_MS = 2000;
+
+function line(level, msg) {
+  const text = String(msg && msg.stack ? msg.stack : msg);
+  for (const l of text.split('\n')) process.stderr.write(`[${level}] ${l}\n`);
+}
+let debugOn = !!process.env.CCS_LLM_BRIDGE_DEBUG;
+const log = {
+  debug: (m) => { if (debugOn) line('debug', m); },
+  info: (m) => line('info', m),
+  warn: (m) => line('warn', m),
+  error: (m) => line('error', m),
+};
+
+if (typeof process.send !== 'function') {
+  line('error', 'llm-bridge child must be started with an IPC channel (stdio "ipc")');
+  process.exit(2);
+}
+
+const runs = new Map();
+const lookups = new Map();
+let lookupSeq = 0;
+let srv = null;
+let shuttingDown = false;
+
+function send(msg) {
+  if (!process.connected) return;
+  try { process.send(msg, (err) => { if (err) { /* channel closing; 'disconnect' ends us */ } }); } catch { /* same */ }
+}
+
+function getRun(token) {
+  const hit = runs.get(token);
+  if (hit) return hit;
+  if (!TOKEN_RE.test(token) || !process.connected) return null;
+  return new Promise((resolve) => {
+    const id = ++lookupSeq;
+    const timer = setTimeout(() => { lookups.delete(id); resolve(null); }, LOOKUP_TIMEOUT_MS);
+    lookups.set(id, { resolve, timer });
+    send({ t: 'lookup', id, token });
+  });
+}
+
+async function start(msg) {
+  try {
+    if (srv) return; // a second init (should not happen) must not open a second listener
+    for (const r of msg.runs || []) if (r && r.token) runs.set(r.token, r);
+    const options = msg.options || {};
+    if (options.debug) debugOn = true;
+    srv = createBridgeServer({
+      getRun,
+      onUsage: (record) => send({ t: 'usage', record }),
+      log,
+      pingIntervalMs: options.pingIntervalMs,
+      retryDelayMs: options.retryDelayMs != null ? () => options.retryDelayMs : undefined,
+    });
+    const { port } = await srv.listen(msg.port || 0, msg.host || '127.0.0.1');
+    send({ t: 'ready', port, pid: process.pid });
+  } catch (e) {
+    send({ t: 'fatal', error: `${e.code || ''} ${e.message}`.trim() });
+    setTimeout(() => process.exit(3), 100);
+  }
+}
+
+function shutdown(code) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  const bye = setTimeout(() => process.exit(code), 2000);
+  bye.unref();
+  Promise.resolve(srv && srv.close()).catch(() => {}).then(() => process.exit(code));
+}
+
+process.on('message', (msg) => {
+  if (!msg || typeof msg !== 'object') return;
+  try {
+    switch (msg.t) {
+      case 'init': start(msg); break;
+      case 'run': if (msg.ctx && msg.ctx.token) runs.set(msg.ctx.token, msg.ctx); break;
+      case 'release': runs.delete(msg.token); break;
+      case 'providers':
+        for (const ctx of runs.values()) {
+          const next = ctx.provider && msg.map && msg.map[ctx.provider.id];
+          if (next) ctx.provider = next;
+        }
+        break;
+      case 'lookup-reply': {
+        const w = lookups.get(msg.id);
+        if (!w) break;
+        lookups.delete(msg.id);
+        clearTimeout(w.timer);
+        if (msg.ctx && msg.ctx.token) runs.set(msg.ctx.token, msg.ctx);
+        w.resolve(msg.ctx || null);
+        break;
+      }
+      case 'recent-log': send({ t: 'recent-log-reply', id: msg.id, entries: srv ? srv.recentLog() : [] }); break;
+      case 'stop': shutdown(0); break;
+      default: break;
+    }
+  } catch (e) {
+    log.error(`[llm-bridge] bad IPC message ${msg.t}: ${e.message}`);
+  }
+});
+
+// The parent died (or closed the channel): nobody can register runs or read usage any more.
+process.on('disconnect', () => shutdown(0));
+
+// Per-request failures are caught where they happen (a malformed request is a 400/500, never a
+// crash). Anything reaching here is a bug with unknown blast radius: log it and let the host
+// restart a clean process.
+process.on('uncaughtException', (e) => { log.error(`[llm-bridge] uncaught exception: ${(e && e.stack) || e}`); process.exit(1); });
+process.on('unhandledRejection', (e) => { log.error(`[llm-bridge] unhandled rejection: ${(e && e.stack) || e}`); });
diff --git a/llm-bridge/dialects.js b/llm-bridge/dialects.js
new file mode 100644
index 00000000..9a3a0455
--- /dev/null
+++ b/llm-bridge/dialects.js
@@ -0,0 +1,92 @@
+'use strict';
+// Per-provider quirks of "OpenAI-compatible" APIs, as DATA. The translator never branches on a
+// provider name — only on these fields — so a new provider is a table row (or a few
+// `provider.options` overrides), not a code change.
+//
+// Fields:
+//   maxTokensField            'max_tokens' | 'max_completion_tokens' (OpenAI reasoning models refuse max_tokens)
+//   effortParam               how reasoning effort is expressed upstream:
+//                               'reasoning_effort'  top-level string (OpenAI, Gemini compat, most gateways)
+//                               'reasoning'         OpenRouter object  reasoning:{effort} / {enabled:false}
+//                               'thinking'          DeepSeek-style     thinking:{type:'enabled'|'disabled'}
+//                               'enable_thinking'   Qwen/DashScope     enable_thinking + thinking_budget
+//                               'none'              never sent
+//   effortRequiresCaps        only send effort when the model's caps say reasoning === true (Ollama:
+//                             a non-reasoning local model 400s on an unknown knob)
+//   effortMap                 Anthropic effort -> upstream value; null = omit the parameter
+//   reasoningEcho             how our own thinking blocks go back upstream in history:
+//                             'reasoning_content' | 'reasoning_details' | 'none'
+//   allowTopK                 forward top_k
+//   dropSamplingWithReasoning drop temperature/top_p when reasoning is on (OpenAI o-series/gpt-5 400 on them)
+//   schemaSanitize            'none' | 'basic' | 'strict' (see schema.js)
+//   toolIdStyle               'passthrough' | 'mistral9' (Mistral wants 9-char alnum tool_call ids)
+//   fileParts                 PDFs can go up as {type:'file'} content parts
+//   streamUsage               ask for usage in the stream (stream_options.include_usage)
+//   usageInclude              also send usage:{include:true} (OpenRouter's own switch for usage accounting)
+//   cacheControl              keep Anthropic cache_control markers on content parts (OpenRouter forwards
+//                             them to Anthropic/Gemini backends); everyone else gets them stripped
+//   upstreamStream            always stream upstream, even for a non-stream client request (idle
+//                             watchdog instead of one long silent wait); false = plain JSON call
+//   systemFold                'leading' = fold system-role entries that come before the first assistant
+//                             turn into the system prompt, later ones become user text (keeps the
+//                             prefix stable for provider-side prompt caching); 'all' = fold every one
+//   noUserAfterTool           a user text message may not directly follow tool messages (Mistral):
+//                             such text is appended to the last tool message instead
+//   sendUser                  send metadata.user_id (hashed) as `user`; off where the API rejects
+//                             unknown fields (Mistral answers 422 "Extra inputs are not permitted")
+
+const BASE_EFFORT = { low: 'low', medium: 'medium', high: 'high', xhigh: 'high', max: 'high', none: null };
+
+const DEFAULTS = {
+  maxTokensField: 'max_tokens',
+  effortParam: 'reasoning_effort',
+  effortRequiresCaps: false,
+  effortMap: BASE_EFFORT,
+  reasoningEcho: 'none',
+  allowTopK: false,
+  dropSamplingWithReasoning: false,
+  schemaSanitize: 'basic',
+  toolIdStyle: 'passthrough',
+  fileParts: false,
+  streamUsage: true,
+  usageInclude: false,
+  cacheControl: false,
+  upstreamStream: true,
+  systemFold: 'leading',
+  noUserAfterTool: false,
+  sendUser: true,
+};
+
+const PRESETS = {
+  generic: {},
+  openai: {
+    maxTokensField: 'max_completion_tokens', dropSamplingWithReasoning: true, fileParts: true,
+    effortMap: { ...BASE_EFFORT, none: 'none' },
+  },
+  openrouter: {
+    effortParam: 'reasoning', reasoningEcho: 'reasoning_details', allowTopK: true, fileParts: true, cacheControl: true, usageInclude: true,
+    effortMap: { ...BASE_EFFORT, none: 'none' },
+  },
+  deepseek: { effortParam: 'thinking', reasoningEcho: 'reasoning_content' },
+  gemini: { schemaSanitize: 'strict', sendUser: false, effortMap: { ...BASE_EFFORT, none: 'none' } },
+  qwen: { effortParam: 'enable_thinking', reasoningEcho: 'reasoning_content' },
+  // Mistral validates strictly (422 on unknown fields) and reports usage in the last chunk anyway
+  mistral: { effortParam: 'none', toolIdStyle: 'mistral9', noUserAfterTool: true, sendUser: false, streamUsage: false },
+  ollama: { effortParam: 'reasoning_effort', effortRequiresCaps: true, allowTopK: true },
+};
+
+const FIELDS = Object.keys(DEFAULTS);
+
+/** The effective dialect for a provider: preset (by provider.dialect) + any provider.options overrides. */
+function resolveDialect(provider) {
+  const name = provider && PRESETS[provider.dialect] ? provider.dialect : 'generic';
+  const d = { name, ...DEFAULTS, ...PRESETS[name] };
+  const opts = (provider && provider.options) || {};
+  for (const f of FIELDS) {
+    if (opts[f] === undefined) continue;
+    d[f] = f === 'effortMap' && opts[f] && typeof opts[f] === 'object' ? { ...d.effortMap, ...opts[f] } : opts[f];
+  }
+  return d;
+}
+
+module.exports = { DEFAULTS, PRESETS, FIELDS, resolveDialect };
diff --git a/llm-bridge/errors.js b/llm-bridge/errors.js
new file mode 100644
index 00000000..8daf5966
--- /dev/null
+++ b/llm-bridge/errors.js
@@ -0,0 +1,111 @@
+'use strict';
+// Upstream OpenAI-style error -> the Anthropic HTTP error Claude Code knows how to act on.
+// The CLI's behaviour hangs on status + type + a few exact phrases, so this is where a provider
+// failure becomes the right CLI reaction:
+//   "prompt is too long: N tokens > M maximum" (400)  -> the CLI compacts / trims instead of dying
+//   credit balance too low (400)                      -> the CLI stops, no retry; the studio sees a usage limit
+//   429 / 5xx / 529                                   -> the CLI's own retry-with-backoff
+// Every message names the provider, so a failure is never mistaken for Anthropic's own.
+
+const { anthropicError, errorTypeFor } = require('./util');
+
+const OVERFLOW_RE = /context[ _-]?length|maximum context|context window|too many tokens|prompt is too long|reduce the length|input is too long|exceeds? the (?:model'?s? )?(?:maximum )?(?:context|token limit)/i;
+const QUOTA_RE = /insufficient[_ ]quota|insufficient[_ ]balance|out of credits|requires more credits|billing|credit balance is too low/i;
+
+const prefix = (label) => `provider "${label}": `;
+
+/** Pull {message, code, status} out of the many error body shapes providers use. */
+function parseErrorBody(text) {
+  let j = null;
+  try { j = JSON.parse(text); } catch { /* not JSON */ }
+  if (Array.isArray(j)) j = j[0]; // Gemini's compat layer answers [{error:{…}}]
+  let err = j && typeof j === 'object' ? (j.error !== undefined ? j.error : j) : null;
+  let message = '';
+  let code = null;
+  if (typeof err === 'string') message = err;
+  else if (err && typeof err === 'object') {
+    message = err.message || err.msg || err.detail || (j && j.message) || '';
+    code = err.code != null ? err.code : (err.type || err.status || null);
+    // OpenRouter wraps the real provider error: {message:"Provider returned error", metadata:{raw:"…"}}
+    const raw = err.metadata && err.metadata.raw;
+    if (raw) message = `${message} (${String(typeof raw === 'string' ? raw : JSON.stringify(raw)).slice(0, 600)})`;
+  }
+  if (!message && typeof text === 'string') message = text.trim().slice(0, 500);
+  if (typeof message !== 'string') message = JSON.stringify(message);
+  return { message: message.slice(0, 2000), code: code == null ? null : String(code) };
+}
+
+const toInt = (s) => Number(String(s).replace(/[,_\s]/g, ''));
+
+/** "prompt is too long: N tokens > M maximum" — numbers from the upstream text when it has them. */
+function overflowMessage(message, estimate, contextWindow) {
+  let n = null;
+  let m = null;
+  const pairs = [
+    [/(\d[\d,]*)\s*tokens?\s*>\s*(\d[\d,]*)/i, 1, 2],
+    [/maximum context length is (\d[\d,]*)[\s\S]*?(?:requested|resulted in|have|contains?) (\d[\d,]*)/i, 2, 1],
+    [/(?:requested|input of|input length|prompt has|contains?) (\d[\d,]*)[\s\S]*?(?:maximum|limit|context window|context length)[^\d]{0,30}(\d[\d,]*)/i, 1, 2],
+  ];
+  for (const [re, ni, mi] of pairs) {
+    const x = re.exec(message);
+    if (x) { n = toInt(x[ni]); m = toInt(x[mi]); break; }
+  }
+  if (!(n > 0 && m > 0)) {
+    const nums = (message.match(/\d[\d,]{2,}/g) || []).map(toInt).filter((v) => v >= 1000);
+    if (nums.length >= 2) { n = Math.max(...nums); m = Math.min(...nums); }
+    else {
+      m = contextWindow || (nums[0] || null);
+      n = estimate || null;
+    }
+  }
+  if (!(m > 0)) m = Math.max(1, (n || 2) - 1);
+  if (!(n > m)) n = m + 1; // the CLI computes how much to drop from N - M; it must be positive
+  return `prompt is too long: ${n} tokens > ${m} maximum`;
+}
+
+/**
+ * @param {{status:number, bodyText:string, headers?:object, label:string, contextWindow?:number, estimate?:number}} o
+ * @returns {{status:number, body:object, headers:object, errorType:string}}
+ */
+function canonicalizeError({ status, bodyText, headers = {}, label, contextWindow = null, estimate = null }) {
+  const { message, code } = parseErrorBody(bodyText == null ? '' : String(bodyText));
+  const msg = message || `HTTP ${status}`;
+  const out = (st, type, text, extra = {}) => ({ status: st, body: anthropicError(type, prefix(label) + text), headers: extra, errorType: type });
+
+  if (code === 'context_length_exceeded' || OVERFLOW_RE.test(msg)) {
+    return out(400, 'invalid_request_error', overflowMessage(msg, estimate, contextWindow));
+  }
+  if (status === 402 || QUOTA_RE.test(`${code || ''} ${msg}`)) {
+    return out(400, 'invalid_request_error', `Your credit balance is too low (insufficient_quota): ${msg}`);
+  }
+  const retryAfter = headers['retry-after'];
+  switch (status) {
+    case 401: return out(401, 'authentication_error', `invalid api key (${msg})`);
+    case 403: return out(403, 'permission_error', msg);
+    case 404: return out(404, 'not_found_error', msg);
+    case 413: return out(413, 'request_too_large', msg);
+    case 429: return out(429, 'rate_limit_error', msg, retryAfter ? { 'retry-after': retryAfter } : {});
+    case 400: case 422: return out(400, 'invalid_request_error', msg);
+    case 500: case 502: case 504: return out(status, 'api_error', msg);
+    case 503: case 529: return out(529, 'overloaded_error', msg);
+    default:
+      if (/overloaded/i.test(`${code || ''} ${msg}`)) return out(529, 'overloaded_error', msg);
+      if (status >= 500) return out(500, 'api_error', msg);
+      return out(400, 'invalid_request_error', msg);
+  }
+}
+
+/** Transport failure (refused, reset, DNS, idle timeout) -> 529, which the CLI retries. */
+function transportError(err, label) {
+  const why = err && err.code ? `${err.code}${err.message && err.message !== err.code ? ` (${err.message})` : ''}` : String((err && err.message) || err);
+  return { status: 529, body: anthropicError('overloaded_error', `${prefix(label)}upstream unreachable: ${why}`), headers: {}, errorType: 'overloaded_error' };
+}
+
+/** A mid-stream `{"error":…}` chunk -> the same mapping, status from its numeric code when it has one. */
+function streamChunkError(errObj, label, opts = {}) {
+  const codeNum = errObj && typeof errObj === 'object' ? Number(errObj.code || errObj.status) : NaN;
+  const status = Number.isInteger(codeNum) && codeNum >= 400 && codeNum < 600 ? codeNum : 500;
+  return canonicalizeError({ status, bodyText: JSON.stringify({ error: errObj }), label, ...opts });
+}
+
+module.exports = { canonicalizeError, transportError, streamChunkError, parseErrorBody, overflowMessage, OVERFLOW_RE, QUOTA_RE, errorTypeFor };
diff --git a/llm-bridge/estimate.js b/llm-bridge/estimate.js
new file mode 100644
index 00000000..798890de
--- /dev/null
+++ b/llm-bridge/estimate.js
@@ -0,0 +1,85 @@
+'use strict';
+// Input-token estimate for requests to providers we cannot tokenize for: message_start's
+// input_tokens (the CLI's context meter reads it), count_tokens, and usage when the upstream
+// never reports any. chars/3.6 is a middle ground between English prose (~4) and code/JSON (~3).
+// A per-session EMA of real/estimated then corrects it once real usage has been seen.
+
+const CHARS_PER_TOKEN = 3.6;
+const IMAGE_TOKENS = 1600;
+const PER_MESSAGE = 3;
+
+function charsOfBlock(b) {
+  if (!b || typeof b !== 'object') return typeof b === 'string' ? b.length : 0;
+  switch (b.type) {
+    case 'text': return (b.text || '').length;
+    case 'thinking': return (b.thinking || '').length;
+    case 'tool_use': return (b.name || '').length + JSON.stringify(b.input || {}).length;
+    case 'tool_result': return charsOfContent(b.content);
+    case 'image': case 'document': return 0; // counted as images below
+    default: return JSON.stringify(b).length;
+  }
+}
+
+function charsOfContent(c) {
+  if (typeof c === 'string') return c.length;
+  if (!Array.isArray(c)) return 0;
+  let n = 0;
+  for (const b of c) n += charsOfBlock(b);
+  return n;
+}
+
+function imagesOf(c) {
+  if (!Array.isArray(c)) return 0;
+  let n = 0;
+  for (const b of c) {
+    if (!b || typeof b !== 'object') continue;
+    if (b.type === 'image' || b.type === 'document') n++;
+    else if (b.type === 'tool_result') n += imagesOf(b.content);
+  }
+  return n;
+}
+
+/** Raw (uncalibrated) estimate of an Anthropic Messages request body. */
+function estimateInputTokens(body) {
+  if (!body || typeof body !== 'object') return 1;
+  let chars = 0, images = 0;
+  const sys = body.system;
+  if (typeof sys === 'string') chars += sys.length;
+  else if (Array.isArray(sys)) chars += charsOfContent(sys);
+  const msgs = Array.isArray(body.messages) ? body.messages : [];
+  for (const m of msgs) {
+    if (!m || typeof m !== 'object') continue;
+    chars += charsOfContent(m.content);
+    images += imagesOf(m.content);
+  }
+  if (Array.isArray(body.tools)) for (const t of body.tools) chars += JSON.stringify(t || {}).length;
+  return Math.max(1, Math.ceil(chars / CHARS_PER_TOKEN) + images * IMAGE_TOKENS + PER_MESSAGE * msgs.length);
+}
+
+/** Output-token estimate from produced text (used only when the upstream reports no usage). */
+const estimateTextTokens = (chars) => Math.max(1, Math.ceil(chars / CHARS_PER_TOKEN));
+
+/**
+ * Per-key calibration. `key` is the CLI session id (x-claude-code-session-id) or the run id, so the
+ * correction learned on one conversation's real usage applies to its next request.
+ */
+function createCalibrator({ max = 500, alpha = 0.3 } = {}) {
+  const ratios = new Map();
+  return {
+    apply(key, raw) {
+      const r = key != null ? ratios.get(key) : undefined;
+      return Math.max(1, Math.round(r ? raw * r : raw));
+    },
+    observe(key, raw, real) {
+      if (key == null || !(raw > 0) || !(real > 0)) return;
+      const ratio = Math.min(3, Math.max(0.3, real / raw));
+      const prev = ratios.get(key);
+      ratios.delete(key); // re-insert = most recently used at the end
+      ratios.set(key, prev ? prev * (1 - alpha) + ratio * alpha : ratio);
+      if (ratios.size > max) ratios.delete(ratios.keys().next().value);
+    },
+    ratio: (key) => ratios.get(key) || null,
+  };
+}
+
+module.exports = { estimateInputTokens, estimateTextTokens, createCalibrator, CHARS_PER_TOKEN, IMAGE_TOKENS };
diff --git a/llm-bridge/host.js b/llm-bridge/host.js
new file mode 100644
index 00000000..d07800e0
--- /dev/null
+++ b/llm-bridge/host.js
@@ -0,0 +1,307 @@
+'use strict';
+// Supervisor for the bridge child, living in the studio process.
+//
+//   const host = createBridgeHost({ onUsage, log });
+//   await host.start();
+//   const token = host.registerRun(ctx);           // synchronous
+//   spawn claude with ANTHROPIC_BASE_URL=host.baseUrl(), ANTHROPIC_AUTH_TOKEN=token
+//   host.releaseRun(token);                         // when the run ends (5 s grace)
+//
+// The child is spawned with the plain `nodeCmd` and stdio ['ignore','pipe','pipe','ipc'] — NOT
+// child_process.fork: the packaged desktop app runs this module under Electron, whose fork
+// would start another Electron. The studio's MCP helpers are spawned the same way.
+//
+// The HOST's registry is the source of truth for run tokens. The child keeps a copy (sent on
+// init, on every registerRun, and again after a restart) and asks the host about any token it
+// does not know, so a request that beats the `run` message over IPC still authenticates.
+//
+// Restarts: backoff 1 s, 2 s, 5 s, 10 s, 30 s (reset after 60 s of uptime), always on the SAME
+// port — live CLI processes have that port in their ANTHROPIC_BASE_URL. Five failures within two
+// minutes and the host gives up: running() false, baseUrl() null, one warn line; the server
+// falls back.
+
+const crypto = require('crypto');
+const path = require('path');
+const readline = require('readline');
+const { spawn } = require('child_process');
+const { createBridgeServer } = require('./server');
+
+const BACKOFF_MS = [1000, 2000, 5000, 10000, 30000];
+const GIVE_UP_FAILURES = 5;
+const GIVE_UP_WINDOW_MS = 2 * 60 * 1000;
+const STABLE_MS = 60 * 1000;
+const READY_TIMEOUT_MS = 15000;
+const IPC_REQUEST_TIMEOUT_MS = 2000;
+const LOG_RE = /^\[(debug|info|warn|error)\] ?(.*)$/;
+
+function normalizeLog(log) {
+  const noop = () => {};
+  const l = log || {};
+  return {
+    debug: typeof l.debug === 'function' ? l.debug.bind(l) : noop,
+    info: typeof l.info === 'function' ? l.info.bind(l) : noop,
+    warn: typeof l.warn === 'function' ? l.warn.bind(l) : noop,
+    error: typeof l.error === 'function' ? l.error.bind(l) : noop,
+  };
+}
+
+const newToken = () => `ccsr_${crypto.randomBytes(24).toString('hex')}`;
+
+/**
+ * @param {object} o
+ * @param {string}   [o.nodeCmd='node']
+ * @param {string}   [o.childPath]         default: ./child.js next to this file
+ * @param {number}   [o.port]              fixed port; default: ephemeral on first start, then reused
+ * @param {function} [o.onUsage]           UsageRecord sink (fire-and-forget)
+ * @param {object}   [o.log]
+ * @param {boolean}  [o.inProcess]         run the server in THIS process (tests / fallback)
+ * @param {object}   [o.serverOptions]     passed to the child / createBridgeServer (pingIntervalMs, retryDelayMs, debug)
+ * @param {number[]} [o.backoffMs]         restart backoff (tests shorten it)
+ * @param {object}   [o.env]               child environment (default process.env)
+ */
+function createBridgeHost(o = {}) {
+  const nodeCmd = o.nodeCmd || 'node';
+  const childPath = o.childPath || path.join(__dirname, 'child.js');
+  const log = normalizeLog(o.log);
+  const onUsage = typeof o.onUsage === 'function' ? o.onUsage : () => {};
+  const backoff = Array.isArray(o.backoffMs) && o.backoffMs.length ? o.backoffMs : BACKOFF_MS;
+  const serverOptions = o.serverOptions || {};
+
+  const runs = new Map();          // token -> ctx (token included)
+  const releaseTimers = new Map();
+  const ipcWaiters = new Map();
+  let ipcSeq = 0;
+
+  let port = o.port || 0;
+  let child = null;
+  let ready = false;
+  let stopping = false;
+  let gaveUp = false;
+  let readySince = 0;
+  let failures = [];
+  let backoffIdx = 0;
+  let restartTimer = null;
+  let inproc = null;
+
+  function safeSend(c, msg) {
+    if (!c || !c.connected) return false;
+    try { c.send(msg, (err) => { if (err) log.debug(`[llm-bridge] IPC send failed: ${err.message}`); }); return true; } catch { return false; }
+  }
+
+  function forwardLines(stream) {
+    if (!stream) return;
+    const rl = readline.createInterface({ input: stream });
+    rl.on('line', (l) => {
+      const m = LOG_RE.exec(l);
+      if (m) log[m[1]](m[2]); else if (l.trim()) log.info(`[llm-bridge child] ${l}`);
+    });
+    rl.on('error', () => {});
+  }
+
+  function onChildMessage(c, m) {
+    if (!m || typeof m !== 'object') return;
+    switch (m.t) {
+      case 'usage':
+        try { const r = onUsage(m.record); if (r && typeof r.catch === 'function') r.catch(() => {}); } catch (e) { log.warn(`[llm-bridge] onUsage threw: ${e.message}`); }
+        break;
+      case 'lookup':
+        safeSend(c, { t: 'lookup-reply', id: m.id, ctx: runs.get(m.token) || null });
+        break;
+      case 'recent-log-reply': {
+        const w = ipcWaiters.get(m.id);
+        if (w) { ipcWaiters.delete(m.id); clearTimeout(w.timer); w.resolve(m.entries || []); }
+        break;
+      }
+      default: break;
+    }
+  }
+
+  function settleWaiters() {
+    for (const [id, w] of ipcWaiters) { clearTimeout(w.timer); w.resolve([]); ipcWaiters.delete(id); }
+  }
+
+  /** Spawn one child and wait for `ready`. Rejects on spawn error, early exit, fatal or timeout. */
+  function spawnChild() {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      let becameReady = false;
+      let c;
+      try {
+        c = spawn(nodeCmd, [childPath], { stdio: ['ignore', 'pipe', 'pipe', 'ipc'], env: o.env || process.env, windowsHide: true });
+      } catch (e) { reject(e); return; }
+      child = c;
+      ready = false;
+      forwardLines(c.stdout);
+      forwardLines(c.stderr);
+      const readyTimer = setTimeout(() => fail(new Error(`bridge child did not report ready within ${READY_TIMEOUT_MS / 1000} s`)), READY_TIMEOUT_MS);
+      function fail(e) {
+        if (settled) return;
+        settled = true;
+        clearTimeout(readyTimer);
+        try { c.kill('SIGKILL'); } catch { /* gone */ }
+        reject(e);
+      }
+      c.on('error', (e) => {
+        if (!settled) fail(e);
+        else log.warn(`[llm-bridge] child process error: ${e.message}`);
+      });
+      c.on('message', (m) => {
+        if (m && m.t === 'ready') {
+          if (settled) return;
+          settled = true;
+          clearTimeout(readyTimer);
+          port = m.port;
+          ready = true;
+          becameReady = true;
+          readySince = Date.now();
+          resolve();
+          return;
+        }
+        if (m && m.t === 'fatal') { fail(new Error(`bridge child could not listen: ${m.error}`)); return; }
+        onChildMessage(c, m);
+      });
+      c.on('exit', (code, signal) => {
+        clearTimeout(readyTimer);
+        const mine = child === c;
+        if (mine) { child = null; ready = false; }
+        settleWaiters();
+        if (!settled) { settled = true; reject(new Error(`bridge child exited before it was ready (code ${code}, signal ${signal})`)); return; }
+        // a child that never became ready is reported through the rejection above, not here
+        if (mine && becameReady && !stopping) {
+          log.warn(`[llm-bridge] bridge child exited unexpectedly (code ${code}, signal ${signal}); restarting`);
+          scheduleRestart();
+        }
+      });
+      safeSend(c, { t: 'init', port, host: '127.0.0.1', runs: [...runs.values()], options: serverOptions });
+    });
+  }
+
+  function scheduleRestart() {
+    if (stopping || restartTimer) return;
+    const now = Date.now();
+    failures = failures.filter((t) => now - t < GIVE_UP_WINDOW_MS);
+    failures.push(now);
+    if (failures.length >= GIVE_UP_FAILURES) {
+      gaveUp = true;
+      log.warn(`[llm-bridge] giving up: the bridge child failed ${failures.length} times within ${GIVE_UP_WINDOW_MS / 60000} min — bridge disabled`);
+      return;
+    }
+    if (readySince && now - readySince > STABLE_MS) backoffIdx = 0;
+    const delay = backoff[Math.min(backoffIdx, backoff.length - 1)];
+    backoffIdx++;
+    restartTimer = setTimeout(() => {
+      restartTimer = null;
+      if (stopping) return;
+      spawnChild().then(
+        () => log.info(`[llm-bridge] bridge child restarted on port ${port}`),
+        (e) => { log.warn(`[llm-bridge] bridge child restart failed: ${e.message}`); scheduleRestart(); },
+      );
+    }, delay);
+    if (restartTimer.unref) restartTimer.unref();
+  }
+
+  return {
+    /** Resolves when the child is listening. Rejects if the first attempt fails (retries continue in the background). */
+    async start() {
+      stopping = false;
+      if (o.inProcess) {
+        if (inproc) return;
+        inproc = createBridgeServer({ getRun: (t) => runs.get(t) || null, onUsage, log, ...serverOptions,
+          retryDelayMs: serverOptions.retryDelayMs != null ? () => serverOptions.retryDelayMs : undefined });
+        const r = await inproc.listen(port, '127.0.0.1');
+        port = r.port;
+        ready = true;
+        return;
+      }
+      if (child && ready) return;
+      gaveUp = false;
+      failures = [];
+      try {
+        await spawnChild();
+      } catch (e) {
+        log.warn(`[llm-bridge] could not start the bridge child: ${e.message}`);
+        scheduleRestart();
+        throw e;
+      }
+    },
+
+    running() { return o.inProcess ? !!inproc && ready : !!child && ready && !gaveUp; },
+    /** 'running' | 'starting' (first start or a restart pending) | 'down' (gave up) | 'stopped'. */
+    state() {
+      if (this.running()) return 'running';
+      if (gaveUp) return 'down';
+      if (stopping) return 'stopped';
+      return (restartTimer || child) ? 'starting' : 'stopped';
+    },
+    baseUrl() { return this.running() ? `http://127.0.0.1:${port}` : null; },
+    pid() { return child ? child.pid : null; },
+
+    /** A new run token ('ccsr_' + 48 hex). Synchronous; the child learns it over IPC (or asks). */
+    registerRun(ctx) {
+      const token = newToken();
+      const full = { ...ctx, token };
+      runs.set(token, full);
+      if (child) safeSend(child, { t: 'run', ctx: full });
+      return token;
+    },
+
+    /** providerId -> ProviderCfg: refresh keys/options of live runs (new runs pass their own). */
+    updateProviders(map) {
+      if (!map || typeof map !== 'object') return;
+      for (const ctx of runs.values()) {
+        const next = ctx.provider && map[ctx.provider.id];
+        if (next) ctx.provider = next;
+      }
+      if (child) safeSend(child, { t: 'providers', map });
+    },
+
+    /** The token keeps working for `graceMs` (the CLI's last calls after the turn), then 401s. */
+    releaseRun(token, { graceMs = 5000 } = {}) {
+      if (!runs.has(token)) return;
+      clearTimeout(releaseTimers.get(token));
+      const drop = () => {
+        releaseTimers.delete(token);
+        runs.delete(token);
+        if (child) safeSend(child, { t: 'release', token });
+      };
+      if (!(graceMs > 0)) { drop(); return; }
+      const t = setTimeout(drop, graceMs);
+      if (t.unref) t.unref();
+      releaseTimers.set(token, t);
+    },
+
+    async recentLog() {
+      if (inproc) return inproc.recentLog();
+      if (!child || !ready) return [];
+      const c = child;
+      return new Promise((resolve) => {
+        const id = ++ipcSeq;
+        const timer = setTimeout(() => { ipcWaiters.delete(id); resolve([]); }, IPC_REQUEST_TIMEOUT_MS);
+        ipcWaiters.set(id, { resolve, timer });
+        if (!safeSend(c, { t: 'recent-log', id })) { clearTimeout(timer); ipcWaiters.delete(id); resolve([]); }
+      });
+    },
+
+    async stop() {
+      stopping = true;
+      clearTimeout(restartTimer);
+      restartTimer = null;
+      for (const t of releaseTimers.values()) clearTimeout(t);
+      releaseTimers.clear();
+      if (inproc) { const s = inproc; inproc = null; ready = false; await s.close(); return; }
+      const c = child;
+      if (!c) return;
+      await new Promise((resolve) => {
+        if (c.exitCode !== null || c.signalCode !== null) { resolve(); return; }
+        const kill = setTimeout(() => { try { c.kill('SIGKILL'); } catch { /* gone */ } }, 3000);
+        c.once('exit', () => { clearTimeout(kill); resolve(); });
+        if (!safeSend(c, { t: 'stop' })) { try { c.kill('SIGTERM'); } catch { /* gone */ } }
+      });
+      if (child === c) child = null;
+      ready = false;
+      settleWaiters();
+    },
+  };
+}
+
+module.exports = { createBridgeHost, newToken };
diff --git a/llm-bridge/ids.js b/llm-bridge/ids.js
new file mode 100644
index 00000000..98a7054e
--- /dev/null
+++ b/llm-bridge/ids.js
@@ -0,0 +1,74 @@
+'use strict';
+// Names and ids that have to survive a round trip through a provider with stricter rules than
+// Anthropic's. Every mapping here is DETERMINISTIC (a pure function of its input), so the bridge
+// keeps no state between requests: the same history maps the same way every time, which also
+// keeps provider-side prefix caches valid.
+
+const { hashAlnum, sha1hex, randomAlnum } = require('./util');
+
+// ---------------------------------------------------------------- tool names --
+// OpenAI function names: ^[a-zA-Z0-9_-]{1,64}$. MCP tools (`mcp__server__tool.name`, long server
+// names) break that; they are renamed `t<8 hex>_<sanitized>` and renamed back on the response.
+const TOOL_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+
+function upstreamToolName(name) {
+  const n = String(name == null ? '' : name);
+  if (TOOL_NAME_RE.test(n)) return n;
+  const clean = n.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 54);
+  return `t${sha1hex(n).slice(0, 8)}_${clean}`;
+}
+
+/** Reverse map (upstream name -> original) for every name in the request's tools and history. */
+function toolNameReverseMap(body) {
+  const rev = new Map();
+  const add = (n) => { if (typeof n === 'string' && n) rev.set(upstreamToolName(n), n); };
+  for (const t of (body && Array.isArray(body.tools) ? body.tools : [])) add(t && t.name);
+  for (const m of (body && Array.isArray(body.messages) ? body.messages : [])) {
+    if (m && Array.isArray(m.content)) for (const b of m.content) if (b && b.type === 'tool_use') add(b.name);
+  }
+  return rev;
+}
+
+// ------------------------------------------------------------------ tool ids --
+// Anthropic tool_use ids the CLI accepts; anything else (a provider's `call_…|with/slashes`) is
+// hashed so the same upstream id always gives the same Anthropic id.
+const TOOL_ID_RE = /^[A-Za-z0-9_-]{1,40}$/;
+
+function anthropicToolId(upstreamId) {
+  if (typeof upstreamId === 'string' && TOOL_ID_RE.test(upstreamId)) return upstreamId;
+  if (typeof upstreamId === 'string' && upstreamId) return `toolu_${sha1hex(upstreamId).slice(0, 24)}`;
+  return `toolu_${randomAlnum(24)}`;
+}
+
+/** History tool ids -> upstream, per dialect.toolIdStyle ('mistral9': exactly 9 alnum chars). */
+function upstreamToolId(id, style) {
+  const s = String(id == null ? '' : id);
+  if (style === 'mistral9') return /^[A-Za-z0-9]{9}$/.test(s) ? s : hashAlnum(s, 9);
+  return s;
+}
+
+// ---------------------------------------------------------- thinking signature --
+// An Anthropic thinking block must carry a signature; the CLI stores it and sends the block back.
+// Ours says WHICH provider produced the reasoning (only that provider may see it again) and
+// carries the provider's opaque reasoning_details (encrypted items included) for the echo.
+const SIG_PREFIX = 'ccsb1:';
+
+function makeSignature(providerId, details) {
+  const o = { p: String(providerId || '') };
+  if (Array.isArray(details) && details.length) o.d = details;
+  return SIG_PREFIX + Buffer.from(JSON.stringify(o)).toString('base64url');
+}
+
+/** -> {p, d?} for one of our signatures, null for anything else (real Anthropic ones, junk). */
+function readSignature(sig) {
+  if (typeof sig !== 'string' || !sig.startsWith(SIG_PREFIX)) return null;
+  try {
+    const o = JSON.parse(Buffer.from(sig.slice(SIG_PREFIX.length), 'base64url').toString('utf8'));
+    return o && typeof o.p === 'string' ? o : null;
+  } catch { return null; }
+}
+
+module.exports = {
+  TOOL_NAME_RE, TOOL_ID_RE, SIG_PREFIX,
+  upstreamToolName, toolNameReverseMap, anthropicToolId, upstreamToolId, makeSignature, readSignature,
+};
diff --git a/llm-bridge/json-repair.js b/llm-bridge/json-repair.js
new file mode 100644
index 00000000..1825c7f8
--- /dev/null
+++ b/llm-bridge/json-repair.js
@@ -0,0 +1,93 @@
+'use strict';
+// Tool-call arguments from OpenAI-style models are a JSON STRING the model typed, and weaker
+// models get it wrong: trailing commas, a stream cut short, JSON wrapped in a JSON string, the
+// whole object sent twice. Silently turning that into {} (what the reference translator did)
+// runs the tool with no arguments; the CLI then reports a confusing failure, or worse, succeeds
+// at the wrong thing. We repair what is unambiguous and otherwise hand the CLI an input that
+// fails its schema validation — the model then sees a clear error and retries.
+
+const MAX_RAW = 2000;
+
+function tryParse(s) {
+  try { return { ok: true, v: JSON.parse(s) }; } catch { return { ok: false }; }
+}
+
+const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/** Index just past the first balanced top-level {...} in `s`, or -1. */
+function firstObjectEnd(s) {
+  let depth = 0, inStr = false, esc = false, started = false;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (c === '\\') esc = true;
+      else if (c === '"') inStr = false;
+      continue;
+    }
+    if (c === '"') inStr = true;
+    else if (c === '{' || c === '[') { depth++; started = true; }
+    else if (c === '}' || c === ']') { depth--; if (started && depth === 0) return i + 1; }
+  }
+  return -1;
+}
+
+/** Close unterminated strings/objects/arrays (a truncated stream) and drop dangling commas. */
+function closeUnbalanced(s) {
+  const stack = [];
+  let inStr = false, esc = false;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (c === '\\') esc = true;
+      else if (c === '"') inStr = false;
+      continue;
+    }
+    if (c === '"') inStr = true;
+    else if (c === '{') stack.push('}');
+    else if (c === '[') stack.push(']');
+    else if (c === '}' || c === ']') { if (stack[stack.length - 1] === c) stack.pop(); }
+  }
+  let out = s;
+  if (inStr) out += esc ? '\\"' : '"';
+  out = out.replace(/[\s,]+$/, '').replace(/:\s*$/, ': null');
+  while (stack.length) out += stack.pop();
+  return out;
+}
+
+const stripTrailingCommas = (s) => s.replace(/,(\s*[}\]])/g, '$1');
+
+/**
+ * -> { value: object, repaired: bool, invalid: bool }. `value` is always a plain object; an
+ * unrepairable input becomes {"__invalid_arguments": "<raw, truncated>"}.
+ */
+function parseToolArguments(raw) {
+  if (isObj(raw)) return { value: raw, repaired: false, invalid: false };
+  const s0 = raw == null ? '' : String(raw).trim();
+  if (!s0) return { value: {}, repaired: false, invalid: false }; // a tool with no parameters
+
+  let p = tryParse(s0);
+  if (p.ok && isObj(p.v)) return { value: p.v, repaired: false, invalid: false };
+  // JSON inside a JSON string: "{\"a\":1}"
+  if (p.ok && typeof p.v === 'string') {
+    const inner = tryParse(p.v.trim());
+    if (inner.ok && isObj(inner.v)) return { value: inner.v, repaired: true, invalid: false };
+  }
+
+  const candidates = [];
+  let s = s0.replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/, '');
+  candidates.push(s);
+  // The same object twice ("{..}{..}") or an object followed by junk: keep the first object.
+  const end = firstObjectEnd(s);
+  if (end > 0 && end < s.length) candidates.push(s.slice(0, end));
+  candidates.push(stripTrailingCommas(s));
+  candidates.push(stripTrailingCommas(closeUnbalanced(s)));
+  for (const c of candidates) {
+    p = tryParse(c);
+    if (p.ok && isObj(p.v)) return { value: p.v, repaired: true, invalid: false };
+  }
+  return { value: { __invalid_arguments: s0.slice(0, MAX_RAW) }, repaired: false, invalid: true };
+}
+
+module.exports = { parseToolArguments };
diff --git a/llm-bridge/limiter.js b/llm-bridge/limiter.js
new file mode 100644
index 00000000..375a39b4
--- /dev/null
+++ b/llm-bridge/limiter.js
@@ -0,0 +1,48 @@
+'use strict';
+// Per-provider in-flight cap. A multi-agent wave can start a dozen CLI subprocesses on one
+// provider at once; most providers answer the burst with 429s the CLI then retries with its own
+// backoff — slower than simply queueing here. FIFO, and a queued request whose client went away
+// leaves the queue instead of occupying a slot later.
+
+function createLimiter(max = 6) {
+  let limit = Math.max(1, max | 0);
+  let active = 0;
+  const queue = [];
+
+  function grant() {
+    while (active < limit && queue.length) {
+      const w = queue.shift();
+      if (w.cancelled) continue;
+      active++;
+      w.resolve(makeRelease());
+    }
+  }
+
+  function makeRelease() {
+    let done = false;
+    return () => { if (done) return; done = true; active--; grant(); };
+  }
+
+  return {
+    /** -> Promise<release()>. Rejects with code 'ABORTED' if `signal` fires while queued. */
+    acquire(signal) {
+      if (signal && signal.aborted) return Promise.reject(Object.assign(new Error('client disconnected'), { code: 'ABORTED' }));
+      if (active < limit && !queue.length) { active++; return Promise.resolve(makeRelease()); }
+      return new Promise((resolve, reject) => {
+        const w = { resolve, cancelled: false };
+        queue.push(w);
+        if (signal) {
+          signal.addEventListener('abort', () => {
+            if (w.cancelled) return;
+            const i = queue.indexOf(w);
+            if (i >= 0) { queue.splice(i, 1); w.cancelled = true; reject(Object.assign(new Error('client disconnected'), { code: 'ABORTED' })); }
+          }, { once: true });
+        }
+      });
+    },
+    setMax(n) { const v = Math.max(1, n | 0); if (v !== limit) { limit = v; grant(); } },
+    stats: () => ({ active, queued: queue.length, limit }),
+  };
+}
+
+module.exports = { createLimiter };
diff --git a/llm-bridge/models.js b/llm-bridge/models.js
new file mode 100644
index 00000000..8e23b1a7
--- /dev/null
+++ b/llm-bridge/models.js
@@ -0,0 +1,78 @@
+'use strict';
+// Which upstream model a request goes to, what that model can do, and how hard it should think.
+
+const { CLAUDE_LIKE_RE } = require('./util');
+
+const FAMILY_RE = /^(haiku|sonnet|opus|fable)$/i;
+const NO_CAPS = Object.freeze({ tools: null, vision: null, reasoning: null, pdf: null, contextWindow: null, maxOutput: null });
+
+/**
+ * The upstream model id for a model name the CLI sent.
+ *  1. modelMap exact match;
+ *  2. modelMap family alias ('haiku' / 'sonnet' / …) contained in the name — the CLI sends dated
+ *     ids like `claude-haiku-4-5-20251001` for its side calls, and nobody can list every date;
+ *  3. type 'anthropic': unchanged (the provider knows every Claude id);
+ *  4. otherwise a model of this run → itself; a Claude-looking unknown id → fallbackModel (an
+ *     OpenAI-style provider would only 404 on it, and so would most anthropic-COMPATIBLE ones —
+ *     DeepSeek/Kimi/GLM speak the protocol, not the model names); anything else → unchanged.
+ *     An anthropic-compatible provider without a fallbackModel keeps the id (a proxy that does
+ *     serve Claude models).
+ */
+function resolveModel(ctx, requested) {
+  const req = typeof requested === 'string' ? requested : '';
+  const map = (ctx && ctx.modelMap) || {};
+  if (req && Object.prototype.hasOwnProperty.call(map, req) && map[req]) return map[req];
+  const lower = req.toLowerCase();
+  for (const [k, v] of Object.entries(map)) {
+    if (v && FAMILY_RE.test(k) && lower.includes(k.toLowerCase())) return v;
+  }
+  const type = ctx && ctx.provider && ctx.provider.type;
+  if (!req) return ctx.model;
+  if (type === 'anthropic') return req;
+  if (ctx.models && ctx.models[req]) return req;
+  if (CLAUDE_LIKE_RE.test(req)) return type === 'anthropic-compatible' ? (ctx.fallbackModel || req) : (ctx.fallbackModel || ctx.model);
+  return req;
+}
+
+/** Caps of an upstream model id; unknown fields stay null (= "do not assume"). */
+function capsFor(ctx, upstreamModel) {
+  const c = ctx && ctx.models && ctx.models[upstreamModel];
+  return c ? { ...NO_CAPS, ...c } : { ...NO_CAPS };
+}
+
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max', 'none']);
+
+/**
+ * The reasoning effort for this request: RunCtx.effort (the studio's choice — the CLI may drop
+ * --effort for a model id it does not know) ?? output_config.effort ?? the thinking config
+ * (enabled budget → bucket; adaptive → provider default; disabled → 'none'). null = send nothing.
+ *
+ * RunCtx.effort 'auto' (beyond the documented values) = "provider default", whatever the request
+ * says: Claude Code 2.1.281 sends output_config.effort "high" even when no --effort was given, so
+ * a null RunCtx.effort can never mean "let the provider decide".
+ */
+function effectiveEffort(ctx, body) {
+  if (ctx && ctx.effort === 'auto') return null;
+  if (ctx && ctx.effort && EFFORTS.has(ctx.effort)) return ctx.effort;
+  const oc = body && body.output_config;
+  if (oc && typeof oc.effort === 'string' && EFFORTS.has(oc.effort)) return oc.effort;
+  const t = body && body.thinking;
+  if (t && typeof t === 'object') {
+    if (t.type === 'disabled') return 'none';
+    if (t.type === 'enabled') {
+      const b = t.budget_tokens;
+      if (!Number.isInteger(b) || b < 1) return 'medium';
+      return b < 2500 ? 'low' : b < 8000 ? 'medium' : 'high';
+    }
+  }
+  return null;
+}
+
+/** min(requested, caps.maxOutput) when the cap is known. */
+function clampMaxTokens(requested, caps) {
+  const cap = caps && Number.isInteger(caps.maxOutput) && caps.maxOutput > 0 ? caps.maxOutput : null;
+  if (!Number.isInteger(requested) || requested < 1) return cap;
+  return cap ? Math.min(requested, cap) : requested;
+}
+
+module.exports = { resolveModel, capsFor, effectiveEffort, clampMaxTokens, NO_CAPS };
diff --git a/llm-bridge/openai.js b/llm-bridge/openai.js
new file mode 100644
index 00000000..b4c92026
--- /dev/null
+++ b/llm-bridge/openai.js
@@ -0,0 +1,230 @@
+'use strict';
+// Translate mode (provider.type 'openai-compatible'): Anthropic Messages in, OpenAI Chat
+// Completions upstream, Anthropic back out. The pure halves live in translate-request.js and
+// translate-response.js; this file is the I/O around them.
+//
+// Order matters for the CLI: the upstream status is known BEFORE anything is written to the
+// client, so a 429/5xx/overflow reaches Claude Code as a real HTTP status it can retry or act
+// on. Only after a 2xx do SSE headers + message_start go out — immediately, so the CLI's own
+// first-byte clock is satisfied — followed by a ping every 15 s of silence (a reasoning model
+// can think for minutes without emitting a token; Claude Code aborts a stream that stays silent).
+
+const { sseFrame, anthropicError } = require('./util');
+const { resolveDialect } = require('./dialects');
+const { resolveModel, capsFor } = require('./models');
+const { toOpenAI, BadRequest } = require('./translate-request');
+const { createTranslator, createAggregator, completionToChunk } = require('./translate-response');
+const { createSseParser, parseEventJson } = require('./sse');
+const { readAll, UpstreamError } = require('./upstream');
+const { canonicalizeError, transportError, streamChunkError } = require('./errors');
+const { estimateInputTokens } = require('./estimate');
+const { authHeaders, extraHeaders } = require('./passthrough');
+
+/**
+ * `<baseUrl>/chat/completions`. baseUrl conventionally carries the version segment
+ * (https://api.openai.com/v1, https://openrouter.ai/api/v1); a base WITHOUT one still just gets
+ * /chat/completions appended — some providers (DeepSeek: https://api.deepseek.com) serve it at the
+ * root, so the bridge never guesses a /v1. A baseUrl that already ends in /chat/completions is used as is.
+ */
+function openaiUrl(baseUrl) {
+  const base = String(baseUrl || '').replace(/\/+$/, '');
+  return /\/chat\/completions$/.test(base) ? base : `${base}/chat/completions`;
+}
+
+function openaiHeaders(provider, stream) {
+  return {
+    'content-type': 'application/json',
+    accept: stream ? 'text/event-stream' : 'application/json',
+    'accept-encoding': 'identity',
+    'user-agent': 'claude-code-studio-llm-bridge/1',
+    ...authHeaders({ ...provider, authScheme: provider.authScheme || 'bearer' }),
+    ...extraHeaders(provider),
+  };
+}
+
+/** SSE response writer with the keep-alive ping: a ping goes out whenever nothing else did for `pingMs`. */
+function createSseWriter(res, pingMs) {
+  let timer = null;
+  let closed = false;
+  const raw = (s) => { if (!closed && !res.destroyed) res.write(s); };
+  return {
+    open() {
+      res.writeHead(200, { 'content-type': 'text/event-stream; charset=utf-8', 'cache-control': 'no-cache', 'x-accel-buffering': 'no' });
+      if (res.flushHeaders) res.flushHeaders();
+      timer = setTimeout(function tick() { raw(sseFrame('ping', { type: 'ping' })); if (!closed) timer.refresh(); }, pingMs);
+    },
+    write(event, data) { raw(sseFrame(event, data)); if (timer && !closed) timer.refresh(); },
+    end() { if (closed) return; closed = true; clearTimeout(timer); if (!res.destroyed) res.end(); },
+    stop() { closed = true; clearTimeout(timer); },
+  };
+}
+
+async function handleTranslate(rc, env) {
+  const p = rc.provider;
+  const label = p.label || p.id || 'provider';
+  const body = rc.body;
+  const dialect = resolveDialect(p);
+  const requestedModel = typeof body.model === 'string' ? body.model : '';
+  const model = resolveModel(rc.ctx, requestedModel);
+  const caps = capsFor(rc.ctx, model);
+  rc.setModel(model, requestedModel);
+
+  let tr;
+  try {
+    tr = toOpenAI(body, { ctx: rc.ctx, dialect, upstreamModel: model, caps });
+  } catch (e) {
+    if (!(e instanceof BadRequest)) throw e;
+    rc.error(400, 'invalid_request_error', `llm-bridge: ${e.message}`);
+    rc.finish({ status: 'error', httpStatus: 400, errorType: 'invalid_request_error' });
+    return;
+  }
+  rc.entry.effort = tr.effort;
+
+  const rawEstimate = estimateInputTokens(body);
+  const estimate = env.calibrator.apply(rc.calKey, rawEstimate);
+  const clientStream = body.stream === true;
+  const payload = Buffer.from(JSON.stringify(tr.body));
+
+  const release = await env.acquire(p, rc.signal).catch(() => null);
+  if (!release) { rc.finish({ status: 'aborted' }); return; }
+
+  let up;
+  try {
+    up = await env.sendWithRetry(rc, { url: openaiUrl(p.baseUrl), headers: openaiHeaders(p, tr.upstreamStream), body: payload });
+  } catch (e) {
+    release();
+    if (rc.aborted()) { rc.finish({ status: 'aborted' }); return; }
+    const m = transportError(e, label);
+    rc.json(m.status, m.body, m.headers);
+    rc.finish({ status: 'error', httpStatus: m.status, errorType: m.errorType });
+    return;
+  }
+  rc.entry.upstreamStatus = up.status;
+
+  if (up.status < 200 || up.status >= 300) {
+    const { text } = await readAll(up, 1024 * 1024);
+    release();
+    const m = canonicalizeError({ status: up.status, bodyText: text, headers: up.headers, label, contextWindow: caps.contextWindow, estimate });
+    rc.json(m.status, m.body, m.headers);
+    rc.finish({ status: 'error', httpStatus: m.status, errorType: m.errorType });
+    return;
+  }
+  if (rc.res.destroyed) { up.destroy(); release(); rc.finish({ status: 'aborted' }); return; }
+
+  const ct = String(up.headers['content-type'] || '');
+  // a provider may ignore stream:true for some models and answer JSON; read what it actually sent
+  const upstreamSse = /event-stream/i.test(ct) || (tr.upstreamStream && !/json/i.test(ct));
+  const sse = clientStream ? createSseWriter(rc.res, env.pingIntervalMs) : null;
+  const agg = clientStream ? null : createAggregator();
+  const tl = createTranslator({
+    clientModel: requestedModel || model,
+    providerId: p.id,
+    toolNames: tr.toolNames,
+    stopSequences: tr.stopSequences,
+    inputEstimate: estimate,
+    emitThinking: tr.emitThinking,
+    sink: clientStream ? (ev, d) => sse.write(ev, d) : (ev, d) => agg.event(ev, d),
+  });
+  if (clientStream) { sse.open(); tl.start(); }
+
+  await new Promise((resolve) => {
+    let done = false;
+    let sawDone = false;
+
+    const usageFields = () => {
+      const u = tl.usage();
+      return { inputTokens: u.input, outputTokens: u.output, cacheReadTokens: u.cacheRead, cacheWriteTokens: u.cacheWrite, reasoningTokens: u.reasoning, promptTotal: u.promptTotal };
+    };
+    const settle = (fields) => {
+      if (done) return;
+      done = true;
+      release();
+      if (sse) sse.stop();
+      const { promptTotal, ...rest } = { ...usageFields(), ...fields };
+      if (fields.status === 'ok' && promptTotal) env.calibrator.observe(rc.calKey, rawEstimate, promptTotal);
+      const st = tl.stats();
+      rc.entry.tools = st.tools;
+      if (st.invalidArgs || st.repairedArgs || st.droppedTools) rc.entry.toolArgs = { invalid: st.invalidArgs, repaired: st.repairedArgs, dropped: st.droppedTools };
+      rc.finish(rest);
+      resolve();
+    };
+    const failWith = (m) => {
+      if (done) return;
+      up.destroy();
+      if (clientStream) {
+        tl.fail(m.body.error.type, m.body.error.message);
+        sse.end();
+        settle({ status: 'error', httpStatus: 200, errorType: m.errorType });
+      } else {
+        rc.json(m.status, m.body, m.headers);
+        settle({ status: 'error', httpStatus: m.status, errorType: m.errorType });
+      }
+    };
+    const complete = () => {
+      if (done) return;
+      if (!tl.sawChunk && !sawDone) {
+        failWith(transportError(new UpstreamError('EEMPTY', 'upstream returned an empty response'), label));
+        return;
+      }
+      tl.end();
+      if (clientStream) sse.end();
+      else rc.json(200, agg.message());
+      settle({ status: 'ok', httpStatus: 200 });
+    };
+    const broken = (e) => {
+      if (done) return;
+      if (rc.aborted()) { up.destroy(); settle({ status: 'aborted' }); return; }
+      failWith(transportError(up.reason() || e, label));
+    };
+    const chunkErrorOpts = { contextWindow: caps.contextWindow, estimate };
+    // A translator bug on one odd chunk must fail THIS request, not escape as an uncaught
+    // exception that takes every other run's stream down with the child.
+    const internal = (e) => {
+      if (env.log) env.log.error(`[llm-bridge] #${rc.id} translation failed: ${(e && e.stack) || e}`);
+      failWith({ status: 500, body: anthropicError('api_error', `llm-bridge: internal error while translating the ${label} response`), headers: {}, errorType: 'api_error' });
+    };
+
+    rc.onAbort(() => { up.destroy(); settle({ status: 'aborted' }); });
+
+    if (upstreamSse) {
+      const parser = createSseParser(({ data }) => {
+        if (done) return;
+        if (data.trim() === '[DONE]') { sawDone = true; return; }
+        for (const j of parseEventJson(data)) {
+          if (done) return;
+          const r = tl.chunk(j);
+          if (r && r.error !== undefined) { failWith(streamChunkError(r.error, label, chunkErrorOpts)); return; }
+        }
+      });
+      up.stream.on('data', (c) => {
+        if (done) return;
+        rc.markFirstByte();
+        try { parser.feed(c); } catch (e) { internal(e); }
+      });
+      up.stream.once('end', () => {
+        if (done) return;
+        try { parser.end(); complete(); } catch (e) { internal(e); }
+      });
+    } else {
+      readAll(up, 64 * 1024 * 1024).then(({ text, error }) => {
+        if (done) return;
+        rc.markFirstByte();
+        if (error) { broken(error); return; }
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* handled below */ }
+        if (!json || typeof json !== 'object') { failWith(transportError(new UpstreamError('EBADJSON', 'upstream returned a body that is not JSON'), label)); return; }
+        if (json.error && !Array.isArray(json.choices)) { failWith(streamChunkError(json.error, label, chunkErrorOpts)); return; }
+        try {
+          const r = tl.chunk(completionToChunk(json));
+          if (r && r.error !== undefined) failWith(streamChunkError(r.error, label, chunkErrorOpts));
+          else complete();
+        } catch (e) { internal(e); }
+      });
+      return;
+    }
+    up.stream.once('error', broken);
+    up.stream.once('close', () => { if (!up.stream.readableEnded) broken(new UpstreamError('ECONNRESET', 'upstream closed the connection mid-stream')); });
+  });
+}
+
+module.exports = { handleTranslate, openaiUrl, openaiHeaders, createSseWriter };
diff --git a/llm-bridge/passthrough.js b/llm-bridge/passthrough.js
new file mode 100644
index 00000000..4714f80b
--- /dev/null
+++ b/llm-bridge/passthrough.js
@@ -0,0 +1,241 @@
+'use strict';
+// Anthropic -> Anthropic (provider.type 'anthropic' | 'anthropic-compatible'). The body is
+// already in the provider's language, so the bridge only swaps credentials, maps the model,
+// clamps max_tokens, and TAPS the response for usage. Response bytes are forwarded as they
+// arrive — never buffered — so a passthrough stream is byte-identical to the provider's.
+
+const { isPlainObject, deepMerge, anthropicError } = require('./util');
+const { resolveModel, capsFor, clampMaxTokens } = require('./models');
+const { createSseParser, parseEventJson } = require('./sse');
+const { readAll } = require('./upstream');
+const { transportError } = require('./errors');
+const { estimateInputTokens } = require('./estimate');
+const { SIG_PREFIX } = require('./ids');
+
+/**
+ * Thinking blocks signed by THIS bridge (a turn served by a translated provider earlier in the
+ * same session) can never be verified by Anthropic — it answers 400 "invalid signature" and the
+ * resumed session is stuck. Drop them; returns null when nothing had to change.
+ */
+function stripBridgeThinking(messages) {
+  if (!Array.isArray(messages)) return null;
+  let changed = false;
+  const out = messages.map((m) => {
+    if (!m || m.role !== 'assistant' || !Array.isArray(m.content)) return m;
+    const kept = m.content.filter((b) => !(b && b.type === 'thinking' && typeof b.signature === 'string' && b.signature.startsWith(SIG_PREFIX)));
+    if (kept.length === m.content.length) return m;
+    changed = true;
+    return { ...m, content: kept.length ? kept : [{ type: 'text', text: '(no content)' }] };
+  });
+  return changed ? out : null;
+}
+
+/** `<base>/v1/messages` — unless the base already ends in /v1, then `<base>/messages`. */
+function anthropicUrl(baseUrl, suffix) {
+  const base = String(baseUrl || '').replace(/\/+$/, '');
+  return /\/v1$/.test(base) ? `${base}${suffix}` : `${base}/v1${suffix}`;
+}
+
+function defaultScheme(type) { return type === 'anthropic' ? 'x-api-key' : type === 'anthropic-compatible' ? 'both' : 'bearer'; }
+
+/** Credentials per authScheme. The client's own auth headers are never copied — only ever the provider key. */
+function authHeaders(provider) {
+  const h = {};
+  const key = provider.apiKey;
+  if (!key) return h; // a local server without auth
+  const scheme = provider.authScheme || defaultScheme(provider.type);
+  if (scheme === 'bearer' || scheme === 'both') h.authorization = `Bearer ${key}`;
+  if (scheme === 'x-api-key' || scheme === 'both') h['x-api-key'] = key;
+  return h;
+}
+
+function extraHeaders(provider) {
+  const h = {};
+  if (isPlainObject(provider.headers)) for (const [k, v] of Object.entries(provider.headers)) if (v != null) h[k.toLowerCase()] = String(v);
+  return h;
+}
+
+function passthroughHeaders(inHeaders, provider) {
+  const opts = provider.options || {};
+  const h = {
+    'content-type': 'application/json',
+    'anthropic-version': inHeaders['anthropic-version'] || '2023-06-01',
+    'accept-encoding': 'identity', // we tap the bytes for usage; a gzip stream would hide it
+  };
+  if (inHeaders['anthropic-beta'] && !opts.stripBetas) h['anthropic-beta'] = inHeaders['anthropic-beta'];
+  if (inHeaders.accept) h.accept = inHeaders.accept;
+  if (inHeaders['user-agent']) h['user-agent'] = inHeaders['user-agent'];
+  for (const [k, v] of Object.entries(inHeaders)) if (k.startsWith('x-claude-code-')) h[k] = v;
+  return { ...h, ...authHeaders(provider), ...extraHeaders(provider) };
+}
+
+/** Response headers worth keeping: the SDK reads request-id and the retry hints. */
+const KEEP_RES = /^(content-type|request-id|x-request-id|retry-after|x-should-retry|anthropic-ratelimit-.*|anthropic-organization-id)$/i;
+function pickResponseHeaders(h) {
+  const out = {};
+  for (const [k, v] of Object.entries(h || {})) if (KEEP_RES.test(k)) out[k] = v;
+  return out;
+}
+
+/** Usage out of an Anthropic SSE stream: message_start.message.usage, then message_delta.usage. */
+function createUsageTap(sse) {
+  const u = { input: null, output: null, cacheRead: null, cacheWrite: null, stopReason: null, error: null };
+  const apply = (x) => {
+    if (!x || typeof x !== 'object') return;
+    if (x.input_tokens != null) u.input = x.input_tokens;
+    if (x.output_tokens != null) u.output = x.output_tokens;
+    if (x.cache_read_input_tokens != null) u.cacheRead = x.cache_read_input_tokens;
+    if (x.cache_creation_input_tokens != null) u.cacheWrite = x.cache_creation_input_tokens;
+  };
+  let tail = '';
+  const onJson = (j) => {
+    if (!j || typeof j !== 'object') return;
+    if (j.type === 'message_start' && j.message) apply(j.message.usage);
+    else if (j.type === 'message_delta') { apply(j.usage); if (j.delta && j.delta.stop_reason) u.stopReason = j.delta.stop_reason; }
+    else if (j.type === 'error') u.error = j.error || {};
+    else if (j.type === 'message') { apply(j.usage); u.stopReason = j.stop_reason || null; } // non-stream body
+  };
+  const parser = sse ? createSseParser(({ data }) => { for (const j of parseEventJson(data)) onJson(j); }) : null;
+  const chunks = [];
+  let size = 0;
+  return {
+    usage: u,
+    feed(c) {
+      if (parser) { parser.feed(c); tail = (tail + c.toString('latin1')).slice(-2); }
+      else if (size < 8 * 1024 * 1024) { chunks.push(c); size += c.length; }
+    },
+    end() {
+      if (parser) parser.end();
+      else { try { onJson(JSON.parse(Buffer.concat(chunks).toString('utf8'))); } catch { /* not JSON */ } }
+    },
+    /** true when everything forwarded so far ends on an event boundary (safe to append an event) */
+    atBoundary: () => tail === '' || tail === '\n\n',
+  };
+}
+
+/**
+ * @param rc   request context from server.js
+ * @param env  { acquire, sendWithRetry, calibrator }
+ * @param kind 'messages' | 'count'
+ */
+async function handlePassthrough(rc, env, kind) {
+  const p = rc.provider;
+  const opts = p.options || {};
+  const body = rc.body;
+  const label = p.label || p.id || 'provider';
+  const requestedModel = typeof body.model === 'string' ? body.model : '';
+  const model = resolveModel(rc.ctx, requestedModel);
+  const caps = capsFor(rc.ctx, model);
+  rc.setModel(model, requestedModel);
+
+  let out = body;
+  let changed = false;
+  if (model && model !== requestedModel) { out = { ...out, model }; changed = true; }
+  if (kind === 'messages') {
+    const mt = clampMaxTokens(out.max_tokens, caps);
+    if (mt && mt !== out.max_tokens) {
+      out = { ...out, max_tokens: mt };
+      changed = true;
+      // an explicit thinking budget must stay below max_tokens (and ≥ 1024), or Anthropic 400s
+      const t = out.thinking;
+      if (t && t.type === 'enabled' && Number.isInteger(t.budget_tokens) && t.budget_tokens >= mt) {
+        if (mt - 1 >= 1024) out.thinking = { ...t, budget_tokens: mt - 1 };
+        else { const { thinking, ...rest } = out; out = rest; }
+      }
+    }
+  }
+  const stripped = stripBridgeThinking(out.messages);
+  if (stripped) { out = { ...out, messages: stripped }; changed = true; }
+  if (isPlainObject(opts.extraBody)) { out = deepMerge(out, opts.extraBody); changed = true; }
+  const payload = changed ? Buffer.from(JSON.stringify(out)) : rc.raw;
+
+  let query = rc.query || '';
+  if (opts.stripBetas) query = query.replace(/([?&])beta=true(&|$)/, (m, a, b) => (b ? a : '')).replace(/[?&]$/, '');
+  const url = anthropicUrl(p.baseUrl, kind === 'count' ? '/messages/count_tokens' : '/messages') + query;
+  const headers = passthroughHeaders(rc.req.headers, p);
+
+  const release = kind === 'messages' ? await env.acquire(p, rc.signal).catch(() => null) : () => {};
+  if (!release) { rc.finish({ status: 'aborted' }); return; }
+
+  let up;
+  try {
+    up = await env.sendWithRetry(rc, { url, headers, body: payload });
+  } catch (e) {
+    release();
+    if (rc.aborted()) { rc.finish({ status: 'aborted' }); return; }
+    const m = transportError(e, label);
+    rc.json(m.status, m.body, m.headers);
+    rc.finish({ status: 'error', httpStatus: m.status, errorType: m.errorType });
+    return;
+  }
+  rc.entry.upstreamStatus = up.status;
+
+  if (up.status < 200 || up.status >= 300) {
+    const { text } = await readAll(up, 1024 * 1024);
+    release();
+    if (kind === 'count' && (up.status === 404 || up.status === 405 || up.status === 501)) {
+      // an anthropic-compatible provider without count_tokens: answer with our estimate
+      rc.json(200, { input_tokens: env.calibrator.apply(rc.calKey, estimateInputTokens(body)) });
+      rc.finish({ status: 'ok', httpStatus: 200 });
+      return;
+    }
+    let errorType = null;
+    try { errorType = (JSON.parse(text).error || {}).type || null; } catch { /* not JSON */ }
+    const h = pickResponseHeaders(up.headers);
+    if (!h['content-type']) h['content-type'] = 'application/json';
+    if (!rc.res.headersSent && !rc.res.destroyed) { rc.res.writeHead(up.status, h); rc.res.end(text || JSON.stringify(anthropicError('api_error', `${label}: HTTP ${up.status}`))); }
+    rc.finish({ status: 'error', httpStatus: up.status, errorType });
+    return;
+  }
+
+  // 2xx: forward bytes as they come, tap for usage on the side
+  const isSse = /event-stream/i.test(up.headers['content-type'] || '');
+  const tap = createUsageTap(isSse);
+  if (rc.res.destroyed) { up.destroy(); release(); rc.finish({ status: 'aborted' }); return; }
+  rc.res.writeHead(up.status, pickResponseHeaders(up.headers));
+  if (rc.res.flushHeaders) rc.res.flushHeaders();
+
+  await new Promise((resolve) => {
+    let done = false;
+    const settle = (fields) => {
+      if (done) return;
+      done = true;
+      release();
+      const u = tap.usage;
+      rc.finish({
+        ...fields,
+        inputTokens: u.input || 0, outputTokens: u.output || 0, cacheReadTokens: u.cacheRead || 0, cacheWriteTokens: u.cacheWrite || 0,
+      });
+      resolve();
+    };
+    rc.onAbort(() => { up.destroy(); settle({ status: 'aborted' }); });
+    up.stream.on('data', (c) => {
+      if (done) return;
+      rc.markFirstByte();
+      try { tap.feed(c); } catch { /* usage tap is best effort; the bytes still go through */ }
+      if (!rc.res.write(c)) { up.stream.pause(); rc.res.once('drain', () => up.stream.resume()); }
+    });
+    up.stream.once('end', () => {
+      if (done) return;
+      try { tap.end(); } catch { /* best effort */ }
+      rc.res.end();
+      const err = tap.usage.error;
+      settle(err ? { status: 'error', httpStatus: up.status, errorType: err.type || 'api_error' } : { status: 'ok', httpStatus: up.status });
+    });
+    const broken = (e) => {
+      if (done) return;
+      if (rc.aborted()) { settle({ status: 'aborted' }); return; }
+      const m = transportError(up.reason() || e, label);
+      if (isSse && tap.atBoundary()) {
+        rc.res.end(`event: error\ndata: ${JSON.stringify(m.body)}\n\n`);
+      } else {
+        rc.res.destroy(); // mid-event: a clean end would hand the SDK half a JSON frame
+      }
+      settle({ status: 'error', httpStatus: up.status, errorType: m.errorType });
+    };
+    up.stream.once('error', broken);
+    up.stream.once('close', () => { if (!up.stream.readableEnded) broken(new Error('upstream closed the connection mid-stream')); });
+  });
+}
+
+module.exports = { handlePassthrough, anthropicUrl, passthroughHeaders, authHeaders, extraHeaders, createUsageTap, pickResponseHeaders, stripBridgeThinking };
diff --git a/llm-bridge/schema.js b/llm-bridge/schema.js
new file mode 100644
index 00000000..289679c9
--- /dev/null
+++ b/llm-bridge/schema.js
@@ -0,0 +1,62 @@
+'use strict';
+// Tool input_schema -> OpenAI `parameters`. Claude Code sends draft 2020-12 JSON Schema
+// (`$schema`, `additionalProperties:false`, `exclusiveMinimum`, …). Most OpenAI-compatible
+// servers accept that; Gemini's compat layer implements an OpenAPI subset and 400s on unknown
+// keywords, hence the levels:
+//   none   — untouched
+//   basic  — drop `$schema` and empty `required: []` (both trip some validators, carry no meaning)
+//   strict — also drop keywords outside the OpenAPI subset, recursively
+// The walk is SCHEMA-AWARE: the keys of `properties` are parameter names, never keywords, so a
+// parameter called `default` or `format` survives.
+
+const STRICT_DROP = new Set([
+  'additionalProperties', 'exclusiveMinimum', 'exclusiveMaximum', 'examples', 'default', '$id',
+  '$comment', 'patternProperties', 'propertyNames', 'unevaluatedProperties', 'unevaluatedItems',
+  'dependentRequired', 'dependentSchemas', 'contentEncoding', 'contentMediaType', 'const',
+  'if', 'then', 'else', 'readOnly', 'writeOnly', 'deprecated', 'minContains', 'maxContains', 'contains',
+]);
+// Formats the OpenAPI subset understands; anything else ("uri", "email", …) is dropped in strict mode.
+const SAFE_FORMATS = new Set(['enum', 'date-time', 'int32', 'int64', 'float', 'double']);
+
+const SCHEMA_MAPS = new Set(['properties', '$defs', 'definitions', 'patternProperties', 'dependentSchemas']);
+const SCHEMA_LISTS = new Set(['anyOf', 'oneOf', 'allOf', 'prefixItems']);
+const SCHEMA_ONE = new Set(['not', 'additionalProperties', 'contains', 'if', 'then', 'else', 'propertyNames', 'unevaluatedProperties', 'unevaluatedItems']);
+
+function walk(node, level) {
+  if (Array.isArray(node)) return node.map((n) => walk(n, level));
+  if (!node || typeof node !== 'object') return node;
+  const out = {};
+  for (const [k, v] of Object.entries(node)) {
+    if (k === '$schema') continue;
+    if (k === 'required' && Array.isArray(v) && v.length === 0) continue;
+    if (level === 'strict') {
+      if (k === 'const') { if (!('enum' in node)) out.enum = [v]; continue; } // const -> enum keeps the constraint
+      if (STRICT_DROP.has(k)) continue;
+      if (k === 'format' && !SAFE_FORMATS.has(v)) continue;
+    }
+    if (SCHEMA_MAPS.has(k) && v && typeof v === 'object' && !Array.isArray(v)) {
+      out[k] = {};
+      for (const [name, sub] of Object.entries(v)) out[k][name] = walk(sub, level);
+    } else if (SCHEMA_LISTS.has(k) && Array.isArray(v)) {
+      out[k] = v.map((s) => walk(s, level));
+    } else if (k === 'items') {
+      out[k] = walk(v, level);
+    } else if (SCHEMA_ONE.has(k) && v && typeof v === 'object') {
+      out[k] = walk(v, level);
+    } else {
+      out[k] = v; // enum values, descriptions, numbers: data, not schema
+    }
+  }
+  return out;
+}
+
+/** Sanitize a tool input_schema for the upstream. Always returns an object schema. */
+function sanitizeSchema(schema, level = 'basic') {
+  const s = schema && typeof schema === 'object' && !Array.isArray(schema) ? schema : { type: 'object', properties: {} };
+  if (level === 'none') return s;
+  const out = walk(s, level);
+  if (!out.type) out.type = 'object';
+  return out;
+}
+
+module.exports = { sanitizeSchema };
diff --git a/llm-bridge/server.js b/llm-bridge/server.js
new file mode 100644
index 00000000..4f328640
--- /dev/null
+++ b/llm-bridge/server.js
@@ -0,0 +1,334 @@
+'use strict';
+// The bridge's HTTP server: what `claude` talks to as ANTHROPIC_BASE_URL. It authenticates the
+// per-run token, finds the run's provider/model/effort, and hands the request to passthrough
+// (Anthropic-shaped providers) or translate (OpenAI-compatible ones).
+//
+//   const srv = createBridgeServer({ getRun, onUsage, log });
+//   await srv.listen(0, '127.0.0.1');   // -> { port }
+//
+// Routes (any path PREFIX is tolerated — the CLI appends /v1/messages to whatever base it got —
+// and so is any query string, e.g. ?beta=true):
+//   POST …/v1/messages               stream and non-stream
+//   POST …/v1/messages/count_tokens
+//   GET  …/v1/models, …/v1/models/<id>
+//   GET  /health                     no auth
+// Prompt content is never logged: the request log holds ids, sizes, statuses and token counts.
+
+const http = require('http');
+const { anthropicError, sleep } = require('./util');
+const { send, discard, RETRYABLE_CODES } = require('./upstream');
+const { createLimiter } = require('./limiter');
+const { createCalibrator, estimateInputTokens } = require('./estimate');
+const { handlePassthrough } = require('./passthrough');
+const { handleTranslate } = require('./openai');
+
+const MAX_BODY = 64 * 1024 * 1024;
+const LOG_KEEP = 200;
+const RETRY_STATUSES = new Set([502, 503, 504]);
+const MODELS_CREATED_AT = '2025-01-01T00:00:00Z';
+
+function normalizeLog(log) {
+  const noop = () => {};
+  const l = log || {};
+  return {
+    debug: typeof l.debug === 'function' ? l.debug.bind(l) : noop,
+    info: typeof l.info === 'function' ? l.info.bind(l) : noop,
+    warn: typeof l.warn === 'function' ? l.warn.bind(l) : noop,
+    error: typeof l.error === 'function' ? l.error.bind(l) : noop,
+  };
+}
+
+function tokenOf(req) {
+  const k = req.headers['x-api-key'];
+  if (typeof k === 'string' && k.trim()) return k.trim();
+  const a = req.headers.authorization;
+  if (typeof a === 'string') { const m = /^Bearer\s+(.+)$/i.exec(a.trim()); if (m) return m[1].trim(); }
+  return null;
+}
+
+function readBody(req, max) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let n = 0;
+    let over = false;
+    req.on('data', (c) => {
+      if (over) return;
+      n += c.length;
+      if (n > max) { over = true; chunks.length = 0; return; } // keep draining, answer 413 at the end
+      chunks.push(c);
+    });
+    req.on('end', () => (over ? reject(Object.assign(new Error('too large'), { code: 'E2BIG' })) : resolve(Buffer.concat(chunks))));
+    req.on('error', reject);
+    req.on('close', () => { if (!req.complete) reject(Object.assign(new Error('client disconnected'), { code: 'ABORTED' })); });
+  });
+}
+
+/** Sleep that ends early (rejecting) when the client goes away — a retry for nobody is waste. */
+function abortableSleep(ms, signal) {
+  if (!signal) return sleep(ms);
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) { reject(Object.assign(new Error('client disconnected'), { code: 'ABORTED' })); return; }
+    const t = setTimeout(() => { signal.removeEventListener('abort', onAbort); resolve(); }, ms);
+    const onAbort = () => { clearTimeout(t); reject(Object.assign(new Error('client disconnected'), { code: 'ABORTED' })); };
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
+/**
+ * @param {object} o
+ * @param {(token:string)=>object|null|Promise<object|null>} o.getRun
+ * @param {(record:object)=>void} [o.onUsage]
+ * @param {object} [o.log]            {debug,info,warn,error}
+ * @param {number} [o.pingIntervalMs] keep-alive ping cadence on silent translated streams (15000)
+ * @param {()=>number} [o.retryDelayMs] backoff before a retry (jittered 0.5–2 s)
+ * @param {number} [o.maxRetries]     retries before the first client byte (2)
+ * @param {number} [o.maxBodyBytes]   request body cap (64 MB)
+ */
+function createBridgeServer(o = {}) {
+  if (typeof o.getRun !== 'function') throw new TypeError('createBridgeServer: getRun(token) is required');
+  const log = normalizeLog(o.log);
+  const onUsage = typeof o.onUsage === 'function' ? o.onUsage : () => {};
+  const pingIntervalMs = o.pingIntervalMs || 15000;
+  const retryDelayMs = o.retryDelayMs || (() => 500 + Math.floor(Math.random() * 1500));
+  const maxRetries = o.maxRetries != null ? o.maxRetries : 2;
+  const maxBody = o.maxBodyBytes || MAX_BODY;
+
+  const recent = [];
+  const limiters = new Map();
+  const calibrator = createCalibrator();
+  const inflight = new Set();
+  let seq = 0;
+
+  function limiterFor(p) {
+    const key = (p && p.id) || '(none)';
+    const max = (p && p.options && p.options.maxConcurrency) || 6;
+    let l = limiters.get(key);
+    if (!l) { l = createLimiter(max); limiters.set(key, l); } else l.setMax(max);
+    return l;
+  }
+
+  const env = {
+    log,
+    calibrator,
+    pingIntervalMs,
+    acquire: (p, signal) => limiterFor(p).acquire(signal),
+    /** Retries ONLY before any byte reached the client: transport errors and 502/503/504. */
+    async sendWithRetry(rc, req) {
+      const opts = rc.provider.options || {};
+      const base = { ...req, connectTimeoutMs: opts.connectTimeoutMs || 30000, idleTimeoutMs: opts.timeoutMs || 600000, signal: rc.signal };
+      for (let attempt = 1; ; attempt++) {
+        rc.entry.attempts = attempt;
+        let up;
+        try {
+          up = await send(base);
+        } catch (e) {
+          if (rc.aborted() || attempt > maxRetries || !RETRYABLE_CODES.has(e.code)) throw e;
+          log.debug(`[llm-bridge] #${rc.id} retry ${attempt} after ${e.code}`);
+          await abortableSleep(retryDelayMs(), rc.signal);
+          continue;
+        }
+        if (RETRY_STATUSES.has(up.status) && attempt <= maxRetries && !rc.aborted()) {
+          discard(up);
+          log.debug(`[llm-bridge] #${rc.id} retry ${attempt} after HTTP ${up.status}`);
+          await abortableSleep(retryDelayMs(), rc.signal);
+          continue;
+        }
+        return up;
+      }
+    },
+  };
+
+  function pushLog(entry) {
+    recent.push(entry);
+    if (recent.length > LOG_KEEP) recent.splice(0, recent.length - LOG_KEEP);
+  }
+
+  function sendJson(res, status, obj, headers = {}) {
+    if (res.headersSent || res.destroyed) return;
+    const s = JSON.stringify(obj);
+    res.writeHead(status, { 'content-type': 'application/json', 'content-length': Buffer.byteLength(s), ...headers });
+    res.end(s);
+  }
+
+  async function handle(req, res) {
+    const t0 = Date.now();
+    const url = req.url || '/';
+    const q = url.indexOf('?');
+    const path = (q >= 0 ? url.slice(0, q) : url).replace(/\/+$/, '') || '/';
+    const query = q >= 0 ? url.slice(q) : '';
+    if (path === '/health' || path.endsWith('/health')) { sendJson(res, 200, { ok: true }); return; }
+
+    let route = null;
+    let modelId = null;
+    if (/\/v1\/messages\/count_tokens$/.test(path)) route = 'count';
+    else if (/\/v1\/messages$/.test(path)) route = 'messages';
+    else if (/\/v1\/models$/.test(path)) route = 'models';
+    else { const m = /\/v1\/models\/([^/]+)$/.exec(path); if (m) { route = 'model'; modelId = decodeURIComponent(m[1]); } }
+    const wantMethod = route === 'models' || route === 'model' ? 'GET' : 'POST';
+    if (!route || req.method !== wantMethod) {
+      req.resume();
+      sendJson(res, 404, anthropicError('not_found_error', `llm-bridge: no route for ${req.method} ${path}`));
+      return;
+    }
+
+    const token = tokenOf(req);
+    const ctx = token ? await o.getRun(token) : null;
+    if (!ctx || !ctx.provider) {
+      req.resume();
+      sendJson(res, 401, anthropicError('authentication_error', 'llm-bridge: unknown or expired run token'));
+      return;
+    }
+
+    if (route === 'models' || route === 'model') {
+      const ids = [...new Set([ctx.model, ...Object.keys(ctx.models || {})].filter((x) => typeof x === 'string' && x))];
+      const data = ids.map((id) => ({ type: 'model', id, display_name: id, created_at: MODELS_CREATED_AT }));
+      if (route === 'model') {
+        const hit = data.find((d) => d.id === modelId);
+        if (hit) sendJson(res, 200, hit); else sendJson(res, 404, anthropicError('not_found_error', `llm-bridge: model ${modelId} is not available to this run`));
+      } else {
+        sendJson(res, 200, { data, has_more: false, first_id: ids[0] || null, last_id: ids[ids.length - 1] || null });
+      }
+      return;
+    }
+
+    let raw;
+    try {
+      raw = await readBody(req, maxBody);
+    } catch (e) {
+      if (e.code === 'E2BIG') sendJson(res, 413, anthropicError('request_too_large', `llm-bridge: request body exceeds ${Math.round(maxBody / 1048576)} MB`));
+      else if (!res.destroyed) res.destroy();
+      return;
+    }
+    let body;
+    try { body = JSON.parse(raw.toString('utf8')); } catch { body = undefined; }
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+      sendJson(res, 400, anthropicError('invalid_request_error', 'llm-bridge: request body is not a JSON object'));
+      return;
+    }
+
+    const p = ctx.provider;
+    const cliSessionId = typeof req.headers['x-claude-code-session-id'] === 'string' ? req.headers['x-claude-code-session-id'] : null;
+    const ac = new AbortController();
+    const abortHandlers = [];
+    let aborted = false;
+    let finished = false;
+    let firstByteAt = null;
+    const entry = {
+      id: ++seq, ts: t0, method: req.method, route, runId: ctx.runId || null, purpose: ctx.purpose || null,
+      providerId: p.id || null, mode: p.type === 'openai-compatible' ? 'translate' : 'passthrough',
+      requestedModel: typeof body.model === 'string' ? body.model : null, model: null,
+      stream: body.stream === true, bytesIn: raw.length, messages: Array.isArray(body.messages) ? body.messages.length : 0,
+      tools: null, status: 'pending', httpStatus: null, upstreamStatus: null, errorType: null, attempts: 0,
+      ms: null, firstByteMs: null, inputTokens: null, outputTokens: null,
+    };
+    pushLog(entry);
+
+    const rc = {
+      id: entry.id, req, res, t0, ctx, provider: p, body, raw, query, entry, cliSessionId,
+      calKey: cliSessionId || ctx.runId || token.slice(-12),
+      signal: ac.signal,
+      aborted: () => aborted,
+      onAbort(fn) { if (aborted) fn(); else abortHandlers.push(fn); },
+      markFirstByte() { if (firstByteAt == null) firstByteAt = Date.now(); },
+      setModel(model, requested) { entry.model = model; entry.requestedModel = requested || entry.requestedModel; },
+      json: (status, obj, headers) => sendJson(res, status, obj, headers),
+      error: (status, type, message, headers) => sendJson(res, status, anthropicError(type, message), headers),
+      finish(f) {
+        if (finished) return;
+        finished = true;
+        inflight.delete(rc);
+        const ms = Date.now() - t0;
+        Object.assign(entry, {
+          status: f.status, httpStatus: f.httpStatus != null ? f.httpStatus : (res.headersSent ? res.statusCode : null),
+          errorType: f.errorType || null, ms, firstByteMs: firstByteAt != null ? firstByteAt - t0 : null,
+          inputTokens: f.inputTokens != null ? f.inputTokens : null, outputTokens: f.outputTokens != null ? f.outputTokens : null,
+        });
+        const line = `[llm-bridge] #${entry.id} ${route} run=${entry.runId} ${entry.providerId}/${entry.model} ${f.status} ${entry.httpStatus || '-'} ${ms}ms in=${entry.inputTokens ?? '-'} out=${entry.outputTokens ?? '-'}`;
+        if (f.status === 'error') log.warn(`${line} ${entry.errorType || ''}`); else log.debug(line);
+        if (route !== 'messages') return;
+        const rec = {
+          ts: t0, runId: ctx.runId || null, purpose: ctx.purpose || null, sessionId: ctx.sessionId || null,
+          taskId: ctx.taskId || null, botId: ctx.botId || null, providerId: p.id || null,
+          model: entry.model, requestedModel: entry.requestedModel,
+          inputTokens: f.inputTokens || 0, outputTokens: f.outputTokens || 0,
+          cacheReadTokens: f.cacheReadTokens || 0, cacheWriteTokens: f.cacheWriteTokens || 0, reasoningTokens: f.reasoningTokens || 0,
+          latencyMs: ms, firstByteMs: entry.firstByteMs, stream: entry.stream,
+          status: f.status, httpStatus: entry.httpStatus, errorType: entry.errorType, cliSessionId,
+        };
+        try { const r = onUsage(rec); if (r && typeof r.catch === 'function') r.catch(() => {}); } catch (e) { log.warn(`[llm-bridge] onUsage threw: ${e.message}`); }
+      },
+    };
+    inflight.add(rc);
+    res.on('close', () => {
+      if (res.writableFinished || aborted) return;
+      aborted = true;
+      ac.abort();
+      for (const fn of abortHandlers.splice(0)) { try { fn(); } catch { /* keep going */ } }
+      if (!finished) rc.finish({ status: 'aborted' });
+    });
+
+    try {
+      if (route === 'count') {
+        if (entry.mode === 'passthrough') await handlePassthrough(rc, env, 'count');
+        else {
+          rc.json(200, { input_tokens: calibrator.apply(rc.calKey, estimateInputTokens(body)) });
+          rc.finish({ status: 'ok', httpStatus: 200 });
+        }
+      } else if (entry.mode === 'passthrough') {
+        await handlePassthrough(rc, env, 'messages');
+      } else {
+        await handleTranslate(rc, env);
+      }
+    } finally {
+      if (!finished) {
+        // a handler that returned without settling: never leave the CLI hanging
+        if (!res.headersSent) rc.error(500, 'api_error', 'llm-bridge: request ended without a response');
+        else if (!res.writableEnded) res.end();
+        rc.finish({ status: 'error', httpStatus: res.statusCode || 500, errorType: 'api_error' });
+      }
+    }
+  }
+
+  const server = http.createServer((req, res) => {
+    handle(req, res).catch((e) => {
+      log.error(`[llm-bridge] request failed: ${(e && e.stack) || e}`);
+      if (!res.headersSent && !res.destroyed) sendJson(res, 500, anthropicError('api_error', 'llm-bridge: internal error'));
+      else if (!res.writableEnded) res.destroy();
+    });
+  });
+  // No server-side clocks on a response that may legitimately stream for an hour.
+  server.requestTimeout = 0;
+  server.headersTimeout = 60000;
+  server.timeout = 0;
+  server.keepAliveTimeout = 65000;
+  server.on('clientError', (err, sock) => { try { sock.end('HTTP/1.1 400 Bad Request\r\n\r\n'); } catch { /* gone */ } });
+
+  return {
+    server,
+    /** Loopback only: this port proxies to providers with real keys behind a bearer token. */
+    listen(port = 0, host = '127.0.0.1') {
+      if (!/^(127\.\d+\.\d+\.\d+|::1|localhost)$/.test(String(host))) {
+        return Promise.reject(new Error(`llm-bridge: refusing to listen on non-loopback host ${host}`));
+      }
+      return new Promise((resolve, reject) => {
+        const onErr = (e) => { server.off('listening', onOk); reject(e); };
+        const onOk = () => { server.off('error', onErr); resolve({ port: server.address().port }); };
+        server.once('error', onErr);
+        server.once('listening', onOk);
+        server.listen(port, host);
+      });
+    },
+    address: () => server.address(),
+    recentLog: () => recent.map((e) => ({ ...e })),
+    close() {
+      return new Promise((resolve) => {
+        for (const rc of inflight) { try { rc.res.destroy(); } catch { /* gone */ } }
+        server.close(() => resolve());
+        if (server.closeAllConnections) server.closeAllConnections();
+      });
+    },
+    stats: () => ({ inflight: inflight.size, limiters: Object.fromEntries([...limiters].map(([k, l]) => [k, l.stats()])) }),
+  };
+}
+
+module.exports = { createBridgeServer, tokenOf };
diff --git a/llm-bridge/sse.js b/llm-bridge/sse.js
new file mode 100644
index 00000000..23918021
--- /dev/null
+++ b/llm-bridge/sse.js
@@ -0,0 +1,68 @@
+'use strict';
+// Incremental Server-Sent-Events parser, for both directions we read: OpenAI chunks (translate
+// mode) and Anthropic events (the passthrough usage tap). Byte chunks may split anywhere — inside
+// a UTF-8 sequence, inside a line, between \r and \n — so it buffers until a full line.
+
+const { StringDecoder } = require('string_decoder');
+
+/** onEvent({event, data}) per complete event. feed(Buffer|string); end() flushes a trailing event. */
+function createSseParser(onEvent) {
+  const decoder = new StringDecoder('utf8');
+  let buf = '';
+  let event = null;
+  let data = [];
+
+  function dispatch() {
+    if (data.length || event) onEvent({ event: event || 'message', data: data.join('\n') });
+    event = null;
+    data = [];
+  }
+
+  function line(l) {
+    if (l.endsWith('\r')) l = l.slice(0, -1);
+    if (l === '') { dispatch(); return; }
+    if (l[0] === ':') return; // comment / keep-alive (": OPENROUTER PROCESSING")
+    const i = l.indexOf(':');
+    const field = i < 0 ? l : l.slice(0, i);
+    let v = i < 0 ? '' : l.slice(i + 1);
+    if (v[0] === ' ') v = v.slice(1);
+    if (field === 'event') event = v;
+    else if (field === 'data') data.push(v);
+  }
+
+  return {
+    feed(chunk) {
+      buf += typeof chunk === 'string' ? chunk : decoder.write(chunk);
+      let nl;
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        const l = buf.slice(0, nl);
+        buf = buf.slice(nl + 1);
+        line(l);
+      }
+    },
+    end() {
+      buf += decoder.end();
+      if (buf) { line(buf); buf = ''; }
+      dispatch();
+    },
+  };
+}
+
+/**
+ * JSON payloads of one event's data. Non-compliant servers put several `data:` lines of complete
+ * JSON in one event (no blank line between); the spec joins them with \n, which is not JSON, so
+ * fall back to parsing each line on its own.
+ */
+function parseEventJson(data) {
+  if (!data) return [];
+  try { return [JSON.parse(data)]; } catch { /* fall through */ }
+  const out = [];
+  for (const l of data.split('\n')) {
+    const t = l.trim();
+    if (!t || t === '[DONE]') continue;
+    try { out.push(JSON.parse(t)); } catch { /* junk line: skip */ }
+  }
+  return out;
+}
+
+module.exports = { createSseParser, parseEventJson };
diff --git a/llm-bridge/translate-request.js b/llm-bridge/translate-request.js
new file mode 100644
index 00000000..f9c0ec45
--- /dev/null
+++ b/llm-bridge/translate-request.js
@@ -0,0 +1,416 @@
+'use strict';
+// Anthropic Messages request -> OpenAI Chat Completions request. Pure: (body, run context,
+// dialect) in, upstream body out. No I/O, so every rule here is pinned by
+// test/llm-bridge-translate.test.js without a server.
+//
+// The upstream body is built FROM SCRATCH (never by copying the Anthropic body), so an Anthropic
+// field we do not understand can never leak through and 400 an OpenAI validator:
+// context_management, container, mcp_servers, service_tier, citations and output_config (after its
+// effort is read) are simply never copied.
+
+const { textOf, sha256hex, deepMerge, isPlainObject } = require('./util');
+const { upstreamToolName, toolNameReverseMap, upstreamToolId, readSignature } = require('./ids');
+const { sanitizeSchema } = require('./schema');
+const { effectiveEffort, clampMaxTokens } = require('./models');
+
+class BadRequest extends Error {}
+
+const BILLING_RE = /^\s*x-anthropic-billing-header:/;
+const IMAGE_OMITTED = '[image omitted: this model does not accept images]';
+const PDF_OMITTED = '[PDF document omitted: this model cannot read PDF files directly. If you need its contents, '
+  + 'extract the text from the original file with a shell tool (for example `pdftotext file.pdf -`) and read that.]';
+const NO_OUTPUT = '(no output)';
+const INTERRUPTED = '(no result: the tool call was interrupted before it returned)';
+const QWEN_BUDGET = { low: 2048, medium: 8192, high: 16384, xhigh: 32768 };
+
+// ------------------------------------------------------------------ content --
+
+function makeEnv(ctx, dialect, caps) {
+  return {
+    dialect, caps,
+    providerId: ctx && ctx.provider ? ctx.provider.id : '',
+    vision: caps.vision !== false,
+    pdf: dialect.fileParts && caps.pdf !== false,
+    idStyle: dialect.toolIdStyle,
+  };
+}
+
+function textPart(text, block, env) {
+  const p = { type: 'text', text };
+  if (env.dialect.cacheControl && block && block.cache_control) p.cache_control = block.cache_control;
+  return p;
+}
+
+function imageUrl(block) {
+  const src = block && block.source;
+  if (!src || typeof src !== 'object') return null;
+  if (src.type === 'base64' && src.data) return `data:${src.media_type || 'image/png'};base64,${src.data}`;
+  if (src.type === 'url' && src.url) return src.url;
+  return null; // Files-API ids and unknown sources cannot be expressed upstream
+}
+
+/** An image block -> an image_url part, or a text placeholder when the model cannot see it. */
+function imagePart(block, env) {
+  const url = imageUrl(block);
+  if (!env.vision) return textPart(IMAGE_OMITTED, block, env);
+  if (!url) return textPart('[image omitted: unsupported image source]', block, env);
+  const p = { type: 'image_url', image_url: { url } };
+  if (env.dialect.cacheControl && block.cache_control) p.cache_control = block.cache_control;
+  return p;
+}
+
+/** A document block -> file part (PDF, when the dialect can), text, or a placeholder. Never a 400. */
+function documentPart(block, env) {
+  const src = (block && block.source) || {};
+  const title = typeof block.title === 'string' && block.title ? `${block.title}\n\n` : '';
+  if (src.type === 'text' && typeof src.data === 'string') return textPart(title + src.data, block, env);
+  if (src.type === 'content') return textPart(title + textOf(src.content), block, env);
+  if (src.type === 'base64' && /pdf/i.test(src.media_type || 'application/pdf') && src.data) {
+    if (env.pdf) return { type: 'file', file: { filename: 'document.pdf', file_data: `data:application/pdf;base64,${src.data}` } };
+    return textPart(PDF_OMITTED, block, env);
+  }
+  if (src.type === 'url' && src.url) return textPart(`[document at ${src.url} omitted: fetch it with a tool if you need its contents]`, block, env);
+  return textPart('[document omitted: unsupported document source]', block, env);
+}
+
+/** A search_result block (tool output of search tools) as plain text. */
+function searchResultText(b) {
+  const head = [b.title, b.source].filter((s) => typeof s === 'string' && s).join(' — ');
+  return [head, textOf(b.content)].filter(Boolean).join('\n');
+}
+
+/** Consecutive text-only parts collapse to a string (what every provider accepts). */
+function collapse(parts) {
+  if (parts.every((p) => p.type === 'text' && !p.cache_control)) return parts.map((p) => p.text).join('\n\n');
+  return parts;
+}
+
+/**
+ * A tool_result block -> { msg: {role:'tool'}, images: [user parts] }. Images cannot go in a tool
+ * message (OpenAI tool content is text), so they ride in a user message right after; the reference
+ * translator dropped them, which blinded the model on every screenshot tool.
+ */
+function toolResult(b, env) {
+  const texts = [];
+  const images = [];
+  const c = b.content;
+  if (typeof c === 'string') texts.push(c);
+  else if (Array.isArray(c)) {
+    for (const x of c) {
+      if (!x || typeof x !== 'object') continue;
+      if (x.type === 'text' && typeof x.text === 'string') texts.push(x.text);
+      else if (x.type === 'image') {
+        if (env.vision && imageUrl(x)) images.push(imagePart(x, env));
+        else texts.push(env.vision ? '[image omitted: unsupported image source]' : IMAGE_OMITTED);
+      } else if (x.type === 'document') {
+        const d = documentPart(x, env);
+        if (d.type === 'text') texts.push(d.text); else images.push(d);
+      } else if (x.type === 'search_result') texts.push(searchResultText(x));
+      else if (x.type === 'tool_reference' && x.tool_name) texts.push(`[tool loaded: ${x.tool_name}]`);
+      else if (typeof x.text === 'string') texts.push(x.text);
+    }
+  }
+  let text = texts.filter(Boolean).join('\n\n');
+  if (!text) text = images.length ? '(the output is the image attached in the next message)' : NO_OUTPUT;
+  if (b.is_error) text = `[tool error] ${text}`;
+  const msg = { role: 'tool', tool_call_id: upstreamToolId(b.tool_use_id, env.idStyle), content: text };
+  if (!images.length) return { msg, userParts: [] };
+  const kind = images.every((p) => p.type === 'image_url') ? 'image' : 'attachment';
+  const label = `[${kind} from tool result${b.tool_use_id ? ` ${b.tool_use_id}` : ''}]`;
+  return { msg, userParts: [{ type: 'text', text: label }, ...images] };
+}
+
+function convertUser(content, env) {
+  if (typeof content === 'string') return content ? [{ role: 'user', content }] : [];
+  if (!Array.isArray(content)) return [];
+  const toolMsgs = [];
+  const toolParts = [];
+  const parts = [];
+  for (const b of content) {
+    if (!b || typeof b !== 'object') { if (typeof b === 'string' && b) parts.push(textPart(b, null, env)); continue; }
+    switch (b.type) {
+      case 'text': if (typeof b.text === 'string' && b.text) parts.push(textPart(b.text, b, env)); break;
+      case 'image': parts.push(imagePart(b, env)); break;
+      case 'document': parts.push(documentPart(b, env)); break;
+      case 'tool_result': { const r = toolResult(b, env); toolMsgs.push(r.msg); toolParts.push(...r.userParts); break; }
+      case 'search_result': parts.push(textPart(searchResultText(b), b, env)); break;
+      case 'thinking': case 'redacted_thinking': break; // never valid in a user turn
+      default: if (typeof b.text === 'string' && b.text) parts.push(textPart(b.text, b, env));
+    }
+  }
+  // tool messages must directly follow the assistant's tool_calls, so they go first
+  const out = [...toolMsgs];
+  const userParts = [...toolParts, ...parts];
+  if (userParts.length) out.push({ role: 'user', content: collapse(userParts) });
+  return out;
+}
+
+function convertAssistant(content, env) {
+  if (typeof content === 'string') return content ? [{ role: 'assistant', content }] : [];
+  if (!Array.isArray(content)) return [];
+  const texts = [];
+  const toolCalls = [];
+  const reasoning = [];
+  const details = [];
+  for (const b of content) {
+    if (!b || typeof b !== 'object') continue;
+    if (b.type === 'text' && typeof b.text === 'string' && b.text) texts.push(b.text);
+    else if (b.type === 'tool_use') {
+      let args;
+      try { args = JSON.stringify(b.input == null ? {} : b.input); } catch { args = '{}'; }
+      toolCalls.push({ id: upstreamToolId(b.id, env.idStyle), type: 'function', function: { name: upstreamToolName(b.name), arguments: args } });
+    } else if (b.type === 'thinking') {
+      // Only reasoning THIS provider produced goes back (its own signature). A real Anthropic
+      // signature or another provider's reasoning means nothing here, so it is dropped.
+      const sig = readSignature(b.signature);
+      if (sig && sig.p === env.providerId) {
+        if (typeof b.thinking === 'string' && b.thinking) reasoning.push(b.thinking);
+        if (Array.isArray(sig.d)) details.push(...sig.d);
+      }
+    }
+    // redacted_thinking, server_tool_use, web_search_tool_result, …: nothing an OpenAI model can take
+  }
+  if (!texts.length && !toolCalls.length) return [];
+  const msg = { role: 'assistant', content: texts.length ? texts.join('\n\n') : null };
+  if (toolCalls.length) msg.tool_calls = toolCalls;
+  const echo = env.dialect.reasoningEcho;
+  if (echo === 'reasoning_content' && reasoning.length) msg.reasoning_content = reasoning.join('');
+  else if (echo === 'reasoning_details' && (details.length || reasoning.length)) {
+    msg.reasoning_details = details.length ? details : [{ type: 'reasoning.text', text: reasoning.join(''), index: 0 }];
+  }
+  return [msg];
+}
+
+// ------------------------------------------------------------- history repair --
+
+/**
+ * OpenAI rejects a tool message that does not answer the assistant turn right before it, and an
+ * assistant tool_call left without an answer. Anthropic histories can have both (an interrupted
+ * turn, a compaction that cut between the two), so: answer the unanswered, demote the orphaned.
+ */
+function repairToolPairs(msgs) {
+  const demote = (t) => ({ role: 'user', content: `[result of tool call ${t.tool_call_id}]\n${t.content}` });
+  const out = [];
+  for (let i = 0; i < msgs.length; i++) {
+    const m = msgs[i];
+    if (m.role === 'tool') { out.push(demote(m)); continue; } // answers nothing before it
+    out.push(m);
+    if (m.role !== 'assistant' || !m.tool_calls) continue;
+    const want = new Set(m.tool_calls.map((t) => t.id));
+    const demoted = [];
+    let j = i + 1;
+    for (; j < msgs.length && msgs[j].role === 'tool'; j++) {
+      const t = msgs[j];
+      if (want.has(t.tool_call_id)) { want.delete(t.tool_call_id); out.push(t); } else demoted.push(demote(t));
+    }
+    for (const id of want) out.push({ role: 'tool', tool_call_id: id, content: INTERRUPTED });
+    out.push(...demoted); // after the whole tool run, so no user message splits it
+    i = j - 1;
+  }
+  return out;
+}
+
+const asParts = (c) => (typeof c === 'string' ? (c ? [{ type: 'text', text: c }] : []) : Array.isArray(c) ? c : []);
+
+/** Merge adjacent same-role user/assistant messages — strict providers require alternation. */
+function mergeAdjacent(msgs) {
+  const out = [];
+  for (const m of msgs) {
+    const prev = out[out.length - 1];
+    if (prev && prev.role === m.role && m.role === 'user') {
+      prev.content = typeof prev.content === 'string' && typeof m.content === 'string'
+        ? [prev.content, m.content].filter(Boolean).join('\n\n')
+        : collapse([...asParts(prev.content), ...asParts(m.content)]);
+      continue;
+    }
+    if (prev && prev.role === m.role && m.role === 'assistant' && !prev.tool_calls) {
+      prev.content = [prev.content, m.content].filter(Boolean).join('\n\n') || null;
+      if (m.tool_calls) prev.tool_calls = m.tool_calls;
+      if (m.reasoning_content) prev.reasoning_content = (prev.reasoning_content || '') + m.reasoning_content;
+      if (m.reasoning_details) prev.reasoning_details = [...(prev.reasoning_details || []), ...m.reasoning_details];
+      continue;
+    }
+    out.push({ ...m });
+  }
+  return out;
+}
+
+/** Mistral: "Unexpected role 'user' after role 'tool'" — fold such text into the last tool message. */
+function foldUserAfterTool(msgs) {
+  const out = [];
+  for (const m of msgs) {
+    const prev = out[out.length - 1];
+    if (prev && prev.role === 'tool' && m.role === 'user' && typeof m.content === 'string') {
+      prev.content = `${prev.content}\n\n${m.content}`;
+      continue;
+    }
+    out.push(m);
+  }
+  return out;
+}
+
+// -------------------------------------------------------------------- tools --
+
+function convertTools(tools, dialect) {
+  const out = [];
+  for (const t of Array.isArray(tools) ? tools : []) {
+    if (!t || typeof t !== 'object' || !t.name) continue;
+    if (t.type !== undefined && t.type !== null && t.type !== 'custom') continue; // server tools (web_search_*, bash_*, …)
+    out.push({
+      type: 'function',
+      function: {
+        name: upstreamToolName(t.name),
+        description: typeof t.description === 'string' ? t.description : '',
+        parameters: sanitizeSchema(t.input_schema, dialect.schemaSanitize),
+      },
+    });
+  }
+  return out;
+}
+
+function convertToolChoice(choice) {
+  if (!choice || typeof choice !== 'object') return { choice: undefined, parallel: undefined };
+  const parallel = choice.disable_parallel_tool_use === true ? false : undefined;
+  switch (choice.type) {
+    case 'auto': return { choice: 'auto', parallel };
+    case 'any': return { choice: 'required', parallel };
+    case 'none': return { choice: 'none', parallel };
+    case 'tool': return choice.name ? { choice: { type: 'function', function: { name: upstreamToolName(choice.name) } }, parallel } : { choice: undefined, parallel };
+    default: return { choice: undefined, parallel };
+  }
+}
+
+// ------------------------------------------------------------------- effort --
+
+/** Writes the dialect's effort parameter into `up`. Returns true when reasoning is ON. */
+function applyEffort(up, effort, dialect, caps) {
+  if (effort == null || caps.reasoning === false) return false;
+  if (dialect.effortRequiresCaps && caps.reasoning !== true) return false;
+  const v = dialect.effortMap ? dialect.effortMap[effort] : undefined;
+  switch (dialect.effortParam) {
+    case 'reasoning_effort':
+      if (!v) return false;
+      up.reasoning_effort = v;
+      return v !== 'none';
+    case 'reasoning':
+      if (effort === 'none' || v === 'none') { up.reasoning = { enabled: false }; return false; }
+      if (!v) return false;
+      up.reasoning = { effort: v };
+      return true;
+    case 'thinking':
+      up.thinking = { type: effort === 'none' ? 'disabled' : 'enabled' };
+      return effort !== 'none';
+    case 'enable_thinking':
+      if (effort === 'none') { up.enable_thinking = false; return false; }
+      up.enable_thinking = true;
+      up.thinking_budget = effort === 'max' ? (caps.maxOutput || 32768) : QWEN_BUDGET[effort] || QWEN_BUDGET.medium;
+      return true;
+    default:
+      return false;
+  }
+}
+
+// --------------------------------------------------------------------- main --
+
+/**
+ * @returns {{ body, upstreamStream, toolNames: Map, stopSequences: string[], emitThinking, effort, reasoningOn }}
+ * @throws BadRequest on a body that cannot be a Messages request at all
+ */
+function toOpenAI(body, { ctx, dialect, upstreamModel, caps }) {
+  if (!isPlainObject(body)) throw new BadRequest('request body must be a JSON object');
+  if (!Array.isArray(body.messages)) throw new BadRequest('messages: field required (a list)');
+  const env = makeEnv(ctx, dialect, caps);
+
+  // system: top-level (string or text blocks) minus the per-request billing header, which varies
+  // on every call and would defeat the provider's prefix cache from byte one
+  let sysBlocks = typeof body.system === 'string'
+    ? [{ type: 'text', text: body.system }]
+    : (Array.isArray(body.system) ? body.system : []).filter((b) => b && b.type === 'text' && typeof b.text === 'string' && b.text);
+  if (sysBlocks.length && BILLING_RE.test(sysBlocks[0].text)) sysBlocks = sysBlocks.slice(1);
+
+  const msgs = [];
+  let seenAssistant = false;
+  for (let i = 0; i < body.messages.length; i++) {
+    const m = body.messages[i];
+    if (!m || typeof m !== 'object') throw new BadRequest(`messages.${i}: must be an object`);
+    if (m.role === 'system') {
+      // CLI 2.1.197+ puts context (environment, token budget) in system-role entries INSIDE messages
+      const t = textOf(m.content);
+      if (!t) continue;
+      if (dialect.systemFold === 'all' || !seenAssistant) sysBlocks.push({ type: 'text', text: t });
+      else msgs.push({ role: 'user', content: /^\s*</.test(t) ? t : `<system-reminder>\n${t}\n</system-reminder>` });
+      continue;
+    }
+    if (m.role === 'assistant') { seenAssistant = true; msgs.push(...convertAssistant(m.content, env)); continue; }
+    if (m.role === 'user') { msgs.push(...convertUser(m.content, env)); continue; }
+    throw new BadRequest(`messages.${i}.role: must be 'user', 'assistant' or 'system' (got ${JSON.stringify(m.role)})`);
+  }
+
+  let history = mergeAdjacent(repairToolPairs(msgs));
+  if (dialect.noUserAfterTool) history = foldUserAfterTool(history);
+  const messages = [];
+  if (sysBlocks.length) {
+    const cached = dialect.cacheControl && sysBlocks.some((b) => b.cache_control);
+    messages.push({
+      role: 'system',
+      content: cached ? sysBlocks.map((b) => textPart(b.text, b, env)) : sysBlocks.map((b) => b.text).join('\n\n'),
+    });
+  }
+  messages.push(...history);
+  if (!history.length) throw new BadRequest('messages: no usable content');
+
+  const up = { model: upstreamModel, messages };
+
+  const maxTokens = clampMaxTokens(body.max_tokens, caps);
+  if (maxTokens) up[dialect.maxTokensField] = maxTokens;
+
+  const effort = effectiveEffort(ctx, body);
+  const reasoningOn = applyEffort(up, effort, dialect, caps);
+
+  const dropSampling = reasoningOn && dialect.dropSamplingWithReasoning;
+  if (typeof body.temperature === 'number' && !dropSampling) up.temperature = body.temperature;
+  if (typeof body.top_p === 'number' && !dropSampling) up.top_p = body.top_p;
+  if (dialect.allowTopK && Number.isInteger(body.top_k)) up.top_k = body.top_k;
+  const stopSequences = Array.isArray(body.stop_sequences) ? body.stop_sequences.filter((s) => typeof s === 'string' && s).slice(0, 4) : [];
+  if (stopSequences.length) up.stop = stopSequences;
+
+  const tools = caps.tools === false ? [] : convertTools(body.tools, dialect);
+  if (tools.length) {
+    up.tools = tools;
+    const { choice, parallel } = convertToolChoice(body.tool_choice);
+    if (choice !== undefined) up.tool_choice = choice;
+    if (parallel !== undefined) up.parallel_tool_calls = parallel;
+  }
+
+  const uid = body.metadata && body.metadata.user_id;
+  if (dialect.sendUser && typeof uid === 'string' && uid) up.user = sha256hex(uid).slice(0, 32);
+
+  // structured output (`--json-schema`): Anthropic output_config.format -> OpenAI response_format
+  const fmt = body.output_config && body.output_config.format;
+  if (fmt && fmt.type === 'json_schema' && isPlainObject(fmt.schema)) {
+    up.response_format = { type: 'json_schema', json_schema: { name: 'output', schema: sanitizeSchema(fmt.schema, dialect.schemaSanitize) } };
+  }
+
+  const upstreamStream = dialect.upstreamStream !== false;
+  if (upstreamStream) {
+    up.stream = true;
+    if (dialect.streamUsage) up.stream_options = { include_usage: true };
+  }
+  if (dialect.usageInclude) up.usage = { include: true };
+
+  const extra = ctx && ctx.provider && ctx.provider.options && ctx.provider.options.extraBody;
+  const final = isPlainObject(extra) ? deepMerge(up, extra) : up;
+
+  const t = body.thinking;
+  return {
+    body: final,
+    upstreamStream,
+    toolNames: toolNameReverseMap(body),
+    stopSequences,
+    emitThinking: !!(t && (t.type === 'enabled' || t.type === 'adaptive')),
+    effort,
+    reasoningOn,
+  };
+}
+
+module.exports = { toOpenAI, BadRequest, applyEffort, convertTools, IMAGE_OMITTED, PDF_OMITTED, NO_OUTPUT, INTERRUPTED };
diff --git a/llm-bridge/translate-response.js b/llm-bridge/translate-response.js
new file mode 100644
index 00000000..745f8336
--- /dev/null
+++ b/llm-bridge/translate-response.js
@@ -0,0 +1,348 @@
+'use strict';
+// OpenAI Chat Completions output -> Anthropic Messages events. ONE state machine serves both
+// client modes: a streaming client gets the events as SSE frames, a non-streaming client gets
+// the Message JSON the aggregator builds from the very same events — so the two paths cannot
+// disagree about content, stop reason or usage.
+//
+// Invariants (pinned by the stream checker in test/llm-bridge-translate.test.js):
+//   exactly one message_start; block indexes strictly increasing; at most one block open;
+//   every content_block_start has its content_block_stop; a successful stream ends with
+//   message_delta (carrying usage) + message_stop; a failed one ends with `error` and no stop.
+
+const { randomAlnum } = require('./util');
+const { anthropicToolId, makeSignature } = require('./ids');
+const { parseToolArguments } = require('./json-repair');
+const { estimateTextTokens } = require('./estimate');
+
+const int = (v) => (Number.isFinite(Number(v)) && v !== null && v !== '' ? Math.max(0, Math.round(Number(v))) : null);
+const TAIL = 256;
+
+/** Merge streamed reasoning_details items by (type, index): text/summary/data concatenate, the rest overwrites. */
+function mergeDetails(into, items) {
+  for (const it of items) {
+    if (!it || typeof it !== 'object') continue;
+    const key = `${it.type || ''}#${it.index != null ? it.index : into.length}`;
+    const prev = into.find((x) => x.__k === key);
+    if (!prev) { into.push({ ...it, __k: key }); continue; }
+    for (const [k, v] of Object.entries(it)) {
+      if ((k === 'text' || k === 'summary' || k === 'data') && typeof v === 'string' && typeof prev[k] === 'string') prev[k] += v;
+      else if (v !== undefined && v !== null) prev[k] = v;
+    }
+  }
+}
+const cleanDetails = (arr) => arr.map(({ __k, ...rest }) => rest);
+
+/** The shown reasoning text of a delta/message: reasoning_content, reasoning, or the details' text. */
+function reasoningOf(d) {
+  if (typeof d.reasoning_content === 'string' && d.reasoning_content) return d.reasoning_content;
+  if (typeof d.reasoning === 'string' && d.reasoning) return d.reasoning;
+  if (!Array.isArray(d.reasoning_details)) return '';
+  let s = '';
+  for (const x of d.reasoning_details) {
+    if (!x || typeof x !== 'object') continue;
+    if ((x.type == null || x.type === 'reasoning.text') && typeof x.text === 'string') s += x.text;
+    else if (x.type === 'reasoning.summary' && typeof x.summary === 'string') s += x.summary;
+    // reasoning.encrypted: never shown, only carried in the signature for the echo
+  }
+  return s;
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.clientModel      the model name the CLI sent (echoed back, as Anthropic does)
+ * @param {string} o.providerId       stamped into thinking signatures
+ * @param {Map}    o.toolNames        upstream tool name -> original
+ * @param {string[]} o.stopSequences
+ * @param {number} o.inputEstimate    calibrated estimate for message_start / missing usage
+ * @param {boolean} o.emitThinking    the client asked for thinking
+ * @param {(event:string, data:object)=>void} o.sink
+ */
+function createTranslator(o) {
+  const sink = o.sink;
+  const toolNames = o.toolNames || new Map();
+  const stops = o.stopSequences || [];
+  const st = {
+    id: `msg_${randomAlnum(24)}`,
+    started: false, ended: false, failed: false,
+    next: 0, open: null,
+    tools: [], byIndex: new Map(), byId: new Map(), lastTool: null,
+    emittedTools: 0, invalidArgs: 0, repairedArgs: 0, droppedTools: 0,
+    finish: null, matchedStop: null, refusal: false,
+    usage: null, tail: '', outChars: 0, sawChunk: false,
+  };
+
+  const emit = (event, data) => sink(event, data);
+
+  function start() {
+    if (st.started) return;
+    st.started = true;
+    emit('message_start', {
+      type: 'message_start',
+      message: {
+        id: st.id, type: 'message', role: 'assistant', model: o.clientModel, content: [],
+        stop_reason: null, stop_sequence: null,
+        usage: { input_tokens: o.inputEstimate || 1, output_tokens: 1, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 },
+      },
+    });
+    emit('ping', { type: 'ping' });
+  }
+
+  function closeOpen() {
+    if (!st.open) return;
+    const { kind, index, details } = st.open;
+    if (kind === 'thinking') {
+      emit('content_block_delta', { type: 'content_block_delta', index, delta: { type: 'signature_delta', signature: makeSignature(o.providerId, cleanDetails(details)) } });
+    }
+    emit('content_block_stop', { type: 'content_block_stop', index });
+    st.open = null;
+  }
+
+  function openBlock(kind, block) {
+    closeOpen();
+    const index = st.next++;
+    st.open = { kind, index, details: [] };
+    emit('content_block_start', { type: 'content_block_start', index, content_block: block });
+    return index;
+  }
+
+  function thinking(text, details) {
+    if (!o.emitThinking) return;
+    start();
+    // reasoning after the answer began opens a NEW thinking block (interleaved thinking) —
+    // dropping it (the reference translator did) loses the model's reasoning about tool results
+    if (!st.open || st.open.kind !== 'thinking') openBlock('thinking', { type: 'thinking', thinking: '', signature: '' });
+    if (details && details.length) mergeDetails(st.open.details, details);
+    if (text) {
+      st.outChars += text.length;
+      emit('content_block_delta', { type: 'content_block_delta', index: st.open.index, delta: { type: 'thinking_delta', thinking: text } });
+    }
+  }
+
+  function text(t) {
+    start();
+    if (!st.open || st.open.kind !== 'text') openBlock('text', { type: 'text', text: '' });
+    st.outChars += t.length;
+    st.tail = (st.tail + t).slice(-TAIL);
+    emit('content_block_delta', { type: 'content_block_delta', index: st.open.index, delta: { type: 'text_delta', text: t } });
+  }
+
+  /** Accumulate a streamed tool call. Keyed by index, and by id when the index is missing or reused. */
+  function toolDelta(tc) {
+    if (!tc || typeof tc !== 'object') return;
+    start();
+    const idx = Number.isInteger(tc.index) ? tc.index : null;
+    const id = typeof tc.id === 'string' && tc.id ? tc.id : null;
+    let e = null;
+    if (idx !== null) {
+      e = st.byIndex.get(idx) || null;
+      if (e && id && e.id && e.id !== id) e = null;          // index reused for a new call
+      if (!e && id) e = st.byId.get(id) || null;
+    } else if (id) {
+      e = st.byId.get(id) || null;
+    } else {
+      e = st.lastTool;                                         // no index, no id: continuation
+    }
+    if (!e || e.flushed) {
+      e = { id: null, name: '', args: '', order: st.tools.length, flushed: false };
+      st.tools.push(e);
+    }
+    if (idx !== null) st.byIndex.set(idx, e);
+    if (id && !e.id) { e.id = id; st.byId.set(id, e); }
+    const fn = tc.function || {};
+    if (typeof fn.name === 'string' && fn.name) {
+      // some servers repeat the full name on every chunk; only a longer spelling replaces it
+      if (!e.name || (fn.name.length > e.name.length && fn.name.startsWith(e.name))) e.name = fn.name;
+    }
+    if (typeof fn.arguments === 'string') e.args += fn.arguments;
+    else if (fn.arguments && typeof fn.arguments === 'object') e.args = JSON.stringify(fn.arguments);
+    st.lastTool = e;
+  }
+
+  /** Emit every accumulated tool call as ONE complete block (never partial JSON). */
+  function flushTools() {
+    const pending = st.tools.filter((t) => !t.flushed);
+    if (!pending.length) return;
+    closeOpen();
+    for (const t of pending) {
+      t.flushed = true;
+      const parsed = parseToolArguments(t.args);
+      if (parsed.invalid && st.finish === 'length') { st.droppedTools++; continue; } // cut off by max_tokens
+      if (parsed.invalid) st.invalidArgs++;
+      if (parsed.repaired) st.repairedArgs++;
+      const index = st.next++;
+      const name = toolNames.get(t.name) || t.name || 'unknown_tool';
+      emit('content_block_start', { type: 'content_block_start', index, content_block: { type: 'tool_use', id: anthropicToolId(t.id), name, input: {} } });
+      emit('content_block_delta', { type: 'content_block_delta', index, delta: { type: 'input_json_delta', partial_json: JSON.stringify(parsed.value) } });
+      emit('content_block_stop', { type: 'content_block_stop', index });
+      st.emittedTools++;
+    }
+  }
+
+  /** Feed one parsed upstream chunk. Returns {error} for an in-band error chunk (the caller decides how to fail). */
+  function chunk(c) {
+    if (st.ended || st.failed || !c || typeof c !== 'object') return null;
+    st.sawChunk = true;
+    // OpenRouter's mid-stream failure carries BOTH `error` and a choice with finish_reason
+    // "error"; either one alone means the answer is incomplete and must not end as end_turn.
+    if (c.error !== undefined && c.error !== null && c.error !== '') return { error: c.error };
+    if (c.usage && typeof c.usage === 'object') st.usage = c.usage;
+    const ch = Array.isArray(c.choices) ? c.choices[0] : null;
+    if (!ch || typeof ch !== 'object') return null;
+    if (ch.finish_reason === 'error') return { error: { message: 'upstream stream ended with finish_reason "error"' } };
+    const d = ch.delta || ch.message || {};
+    const r = reasoningOf(d);
+    const det = Array.isArray(d.reasoning_details) ? d.reasoning_details : null;
+    if (r || (det && det.length)) thinking(r, det);
+    let content = d.content;
+    if (Array.isArray(content)) content = content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join('');
+    if (typeof content === 'string' && content) text(content);
+    if (typeof d.refusal === 'string' && d.refusal) { text(d.refusal); st.refusal = true; }
+    if (Array.isArray(d.tool_calls)) for (const tc of d.tool_calls) toolDelta(tc);
+    if (d.function_call && typeof d.function_call === 'object') toolDelta({ index: 0, function: d.function_call });
+    if (ch.finish_reason) {
+      st.finish = ch.finish_reason;
+      const ms = typeof ch.stop_reason === 'string' ? ch.stop_reason : typeof ch.matched_stop === 'string' ? ch.matched_stop : null;
+      if (ms) st.matchedStop = ms;
+      flushTools();
+    }
+    return null;
+  }
+
+  function stopReason() {
+    if (st.emittedTools > 0) return { reason: 'tool_use', seq: null };
+    if (st.finish === 'length') return { reason: 'max_tokens', seq: null };
+    if (st.finish === 'content_filter' || st.refusal) return { reason: 'refusal', seq: null };
+    if (stops.length && (st.finish === 'stop' || st.finish == null)) {
+      if (st.matchedStop && stops.includes(st.matchedStop)) return { reason: 'stop_sequence', seq: st.matchedStop };
+      const hit = stops.find((s) => st.tail.endsWith(s));
+      if (hit) return { reason: 'stop_sequence', seq: hit };
+    }
+    return { reason: 'end_turn', seq: null };
+  }
+
+  /** Usage in Anthropic terms, plus what the usage record needs. Estimates fill what the upstream omitted. */
+  function usage() {
+    const u = st.usage || {};
+    const ptd = u.prompt_tokens_details || {};
+    const prompt = int(u.prompt_tokens != null ? u.prompt_tokens : u.input_tokens);
+    const cached = int(ptd.cached_tokens != null ? ptd.cached_tokens : u.prompt_cache_hit_tokens != null ? u.prompt_cache_hit_tokens : u.cache_read_input_tokens) || 0;
+    const cacheWrite = int(ptd.cache_write_tokens != null ? ptd.cache_write_tokens : u.cache_creation_input_tokens) || 0;
+    const completion = int(u.completion_tokens != null ? u.completion_tokens : u.output_tokens);
+    const ctd = u.completion_tokens_details || {};
+    const reasoning = int(ctd.reasoning_tokens != null ? ctd.reasoning_tokens : u.reasoning_tokens) || 0;
+    const estimatedInput = prompt == null;
+    const totalIn = estimatedInput ? (o.inputEstimate || 1) : prompt;
+    return {
+      input: Math.max(0, totalIn - cached - cacheWrite),
+      output: completion == null ? estimateTextTokens(st.outChars + st.tools.reduce((n, t) => n + t.args.length, 0)) : completion,
+      cacheRead: cached, cacheWrite, reasoning,
+      promptTotal: estimatedInput ? null : prompt,
+      estimated: estimatedInput || completion == null,
+    };
+  }
+
+  /** The upstream finished normally: flush, close, message_delta + message_stop. */
+  function end() {
+    if (st.ended || st.failed) return;
+    start();
+    flushTools();
+    closeOpen();
+    st.ended = true;
+    const u = usage();
+    const sr = stopReason();
+    emit('message_delta', {
+      type: 'message_delta',
+      delta: { stop_reason: sr.reason, stop_sequence: sr.seq },
+      usage: { input_tokens: u.input, output_tokens: u.output, cache_read_input_tokens: u.cacheRead, cache_creation_input_tokens: u.cacheWrite },
+    });
+    emit('message_stop', { type: 'message_stop' });
+  }
+
+  /** The stream failed after it started: close the open block, `error`, and no message_stop. */
+  function fail(type, message) {
+    if (st.ended || st.failed) return;
+    st.failed = true;
+    if (st.started) closeOpen();
+    emit('error', { type: 'error', error: { type, message } });
+  }
+
+  return {
+    start, chunk, end, fail, usage,
+    stopReason: () => stopReason().reason,
+    get started() { return st.started; },
+    get finished() { return st.ended || st.failed; },
+    get sawChunk() { return st.sawChunk; },
+    stats: () => ({ tools: st.emittedTools, invalidArgs: st.invalidArgs, repairedArgs: st.repairedArgs, droppedTools: st.droppedTools, finish: st.finish }),
+  };
+}
+
+/** A non-stream OpenAI response -> one synthetic chunk the translator understands. */
+function completionToChunk(json) {
+  const ch = (json && Array.isArray(json.choices) && json.choices[0]) || {};
+  const m = ch.message || {};
+  return {
+    choices: [{
+      delta: {
+        content: m.content, reasoning_content: m.reasoning_content, reasoning: m.reasoning,
+        reasoning_details: m.reasoning_details, refusal: m.refusal, function_call: m.function_call,
+        tool_calls: Array.isArray(m.tool_calls) ? m.tool_calls.map((t, i) => ({ ...t, index: i })) : undefined,
+      },
+      finish_reason: ch.finish_reason || 'stop',
+      stop_reason: ch.stop_reason, matched_stop: ch.matched_stop,
+    }],
+    usage: json && json.usage,
+  };
+}
+
+/** Builds the Anthropic Message JSON from the event sequence (the non-stream client path). */
+function createAggregator() {
+  const msg = { id: null, type: 'message', role: 'assistant', model: null, content: [], stop_reason: null, stop_sequence: null, usage: {} };
+  const blocks = new Map();
+  let error = null;
+  return {
+    event(name, d) {
+      switch (name) {
+        case 'message_start':
+          msg.id = d.message.id; msg.model = d.message.model; msg.usage = { ...d.message.usage };
+          break;
+        case 'content_block_start': {
+          const b = { ...d.content_block };
+          if (b.type === 'tool_use') b.__json = '';
+          blocks.set(d.index, b);
+          break;
+        }
+        case 'content_block_delta': {
+          const b = blocks.get(d.index);
+          if (!b) break;
+          const x = d.delta;
+          if (x.type === 'text_delta') b.text += x.text;
+          else if (x.type === 'thinking_delta') b.thinking += x.thinking;
+          else if (x.type === 'signature_delta') b.signature = x.signature;
+          else if (x.type === 'input_json_delta') b.__json += x.partial_json;
+          break;
+        }
+        case 'content_block_stop': {
+          const b = blocks.get(d.index);
+          if (b && b.type === 'tool_use') {
+            try { b.input = b.__json ? JSON.parse(b.__json) : {}; } catch { b.input = {}; }
+            delete b.__json;
+          }
+          break;
+        }
+        case 'message_delta':
+          msg.stop_reason = d.delta.stop_reason; msg.stop_sequence = d.delta.stop_sequence;
+          msg.usage = { ...msg.usage, ...d.usage };
+          break;
+        case 'error': error = d.error; break;
+        default: break;
+      }
+    },
+    get error() { return error; },
+    message() {
+      msg.content = [...blocks.keys()].sort((a, b) => a - b).map((k) => blocks.get(k));
+      return msg;
+    },
+  };
+}
+
+module.exports = { createTranslator, createAggregator, completionToChunk, reasoningOf, mergeDetails };
diff --git a/llm-bridge/upstream.js b/llm-bridge/upstream.js
new file mode 100644
index 00000000..bb284f73
--- /dev/null
+++ b/llm-bridge/upstream.js
@@ -0,0 +1,134 @@
+'use strict';
+// Upstream HTTP on core http/https — deliberately NOT global fetch: undici's default 300 s
+// bodyTimeout kills a reasoning model that thinks silently for five minutes, and its
+// headersTimeout does the same before the first byte. Here the only clocks are ours:
+//   connectTimeoutMs — TCP/TLS connect
+//   idleTimeoutMs    — no bytes at all (neither headers nor body) for this long; NOT a total cap
+// plus an AbortSignal so a client disconnect tears the upstream request down.
+
+const http = require('http');
+const https = require('https');
+const zlib = require('zlib');
+const { pipeline, PassThrough } = require('stream');
+
+// keep-alive: a long agent turn makes dozens of calls to the same host; reusing the TLS session
+// saves a handshake per call. A stale pooled socket fails with ECONNRESET, which is retried.
+const AGENTS = {
+  'http:': new http.Agent({ keepAlive: true, maxSockets: 64, keepAliveMsecs: 15000 }),
+  'https:': new https.Agent({ keepAlive: true, maxSockets: 64, keepAliveMsecs: 15000 }),
+};
+
+class UpstreamError extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+/** Transport errors worth one more attempt (only ever before a byte went to the client). */
+const RETRYABLE_CODES = new Set(['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'ECONNECT_TIMEOUT', 'EPIPE', 'EAI_AGAIN', 'ENETUNREACH', 'EHOSTUNREACH', 'ECONNABORTED']);
+
+/**
+ * Send one request. Resolves once response headers arrive with
+ *   { status, headers, stream (decoded body, Readable), destroy(err), reason() }
+ * Rejects on connect/transport/idle failure before headers, or on abort.
+ */
+function send({ url, method = 'POST', headers = {}, body = null, connectTimeoutMs = 30000, idleTimeoutMs = 600000, signal = null }) {
+  return new Promise((resolve, reject) => {
+    let u;
+    try { u = new URL(url); } catch { reject(new UpstreamError('EBADURL', `invalid upstream URL: ${url}`)); return; }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') { reject(new UpstreamError('EBADURL', `unsupported protocol ${u.protocol}`)); return; }
+    if (signal && signal.aborted) { reject(new UpstreamError('ABORTED', 'client disconnected')); return; }
+
+    const lib = u.protocol === 'https:' ? https : http;
+    const hdrs = { ...headers };
+    if (body != null) hdrs['content-length'] = Buffer.byteLength(body);
+    let settled = false;
+    let reason = null;          // why WE destroyed the request (idle, abort) — survives into res 'error'
+    let idleTimer = null;
+    let connectTimer = null;
+
+    const req = lib.request({
+      protocol: u.protocol, hostname: u.hostname, port: u.port || undefined,
+      path: `${u.pathname}${u.search}`, method, headers: hdrs, agent: AGENTS[u.protocol],
+    });
+    const kill = (err) => { if (!reason) reason = err; req.destroy(err); };
+    const clearTimers = () => { clearTimeout(idleTimer); clearTimeout(connectTimer); };
+    const onAbort = () => kill(new UpstreamError('ABORTED', 'client disconnected'));
+    if (signal) signal.addEventListener('abort', onAbort, { once: true });
+    const detach = () => { clearTimers(); if (signal) signal.removeEventListener('abort', onAbort); };
+
+    const armIdle = () => {
+      if (idleTimer) { idleTimer.refresh(); return; }
+      idleTimer = setTimeout(() => kill(new UpstreamError('EIDLE', `no data from upstream for ${Math.round(idleTimeoutMs / 1000)} s`)), idleTimeoutMs);
+    };
+    connectTimer = setTimeout(() => kill(new UpstreamError('ECONNECT_TIMEOUT', `connect timeout after ${Math.round(connectTimeoutMs / 1000)} s`)), connectTimeoutMs);
+
+    req.on('socket', (sock) => {
+      const connected = () => { clearTimeout(connectTimer); armIdle(); };
+      if (!sock.connecting) connected(); // a pooled keep-alive socket
+      else sock.once(u.protocol === 'https:' ? 'secureConnect' : 'connect', connected);
+    });
+
+    req.on('response', (res) => {
+      clearTimeout(connectTimer);
+      armIdle();
+      settled = true;
+      const done = () => detach();
+      res.once('end', done);
+      res.once('close', done);
+      res.once('error', done);
+      // The consumer attaches its listeners only after an await or two; a PassThrough holds the
+      // bytes until then (with backpressure) — a bare 'data' listener here would switch `res` to
+      // flowing mode and drop everything that arrived before the consumer was ready.
+      const out = new PassThrough();
+      const enc = String(res.headers['content-encoding'] || '').toLowerCase();
+      const dec = enc === 'gzip' || enc === 'x-gzip' ? zlib.createGunzip() : enc === 'deflate' ? zlib.createInflate() : enc === 'br' ? zlib.createBrotliDecompress() : null;
+      const onPipeEnd = (err) => { if (err && !reason) reason = err; };
+      if (dec) pipeline(res, dec, out, onPipeEnd); else pipeline(res, out, onPipeEnd);
+      res.on('data', armIdle); // pipe() owns the flow control; this only watches for silence
+      resolve({
+        status: res.statusCode,
+        headers: res.headers,
+        stream: out,
+        decoded: !!dec,
+        destroy: (err) => { kill(err || new UpstreamError('ABORTED', 'closed by bridge')); res.destroy(); out.destroy(); },
+        reason: () => reason,
+      });
+    });
+
+    req.on('error', (err) => {
+      detach();
+      if (!settled) { settled = true; reject(reason || err); }
+    });
+
+    if (body != null) req.end(body); else req.end();
+  });
+}
+
+/**
+ * Read a whole response body (for errors and non-stream JSON), capped. Never rejects:
+ * resolves {text, error} so a mid-body failure still yields what arrived.
+ */
+function readAll(up, max = 4 * 1024 * 1024) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let n = 0;
+    let finished = false;
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      resolve({ text: Buffer.concat(chunks).toString('utf8'), error: error || null });
+    };
+    up.stream.on('data', (c) => {
+      if (n < max) { chunks.push(c); n += c.length; }
+    });
+    up.stream.once('end', () => finish(null));
+    up.stream.once('error', (e) => finish(up.reason() || e));
+    up.stream.once('close', () => finish(up.stream.readableEnded ? null : (up.reason() || new UpstreamError('ECONNRESET', 'upstream closed the connection'))));
+  });
+}
+
+/** Drain and drop a response we are not going to use (so the socket can go back to the pool). */
+function discard(up) {
+  try { up.stream.resume(); up.stream.on('error', () => {}); } catch { /* already gone */ }
+}
+
+module.exports = { send, readAll, discard, UpstreamError, RETRYABLE_CODES, AGENTS };
diff --git a/llm-bridge/util.js b/llm-bridge/util.js
new file mode 100644
index 00000000..1e1f714e
--- /dev/null
+++ b/llm-bridge/util.js
@@ -0,0 +1,81 @@
+'use strict';
+// Small shared helpers for the LLM bridge. Pure, no I/O.
+
+const crypto = require('crypto');
+
+const ALNUM = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+
+/** `n` random alphanumerics (ids the CLI shows or stores, never secrets). */
+function randomAlnum(n) {
+  const bytes = crypto.randomBytes(n);
+  let s = '';
+  for (let i = 0; i < n; i++) s += ALNUM[bytes[i] % ALNUM.length];
+  return s;
+}
+
+/** Deterministic alphanumerics derived from `input` (base62 of sha1) — same input, same output. */
+function hashAlnum(input, n) {
+  let h = crypto.createHash('sha1').update(String(input)).digest();
+  let s = '';
+  while (s.length < n) {
+    for (const b of h) { s += ALNUM[b % ALNUM.length]; if (s.length >= n) break; }
+    h = crypto.createHash('sha1').update(h).digest();
+  }
+  return s;
+}
+
+const sha1hex = (s) => crypto.createHash('sha1').update(String(s)).digest('hex');
+const sha256hex = (s) => crypto.createHash('sha256').update(String(s)).digest('hex');
+
+const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/** Deep merge for plain objects (arrays and scalars in `src` replace). Returns a new object. */
+function deepMerge(dst, src) {
+  if (!isPlainObject(src)) return dst;
+  const out = isPlainObject(dst) ? { ...dst } : {};
+  for (const [k, v] of Object.entries(src)) {
+    out[k] = isPlainObject(v) && isPlainObject(out[k]) ? deepMerge(out[k], v) : v;
+  }
+  return out;
+}
+
+/** Anthropic HTTP status -> error type (the shape the CLI's SDK understands). */
+const STATUS_ERROR_TYPE = {
+  400: 'invalid_request_error', 401: 'authentication_error', 403: 'permission_error',
+  404: 'not_found_error', 413: 'request_too_large', 429: 'rate_limit_error',
+  500: 'api_error', 502: 'api_error', 503: 'overloaded_error', 504: 'api_error', 529: 'overloaded_error',
+};
+const errorTypeFor = (status) => STATUS_ERROR_TYPE[status] || (status >= 500 ? 'api_error' : 'invalid_request_error');
+
+/** `{"type":"error","error":{type,message}}` — every error the bridge itself produces has this shape. */
+function anthropicError(type, message) {
+  return { type: 'error', error: { type, message: String(message) } };
+}
+
+/** One SSE frame in the Anthropic event format. */
+function sseFrame(event, data) {
+  return `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** Plain text of a system value / tool_result content / text-block list. Non-text blocks are ignored. */
+function textOf(content, sep = '\n\n') {
+  if (content == null) return '';
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  const parts = [];
+  for (const b of content) {
+    if (typeof b === 'string') parts.push(b);
+    else if (b && b.type === 'text' && typeof b.text === 'string') parts.push(b.text);
+  }
+  return parts.filter(Boolean).join(sep);
+}
+
+/** Claude-looking model id — the CLI's own defaults for side calls and subagents look like this. */
+const CLAUDE_LIKE_RE = /claude|haiku|sonnet|opus|fable/i;
+
+module.exports = {
+  randomAlnum, hashAlnum, sha1hex, sha256hex, isPlainObject, deepMerge,
+  STATUS_ERROR_TYPE, errorTypeFor, anthropicError, sseFrame, sleep, textOf, CLAUDE_LIKE_RE,
+};
diff --git a/mcp-set-ui-state.js b/mcp-set-ui-state.js
index 2656ee4f..d643e9d0 100644
--- a/mcp-set-ui-state.js
+++ b/mcp-set-ui-state.js
@@ -44,8 +44,7 @@ const SET_UI_STATE_TOOL = {
       },
       model: {
         type: 'string',
-        enum: ['haiku', 'sonnet', 'opus'],
-        description: 'Model to switch to in the UI',
+        description: 'Model to switch to in the UI: a Claude alias (haiku, sonnet, opus, fable) or a provider ref "provider::model" configured in this studio',
       },
       agent: {
         type: 'string',
@@ -137,14 +136,18 @@ async function handleMessage(msg) {
 
       // Validate enum values
       const validModes = ['auto', 'planning', 'task'];
-      const validModels = ['haiku', 'sonnet', 'opus'];
+      // `fable` was missing from this list while every other model picker offered it.
+      // A provider ref ("deepseek::deepseek-chat") is checked for SHAPE only; the UI
+      // ignores a model it does not offer.
+      const validModels = ['haiku', 'sonnet', 'opus', 'fable'];
+      const MODEL_REF_RE = /^[a-z0-9][a-z0-9_-]{0,31}::[A-Za-z0-9._:/@+-]{1,160}$/;
       const validAgents = ['single', 'multi'];
 
       if (mode && !validModes.includes(mode)) {
         sendError(id, -32602, `Invalid mode: ${mode}. Valid values: ${validModes.join(', ')}`);
         return;
       }
-      if (model && !validModels.includes(model)) {
+      if (model && !validModels.includes(model) && !MODEL_REF_RE.test(model)) {
         sendError(id, -32602, `Invalid model: ${model}. Valid values: ${validModels.join(', ')}`);
         return;
       }
diff --git a/mcp-task-manager.js b/mcp-task-manager.js
index 51aff642..0dd5c2cd 100644
--- a/mcp-task-manager.js
+++ b/mcp-task-manager.js
@@ -18,6 +18,11 @@ const SERVER_URL = process.env.TASK_MANAGER_SERVER_URL || 'http://127.0.0.1:3000
 const TASK_ID = process.env.TASK_MANAGER_TASK_ID || '';
 const SESSION_ID = process.env.TASK_MANAGER_SESSION_ID || '';
 const SECRET = process.env.TASK_MANAGER_SECRET || '';
+// Models used to be a fixed enum of four Claude aliases. The studio now routes any
+// provider's model ("deepseek::deepseek-chat"), so the field is free text and the list
+// of what is actually configured arrives from the server; the endpoint re-validates.
+const MODEL_CHOICES = String(process.env.TASK_MANAGER_MODELS || 'haiku, sonnet, opus, fable').slice(0, 4000);
+const MODEL_HELP = `One of: ${MODEL_CHOICES}. An unknown value is ignored and the current task's model is used.`;
 const MAX_STDIN_BUFFER = 10 * 1024 * 1024; // 10 MB
 
 // ─── JSON-RPC helpers ────────────────────────────────────────────────────────
@@ -47,7 +52,7 @@ const TOOLS = [
         context: {
           description: 'Curated context to pass to the child task. Include ONLY what the child needs — issue details, code snippets, error messages, etc. Can be a string or a JSON object. The child reads this via get_current_task.',
         },
-        model: { type: 'string', enum: ['haiku', 'sonnet', 'opus', 'fable'], description: 'AI model for the task (default: inherit from current task)' },
+        model: { type: 'string', description: `AI model for the task (default: inherit from current task). ${MODEL_HELP}` },
         depends_on: { type: 'array', items: { type: 'string' }, description: 'Task IDs that must complete before this task starts' },
         chain_id: { type: 'string', description: 'Add this task to an existing chain' },
         scheduled_at: { type: 'string', description: 'ISO 8601 datetime for delayed execution' },
@@ -71,7 +76,7 @@ const TOOLS = [
               title: { type: 'string' },
               description: { type: 'string' },
               context: { description: 'Context for this specific task' },
-              model: { type: 'string', enum: ['haiku', 'sonnet', 'opus', 'fable'] },
+              model: { type: 'string', description: MODEL_HELP },
               max_turns: { type: 'number' },
               depends_on_index: { type: 'array', items: { type: 'number' }, description: 'Indices (0-based) of tasks in this chain that must complete first. If omitted, depends on previous task.' },
             },
@@ -79,7 +84,7 @@ const TOOLS = [
           },
           description: 'Array of task definitions (max 10)',
         },
-        model: { type: 'string', enum: ['haiku', 'sonnet', 'opus', 'fable'], description: 'Default model for all tasks' },
+        model: { type: 'string', description: `Default model for all tasks. ${MODEL_HELP}` },
         scheduled_at: { type: 'string', description: 'ISO 8601 datetime for delayed execution' },
         recurrence: { type: 'string', pattern: '^(hourly|daily|weekly|monthly|every:[1-9][0-9]*:(hour|day|week|month)|times:[1-9][0-9]*:month)$', description: 'Repeat schedule. A preset (hourly|daily|weekly|monthly), or "every:N:unit" where unit = hour|day|week|month (e.g. "every:2:hour", "every:10:day", "every:6:month"), or "times:N:month" = N runs per calendar month (e.g. "times:3:month").' },
         recurrence_end_at: { type: 'string', description: 'ISO 8601 datetime to stop recurring' },
diff --git a/package.json b/package.json
index 9160bf59..e6fb5037 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   "scripts": {
     "start": "node server.js",
     "dev": "node --watch server.js",
-    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/cli-tool-names.test.js && node test/mcp-web.test.js && node test/gateway-models.test.js && node test/plan-lib.test.js && node test/plan-import.test.js && node test/plans-api.test.js && node test/room-files.test.js && node test/room-git.test.js && node test/room-run.test.js && node test/worktree-manager.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/task-blocked-and-empty-response.test.js",
+    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/cli-tool-names.test.js && node test/mcp-web.test.js && node test/gateway-models.test.js && node test/plan-lib.test.js && node test/plan-import.test.js && node test/plans-api.test.js && node test/room-files.test.js && node test/room-git.test.js && node test/room-run.test.js && node test/worktree-manager.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/task-blocked-and-empty-response.test.js && node test/providers.test.js && node test/llm-bridge-translate.test.js && node test/llm-bridge-server.test.js && node test/llm-bridge-host.test.js && node test/llm-bridge-contract.test.js",
     "postinstall": "node scripts/install-hooks.js",
     "release": "node scripts/release.js",
     "electron:dev": "electron .",
diff --git a/providers-catalog.js b/providers-catalog.js
new file mode 100644
index 00000000..c8e38b9d
--- /dev/null
+++ b/providers-catalog.js
@@ -0,0 +1,95 @@
+// Reading a provider's model catalogue — the one network call the registry makes itself.
+// (Model TRAFFIC goes through llm-bridge/; this is only GET /models.)
+//
+// Two shapes:
+//   openai-compatible            GET <base>/models        Authorization: Bearer <key>
+//   anthropic / -compatible      GET <base>/v1/models     x-api-key and/or Bearer, anthropic-version
+// A provider that publishes no catalogue (404) is not an error for "Test": the endpoint
+// answered, so the key and URL are fine; the user adds model ids by hand.
+'use strict';
+
+const { normalizeCatalog } = require('./providers');
+
+const TIMEOUT_MS = 10000;
+const MAX_PAGES = 5;
+
+function authHeaders(p) {
+  const h = { accept: 'application/json', ...(p.headers || {}) };
+  const key = p.apiKey || '';
+  if (key) {
+    const scheme = p.type === 'openai-compatible' ? 'bearer' : (p.authScheme || 'bearer');
+    if (scheme === 'bearer' || scheme === 'both') h.authorization = `Bearer ${key}`;
+    if (scheme === 'x-api-key' || scheme === 'both') h['x-api-key'] = key;
+  }
+  if (p.type !== 'openai-compatible') h['anthropic-version'] = '2023-06-01';
+  return h;
+}
+
+function modelsUrl(p) {
+  const base = String(p.baseUrl || '').replace(/\/+$/, '');
+  if (p.type === 'openai-compatible') return `${base}/models`;
+  return /\/v1$/.test(base) ? `${base}/models` : `${base}/v1/models`;
+}
+
+async function getJson(url, headers, fetchImpl, timeoutMs) {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    const r = await fetchImpl(url, { headers, signal: ctl.signal });
+    let body = null;
+    try { body = await r.json(); } catch {}
+    return { status: r.status, ok: r.ok, body };
+  } finally { clearTimeout(timer); }
+}
+
+function errText(e) {
+  if (e && e.name === 'AbortError') return 'timeout';
+  const c = e && (e.cause && (e.cause.code || e.cause.message));
+  return String(c || (e && e.message) || e).substring(0, 160);
+}
+
+function upstreamMessage(body) {
+  if (!body || typeof body !== 'object') return '';
+  const e = body.error;
+  if (typeof e === 'string') return e;
+  if (e && typeof e.message === 'string') return e.message;
+  if (typeof body.message === 'string') return body.message;
+  if (typeof body.detail === 'string') return body.detail;
+  return '';
+}
+
+/**
+ * @returns {Promise<{ok:boolean, models:Array, status?:number, error?:string, noCatalog?:boolean}>}
+ */
+async function fetchCatalog(p, { fetchImpl = globalThis.fetch, timeoutMs = TIMEOUT_MS } = {}) {
+  if (!p || p.type === 'claude-subscription') return { ok: true, models: [], noCatalog: true };
+  if (!p.baseUrl) return { ok: false, models: [], error: 'no_base_url' };
+  const headers = authHeaders(p);
+  const all = [];
+  let url = modelsUrl(p), pages = 0;
+  try {
+    while (url && pages < MAX_PAGES) {
+      pages++;
+      const r = await getJson(url, headers, fetchImpl, timeoutMs);
+      if (r.status === 404 || r.status === 405) return { ok: true, models: all, status: r.status, noCatalog: all.length === 0 };
+      if (!r.ok) {
+        const msg = upstreamMessage(r.body);
+        return { ok: false, models: [], status: r.status, error: `HTTP ${r.status}${msg ? ': ' + msg.substring(0, 160) : ''}` };
+      }
+      all.push(...normalizeCatalog(r.body));
+      // Anthropic's list paginates with has_more/last_id; OpenAI-style lists do not.
+      if (r.body && r.body.has_more && r.body.last_id && p.type !== 'openai-compatible') {
+        const u = new URL(modelsUrl(p));
+        u.searchParams.set('after_id', r.body.last_id);
+        u.searchParams.set('limit', '1000');
+        url = u.toString();
+      } else url = null;
+    }
+  } catch (e) {
+    return { ok: false, models: [], error: errText(e) };
+  }
+  const seen = new Set();
+  return { ok: true, models: all.filter(m => (seen.has(m.id) ? false : (seen.add(m.id), true))) };
+}
+
+module.exports = { fetchCatalog, authHeaders, modelsUrl, TIMEOUT_MS };
diff --git a/providers-store.js b/providers-store.js
new file mode 100644
index 00000000..d7277daa
--- /dev/null
+++ b/providers-store.js
@@ -0,0 +1,484 @@
+// Provider registry — the persistent half (SQLite). providers.js holds the pure rules.
+//
+// Kept in SQLite rather than config.json for the same reasons as bots: catalogues run
+// to hundreds of models, config.json is rewritten wholesale on every settings change,
+// and the usage ledger joins against sessions/tasks.
+//
+// Secrets (API keys, extra headers) are encrypted with the SAME function the SSH host
+// passwords use (AES-256-GCM, key in data/hosts.key) and never leave this module in a
+// public view: the API answers `hasKey`, and a header value whose NAME looks secret is
+// masked as '***' (sending '***' back on save keeps the stored value — the SSH-host
+// "blank means keep" rule, adapted to a map).
+'use strict';
+
+const P = require('./providers');
+
+const SECRET_HEADER_RE = /(SECRET|TOKEN|PASSWORD|AUTH|API_?KEY|KEY|COOKIE)/i;
+const USAGE_RETENTION_DAYS = 90;
+// A catalogue this small is enabled wholesale on first import; a big one (OpenRouter
+// lists hundreds) is imported switched off, so the pickers are not flooded.
+const AUTO_ENABLE_MAX = 40;
+
+function j(v, fallback) {
+  if (v == null || v === '') return fallback;
+  try { const x = JSON.parse(v); return x == null ? fallback : x; } catch { return fallback; }
+}
+
+function createProviderStore(db, { encrypt, decrypt, log } = {}) {
+  const L = log || { info() {}, warn() {}, error() {} };
+  const enc = (s) => (s ? encrypt(String(s)) : '');
+  const dec = (s) => (s ? decrypt(String(s)) : '');
+
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS providers (
+      id          TEXT PRIMARY KEY,
+      type        TEXT NOT NULL,
+      label       TEXT NOT NULL,
+      base_url    TEXT NOT NULL DEFAULT '',
+      auth_scheme TEXT NOT NULL DEFAULT 'bearer',
+      api_key_enc TEXT NOT NULL DEFAULT '',
+      headers_enc TEXT NOT NULL DEFAULT '',
+      dialect     TEXT NOT NULL DEFAULT 'generic',
+      options     TEXT NOT NULL DEFAULT '{}',
+      roles       TEXT NOT NULL DEFAULT '{}',
+      aliases     INTEGER NOT NULL DEFAULT 0,
+      enabled     INTEGER NOT NULL DEFAULT 1,
+      -- 'builtin' (the CLI login row), 'env' (seeded from ANTHROPIC_* and kept in sync
+      -- with it at boot until edited here), 'user'
+      source      TEXT NOT NULL DEFAULT 'user',
+      sort_order  INTEGER NOT NULL DEFAULT 0,
+      last_test   TEXT,
+      created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at  TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    -- caps/pricing come from the provider's catalogue and are overwritten on refresh;
+    -- caps_user/pricing_user are the user's corrections and are never touched by one.
+    CREATE TABLE IF NOT EXISTS provider_models (
+      provider_id  TEXT NOT NULL,
+      model_id     TEXT NOT NULL,
+      label        TEXT NOT NULL DEFAULT '',
+      enabled      INTEGER NOT NULL DEFAULT 1,
+      source       TEXT NOT NULL DEFAULT 'catalog',
+      caps         TEXT NOT NULL DEFAULT '{}',
+      caps_user    TEXT NOT NULL DEFAULT '{}',
+      pricing      TEXT,
+      pricing_user TEXT,
+      verified     TEXT,
+      sort_order   INTEGER NOT NULL DEFAULT 0,
+      updated_at   TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (provider_id, model_id)
+    );
+    CREATE TABLE IF NOT EXISTS provider_settings (
+      key   TEXT PRIMARY KEY,
+      value TEXT
+    );
+    -- One row per upstream request the llm-bridge served. Before this, usage existed
+    -- only on the WS 'done' frame of the CLI's own result and was never stored.
+    CREATE TABLE IF NOT EXISTS llm_usage (
+      id                 INTEGER PRIMARY KEY AUTOINCREMENT,
+      ts                 INTEGER NOT NULL,
+      run_id             TEXT,
+      purpose            TEXT,
+      session_id         TEXT,
+      task_id            TEXT,
+      bot_id             TEXT,
+      provider_id        TEXT,
+      model              TEXT,
+      requested_model    TEXT,
+      input_tokens       INTEGER NOT NULL DEFAULT 0,
+      output_tokens      INTEGER NOT NULL DEFAULT 0,
+      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
+      cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+      reasoning_tokens   INTEGER NOT NULL DEFAULT 0,
+      cost_usd           REAL,
+      latency_ms         INTEGER,
+      status             TEXT,
+      http_status        INTEGER,
+      error_type         TEXT,
+      cli_session_id     TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_llm_usage_ts ON llm_usage(ts);
+    CREATE INDEX IF NOT EXISTS idx_llm_usage_run ON llm_usage(run_id);
+    CREATE INDEX IF NOT EXISTS idx_llm_usage_session ON llm_usage(session_id);
+  `);
+
+  const st = {
+    all: db.prepare(`SELECT * FROM providers ORDER BY sort_order, created_at`),
+    get: db.prepare(`SELECT * FROM providers WHERE id = ?`),
+    insert: db.prepare(`INSERT INTO providers (id, type, label, base_url, auth_scheme, api_key_enc, headers_enc, dialect, options, roles, aliases, enabled, source, sort_order)
+                        VALUES (@id, @type, @label, @base_url, @auth_scheme, @api_key_enc, @headers_enc, @dialect, @options, @roles, @aliases, @enabled, @source, @sort_order)`),
+    del: db.prepare(`DELETE FROM providers WHERE id = ?`),
+    delModels: db.prepare(`DELETE FROM provider_models WHERE provider_id = ?`),
+    models: db.prepare(`SELECT * FROM provider_models WHERE provider_id = ? ORDER BY sort_order, model_id`),
+    allModels: db.prepare(`SELECT * FROM provider_models ORDER BY provider_id, sort_order, model_id`),
+    model: db.prepare(`SELECT * FROM provider_models WHERE provider_id = ? AND model_id = ?`),
+    upsertCatalogModel: db.prepare(`INSERT INTO provider_models (provider_id, model_id, label, enabled, source, caps, pricing, sort_order)
+                                    VALUES (?, ?, ?, ?, 'catalog', ?, ?, ?)
+                                    ON CONFLICT(provider_id, model_id) DO UPDATE SET label = excluded.label, caps = excluded.caps,
+                                      pricing = excluded.pricing, sort_order = excluded.sort_order, updated_at = datetime('now')`),
+    insertManual: db.prepare(`INSERT INTO provider_models (provider_id, model_id, label, enabled, source, caps, caps_user, sort_order)
+                              VALUES (?, ?, ?, 1, 'manual', '{}', ?, 100000)
+                              ON CONFLICT(provider_id, model_id) DO UPDATE SET enabled = 1, caps_user = excluded.caps_user, updated_at = datetime('now')`),
+    delModel: db.prepare(`DELETE FROM provider_models WHERE provider_id = ? AND model_id = ?`),
+    getSetting: db.prepare(`SELECT value FROM provider_settings WHERE key = ?`),
+    setSetting: db.prepare(`INSERT INTO provider_settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value`),
+    delSetting: db.prepare(`DELETE FROM provider_settings WHERE key = ?`),
+    usageInsert: db.prepare(`INSERT INTO llm_usage (ts, run_id, purpose, session_id, task_id, bot_id, provider_id, model, requested_model,
+                               input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, cost_usd, latency_ms, status, http_status, error_type, cli_session_id)
+                             VALUES (@ts, @run_id, @purpose, @session_id, @task_id, @bot_id, @provider_id, @model, @requested_model,
+                               @input_tokens, @output_tokens, @cache_read_tokens, @cache_write_tokens, @reasoning_tokens, @cost_usd, @latency_ms, @status, @http_status, @error_type, @cli_session_id)`),
+    usagePrune: db.prepare(`DELETE FROM llm_usage WHERE ts < ?`),
+    usageByRun: db.prepare(`SELECT COALESCE(SUM(input_tokens),0) AS input, COALESCE(SUM(output_tokens),0) AS output, COALESCE(SUM(cache_read_tokens),0) AS cache_read,
+                              COALESCE(SUM(reasoning_tokens),0) AS reasoning, SUM(cost_usd) AS cost, COUNT(*) AS requests,
+                              SUM(CASE WHEN cost_usd IS NULL THEN 1 ELSE 0 END) AS unpriced
+                            FROM llm_usage WHERE run_id = ?`),
+    usageLastByRun: db.prepare(`SELECT input_tokens, cache_read_tokens, cache_write_tokens FROM llm_usage WHERE run_id = ? AND status = 'ok' ORDER BY id DESC LIMIT 1`),
+    usageSummary: db.prepare(`SELECT provider_id, model, date(ts, 'unixepoch') AS day, COUNT(*) AS requests,
+                                SUM(input_tokens) AS input, SUM(output_tokens) AS output, SUM(cache_read_tokens) AS cache_read,
+                                SUM(cost_usd) AS cost, SUM(CASE WHEN status != 'ok' THEN 1 ELSE 0 END) AS errors
+                              FROM llm_usage WHERE ts >= ? GROUP BY provider_id, model, day ORDER BY day DESC, cost DESC`),
+    lastStatus: db.prepare(`SELECT provider_id, status, error_type, http_status, ts FROM llm_usage
+                            WHERE id IN (SELECT MAX(id) FROM llm_usage GROUP BY provider_id)`),
+  };
+
+  let _cache = null;
+  const invalidate = () => { _cache = null; };
+
+  function rowToModel(r) {
+    const caps = { ...P.normalizeCaps(j(r.caps, {})) };
+    const user = j(r.caps_user, {});
+    for (const k of P.CAP_KEYS) if (user[k] !== undefined && user[k] !== null) caps[k] = user[k];
+    const pricing = P.normalizePricing(j(r.pricing_user, null)) || P.normalizePricing(j(r.pricing, null));
+    return { id: r.model_id, label: r.label || r.model_id, enabled: !!r.enabled, source: r.source, caps: P.normalizeCaps(caps),
+      capsUser: j(r.caps_user, {}), pricing, pricingUser: j(r.pricing_user, null), verified: j(r.verified, null) };
+  }
+
+  function rowToProvider(r, models) {
+    return {
+      id: r.id, type: r.type, label: r.label, baseUrl: r.base_url, authScheme: r.auth_scheme,
+      apiKey: dec(r.api_key_enc), headers: j(dec(r.headers_enc), {}), dialect: r.dialect,
+      options: j(r.options, {}), roles: j(r.roles, {}), aliases: !!r.aliases, enabled: !!r.enabled,
+      source: r.source, sortOrder: r.sort_order, lastTest: j(r.last_test, null), models: models || [],
+    };
+  }
+
+  /** Decrypted registry for resolveModel(). Cached; every write invalidates. */
+  function registry() {
+    if (_cache) return _cache;
+    const byProv = new Map();
+    for (const m of st.allModels.all()) {
+      if (!byProv.has(m.provider_id)) byProv.set(m.provider_id, []);
+      byProv.get(m.provider_id).push(rowToModel(m));
+    }
+    const providers = st.all.all().map(r => rowToProvider(r, byProv.get(r.id)));
+    const defaultProviderId = getSetting('defaultProvider') || P.BUILTIN_CLAUDE_ID;
+    const utilityModel = getSetting('utilityModel') || '';
+    _cache = { providers, defaultProviderId, utilityModel };
+    return _cache;
+  }
+
+  function getSetting(k) { const r = st.getSetting.get(k); return r ? r.value : null; }
+  function setSetting(k, v) { if (v == null || v === '') st.delSetting.run(k); else st.setSetting.run(k, String(v)); invalidate(); }
+
+  function maskHeaders(h) {
+    const out = {};
+    for (const [k, v] of Object.entries(h || {})) out[k] = SECRET_HEADER_RE.test(k) ? (v ? '***' : '') : v;
+    return out;
+  }
+
+  /** What the browser may see. */
+  function publicProvider(p) {
+    return {
+      id: p.id, type: p.type, label: p.label, baseUrl: p.baseUrl, authScheme: p.authScheme,
+      hasKey: !!p.apiKey, headers: maskHeaders(p.headers), dialect: p.dialect, options: p.options,
+      roles: p.roles, aliases: P.supportsAliases(p), aliasesSetting: p.aliases, enabled: p.enabled, source: p.source,
+      builtin: p.id === P.BUILTIN_CLAUDE_ID, lastTest: p.lastTest,
+      models: p.models.map(m => ({ id: m.id, label: m.label, enabled: m.enabled, source: m.source, caps: m.caps, capsUser: m.capsUser, pricing: m.pricing, verified: m.verified })),
+    };
+  }
+
+  function publicList() {
+    const reg = registry();
+    return { providers: reg.providers.map(publicProvider), defaultProviderId: reg.defaultProviderId, utilityModel: reg.utilityModel };
+  }
+
+  function get(id) { return registry().providers.find(p => p.id === id) || null; }
+
+  function create(v) {
+    if (st.get.get(v.id)) throw Object.assign(new Error('exists'), { code: 'exists' });
+    const maxOrder = registry().providers.reduce((m, p) => Math.max(m, p.sortOrder || 0), 0);
+    st.insert.run({
+      id: v.id, type: v.type, label: v.label, base_url: v.baseUrl || '', auth_scheme: v.authScheme || 'bearer',
+      api_key_enc: enc(v.apiKey), headers_enc: v.headers && Object.keys(v.headers).length ? enc(JSON.stringify(v.headers)) : '',
+      dialect: v.dialect || 'generic', options: JSON.stringify(v.options || {}), roles: JSON.stringify(v.roles || {}),
+      aliases: v.aliases ? 1 : 0, enabled: v.enabled === false ? 0 : 1, source: v.source || 'user', sort_order: v.sortOrder ?? (maxOrder + 1),
+    });
+    invalidate();
+    return get(v.id);
+  }
+
+  /** Patch semantics: an absent field is unchanged; apiKey '' is unchanged, `clearApiKey` clears it;
+   *  a header value '***' keeps the stored one; an option set to null is removed. Only a field
+   *  whose value really CHANGES counts — pressing Save on an untouched env-seeded row must not
+   *  detach it from .env — and any real edit of such a row makes it the user's. */
+  function update(id, patch, { fromEnv } = {}) {
+    const cur = get(id);
+    if (!cur) return null;
+    const sets = [], vals = {};
+    let userEdit = false;
+    const put = (col, val, isUserField = true) => { sets.push(`${col} = @${col}`); vals[col] = val; if (isUserField) userEdit = true; };
+    const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    if (patch.label !== undefined && patch.label !== cur.label) put('label', patch.label);
+    if (patch.baseUrl !== undefined && cur.type !== 'claude-subscription' && patch.baseUrl !== cur.baseUrl) put('base_url', patch.baseUrl);
+    if (patch.type !== undefined && cur.type !== 'claude-subscription' && patch.type !== cur.type) put('type', patch.type);
+    if (patch.authScheme !== undefined && patch.authScheme !== cur.authScheme) put('auth_scheme', patch.authScheme);
+    if (patch.dialect !== undefined && patch.dialect !== cur.dialect) put('dialect', patch.dialect);
+    if (patch.clearApiKey) { if (cur.apiKey) put('api_key_enc', ''); }
+    else if (typeof patch.apiKey === 'string' && patch.apiKey !== '' && patch.apiKey !== cur.apiKey) put('api_key_enc', enc(patch.apiKey));
+    if (patch.headers !== undefined) {
+      const merged = {};
+      for (const [k, v] of Object.entries(patch.headers || {})) merged[k] = (v === '***' && cur.headers[k] !== undefined) ? cur.headers[k] : v;
+      if (!same(merged, cur.headers)) put('headers_enc', Object.keys(merged).length ? enc(JSON.stringify(merged)) : '');
+    }
+    if (patch.options !== undefined) {
+      const merged = { ...cur.options, ...patch.options };
+      for (const k of Object.keys(merged)) if (merged[k] === null || merged[k] === undefined) delete merged[k];
+      if (!same(merged, cur.options)) put('options', JSON.stringify(merged));
+    }
+    if (patch.roles !== undefined && !same(patch.roles || {}, cur.roles || {})) put('roles', JSON.stringify(patch.roles || {}));
+    if (patch.aliases !== undefined && !!patch.aliases !== !!cur.aliases) put('aliases', patch.aliases ? 1 : 0);
+    if (patch.enabled !== undefined && !!patch.enabled !== !!cur.enabled) put('enabled', patch.enabled ? 1 : 0, false);
+    if (patch.lastTest !== undefined) put('last_test', patch.lastTest ? JSON.stringify(patch.lastTest) : null, false);
+    if (patch.sortOrder !== undefined) put('sort_order', patch.sortOrder, false);
+    if (!fromEnv && cur.source === 'env' && userEdit) put('source', 'user', false);
+    if (!sets.length) return cur;
+    sets.push(`updated_at = datetime('now')`);
+    db.prepare(`UPDATE providers SET ${sets.join(', ')} WHERE id = @id`).run({ ...vals, id });
+    invalidate();
+    return get(id);
+  }
+
+  function remove(id) {
+    if (id === P.BUILTIN_CLAUDE_ID) return false;
+    const r = st.del.run(id);
+    st.delModels.run(id);
+    if (getSetting('defaultProvider') === id) setSetting('defaultProvider', P.BUILTIN_CLAUDE_ID);
+    invalidate();
+    return r.changes > 0;
+  }
+
+  function setDefault(id) {
+    const p = get(id);
+    if (!p || !p.enabled) return false;
+    setSetting('defaultProvider', id);
+    return true;
+  }
+
+  /** Merge a fetched catalogue. Enabled/manual models and the user's corrections survive. */
+  function upsertCatalog(providerId, models) {
+    const existing = new Map(st.models.all(providerId).map(r => [r.model_id, r]));
+    const firstImport = ![...existing.values()].some(r => r.source === 'catalog');
+    const autoEnable = firstImport && models.length <= AUTO_ENABLE_MAX;
+    const seen = new Set();
+    const tx = db.transaction(() => {
+      models.forEach((m, i) => {
+        seen.add(m.id);
+        const prev = existing.get(m.id);
+        const enabled = prev ? prev.enabled : (autoEnable ? 1 : 0);
+        st.upsertCatalogModel.run(providerId, m.id, m.label || m.id, enabled, JSON.stringify(m.caps || {}), m.pricing ? JSON.stringify(m.pricing) : null, i);
+      });
+      // A model that left the catalogue is dropped unless the user switched it on —
+      // then it stays (a chat may be pinned to it) until they remove it.
+      for (const [id, r] of existing) {
+        if (!seen.has(id) && r.source === 'catalog' && !r.enabled) st.delModel.run(providerId, id);
+      }
+    });
+    tx();
+    invalidate();
+    return { total: models.length, added: models.filter(m => !existing.has(m.id)).length, autoEnabled: autoEnable };
+  }
+
+  function setModel(providerId, modelId, patch) {
+    const r = st.model.get(providerId, modelId);
+    if (!r) return null;
+    const sets = [], vals = { p: providerId, m: modelId };
+    if (patch.enabled !== undefined) { sets.push('enabled = @enabled'); vals.enabled = patch.enabled ? 1 : 0; }
+    if (patch.label !== undefined) { sets.push('label = @label'); vals.label = String(patch.label).substring(0, 120); }
+    if (patch.caps !== undefined) {
+      const cu = {};
+      for (const k of P.CAP_KEYS) {
+        const v = patch.caps ? patch.caps[k] : undefined;
+        if (v === true || v === false) cu[k] = v;
+        else if ((k === 'contextWindow' || k === 'maxOutput') && Number(v) > 0) cu[k] = Math.trunc(Number(v));
+      }
+      sets.push('caps_user = @caps_user'); vals.caps_user = JSON.stringify(cu);
+    }
+    if (patch.pricing !== undefined) { sets.push('pricing_user = @pricing_user'); const pr = P.normalizePricing(patch.pricing); vals.pricing_user = pr ? JSON.stringify(pr) : null; }
+    if (patch.verified !== undefined) { sets.push('verified = @verified'); vals.verified = patch.verified ? JSON.stringify(patch.verified) : null; }
+    if (!sets.length) return rowToModel(r);
+    sets.push(`updated_at = datetime('now')`);
+    db.prepare(`UPDATE provider_models SET ${sets.join(', ')} WHERE provider_id = @p AND model_id = @m`).run(vals);
+    invalidate();
+    return rowToModel(st.model.get(providerId, modelId));
+  }
+
+  function addManualModel(providerId, modelId, { label, caps } = {}) {
+    if (!P.MODEL_ID_RE.test(modelId)) return null;
+    st.insertManual.run(providerId, modelId, label || modelId, JSON.stringify(P.normalizeCaps(caps)));
+    invalidate();
+    return rowToModel(st.model.get(providerId, modelId));
+  }
+
+  function removeModel(providerId, modelId) {
+    const r = st.delModel.run(providerId, modelId);
+    invalidate();
+    return r.changes > 0;
+  }
+
+  // ── usage ledger ──────────────────────────────────────────────────────────
+  function recordUsage(u) {
+    try {
+      st.usageInsert.run({
+        ts: Math.floor((u.ts || Date.now()) / 1000), run_id: u.runId || null, purpose: u.purpose || null,
+        session_id: u.sessionId || null, task_id: u.taskId || null, bot_id: u.botId || null,
+        provider_id: u.providerId || null, model: u.model || null, requested_model: u.requestedModel || null,
+        input_tokens: u.inputTokens | 0, output_tokens: u.outputTokens | 0, cache_read_tokens: u.cacheReadTokens | 0,
+        cache_write_tokens: u.cacheWriteTokens | 0, reasoning_tokens: u.reasoningTokens | 0,
+        cost_usd: u.costUsd == null ? null : Number(u.costUsd), latency_ms: u.latencyMs == null ? null : Math.round(u.latencyMs),
+        status: u.status || 'ok', http_status: u.httpStatus || null, error_type: u.errorType || null, cli_session_id: u.cliSessionId || null,
+      });
+    } catch (e) { L.warn('llm_usage insert failed', { err: e.message }); }
+  }
+
+  function usageForRun(runId) {
+    if (!runId) return null;
+    const s = st.usageByRun.get(runId);
+    if (!s || !s.requests) return null;
+    const last = st.usageLastByRun.get(runId);
+    return { ...s, lastTurn: last ? { input_tokens: last.input_tokens, cache_read_input_tokens: last.cache_read_tokens, cache_creation_input_tokens: last.cache_write_tokens } : null };
+  }
+
+  function usageSummary(days = 30) {
+    const since = Math.floor(Date.now() / 1000) - Math.max(1, Math.min(366, days | 0)) * 86400;
+    return st.usageSummary.all(since);
+  }
+
+  function lastStatusByProvider() {
+    const out = {};
+    for (const r of st.lastStatus.all()) out[r.provider_id] = { status: r.status, errorType: r.error_type, httpStatus: r.http_status, ts: r.ts };
+    return out;
+  }
+
+  function pruneUsage() {
+    try { st.usagePrune.run(Math.floor(Date.now() / 1000) - USAGE_RETENTION_DAYS * 86400); } catch {}
+  }
+
+  // ── boot: seed and keep the env-sourced row in sync ───────────────────────
+  /**
+   * First boot: the CLI-login row always exists; ANTHROPIC_BASE_URL (+ its token) becomes
+   * a provider 'gateway' and the DEFAULT, because that is what every run used until now —
+   * a bare "sonnet" in an existing row must keep landing on the same endpoint.
+   * Later boots: an env-sourced row follows the env (edit .env + restart still works, as
+   * before), until it is edited in the UI — then it is the user's and env is ignored.
+   */
+  /** The part of the env the CLI used to read directly, as a provider's roles and headers. */
+  function envShape(env) {
+    const roles = {};
+    const pick = (k) => { const v = String(env[k] || '').trim(); return v && P.MODEL_ID_RE.test(v) ? v : null; };
+    const main = pick('ANTHROPIC_DEFAULT_SONNET_MODEL'), fast = pick('ANTHROPIC_DEFAULT_HAIKU_MODEL') || pick('ANTHROPIC_SMALL_FAST_MODEL');
+    const strong = pick('ANTHROPIC_DEFAULT_OPUS_MODEL'), fable = pick('ANTHROPIC_DEFAULT_FABLE_MODEL'), sub = pick('CLAUDE_CODE_SUBAGENT_MODEL');
+    if (main) roles.main = main; if (fast) roles.fast = fast; if (strong) roles.strong = strong; if (fable) roles.fable = fable; if (sub) roles.subagent = sub;
+    // ANTHROPIC_CUSTOM_HEADERS: "Name: value" lines, as the CLI parses them.
+    const headers = {};
+    for (const line of String(env.ANTHROPIC_CUSTOM_HEADERS || '').split(/\r?\n/)) {
+      const i = line.indexOf(':');
+      if (i <= 0) continue;
+      const k = line.slice(0, i).trim(), v = line.slice(i + 1).trim();
+      if (/^[A-Za-z0-9-]{1,64}$/.test(k) && v && !/[\r\n]/.test(v)) headers[k] = v;
+    }
+    return { roles, headers };
+  }
+
+  /**
+   * First boot: the CLI-login row always exists; ANTHROPIC_BASE_URL (+ its token, the
+   * ANTHROPIC_DEFAULT_*_MODEL remaps and ANTHROPIC_CUSTOM_HEADERS the CLI used to read
+   * directly) becomes a provider 'gateway' and the DEFAULT, because that is what every run
+   * used until now — a bare "sonnet" in an existing row must keep landing on the same model.
+   * Later boots: an env-sourced row follows the env (edit .env + restart still works, as
+   * before), until it is edited in the UI — then it is the user's and env is ignored. An
+   * env row whose variable was REMOVED is switched off (and stops being the default), which
+   * is what removing it used to mean: back to the CLI login.
+   */
+  function seedFromEnv(env) {
+    if (!st.get.get(P.BUILTIN_CLAUDE_ID)) {
+      st.insert.run({ id: P.BUILTIN_CLAUDE_ID, type: 'claude-subscription', label: 'Claude', base_url: '', auth_scheme: 'bearer',
+        api_key_enc: '', headers_enc: '', dialect: 'generic', options: '{}', roles: '{}', aliases: 1, enabled: 1, source: 'builtin', sort_order: 0 });
+      invalidate();
+    }
+    const baseUrl = String(env.ANTHROPIC_BASE_URL || '').trim().replace(/\/+$/, '');
+    const authToken = String(env.ANTHROPIC_AUTH_TOKEN || '').trim();
+    const apiKey = String(env.ANTHROPIC_API_KEY || '').trim();
+    const shape = envShape(env);
+    const seeded = getSetting('seededFromEnv');
+    const envRows = registry().providers.filter(p => p.source === 'env');
+    const gwRow = envRows.find(p => p.type === 'anthropic-compatible');
+    const anRow = envRows.find(p => p.type === 'anthropic');
+
+    const disableEnvRow = (row) => {
+      if (!row.enabled) return;
+      update(row.id, { enabled: false }, { fromEnv: true });
+      setSetting(`envDisabled:${row.id}`, '1');
+      if (getSetting('defaultProvider') === row.id) setSetting('defaultProvider', P.BUILTIN_CLAUDE_ID);
+      L.info('env provider switched off — its variable is gone', { id: row.id });
+    };
+    const syncEnvRow = (row, fields) => {
+      const wasEnvDisabled = getSetting(`envDisabled:${row.id}`);
+      update(row.id, { ...fields, ...(wasEnvDisabled ? { enabled: true } : {}) }, { fromEnv: true });
+      if (wasEnvDisabled) { setSetting(`envDisabled:${row.id}`, ''); if (!getSetting('defaultProvider') || getSetting('defaultProvider') === P.BUILTIN_CLAUDE_ID) setSetting('defaultProvider', row.id); }
+    };
+
+    if (baseUrl && /^https?:\/\//i.test(baseUrl)) {
+      const key = authToken || apiKey;
+      const scheme = authToken ? 'bearer' : 'x-api-key';
+      const fields = { baseUrl, apiKey: key || undefined, clearApiKey: !key, authScheme: scheme, roles: shape.roles, headers: shape.headers };
+      if (gwRow) {
+        syncEnvRow(gwRow, fields);
+      } else if (!seeded) {
+        let host = baseUrl;
+        try { host = new URL(baseUrl).host; } catch {}
+        const id = st.get.get('gateway') ? 'gateway-env' : 'gateway';
+        create({ id, type: 'anthropic-compatible', label: host.substring(0, 60), baseUrl, apiKey: key, authScheme: scheme,
+          aliases: true, source: 'env', options: { quietCli: false }, roles: shape.roles, headers: shape.headers });
+        setSetting('defaultProvider', id);
+        L.info('provider seeded from ANTHROPIC_BASE_URL', { id, host });
+      }
+    } else if (gwRow) {
+      disableEnvRow(gwRow);
+    }
+
+    if (!baseUrl) {
+      if (anRow) {
+        if (authToken || apiKey) syncEnvRow(anRow, { apiKey: authToken || apiKey, authScheme: authToken ? 'bearer' : 'x-api-key' });
+        else disableEnvRow(anRow);
+      } else if (!seeded && authToken) {
+        // Without a base URL the old code still passed ANTHROPIC_AUTH_TOKEN through (and
+        // dropped ANTHROPIC_API_KEY so the CLI used the subscription): keep both behaviours.
+        create({ id: 'anthropic', type: 'anthropic', label: 'Anthropic API', baseUrl: 'https://api.anthropic.com', apiKey: authToken,
+          authScheme: 'bearer', aliases: true, source: 'env' });
+        setSetting('defaultProvider', 'anthropic');
+      } else if (!seeded && apiKey) {
+        create({ id: 'anthropic', type: 'anthropic', label: 'Anthropic API', baseUrl: 'https://api.anthropic.com', apiKey,
+          authScheme: 'x-api-key', aliases: true, source: 'env' });
+      }
+    }
+    if (!seeded) setSetting('seededFromEnv', String(Date.now()));
+  }
+
+  return {
+    registry, invalidate, publicList, publicProvider, get, create, update, remove, setDefault,
+    getSetting, setSetting, upsertCatalog, setModel, addManualModel, removeModel,
+    recordUsage, usageForRun, usageSummary, lastStatusByProvider, pruneUsage, seedFromEnv,
+  };
+}
+
+module.exports = { createProviderStore, SECRET_HEADER_RE, AUTO_ENABLE_MAX, USAGE_RETENTION_DAYS };
diff --git a/providers.js b/providers.js
new file mode 100644
index 00000000..bc8f027c
--- /dev/null
+++ b/providers.js
@@ -0,0 +1,593 @@
+// Provider registry — the pure half (no fs, no db, no network).
+//
+// Before this module the studio had exactly one provider: whatever ANTHROPIC_BASE_URL /
+// ANTHROPIC_AUTH_TOKEN said at boot, and four hardcoded aliases (haiku/sonnet/opus/fable)
+// to pick from. Every run still goes through the `claude` CLI — that is what gives each
+// mode its tools, MCP, hooks, resume and compaction — so "another provider" means
+// "another endpoint + model for THIS run", decided here and handed to the spawn.
+//
+// A model is stored as ONE string everywhere it already travels (sessions.model,
+// tasks.model, bots.model, WS frames, MCP create_task, plan files, bot exports):
+//
+//     "<providerId>::<modelId>"      e.g. "deepseek::deepseek-chat", "kilo::z-ai/glm-5:free"
+//     "<modelId>"                    legacy / bare: resolved on the DEFAULT provider
+//
+// `::` because model ids themselves carry `/` and `:` (":free"), never `::`. A bare value
+// keeps every row written before this module meaning exactly what it meant: "sonnet" on
+// the provider the studio used to talk to.
+//
+// Four provider types:
+//   claude-subscription  — the CLI's own login (OAuth). No bridge, no key. The only type
+//                          the tmux "Subscription" engine runs on.
+//   anthropic            — Anthropic API key. Bridge in passthrough mode.
+//   anthropic-compatible — any /v1/messages endpoint (a gateway such as kilo-gateway,
+//                          DeepSeek/Kimi/GLM/MiniMax Anthropic endpoints). Passthrough.
+//   openai-compatible    — /v1/chat/completions. Bridge TRANSLATES (llm-bridge/).
+'use strict';
+
+const crypto = require('crypto');
+
+const PROVIDER_TYPES = ['claude-subscription', 'anthropic', 'anthropic-compatible', 'openai-compatible'];
+const DIALECTS = ['generic', 'openai', 'openrouter', 'deepseek', 'gemini', 'qwen', 'mistral', 'ollama'];
+const AUTH_SCHEMES = ['bearer', 'x-api-key', 'both'];
+const CLAUDE_ALIASES = ['haiku', 'sonnet', 'opus', 'fable'];
+const ROLE_KEYS = ['main', 'fast', 'strong', 'fable', 'subagent'];
+const REF_SEP = '::';
+const BUILTIN_CLAUDE_ID = 'claude';
+
+const PROVIDER_ID_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+// Wider than gateway-models.MODEL_ID_RE on purpose: Vertex/Bedrock-style ids carry `@`,
+// some local servers `+`. Still no whitespace, quotes or shell metacharacters — the value
+// reaches argv (`--model`) and, for the subscription engine, a generated shell script.
+const MODEL_ID_RE = /^[A-Za-z0-9._:/@+-]{1,160}$/;
+
+/** Split a stored model value. Bare values keep `providerId: null` (= default provider). */
+function parseModelRef(value) {
+  if (typeof value !== 'string') return null;
+  const v = value.trim();
+  if (!v) return null;
+  const i = v.indexOf(REF_SEP);
+  if (i === -1) return MODEL_ID_RE.test(v) ? { providerId: null, modelId: v } : null;
+  const providerId = v.slice(0, i), modelId = v.slice(i + REF_SEP.length);
+  if (!PROVIDER_ID_RE.test(providerId) || !MODEL_ID_RE.test(modelId)) return null;
+  return { providerId, modelId };
+}
+
+function formatModelRef(providerId, modelId) {
+  return providerId ? `${providerId}${REF_SEP}${modelId}` : modelId;
+}
+
+/** True for `provider::model` (not for a bare id) — what chat-defaults accepts beyond its alias list. */
+function isQualifiedRef(value) {
+  const r = parseModelRef(value);
+  return !!(r && r.providerId);
+}
+
+/** The model id without its provider — what a REMOTE `claude` (SSH) or the tmux engine can use. */
+function bareModelId(value) {
+  const r = parseModelRef(value);
+  return r ? r.modelId : null;
+}
+
+// ── Presets ─────────────────────────────────────────────────────────────────
+// A preset only pre-fills the form; every field stays editable. Base URLs are the
+// providers' documented OpenAI- / Anthropic-compatible roots.
+const PRESETS = [
+  { id: 'anthropic',   label: 'Claude API (Anthropic key)', type: 'anthropic',            baseUrl: 'https://api.anthropic.com',                  authScheme: 'x-api-key', aliases: true },
+  { id: 'gateway',     label: 'Anthropic-compatible gateway', type: 'anthropic-compatible', baseUrl: '',                                   authScheme: 'bearer',    aliases: true },
+  { id: 'openai',      label: 'OpenAI',                 type: 'openai-compatible',    baseUrl: 'https://api.openai.com/v1',                  dialect: 'openai' },
+  { id: 'openrouter',  label: 'OpenRouter',             type: 'openai-compatible',    baseUrl: 'https://openrouter.ai/api/v1',               dialect: 'openrouter' },
+  { id: 'deepseek',    label: 'DeepSeek (Anthropic API)', type: 'anthropic-compatible', baseUrl: 'https://api.deepseek.com/anthropic',       authScheme: 'x-api-key' },
+  { id: 'deepseek-oai', label: 'DeepSeek (OpenAI API)', type: 'openai-compatible',    baseUrl: 'https://api.deepseek.com/v1',                dialect: 'deepseek' },
+  { id: 'moonshot',    label: 'Kimi / Moonshot (Anthropic API)', type: 'anthropic-compatible', baseUrl: 'https://api.moonshot.ai/anthropic', authScheme: 'bearer' },
+  { id: 'zai',         label: 'Z.ai GLM (Anthropic API)', type: 'anthropic-compatible', baseUrl: 'https://api.z.ai/api/anthropic',           authScheme: 'bearer' },
+  { id: 'minimax',     label: 'MiniMax (Anthropic API)', type: 'anthropic-compatible', baseUrl: 'https://api.minimax.io/anthropic',          authScheme: 'bearer' },
+  { id: 'qwen',        label: 'Qwen / DashScope',       type: 'openai-compatible',    baseUrl: 'https://dashscope-intl.aliyuncs.com/compatible-mode/v1', dialect: 'qwen' },
+  { id: 'gemini',      label: 'Google Gemini',          type: 'openai-compatible',    baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai', dialect: 'gemini' },
+  { id: 'groq',        label: 'Groq',                   type: 'openai-compatible',    baseUrl: 'https://api.groq.com/openai/v1',             dialect: 'generic' },
+  { id: 'mistral',     label: 'Mistral',                type: 'openai-compatible',    baseUrl: 'https://api.mistral.ai/v1',                  dialect: 'mistral' },
+  { id: 'xai',         label: 'xAI Grok',               type: 'openai-compatible',    baseUrl: 'https://api.x.ai/v1',                        dialect: 'generic' },
+  { id: 'ollama',      label: 'Ollama (local)',         type: 'openai-compatible',    baseUrl: 'http://localhost:11434/v1',                  dialect: 'ollama', noKey: true },
+  { id: 'lmstudio',    label: 'LM Studio (local)',      type: 'openai-compatible',    baseUrl: 'http://localhost:1234/v1',                   dialect: 'generic', noKey: true },
+  { id: 'custom-oai',  label: 'OpenAI-compatible (custom)', type: 'openai-compatible', baseUrl: '',                                       dialect: 'generic' },
+];
+
+// ── Capabilities ────────────────────────────────────────────────────────────
+// null = unknown. Only an explicit `false` restricts anything: an unknown model is
+// offered everywhere (like gateway-models did), a model that SAYS it has no tools is
+// kept out of agent modes.
+const CAP_KEYS = ['tools', 'vision', 'reasoning', 'pdf', 'contextWindow', 'maxOutput'];
+const CLAUDE_CAPS = Object.freeze({ tools: true, vision: true, reasoning: true, pdf: true, contextWindow: null, maxOutput: null });
+const UNKNOWN_CAPS = Object.freeze({ tools: null, vision: null, reasoning: null, pdf: null, contextWindow: null, maxOutput: null });
+
+function normalizeCaps(raw) {
+  const out = { ...UNKNOWN_CAPS };
+  if (!raw || typeof raw !== 'object') return out;
+  for (const k of ['tools', 'vision', 'reasoning', 'pdf']) {
+    if (raw[k] === true || raw[k] === false) out[k] = raw[k];
+  }
+  for (const k of ['contextWindow', 'maxOutput']) {
+    const n = Number(raw[k]);
+    if (Number.isFinite(n) && n > 0) out[k] = Math.trunc(n);
+  }
+  return out;
+}
+
+/** Pricing in USD per 1M tokens. */
+function normalizePricing(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const out = {};
+  for (const k of ['in', 'out', 'cacheRead']) {
+    // Number(null) is 0: an ABSENT price must stay absent, not become "free".
+    if (raw[k] == null || raw[k] === '') continue;
+    const n = Number(raw[k]);
+    if (Number.isFinite(n) && n >= 0) out[k] = n;
+  }
+  return Object.keys(out).length ? out : null;
+}
+
+// ── Catalogue normalisation ─────────────────────────────────────────────────
+// One parser for every /models shape we meet: OpenAI (`{data:[{id}]}`, ids only),
+// OpenRouter/Kilo (context_length, supported_parameters, architecture, pricing per
+// TOKEN as strings), Anthropic (`{data:[{type:'model', id, display_name}]}`), Ollama.
+function perMillion(v) {
+  const n = Number(v);
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 1e6 * 1e6) / 1e6 : null;
+}
+
+function normalizeCatalog(json) {
+  const arr = Array.isArray(json) ? json : (json && (json.data || json.models));
+  if (!Array.isArray(arr)) return [];
+  const seen = new Set(), out = [];
+  for (const m of arr) {
+    if (!m || typeof m !== 'object') continue;
+    const id = typeof m.id === 'string' ? m.id.trim() : (typeof m.name === 'string' && !m.id ? m.name.trim() : '');
+    if (!id || !MODEL_ID_RE.test(id) || seen.has(id)) continue;
+    seen.add(id);
+    const params = Array.isArray(m.supported_parameters) ? m.supported_parameters : null;
+    const mods = Array.isArray(m.architecture?.input_modalities) ? m.architecture.input_modalities
+      : (Array.isArray(m.input_modalities) ? m.input_modalities : null);
+    const caps = normalizeCaps({
+      tools: params ? params.includes('tools') : (m.capabilities?.tools ?? m.supports_tools),
+      reasoning: params ? (params.includes('reasoning') || params.includes('include_reasoning')) : (m.capabilities?.reasoning ?? m.supports_reasoning),
+      vision: mods ? mods.includes('image') : (m.capabilities?.vision ?? m.supports_vision),
+      pdf: mods ? mods.includes('file') : null,
+      contextWindow: m.context_length ?? m.context_window ?? m.max_input_tokens ?? m.top_provider?.context_length,
+      maxOutput: m.top_provider?.max_completion_tokens ?? m.max_output_tokens ?? m.max_tokens,
+    });
+    let pricing = null;
+    if (m.pricing && typeof m.pricing === 'object') {
+      pricing = normalizePricing({ in: perMillion(m.pricing.prompt), out: perMillion(m.pricing.completion), cacheRead: perMillion(m.pricing.input_cache_read) });
+    }
+    const label = [m.display_name, m.name].find(s => typeof s === 'string' && s.trim()) || id;
+    out.push({ id, label: String(label).trim().substring(0, 120), caps, pricing });
+  }
+  return out;
+}
+
+// ── Resolution ──────────────────────────────────────────────────────────────
+// registry: { providers: ProviderRecord[], defaultProviderId, utilityModel }
+// ProviderRecord (decrypted, server-side only):
+//   { id, type, label, enabled, source, baseUrl, apiKey, authScheme, headers, dialect,
+//     options, roles: {main, fast, strong, subagent}, aliases: bool,
+//     models: [{ id, label, enabled, source, caps, pricing }] }
+
+function findProvider(registry, id) {
+  return (registry && Array.isArray(registry.providers)) ? registry.providers.find(p => p.id === id) || null : null;
+}
+
+function builtinClaude(registry) {
+  return findProvider(registry, BUILTIN_CLAUDE_ID)
+    || { id: BUILTIN_CLAUDE_ID, type: 'claude-subscription', label: 'Claude', enabled: true, aliases: true, models: [], roles: {}, options: {} };
+}
+
+/** The provider a BARE value means for this engine. */
+function defaultProviderFor(registry, engine) {
+  if (engine === 'subscription') return builtinClaude(registry);
+  const d = findProvider(registry, registry && registry.defaultProviderId);
+  if (d && d.enabled !== false) return d;
+  return builtinClaude(registry);
+}
+
+function supportsAliases(p) {
+  if (p.type === 'claude-subscription' || p.type === 'anthropic') return true;
+  if (p.type === 'openai-compatible') return false;
+  return p.aliases === true;
+}
+
+function enabledModels(p) {
+  return (Array.isArray(p.models) ? p.models : []).filter(m => m && m.enabled !== false);
+}
+
+/** A role → upstream model id, falling back to `main`, then the first enabled model. */
+function roleModel(p, role) {
+  const r = p.roles || {};
+  if (r[role]) return r[role];
+  if (r.main) return r.main;
+  const first = enabledModels(p)[0];
+  return first ? first.id : null;
+}
+
+// roleModel() falls back to `main` for an unset role, so `fable` means main unless pinned.
+const ALIAS_ROLE = { haiku: 'fast', sonnet: 'main', opus: 'strong', fable: 'fable' };
+
+function capsFor(p, modelId) {
+  const m = (Array.isArray(p.models) ? p.models : []).find(x => x && x.id === modelId);
+  if (m) return normalizeCaps(m.caps);
+  if ((p.type === 'claude-subscription' || p.type === 'anthropic') || CLAUDE_ALIASES.includes(modelId) || /^claude-/i.test(modelId)) return { ...CLAUDE_CAPS };
+  return { ...UNKNOWN_CAPS };
+}
+
+function pricingFor(p, modelId) {
+  const m = (Array.isArray(p.models) ? p.models : []).find(x => x && x.id === modelId);
+  return m ? normalizePricing(m.pricing) : null;
+}
+
+/**
+ * Resolve a stored model value for one run.
+ * @param value   what the row/frame carries ('sonnet', 'deepseek::deepseek-chat', …)
+ * @param opts    { engine: 'api'|'subscription'|'ssh' }
+ * @returns {{ok:true, ref, provider, modelId, cliModel, caps, pricing, engine, routing, fallback?:string, engineChanged?:boolean}
+ *          | {ok:false, error:string}}
+ *   routing: 'oauth'  — the CLI's own login, nothing injected
+ *            'bridge' — ANTHROPIC_BASE_URL = the local llm-bridge, run token as the key
+ *            'remote' — SSH: the remote host's own `claude` config decides
+ */
+function resolveModel(value, registry, opts = {}) {
+  const engine = opts.engine || 'api';
+  const parsed = parseModelRef(value == null || value === '' ? 'sonnet' : String(value));
+  if (!parsed) return { ok: false, error: 'invalid_model' };
+
+  let provider, fallback = null;
+  if (parsed.providerId) {
+    provider = findProvider(registry, parsed.providerId);
+    if (!provider || provider.enabled === false) {
+      // A chat pinned to a provider that was deleted or switched off must still run —
+      // on the default, and the caller says so — rather than fail every turn forever.
+      fallback = provider ? 'provider_disabled' : 'provider_missing';
+      provider = defaultProviderFor(registry, engine);
+    }
+  } else {
+    provider = defaultProviderFor(registry, engine);
+  }
+
+  let modelId = parsed.modelId;
+  // On a fallback an ALIAS keeps meaning its tier ("claude::haiku" for titles stays a fast
+  // model on the default); any other id of the lost provider means nothing here → main.
+  if (fallback && !CLAUDE_ALIASES.includes(modelId)) {
+    modelId = supportsAliases(provider) ? 'sonnet' : roleModel(provider, 'main');
+  } else if (CLAUDE_ALIASES.includes(modelId) && !supportsAliases(provider)) {
+    modelId = roleModel(provider, ALIAS_ROLE[modelId]);
+  }
+  if (!modelId) return { ok: false, error: 'no_model', providerId: provider.id };
+
+  let effEngine = engine, engineChanged = false;
+  if (engine === 'subscription' && provider.type !== 'claude-subscription') { effEngine = 'api'; engineChanged = true; }
+  const routing = effEngine === 'ssh' ? 'remote' : (provider.type === 'claude-subscription' ? 'oauth' : 'bridge');
+
+  return {
+    ok: true,
+    ref: formatModelRef(provider.id, modelId),
+    provider, modelId,
+    cliModel: modelId,
+    caps: capsFor(provider, modelId),
+    pricing: pricingFor(provider, modelId),
+    engine: effEngine, engineChanged, routing,
+    ...(fallback ? { fallback } : {}),
+  };
+}
+
+/** Engine a run should really use: the tmux Subscription engine runs Claude's own login only. */
+function effectiveEngine(engine, value, registry) {
+  if (engine !== 'subscription') return engine;
+  const r = resolveModel(value, registry, { engine });
+  return r.ok ? r.engine : engine;
+}
+
+/** How a provider is billed, as the UI marks it: the CLI login is the subscription, the rest is API. */
+function providerMode(p) {
+  return p && p.type === 'claude-subscription' ? 'subscription' : 'api';
+}
+
+/**
+ * The engine a stored model value runs on. There is no engine dial: the model's provider
+ * decides. The CLI-login provider runs on the tmux Subscription engine when tmux exists
+ * (`opts.tmux`), every other provider — and the CLI login without tmux — headless.
+ * A bare value means the DEFAULT provider's model, exactly as resolveModel() reads it.
+ */
+function engineForModel(value, registry, opts = {}) {
+  const r = resolveModel(value, registry, { engine: 'api' });
+  return (r.ok && providerMode(r.provider) === 'subscription' && opts.tmux !== false) ? 'subscription' : 'api';
+}
+
+/**
+ * A value stored next to an explicit "Subscription" choice (the dial this replaced), as the
+ * model ref that now means the same thing: the CLI login's model. A bare alias or Claude id
+ * becomes `claude::<id>`; a ref to the CLI login stays; a ref to another provider stays too —
+ * that run already went headless under the old rule, so pinning it to Claude would change it.
+ */
+function toClaudeRef(value) {
+  const v = value == null ? '' : String(value).trim();
+  if (!v) return formatModelRef(BUILTIN_CLAUDE_ID, 'sonnet');
+  const parsed = parseModelRef(v);
+  if (!parsed) return v;
+  if (parsed.providerId) return v;
+  if (CLAUDE_ALIASES.includes(parsed.modelId) || /^claude-/i.test(parsed.modelId)) return formatModelRef(BUILTIN_CLAUDE_ID, parsed.modelId);
+  return v;
+}
+
+// ── Environment for one run ─────────────────────────────────────────────────
+// Every variable a provider decision may set. They are stripped from the inherited
+// environment FIRST, so a stale ANTHROPIC_BASE_URL in the server's own env (docker
+// compose still passes it) can never leak into a run that chose another provider.
+// Switches that route the CLI to a cloud backend (or an OAuth token that outranks the
+// login). They rank ABOVE ANTHROPIC_BASE_URL in the CLI, so a bridge or direct run must
+// not inherit them — but a run on the CLI's own configuration (routing 'oauth') keeps them.
+const BACKEND_ENV_VARS = [
+  'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY',
+  'ANTHROPIC_BEDROCK_BASE_URL', 'ANTHROPIC_VERTEX_BASE_URL', 'ANTHROPIC_FOUNDRY_BASE_URL',
+  'ANTHROPIC_FOUNDRY_API_KEY', 'CLAUDE_CODE_OAUTH_TOKEN',
+];
+
+const PROVIDER_ENV_VARS = [
+  'ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_MODEL',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'ANTHROPIC_DEFAULT_FABLE_MODEL', 'ANTHROPIC_SMALL_FAST_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL',
+  'ANTHROPIC_CUSTOM_HEADERS', 'CLAUDE_CODE_MAX_CONTEXT_TOKENS', 'CLAUDE_CODE_MAX_OUTPUT_TOKENS',
+  'CLAUDE_CODE_ALWAYS_ENABLE_EFFORT',
+];
+
+// The CLI asks for up to 64K output tokens by default; many models answer that with a 400.
+const MAX_OUTPUT_CEILING = 32000;
+
+/**
+ * @param target  resolveModel() result
+ * @param bridge  { baseUrl, token } for routing 'bridge'
+ * @returns {{ set: Object<string,string>, unset: string[], extraArgs: string[] }}
+ */
+function buildRunEnv(target, bridge = {}) {
+  const set = {}, unset = PROVIDER_ENV_VARS.slice(), extraArgs = [];
+  if (!target || !target.ok || target.routing === 'oauth' || target.routing === 'remote') {
+    return { set, unset, extraArgs };
+  }
+  unset.push(...BACKEND_ENV_VARS);
+  const p = target.provider, caps = target.caps || UNKNOWN_CAPS, o = p.options || {};
+  const firstParty = p.type === 'anthropic';
+  // A gateway that serves the Claude aliases, running a Claude model, is Claude as far as
+  // the CLI is concerned — before the registry every run looked exactly like this.
+  const claudeViaGateway = supportsAliases(p) && (CLAUDE_ALIASES.includes(target.modelId) || /^claude-/i.test(target.modelId));
+  set.ANTHROPIC_BASE_URL = bridge.baseUrl;
+  set.ANTHROPIC_AUTH_TOKEN = bridge.token;
+
+  // Which model the CLI's OWN background calls use. It asks for "haiku" (WebFetch
+  // summaries, Explore sub-agents) and "sonnet"/"opus" by alias; a provider that does
+  // not serve Claude would answer every one of those with 404.
+  // A provider that serves the aliases itself (a Claude gateway) keeps its own mapping
+  // unless a role was pinned explicitly; any other provider always gets one.
+  const aliases = supportsAliases(p);
+  const r = p.roles || {};
+  const haiku = aliases ? (r.fast || null) : (roleModel(p, 'fast') || target.modelId);
+  const sonnet = aliases ? (r.main || null) : (roleModel(p, 'main') || target.modelId);
+  const opus = aliases ? (r.strong || null) : (roleModel(p, 'strong') || target.modelId);
+  if (haiku) { set.ANTHROPIC_DEFAULT_HAIKU_MODEL = haiku; set.ANTHROPIC_SMALL_FAST_MODEL = haiku; }
+  const fable = aliases ? (r.fable || r.main || null) : (roleModel(p, 'fable') || target.modelId);
+  if (sonnet) set.ANTHROPIC_DEFAULT_SONNET_MODEL = sonnet;
+  if (fable) set.ANTHROPIC_DEFAULT_FABLE_MODEL = fable;
+  if (opus) set.ANTHROPIC_DEFAULT_OPUS_MODEL = opus;
+  if (r.subagent) set.CLAUDE_CODE_SUBAGENT_MODEL = r.subagent;
+
+  if (!firstParty) {
+    // For an id the CLI does not recognise it assumes a 200K window and compacts on
+    // that — too late for a 128K model, far too early for a 1M one.
+    if (caps.contextWindow) set.CLAUDE_CODE_MAX_CONTEXT_TOKENS = String(caps.contextWindow);
+    // WebSearch is an Anthropic SERVER tool: behind any other endpoint the nested call
+    // answers without searching. The `web` MCP server (SearXNG) is the working substitute.
+    // A Claude model behind a Claude gateway keeps it, as it always had.
+    if (!claudeViaGateway) extraArgs.push('--disallowedTools', 'WebSearch');
+  }
+  if (caps.maxOutput) set.CLAUDE_CODE_MAX_OUTPUT_TOKENS = String(Math.min(caps.maxOutput, MAX_OUTPUT_CEILING));
+  if (caps.reasoning === false) set.CLAUDE_CODE_DISABLE_THINKING = '1';
+  if (p.type === 'openai-compatible' || o.stripBetas) set.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = '1';
+  if (o.quietCli !== false && !firstParty) set.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = '1';
+  if (Number(o.apiTimeoutMs) > 0) set.API_TIMEOUT_MS = String(Math.trunc(Number(o.apiTimeoutMs)));
+  return { set, unset, extraArgs };
+}
+
+/** Apply buildRunEnv() to a copied environment object (mutates and returns it). */
+function applyRunEnv(env, runEnv) {
+  if (!runEnv) return env;
+  for (const k of runEnv.unset) delete env[k];
+  for (const [k, v] of Object.entries(runEnv.set)) { if (v != null && v !== '') env[k] = String(v); }
+  return env;
+}
+
+// ── Bridge run context ──────────────────────────────────────────────────────
+/** The provider as the bridge sees it (llm-bridge/server.js ProviderCfg). */
+function providerCfg(p) {
+  return {
+    id: p.id, label: p.label, type: p.type,
+    baseUrl: p.baseUrl, apiKey: p.apiKey || '', authScheme: p.authScheme || 'bearer',
+    headers: p.headers || {}, dialect: p.dialect || 'generic', options: p.options || {},
+  };
+}
+
+/** What the llm-bridge needs to serve one run (see llm-bridge/server.js RunCtx). */
+function buildRunCtx(target, meta = {}) {
+  const p = target.provider;
+  const models = {}, modelMap = {};
+  const add = (id) => { if (id && !models[id]) models[id] = capsFor(p, id); };
+  add(target.modelId);
+  for (const role of ROLE_KEYS) add((p.roles || {})[role]);
+  if (!supportsAliases(p)) {
+    for (const a of CLAUDE_ALIASES) {
+      const id = roleModel(p, ALIAS_ROLE[a]) || target.modelId;
+      modelMap[a] = id; add(id);
+    }
+  }
+  return {
+    runId: meta.runId || crypto.randomBytes(8).toString('hex'),
+    purpose: meta.purpose || 'chat',
+    sessionId: meta.sessionId || null,
+    taskId: meta.taskId || null,
+    botId: meta.botId || null,
+    provider: providerCfg(p),
+    model: target.modelId,
+    models, modelMap,
+    fallbackModel: supportsAliases(p) ? null : (roleModel(p, 'fast') || target.modelId),
+    // 'auto' = send the provider no effort at all. Measured on CLI 2.1.281: with no --effort
+    // flag the CLI still sends effort "high" itself, so null ("use the request's") would turn
+    // the toolbar's Auto into High on every reasoning model.
+    effort: ['low', 'medium', 'high', 'xhigh', 'max'].includes(meta.effort) ? meta.effort : 'auto',
+  };
+}
+
+// ── Choices for the pickers ─────────────────────────────────────────────────
+function publicModel(p, m) {
+  return { ref: formatModelRef(p.id, m.id), id: m.id, label: m.label || m.id, caps: normalizeCaps(m.caps), pricing: normalizePricing(m.pricing) };
+}
+
+/** Grouped list every model picker renders. Never carries a key. */
+function listChoices(registry) {
+  const providers = [];
+  for (const p of (registry && registry.providers) || []) {
+    if (p.enabled === false) continue;
+    const models = [];
+    if (supportsAliases(p)) {
+      for (const a of CLAUDE_ALIASES) models.push({ ref: formatModelRef(p.id, a), id: a, label: a, alias: true, caps: { ...CLAUDE_CAPS }, pricing: null });
+    }
+    for (const m of enabledModels(p)) {
+      if (CLAUDE_ALIASES.includes(m.id)) continue;
+      models.push(publicModel(p, m));
+    }
+    providers.push({ id: p.id, label: p.label, type: p.type, mode: providerMode(p), builtin: p.id === BUILTIN_CLAUDE_ID, isDefault: p.id === (registry.defaultProviderId || BUILTIN_CLAUDE_ID), models });
+  }
+  // utilityModel stays '' when unset: the pickers show that as "haiku on the default provider".
+  return { defaultProviderId: registry && registry.defaultProviderId || BUILTIN_CLAUDE_ID, utilityModel: (registry && registry.utilityModel) || '', providers };
+}
+
+/** Is this value something a run can use right now? (for write-time validation) */
+function isKnownModel(value, registry) {
+  const r = parseModelRef(value);
+  if (!r) return false;
+  // Bare: an alias always resolves; any other bare id only if the DEFAULT provider lists
+  // it — an agent naming "gpt-4o" must not produce a task that then fails on the login.
+  if (!r.providerId) {
+    if (CLAUDE_ALIASES.includes(r.modelId)) return true;
+    const d = defaultProviderFor(registry, 'api');
+    return !!(d && (d.models || []).some(m => m && m.id === r.modelId));
+  }
+  const p = findProvider(registry, r.providerId);
+  if (!p || p.enabled === false) return false;
+  if (supportsAliases(p) && CLAUDE_ALIASES.includes(r.modelId)) return true;
+  if (!supportsAliases(p) && CLAUDE_ALIASES.includes(r.modelId)) return !!roleModel(p, ALIAS_ROLE[r.modelId]);
+  // A model the catalogue does not list is still accepted: catalogues lag (and some
+  // providers publish none), and a hand-typed id is a legitimate choice.
+  return true;
+}
+
+/** Human label for a stored value, e.g. "DeepSeek · deepseek-chat". */
+function describeModel(value, registry) {
+  const r = parseModelRef(value);
+  if (!r) return String(value || '');
+  if (!r.providerId) return r.modelId;
+  const p = findProvider(registry, r.providerId);
+  const m = p && (p.models || []).find(x => x.id === r.modelId);
+  return `${p ? p.label : r.providerId} · ${m && m.label ? m.label : r.modelId}`;
+}
+
+/** Cost in USD of one usage record under a pricing table (USD per 1M tokens). */
+function computeCost(u, pricing) {
+  if (!u || !pricing) return null;
+  const inp = Number(u.inputTokens) || 0, out = Number(u.outputTokens) || 0, cr = Number(u.cacheReadTokens) || 0;
+  const c = (inp * (pricing.in || 0) + out * (pricing.out || 0) + cr * (pricing.cacheRead != null ? pricing.cacheRead : (pricing.in || 0))) / 1e6;
+  return Math.round(c * 1e6) / 1e6;
+}
+
+// ── Validation of a provider record coming from the API ─────────────────────
+function validateProviderInput(raw, { creating } = {}) {
+  const errors = [];
+  const out = {};
+  if (!raw || typeof raw !== 'object') return { errors: ['body'], value: out };
+  if (creating) {
+    if (!PROVIDER_ID_RE.test(String(raw.id || ''))) errors.push('id');
+    else out.id = raw.id;
+  }
+  if (raw.type !== undefined) {
+    if (!PROVIDER_TYPES.includes(raw.type) || raw.type === 'claude-subscription') errors.push('type');
+    else out.type = raw.type;
+  } else if (creating) errors.push('type');
+  if (raw.label !== undefined) {
+    const l = String(raw.label).trim();
+    if (!l || l.length > 60) errors.push('label'); else out.label = l;
+  } else if (creating) errors.push('label');
+  if (raw.baseUrl !== undefined) {
+    const u = String(raw.baseUrl).trim().replace(/\/+$/, '');
+    if (!/^https?:\/\/[^\s/?#]+[^\s]*$/i.test(u)) errors.push('baseUrl'); else out.baseUrl = u;
+  } else if (creating) errors.push('baseUrl');
+  if (raw.authScheme !== undefined) {
+    if (!AUTH_SCHEMES.includes(raw.authScheme)) errors.push('authScheme'); else out.authScheme = raw.authScheme;
+  }
+  if (raw.dialect !== undefined) {
+    if (!DIALECTS.includes(raw.dialect)) errors.push('dialect'); else out.dialect = raw.dialect;
+  }
+  if (raw.apiKey !== undefined && raw.apiKey !== null) {
+    const k = String(raw.apiKey);
+    if (k.length > 4096 || /[\r\n]/.test(k)) errors.push('apiKey'); else out.apiKey = k.trim();
+  }
+  if (raw.headers !== undefined) {
+    if (!raw.headers || typeof raw.headers !== 'object' || Array.isArray(raw.headers)) errors.push('headers');
+    else {
+      const h = {};
+      for (const [k, v] of Object.entries(raw.headers)) {
+        if (!/^[A-Za-z0-9-]{1,64}$/.test(k) || typeof v !== 'string' || /[\r\n]/.test(v) || v.length > 2048) { errors.push('headers'); break; }
+        h[k] = v;
+      }
+      out.headers = h;
+    }
+  }
+  if (raw.roles !== undefined) {
+    if (!raw.roles || typeof raw.roles !== 'object') errors.push('roles');
+    else {
+      const r = {};
+      for (const k of ROLE_KEYS) {
+        const v = raw.roles[k];
+        if (v == null || v === '') continue;
+        if (typeof v !== 'string' || !MODEL_ID_RE.test(v)) { errors.push('roles'); break; }
+        r[k] = v;
+      }
+      out.roles = r;
+    }
+  }
+  if (raw.aliases !== undefined) out.aliases = !!raw.aliases;
+  if (raw.enabled !== undefined) out.enabled = !!raw.enabled;
+  if (raw.options !== undefined) {
+    if (!raw.options || typeof raw.options !== 'object' || Array.isArray(raw.options)) errors.push('options');
+    else {
+      const o = {};
+      // An explicit null (a cleared form field) means "remove it" — providers-store drops
+      // null keys on merge; an absent key leaves the stored value alone.
+      const num = (k, min, max) => { const v = raw.options[k]; if (v === undefined) return; if (v === null || v === '') { o[k] = null; return; } const n = Number(v); if (!Number.isFinite(n) || n < min || n > max) errors.push(`options.${k}`); else o[k] = Math.trunc(n); };
+      num('timeoutMs', 10000, 3600000);
+      num('apiTimeoutMs', 10000, 3600000);
+      num('maxConcurrency', 1, 64);
+      for (const b of ['stripBetas', 'quietCli']) if (raw.options[b] !== undefined) o[b] = !!raw.options[b];
+      if (raw.options.extraBody === null) o.extraBody = null;
+      else if (raw.options.extraBody !== undefined) {
+        const eb = raw.options.extraBody;
+        if (typeof eb !== 'object' || Array.isArray(eb) || JSON.stringify(eb).length > 8192) errors.push('options.extraBody'); else o.extraBody = eb;
+      }
+      out.options = o;
+    }
+  }
+  return { errors: [...new Set(errors)], value: out };
+}
+
+module.exports = {
+  PROVIDER_TYPES, DIALECTS, AUTH_SCHEMES, CLAUDE_ALIASES, ROLE_KEYS, REF_SEP, BUILTIN_CLAUDE_ID,
+  PROVIDER_ID_RE, MODEL_ID_RE, PRESETS, CAP_KEYS, CLAUDE_CAPS, UNKNOWN_CAPS, PROVIDER_ENV_VARS, MAX_OUTPUT_CEILING,
+  parseModelRef, formatModelRef, isQualifiedRef, bareModelId,
+  normalizeCaps, normalizePricing, normalizeCatalog,
+  findProvider, defaultProviderFor, supportsAliases, roleModel, capsFor,
+  resolveModel, effectiveEngine, engineForModel, providerMode, toClaudeRef, buildRunEnv, applyRunEnv, buildRunCtx, providerCfg, BACKEND_ENV_VARS,
+  listChoices, isKnownModel, describeModel, computeCost, validateProviderInput,
+};
diff --git a/public/index.html b/public/index.html
index 91263552..e6002e3f 100644
--- a/public/index.html
+++ b/public/index.html
@@ -215,35 +215,32 @@
   overflow: hidden;
 }
 .proj-dd-menu.open { opacity: 1; visibility: visible; transform: translateY(0); }
-.proj-dd-search { padding: 12px; border-bottom: 1px solid var(--border); background: rgba(124,106,239,.05); }
+.proj-dd-search { padding: 8px; border-bottom: 1px solid var(--border); }
 .proj-dd-search input {
   width: 100%; background: var(--s3); border: 1px solid var(--border);
-  border-radius: 8px; padding: 8px 12px; font-size: 13px; color: var(--text);
+  border-radius: 6px; padding: 6px 10px; font-size: 12px; color: var(--text);
   outline: none; font-family: inherit; transition: border-color .15s, box-shadow .15s;
 }
-.proj-dd-search input:focus { border-color: var(--accent); box-shadow: 0 0 0 3px rgba(124,106,239,.15); }
-.proj-dd-list { max-height: 320px; overflow-y: auto; padding: 6px 0; }
-.proj-dd-list::-webkit-scrollbar { width: 6px; }
-.proj-dd-list::-webkit-scrollbar-thumb { background: var(--border); border-radius: 3px; }
+.proj-dd-search input:focus { border-color: var(--accent); box-shadow: 0 0 0 2px rgba(124,106,239,.15); }
+.proj-dd-list { max-height: 340px; overflow-y: auto; padding: 4px; }
+.proj-dd-list::-webkit-scrollbar { width: 4px; }
+.proj-dd-list::-webkit-scrollbar-thumb { background: var(--border); border-radius: 2px; }
 .proj-dd-list::-webkit-scrollbar-thumb:hover { background: var(--muted); }
 .proj-dd-item {
   position: relative;
-  display: flex; flex-direction: column; gap: 3px;
-  padding: 10px 16px; cursor: pointer; transition: background .12s;
-  border-left: 3px solid transparent;
+  display: flex; flex-direction: column; gap: 1px;
+  padding: 6px 28px 6px 10px; border-radius: 6px;
+  cursor: pointer; transition: background .12s;
 }
 .proj-dd-item:hover { background: var(--s3); }
-.proj-dd-item.active {
-  background: rgba(124,106,239,.1);
-  border-left-color: var(--accent);
-}
-.proj-dd-item .proj-dd-item-name { font-size: 14px; font-weight: 600; color: var(--text); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: flex; align-items: center; gap: 8px; }
-.proj-dd-item .proj-dd-item-path { font-size: 11px; color: var(--muted); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; padding-left: 22px; }
-.proj-dd-item.active .proj-dd-item-name { color: var(--accent2); }
-.proj-dd-item.active .proj-dd-item-name::before { content: '●'; color: var(--accent); font-size: 8px; flex-shrink: 0; }
-.proj-dd-empty { padding: 20px 16px; text-align: center; color: var(--muted); font-size: 13px; }
-.proj-dd-section-label { padding: 8px 16px 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .6px; color: var(--muted); }
-.proj-dd-divider { height: 1px; background: var(--border); margin: 6px 0; }
+.proj-dd-item.active { background: rgba(124,106,239,.12); }
+.proj-dd-item .proj-dd-item-name { font-size: 13px; font-weight: 500; color: var(--text); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: flex; align-items: center; gap: 6px; }
+.proj-dd-item .proj-dd-item-path { font-size: 11px; color: var(--muted); opacity: .8; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.proj-dd-item.active .proj-dd-item-name { color: var(--accent2); font-weight: 600; }
+.proj-dd-item.active::after { content: '✓'; position: absolute; right: 10px; top: 50%; transform: translateY(-50%); color: var(--accent2); font-size: 12px; }
+.proj-dd-empty { padding: 16px 12px; text-align: center; color: var(--muted); font-size: 12px; }
+.proj-dd-section-label { padding: 8px 10px 4px; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: .6px; color: var(--muted); opacity: .8; }
+.proj-dd-divider { height: 1px; background: var(--border); margin: 4px 6px; }
 
 /* ─── Rate limit badge ─── */
 #rlBadge { display:none; position:relative; align-items:center; gap:5px; padding:3px 9px; border-radius:6px; font-size:12px; font-weight:600; cursor:default; user-select:none; background:rgba(245,158,11,.15); border:1px solid rgba(245,158,11,.45); color:#f59e0b; transition:background .2s,border-color .2s; }
@@ -593,6 +590,7 @@
 
 /* ─── Agent team card ─── */
 .agent-team-card {
+  white-space: normal; /* same as .plan-review-card: may sit inside a pre-wrap .msg */
   align-self: flex-start;
   background: var(--s2);
   border: 1px solid var(--border);
@@ -697,6 +695,9 @@
 
 /* ─── Plan review card (planner bot's plan/ package -> Kanban approval) ─── */
 .plan-review-card {
+  /* Restored from history the card lives inside .mw.assistant .msg, which is pre-wrap for
+     plain text; without this the template's newlines/indent render as blank lines. */
+  white-space: normal;
   align-self: flex-start; background: var(--s2); border: 1px solid var(--border); border-radius: 12px;
   padding: 0; max-width: 560px; width: 100%; overflow: hidden; animation: status-appear .25s var(--ease-out); margin: 4px 0;
 }
@@ -1212,22 +1213,6 @@
 .emoji-grid button:active { scale: .92; }
 .emoji-grid button:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
 
-/* Starter-prompt chips in the bot modal. Self-sufficient on purpose: these used
-   class="cfg", which is only ever defined as a descendant (.ci .cfg), so on their
-   own they rendered as default browser buttons — white pills on a dark modal. */
-.tpl-chip {
-  font-family: inherit; font-size: 12px; line-height: 1;
-  padding: 8px 13px; border: none; border-radius: 999px; cursor: pointer;
-  background: var(--s2); color: var(--text);
-  box-shadow: inset 0 0 0 1px var(--border);
-  transition: box-shadow .15s, background-color .15s, scale .12s cubic-bezier(.2,0,0,1);
-}
-.tpl-chip { position: relative; }
-.tpl-chip::after { content: ''; position: absolute; left: 0; right: 0; top: 50%; height: 40px; transform: translateY(-50%); }
-.tpl-chip:hover { background: var(--s3); box-shadow: inset 0 0 0 1px var(--accent2); }
-.tpl-chip:active { scale: .96; }
-.tpl-chip:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
-
 /* New-tab chooser: two ways to start work, each speaking its own visual dialect.
    A bare '+' that always meant 'chat' hid the terminal entirely — the owner had to
    ask how to open one. Chat is the warm, rounded, conversational surface; the
@@ -1372,8 +1357,13 @@
 .bot-seg-btn { padding: 4px 11px; border-radius: 6px; border: none; background: transparent; color: var(--muted); cursor: pointer; font-size: 13px; font-weight: 500; white-space: nowrap; transition: background .12s, color .12s, box-shadow .12s; }
 .bot-seg-btn:hover { color: var(--text); background: rgba(255,255,255,.06); }
 .bot-seg-btn.on { background: var(--accent); color: white; box-shadow: 0 1px 6px rgba(124,106,239,.4); }
-.bot-seg-gw { margin-top: 6px; width: 100%; }
-.bot-seg-gw[hidden] { display: none; }
+/* The bot's model: one button opening the toolbar's picker (openBotModelPicker). */
+.bot-mdl-btn { display: flex; align-items: center; gap: 8px; width: 100%; padding: 9px 12px; background: var(--s2); border: 1px solid var(--border); border-radius: 8px; color: var(--text); font: inherit; font-size: 13px; cursor: pointer; text-align: left; transition: border-color .12s, background-color .12s; }
+.bot-mdl-btn:hover { border-color: var(--accent2); background: var(--s3); }
+.bot-mdl-btn:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.bot-mdl-btn .mdl-cur-name { flex: 1; }
+.bot-mdl-btn.inherit .mdl-cur-name { color: var(--muted); }
+.bot-mdl-btn .mdl-cur-prov { background: var(--s3); }
 .bot-mcp-list { display: flex; flex-direction: column; gap: 6px; max-height: 168px; overflow: auto; }
 .bot-mcp-row { display: flex; gap: 8px; align-items: flex-start; font-size: 13px; cursor: pointer; }
 .bot-mcp-row input { margin-top: 3px; flex-shrink: 0; }
@@ -2971,6 +2961,86 @@
 html[dir="rtl"] .notif-card.notif-error     { border-right-color: var(--red); }
 html[dir="rtl"] .notif-card.notif-milestone { border-right-color: var(--green); }
 html[dir="rtl"] .notif-card.notif-progress  { border-right-color: #a78bfa; }
+/* ─── Providers (sidebar + modal) and the model picker ─── */
+.tb-btn.mdl-cur, .mob-chip.mdl-cur { display: inline-flex; align-items: center; gap: 6px; max-width: 260px; }
+.mob-chip.mdl-cur { max-width: 100%; }
+.mdl-cur-name { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0; }
+.mdl-cur-prov { font-size: 10.5px; font-weight: 600; opacity: .8; padding: 1px 6px; border-radius: 6px; background: rgba(255,255,255,.14); white-space: nowrap; max-width: 110px; overflow: hidden; text-overflow: ellipsis; }
+.mdl-cur-caret { font-size: 9px; opacity: .75; }
+.mdl-pick {
+  position: fixed; z-index: 1300; width: 380px; max-width: calc(100vw - 16px);
+  background: var(--s2); border: 1px solid var(--border); border-radius: 12px;
+  box-shadow: 0 8px 32px rgba(0,0,0,.35), 0 0 0 1px rgba(124,106,239,.1);
+  display: none; overflow: hidden;
+}
+.mdl-pick.open { display: block; }
+.mdl-pick-search { padding: 10px; border-bottom: 1px solid var(--border); background: rgba(124,106,239,.05); }
+.mdl-pick-search input {
+  width: 100%; background: var(--s3); border: 1px solid var(--border); border-radius: 8px;
+  padding: 7px 10px; font-size: 13px; color: var(--text); outline: none; font-family: inherit;
+}
+.mdl-pick-search input:focus { border-color: var(--accent); box-shadow: 0 0 0 3px rgba(124,106,239,.15); }
+.mdl-pick-list { max-height: min(420px, 58vh); overflow-y: auto; padding: 4px 0; }
+.mdl-pick-grp { padding: 8px 12px 3px; font-size: 10.5px; font-weight: 700; color: var(--muted); text-transform: uppercase; letter-spacing: .05em; display: flex; gap: 6px; align-items: center; }
+.mdl-pick-item { display: flex; align-items: center; gap: 8px; padding: 6px 12px; cursor: pointer; font-size: 13px; color: var(--text); border-left: 3px solid transparent; }
+.mdl-pick-item:hover, .mdl-pick-item.kb { background: var(--s3); }
+.mdl-pick-item.on { background: var(--abg); border-left-color: var(--accent); }
+.mdl-pick-item .nm { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.mdl-pick-item .sub { color: var(--muted); font-family: var(--font-mono); font-size: 11px; margin-left: 6px; }
+.mdl-pick-item .caps { font-size: 11px; color: var(--muted); white-space: nowrap; }
+.mdl-pick-item.dim .nm { opacity: .55; }
+.mdl-pick-empty { padding: 14px 12px; color: var(--muted); font-size: 12.5px; }
+.mdl-pick-foot { border-top: 1px solid var(--border); padding: 8px 12px; font-size: 12px; }
+.mdl-pick-foot button { background: none; border: none; color: var(--accent2); cursor: pointer; font: inherit; padding: 0; }
+@media (max-width: 768px) {
+  .mdl-pick { left: 8px !important; right: 8px; bottom: 8px; top: auto !important; width: auto; }
+  .mdl-pick-list { max-height: 56vh; }
+}
+.prov-dot { width: 8px; height: 8px; border-radius: 50%; display: inline-block; background: var(--muted); flex-shrink: 0; opacity: .6; }
+.prov-dot.ok { background: var(--green); opacity: 1; }
+.prov-dot.err { background: var(--red); opacity: 1; }
+.prov-badge { font-size: 10px; padding: 1px 6px; border-radius: 8px; background: var(--abg); color: var(--accent2); flex-shrink: 0; }
+/* How a provider is billed — the engine follows it: the CLI login is the subscription, the rest API. */
+.prov-mode { font-size: 10px; font-weight: 600; padding: 1px 6px; border-radius: 8px; flex-shrink: 0; text-transform: none; letter-spacing: 0; white-space: nowrap; }
+.prov-mode.subscription { background: color-mix(in srgb, var(--orange) 16%, transparent); color: var(--orange); }
+.prov-mode.api { background: color-mix(in srgb, var(--blue) 14%, transparent); color: var(--blue); }
+.prov-warn { font-size: 11.5px; color: var(--orange); padding: 2px 2px 6px; line-height: 1.45; }
+.prov-warn[hidden] { display: none; }
+.prov-util { padding: 8px 2px 2px; font-size: 11.5px; color: var(--muted); }
+.prov-util select { width: 100%; margin-top: 4px; }
+.prov-usage { padding: 8px 2px 2px; font-size: 11px; color: var(--muted); }
+.prov-usage table { width: 100%; border-collapse: collapse; margin-top: 4px; }
+.prov-usage td { padding: 2px 0; }
+.prov-usage td.n { text-align: right; font-variant-numeric: tabular-nums; }
+.prov-modal { max-width: 640px; width: calc(100vw - 24px); }
+.prov-modal .modal-body { max-height: min(70vh, 640px); overflow-y: auto; }
+.prov-tabs { display: flex; gap: 2px; border-bottom: 1px solid var(--border); margin-bottom: 12px; flex-wrap: wrap; }
+.prov-tab { background: none; border: none; color: var(--muted); padding: 7px 10px; cursor: pointer; border-bottom: 2px solid transparent; font: inherit; font-size: 13px; }
+.prov-tab.on { color: var(--text); border-bottom-color: var(--accent); }
+.prov-tab[disabled] { opacity: .45; cursor: not-allowed; }
+.prov-pane[hidden], .prov-row[hidden] { display: none; }
+.prov-check { display: flex; align-items: center; gap: 8px; font-size: 12.5px; color: var(--text); margin: 0; cursor: pointer; text-transform: none; letter-spacing: 0; font-weight: 400; }
+.prov-check[hidden] { display: none; }
+.prov-test-res { font-size: 12px; margin-top: 6px; line-height: 1.45; word-break: break-word; }
+.prov-test-res.ok { color: var(--green); }
+.prov-test-res.err { color: var(--red); }
+.prov-models-bar { display: flex; gap: 6px; align-items: center; flex-wrap: wrap; margin-bottom: 8px; }
+.prov-models-list { max-height: 44vh; overflow-y: auto; border: 1px solid var(--border); border-radius: 8px; }
+.prov-model { padding: 6px 8px; border-bottom: 1px solid var(--border); font-size: 12.5px; }
+.prov-model:last-child { border-bottom: none; }
+.prov-model .pm-top { display: flex; gap: 8px; align-items: center; }
+.prov-model .pm-id { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.prov-model .pm-id code { font-family: var(--font-mono); font-size: 11.5px; color: var(--muted); margin-left: 6px; }
+.prov-model .pm-caps { color: var(--muted); font-size: 11px; margin: 2px 0 0 26px; }
+.prov-model .pm-edit { display: flex; gap: 6px 10px; flex-wrap: wrap; margin: 6px 0 2px 26px; font-size: 11px; color: var(--muted); align-items: center; }
+.prov-model .pm-edit[hidden] { display: none; }
+.prov-model .pm-edit select, .prov-model .pm-edit input { width: auto; background: var(--s3); border: 1px solid var(--border); color: var(--text); border-radius: 5px; padding: 2px 4px; font-size: 11px; font-family: inherit; }
+.prov-model .pm-edit select { padding-right: 18px; background-position: calc(100% - 9px) 52%, calc(100% - 5px) 52%; background-size: 4px 4px, 4px 4px; }
+.prov-model .pm-edit input[type=number] { width: 86px; }
+.prov-model .pm-btn { background: none; border: none; color: var(--muted); cursor: pointer; font-size: 12px; padding: 2px 4px; border-radius: 4px; }
+.prov-model .pm-btn:hover { color: var(--text); background: var(--s3); }
+.prov-model .pm-ok { color: var(--green); }
+.prov-model .pm-bad { color: var(--red); }
 </style>
 </head>
 <body>
@@ -3111,6 +3181,28 @@
       </div>
     </div>
 
+    <!-- Providers: where models come from (providers.js). Every model picker reads these. -->
+    <div class="sec">
+      <div class="sec-title" role="button" tabindex="0" aria-expanded="false" onclick="toggleSec('providers')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();toggleSec('providers')}">
+        <span data-i18n="sec.providers">Providers</span>
+        <div style="display:flex;align-items:center;gap:4px;margin-left:auto">
+          <button class="sec-add-btn" onclick="event.stopPropagation();openProviderForm()" title="Add provider" data-i18n-title="prov.add">＋</button>
+          <span class="badge" id="providersCount">0</span>
+        </div>
+      </div>
+      <div class="sec-body collapsed" id="providersBody">
+        <div style="font-size:11px;color:var(--muted);padding:2px 2px 6px;line-height:1.5" data-i18n="prov.hint">Where models come from. A model of any provider can be picked in chats, bots, tasks and schedules.</div>
+        <div class="prov-warn" id="provBridgeWarn" hidden data-i18n="prov.bridge.down">LLM bridge is not running: OpenAI-compatible providers are unavailable</div>
+        <div class="sec-list"><div id="providersList"></div></div>
+        <div class="prov-util">
+          <label for="provUtilitySel" data-i18n="prov.utility">Utility model</label>
+          <select id="provUtilitySel" class="tb-input" onchange="setUtilityModel(this.value)"></select>
+          <div style="margin-top:3px;line-height:1.4" data-i18n="prov.utility.hint">Chat titles, skill selection, history compaction, translation.</div>
+        </div>
+        <div class="prov-usage" id="provUsage"></div>
+      </div>
+    </div>
+
     <div class="sec">
       <div class="sec-title" role="button" tabindex="0" aria-expanded="false" onclick="toggleSec('agents')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();toggleSec('agents')}">
         <span data-i18n="sec.agents">Agents</span>
@@ -3128,7 +3220,7 @@
     
 
     <!-- Tunnel Manager -->
-    <div class="sec">
+    <div class="sec" hidden>
       <div class="sec-title" role="button" tabindex="0" aria-expanded="false" onclick="toggleSec('tunnel')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();toggleSec('tunnel')}">
         <span data-i18n="sec.tunnel">Remote Access</span>
         <div style="display:flex;align-items:center;gap:6px;margin-left:auto">
@@ -3189,7 +3281,7 @@
     </div>
 
     <!-- Telegram Remote Access -->
-    <div class="sec">
+    <div class="sec" hidden>
       <div class="sec-title" role="button" tabindex="0" aria-expanded="false" onclick="toggleSec('tg')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();toggleSec('tg')}">
         <span data-i18n="sec.telegram">Telegram</span>
         <div style="display:flex;align-items:center;gap:6px;margin-left:auto">
@@ -3301,18 +3393,7 @@
       <div class="mob-sheet-section">
         <div class="mob-sheet-label" data-i18n="tb.model">Model</div>
         <div class="mob-sheet-chips">
-          <button class="mob-chip" data-mob="model" data-v="haiku" onclick="setMobOpt(this,'model')" data-i18n-tip="model.haiku.tip">Haiku</button>
-          <button class="mob-chip on" data-mob="model" data-v="sonnet" onclick="setMobOpt(this,'model')" data-i18n-tip="model.sonnet.tip">Sonnet</button>
-          <button class="mob-chip" data-mob="model" data-v="opus" onclick="setMobOpt(this,'model')" data-i18n-tip="model.opus.tip">Opus</button>
-          <button class="mob-chip" data-mob="model" data-v="fable" onclick="setMobOpt(this,'model')" data-i18n-tip="model.fable.tip">Fable</button>
-        </div>
-      </div>
-      <div class="mob-sheet-section">
-        <div class="mob-sheet-label" data-i18n="tb.engine">Engine</div>
-        <div class="mob-sheet-chips">
-          <button class="mob-chip on" data-mob="engine" data-v="api" onclick="setMobOpt(this,'engine')" data-i18n-title="engine.api.title" title="API engine — headless claude -p, billed per token (Claude Pro / API key)">API</button>
-          <button class="mob-chip" data-mob="engine" data-v="subscription" onclick="setMobOpt(this,'engine')" data-i18n="engine.sub" data-i18n-title="engine.sub.title" title="Subscription engine — persistent tmux session, billed on the Claude Max subscription (no API credits). Requires tmux + Claude Max.">Subscription</button>
-          <button class="mob-chip" data-default-star onclick="setDefaultEngine()" data-i18n-title="engine.default.title" title="Make the current engine the default for new chats" data-i18n="engine.default.btn">★ Set as default</button>
+          <button class="mob-chip mdl-cur on" id="mobMdlMoreBtn" onclick="openModelPicker(this)" aria-haspopup="dialog">Sonnet</button>
         </div>
       </div>
       <div class="mob-sheet-section">
@@ -3425,7 +3506,6 @@ <h3 data-i18n="mob.tabs">Sessions</h3>
         <option value="fr">FR</option>
         <option value="he">HE</option>
       </select>
-      <a class="hb" href="https://github.com/Lexus2016/claude-code-studio" target="_blank" rel="noopener" data-tip="GitHub" style="text-decoration:none"><svg width="14" height="14" viewBox="0 0 24 24" fill="currentColor"><path d="M12 2C6.477 2 2 6.477 2 12c0 4.418 2.865 8.166 6.839 9.489.5.092.682-.217.682-.482 0-.237-.009-.868-.013-1.703-2.782.604-3.369-1.34-3.369-1.34-.454-1.154-1.11-1.462-1.11-1.462-.908-.62.069-.608.069-.608 1.003.07 1.531 1.03 1.531 1.03.892 1.529 2.341 1.087 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.11-4.555-4.943 0-1.091.39-1.984 1.029-2.683-.103-.253-.446-1.27.098-2.647 0 0 .84-.269 2.75 1.025A9.578 9.578 0 0112 6.836c.85.004 1.705.115 2.504.337 1.909-1.294 2.747-1.025 2.747-1.025.546 1.377.203 2.394.1 2.647.64.699 1.028 1.592 1.028 2.683 0 3.842-2.339 4.687-4.566 4.935.359.309.678.919.678 1.852 0 1.336-.012 2.415-.012 2.743 0 .267.18.578.688.48C19.138 20.163 22 16.418 22 12c0-5.523-4.477-10-10-10z"/></svg></a>
       <button class="hb" onclick="logout()" data-tip="Logout" data-i18n-tip="tip.logout"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2"><path d="M9 21H5a2 2 0 01-2-2V5a2 2 0 012-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg></button>
     </div>
   </div>
@@ -3448,17 +3528,8 @@ <h3 data-i18n="mob.tabs">Sessions</h3>
     <div class="tb-sep"></div>
     <div class="tb-group" data-tbg="model">
       <span class="label" data-i18n="tb.model">Model</span>
-      <button class="tb-btn" data-v="haiku" onclick="setOpt(this,'model')" data-i18n-tip="model.haiku.tip">Haiku</button>
-      <button class="tb-btn on" data-v="sonnet" onclick="setOpt(this,'model')" data-i18n-tip="model.sonnet.tip">Sonnet</button>
-      <button class="tb-btn" data-v="opus" onclick="setOpt(this,'model')" data-i18n-tip="model.opus.tip">Opus</button>
-      <button class="tb-btn" data-v="fable" onclick="setOpt(this,'model')" data-i18n-tip="model.fable.tip">Fable</button>
-    </div>
-    <div class="tb-sep"></div>
-    <div class="tb-group">
-      <span class="label" data-i18n="tb.engine">Engine</span>
-      <button class="tb-btn on" data-v="api" onclick="setOpt(this,'engine')" data-i18n-title="engine.api.title" title="API engine — headless claude -p, billed per token (Claude Pro / API key)">API</button>
-      <button class="tb-btn" data-v="subscription" onclick="setOpt(this,'engine')" data-i18n-title="engine.sub.title" title="Subscription engine — persistent tmux session, billed on Claude Max subscription (no API credits). Requires: tmux + Claude Max." data-i18n="engine.sub">Subscription</button>
-      <button class="tb-btn" data-default-star onclick="setDefaultEngine()" data-i18n-title="engine.default.title" title="Make the current engine the default for new chats" style="padding:0 8px">★</button>
+      <!-- One button: the chat's current model; the popup lists every provider's models (syncModelMore / openModelPicker). -->
+      <button class="tb-btn mdl-cur on" id="mdlMoreBtn" data-v="__model" onclick="openModelPicker(this)" aria-haspopup="dialog">Sonnet</button>
     </div>
     <div class="tb-sep"></div>
     <div class="tb-group" data-tbg="effort">
@@ -4184,28 +4255,12 @@ <h2 id="botModalTitle" data-i18n="bot.modal.add.title">New bot</h2>
         <input id="botDesc" data-i18n-ph="bot.modal.desc.ph" placeholder="crypto market analysis" autocomplete="off">
         <div class="cmd-name-hint" data-i18n="bot.modal.desc.hint">One line. Other bots see this, so they know who to hand work to.</div>
       </div>
-      <div class="cmd-field">
-        <label data-i18n="bot.modal.engine.label">Engine</label>
-        <div class="bot-seg" id="botEngineSeg" role="group">
-          <button type="button" class="bot-seg-btn on" data-v="" onclick="setBotEngine('')" data-i18n="bot.engine.inherit">Same as chat</button>
-          <button type="button" class="bot-seg-btn" data-v="api" onclick="setBotEngine('api')" data-i18n="bot.engine.api" data-i18n-title="engine.api.title">API</button>
-          <button type="button" class="bot-seg-btn" data-v="subscription" onclick="setBotEngine('subscription')" data-i18n="bot.engine.subscription" data-i18n-title="engine.sub.title">Claude subscription</button>
-        </div>
-        <input type="hidden" id="botEngine">
-        <div class="cmd-name-hint" data-i18n="bot.modal.engine.hint">Applies to this bot only, even when the chat runs on the other engine. Subscription needs a Claude login inside the server and tmux.</div>
-      </div>
       <div class="cmd-field">
         <label data-i18n="bot.modal.model.label">Model</label>
-        <div class="bot-seg" id="botModelSeg" role="group">
-          <button type="button" class="bot-seg-btn on" data-v="" onclick="setBotModel('')" data-i18n="bot.model.inherit">Same as chat</button>
-          <button type="button" class="bot-seg-btn" data-v="haiku" onclick="setBotModel('haiku')" data-i18n-tip="model.haiku.tip">Haiku</button>
-          <button type="button" class="bot-seg-btn" data-v="sonnet" onclick="setBotModel('sonnet')" data-i18n-tip="model.sonnet.tip">Sonnet</button>
-          <button type="button" class="bot-seg-btn" data-v="opus" onclick="setBotModel('opus')" data-i18n-tip="model.opus.tip">Opus</button>
-          <button type="button" class="bot-seg-btn" data-v="fable" onclick="setBotModel('fable')" data-i18n-tip="model.fable.tip">Fable</button>
-        </div>
-        <select id="botModelGw" class="bot-seg-gw" onchange="setBotModel(this.value)" hidden></select>
+        <!-- One button, the toolbar's picker (openModelPicker with a target): the model's provider decides the engine. -->
+        <button type="button" class="bot-mdl-btn" id="botModelBtn" onclick="openBotModelPicker(this)" aria-haspopup="dialog"></button>
         <input type="hidden" id="botModel">
-        <div class="cmd-name-hint" data-i18n="bot.modal.model.hint">Haiku, Sonnet, Opus, Fable, as on the new-chat bar. On the subscription these are Claude CLI aliases; on the API, whatever the gateway maps them to.</div>
+        <div class="cmd-name-hint" data-i18n="bot.modal.model.hint">"Same as chat" follows the chat the bot answers in. A model of the Claude (subscription) provider runs on the subscription, every other one through its API.</div>
       </div>
       <div class="cmd-field">
         <label data-i18n="bot.modal.tools.label">Files in a discussion</label>
@@ -4235,7 +4290,6 @@ <h2 id="botModalTitle" data-i18n="bot.modal.add.title">New bot</h2>
       </div>
       <div class="cmd-field">
         <label for="botPrompt" data-i18n="bot.modal.prompt.label">System prompt</label>
-        <div id="botTemplates" style="display:flex;flex-wrap:wrap;gap:6px;margin-bottom:2px"></div>
         <textarea id="botPrompt" rows="7" data-i18n-ph="bot.modal.prompt.ph" placeholder="You are a crypto market analyst..."></textarea>
         <div class="cmd-name-hint" data-i18n="bot.modal.prompt.hint">Who this bot is and how it works. Up to 8000 characters.</div>
       </div>
@@ -4249,6 +4303,131 @@ <h2 id="botModalTitle" data-i18n="bot.modal.add.title">New bot</h2>
   </div>
 </div>
 
+<div class="modal-overlay hidden" id="provModal" aria-hidden="true" onclick="if(event.target===this)cancelProviderForm()">
+  <div class="modal bot-modal prov-modal" role="dialog" aria-modal="true" aria-labelledby="provModalTitle" tabindex="-1">
+    <div class="modal-hdr">
+      <h2 id="provModalTitle" data-i18n="prov.modal.add.title">＋ New provider</h2>
+      <button class="modal-close" onclick="cancelProviderForm()">✕</button>
+    </div>
+    <div class="modal-body">
+      <div class="prov-tabs" role="tablist">
+        <button type="button" class="prov-tab on" data-pt="main" onclick="provTab('main')" data-i18n="prov.tab.main">General</button>
+        <button type="button" class="prov-tab" data-pt="models" onclick="provTab('models')" data-i18n="prov.tab.models">Models</button>
+        <button type="button" class="prov-tab" data-pt="roles" onclick="provTab('roles')" data-i18n="prov.tab.roles">Roles</button>
+        <button type="button" class="prov-tab" data-pt="adv" onclick="provTab('adv')" data-i18n="prov.tab.adv">Advanced</button>
+      </div>
+
+      <div class="prov-pane" data-pp="main">
+        <div class="cmd-field prov-row" id="provPresetRow">
+          <label for="provPreset" data-i18n="prov.f.preset">Preset</label>
+          <select id="provPreset" onchange="applyProviderPreset(this.value)"></select>
+        </div>
+        <div class="cmd-field">
+          <label for="provLabel" data-i18n="prov.f.label">Name</label>
+          <input id="provLabel" autocomplete="off" oninput="provLabelChanged()">
+        </div>
+        <div class="cmd-field prov-row" id="provIdRow">
+          <label for="provId" data-i18n="prov.f.id">Id</label>
+          <input id="provId" autocomplete="off" spellcheck="false" oninput="this.dataset.touched='1'">
+          <div class="cmd-name-hint" data-i18n="prov.f.id.hint">Part of every model reference ("id::model"). Cannot be changed later.</div>
+        </div>
+        <div class="cmd-field prov-row" id="provTypeRow">
+          <label for="provType" data-i18n="prov.f.type">API type</label>
+          <select id="provType" onchange="provTypeChanged()">
+            <option value="anthropic-compatible" data-i18n="prov.type.anthropic-compatible">Anthropic-compatible (/v1/messages)</option>
+            <option value="openai-compatible" data-i18n="prov.type.openai-compatible">OpenAI-compatible (/chat/completions)</option>
+            <option value="anthropic" data-i18n="prov.type.anthropic">Anthropic API</option>
+          </select>
+        </div>
+        <div class="cmd-field prov-row" id="provUrlRow">
+          <label for="provUrl" data-i18n="prov.f.url">Base URL</label>
+          <input id="provUrl" autocomplete="off" spellcheck="false" data-i18n-ph="prov.f.url.ph" placeholder="https://…">
+          <div class="cmd-name-hint" id="provUrlHint"></div>
+        </div>
+        <div class="cmd-field prov-row" id="provKeyRow">
+          <label for="provKey" data-i18n="prov.f.key">API key</label>
+          <input id="provKey" type="password" autocomplete="new-password" spellcheck="false">
+          <div class="cmd-name-hint prov-row" id="provKeyKeep" data-i18n="prov.f.key.keep" hidden>Leave empty to keep the stored key</div>
+          <label class="prov-check" id="provKeyClearRow" hidden><input type="checkbox" id="provKeyClear"> <span data-i18n="prov.f.key.clear">Remove the stored key</span></label>
+          <div class="cmd-name-hint" data-i18n="prov.f.key.hint">Stored encrypted; it never reaches the browser or the agent's environment.</div>
+        </div>
+        <div class="cmd-field prov-row" id="provAuthRow">
+          <label for="provAuth" data-i18n="prov.f.auth">Auth header</label>
+          <select id="provAuth">
+            <option value="bearer" data-i18n="prov.auth.bearer">Authorization: Bearer</option>
+            <option value="x-api-key" data-i18n="prov.auth.xapikey">x-api-key</option>
+            <option value="both" data-i18n="prov.auth.both">Both headers</option>
+          </select>
+        </div>
+        <div class="cmd-field prov-row" id="provDialectRow">
+          <label for="provDialect" data-i18n="prov.f.dialect">Dialect</label>
+          <select id="provDialect"></select>
+          <div class="cmd-name-hint" data-i18n="prov.f.dialect.hint">How effort, reasoning and the token limit are passed to this provider.</div>
+        </div>
+        <label class="prov-check" id="provAliasesRow"><input type="checkbox" id="provAliases"> <span data-i18n="prov.f.aliases">The server itself serves the Claude aliases (haiku/sonnet/opus/fable)</span></label>
+        <label class="prov-check"><input type="checkbox" id="provEnabled" checked> <span data-i18n="prov.f.enabled">Enabled</span></label>
+        <div class="cmd-field">
+          <button type="button" class="bg" onclick="testProviderForm()" data-i18n="prov.test">Test</button>
+          <div class="prov-test-res" id="provTestRes"></div>
+        </div>
+      </div>
+
+      <div class="prov-pane" data-pp="models" hidden>
+        <div class="cmd-name-hint" id="provModelsNote" hidden></div>
+        <div id="provModelsBox">
+          <div class="prov-models-bar">
+            <input id="provModelSearch" style="flex:1;min-width:140px" data-i18n-ph="prov.models.search" placeholder="Search models…" oninput="renderProviderModels()">
+            <button type="button" class="bg" onclick="refreshProviderModels()" data-i18n="prov.models.refresh">Refresh catalogue</button>
+          </div>
+          <div class="prov-models-bar">
+            <span class="cmd-name-hint" id="provModelsCount" style="flex:1"></span>
+            <button type="button" class="bg" onclick="bulkProviderModels(true)" data-i18n="prov.models.all_on">Enable shown</button>
+            <button type="button" class="bg" onclick="bulkProviderModels(false)" data-i18n="prov.models.all_off">Disable shown</button>
+          </div>
+          <div class="prov-models-list" id="provModelsList"></div>
+          <div class="prov-models-bar" style="margin-top:8px">
+            <input id="provModelAddId" style="flex:1;min-width:140px" spellcheck="false" data-i18n-ph="prov.models.add.ph" placeholder="model id, e.g. gpt-5">
+            <button type="button" class="bg" onclick="addProviderModel()" data-i18n="prov.models.add">Add a model by id</button>
+          </div>
+        </div>
+      </div>
+
+      <div class="prov-pane" data-pp="roles" hidden>
+        <div class="cmd-name-hint" style="margin-bottom:10px" data-i18n="prov.roles.hint">Which models the CLI uses for its own background calls and sub-agents. Empty = the main model.</div>
+        <div class="cmd-field"><label for="provRoleMain" data-i18n="prov.role.main">Main (sonnet, fable)</label><select id="provRoleMain"></select></div>
+        <div class="cmd-field"><label for="provRoleFast" data-i18n="prov.role.fast">Fast (haiku, background calls)</label><select id="provRoleFast"></select></div>
+        <div class="cmd-field"><label for="provRoleStrong" data-i18n="prov.role.strong">Strong (opus)</label><select id="provRoleStrong"></select></div>
+        <div class="cmd-field"><label for="provRoleSubagent" data-i18n="prov.role.subagent">Sub-agents (Task)</label><select id="provRoleSubagent"></select></div>
+      </div>
+
+      <div class="prov-pane" data-pp="adv" hidden>
+        <div class="cmd-field">
+          <label for="provHeaders" data-i18n="prov.f.headers">Extra headers</label>
+          <textarea id="provHeaders" rows="3" spellcheck="false" style="width:100%;font-family:var(--font-mono);font-size:12px"></textarea>
+          <div class="cmd-name-hint" data-i18n="prov.f.headers.hint">One per line: Name: value</div>
+        </div>
+        <div class="cmd-field">
+          <label for="provTimeout" data-i18n="prov.f.timeout">Response silence timeout, s</label>
+          <input id="provTimeout" type="number" min="10" max="3600">
+        </div>
+        <div class="cmd-field">
+          <label for="provConcurrency" data-i18n="prov.f.concurrency">Parallel requests</label>
+          <input id="provConcurrency" type="number" min="1" max="64">
+        </div>
+        <label class="prov-check" id="provStripRow"><input type="checkbox" id="provStripBetas"> <span data-i18n="prov.f.stripBetas">Do not forward the anthropic-beta header</span></label>
+        <div class="cmd-field">
+          <label for="provExtra" data-i18n="prov.f.extra">Extra request body (JSON)</label>
+          <textarea id="provExtra" rows="3" spellcheck="false" style="width:100%;font-family:var(--font-mono);font-size:12px"></textarea>
+          <div class="cmd-name-hint" data-i18n="prov.f.extra.hint">Merged into every request — for provider-specific switches.</div>
+        </div>
+      </div>
+    </div>
+    <div class="modal-footer">
+      <button class="bg" onclick="cancelProviderForm()" data-i18n="prov.cancel">Cancel</button>
+      <button class="bp" id="provSaveBtn" onclick="saveProvider()" data-i18n="prov.create">Add</button>
+    </div>
+  </div>
+</div>
 <div class="modal-overlay hidden" id="agentModal" aria-hidden="true" onclick="if(event.target===this)cancelAgentForm()">
   <div class="modal cmd-modal" role="dialog" aria-modal="true" aria-labelledby="agentModalTitle" tabindex="-1">
     <div class="modal-hdr">
@@ -4544,10 +4723,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // Settings form (issue #40): last /api/config/resolved payload + collapsed sections.
 let cfgResolved = null;
 const cfgCollapsedSections = new Set();
+// curEngine is DERIVED from curModel (engineOfModel) — the model's provider decides it.
 let curMode = 'auto', curAgent = 'single', curModel = 'sonnet', curEngine = 'api';
-// Global default engine for NEW chats (server-backed via /api/default-engine).
-// _curSessionRunEngine = the open chat's explicit run_engine (null = inherit default).
-let _globalDefaultEngine = 'api', _curSessionRunEngine = null;
 // Server truth for the currently-open session, snapshotted by loadSess() — an
 // 'interrupt' row still undelivered only means "lost" if the task has actually
 // ended; while it's running, the same row is still sitting in the server's queue.
@@ -4746,6 +4923,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     // listener could never take precedence; the check belongs here.
     const pop = $i('emojiPop');
     if (pop && !pop.classList.contains('hidden')) { closeEmojiPicker(); return; }
+    // …and so does the model picker the bot editor borrows.
+    const mp = $i('mdlPick');
+    if (mp && mp.classList.contains('open')) { closeModelPicker(); return; }
     if (typeof top.onEscape === 'function') top.onEscape();
     return;
   }
@@ -4812,9 +4992,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'cfg.reset.title':'Прибрати значення з файлу, щоб знову діяло вбудоване',
     'cfg.reset.done':'Скинуто до вбудованого значення',
     'cfg.saved_restart':'Збережено — перезапустіть сервер, щоб застосувати',
-    'cfg.h.defaultEngine':'Рушій, попередньо вибраний для нових чатів і задач: API (без інтерфейсу) або Subscription (Claude Max).',
     'cfg.h.chatDefaults.mode':'Режим, на якому відкривається новий чат. Проєкт може перевизначити його кнопкою ★ на панелі.','cfg.h.chatDefaults.agent':'Режим агента для нового чату: single, multi, dispatch або conversation.','cfg.h.chatDefaults.model':'Модель, попередньо вибрана для нового чату.','cfg.h.chatDefaults.effort':'Рівень обдумування для нового чату; auto — без прапорця --effort.','cfg.h.chatDefaults.turns':'Ліміт кроків для нового чату (1–200).',
-    'cfg.h.ANTHROPIC_BASE_URL':'Направляє запити Claude CLI через проксі чи шлюз замість прямого звернення до Anthropic.',
+    'cfg.h.ANTHROPIC_BASE_URL':'Шлюз, з якого на першому запуску створюється провайдер за замовчуванням (розділ «Провайдери»). Поки цього провайдера не змінено в інтерфейсі, він слідує за цим значенням після перезапуску.',
     'cfg.h.ANTHROPIC_API_KEY':'Ключ API для рушія API, коли claude CLI не має входу в акаунт.',
     'cfg.h.ANTHROPIC_AUTH_TOKEN':'Токен для проксі, заданого в ANTHROPIC_BASE_URL.',
     'cfg.h.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS':'Прибирає експериментальні beta-заголовки, які ламають бекенди поза Anthropic.',
@@ -4862,11 +5041,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'newtab.title':'Що відкрити?','newtab.chat':'Чат','newtab.chat.desc':'Звичайна розмова. Ботів кличте через @@','newtab.term':'Термінальний агент','newtab.term.desc':'Живий термінал CLI-агента у вкладці. Оберіть, кого запустити:','newtab.or':'або','term.tab':'термінал',
     'stream.gap':'Частину подій не показано — зʼєднання переривалось. Текст відповіді повний.',
     'agent.cap.delegate':'делегування','agent.cap.terminal':'термінал',
-    'bots.empty.what':'Бот — це named учасник чату зі своїм промптом, моделлю і памʼяттю. Аналітик, редактор, рецензент — кожен знає своє.','bots.empty.how':'Створіть бота і покличте його в повідомленні:','bots.empty.cta':'Створити першого бота','bot.tpl.replace':'Замінити те, що вже написано в промпті?','bot.tpl.analyst.name':'Аналітик','bot.tpl.analyst.desc':'аналіз даних і висновки','bot.tpl.analyst.prompt':'Ти аналітик. Розбираєш дані й даєш висновки, на які можна спертися.\n\nПравила:\n- Спершу цифри, потім інтерпретація.\n- Кожен висновок має спиратися на конкретне джерело.\n- Якщо даних бракує — скажи прямо, чого саме бракує.\n- Без води: короткі абзаци, ключове винось у список.','bot.tpl.writer.name':'Редактор','bot.tpl.writer.desc':'тексти і звіти','bot.tpl.writer.prompt':'Ти редактор. Перетворюєш чернетки й дані на текст, який приємно читати.\n\nПравила:\n- Пиши для людини, не для галочки.\n- Структура: заголовок, суть у першому абзаці, деталі нижче.\n- Не вигадуй фактів. Якщо чогось нема у вихідних даних — постав питання.\n- Прибирай канцелярит і повтори.','bot.tpl.reviewer.name':'Рецензент','bot.tpl.reviewer.desc':'перевірка коду і рішень','bot.tpl.reviewer.prompt':'Ти рецензент. Шукаєш, де рішення ламається, а не де воно гарне.\n\nПравила:\n- Кожна знахідка: що саме зламається, за яких вхідних даних, з посиланням на файл і рядок.\n- Розділяй «це помилка» і «мені так не подобається».\n- Якщо не впевнений — кажи, що це припущення.\n- Наприкінці: найважливіше першим.','bot.tpl.explainer.name':'Пояснювач','bot.tpl.explainer.desc':'пояснює складне просто','bot.tpl.explainer.prompt':'Ти пояснюєш складні речі простими словами.\n\nПравила:\n- Спочатку одне речення суті, потім деталі.\n- Приклад важливіший за визначення.\n- Терміни розшифровуй при першій згадці.\n- Не спрощуй до неправди: якщо є важливий нюанс — назви його.',
+    'bots.empty.what':'Бот — це named учасник чату зі своїм промптом, моделлю і памʼяттю. Аналітик, редактор, рецензент — кожен знає своє.','bots.empty.how':'Створіть бота і покличте його в повідомленні:','bots.empty.cta':'Створити першого бота',
     'bot.state.queued':'у черзі','bot.state.running':'працює','bot.state.done':'готово','bot.state.failed':'помилка','bot.state.stopped':'зупинено','bot.state.skipped':'пропущено','bot.stop.all':'Зупинити',
     'at.no_bots':'Ботів не знайдено',
     'bot.modal.mcp.label':'MCP-сервери','bot.modal.mcp.hint':'Інструменти, які бот отримує понад увімкнені для чату. Вебпошук давайте лише тим, хто читає, а не тим, хто ще запускає команди чи змінює файли.','bot.modal.mcp.none':'MCP-сервери не налаштовано.',
-    'sec.bots':'Боти','bots.hint':'Учасники цього проєкту. Згадайте бота через @@ у повідомленні.','bot.add.new':'Створити бота','bot.add.btn':'Створити','bot.use.title':'Вставити згадку','bot.modal.add.title':'Новий бот','bot.modal.edit.title':'Редагувати бота','bot.modal.label.label':'Ім\'я','bot.modal.handle.hint':'Звертання у чаті:','bot.modal.avatar.label':'Емодзі','bot.modal.desc.label':'Призначення','bot.modal.desc.hint':'Одним рядком. Це бачать інші боти, щоб знати, кому передати роботу.','bot.modal.model.label':'Модель','bot.model.inherit':'Як у чаті','bot.model.group.gateway':'Шлюз (API)','bot.model.no_tools':'без інструментів','bot.modal.model.hint':'Haiku, Sonnet, Opus, Fable — як на панелі нового чату. На підписці це псевдоніми Claude CLI, на API — те, у що їх перетворює шлюз.','bot.model.gateway.ph':'Інша модель шлюзу…','bot.modal.tools.label':'Файли в обговоренні','bot.tools.default':'За замовчуванням','bot.tools.read':'Читання','bot.tools.run':'Читання + команди','bot.tools.work':'Читання + запис','bot.modal.tools.hint':'Що бот може робити з файлами, поки бере участь у кімнаті. За замовчуванням — читання й запис. У картці Kanban і при прямому зверненні @@ він має повний доступ. На рушії «Підписка» це прохання в промпті, а не заборона.','bot.modal.engine.label':'Рушій','bot.engine.inherit':'Як у чаті','bot.engine.api':'API','bot.engine.subscription':'Підписка Claude','bot.modal.engine.hint':'Діє лише для цього бота, навіть якщо чат працює на іншому рушії. Підписці потрібен вхід у Claude на сервері та tmux.','bot.modal.prompt.label':'Системний промпт','bot.modal.prompt.hint':'Хто цей бот і як він працює. До 8000 символів.','bot.err.label':'Вкажіть імʼя бота','bot.del.confirm':'Видалити бота','bot.del.note':'Його минулі повідомлення лишаться, а звертання більше ніколи не дістанеться іншому боту.','bot.deleted':'видалений бот','toast.bot_added':'✓ Бота створено','toast.bot_updated':'✓ Бота оновлено','toast.bot_deleted':'✓ Бота видалено','bot.modal.global.label':'Доступний у всіх проєктах','bot.modal.global.hint':'Роль на кшталт програміста потрібна скрізь. Увімкніть — і бот зʼявиться в кожному проєкті без окремого додавання.','bot.modal.also_in':'Також у проєктах:','bot.modal.delete':'Видалити бота','bot.global.badge':'Доступний у всіх проєктах','bot.unlink.title':'Прибрати з цього проєкту','bot.unlink.confirm':'Прибрати з цього проєкту','bot.unlink.note':'Бот лишиться в інших проєктах, його повідомлення нікуди не зникнуть.','bot.del.everywhere':'Він доступний у всіх проєктах — зникне звідусіль.','bot.del.in_n':'Він доступний у {n} проєктах — зникне з усіх.','toast.bot_unlinked':'✓ Прибрано з проєкту','bots.import.title':'Імпортувати ботів з JSON файлу','bots.export.title':'Експортувати ботів у JSON файл','bots.import.conflict':'Ботів із такими звертаннями вже є: {n}. Перезаписати їх даними з файлу? Локальні зміни в них буде втрачено.','toast.bots_imported':'✓ Імпортовано ботів: {n}, пропущено: {s}','toast.bots_import_err':'Не вдалося імпортувати: ','toast.bots_import_parse':'Файл не є коректним JSON','toast.bots_import_empty':'У файлі немає жодного бота','toast.bots_import_reserved':'Пропущено через видалених ботів: {n} ({list}) — ці звертання зарезервовані назавжди','toast.bots_export_err':'Не вдалося експортувати ботів','toast.bots_export_empty':'Немає кого експортувати','at.group.bots':'Боти','at.group.files':'Файли',
+    'sec.bots':'Боти','bots.hint':'Учасники цього проєкту. Згадайте бота через @@ у повідомленні.','bot.add.new':'Створити бота','bot.add.btn':'Створити','bot.use.title':'Вставити згадку','bot.modal.add.title':'Новий бот','bot.modal.edit.title':'Редагувати бота','bot.modal.label.label':'Ім\'я','bot.modal.handle.hint':'Звертання у чаті:','bot.modal.avatar.label':'Емодзі','bot.modal.desc.label':'Призначення','bot.modal.desc.hint':'Одним рядком. Це бачать інші боти, щоб знати, кому передати роботу.','bot.modal.model.label':'Модель','bot.model.inherit':'Як у чаті','bot.modal.model.hint':'«Як у чаті» — модель чату, в якому бот відповідає. Модель провайдера з позначкою «підписка» працює з підписки Claude, решта — через API свого провайдера.','bot.modal.tools.label':'Файли в обговоренні','bot.tools.default':'За замовчуванням','bot.tools.read':'Читання','bot.tools.run':'Читання + команди','bot.tools.work':'Читання + запис','bot.modal.tools.hint':'Що бот може робити з файлами, поки бере участь у кімнаті. За замовчуванням — читання й запис. У картці Kanban і при прямому зверненні @@ він має повний доступ. Для моделі з підписки це прохання в промпті, а не заборона.','bot.modal.prompt.label':'Системний промпт','bot.modal.prompt.hint':'Хто цей бот і як він працює. До 8000 символів.','bot.err.label':'Вкажіть імʼя бота','bot.del.confirm':'Видалити бота','bot.del.note':'Його минулі повідомлення лишаться, а звертання більше ніколи не дістанеться іншому боту.','bot.deleted':'видалений бот','toast.bot_added':'✓ Бота створено','toast.bot_updated':'✓ Бота оновлено','toast.bot_deleted':'✓ Бота видалено','bot.modal.global.label':'Доступний у всіх проєктах','bot.modal.global.hint':'Роль на кшталт програміста потрібна скрізь. Увімкніть — і бот зʼявиться в кожному проєкті без окремого додавання.','bot.modal.also_in':'Також у проєктах:','bot.modal.delete':'Видалити бота','bot.global.badge':'Доступний у всіх проєктах','bot.unlink.title':'Прибрати з цього проєкту','bot.unlink.confirm':'Прибрати з цього проєкту','bot.unlink.note':'Бот лишиться в інших проєктах, його повідомлення нікуди не зникнуть.','bot.del.everywhere':'Він доступний у всіх проєктах — зникне звідусіль.','bot.del.in_n':'Він доступний у {n} проєктах — зникне з усіх.','toast.bot_unlinked':'✓ Прибрано з проєкту','bots.import.title':'Імпортувати ботів з JSON файлу','bots.export.title':'Експортувати ботів у JSON файл','bots.import.conflict':'Ботів із такими звертаннями вже є: {n}. Перезаписати їх даними з файлу? Локальні зміни в них буде втрачено.','toast.bots_imported':'✓ Імпортовано ботів: {n}, пропущено: {s}','toast.bots_import_err':'Не вдалося імпортувати: ','toast.bots_import_parse':'Файл не є коректним JSON','toast.bots_import_empty':'У файлі немає жодного бота','toast.bots_import_reserved':'Пропущено через видалених ботів: {n} ({list}) — ці звертання зарезервовані назавжди','toast.bots_export_err':'Не вдалося експортувати ботів','toast.bots_export_empty':'Немає кого експортувати','at.group.bots':'Боти','at.group.files':'Файли',
     'term.open.title':'Відкрити живий термінал цього агента у вкладці','term.kill':'Завершити','term.killConfirm':'Завершити цю термінальну сесію? Розмову можна буде відновити пізніше.','term.unavailable':'Термінальні сесії недоступні','term.state.attached':'підключено','term.state.started':'запущено','term.state.restored':'відновлено','term.state.restoredLast':'відновлено останню розмову агента','term.state.restoreFailed':'відновлювати не було чого — почато заново','term.state.exited':'агент завершився','term.state.error':'помилка','term.state.disconnected':'з’єднання втрачено — перепідключення...','term.state.reconnecting':'перепідключення...','term.paste.title':'Вставити в термінал','term.paste.notarget':'Немає відкритого термінала для вставки','term.paste.notconnected':'Термінал не підключений','term.paste.done':'Вставлено в термінал','term.refresh.title':'Перепідключити цей термінал','term.send.ph':'Надіслати рядок у термінал…','term.send.title':'Надіслати (Enter)',
     'agent.modal.newIdCommand.label':'Команда створення розмови','agent.modal.newIdCommand.hint':'Альтернатива прапорцю: команда, що створює розмову і друкує її id. Виконується один раз при створенні сесії.',
     'agent.modal.interactive.label':'Інтерактивна команда','agent.modal.interactive.hint':'Запускає TUI агента для термінальної сесії. Порожньо — агент лише для делегування.','agent.modal.resume.label':'Команда відновлення','agent.modal.resume.hint':'{sid} — ідентифікатор розмови. Використовується для відновлення сесії після перезавантаження.','agent.modal.resumeLast.label':'Відновити останню (запасний варіант)','agent.modal.resumeLast.hint':'Використовується, коли ідентифікатор невідомий. Може відновити іншу розмову.','agent.modal.newIdFlag.label':'Прапорець id нової розмови','agent.modal.newIdFlag.hint':'Якщо CLI дозволяє задати id НОВОЇ розмови, відновлення стає точним. Порожньо — не підтримується.',
@@ -5139,12 +5318,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'model.opus.tip':'Opus — найпотужніша модель; вибирайте для складних завдань, де важлива глибина аналізу, а не швидкість чи вартість.',
     'model.fable.tip':'Fable — найтворчіша й найглибша модель у міркуваннях (контекст 1М токенів, як у Sonnet/Opus); обирайте для складного планування й глибокого аналізу.',
     'turns.tip':'Максимальна кількість кроків Claude в одному запуску. Після ліміту Claude до 3 разів автоматично продовжує сесію («Continue where you left off») — реальна витрата може сягати ~4× заданого числа, перш ніж з\'явиться повідомлення про незавершення. Діапазон 1–200.',
-    'tb.engine':'Рушій','engine.sub':'Підписка',
-    'engine.api.title':'Рушій API — headless claude -p, оплата за токени (Claude Pro / ключ API)',
-    'engine.sub.title':'Рушій підписки — постійна сесія tmux, оплата з підписки Claude Max (без кредитів API). Потрібні tmux і Claude Max.',
-    'engine.default.btn':'★ Зробити типовим','engine.default.title':'Зробити поточний рушій типовим для нових чатів',
-    'engine.default.set':'Зробити поточний рушій ({engine}) типовим для нових чатів','engine.default.is':'{engine} — типовий рушій для нових чатів',
-    'engine.default.toast':'★ {engine} — типовий рушій для нових чатів','engine.default.err':'⚠ Не вдалося зберегти типовий рушій',
+    
+    
+    
     'tb.effort':'Зусилля','effort.title':'Рівень обдумування (claude --effort): Авто — типове значення CLI, вищі рівні — глибші міркування',
     'effort.auto':'Авто','effort.low':'Низьке','effort.med':'Середнє','effort.high':'Високе','effort.xhigh':'Дуже високе','effort.max':'Максимальне',
     'tb.defaults':'Типове','defaults.pin.title':'Зберегти поточні Режим / Агент / Модель / Effort / Кроки як типові для цього проєкту','defaults.reset.title':'Прибрати перевизначення проєкту й успадкувати глобальні типові значення','defaults.noproject':'Спершу відкрийте проєкт','defaults.pinned':'Типові значення проєкту збережено','defaults.reset.done':'Проєкт успадковує глобальні типові значення',
@@ -5173,6 +5349,114 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'input.ph.mob':'Напишіть завдання...',
     'skillcat.engineering':'⚙️ Розробка','skillcat.ai':'🧠 AI та промпти','skillcat.quality':'💎 Якість коду','skillcat.security':'🔒 Безпека','skillcat.design':'🎨 Дизайн','skillcat.product':'📋 Продукт','skillcat.finance':'💼 Фінанси','skillcat.research':'🔬 Дослідження','skillcat.workflow':'📐 Робочий процес','skillcat.system':'⚙️ Система','skillcat.plugin':'🧩 Skills плагінів',
     'upd.available':'Доступне оновлення','upd.btn':'Оновити','upd.updating':'Оновлення… {time}','upd.copy_cmd':'Копіювати команду','upd.via_terminal':'Оновлення через термінал:','upd.copied':'Скопійовано ✓','upd.retry':'Повторити','upd.failed':'Оновлення не вдалося','upd.new_version':'Доступна нова версія {version}',
+    /* providers & model picker (providers.js) */
+    'sec.providers':'Провайдери',
+    'prov.add':'＋ Додати провайдера',
+    'prov.hint':'Звідки беруться моделі. Модель будь-якого провайдера можна обрати в чаті, у ботів, задач і розкладу.',
+    'prov.bridge.down':'LLM-міст не запущено: OpenAI-сумісні провайдери недоступні',
+    'prov.utility':'Службова модель',
+    'prov.utility.hint':'Заголовки чатів, вибір навичок, стиснення історії, переклад.',
+    'prov.utility.default':'haiku на провайдері за замовчуванням',
+    'prov.builtin.claude':'Claude (вхід CLI)',
+    'prov.mode.subscription':'підписка','prov.mode.api':'API',
+    'prov.mode.subscription.tip':'Вхід Claude CLI: відповідає постійна сесія tmux, витрати — з підписки Claude. Без tmux — headless, з того ж входу.',
+    'prov.mode.api.tip':'Запити йдуть за API-ключем провайдера (headless claude -p), оплата за токени.',
+    'prov.default':'за замовч.',
+    'prov.make_default':'Зробити провайдером за замовчуванням',
+    'prov.test':'Перевірити',
+    'prov.edit':'Змінити',
+    'prov.del':'Видалити',
+    'prov.del.confirm':'Видалити провайдера «{name}»? Чати, закріплені за ним, працюватимуть на провайдері за замовчуванням.',
+    'prov.models.count':'моделей: {n}',
+    'prov.status.ok':'Працює',
+    'prov.status.unknown':'Ще не перевірявся',
+    'prov.disabled':'вимкнено',
+    'prov.type.anthropic':'Anthropic API',
+    'prov.type.anthropic-compatible':'Anthropic-сумісний (/v1/messages)',
+    'prov.type.openai-compatible':'OpenAI-сумісний (/chat/completions)',
+    'prov.type.claude-subscription':'Вхід Claude CLI (підписка)',
+    'prov.modal.add.title':'＋ Новий провайдер',
+    'prov.modal.edit.title':'Провайдер',
+    'prov.tab.main':'Основне',
+    'prov.tab.models':'Моделі',
+    'prov.tab.roles':'Ролі',
+    'prov.tab.adv':'Додатково',
+    'prov.f.preset':'Шаблон',
+    'prov.f.preset.ph':'Оберіть шаблон…',
+    'prov.f.label':'Назва',
+    'prov.f.id':'Ідентифікатор',
+    'prov.f.id.hint':'Частина кожного посилання на модель («id::модель»). Після створення не змінюється.',
+    'prov.f.type':'Тип API',
+    'prov.f.url':'Базова адреса',
+    'prov.f.url.ph':'https://…',
+    'prov.f.url.hint.oai':'Зазвичай закінчується на /v1 — до неї додається /chat/completions.',
+    'prov.f.url.hint.anth':'Без /v1/messages — його додає CLI.',
+    'prov.f.key':'API-ключ',
+    'prov.f.key.keep':'Залиште порожнім, щоб зберегти поточний ключ',
+    'prov.f.key.clear':'Видалити збережений ключ',
+    'prov.f.key.hint':'Зберігається зашифрованим і не потрапляє ні в браузер, ні в оточення агента.',
+    'prov.f.auth':'Заголовок авторизації',
+    'prov.auth.bearer':'Authorization: Bearer',
+    'prov.auth.xapikey':'x-api-key',
+    'prov.auth.both':'Обидва заголовки',
+    'prov.f.dialect':'Діалект',
+    'prov.f.dialect.hint':'Як передавати цьому провайдеру effort, міркування і ліміт токенів.',
+    'prov.f.aliases':'Сервер сам обслуговує аліаси Claude (haiku/sonnet/opus/fable)',
+    'prov.f.enabled':'Увімкнено',
+    'prov.f.headers':'Додаткові заголовки',
+    'prov.f.headers.hint':'По одному в рядку: Назва: значення',
+    'prov.f.timeout':'Тайм-аут тиші відповіді, с',
+    'prov.f.concurrency':'Паралельних запитів',
+    'prov.f.stripBetas':'Не передавати заголовок anthropic-beta',
+    'prov.f.extra':'Додаткове тіло запиту (JSON)',
+    'prov.f.extra.hint':'Об’єднується з кожним запитом — для перемикачів, специфічних для провайдера.',
+    'prov.models.search':'Пошук моделі…',
+    'prov.models.refresh':'Оновити каталог',
+    'prov.models.all_on':'Увімкнути показані',
+    'prov.models.all_off':'Вимкнути показані',
+    'prov.models.add':'Додати модель вручну',
+    'prov.models.add.ph':'id моделі, напр. gpt-5',
+    'prov.models.empty':'Каталог порожній — додайте моделі вручну.',
+    'prov.models.save_first':'Збережіть провайдера, щоб керувати його моделями.',
+    'prov.models.builtin':'Вхід CLI пропонує аліаси Claude: Haiku, Sonnet, Opus, Fable.',
+    'prov.models.enabled_n':'Увімкнено {on} з {all}',
+    'prov.models.more':'і ще {n} — уточніть пошук',
+    'prov.models.probe':'Перевірити модель: виклик інструмента й коротка відповідь',
+    'prov.models.caps':'Можливості та ціна',
+    'prov.probe.res':'Інструменти {tools} · текст {text} · {ms} мс',
+    'prov.cap.tools':'інструменти',
+    'prov.cap.vision':'зображення',
+    'prov.cap.reasoning':'міркування',
+    'prov.cap.ctx':'контекст',
+    'prov.cap.out':'макс. відповідь',
+    'prov.cap.price':'$ за 1M (вхід / вихід)',
+    'prov.roles.hint':'Які моделі CLI використовує для власних фонових викликів і субагентів. Порожньо — основна модель.',
+    'prov.role.main':'Основна (sonnet, fable)',
+    'prov.role.fast':'Швидка (haiku, фонові виклики)',
+    'prov.role.strong':'Сильна (opus)',
+    'prov.role.subagent':'Субагенти (Task)',
+    'prov.role.none':'— основна модель —',
+    'prov.cancel':'Скасувати',
+    'prov.create':'Додати',
+    'prov.save':'Зберегти',
+    'prov.saved':'Збережено',
+    'prov.test.ok':'З’єднання працює · моделей у каталозі: {n}',
+    'prov.test.nocat':'З’єднання працює · каталог моделей не публікується',
+    'prov.test.fail':'Не вдалося: {err}',
+    'prov.err.fields':'Перевірте поля: {fields}',
+    'prov.err.exists':'Провайдер з таким ідентифікатором уже існує',
+    'prov.usage':'Витрати за 30 днів (запити · токени вх/вих · $)',
+    'prov.usage.none':'Поки немає запитів через міст.',
+    'prov.notice.provider_missing':'Провайдера моделі «{ref}» більше немає — відповідь іде через провайдера за замовчуванням.',
+    'prov.notice.provider_disabled':'Провайдера моделі «{ref}» вимкнено — відповідь іде через провайдера за замовчуванням.',
+    
+    'model.pick.change':'натисніть, щоб змінити модель',
+    'model.pick.search':'Знайти модель…',
+    'model.pick.empty':'Нічого не знайдено',
+    'model.pick.manage':'⚙ Керувати провайдерами',
+    'model.pick.notools':'Без інструментів — не зможе читати й змінювати файли',
+    
+    'effort.unsupported':'Ця модель не підтримує міркування',
   },
   en: {
     'dlg.model':'Model','dlg.effort':'Reasoning effort','dlg.tuning.default':'Default',
@@ -5216,9 +5500,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'cfg.reset.title':'Remove the value from the file so the built-in default applies again',
     'cfg.reset.done':'Reset to the built-in default',
     'cfg.saved_restart':'Saved — restart the server to apply',
-    'cfg.h.defaultEngine':'Engine preselected for new chats and tasks: API (headless) or Subscription (Claude Max).',
     'cfg.h.chatDefaults.mode':'Mode a new chat opens on. A project can pin its own with the \u2605 button in the toolbar.','cfg.h.chatDefaults.agent':'Agent mode for a new chat: single, multi, dispatch or conversation.','cfg.h.chatDefaults.model':'Model preselected for a new chat.','cfg.h.chatDefaults.effort':'Thinking effort for a new chat; auto means no --effort flag is passed.','cfg.h.chatDefaults.turns':'Turn limit for a new chat (1\u2013200).',
-    'cfg.h.ANTHROPIC_BASE_URL':'Route Claude CLI requests through a proxy or gateway instead of Anthropic directly.',
+    'cfg.h.ANTHROPIC_BASE_URL':'The gateway the default provider is created from on first start (see Providers). Until that provider is edited in the UI, it follows this value after a restart.',
     'cfg.h.ANTHROPIC_API_KEY':'API key for the API engine when the claude CLI is not signed in.',
     'cfg.h.ANTHROPIC_AUTH_TOKEN':'Token for the proxy set in ANTHROPIC_BASE_URL.',
     'cfg.h.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS':'Strips experimental beta headers that break non-Anthropic backends.',
@@ -5266,11 +5549,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'newtab.title':'What would you like to open?','newtab.chat':'Chat','newtab.chat.desc':'An ordinary conversation. Call bots with @@','newtab.term':'Terminal agent','newtab.term.desc':"A CLI agent's live terminal in a tab. Pick which one:",'newtab.or':'or','term.tab':'terminal',
     'stream.gap':'Some live activity was not shown — the connection dropped. The answer itself is complete.',
     'agent.cap.delegate':'delegation','agent.cap.terminal':'terminal',
-    'bots.empty.what':'A bot is a named chat participant with its own prompt, model and memory. An analyst, an editor, a reviewer — each one knows its job.','bots.empty.how':'Create a bot, then call it in a message:','bots.empty.cta':'Create your first bot','bot.tpl.replace':'Replace what is already written in the prompt?','bot.tpl.analyst.name':'Analyst','bot.tpl.analyst.desc':'data analysis and conclusions','bot.tpl.analyst.prompt':'You are an analyst. You work through data and give conclusions someone can rely on.\n\nRules:\n- Numbers first, interpretation second.\n- Every conclusion names the source it rests on.\n- If the data is not enough, say exactly what is missing.\n- No padding: short paragraphs, key points as a list.','bot.tpl.writer.name':'Editor','bot.tpl.writer.desc':'documents and reports','bot.tpl.writer.prompt':'You are an editor. You turn drafts and data into text people actually want to read.\n\nRules:\n- Write for a reader, not for the record.\n- Structure: title, the point in the first paragraph, detail below.\n- Invent nothing. If a fact is not in the source, ask for it.\n- Cut jargon and repetition.','bot.tpl.reviewer.name':'Reviewer','bot.tpl.reviewer.desc':'reviews code and decisions','bot.tpl.reviewer.prompt':'You are a reviewer. You look for where a solution breaks, not where it is nice.\n\nRules:\n- Each finding: what breaks, on which input, with the file and line.\n- Separate \'this is a bug\' from \'I would have done it differently\'.\n- If you are unsure, say it is a guess.\n- Most severe first.','bot.tpl.explainer.name':'Explainer','bot.tpl.explainer.desc':'makes hard things clear','bot.tpl.explainer.prompt':'You explain difficult things in plain language.\n\nRules:\n- One sentence of the point first, then the detail.\n- An example beats a definition.\n- Unpack a term the first time it appears.\n- Do not simplify into being wrong: if a caveat matters, name it.',
+    'bots.empty.what':'A bot is a named chat participant with its own prompt, model and memory. An analyst, an editor, a reviewer — each one knows its job.','bots.empty.how':'Create a bot, then call it in a message:','bots.empty.cta':'Create your first bot',
     'bot.state.queued':'queued','bot.state.running':'working','bot.state.done':'done','bot.state.failed':'failed','bot.state.stopped':'stopped','bot.state.skipped':'skipped','bot.stop.all':'Stop',
     'at.no_bots':'No bots found',
     'bot.modal.mcp.label':'MCP servers','bot.modal.mcp.hint':'Tools this bot gets on top of the ones switched on for the chat. Give web search only to bots that read, not to ones that also run commands or edit files.','bot.modal.mcp.none':'No MCP servers configured.',
-    'sec.bots':'Bots','bots.hint':'Participants in this project. Mention one with @@ in a message.','bot.add.new':'Create bot','bot.add.btn':'Create','bot.use.title':'Insert mention','bot.modal.add.title':'New bot','bot.modal.edit.title':'Edit bot','bot.modal.label.label':'Name','bot.modal.handle.hint':'Addressed in chat as:','bot.modal.avatar.label':'Emoji','bot.modal.desc.label':'Purpose','bot.modal.desc.hint':'One line. Other bots see this, so they know who to hand work to.','bot.modal.model.label':'Model','bot.model.inherit':'Same as chat','bot.model.group.gateway':'Gateway (API)','bot.model.no_tools':'no tools','bot.modal.model.hint':'Haiku, Sonnet, Opus, Fable, as on the new-chat bar. On the subscription these are Claude CLI aliases; on the API, whatever the gateway maps them to.','bot.model.gateway.ph':'Another gateway model…','bot.modal.tools.label':'Files in a discussion','bot.tools.default':'Default','bot.tools.read':'Read','bot.tools.run':'Read + run','bot.tools.work':'Read + write','bot.modal.tools.hint':'What this bot may do to files while it takes part in a room. Default = read and write. On a Kanban card and when you address it with @@ it has full access. On the Subscription engine this is a request in the prompt, not a lock.','bot.modal.engine.label':'Engine','bot.engine.inherit':'Same as chat','bot.engine.api':'API','bot.engine.subscription':'Claude subscription','bot.modal.engine.hint':'Applies to this bot only, even when the chat runs on the other engine. Subscription needs a Claude login inside the server and tmux.','bot.modal.prompt.label':'System prompt','bot.modal.prompt.hint':'Who this bot is and how it works. Up to 8000 characters.','bot.err.label':'Give the bot a name','bot.del.confirm':'Delete bot','bot.del.note':'Its past messages stay, and its handle can never be taken by another bot.','bot.deleted':'deleted bot','toast.bot_added':'✓ Bot created','toast.bot_updated':'✓ Bot updated','toast.bot_deleted':'✓ Bot deleted','bot.modal.global.label':'Available in every project','bot.modal.global.hint':'A role like a programmer is wanted everywhere. Turn this on and the bot shows up in every project without being added to each one.','bot.modal.also_in':'Also in projects:','bot.modal.delete':'Delete bot','bot.global.badge':'Available in every project','bot.unlink.title':'Remove from this project','bot.unlink.confirm':'Remove from this project','bot.unlink.note':'The bot stays in other projects and keeps all of its messages.','bot.del.everywhere':'It is available in every project and will disappear from all of them.','bot.del.in_n':'It is available in {n} projects and will disappear from all of them.','toast.bot_unlinked':'✓ Removed from project','bots.import.title':'Import bots from a JSON file','bots.export.title':'Export bots to a JSON file','bots.import.conflict':'{n} of these handles already exist here. Overwrite them from the file? Local edits to those bots will be lost.','toast.bots_imported':'✓ Imported {n} bots, skipped {s}','toast.bots_import_err':'Could not import: ','toast.bots_import_parse':'That file is not valid JSON','toast.bots_import_empty':'No bots in that file','toast.bots_import_reserved':'Skipped {n} handle(s) belonging to deleted bots ({list}) — those are reserved forever','toast.bots_export_err':'Could not export the bots','toast.bots_export_empty':'Nothing to export','at.group.bots':'Bots','at.group.files':'Files',
+    'sec.bots':'Bots','bots.hint':'Participants in this project. Mention one with @@ in a message.','bot.add.new':'Create bot','bot.add.btn':'Create','bot.use.title':'Insert mention','bot.modal.add.title':'New bot','bot.modal.edit.title':'Edit bot','bot.modal.label.label':'Name','bot.modal.handle.hint':'Addressed in chat as:','bot.modal.avatar.label':'Emoji','bot.modal.desc.label':'Purpose','bot.modal.desc.hint':'One line. Other bots see this, so they know who to hand work to.','bot.modal.model.label':'Model','bot.model.inherit':'Same as chat','bot.modal.model.hint':'"Same as chat" follows the chat the bot answers in. A model of a provider marked "subscription" runs on the Claude subscription, any other one through its provider\'s API.','bot.modal.tools.label':'Files in a discussion','bot.tools.default':'Default','bot.tools.read':'Read','bot.tools.run':'Read + run','bot.tools.work':'Read + write','bot.modal.tools.hint':'What this bot may do to files while it takes part in a room. Default = read and write. On a Kanban card and when you address it with @@ it has full access. For a subscription model this is a request in the prompt, not a lock.','bot.modal.prompt.label':'System prompt','bot.modal.prompt.hint':'Who this bot is and how it works. Up to 8000 characters.','bot.err.label':'Give the bot a name','bot.del.confirm':'Delete bot','bot.del.note':'Its past messages stay, and its handle can never be taken by another bot.','bot.deleted':'deleted bot','toast.bot_added':'✓ Bot created','toast.bot_updated':'✓ Bot updated','toast.bot_deleted':'✓ Bot deleted','bot.modal.global.label':'Available in every project','bot.modal.global.hint':'A role like a programmer is wanted everywhere. Turn this on and the bot shows up in every project without being added to each one.','bot.modal.also_in':'Also in projects:','bot.modal.delete':'Delete bot','bot.global.badge':'Available in every project','bot.unlink.title':'Remove from this project','bot.unlink.confirm':'Remove from this project','bot.unlink.note':'The bot stays in other projects and keeps all of its messages.','bot.del.everywhere':'It is available in every project and will disappear from all of them.','bot.del.in_n':'It is available in {n} projects and will disappear from all of them.','toast.bot_unlinked':'✓ Removed from project','bots.import.title':'Import bots from a JSON file','bots.export.title':'Export bots to a JSON file','bots.import.conflict':'{n} of these handles already exist here. Overwrite them from the file? Local edits to those bots will be lost.','toast.bots_imported':'✓ Imported {n} bots, skipped {s}','toast.bots_import_err':'Could not import: ','toast.bots_import_parse':'That file is not valid JSON','toast.bots_import_empty':'No bots in that file','toast.bots_import_reserved':'Skipped {n} handle(s) belonging to deleted bots ({list}) — those are reserved forever','toast.bots_export_err':'Could not export the bots','toast.bots_export_empty':'Nothing to export','at.group.bots':'Bots','at.group.files':'Files',
     'term.open.title':"Open this agent's live terminal in a tab",'term.kill':'Kill','term.killConfirm':'Kill this terminal session? The conversation can be resumed later.','term.unavailable':'Terminal sessions are unavailable','term.state.attached':'attached','term.state.started':'started','term.state.restored':'restored','term.state.restoredLast':"restored the agent's last conversation",'term.state.restoreFailed':'nothing to resume — started fresh','term.state.exited':'agent exited','term.state.error':'error','term.state.disconnected':'connection lost — reconnecting…','term.state.reconnecting':'reconnecting…','term.paste.title':'Paste into terminal','term.paste.notarget':'No open terminal to paste into','term.paste.notconnected':'Terminal is not connected','term.paste.done':'Pasted into terminal','term.refresh.title':'Reconnect this terminal','term.send.ph':'Send a line to the terminal…','term.send.title':'Send (Enter)',
     'agent.modal.newIdCommand.label':'New-conversation command','agent.modal.newIdCommand.hint':'Alternative to the flag: a command that creates a conversation and prints its id. Run once when the session is created.',
     'agent.modal.interactive.label':'Interactive command','agent.modal.interactive.hint':"Starts the agent's TUI for a terminal session. Leave empty for a delegation-only agent.",'agent.modal.resume.label':'Resume command','agent.modal.resume.hint':'{sid} — the conversation id. Used to restore the session after a reboot.','agent.modal.resumeLast.label':'Resume last (fallback)','agent.modal.resumeLast.hint':'Used when no conversation id is known. May restore a different conversation.','agent.modal.newIdFlag.label':'New-conversation id flag','agent.modal.newIdFlag.hint':'If the CLI can be told the id of a NEW conversation, restore becomes exact. Leave empty if unsupported.',
@@ -5543,12 +5826,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'model.opus.tip':'Opus — the most capable model; pick it for hard tasks where depth of reasoning matters more than speed or cost.',
     'model.fable.tip':'Fable — the most creative, deepest-reasoning model (1M token context, same as Sonnet/Opus); pick it for complex planning and deep analysis.',
     'turns.tip':'Maximum steps Claude may take in one run. On hitting the limit, Claude auto-continues the session up to 3 more times ("Continue where you left off") — actual usage can reach ~4x this number before you see an incomplete-run notice. Range 1–200.',
-    'tb.engine':'Engine','engine.sub':'Subscription',
-    'engine.api.title':'API engine — headless claude -p, billed per token (Claude Pro / API key)',
-    'engine.sub.title':'Subscription engine — persistent tmux session, billed on the Claude Max subscription (no API credits). Requires tmux + Claude Max.',
-    'engine.default.btn':'★ Set as default','engine.default.title':'Make the current engine the default for new chats',
-    'engine.default.set':'Make the current engine ({engine}) the default for new chats','engine.default.is':'{engine} — default engine for new chats',
-    'engine.default.toast':'★ {engine} — default engine for new chats','engine.default.err':'⚠ Could not save the default engine',
+    
+    
+    
     'tb.effort':'Effort','effort.title':'Thinking effort dial (claude --effort): Auto = CLI default, higher levels = deeper reasoning',
     'effort.auto':'Auto','effort.low':'Low','effort.med':'Med','effort.high':'High','effort.xhigh':'X-High','effort.max':'Max',
     'tb.defaults':'Defaults','defaults.pin.title':'Save the current Mode / Agent / Model / Effort / Turns as this project\u2019s defaults','defaults.reset.title':'Drop this project\u2019s overrides and inherit the global defaults','defaults.noproject':'Open a project first','defaults.pinned':'Project defaults saved','defaults.reset.done':'Project inherits the global defaults',
@@ -5577,6 +5857,114 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'input.ph.mob':'Write a task...',
     'skillcat.engineering':'⚙️ Engineering','skillcat.ai':'🧠 AI & Prompts','skillcat.quality':'💎 Code Quality','skillcat.security':'🔒 Security','skillcat.design':'🎨 Design','skillcat.product':'📋 Product','skillcat.finance':'💼 Finance','skillcat.research':'🔬 Research','skillcat.workflow':'📐 Workflow','skillcat.system':'⚙️ System','skillcat.plugin':'🧩 Plugin Skills',
     'upd.available':'Update available','upd.btn':'Update','upd.updating':'Updating… {time}','upd.copy_cmd':'Copy command','upd.via_terminal':'Update via Terminal:','upd.copied':'Copied ✓','upd.retry':'Retry','upd.failed':'Update failed','upd.new_version':'New version {version} available',
+    /* providers & model picker (providers.js) */
+    'sec.providers':'Providers',
+    'prov.add':'＋ Add provider',
+    'prov.hint':'Where models come from. A model of any provider can be picked in chats, bots, tasks and schedules.',
+    'prov.bridge.down':'LLM bridge is not running: OpenAI-compatible providers are unavailable',
+    'prov.utility':'Utility model',
+    'prov.utility.hint':'Chat titles, skill selection, history compaction, translation.',
+    'prov.utility.default':'haiku on the default provider',
+    'prov.builtin.claude':'Claude (CLI login)',
+    'prov.mode.subscription':'subscription','prov.mode.api':'API',
+    'prov.mode.subscription.tip':'Claude CLI login: a persistent tmux session answers, billed on the Claude subscription. Without tmux it runs headless on the same login.',
+    'prov.mode.api.tip':'Requests go with the provider’s API key (headless claude -p), billed per token.',
+    'prov.default':'default',
+    'prov.make_default':'Make it the default provider',
+    'prov.test':'Test',
+    'prov.edit':'Edit',
+    'prov.del':'Delete',
+    'prov.del.confirm':'Delete provider "{name}"? Chats pinned to it will run on the default provider.',
+    'prov.models.count':'models: {n}',
+    'prov.status.ok':'Working',
+    'prov.status.unknown':'Not tested yet',
+    'prov.disabled':'disabled',
+    'prov.type.anthropic':'Anthropic API',
+    'prov.type.anthropic-compatible':'Anthropic-compatible (/v1/messages)',
+    'prov.type.openai-compatible':'OpenAI-compatible (/chat/completions)',
+    'prov.type.claude-subscription':'Claude CLI login (subscription)',
+    'prov.modal.add.title':'＋ New provider',
+    'prov.modal.edit.title':'Provider',
+    'prov.tab.main':'General',
+    'prov.tab.models':'Models',
+    'prov.tab.roles':'Roles',
+    'prov.tab.adv':'Advanced',
+    'prov.f.preset':'Preset',
+    'prov.f.preset.ph':'Choose a preset…',
+    'prov.f.label':'Name',
+    'prov.f.id':'Id',
+    'prov.f.id.hint':'Part of every model reference ("id::model"). Cannot be changed later.',
+    'prov.f.type':'API type',
+    'prov.f.url':'Base URL',
+    'prov.f.url.ph':'https://…',
+    'prov.f.url.hint.oai':'Usually ends in /v1 — /chat/completions is appended.',
+    'prov.f.url.hint.anth':'Without /v1/messages — the CLI appends it.',
+    'prov.f.key':'API key',
+    'prov.f.key.keep':'Leave empty to keep the stored key',
+    'prov.f.key.clear':'Remove the stored key',
+    'prov.f.key.hint':'Stored encrypted; it never reaches the browser or the agent\'s environment.',
+    'prov.f.auth':'Auth header',
+    'prov.auth.bearer':'Authorization: Bearer',
+    'prov.auth.xapikey':'x-api-key',
+    'prov.auth.both':'Both headers',
+    'prov.f.dialect':'Dialect',
+    'prov.f.dialect.hint':'How effort, reasoning and the token limit are passed to this provider.',
+    'prov.f.aliases':'The server itself serves the Claude aliases (haiku/sonnet/opus/fable)',
+    'prov.f.enabled':'Enabled',
+    'prov.f.headers':'Extra headers',
+    'prov.f.headers.hint':'One per line: Name: value',
+    'prov.f.timeout':'Response silence timeout, s',
+    'prov.f.concurrency':'Parallel requests',
+    'prov.f.stripBetas':'Do not forward the anthropic-beta header',
+    'prov.f.extra':'Extra request body (JSON)',
+    'prov.f.extra.hint':'Merged into every request — for provider-specific switches.',
+    'prov.models.search':'Search models…',
+    'prov.models.refresh':'Refresh catalogue',
+    'prov.models.all_on':'Enable shown',
+    'prov.models.all_off':'Disable shown',
+    'prov.models.add':'Add a model by id',
+    'prov.models.add.ph':'model id, e.g. gpt-5',
+    'prov.models.empty':'No catalogue — add models by id.',
+    'prov.models.save_first':'Save the provider to manage its models.',
+    'prov.models.builtin':'The CLI login offers the Claude aliases: Haiku, Sonnet, Opus, Fable.',
+    'prov.models.enabled_n':'{on} of {all} enabled',
+    'prov.models.more':'and {n} more — narrow the search',
+    'prov.models.probe':'Probe the model: a tool call and a short reply',
+    'prov.models.caps':'Capabilities and price',
+    'prov.probe.res':'Tools {tools} · text {text} · {ms} ms',
+    'prov.cap.tools':'tools',
+    'prov.cap.vision':'images',
+    'prov.cap.reasoning':'reasoning',
+    'prov.cap.ctx':'context',
+    'prov.cap.out':'max output',
+    'prov.cap.price':'$ per 1M (in / out)',
+    'prov.roles.hint':'Which models the CLI uses for its own background calls and sub-agents. Empty = the main model.',
+    'prov.role.main':'Main (sonnet, fable)',
+    'prov.role.fast':'Fast (haiku, background calls)',
+    'prov.role.strong':'Strong (opus)',
+    'prov.role.subagent':'Sub-agents (Task)',
+    'prov.role.none':'— the main model —',
+    'prov.cancel':'Cancel',
+    'prov.create':'Add',
+    'prov.save':'Save',
+    'prov.saved':'Saved',
+    'prov.test.ok':'Connection works · models in the catalogue: {n}',
+    'prov.test.nocat':'Connection works · no model catalogue is published',
+    'prov.test.fail':'Failed: {err}',
+    'prov.err.fields':'Check the fields: {fields}',
+    'prov.err.exists':'A provider with this id already exists',
+    'prov.usage':'Usage, last 30 days (requests · tokens in/out · $)',
+    'prov.usage.none':'No bridge requests yet.',
+    'prov.notice.provider_missing':'The provider of "{ref}" no longer exists — running on the default provider.',
+    'prov.notice.provider_disabled':'The provider of "{ref}" is switched off — running on the default provider.',
+    
+    'model.pick.change':'click to change the model',
+    'model.pick.search':'Find a model…',
+    'model.pick.empty':'Nothing found',
+    'model.pick.manage':'⚙ Manage providers',
+    'model.pick.notools':'No tools — cannot read or change files',
+    
+    'effort.unsupported':'This model does not reason',
   },
   ru: {
     'dlg.model':'Модель','dlg.effort':'Уровень рассуждений','dlg.tuning.default':'По умолчанию',
@@ -5620,9 +6008,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'cfg.reset.title':'Убрать значение из файла, чтобы снова действовало встроенное',
     'cfg.reset.done':'Сброшено до встроенного значения',
     'cfg.saved_restart':'Сохранено — перезапустите сервер, чтобы применить',
-    'cfg.h.defaultEngine':'Движок, предварительно выбранный для новых чатов и задач: API (без интерфейса) или Subscription (Claude Max).',
     'cfg.h.chatDefaults.mode':'Режим, с которым открывается новый чат. Проект может переопределить его кнопкой ★ на панели.','cfg.h.chatDefaults.agent':'Режим агента для нового чата: single, multi, dispatch или conversation.','cfg.h.chatDefaults.model':'Модель, предварительно выбранная для нового чата.','cfg.h.chatDefaults.effort':'Уровень обдумывания для нового чата; auto — без флага --effort.','cfg.h.chatDefaults.turns':'Лимит шагов для нового чата (1–200).',
-    'cfg.h.ANTHROPIC_BASE_URL':'Направляет запросы Claude CLI через прокси или шлюз вместо прямого обращения к Anthropic.',
+    'cfg.h.ANTHROPIC_BASE_URL':'Шлюз, из которого при первом запуске создаётся провайдер по умолчанию (раздел «Провайдеры»). Пока этот провайдер не изменён в интерфейсе, он следует за этим значением после перезапуска.',
     'cfg.h.ANTHROPIC_API_KEY':'Ключ API для движка API, когда claude CLI не выполнил вход.',
     'cfg.h.ANTHROPIC_AUTH_TOKEN':'Токен для прокси, заданного в ANTHROPIC_BASE_URL.',
     'cfg.h.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS':'Убирает экспериментальные beta-заголовки, ломающие бэкенды вне Anthropic.',
@@ -5670,11 +6057,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'newtab.title':'Что открыть?','newtab.chat':'Чат','newtab.chat.desc':'Обычный разговор. Ботов зовите через @@','newtab.term':'Терминальный агент','newtab.term.desc':'Живой терминал CLI-агента во вкладке. Выберите, кого запустить:','newtab.or':'или','term.tab':'терминал',
     'stream.gap':'Часть событий не показана — соединение прерывалось. Текст ответа полный.',
     'agent.cap.delegate':'делегирование','agent.cap.terminal':'терминал',
-    'bots.empty.what':'Бот — это именованный участник чата со своим промптом, моделью и памятью. Аналитик, редактор, рецензент — каждый знает своё.','bots.empty.how':'Создайте бота и позовите его в сообщении:','bots.empty.cta':'Создать первого бота','bot.tpl.replace':'Заменить то, что уже написано в промпте?','bot.tpl.analyst.name':'Аналитик','bot.tpl.analyst.desc':'анализ данных и выводы','bot.tpl.analyst.prompt':'Ты аналитик. Разбираешь данные и даёшь выводы, на которые можно опереться.\n\nПравила:\n- Сначала цифры, потом интерпретация.\n- Каждый вывод опирается на конкретный источник.\n- Если данных не хватает — скажи, чего именно.\n- Без воды: короткие абзацы, ключевое списком.','bot.tpl.writer.name':'Редактор','bot.tpl.writer.desc':'тексты и отчёты','bot.tpl.writer.prompt':'Ты редактор. Превращаешь черновики и данные в текст, который приятно читать.\n\nПравила:\n- Пиши для человека.\n- Структура: заголовок, суть в первом абзаце, детали ниже.\n- Не выдумывай фактов. Чего нет в источнике — спроси.\n- Убирай канцелярит и повторы.','bot.tpl.reviewer.name':'Рецензент','bot.tpl.reviewer.desc':'проверка кода и решений','bot.tpl.reviewer.prompt':'Ты рецензент. Ищешь, где решение ломается.\n\nПравила:\n- Каждая находка: что ломается, при каких данных, файл и строка.\n- Разделяй «это ошибка» и «мне не нравится».\n- Не уверен — скажи, что это предположение.\n- Самое важное первым.','bot.tpl.explainer.name':'Объяснятель','bot.tpl.explainer.desc':'объясняет сложное просто','bot.tpl.explainer.prompt':'Ты объясняешь сложное простыми словами.\n\nПравила:\n- Сначала суть одним предложением, потом детали.\n- Пример важнее определения.\n- Термин расшифровывай при первом упоминании.\n- Не упрощай до неправды: важный нюанс называй.',
+    'bots.empty.what':'Бот — это именованный участник чата со своим промптом, моделью и памятью. Аналитик, редактор, рецензент — каждый знает своё.','bots.empty.how':'Создайте бота и позовите его в сообщении:','bots.empty.cta':'Создать первого бота',
     'bot.state.queued':'в очереди','bot.state.running':'работает','bot.state.done':'готово','bot.state.failed':'ошибка','bot.state.stopped':'остановлен','bot.state.skipped':'пропущен','bot.stop.all':'Остановить',
     'at.no_bots':'Боты не найдены',
     'bot.modal.mcp.label':'MCP-серверы','bot.modal.mcp.hint':'Инструменты, которые бот получает сверх включённых для чата. Веб-поиск давайте только тем, кто читает, а не тем, кто ещё запускает команды или правит файлы.','bot.modal.mcp.none':'MCP-серверы не настроены.',
-    'sec.bots':'Боты','bots.hint':'Участники этого проекта. Упомяните бота через @@ в сообщении.','bot.add.new':'Создать бота','bot.add.btn':'Создать','bot.use.title':'Вставить упоминание','bot.modal.add.title':'Новый бот','bot.modal.edit.title':'Редактировать бота','bot.modal.label.label':'Имя','bot.modal.handle.hint':'Обращение в чате:','bot.modal.avatar.label':'Эмодзи','bot.modal.desc.label':'Назначение','bot.modal.desc.hint':'Одной строкой. Это видят другие боты, чтобы знать, кому передать работу.','bot.modal.model.label':'Модель','bot.model.inherit':'Как в чате','bot.model.group.gateway':'Шлюз (API)','bot.model.no_tools':'без инструментов','bot.modal.model.hint':'Haiku, Sonnet, Opus, Fable — как на панели нового чата. На подписке это алиасы Claude CLI, на API — то, во что их превращает шлюз.','bot.model.gateway.ph':'Другая модель шлюза…','bot.modal.tools.label':'Файлы в обсуждении','bot.tools.default':'По умолчанию','bot.tools.read':'Чтение','bot.tools.run':'Чтение + команды','bot.tools.work':'Чтение + запись','bot.modal.tools.hint':'Что бот может делать с файлами, пока участвует в комнате. По умолчанию — чтение и запись. В карточке канбана и при прямом обращении @@ у него полный доступ. На движке «Подписка» это просьба в промпте, а не запрет.','bot.modal.engine.label':'Движок','bot.engine.inherit':'Как в чате','bot.engine.api':'API','bot.engine.subscription':'Подписка Claude','bot.modal.engine.hint':'Действует только для этого бота, даже если чат идёт на другом движке. Подписке нужен вход в Claude на сервере и tmux.','bot.modal.prompt.label':'Системный промпт','bot.modal.prompt.hint':'Кто этот бот и как он работает. До 8000 символов.','bot.err.label':'Укажите имя бота','bot.del.confirm':'Удалить бота','bot.del.note':'Его прошлые сообщения останутся, а обращение больше никогда не достанется другому боту.','bot.deleted':'удалённый бот','toast.bot_added':'✓ Бот создан','toast.bot_updated':'✓ Бот обновлён','toast.bot_deleted':'✓ Бот удалён','bot.modal.global.label':'Доступен во всех проектах','bot.modal.global.hint':'Роль вроде программиста нужна везде. Включите — и бот появится в каждом проекте без отдельного добавления.','bot.modal.also_in':'Также в проектах:','bot.modal.delete':'Удалить бота','bot.global.badge':'Доступен во всех проектах','bot.unlink.title':'Убрать из этого проекта','bot.unlink.confirm':'Убрать из этого проекта','bot.unlink.note':'Бот останется в других проектах, его сообщения никуда не денутся.','bot.del.everywhere':'Он доступен во всех проектах — исчезнет отовсюду.','bot.del.in_n':'Он доступен в {n} проектах — исчезнет из всех.','toast.bot_unlinked':'✓ Убран из проекта','bots.import.title':'Импортировать ботов из JSON файла','bots.export.title':'Экспортировать ботов в JSON файл','bots.import.conflict':'Ботов с такими обращениями уже есть: {n}. Перезаписать их данными из файла? Локальные изменения в них будут потеряны.','toast.bots_imported':'✓ Импортировано ботов: {n}, пропущено: {s}','toast.bots_import_err':'Не удалось импортировать: ','toast.bots_import_parse':'Файл не является корректным JSON','toast.bots_import_empty':'В файле нет ни одного бота','toast.bots_import_reserved':'Пропущено из-за удалённых ботов: {n} ({list}) — эти обращения зарезервированы навсегда','toast.bots_export_err':'Не удалось экспортировать ботов','toast.bots_export_empty':'Некого экспортировать','at.group.bots':'Боты','at.group.files':'Файлы',
+    'sec.bots':'Боты','bots.hint':'Участники этого проекта. Упомяните бота через @@ в сообщении.','bot.add.new':'Создать бота','bot.add.btn':'Создать','bot.use.title':'Вставить упоминание','bot.modal.add.title':'Новый бот','bot.modal.edit.title':'Редактировать бота','bot.modal.label.label':'Имя','bot.modal.handle.hint':'Обращение в чате:','bot.modal.avatar.label':'Эмодзи','bot.modal.desc.label':'Назначение','bot.modal.desc.hint':'Одной строкой. Это видят другие боты, чтобы знать, кому передать работу.','bot.modal.model.label':'Модель','bot.model.inherit':'Как в чате','bot.modal.model.hint':'«Как в чате» — модель чата, в котором бот отвечает. Модель провайдера с пометкой «подписка» работает по подписке Claude, остальные — через API своего провайдера.','bot.modal.tools.label':'Файлы в обсуждении','bot.tools.default':'По умолчанию','bot.tools.read':'Чтение','bot.tools.run':'Чтение + команды','bot.tools.work':'Чтение + запись','bot.modal.tools.hint':'Что бот может делать с файлами, пока участвует в комнате. По умолчанию — чтение и запись. В карточке канбана и при прямом обращении @@ у него полный доступ. Для модели по подписке это просьба в промпте, а не запрет.','bot.modal.prompt.label':'Системный промпт','bot.modal.prompt.hint':'Кто этот бот и как он работает. До 8000 символов.','bot.err.label':'Укажите имя бота','bot.del.confirm':'Удалить бота','bot.del.note':'Его прошлые сообщения останутся, а обращение больше никогда не достанется другому боту.','bot.deleted':'удалённый бот','toast.bot_added':'✓ Бот создан','toast.bot_updated':'✓ Бот обновлён','toast.bot_deleted':'✓ Бот удалён','bot.modal.global.label':'Доступен во всех проектах','bot.modal.global.hint':'Роль вроде программиста нужна везде. Включите — и бот появится в каждом проекте без отдельного добавления.','bot.modal.also_in':'Также в проектах:','bot.modal.delete':'Удалить бота','bot.global.badge':'Доступен во всех проектах','bot.unlink.title':'Убрать из этого проекта','bot.unlink.confirm':'Убрать из этого проекта','bot.unlink.note':'Бот останется в других проектах, его сообщения никуда не денутся.','bot.del.everywhere':'Он доступен во всех проектах — исчезнет отовсюду.','bot.del.in_n':'Он доступен в {n} проектах — исчезнет из всех.','toast.bot_unlinked':'✓ Убран из проекта','bots.import.title':'Импортировать ботов из JSON файла','bots.export.title':'Экспортировать ботов в JSON файл','bots.import.conflict':'Ботов с такими обращениями уже есть: {n}. Перезаписать их данными из файла? Локальные изменения в них будут потеряны.','toast.bots_imported':'✓ Импортировано ботов: {n}, пропущено: {s}','toast.bots_import_err':'Не удалось импортировать: ','toast.bots_import_parse':'Файл не является корректным JSON','toast.bots_import_empty':'В файле нет ни одного бота','toast.bots_import_reserved':'Пропущено из-за удалённых ботов: {n} ({list}) — эти обращения зарезервированы навсегда','toast.bots_export_err':'Не удалось экспортировать ботов','toast.bots_export_empty':'Некого экспортировать','at.group.bots':'Боты','at.group.files':'Файлы',
     'term.open.title':'Открыть живой терминал этого агента во вкладке','term.kill':'Завершить','term.killConfirm':'Завершить эту терминальную сессию? Разговор можно будет восстановить позже.','term.unavailable':'Терминальные сессии недоступны','term.state.attached':'подключено','term.state.started':'запущено','term.state.restored':'восстановлено','term.state.restoredLast':'восстановлен последний разговор агента','term.state.restoreFailed':'восстанавливать было нечего — начато заново','term.state.exited':'агент завершился','term.state.error':'ошибка','term.state.disconnected':'соединение потеряно — переподключение...','term.state.reconnecting':'переподключение...','term.paste.title':'Вставить в терминал','term.paste.notarget':'Нет открытого терминала для вставки','term.paste.notconnected':'Терминал не подключен','term.paste.done':'Вставлено в терминал','term.refresh.title':'Переподключить этот терминал','term.send.ph':'Отправить строку в терминал…','term.send.title':'Отправить (Enter)',
     'agent.modal.newIdCommand.label':'Команда создания разговора','agent.modal.newIdCommand.hint':'Альтернатива флагу: команда, создающая разговор и печатающая его id. Выполняется один раз при создании сессии.',
     'agent.modal.interactive.label':'Интерактивная команда','agent.modal.interactive.hint':'Запускает TUI агента для терминальной сессии. Пусто — агент только для делегирования.','agent.modal.resume.label':'Команда восстановления','agent.modal.resume.hint':'{sid} — идентификатор разговора. Используется для восстановления сессии после перезагрузки.','agent.modal.resumeLast.label':'Восстановить последний (запасной вариант)','agent.modal.resumeLast.hint':'Используется, когда идентификатор неизвестен. Может восстановить другой разговор.','agent.modal.newIdFlag.label':'Флаг id нового разговора','agent.modal.newIdFlag.hint':'Если CLI позволяет задать id НОВОГО разговора, восстановление становится точным. Пусто — не поддерживается.',
@@ -5947,12 +6334,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'model.opus.tip':'Opus — самая мощная модель; выбирайте для сложных задач, где важна глубина анализа, а не скорость или стоимость.',
     'model.fable.tip':'Fable — самая творческая и глубокая в рассуждениях модель (контекст 1М токенов, как у Sonnet/Opus); выбирайте для сложного планирования и глубокого анализа.',
     'turns.tip':'Максимальное количество шагов Claude за один запуск. По достижении лимита Claude автоматически продолжает сессию до 3 раз («Continue where you left off») — реальный расход может достигать ~4× заданного числа, прежде чем появится уведомление о незавершении. Диапазон 1–200.',
-    'tb.engine':'Движок','engine.sub':'Подписка',
-    'engine.api.title':'Движок API — headless claude -p, оплата за токены (Claude Pro / ключ API)',
-    'engine.sub.title':'Движок подписки — постоянная сессия tmux, оплата по подписке Claude Max (без кредитов API). Требуются tmux и Claude Max.',
-    'engine.default.btn':'★ Сделать основным','engine.default.title':'Сделать текущий движок основным для новых чатов',
-    'engine.default.set':'Сделать текущий движок ({engine}) основным для новых чатов','engine.default.is':'{engine} — основной движок для новых чатов',
-    'engine.default.toast':'★ {engine} — основной движок для новых чатов','engine.default.err':'⚠ Не удалось сохранить основной движок',
+    
+    
+    
     'tb.effort':'Усилие','effort.title':'Уровень обдумывания (claude --effort): Авто — значение CLI по умолчанию, более высокие уровни — более глубокие рассуждения',
     'effort.auto':'Авто','effort.low':'Низкое','effort.med':'Среднее','effort.high':'Высокое','effort.xhigh':'Очень высокое','effort.max':'Максимальное',
     'tb.defaults':'По умолчанию','defaults.pin.title':'Сохранить текущие Режим / Агент / Модель / Effort / Шаги как значения по умолчанию для этого проекта','defaults.reset.title':'Убрать переопределения проекта и унаследовать глобальные значения по умолчанию','defaults.noproject':'Сначала откройте проект','defaults.pinned':'Значения по умолчанию для проекта сохранены','defaults.reset.done':'Проект наследует глобальные значения по умолчанию',
@@ -5981,6 +6365,114 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'input.ph.mob':'Напишите задачу...',
     'skillcat.engineering':'⚙️ Разработка','skillcat.ai':'🧠 AI и промпты','skillcat.quality':'💎 Качество кода','skillcat.security':'🔒 Безопасность','skillcat.design':'🎨 Дизайн','skillcat.product':'📋 Продукт','skillcat.finance':'💼 Финансы','skillcat.research':'🔬 Исследования','skillcat.workflow':'📐 Рабочий процесс','skillcat.system':'⚙️ Система','skillcat.plugin':'🧩 Skills плагинов',
     'upd.available':'Доступно обновление','upd.btn':'Обновить','upd.updating':'Обновление… {time}','upd.copy_cmd':'Копировать команду','upd.via_terminal':'Обновление через терминал:','upd.copied':'Скопировано ✓','upd.retry':'Повторить','upd.failed':'Обновление не удалось','upd.new_version':'Доступна новая версия {version}',
+    /* providers & model picker (providers.js) */
+    'sec.providers':'Провайдеры',
+    'prov.add':'＋ Добавить провайдера',
+    'prov.hint':'Откуда берутся модели. Модель любого провайдера можно выбрать в чате, у ботов, задач и расписаний.',
+    'prov.bridge.down':'LLM-мост не запущен: OpenAI-совместимые провайдеры недоступны',
+    'prov.utility':'Служебная модель',
+    'prov.utility.hint':'Заголовки чатов, выбор навыков, сжатие истории, перевод.',
+    'prov.utility.default':'haiku на провайдере по умолчанию',
+    'prov.builtin.claude':'Claude (вход CLI)',
+    'prov.mode.subscription':'подписка','prov.mode.api':'API',
+    'prov.mode.subscription.tip':'Вход Claude CLI: отвечает постоянная сессия tmux, расход — по подписке Claude. Без tmux — headless, с тем же входом.',
+    'prov.mode.api.tip':'Запросы идут по API-ключу провайдера (headless claude -p), оплата за токены.',
+    'prov.default':'по умолч.',
+    'prov.make_default':'Сделать провайдером по умолчанию',
+    'prov.test':'Проверить',
+    'prov.edit':'Изменить',
+    'prov.del':'Удалить',
+    'prov.del.confirm':'Удалить провайдера «{name}»? Чаты, закреплённые за ним, будут работать на провайдере по умолчанию.',
+    'prov.models.count':'моделей: {n}',
+    'prov.status.ok':'Работает',
+    'prov.status.unknown':'Ещё не проверялся',
+    'prov.disabled':'выключен',
+    'prov.type.anthropic':'Anthropic API',
+    'prov.type.anthropic-compatible':'Anthropic-совместимый (/v1/messages)',
+    'prov.type.openai-compatible':'OpenAI-совместимый (/chat/completions)',
+    'prov.type.claude-subscription':'Вход Claude CLI (подписка)',
+    'prov.modal.add.title':'＋ Новый провайдер',
+    'prov.modal.edit.title':'Провайдер',
+    'prov.tab.main':'Основное',
+    'prov.tab.models':'Модели',
+    'prov.tab.roles':'Роли',
+    'prov.tab.adv':'Дополнительно',
+    'prov.f.preset':'Шаблон',
+    'prov.f.preset.ph':'Выберите шаблон…',
+    'prov.f.label':'Название',
+    'prov.f.id':'Идентификатор',
+    'prov.f.id.hint':'Часть каждой ссылки на модель («id::модель»). После создания не меняется.',
+    'prov.f.type':'Тип API',
+    'prov.f.url':'Базовый адрес',
+    'prov.f.url.ph':'https://…',
+    'prov.f.url.hint.oai':'Обычно заканчивается на /v1 — к нему добавляется /chat/completions.',
+    'prov.f.url.hint.anth':'Без /v1/messages — его добавляет CLI.',
+    'prov.f.key':'API-ключ',
+    'prov.f.key.keep':'Оставьте пустым, чтобы сохранить текущий ключ',
+    'prov.f.key.clear':'Удалить сохранённый ключ',
+    'prov.f.key.hint':'Хранится зашифрованным и не попадает ни в браузер, ни в окружение агента.',
+    'prov.f.auth':'Заголовок авторизации',
+    'prov.auth.bearer':'Authorization: Bearer',
+    'prov.auth.xapikey':'x-api-key',
+    'prov.auth.both':'Оба заголовка',
+    'prov.f.dialect':'Диалект',
+    'prov.f.dialect.hint':'Как передавать этому провайдеру effort, рассуждения и лимит токенов.',
+    'prov.f.aliases':'Сервер сам обслуживает алиасы Claude (haiku/sonnet/opus/fable)',
+    'prov.f.enabled':'Включён',
+    'prov.f.headers':'Дополнительные заголовки',
+    'prov.f.headers.hint':'По одному в строке: Имя: значение',
+    'prov.f.timeout':'Тайм-аут тишины ответа, с',
+    'prov.f.concurrency':'Параллельных запросов',
+    'prov.f.stripBetas':'Не передавать заголовок anthropic-beta',
+    'prov.f.extra':'Дополнительное тело запроса (JSON)',
+    'prov.f.extra.hint':'Объединяется с каждым запросом — для переключателей, специфичных для провайдера.',
+    'prov.models.search':'Поиск модели…',
+    'prov.models.refresh':'Обновить каталог',
+    'prov.models.all_on':'Включить показанные',
+    'prov.models.all_off':'Выключить показанные',
+    'prov.models.add':'Добавить модель вручную',
+    'prov.models.add.ph':'id модели, напр. gpt-5',
+    'prov.models.empty':'Каталог пуст — добавьте модели вручную.',
+    'prov.models.save_first':'Сохраните провайдера, чтобы управлять его моделями.',
+    'prov.models.builtin':'Вход CLI предлагает алиасы Claude: Haiku, Sonnet, Opus, Fable.',
+    'prov.models.enabled_n':'Включено {on} из {all}',
+    'prov.models.more':'и ещё {n} — уточните поиск',
+    'prov.models.probe':'Проверить модель: вызов инструмента и короткий ответ',
+    'prov.models.caps':'Возможности и цена',
+    'prov.probe.res':'Инструменты {tools} · текст {text} · {ms} мс',
+    'prov.cap.tools':'инструменты',
+    'prov.cap.vision':'изображения',
+    'prov.cap.reasoning':'рассуждения',
+    'prov.cap.ctx':'контекст',
+    'prov.cap.out':'макс. ответ',
+    'prov.cap.price':'$ за 1M (вход / выход)',
+    'prov.roles.hint':'Какие модели CLI использует для своих фоновых вызовов и субагентов. Пусто — основная модель.',
+    'prov.role.main':'Основная (sonnet, fable)',
+    'prov.role.fast':'Быстрая (haiku, фоновые вызовы)',
+    'prov.role.strong':'Сильная (opus)',
+    'prov.role.subagent':'Субагенты (Task)',
+    'prov.role.none':'— основная модель —',
+    'prov.cancel':'Отмена',
+    'prov.create':'Добавить',
+    'prov.save':'Сохранить',
+    'prov.saved':'Сохранено',
+    'prov.test.ok':'Соединение работает · моделей в каталоге: {n}',
+    'prov.test.nocat':'Соединение работает · каталог моделей не публикуется',
+    'prov.test.fail':'Не удалось: {err}',
+    'prov.err.fields':'Проверьте поля: {fields}',
+    'prov.err.exists':'Провайдер с таким идентификатором уже существует',
+    'prov.usage':'Расход за 30 дней (запросы · токены вх/вых · $)',
+    'prov.usage.none':'Пока нет запросов через мост.',
+    'prov.notice.provider_missing':'Провайдера модели «{ref}» больше нет — ответ идёт через провайдера по умолчанию.',
+    'prov.notice.provider_disabled':'Провайдер модели «{ref}» выключен — ответ идёт через провайдера по умолчанию.',
+    
+    'model.pick.change':'нажмите, чтобы сменить модель',
+    'model.pick.search':'Найти модель…',
+    'model.pick.empty':'Ничего не найдено',
+    'model.pick.manage':'⚙ Управлять провайдерами',
+    'model.pick.notools':'Без инструментов — не сможет читать и менять файлы',
+    
+    'effort.unsupported':'Эта модель не поддерживает рассуждения',
   },
   fr: {
     'dlg.model':'Modèle','dlg.effort':'Niveau de raisonnement','dlg.tuning.default':'Par défaut',
@@ -6024,9 +6516,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'cfg.reset.title':'Retirer la valeur du fichier pour que la valeur par défaut s’applique de nouveau',
     'cfg.reset.done':'Réinitialisé à la valeur par défaut',
     'cfg.saved_restart':'Enregistré — redémarrez le serveur pour appliquer',
-    'cfg.h.defaultEngine':'Moteur présélectionné pour les nouveaux chats et tâches : API (sans interface) ou Subscription (Claude Max).',
     'cfg.h.chatDefaults.mode':'Mode avec lequel un nouveau chat s\u2019ouvre. Un projet peut le surcharger avec le bouton \u2605 de la barre d\u2019outils.','cfg.h.chatDefaults.agent':'Mode agent d\u2019un nouveau chat : single, multi, dispatch ou conversation.','cfg.h.chatDefaults.model':'Modèle présélectionné pour un nouveau chat.','cfg.h.chatDefaults.effort':'Niveau de réflexion d\u2019un nouveau chat ; auto n\u2019envoie aucun indicateur --effort.','cfg.h.chatDefaults.turns':'Limite de tours d\u2019un nouveau chat (1\u2013200).',
-    'cfg.h.ANTHROPIC_BASE_URL':'Fait passer les requêtes du CLI Claude par un proxy ou une passerelle au lieu d’Anthropic directement.',
+    'cfg.h.ANTHROPIC_BASE_URL':'La passerelle à partir de laquelle le fournisseur par défaut est créé au premier démarrage (voir Fournisseurs). Tant qu’il n’est pas modifié dans l’interface, il suit cette valeur après un redémarrage.',
     'cfg.h.ANTHROPIC_API_KEY':'Clé API du moteur API lorsque le CLI claude n’est pas connecté.',
     'cfg.h.ANTHROPIC_AUTH_TOKEN':'Jeton du proxy défini dans ANTHROPIC_BASE_URL.',
     'cfg.h.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS':'Supprime les en-têtes bêta expérimentaux qui cassent les backends non Anthropic.',
@@ -6074,11 +6565,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     "newtab.title":"Que voulez-vous ouvrir ?","newtab.chat":"Chat","newtab.chat.desc":"Une conversation ordinaire. Appelez les bots avec @@","newtab.term":"Agent terminal","newtab.term.desc":"Le terminal vivant d'un agent CLI dans un onglet. Choisissez :","newtab.or":"ou","term.tab":"terminal",
     "stream.gap":"Une partie de l'activité n'a pas été affichée — la connexion a été interrompue. La réponse elle-même est complète.",
     "agent.cap.delegate":"délégation","agent.cap.terminal":"terminal",
-    "bots.empty.what":"Un bot est un participant nommé du chat, avec son propre prompt, son modèle et sa mémoire.","bots.empty.how":"Créez un bot puis appelez-le dans un message :","bots.empty.cta":"Créer votre premier bot","bot.tpl.replace":"Remplacer ce qui est déjà écrit dans le prompt ?","bot.tpl.analyst.name":"Analyste","bot.tpl.analyst.desc":"analyse de données et conclusions","bot.tpl.analyst.prompt":"Tu es analyste. Tu examines les données et donnes des conclusions sur lesquelles on peut s'appuyer.\n\nRègles :\n- Les chiffres d'abord, l'interprétation ensuite.\n- Chaque conclusion nomme la source sur laquelle elle repose.\n- Si les données sont insuffisantes, dis précisément ce qui manque.\n- Pas de remplissage : paragraphes courts, points clés en liste.","bot.tpl.writer.name":"Rédacteur","bot.tpl.writer.desc":"textes et rapports","bot.tpl.writer.prompt":"Tu es rédacteur. Tu transformes brouillons et données en un texte qu'on a envie de lire.\n\nRègles :\n- Écris pour un lecteur, pas pour la forme.\n- Structure : titre, l'essentiel dans le premier paragraphe, les détails ensuite.\n- N'invente rien. Si un fait ne figure pas dans la source, demande-le.\n- Supprime le jargon et les répétitions.","bot.tpl.reviewer.name":"Relecteur","bot.tpl.reviewer.desc":"revue du code et des décisions","bot.tpl.reviewer.prompt":"Tu es relecteur. Tu cherches où la solution casse, pas où elle est élégante.\n\nRègles :\n- Chaque constat : ce qui casse, avec quelles entrées, fichier et ligne à l'appui.\n- Distingue « c'est un bug » de « je l'aurais fait autrement ».\n- Si tu n'es pas sûr, dis que c'est une hypothèse.\n- Le plus grave en premier.","bot.tpl.explainer.name":"Vulgarisateur","bot.tpl.explainer.desc":"rend le complexe clair","bot.tpl.explainer.prompt":"Tu expliques les choses difficiles en langage simple.\n\nRègles :\n- Une phrase pour l'essentiel, puis le détail.\n- Un exemple vaut mieux qu'une définition.\n- Explique un terme dès sa première apparition.\n- Ne simplifie pas jusqu'à l'erreur : si une nuance compte, nomme-la.",
+    "bots.empty.what":"Un bot est un participant nommé du chat, avec son propre prompt, son modèle et sa mémoire.","bots.empty.how":"Créez un bot puis appelez-le dans un message :","bots.empty.cta":"Créer votre premier bot",
     "bot.state.queued":"en attente","bot.state.running":"en cours","bot.state.done":"terminé","bot.state.failed":"échec","bot.state.stopped":"arrêté","bot.state.skipped":"ignoré","bot.stop.all":"Arrêter",
     "at.no_bots":"Aucun bot trouvé",
     "bot.modal.mcp.label":"Serveurs MCP","bot.modal.mcp.hint":"Outils que ce bot reçoit en plus de ceux activés pour le chat. Réservez la recherche web aux bots qui lisent, pas à ceux qui exécutent aussi des commandes ou modifient des fichiers.","bot.modal.mcp.none":"Aucun serveur MCP configuré.",
-    "sec.bots":"Bots","bots.hint":"Participants de ce projet. Mentionnez un bot avec @@ dans un message.","bot.add.new":"Créer un bot","bot.add.btn":"Créer","bot.use.title":"Insérer la mention","bot.modal.add.title":"Nouveau bot","bot.modal.edit.title":"Modifier le bot","bot.modal.label.label":"Nom","bot.modal.handle.hint":"Adressé dans le chat comme :","bot.modal.avatar.label":"Émoji","bot.modal.desc.label":"Rôle","bot.modal.desc.hint":"Une ligne. Les autres bots la voient pour savoir à qui passer le travail.","bot.modal.model.label":"Modèle","bot.model.inherit":"Comme le chat","bot.model.group.gateway":"Passerelle (API)","bot.model.no_tools":"sans outils","bot.modal.model.hint":"Haiku, Sonnet, Opus, Fable, comme dans la barre d'un nouveau chat. Sur l'abonnement ce sont des alias de Claude CLI ; sur l'API, ce que la passerelle en fait.","bot.model.gateway.ph":"Autre modèle de la passerelle…","bot.modal.tools.label":"Fichiers pendant une discussion","bot.tools.default":"Par défaut","bot.tools.read":"Lecture","bot.tools.run":"Lecture + commandes","bot.tools.work":"Lecture + écriture","bot.modal.tools.hint":"Ce que ce bot peut faire des fichiers pendant qu'il participe à une salle. Par défaut : lecture et écriture. Sur une carte Kanban et quand vous l'appelez avec @@, il a un accès complet. Sur le moteur Abonnement, c'est une demande dans l'invite, pas un verrou.","bot.modal.engine.label":"Moteur","bot.engine.inherit":"Comme le chat","bot.engine.api":"API","bot.engine.subscription":"Abonnement Claude","bot.modal.engine.hint":"Ne s'applique qu'à ce bot, même si le chat tourne sur l'autre moteur. L'abonnement exige une connexion Claude sur le serveur et tmux.","bot.modal.prompt.label":"Invite système","bot.modal.prompt.hint":"Qui est ce bot et comment il travaille. Jusqu'à 8000 caractères.","bot.err.label":"Donnez un nom au bot","bot.del.confirm":"Supprimer le bot","bot.del.note":"Ses anciens messages restent, et son identifiant ne sera jamais repris par un autre bot.","bot.deleted":"bot supprimé","toast.bot_added":"✓ Bot créé","toast.bot_updated":"✓ Bot mis à jour","toast.bot_deleted":"✓ Bot supprimé","bot.modal.global.label":"Disponible dans tous les projets","bot.modal.global.hint":"Un rôle comme celui de programmeur est utile partout. Activez cette option et le bot apparaît dans chaque projet sans y être ajouté un par un.","bot.modal.also_in":"Aussi dans les projets :","bot.modal.delete":"Supprimer le bot","bot.global.badge":"Disponible dans tous les projets","bot.unlink.title":"Retirer de ce projet","bot.unlink.confirm":"Retirer de ce projet","bot.unlink.note":"Le bot reste dans les autres projets et conserve tous ses messages.","bot.del.everywhere":"Il est disponible dans tous les projets et disparaîtra de partout.","bot.del.in_n":"Il est disponible dans {n} projets et disparaîtra de tous.","toast.bot_unlinked":"✓ Retiré du projet","bots.import.title":"Importer des bots depuis un fichier JSON","bots.export.title":"Exporter les bots vers un fichier JSON","bots.import.conflict":"{n} de ces identifiants existent déjà ici. Les écraser avec le fichier ? Les modifications locales de ces bots seront perdues.","toast.bots_imported":"✓ {n} bots importés, {s} ignorés","toast.bots_import_err":"Import impossible : ","toast.bots_import_parse":"Ce fichier n'est pas du JSON valide","toast.bots_import_empty":"Aucun bot dans ce fichier","toast.bots_import_reserved":"{n} identifiant(s) ignoré(s), appartenant à des bots supprimés ({list}) — ils sont réservés définitivement","toast.bots_export_err":"Export des bots impossible","toast.bots_export_empty":"Rien à exporter","at.group.bots":"Bots","at.group.files":"Fichiers",
+    "sec.bots":"Bots","bots.hint":"Participants de ce projet. Mentionnez un bot avec @@ dans un message.","bot.add.new":"Créer un bot","bot.add.btn":"Créer","bot.use.title":"Insérer la mention","bot.modal.add.title":"Nouveau bot","bot.modal.edit.title":"Modifier le bot","bot.modal.label.label":"Nom","bot.modal.handle.hint":"Adressé dans le chat comme :","bot.modal.avatar.label":"Émoji","bot.modal.desc.label":"Rôle","bot.modal.desc.hint":"Une ligne. Les autres bots la voient pour savoir à qui passer le travail.","bot.modal.model.label":"Modèle","bot.model.inherit":"Comme le chat",'bot.modal.model.hint':'« Comme le chat » suit le chat où le bot répond. Un modèle d’un fournisseur marqué « abonnement » tourne sur l’abonnement Claude, tout autre via l’API de son fournisseur.',"bot.modal.tools.label":"Fichiers pendant une discussion","bot.tools.default":"Par défaut","bot.tools.read":"Lecture","bot.tools.run":"Lecture + commandes","bot.tools.work":"Lecture + écriture","bot.modal.tools.hint":"Ce que ce bot peut faire des fichiers pendant qu'il participe à une salle. Par défaut : lecture et écriture. Sur une carte Kanban et quand vous l'appelez avec @@, il a un accès complet. Pour un modèle sur abonnement, c'est une demande dans l'invite, pas un verrou.","bot.modal.prompt.label":"Invite système","bot.modal.prompt.hint":"Qui est ce bot et comment il travaille. Jusqu'à 8000 caractères.","bot.err.label":"Donnez un nom au bot","bot.del.confirm":"Supprimer le bot","bot.del.note":"Ses anciens messages restent, et son identifiant ne sera jamais repris par un autre bot.","bot.deleted":"bot supprimé","toast.bot_added":"✓ Bot créé","toast.bot_updated":"✓ Bot mis à jour","toast.bot_deleted":"✓ Bot supprimé","bot.modal.global.label":"Disponible dans tous les projets","bot.modal.global.hint":"Un rôle comme celui de programmeur est utile partout. Activez cette option et le bot apparaît dans chaque projet sans y être ajouté un par un.","bot.modal.also_in":"Aussi dans les projets :","bot.modal.delete":"Supprimer le bot","bot.global.badge":"Disponible dans tous les projets","bot.unlink.title":"Retirer de ce projet","bot.unlink.confirm":"Retirer de ce projet","bot.unlink.note":"Le bot reste dans les autres projets et conserve tous ses messages.","bot.del.everywhere":"Il est disponible dans tous les projets et disparaîtra de partout.","bot.del.in_n":"Il est disponible dans {n} projets et disparaîtra de tous.","toast.bot_unlinked":"✓ Retiré du projet","bots.import.title":"Importer des bots depuis un fichier JSON","bots.export.title":"Exporter les bots vers un fichier JSON","bots.import.conflict":"{n} de ces identifiants existent déjà ici. Les écraser avec le fichier ? Les modifications locales de ces bots seront perdues.","toast.bots_imported":"✓ {n} bots importés, {s} ignorés","toast.bots_import_err":"Import impossible : ","toast.bots_import_parse":"Ce fichier n'est pas du JSON valide","toast.bots_import_empty":"Aucun bot dans ce fichier","toast.bots_import_reserved":"{n} identifiant(s) ignoré(s), appartenant à des bots supprimés ({list}) — ils sont réservés définitivement","toast.bots_export_err":"Export des bots impossible","toast.bots_export_empty":"Rien à exporter","at.group.bots":"Bots","at.group.files":"Fichiers",
     "term.open.title":"Ouvrir le terminal","term.kill":"Terminer","term.killConfirm":"Terminer cette session terminal ? La conversation pourra être reprise plus tard.","term.unavailable":"Sessions terminal indisponibles","term.state.attached":"connecté","term.state.started":"démarré","term.state.restored":"restauré","term.state.restoredLast":"dernière conversation de l'agent restaurée","term.state.restoreFailed":"rien à reprendre — nouveau départ","term.state.exited":"agent terminé","term.state.error":"erreur","term.state.disconnected":"connexion perdue — reconnexion…","term.state.reconnecting":"reconnexion…","term.paste.title":"Coller dans le terminal","term.paste.notarget":"Aucun terminal ouvert où coller","term.paste.notconnected":"Le terminal n'est pas connecté","term.paste.done":"Collé dans le terminal","term.refresh.title":"Reconnecter ce terminal","term.send.ph":"Envoyer une ligne au terminal…","term.send.title":"Envoyer (Entrée)",
     "agent.modal.newIdCommand.label":"Commande de nouvelle conversation","agent.modal.newIdCommand.hint":"Alternative à l'indicateur : une commande qui crée une conversation et affiche son id. Exécutée une fois à la création de la session.",
     "agent.modal.interactive.label":"Commande interactive","agent.modal.interactive.hint":"Lance le TUI de l'agent pour une session terminal. Vide — agent de délégation uniquement.","agent.modal.resume.label":"Commande de reprise","agent.modal.resume.hint":"{sid} — identifiant de la conversation. Sert à restaurer la session après un redémarrage.","agent.modal.resumeLast.label":"Reprendre la dernière (repli)","agent.modal.resumeLast.hint":"Utilisée quand aucun identifiant n'est connu. Peut restaurer une autre conversation.","agent.modal.newIdFlag.label":"Indicateur d'id de nouvelle conversation","agent.modal.newIdFlag.hint":"Si la CLI accepte l'id d'une NOUVELLE conversation, la restauration devient exacte. Vide si non pris en charge.",
@@ -6251,12 +6742,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     "model.opus.tip":"Opus — le modèle le plus performant ; à choisir pour les tâches complexes où la profondeur de raisonnement prime sur la vitesse ou le coût.",
     "model.fable.tip":"Fable — le modèle le plus créatif et le plus profond en raisonnement (contexte de 1M jetons, comme Sonnet/Opus) ; à choisir pour la planification complexe et l'analyse approfondie.",
     "turns.tip":"Nombre maximal d'étapes que Claude peut effectuer en une exécution. À la limite, Claude poursuit automatiquement la session jusqu'à 3 fois (« Continue where you left off ») — l'usage réel peut atteindre ~4x ce nombre avant qu'une notice d'exécution incomplète n'apparaisse. Plage 1-200.",
-    "tb.engine":"Moteur","engine.sub":"Abonnement",
-    "engine.api.title":"Moteur API — claude -p sans interface, facturé au jeton (Claude Pro / clé API)",
-    "engine.sub.title":"Moteur d'abonnement — session tmux persistante, facturée sur l'abonnement Claude Max (sans crédits API). Nécessite tmux et Claude Max.",
-    "engine.default.btn":"★ Définir par défaut","engine.default.title":"Définir le moteur actuel comme moteur par défaut des nouvelles discussions",
-    "engine.default.set":"Définir le moteur actuel ({engine}) comme moteur par défaut des nouvelles discussions","engine.default.is":"{engine} — moteur par défaut des nouvelles discussions",
-    "engine.default.toast":"★ {engine} — moteur par défaut des nouvelles discussions","engine.default.err":"⚠ Impossible d'enregistrer le moteur par défaut",
+    
+    
+    
     "tb.effort":"Effort","effort.title":"Niveau de réflexion (claude --effort) : Auto = valeur par défaut du CLI, les niveaux supérieurs raisonnent plus en profondeur",
     "effort.auto":"Auto","effort.low":"Faible","effort.med":"Moyen","effort.high":"Élevé","effort.xhigh":"Très élevé","effort.max":"Maximal",
     "tb.defaults":"Par défaut","defaults.pin.title":"Enregistrer les valeurs Mode / Agent / Modèle / Effort / Tours actuelles comme valeurs par défaut de ce projet","defaults.reset.title":"Supprimer les surcharges de ce projet et hériter des valeurs par défaut globales","defaults.noproject":"Ouvrez d\u2019abord un projet","defaults.pinned":"Valeurs par défaut du projet enregistrées","defaults.reset.done":"Le projet hérite des valeurs par défaut globales",
@@ -6285,6 +6773,114 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     "input.ph.mob":"Écrivez une tâche…",
     "skillcat.engineering":"⚙️ Ingénierie","skillcat.ai":"🧠 IA et prompts","skillcat.quality":"💎 Qualité du code","skillcat.security":"🔒 Sécurité","skillcat.design":"🎨 Design","skillcat.product":"📋 Produit","skillcat.finance":"💼 Finance","skillcat.research":"🔬 Recherche","skillcat.workflow":"📐 Flux de travail","skillcat.system":"⚙️ Système","skillcat.plugin":"🧩 Compétences des plugins",
     "upd.available":"Mise à jour disponible","upd.btn":"Mettre à jour","upd.updating":"Mise à jour… {time}","upd.copy_cmd":"Copier la commande","upd.via_terminal":"Mise à jour via le terminal :","upd.copied":"Copié ✓","upd.retry":"Réessayer","upd.failed":"Échec de la mise à jour","upd.new_version":"Nouvelle version {version} disponible",
+    /* providers & model picker (providers.js) */
+    'sec.providers':'Fournisseurs',
+    'prov.add':'＋ Ajouter un fournisseur',
+    'prov.hint':'D’où viennent les modèles. Un modèle de n’importe quel fournisseur se choisit dans les discussions, les bots, les tâches et les planifications.',
+    'prov.bridge.down':'Le pont LLM ne tourne pas : les fournisseurs compatibles OpenAI sont indisponibles',
+    'prov.utility':'Modèle utilitaire',
+    'prov.utility.hint':'Titres des discussions, choix des compétences, compactage de l’historique, traduction.',
+    'prov.utility.default':'haiku sur le fournisseur par défaut',
+    'prov.builtin.claude':'Claude (connexion CLI)',
+    'prov.mode.subscription':'abonnement','prov.mode.api':'API',
+    'prov.mode.subscription.tip':'Connexion Claude CLI : une session tmux persistante répond, facturée sur l’abonnement Claude. Sans tmux, elle tourne en headless avec la même connexion.',
+    'prov.mode.api.tip':'Les requêtes utilisent la clé API du fournisseur (claude -p headless), facturées au token.',
+    'prov.default':'par défaut',
+    'prov.make_default':'Définir comme fournisseur par défaut',
+    'prov.test':'Tester',
+    'prov.edit':'Modifier',
+    'prov.del':'Supprimer',
+    'prov.del.confirm':'Supprimer le fournisseur « {name} » ? Les discussions qui l’utilisent passeront au fournisseur par défaut.',
+    'prov.models.count':'modèles : {n}',
+    'prov.status.ok':'Fonctionne',
+    'prov.status.unknown':'Pas encore testé',
+    'prov.disabled':'désactivé',
+    'prov.type.anthropic':'API Anthropic',
+    'prov.type.anthropic-compatible':'Compatible Anthropic (/v1/messages)',
+    'prov.type.openai-compatible':'Compatible OpenAI (/chat/completions)',
+    'prov.type.claude-subscription':'Connexion Claude CLI (abonnement)',
+    'prov.modal.add.title':'＋ Nouveau fournisseur',
+    'prov.modal.edit.title':'Fournisseur',
+    'prov.tab.main':'Général',
+    'prov.tab.models':'Modèles',
+    'prov.tab.roles':'Rôles',
+    'prov.tab.adv':'Avancé',
+    'prov.f.preset':'Modèle prérempli',
+    'prov.f.preset.ph':'Choisir un modèle prérempli…',
+    'prov.f.label':'Nom',
+    'prov.f.id':'Identifiant',
+    'prov.f.id.hint':'Fait partie de chaque référence de modèle (« id::modèle »). Non modifiable ensuite.',
+    'prov.f.type':'Type d’API',
+    'prov.f.url':'URL de base',
+    'prov.f.url.ph':'https://…',
+    'prov.f.url.hint.oai':'Se termine généralement par /v1 — /chat/completions y est ajouté.',
+    'prov.f.url.hint.anth':'Sans /v1/messages — le CLI l’ajoute.',
+    'prov.f.key':'Clé API',
+    'prov.f.key.keep':'Laisser vide pour conserver la clé enregistrée',
+    'prov.f.key.clear':'Supprimer la clé enregistrée',
+    'prov.f.key.hint':'Stockée chiffrée ; elle n’atteint jamais le navigateur ni l’environnement de l’agent.',
+    'prov.f.auth':'En-tête d’authentification',
+    'prov.auth.bearer':'Authorization: Bearer',
+    'prov.auth.xapikey':'x-api-key',
+    'prov.auth.both':'Les deux en-têtes',
+    'prov.f.dialect':'Dialecte',
+    'prov.f.dialect.hint':'Comment transmettre à ce fournisseur l’effort, le raisonnement et la limite de jetons.',
+    'prov.f.aliases':'Le serveur gère lui-même les alias Claude (haiku/sonnet/opus/fable)',
+    'prov.f.enabled':'Activé',
+    'prov.f.headers':'En-têtes supplémentaires',
+    'prov.f.headers.hint':'Un par ligne : Nom : valeur',
+    'prov.f.timeout':'Délai de silence de la réponse, s',
+    'prov.f.concurrency':'Requêtes parallèles',
+    'prov.f.stripBetas':'Ne pas transmettre l’en-tête anthropic-beta',
+    'prov.f.extra':'Corps de requête supplémentaire (JSON)',
+    'prov.f.extra.hint':'Fusionné dans chaque requête — pour les options propres au fournisseur.',
+    'prov.models.search':'Rechercher un modèle…',
+    'prov.models.refresh':'Actualiser le catalogue',
+    'prov.models.all_on':'Activer les affichés',
+    'prov.models.all_off':'Désactiver les affichés',
+    'prov.models.add':'Ajouter un modèle par id',
+    'prov.models.add.ph':'id du modèle, ex. gpt-5',
+    'prov.models.empty':'Catalogue vide — ajoutez des modèles par id.',
+    'prov.models.save_first':'Enregistrez le fournisseur pour gérer ses modèles.',
+    'prov.models.builtin':'La connexion CLI propose les alias Claude : Haiku, Sonnet, Opus, Fable.',
+    'prov.models.enabled_n':'{on} sur {all} activés',
+    'prov.models.more':'et {n} de plus — affinez la recherche',
+    'prov.models.probe':'Tester le modèle : un appel d’outil et une réponse courte',
+    'prov.models.caps':'Capacités et prix',
+    'prov.probe.res':'Outils {tools} · texte {text} · {ms} ms',
+    'prov.cap.tools':'outils',
+    'prov.cap.vision':'images',
+    'prov.cap.reasoning':'raisonnement',
+    'prov.cap.ctx':'contexte',
+    'prov.cap.out':'sortie max',
+    'prov.cap.price':'$ par 1M (entrée / sortie)',
+    'prov.roles.hint':'Modèles utilisés par le CLI pour ses appels d’arrière-plan et ses sous-agents. Vide = le modèle principal.',
+    'prov.role.main':'Principal (sonnet, fable)',
+    'prov.role.fast':'Rapide (haiku, appels d’arrière-plan)',
+    'prov.role.strong':'Puissant (opus)',
+    'prov.role.subagent':'Sous-agents (Task)',
+    'prov.role.none':'— le modèle principal —',
+    'prov.cancel':'Annuler',
+    'prov.create':'Ajouter',
+    'prov.save':'Enregistrer',
+    'prov.saved':'Enregistré',
+    'prov.test.ok':'La connexion fonctionne · modèles au catalogue : {n}',
+    'prov.test.nocat':'La connexion fonctionne · aucun catalogue de modèles publié',
+    'prov.test.fail':'Échec : {err}',
+    'prov.err.fields':'Vérifiez les champs : {fields}',
+    'prov.err.exists':'Un fournisseur avec cet identifiant existe déjà',
+    'prov.usage':'Consommation sur 30 jours (requêtes · jetons entrée/sortie · $)',
+    'prov.usage.none':'Aucune requête via le pont pour l’instant.',
+    'prov.notice.provider_missing':'Le fournisseur de « {ref} » n’existe plus — exécution sur le fournisseur par défaut.',
+    'prov.notice.provider_disabled':'Le fournisseur de « {ref} » est désactivé — exécution sur le fournisseur par défaut.',
+    
+    'model.pick.change':'cliquez pour changer de modèle',
+    'model.pick.search':'Trouver un modèle…',
+    'model.pick.empty':'Rien trouvé',
+    'model.pick.manage':'⚙ Gérer les fournisseurs',
+    'model.pick.notools':'Sans outils — ne peut ni lire ni modifier les fichiers',
+    
+    'effort.unsupported':'Ce modèle ne raisonne pas',
   },
   he: {
     'dlg.model':'מודל','dlg.effort':'רמת חשיבה','dlg.tuning.default':'ברירת מחדל',
@@ -6328,9 +6924,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     'cfg.reset.title':'הסרת הערך מהקובץ כדי שברירת המחדל תחול שוב',
     'cfg.reset.done':'אופס לברירת המחדל',
     'cfg.saved_restart':'נשמר — הפעילו מחדש את השרת כדי להחיל',
-    'cfg.h.defaultEngine':'המנוע שנבחר מראש עבור צ׳אטים ומשימות חדשים: API (ללא ממשק) או Subscription‏ (Claude Max).',
     'cfg.h.chatDefaults.mode':'המצב שבו נפתח צ׳אט חדש. פרויקט יכול לקבוע ערך משלו בעזרת הכפתור ★ בסרגל הכלים.','cfg.h.chatDefaults.agent':'מצב הסוכן לצ׳אט חדש: single, multi, dispatch או conversation.','cfg.h.chatDefaults.model':'המודל שנבחר מראש לצ׳אט חדש.','cfg.h.chatDefaults.effort':'רמת החשיבה לצ׳אט חדש; auto פירושו שלא נשלח דגל ‎--effort‎.','cfg.h.chatDefaults.turns':'מגבלת הצעדים לצ׳אט חדש (1–200).',
-    'cfg.h.ANTHROPIC_BASE_URL':'מנתב את בקשות ה-CLI של Claude דרך פרוקסי או שער במקום ישירות ל-Anthropic.',
+    'cfg.h.ANTHROPIC_BASE_URL':'השער שממנו נוצר ספק ברירת המחדל בהפעלה הראשונה (ראה ספקים). כל עוד הספק לא נערך בממשק, הוא עוקב אחרי הערך הזה אחרי הפעלה מחדש.',
     'cfg.h.ANTHROPIC_API_KEY':'מפתח API עבור מנוע ה-API כאשר ה-CLI של claude אינו מחובר.',
     'cfg.h.ANTHROPIC_AUTH_TOKEN':'אסימון עבור הפרוקסי שהוגדר ב-ANTHROPIC_BASE_URL.',
     'cfg.h.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS':'מסיר כותרות בטא ניסיוניות ששוברות שרתי קצה שאינם של Anthropic.',
@@ -6378,11 +6973,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     "newtab.title":"מה לפתוח?","newtab.chat":"צ׳אט","newtab.chat.desc":"שיחה רגילה. קראו לבוטים עם @@","newtab.term":"סוכן טרמינל","newtab.term.desc":"טרמינל חי של סוכן CLI בלשונית. בחרו את מי:","newtab.or":"או","term.tab":"טרמינל",
     "stream.gap":"חלק מהפעילות לא הוצג — החיבור נותק. התשובה עצמה מלאה.",
     "agent.cap.delegate":"האצלה","agent.cap.terminal":"טרמינל",
-    "bots.empty.what":"בוט הוא משתתף בעל שם בצ׳אט, עם הנחיה, מודל וזיכרון משלו.","bots.empty.how":"צרו בוט ואז קראו לו בהודעה:","bots.empty.cta":"צרו את הבוט הראשון","bot.tpl.replace":"להחליף את מה שכבר כתוב בהנחיה?","bot.tpl.analyst.name":"אנליסט","bot.tpl.analyst.desc":"ניתוח נתונים ומסקנות","bot.tpl.analyst.prompt":"אתה אנליסט. אתה מנתח נתונים ונותן מסקנות שאפשר להישען עליהן.\n\nכללים:\n- קודם המספרים, אחר כך הפרשנות.\n- כל מסקנה מציינת את המקור שעליו היא נשענת.\n- אם הנתונים אינם מספיקים, אמור בדיוק מה חסר.\n- בלי מילוי מיותר: פסקאות קצרות, עיקרי הדברים ברשימה.","bot.tpl.writer.name":"עורך","bot.tpl.writer.desc":"טקסטים ודוחות","bot.tpl.writer.prompt":"אתה עורך. אתה הופך טיוטות ונתונים לטקסט שנעים לקרוא.\n\nכללים:\n- כתוב עבור קורא, לא לפרוטוקול.\n- מבנה: כותרת, העיקר בפסקה הראשונה, הפרטים מתחת.\n- אל תמציא עובדות. מה שאינו במקור — בקש.\n- הסר ז׳רגון וחזרות.","bot.tpl.reviewer.name":"סוקר","bot.tpl.reviewer.desc":"סקירת קוד והחלטות","bot.tpl.reviewer.prompt":"אתה סוקר. אתה מחפש היכן הפתרון נשבר, לא היכן הוא יפה.\n\nכללים:\n- כל ממצא: מה נשבר, באילו קלטים, עם קובץ ושורה.\n- הפרד בין ״זה באג״ ל״הייתי עושה אחרת״.\n- אם אינך בטוח, אמור שזו השערה.\n- החמור ביותר ראשון.","bot.tpl.explainer.name":"מסביר","bot.tpl.explainer.desc":"הופך מסובך לברור","bot.tpl.explainer.prompt":"אתה מסביר דברים מורכבים בשפה פשוטה.\n\nכללים:\n- משפט אחד של העיקר, ואז הפירוט.\n- דוגמה עדיפה על הגדרה.\n- פרש מונח בהופעתו הראשונה.\n- אל תפשט עד כדי טעות: אם יש סייג חשוב, ציין אותו.",
+    "bots.empty.what":"בוט הוא משתתף בעל שם בצ׳אט, עם הנחיה, מודל וזיכרון משלו.","bots.empty.how":"צרו בוט ואז קראו לו בהודעה:","bots.empty.cta":"צרו את הבוט הראשון",
     "bot.state.queued":"בתור","bot.state.running":"עובד","bot.state.done":"הושלם","bot.state.failed":"נכשל","bot.state.stopped":"נעצר","bot.state.skipped":"דולג","bot.stop.all":"עצור",
     "at.no_bots":"לא נמצאו בוטים",
     "bot.modal.mcp.label":"שרתי MCP","bot.modal.mcp.hint":"כלים שהבוט מקבל בנוסף לאלה שהופעלו לצ׳אט. כדאי לתת חיפוש ברשת רק לבוטים שקוראים, לא לאלה שגם מריצים פקודות או עורכים קבצים.","bot.modal.mcp.none":"לא הוגדרו שרתי MCP.",
-    "sec.bots":"בוטים","bots.hint":"משתתפים בפרויקט הזה. אזכרו בוט עם @@ בהודעה.","bot.add.new":"צור בוט","bot.add.btn":"צור","bot.use.title":"הוסף אזכור","bot.modal.add.title":"בוט חדש","bot.modal.edit.title":"עריכת בוט","bot.modal.label.label":"שם","bot.modal.handle.hint":"פנייה בצ׳אט:","bot.modal.avatar.label":"אמוג׳י","bot.modal.desc.label":"ייעוד","bot.modal.desc.hint":"שורה אחת. בוטים אחרים רואים אותה כדי לדעת למי להעביר עבודה.","bot.modal.model.label":"מודל","bot.model.inherit":"כמו בצ׳אט","bot.model.group.gateway":"שער (API)","bot.model.no_tools":"ללא כלים","bot.modal.model.hint":"Haiku, Sonnet, Opus, Fable, כמו בסרגל של צ׳אט חדש. במנוי אלה כינויי Claude CLI; ב-API, מה שהשער ממפה אותם אליו.","bot.model.gateway.ph":"מודל אחר של השער…","bot.modal.tools.label":"קבצים בדיון","bot.tools.default":"ברירת מחדל","bot.tools.read":"קריאה","bot.tools.run":"קריאה + פקודות","bot.tools.work":"קריאה + כתיבה","bot.modal.tools.hint":"מה הבוט יכול לעשות בקבצים בזמן שהוא משתתף בחדר. ברירת מחדל: קריאה וכתיבה. בכרטיס Kanban וכשפונים אליו ב-@@ יש לו גישה מלאה. במנוע המנוי זו בקשה בפרומפט, לא נעילה.","bot.modal.engine.label":"מנוע","bot.engine.inherit":"כמו בצ׳אט","bot.engine.api":"API","bot.engine.subscription":"מנוי Claude","bot.modal.engine.hint":"חל על הבוט הזה בלבד, גם אם הצ׳אט רץ על המנוע השני. מנוי דורש התחברות ל-Claude בשרת ו-tmux.","bot.modal.prompt.label":"הנחיית מערכת","bot.modal.prompt.hint":"מי הבוט הזה ואיך הוא עובד. עד 8000 תווים.","bot.err.label":"תנו שם לבוט","bot.del.confirm":"למחוק בוט","bot.del.note":"ההודעות הקודמות שלו נשארות, והמזהה שלו לעולם לא יעבור לבוט אחר.","bot.deleted":"בוט שנמחק","toast.bot_added":"✓ הבוט נוצר","toast.bot_updated":"✓ הבוט עודכן","toast.bot_deleted":"✓ הבוט נמחק","bot.modal.global.label":"זמין בכל הפרויקטים","bot.modal.global.hint":"תפקיד כמו מתכנת נחוץ בכל מקום. הפעילו את האפשרות והבוט יופיע בכל פרויקט בלי להוסיף אותו לכל אחד בנפרד.","bot.modal.also_in":"גם בפרויקטים:","bot.modal.delete":"מחיקת הבוט","bot.global.badge":"זמין בכל הפרויקטים","bot.unlink.title":"הסרה מהפרויקט הזה","bot.unlink.confirm":"להסיר מהפרויקט הזה","bot.unlink.note":"הבוט יישאר בפרויקטים האחרים וכל ההודעות שלו נשמרות.","bot.del.everywhere":"הוא זמין בכל הפרויקטים וייעלם מכולם.","bot.del.in_n":"הוא זמין ב-{n} פרויקטים וייעלם מכולם.","toast.bot_unlinked":"✓ הוסר מהפרויקט","bots.import.title":"ייבוא בוטים מקובץ JSON","bots.export.title":"ייצוא בוטים לקובץ JSON","bots.import.conflict":"{n} מהשמות האלה כבר קיימים כאן. לדרוס אותם מהקובץ? שינויים מקומיים בבוטים האלה יאבדו.","toast.bots_imported":"✓ יובאו {n} בוטים, {s} דולגו","toast.bots_import_err":"הייבוא נכשל: ","toast.bots_import_parse":"הקובץ אינו JSON תקין","toast.bots_import_empty":"אין בוטים בקובץ הזה","toast.bots_import_reserved":"{n} שמות דולגו כי הם שייכים לבוטים שנמחקו ({list}) — הם שמורים לתמיד","toast.bots_export_err":"ייצוא הבוטים נכשל","toast.bots_export_empty":"אין מה לייצא","at.group.bots":"בוטים","at.group.files":"קבצים",
+    "sec.bots":"בוטים","bots.hint":"משתתפים בפרויקט הזה. אזכרו בוט עם @@ בהודעה.","bot.add.new":"צור בוט","bot.add.btn":"צור","bot.use.title":"הוסף אזכור","bot.modal.add.title":"בוט חדש","bot.modal.edit.title":"עריכת בוט","bot.modal.label.label":"שם","bot.modal.handle.hint":"פנייה בצ׳אט:","bot.modal.avatar.label":"אמוג׳י","bot.modal.desc.label":"ייעוד","bot.modal.desc.hint":"שורה אחת. בוטים אחרים רואים אותה כדי לדעת למי להעביר עבודה.","bot.modal.model.label":"מודל","bot.model.inherit":"כמו בצ׳אט",'bot.modal.model.hint':'"כמו בצ׳אט" — המודל של הצ׳אט שבו הבוט עונה. מודל של ספק המסומן "מנוי" רץ על מנוי Claude, כל השאר דרך ה-API של הספק שלו.',"bot.modal.tools.label":"קבצים בדיון","bot.tools.default":"ברירת מחדל","bot.tools.read":"קריאה","bot.tools.run":"קריאה + פקודות","bot.tools.work":"קריאה + כתיבה","bot.modal.tools.hint":"מה הבוט יכול לעשות בקבצים בזמן שהוא משתתף בחדר. ברירת מחדל: קריאה וכתיבה. בכרטיס Kanban וכשפונים אליו ב-@@ יש לו גישה מלאה. במודל של המנוי זו בקשה בפרומפט, לא נעילה.","bot.modal.prompt.label":"הנחיית מערכת","bot.modal.prompt.hint":"מי הבוט הזה ואיך הוא עובד. עד 8000 תווים.","bot.err.label":"תנו שם לבוט","bot.del.confirm":"למחוק בוט","bot.del.note":"ההודעות הקודמות שלו נשארות, והמזהה שלו לעולם לא יעבור לבוט אחר.","bot.deleted":"בוט שנמחק","toast.bot_added":"✓ הבוט נוצר","toast.bot_updated":"✓ הבוט עודכן","toast.bot_deleted":"✓ הבוט נמחק","bot.modal.global.label":"זמין בכל הפרויקטים","bot.modal.global.hint":"תפקיד כמו מתכנת נחוץ בכל מקום. הפעילו את האפשרות והבוט יופיע בכל פרויקט בלי להוסיף אותו לכל אחד בנפרד.","bot.modal.also_in":"גם בפרויקטים:","bot.modal.delete":"מחיקת הבוט","bot.global.badge":"זמין בכל הפרויקטים","bot.unlink.title":"הסרה מהפרויקט הזה","bot.unlink.confirm":"להסיר מהפרויקט הזה","bot.unlink.note":"הבוט יישאר בפרויקטים האחרים וכל ההודעות שלו נשמרות.","bot.del.everywhere":"הוא זמין בכל הפרויקטים וייעלם מכולם.","bot.del.in_n":"הוא זמין ב-{n} פרויקטים וייעלם מכולם.","toast.bot_unlinked":"✓ הוסר מהפרויקט","bots.import.title":"ייבוא בוטים מקובץ JSON","bots.export.title":"ייצוא בוטים לקובץ JSON","bots.import.conflict":"{n} מהשמות האלה כבר קיימים כאן. לדרוס אותם מהקובץ? שינויים מקומיים בבוטים האלה יאבדו.","toast.bots_imported":"✓ יובאו {n} בוטים, {s} דולגו","toast.bots_import_err":"הייבוא נכשל: ","toast.bots_import_parse":"הקובץ אינו JSON תקין","toast.bots_import_empty":"אין בוטים בקובץ הזה","toast.bots_import_reserved":"{n} שמות דולגו כי הם שייכים לבוטים שנמחקו ({list}) — הם שמורים לתמיד","toast.bots_export_err":"ייצוא הבוטים נכשל","toast.bots_export_empty":"אין מה לייצא","at.group.bots":"בוטים","at.group.files":"קבצים",
     "term.open.title":"פתח טרמינל","term.kill":"סיים","term.killConfirm":"לסיים את שיחת הטרמינל הזו? אפשר יהיה לשחזר אותה בהמשך.","term.unavailable":"שיחות טרמינל אינן זמינות","term.state.attached":"מחובר","term.state.started":"הופעל","term.state.restored":"שוחזר","term.state.restoredLast":"שוחזרה השיחה האחרונה של הסוכן","term.state.restoreFailed":"לא היה מה לשחזר — התחלה מחדש","term.state.exited":"הסוכן הסתיים","term.state.error":"שגיאה","term.state.disconnected":"החיבור אבד — מתחבר מחדש...","term.state.reconnecting":"מתחבר מחדש...","term.paste.title":"הדבק בטרמינל","term.paste.notarget":"אין טרמינל פתוח להדבקה","term.paste.notconnected":"הטרמינל אינו מחובר","term.paste.done":"הודבק בטרמינל","term.refresh.title":"חבר מחדש את הטרמינל","term.send.ph":"שלחו שורה לטרמינל…","term.send.title":"שליחה (Enter)",
     "agent.modal.newIdCommand.label":"פקודת יצירת שיחה","agent.modal.newIdCommand.hint":"חלופה לדגל: פקודה שיוצרת שיחה ומדפיסה את המזהה שלה. מורצת פעם אחת ביצירת השיחה.",
     "agent.modal.interactive.label":"פקודה אינטראקטיבית","agent.modal.interactive.hint":"מפעילה את ה-TUI של הסוכן עבור שיחת טרמינל. ריק — סוכן להאצלה בלבד.","agent.modal.resume.label":"פקודת שחזור","agent.modal.resume.hint":"{sid} — מזהה השיחה. משמש לשחזור השיחה לאחר הפעלה מחדש.","agent.modal.resumeLast.label":"שחזר אחרונה (גיבוי)","agent.modal.resumeLast.hint":"משמש כאשר המזהה אינו ידוע. עשוי לשחזר שיחה אחרת.","agent.modal.newIdFlag.label":"דגל מזהה לשיחה חדשה","agent.modal.newIdFlag.hint":"אם ה-CLI מאפשר לקבוע מזהה לשיחה חדשה, השחזור נעשה מדויק. ריק אם אינו נתמך.",
@@ -6528,12 +7123,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     "model.opus.tip":"Opus — המודל החזק ביותר; בחרו בו למשימות מורכבות שבהן עומק הניתוח חשוב יותר ממהירות או עלות.",
     "model.fable.tip":"Fable — המודל היצירתי ביותר ובעל היכולת ההסקתית העמוקה ביותר (חלון הקשר של 1M טוקנים, כמו Sonnet/Opus); בחרו בו לתכנון מורכב וניתוח מעמיק.",
     "turns.tip":"מספר הצעדים המרבי ש-Claude יכול לבצע בהרצה אחת. עם הגעה למגבלה, Claude ממשיך את הסשן אוטומטית עד 3 פעמים נוספות (\"Continue where you left off\") — השימוש בפועל עשוי להגיע לכ-4x מהמספר שהוגדר לפני שתופיע הודעה על הרצה לא-גמורה. טווח 1–200.",
-    "tb.engine":"מנוע","engine.sub":"מנוי",
-    "engine.api.title":"מנוע API — claude -p ללא ממשק, חיוב לפי טוקנים (Claude Pro / מפתח API)",
-    "engine.sub.title":"מנוע מנוי — סשן tmux קבוע, חיוב במסגרת מנוי Claude Max (ללא קרדיטים של API). דורש tmux ו-Claude Max.",
-    "engine.default.btn":"★ הגדרה כברירת מחדל","engine.default.title":"להגדיר את המנוע הנוכחי כברירת מחדל לצ׳אטים חדשים",
-    "engine.default.set":"להגדיר את המנוע הנוכחי ({engine}) כברירת מחדל לצ׳אטים חדשים","engine.default.is":"{engine} — מנוע ברירת המחדל לצ׳אטים חדשים",
-    "engine.default.toast":"★ {engine} — מנוע ברירת המחדל לצ׳אטים חדשים","engine.default.err":"⚠ שמירת מנוע ברירת המחדל נכשלה",
+    
+    
+    
     "tb.effort":"מאמץ","effort.title":"רמת החשיבה (claude --effort): אוטומטי = ברירת המחדל של ה-CLI, רמות גבוהות יותר = חשיבה מעמיקה יותר",
     "effort.auto":"אוטומטי","effort.low":"נמוך","effort.med":"בינוני","effort.high":"גבוה","effort.xhigh":"גבוה מאוד","effort.max":"מרבי",
     "tb.defaults":"ברירת מחדל","defaults.pin.title":"שמירת המצב / הסוכן / המודל / המאמץ / הצעדים הנוכחיים כברירת המחדל של הפרויקט הזה","defaults.reset.title":"הסרת ההגדרות הייעודיות של הפרויקט וירושת ברירות המחדל הגלובליות","defaults.noproject":"יש לפתוח פרויקט תחילה","defaults.pinned":"ברירות המחדל של הפרויקט נשמרו","defaults.reset.done":"הפרויקט יורש את ברירות המחדל הגלובליות",
@@ -6562,6 +7154,114 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     "input.ph.mob":"כתבו משימה...",
     "skillcat.engineering":"⚙️ הנדסה","skillcat.ai":"🧠 בינה מלאכותית ופרומפטים","skillcat.quality":"💎 איכות קוד","skillcat.security":"🔒 אבטחה","skillcat.design":"🎨 עיצוב","skillcat.product":"📋 מוצר","skillcat.finance":"💼 פיננסים","skillcat.research":"🔬 מחקר","skillcat.workflow":"📐 תהליכי עבודה","skillcat.system":"⚙️ מערכת","skillcat.plugin":"🧩 מיומנויות של תוספים",
     "upd.available":"עדכון זמין","upd.btn":"עדכון","upd.updating":"מעדכן… {time}","upd.copy_cmd":"העתקת הפקודה","upd.via_terminal":"עדכון דרך הטרמינל:","upd.copied":"הועתק ✓","upd.retry":"ניסיון נוסף","upd.failed":"העדכון נכשל","upd.new_version":"גרסה חדשה {version} זמינה",
+    /* providers & model picker (providers.js) */
+    'sec.providers':'ספקים',
+    'prov.add':'＋ הוסף ספק',
+    'prov.hint':'מאיפה מגיעים המודלים. אפשר לבחור מודל של כל ספק בצ׳אט, בבוטים, במשימות ובתזמונים.',
+    'prov.bridge.down':'גשר ה-LLM לא פועל: ספקים תואמי OpenAI אינם זמינים',
+    'prov.utility':'מודל שירות',
+    'prov.utility.hint':'כותרות צ׳אט, בחירת מיומנויות, דחיסת היסטוריה, תרגום.',
+    'prov.utility.default':'haiku בספק ברירת המחדל',
+    'prov.builtin.claude':'Claude (התחברות CLI)',
+    'prov.mode.subscription':'מנוי','prov.mode.api':'API',
+    'prov.mode.subscription.tip':'התחברות Claude CLI: סשן tmux קבוע עונה, החיוב על מנוי Claude. בלי tmux — headless עם אותה התחברות.',
+    'prov.mode.api.tip':'הבקשות נשלחות עם מפתח ה-API של הספק (claude -p headless), חיוב לפי טוקנים.',
+    'prov.default':'ברירת מחדל',
+    'prov.make_default':'הגדר כספק ברירת המחדל',
+    'prov.test':'בדוק',
+    'prov.edit':'ערוך',
+    'prov.del':'מחק',
+    'prov.del.confirm':'למחוק את הספק "{name}"? צ׳אטים שמשויכים אליו יעבדו עם ספק ברירת המחדל.',
+    'prov.models.count':'מודלים: {n}',
+    'prov.status.ok':'פועל',
+    'prov.status.unknown':'עדיין לא נבדק',
+    'prov.disabled':'מושבת',
+    'prov.type.anthropic':'Anthropic API',
+    'prov.type.anthropic-compatible':'תואם Anthropic (/v1/messages)',
+    'prov.type.openai-compatible':'תואם OpenAI (/chat/completions)',
+    'prov.type.claude-subscription':'התחברות Claude CLI (מנוי)',
+    'prov.modal.add.title':'＋ ספק חדש',
+    'prov.modal.edit.title':'ספק',
+    'prov.tab.main':'כללי',
+    'prov.tab.models':'מודלים',
+    'prov.tab.roles':'תפקידים',
+    'prov.tab.adv':'מתקדם',
+    'prov.f.preset':'תבנית',
+    'prov.f.preset.ph':'בחר תבנית…',
+    'prov.f.label':'שם',
+    'prov.f.id':'מזהה',
+    'prov.f.id.hint':'חלק מכל הפניה למודל ("id::model"). לא ניתן לשנות אחר כך.',
+    'prov.f.type':'סוג API',
+    'prov.f.url':'כתובת בסיס',
+    'prov.f.url.ph':'https://…',
+    'prov.f.url.hint.oai':'בדרך כלל מסתיימת ב-/v1 — מתווסף אליה /chat/completions.',
+    'prov.f.url.hint.anth':'בלי /v1/messages — ה-CLI מוסיף אותו.',
+    'prov.f.key':'מפתח API',
+    'prov.f.key.keep':'השאר ריק כדי לשמור את המפתח הקיים',
+    'prov.f.key.clear':'הסר את המפתח השמור',
+    'prov.f.key.hint':'נשמר מוצפן; הוא לעולם לא מגיע לדפדפן או לסביבת הסוכן.',
+    'prov.f.auth':'כותרת אימות',
+    'prov.auth.bearer':'Authorization: Bearer',
+    'prov.auth.xapikey':'x-api-key',
+    'prov.auth.both':'שתי הכותרות',
+    'prov.f.dialect':'דיאלקט',
+    'prov.f.dialect.hint':'איך להעביר לספק הזה את רמת המאמץ, החשיבה ומגבלת האסימונים.',
+    'prov.f.aliases':'השרת עצמו משרת את הכינויים של Claude (haiku/sonnet/opus/fable)',
+    'prov.f.enabled':'מופעל',
+    'prov.f.headers':'כותרות נוספות',
+    'prov.f.headers.hint':'אחת בכל שורה: שם: ערך',
+    'prov.f.timeout':'זמן המתנה לשקט בתגובה, שניות',
+    'prov.f.concurrency':'בקשות מקבילות',
+    'prov.f.stripBetas':'אל תעביר את הכותרת anthropic-beta',
+    'prov.f.extra':'גוף בקשה נוסף (JSON)',
+    'prov.f.extra.hint':'ממוזג לכל בקשה — עבור מתגים ייחודיים לספק.',
+    'prov.models.search':'חפש מודל…',
+    'prov.models.refresh':'רענן קטלוג',
+    'prov.models.all_on':'הפעל את המוצגים',
+    'prov.models.all_off':'השבת את המוצגים',
+    'prov.models.add':'הוסף מודל לפי מזהה',
+    'prov.models.add.ph':'מזהה מודל, למשל gpt-5',
+    'prov.models.empty':'אין קטלוג — הוסף מודלים לפי מזהה.',
+    'prov.models.save_first':'שמור את הספק כדי לנהל את המודלים שלו.',
+    'prov.models.builtin':'התחברות ה-CLI מציעה את הכינויים של Claude: Haiku, Sonnet, Opus, Fable.',
+    'prov.models.enabled_n':'{on} מתוך {all} מופעלים',
+    'prov.models.more':'ועוד {n} — צמצם את החיפוש',
+    'prov.models.probe':'בדוק את המודל: קריאה לכלי ותשובה קצרה',
+    'prov.models.caps':'יכולות ומחיר',
+    'prov.probe.res':'כלים {tools} · טקסט {text} · {ms} מ״ש',
+    'prov.cap.tools':'כלים',
+    'prov.cap.vision':'תמונות',
+    'prov.cap.reasoning':'חשיבה',
+    'prov.cap.ctx':'הקשר',
+    'prov.cap.out':'פלט מרבי',
+    'prov.cap.price':'$ ל-1M (קלט / פלט)',
+    'prov.roles.hint':'אילו מודלים ה-CLI משתמש בהם לקריאות רקע ולתתי-סוכנים. ריק = המודל הראשי.',
+    'prov.role.main':'ראשי (sonnet, fable)',
+    'prov.role.fast':'מהיר (haiku, קריאות רקע)',
+    'prov.role.strong':'חזק (opus)',
+    'prov.role.subagent':'תתי-סוכנים (Task)',
+    'prov.role.none':'— המודל הראשי —',
+    'prov.cancel':'ביטול',
+    'prov.create':'הוסף',
+    'prov.save':'שמור',
+    'prov.saved':'נשמר',
+    'prov.test.ok':'החיבור עובד · מודלים בקטלוג: {n}',
+    'prov.test.nocat':'החיבור עובד · לא מתפרסם קטלוג מודלים',
+    'prov.test.fail':'נכשל: {err}',
+    'prov.err.fields':'בדוק את השדות: {fields}',
+    'prov.err.exists':'ספק עם המזהה הזה כבר קיים',
+    'prov.usage':'שימוש ב-30 הימים האחרונים (בקשות · אסימונים קלט/פלט · $)',
+    'prov.usage.none':'עדיין אין בקשות דרך הגשר.',
+    'prov.notice.provider_missing':'הספק של "{ref}" כבר לא קיים — מריץ בספק ברירת המחדל.',
+    'prov.notice.provider_disabled':'הספק של "{ref}" מושבת — מריץ בספק ברירת המחדל.',
+    
+    'model.pick.change':'לחץ כדי להחליף מודל',
+    'model.pick.search':'מצא מודל…',
+    'model.pick.empty':'לא נמצא דבר',
+    'model.pick.manage':'⚙ ניהול ספקים',
+    'model.pick.notools':'ללא כלים — לא יכול לקרוא או לשנות קבצים',
+    
+    'effort.unsupported':'המודל הזה אינו תומך בחשיבה',
   }
 };
 function t(key) {
@@ -6578,10 +7278,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // language until the next page reload.
 let _i18nDynReady = false;
 const I18N_RERENDER = [
-  'renderBots', 'renderBotsStrip', 'renderBotTemplates', 'renderMcp', 'renderSkills',
+  'renderBots', 'renderBotsStrip', 'renderMcp', 'renderSkills',
   'renderCommands', 'renderAgents', 'renderProjects', 'renderRemoteHostsList',
   'renderGlobalHome', 'renderCfgForm',
   'renderRemoteHostSelect', 'renderTabs', 'updateSessBarSkills', 'loadHist', 'updateMobSubtitle',
+  'renderProviders', 'syncModelMore', 'applyModelDependentDials', 'renderUtilitySelect',
 ];
 function rerenderI18nDynamic() {
   if (!_i18nDynReady) return;
@@ -7775,13 +8476,20 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
       break;
     }
 
+    case 'provider_notice': {
+      // The server ran a turn somewhere other than where the chat says (providers.js fallback).
+      const key = { provider_missing: 'prov.notice.provider_missing', provider_disabled: 'prov.notice.provider_disabled' }[d.kind];
+      if (key) toast(t(key).replace('{ref}', String(d.ref || '')));
+      break;
+    }
+
     case 'ui_state_change': {
       // Agent requested UI state update — validate before assigning to prevent invalid state
-      const _validModes = ['auto','planning','task'], _validModels = ['haiku','sonnet','opus','fable'], _validAgents = ['single','multi','dispatch','conversation'], _validEngines = ['api','subscription'];
+      // No `engine` any more: it follows the model (engineOfModel), so a model change carries it.
+      const _validModes = ['auto','planning','task'], _validModels = ['haiku','sonnet','opus','fable'], _validAgents = ['single','multi','dispatch','conversation'];
       if (d.mode && _validModes.includes(d.mode)) { curMode = d.mode; syncBtn('mode', d.mode); }
-      if (d.model && _validModels.includes(d.model)) { curModel = d.model; syncBtn('model', d.model); }
+      if (d.model && (_validModels.includes(d.model) || modelInfo(d.model).known)) { curModel = d.model; syncBtn('model', d.model); }
       if (d.agent && _validAgents.includes(d.agent)) { curAgent = d.agent; syncBtn('agent', d.agent); }
-      if (d.engine && _validEngines.includes(d.engine)) { curEngine = d.engine; syncBtn('engine', d.engine); syncDefaultStar(); }
       break;
     }
 
@@ -7879,6 +8587,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
         if (d.resultMeta && streaming.el) {
           const rm = d.resultMeta;
           const parts = [];
+          // Which provider answered — shown unless it is the plain Claude login.
+          if (rm.provider && rm.provider.id && rm.provider.id !== 'claude') parts.push(`${rm.provider.label} · ${rm.provider.model}`);
           if (rm.cost != null) parts.push(`$${rm.cost < 0.01 ? rm.cost.toFixed(4) : rm.cost.toFixed(3)}`);
           if (rm.usage) {
             const inT = rm.usage.input_tokens; const outT = rm.usage.output_tokens;
@@ -8971,23 +9681,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 }
 
 
-// Starter prompts. A blank textarea is the real barrier to making a good bot: the
-// user knows what they want the bot to DO but not how a system prompt is shaped.
-// These are one click away and fully editable — a starting point, not a preset.
-const BOT_TEMPLATES = [
-  { key: 'analyst', avatar: '📈' },
-  { key: 'writer',  avatar: '📄' },
-  { key: 'reviewer', avatar: '🔍' },
-  { key: 'explainer', avatar: '💡' },
-];
-
-function renderBotTemplates() {
-  const box = $i('botTemplates'); if (!box) return;
-  box.innerHTML = BOT_TEMPLATES.map((tpl, i) =>
-    `<button type="button" class="tpl-chip" onclick="applyBotTemplate(${i})">${tpl.avatar} ${escH(t('bot.tpl.' + tpl.key + '.name'))}</button>`
-  ).join('');
-}
-
 // ─── Emoji picker (bot avatar) ───────────────────────────────────────────────
 // A curated set rather than a full Unicode table: a bot avatar wants a role or a
 // tool, and 1500 emoji to scroll makes the choice slower, not richer. Typing or
@@ -9035,16 +9728,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   closeEmojiPicker();
 }
 
-function applyBotTemplate(i) {
-  const tpl = BOT_TEMPLATES[i]; if (!tpl) return;
-  const cur = $i('botPrompt').value.trim();
-  if (cur && !confirm(t('bot.tpl.replace'))) return;
-  $i('botPrompt').value = t('bot.tpl.' + tpl.key + '.prompt');
-  if (!$i('botLabel').value.trim()) { $i('botLabel').value = t('bot.tpl.' + tpl.key + '.name'); _botHandlePreview(); }
-  if (!$i('botAvatar').value.trim()) $i('botAvatar').value = tpl.avatar;
-  if (!$i('botDesc').value.trim()) $i('botDesc').value = t('bot.tpl.' + tpl.key + '.desc');
-}
-
 function _botHandlePreview() {
   const el = $i('botHandlePreview'); if (!el) return;
   const label = $i('botLabel').value.trim();
@@ -9064,59 +9747,34 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // The MCP servers a bot can be given: every server the config lists (the built-in `web` one
 // included), ticked when the bot's stored list (a JSON array of ids, as bots.active_mcp) has it.
 // Pure so it can be tested; renderBotMcp only puts it on the page.
-// What the model picker offers for a bot. Claude aliases work on both engines; gateway models
-// ("vendor/model:free") only on the API engine, so they are left out while "Subscription" is chosen. A stored
-// value that is not on offer any more stays selectable, so opening and saving the editor never drops it.
-function botModelChoices(models, engine, current) {
-  const claude = ['haiku', 'sonnet', 'opus', 'fable'];
-  const gateway = engine === 'subscription' ? [] : (Array.isArray(models) ? models : [])
-    .filter(m => m && typeof m.id === 'string' && !claude.includes(m.id))
-    .map(m => ({ id: m.id, name: m.name || m.id, tools: m.tools !== false }));
-  const known = new Set([...claude, ...gateway.map(g => g.id)]);
-  const extra = current && !known.has(current) ? current : null;
-  return { claude, gateway, extra };
-}
-let _gatewayModels = null; // null = not asked yet
-async function loadGatewayModels() {
-  if (_gatewayModels) return _gatewayModels;
-  try {
-    const r = await fetch('/api/models');
-    const j = await r.json();
-    _gatewayModels = Array.isArray(j.models) ? j.models : [];
-  } catch { _gatewayModels = []; }
-  return _gatewayModels;
-}
-function renderBotEngine() {
-  const v = ($i('botEngine') || {}).value || '';
-  document.querySelectorAll('#botEngineSeg .bot-seg-btn').forEach(b => b.classList.toggle('on', b.dataset.v === v));
-}
-// The model chips are the four the new-chat bar has; a gateway model (API only) is a second, optional list
-// under them. The chosen value lives in the hidden #botModel, which is what saveBot reads.
+// The bot's model: '' = as the chat, else a value exactly as the toolbar stores it (a bare
+// alias of the default provider, or "provider::model"). Its PROVIDER decides the engine the
+// bot runs on (server.js runEngineFor), which is why there is no engine field any more.
+// The choice is made in the toolbar's own picker (openModelPicker with a target).
 function renderBotModel(current) {
   const hid = $i('botModel'); if (!hid) return;
-  hid.value = (current !== undefined ? current : hid.value) || '';
-  const ch = botModelChoices(_gatewayModels, ($i('botEngine') || {}).value || '', hid.value);
-  document.querySelectorAll('#botModelSeg .bot-seg-btn').forEach(b => b.classList.toggle('on', b.dataset.v === hid.value));
-  const gw = $i('botModelGw'); if (!gw) return;
-  const opt = (v, label) => { const o = document.createElement('option'); o.value = v; o.textContent = label; return o; };
-  gw.textContent = '';
-  gw.appendChild(opt('', t('bot.model.gateway.ph')));
-  ch.gateway.forEach(m => gw.appendChild(opt(m.id, m.name + (m.tools ? '' : ' — ' + t('bot.model.no_tools')))));
-  if (ch.extra) gw.appendChild(opt(ch.extra, ch.extra));
-  gw.value = hid.value && !ch.claude.includes(hid.value) ? hid.value : '';
-  gw.hidden = !(ch.gateway.length || ch.extra);
-  if (_gatewayModels === null) loadGatewayModels().then(() => { if (($i('botModel') || {}).isConnected) renderBotModel(); });
+  if (current !== undefined) hid.value = current || '';
+  const btn = $i('botModelBtn'); if (!btn) return;
+  const v = hid.value;
+  btn.classList.toggle('inherit', !v);
+  if (!v) {
+    btn.innerHTML = `<span class="mdl-cur-name">${escH(t('bot.model.inherit'))}</span><span class="mdl-cur-caret">▾</span>`;
+    btn.title = t('bot.model.inherit');
+    return;
+  }
+  const mi = modelInfo(v);
+  btn.innerHTML = `<span class="mdl-cur-name">${escH(mi.label)}</span>`
+    + (mi.providerLabel ? `<span class="mdl-cur-prov">${escH(mi.providerLabel)}</span>` : '')
+    + provModeBadge(mi.providerType)
+    + '<span class="mdl-cur-caret">▾</span>';
+  btn.title = `${mi.providerLabel ? mi.providerLabel + ' · ' : ''}${mi.label}`;
 }
 function setBotModel(v) {
   $i('botModel').value = v || '';
   renderBotModel();
 }
-function setBotEngine(v) {
-  $i('botEngine').value = v || '';
-  // A gateway id ("vendor/model:free") means nothing on the subscription; drop it visibly rather than keep a choice
-  // the chips cannot show. Claude aliases and full Claude ids stay.
-  if (v === 'subscription' && !/^[A-Za-z0-9._-]*$/.test($i('botModel').value)) $i('botModel').value = '';
-  renderBotEngine(); renderBotModel();
+function openBotModelPicker(anchor) {
+  openModelPicker(anchor, { current: ($i('botModel') || {}).value || '', inherit: true, onPick: setBotModel });
 }
 function renderBotRoomTools() {
   const v = ($i('botRoomTools') || {}).value || '';
@@ -9167,9 +9825,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   $i('botLabel').value = bot?.label || '';
   $i('botAvatar').value = bot?.avatar || '';
   $i('botDesc').value = bot?.description || '';
-  $i('botEngine').value = bot?.run_engine || '';
-  renderBotEngine();
   renderBotModel(bot?.model || '');
+  // The button names the model through the provider list; fetched once, then re-rendered.
+  if (!_modelChoices) loadModelChoices().then(() => { if (($i('botModel') || {}).isConnected) renderBotModel(); });
   $i('botRoomTools').value = bot?.room_tools || '';
   renderBotRoomTools();
   $i('botPrompt').value = bot?.system_prompt || '';
@@ -9195,7 +9853,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   btn.textContent = t(btnKey); btn.setAttribute('data-i18n', btnKey);
   title.textContent = t(titleKey); title.setAttribute('data-i18n', titleKey);
   _botHandlePreview();
-  renderBotTemplates();
   openModalOverlay('botModal', { initialFocus: '#botLabel', labelId: 'botModalTitle', onEscape: cancelBotForm });
 }
 
@@ -9209,7 +9866,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     avatar: $i('botAvatar').value.trim(),
     description: $i('botDesc').value.trim(),
     model: $i('botModel').value || null,
-    runEngine: $i('botEngine').value || null,
     roomTools: $i('botRoomTools').value || null,
     systemPrompt: $i('botPrompt').value,
     isGlobal: $i('botGlobal').checked,
@@ -9308,8 +9964,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   hd.innerHTML = `<span class="bh-ic">${escH(bot.avatar || '🤖')}</span>`
     + `<b class="bh-name">${escH(bot.label)}</b>`
     + `<span class="bh-handle">@@${escH(agent)}</span>`
-    + (bot.model ? `<span class="bh-model">${escH(bot.model)}</span>` : '')
-    + (bot.run_engine === 'subscription' ? `<span class="bh-model">${escH(t('bot.engine.subscription'))}</span>` : '');
+    + (bot.model ? `<span class="bh-model">${escH(botModelText(bot.model))}</span>` : '');
   el.classList.add('from-bot');
   el.style.setProperty('--bc', accent);
   el.insertBefore(hd, el.firstChild);
@@ -9436,6 +10091,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     tabId: activeTabId,
     workdir: curWorkdir || undefined,
     model: curModel,
+    effort: curEffort || null,
   }));
   const btn = document.querySelector('.atc-dispatch-btn');
   if (btn) { btn.textContent = t('msf.sent'); btn.disabled = true; }
@@ -9648,9 +10304,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   // tab, project switch) rather than each of them remembering.
   hideTerminalView();
   streaming.el = null;
-  // Welcome/blank screen = no active chat → engine selector reflects the global default
-  _curSessionRunEngine = null;
-  if (typeof resolveEngineForView === 'function') resolveEngineForView();
   msgsEl.innerHTML = `<div class="welcome"><div class="wi">CCS</div><h2>Claude Code Studio</h2><p>${t('welcome.desc')}</p><div class="welcome-prompts"><div class="wp-card" onclick="setPrompt(this)">&#x1F4A1; ${t('welcome.prompt.1')}</div><div class="wp-card" onclick="setPrompt(this)">&#x1F41B; ${t('welcome.prompt.2')}</div><div class="wp-card" onclick="setPrompt(this)">&#x2728; ${t('welcome.prompt.3')}</div><div class="wp-card" onclick="setPrompt(this)">&#x1F3D7;&#xFE0F; ${t('welcome.prompt.4')}</div></div><button class="welcome-import-btn" onclick="$i('sessImportInput').click()"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 01-2 2H5a2 2 0 01-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg> ${t('welcome.import')}</button></div>`;
 }
 
@@ -11579,49 +12232,12 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   const v = btn.dataset.v;
   if (group === 'mode') curMode = v;
   else if (group === 'agent') curAgent = v;
-  else if (group === 'model') curModel = v;
-  else if (group === 'engine') { curEngine = v; syncDefaultStar(); }
+  else if (group === 'model') { curModel = v; syncModelMore(); applyModelDependentDials(); }
   updInd();
   // Sync mobile UI
   if (typeof updateMobSubtitle === 'function') updateMobSubtitle();
 }
 
-// Highlight the ★ button when the current engine selection IS the global default.
-// (setOpt / syncBtn clear .on across the whole tb-group, including the star, so
-// this must run AFTER them.)
-function syncDefaultStar() {
-  const isDefault = curEngine === _globalDefaultEngine;
-  const cur = curEngine === 'subscription' ? 'Subscription' : 'API';
-  document.querySelectorAll('[data-default-star]').forEach(b => {
-    b.classList.toggle('on', isDefault);
-    b.title = t(isDefault ? 'engine.default.is' : 'engine.default.set').replace('{engine}', cur);
-  });
-}
-
-// Resolve which engine the current view shows: an explicit per-chat run_engine
-// wins; otherwise the chat inherits the global default. Race-proof — called from
-// both checkVersion (default loaded) and loadSess (session loaded); whichever
-// runs last produces the correct result.
-function resolveEngineForView() {
-  const want = _curSessionRunEngine || _globalDefaultEngine;
-  curEngine = (want === 'subscription' && _tmuxAvailable) ? 'subscription' : 'api';
-  syncBtn('engine', curEngine);
-  syncDefaultStar();
-}
-
-// Persist the current engine choice as the global default for NEW chats/tasks.
-function setDefaultEngine() {
-  fetch('/api/default-engine', {
-    method: 'PUT',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ engine: curEngine }),
-  }).then(r => r.json()).then(d => {
-    _globalDefaultEngine = d.defaultEngine === 'subscription' ? 'subscription' : 'api';
-    syncDefaultStar();
-    toast(t('engine.default.toast').replace('{engine}', _globalDefaultEngine === 'subscription' ? 'Subscription' : 'API'));
-  }).catch(() => toast(t('engine.default.err'), true));
-}
-
 function updInd() { /* removed — mode indicator no longer in toolbar */ }
 
 function updateSessBarSkills() {
@@ -11662,7 +12278,15 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 }
 
 function syncBtn(group, val) {
-  const groups = { mode: ['auto','planning','task'], agent: ['single','multi','dispatch','conversation'], model: ['haiku','sonnet','opus','fable'], engine: ['api','subscription'] };
+  const groups = { mode: ['auto','planning','task'], agent: ['single','multi','dispatch','conversation'], model: ['haiku','sonnet','opus','fable'] };
+  if (group === 'model' && val && !groups.model.includes(val)) {
+    // A model of any provider ("deepseek::deepseek-chat"): no alias chip is lit, "⋯" names it.
+    document.querySelectorAll('.tb-group[data-tbg="model"] .tb-btn').forEach(x => x.classList.remove('on'));
+    document.querySelectorAll('.mob-chip[data-mob="model"]').forEach(c => c.classList.remove('on'));
+    if (typeof syncModelMore === 'function') { syncModelMore(); applyModelDependentDials(); }
+    if (typeof updateMobSubtitle === 'function') updateMobSubtitle();
+    return;
+  }
   if (!groups[group]?.includes(val)) return;
   // Sync desktop toolbar
   document.querySelectorAll('.tb-group .tb-btn').forEach(b => {
@@ -11675,6 +12299,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   document.querySelectorAll(`.mob-chip[data-mob="${group}"]`).forEach(c => {
     c.classList.toggle('on', c.dataset.v === val);
   });
+  if (group === 'model' && typeof syncModelMore === 'function') { syncModelMore(); applyModelDependentDials(); }
   if (typeof updateMobSubtitle === 'function') updateMobSubtitle();
 }
 
@@ -12153,16 +12778,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 function sendChat(text) { inEl.value = text; send(); }
 
 async function send() {
-  // _globalDefaultEngine starts hardcoded 'api' and only becomes the real
-  // configured default once checkVersion()'s /api/version fetch resolves
-  // (see resolveEngineForView()). A message sent before that fetch lands —
-  // e.g. the very first message of a fresh page load — used to go out with
-  // curEngine still on that placeholder 'api', and the server bakes whatever
-  // `engine` arrives into the session's run_engine permanently (server.js
-  // ~11914). That silently routed billing through the API key instead of the
-  // user's actually-configured Subscription default, and stuck that way for
-  // the life of the chat. Awaiting an already-settled promise is a no-op, so
-  // this costs nothing once the page has been open for more than an instant.
+  // The first message of a fresh page load waits for checkVersion() (capabilities,
+  // chat defaults) so it never goes out on placeholder dials. Awaiting an
+  // already-settled promise is a no-op once the page has been open an instant.
   if (typeof _versionCheckDone !== 'undefined') { try { await _versionCheckDone; } catch {} }
   if (!ws || ws.readyState !== 1) { toast(t('toast.no_connection'), true); return; }
 
@@ -12300,6 +12918,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
       tabId: activeTabId,
       sessionId: currentSessionId || undefined,
       model: curModel,
+      effort: curEffort || null,
       workdir: curWorkdir || undefined,
     }));
   } else {
@@ -12315,7 +12934,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
       mcpServers: [...activeMcp],
       mode: curMode, agentMode: curAgent,
       model: curModel,
-      engine: curEngine,
       // 'auto' explicitly, never undefined. An omitted key lets the server's
       // destructuring default fill in the CURRENT global default — so a chat
       // deliberately on Auto would be re-dialled, and persisted, the day someone
@@ -12486,30 +13104,13 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 function loadStats() { /* removed */ }
 
 // ─── tmux capability (Subscription engine) ─────────────────────────────────
-// Subscription engine needs tmux on the server. When absent (e.g. native
-// Windows without WSL/Git-Bash), disable the button up front with a reason
-// instead of letting the user discover it via a failed send.
+// The Subscription engine needs tmux on the server. There is no engine button any
+// more — a model of the CLI-login provider runs there when tmux exists and headless
+// otherwise (engineOfModel), so this only feeds that rule.
 let _tmuxAvailable = true;
 function applyTmuxCapability(available) {
   _tmuxAvailable = !!available;
-  const reason = t('tmux.required');
-  const sel = [
-    ...document.querySelectorAll('.tb-btn[data-v="subscription"]'),
-    ...document.querySelectorAll('.mob-chip[data-mob="engine"][data-v="subscription"]'),
-  ];
-  for (const btn of sel) {
-    btn.disabled = !_tmuxAvailable;
-    btn.style.opacity = _tmuxAvailable ? '' : '0.4';
-    btn.style.cursor = _tmuxAvailable ? '' : 'not-allowed';
-    if (!_tmuxAvailable) btn.title = reason;
-  }
-  // If a stored session already had Subscription selected but tmux is now gone,
-  // fall back to API in the UI so the user is not stranded on a dead engine.
-  if (!_tmuxAvailable && curEngine === 'subscription') {
-    curEngine = 'api';
-    syncBtn('engine', 'api');
-  }
-  if (typeof syncDefaultStar === 'function') syncDefaultStar();
+  if (typeof applyModelDependentDials === 'function') applyModelDependentDials();
 }
 
 // ─── Version check ────────────────────────────────────────────────────────
@@ -12525,13 +13126,9 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     }
     loadTerminalCapability();
     loadBots();
-    // Store the global default and resolve the current view's engine. An open
-    // chat's explicit run_engine wins; a chat without one inherits this default.
-    _globalDefaultEngine = local.defaultEngine === 'subscription' ? 'subscription' : 'api';
     // Issue #63 — label the "Open in …" buttons with the editor actually configured.
     if (local.editor && local.editor.label) _editorLabel = local.editor.label;
     _syncEditorLabels();
-    resolveEngineForView();
     // Issue #58: resolve the dials for whatever project the session restored to.
     // Only a brand-new tab is seeded — a restored chat keeps what it was saved with.
     loadChatDefaults(curProjectId).then(() => { if (!currentSessionId) applyChatDefaults(); });
@@ -13335,10 +13932,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
       if (_eff != null) { setEffort(_eff); const es = $i('effortSel'); if (es) es.value = curEffort; }
       markDefaultOverrides();
     }
-    // Explicit per-chat run_engine wins; a chat without one (null — old chats or
-    // never-sent) inherits the global default instead of being forced to API.
-    _curSessionRunEngine = (d.run_engine === 'subscription' || d.run_engine === 'api') ? d.run_engine : null;
-    resolveEngineForView();
+    // The engine is not stored per chat any more: it follows the model just restored.
+    applyModelDependentDials();
     updInd();
 
     // git_root FIRST: a worktree-isolated session stores the WORKTREE in `workdir`,
@@ -14711,6 +15306,845 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // ─── External Agents sidebar ─────────────────────────────────────────────────
 let _editingAgentId = null;
 
+// ─── Providers & model choices (providers.js on the server) ─────────────────
+// State below is `var`, not `let`/`const`, on purpose: syncBtn() → modelInfo() can run
+// during boot from code ABOVE this block, and a `let` read there is a TDZ ReferenceError.
+// A model is one string: a bare alias ("sonnet" — the DEFAULT provider's, which is what
+// the four toolbar chips have always sent) or "provider::model". `_modelChoices` feeds
+// every picker on this page — the toolbar's "⋯" menu, the bot editor's list, the
+// utility-model select — and never carries a key.
+var _providersData = null;   // GET /api/providers (public view)
+var _modelChoices = null;    // GET /api/models/choices
+var _editingProviderId = null;
+var _provEdit = null;        // the provider open in the modal (public view), null while creating
+var _MODEL_ALIASES = ['haiku', 'sonnet', 'opus', 'fable'];
+var _MODEL_ALIAS_LABEL = { haiku: 'Haiku', sonnet: 'Sonnet', opus: 'Opus', fable: 'Fable' };
+var _PROV_ID_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+
+async function loadModelChoices() {
+  try {
+    const r = await fetch('/api/models/choices');
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+    _modelChoices = await r.json();
+  } catch {
+    if (!_modelChoices) _modelChoices = { providers: [], defaultProviderId: 'claude', utilityModel: '' };
+  }
+  syncModelMore();
+  applyModelDependentDials();
+  renderUtilitySelect();
+  return _modelChoices;
+}
+
+/** What this page knows about a stored model value. */
+function modelInfo(value) {
+  const v = String(value || '');
+  const i = v.indexOf('::');
+  const provId = i === -1 ? null : v.slice(0, i);
+  const modelId = i === -1 ? v : v.slice(i + 2);
+  const provs = (_modelChoices && _modelChoices.providers) || [];
+  const prov = provId ? provs.find(p => p.id === provId) : provs.find(p => p.isDefault);
+  const m = prov ? (prov.models || []).find(x => x.id === modelId) : null;
+  return {
+    value: v, qualified: !!provId, modelId,
+    providerId: prov ? prov.id : provId,
+    providerLabel: prov ? (prov.builtin ? t('prov.builtin.claude') : prov.label) : (provId || ''),
+    providerType: prov ? prov.type : null,
+    label: m ? (m.alias ? (_MODEL_ALIAS_LABEL[m.id] || m.id) : m.label) : (_MODEL_ALIAS_LABEL[modelId] || modelId),
+    caps: m ? m.caps : null,
+    alias: _MODEL_ALIASES.includes(modelId),
+    known: !!m,
+  };
+}
+
+/** How a provider is billed, as every list marks it: the CLI login is the subscription, the rest API. */
+function provModeOf(type) {
+  return type === 'claude-subscription' ? 'subscription' : 'api';
+}
+function provModeBadge(type) {
+  if (!type) return '';
+  const m = provModeOf(type);
+  return `<span class="prov-mode ${m}" title="${escH(t('prov.mode.' + m + '.tip'))}">${escH(t('prov.mode.' + m))}</span>`;
+}
+
+/** The engine a model runs on — there is no dial: its provider decides (server.js runEngineFor). */
+function engineOfModel(value) {
+  const tmuxOk = typeof _tmuxAvailable === 'undefined' ? true : !!_tmuxAvailable;
+  return (tmuxOk && provModeOf(modelInfo(value).providerType) === 'subscription') ? 'subscription' : 'api';
+}
+
+/** "Opus" on the default provider, "Claude (subscription) · Opus" on another one. */
+function botModelText(value) {
+  const mi = modelInfo(value);
+  const defId = _modelChoices && _modelChoices.defaultProviderId;
+  return (mi.qualified && mi.providerId !== defId && mi.providerLabel) ? `${mi.providerLabel} · ${mi.label}` : mi.label;
+}
+
+function _fmtTokens(n) {
+  if (!n) return '';
+  return n >= 1000000 ? (n / 1000000).toFixed(n % 1000000 ? 1 : 0) + 'M' : n >= 1000 ? Math.round(n / 1000) + 'K' : String(n);
+}
+
+function modelCapsText(caps) {
+  if (!caps) return '';
+  const out = [];
+  if (caps.tools !== false) out.push('🛠');
+  if (caps.vision) out.push('👁');
+  if (caps.reasoning) out.push('🧠');
+  if (caps.contextWindow) out.push(_fmtTokens(caps.contextWindow));
+  return out.join(' ');
+}
+
+/** The toolbar's model button names the chat's current model; a model of a provider other
+ *  than the default also carries that provider as a tag ("Sonnet" on the CLI login and
+ *  "Sonnet" on a gateway are different models and must not look alike). */
+function syncModelMore() {
+  const mi = modelInfo(curModel);
+  const defId = _modelChoices && _modelChoices.defaultProviderId;
+  const otherProv = mi.qualified && mi.providerId && mi.providerId !== defId;
+  const mode = mi.providerType ? ` (${t('prov.mode.' + provModeOf(mi.providerType))})` : '';
+  const full = `${mi.providerLabel ? mi.providerLabel + ' · ' : ''}${mi.label}${mode}`;
+  const name = mi.label.length > 26 ? mi.label.slice(0, 25) + '…' : mi.label;
+  for (const id of ['mdlMoreBtn', 'mobMdlMoreBtn']) {
+    const b = $i(id); if (!b) continue;
+    b.classList.add('on');
+    b.innerHTML = `<span class="mdl-cur-name">${escH(name)}</span>`
+      + (otherProv ? `<span class="mdl-cur-prov">${escH(mi.providerLabel)}</span>` : '')
+      + '<span class="mdl-cur-caret">▾</span>';
+    b.title = `${full} — ${t('model.pick.change')}`;
+    b.dataset.tip = b.title;
+  }
+}
+
+/** Engine and effort follow the model: its provider decides the engine, and a model that cannot reason has no effort dial. */
+function applyModelDependentDials() {
+  curEngine = engineOfModel(curModel);
+  const es = $i('effortSel');
+  if (es) {
+    const mi = modelInfo(curModel);
+    const noReason = !!(mi.caps && mi.caps.reasoning === false);
+    es.disabled = noReason;
+    es.title = noReason ? t('effort.unsupported') : t('effort.title');
+  }
+}
+
+// ── The "⋯" picker ──────────────────────────────────────────────────────────
+var _mdlPickAnchor = null, _mdlPickKb = -1, _mdlPickRefs = [];
+// null = the picker serves the chat toolbar (curModel); otherwise another field borrowed
+// it — the bot editor: { current, onPick(value), inherit } ('' = "same as chat").
+var _mdlPickOpts = null;
+
+function _ensureModelPicker() {
+  let el = $i('mdlPick');
+  if (el) return el;
+  el = document.createElement('div');
+  el.id = 'mdlPick';
+  el.className = 'mdl-pick';
+  el.setAttribute('role', 'dialog');
+  el.innerHTML = '<div class="mdl-pick-search"><input type="text" id="mdlPickInp" autocomplete="off" spellcheck="false"></div>'
+    + '<div class="mdl-pick-list" id="mdlPickList" role="listbox"></div>'
+    + '<div class="mdl-pick-foot"><button type="button" id="mdlPickManage"></button></div>';
+  document.body.appendChild(el);
+  const inp = el.querySelector('#mdlPickInp');
+  inp.addEventListener('input', () => { _mdlPickKb = -1; renderModelPicker(); });
+  inp.addEventListener('keydown', modelPickerKey);
+  el.querySelector('#mdlPickManage').addEventListener('click', () => { closeModelPicker(); openProvidersSection(); });
+  document.addEventListener('mousedown', (e) => {
+    const p = $i('mdlPick');
+    if (!p || !p.classList.contains('open')) return;
+    if (p.contains(e.target) || (_mdlPickAnchor && _mdlPickAnchor.contains(e.target))) return;
+    closeModelPicker();
+  }, true);
+  window.addEventListener('resize', () => { if ($i('mdlPick')?.classList.contains('open')) positionModelPicker(); });
+  return el;
+}
+
+function openModelPicker(anchor, opts) {
+  const el = _ensureModelPicker();
+  if (el.classList.contains('open') && _mdlPickAnchor === anchor) { closeModelPicker(); return; }
+  _mdlPickAnchor = anchor || null;
+  _mdlPickOpts = opts || null;
+  const inp = $i('mdlPickInp');
+  inp.value = '';
+  inp.placeholder = t('model.pick.search');
+  $i('mdlPickManage').textContent = t('model.pick.manage');
+  _mdlPickKb = -1;
+  el.classList.add('open');
+  renderModelPicker();
+  positionModelPicker();
+  // Refresh in the background: a provider added in another tab shows up on the next open.
+  loadModelChoices().then(() => { if (el.classList.contains('open')) { renderModelPicker(); positionModelPicker(); } });
+  setTimeout(() => { try { inp.focus(); } catch {} }, 0);
+}
+
+function closeModelPicker() {
+  const el = $i('mdlPick');
+  if (el) el.classList.remove('open');
+  _mdlPickAnchor = null;
+  _mdlPickOpts = null;
+}
+
+function positionModelPicker() {
+  const el = $i('mdlPick'); if (!el) return;
+  const list = el.querySelector('.mdl-pick-list');
+  if (list) list.style.maxHeight = '';
+  el.style.width = '';
+  if (window.innerWidth <= 768 || !_mdlPickAnchor) { el.style.left = ''; el.style.top = ''; return; }
+  const r = _mdlPickAnchor.getBoundingClientRect();
+  // A wide anchor (the bot editor's field) gets a picker as wide as itself.
+  if (r.width > 380) el.style.width = Math.min(r.width, window.innerWidth - 16) + 'px';
+  const w = el.offsetWidth || 380;
+  let h = el.offsetHeight || 300;
+  // Below the anchor when it fits, else above; when neither side fits (an anchor in the
+  // middle of a modal), the roomier side and a shorter list — never off the screen.
+  const below = window.innerHeight - r.bottom - 14, above = r.top - 14;
+  let top;
+  if (h <= below) top = r.bottom + 6;
+  else if (h <= above) top = r.top - h - 6;
+  else {
+    const room = Math.max(below, above);
+    if (list) list.style.maxHeight = Math.max(120, list.offsetHeight - (h - room)) + 'px';
+    h = el.offsetHeight || room;
+    top = below >= above ? r.bottom + 6 : r.top - h - 6;
+  }
+  el.style.left = Math.max(8, Math.min(r.left, window.innerWidth - w - 8)) + 'px';
+  el.style.top = Math.max(8, top) + 'px';
+}
+
+function renderModelPicker() {
+  const list = $i('mdlPickList'); if (!list) return;
+  const q = ($i('mdlPickInp')?.value || '').trim().toLowerCase();
+  // The default provider first: its models are what a bare alias means.
+  const provs = ((_modelChoices && _modelChoices.providers) || []).slice().sort((x, y) => (y.isDefault ? 1 : 0) - (x.isDefault ? 1 : 0));
+  const curVal = _mdlPickOpts ? _mdlPickOpts.current : curModel;
+  const cur = curVal ? modelInfo(curVal) : { providerId: null, modelId: null };
+  list.innerHTML = '';
+  _mdlPickRefs = [];
+  // A borrowed picker may offer "same as chat" ('') on top — the bot editor does.
+  if (_mdlPickOpts && _mdlPickOpts.inherit && (!q || t('bot.model.inherit').toLowerCase().includes(q))) {
+    const idx = _mdlPickRefs.push('') - 1;
+    const row = document.createElement('div');
+    row.className = 'mdl-pick-item' + (!curVal ? ' on' : '') + (idx === _mdlPickKb ? ' kb' : '');
+    row.setAttribute('role', 'option');
+    row.dataset.idx = String(idx);
+    row.innerHTML = `<span class="nm">${escH(t('bot.model.inherit'))}</span>`;
+    row.addEventListener('click', () => pickModel(''));
+    list.appendChild(row);
+  }
+  for (const p of provs) {
+    const pl = p.builtin ? t('prov.builtin.claude') : p.label;
+    const items = (p.models || []).filter(m => !q || pl.toLowerCase().includes(q) || m.id.toLowerCase().includes(q) || String(m.label || '').toLowerCase().includes(q));
+    if (!items.length) continue;
+    const g = document.createElement('div');
+    g.className = 'mdl-pick-grp';
+    // Every group says how it is billed: the engine follows the provider (engineOfModel).
+    g.innerHTML = `<span>${escH(pl)}</span>${provModeBadge(p.type)}${p.isDefault ? `<span class="prov-badge">${escH(t('prov.default'))}</span>` : ''}`;
+    list.appendChild(g);
+    for (const m of items) {
+      const value = (m.alias && p.isDefault) ? m.id : m.ref;
+      const idx = _mdlPickRefs.push(value) - 1;
+      const on = cur.providerId === p.id && cur.modelId === m.id;
+      const noTools = m.caps && m.caps.tools === false;
+      const row = document.createElement('div');
+      row.className = 'mdl-pick-item' + (on ? ' on' : '') + (noTools ? ' dim' : '') + (idx === _mdlPickKb ? ' kb' : '');
+      row.setAttribute('role', 'option');
+      row.dataset.idx = String(idx);
+      const name = m.alias ? (_MODEL_ALIAS_LABEL[m.id] || m.id) : (m.label || m.id);
+      const sub = !m.alias && m.label && m.label !== m.id ? `<span class="sub">${escH(m.id)}</span>` : '';
+      row.innerHTML = `<span class="nm">${escH(name)}${sub}</span><span class="caps">${escH(modelCapsText(m.caps))}</span>`;
+      if (noTools) row.title = t('model.pick.notools');
+      row.addEventListener('click', () => pickModel(value));
+      list.appendChild(row);
+    }
+  }
+  if (!_mdlPickRefs.length) {
+    const e = document.createElement('div');
+    e.className = 'mdl-pick-empty';
+    e.textContent = t('model.pick.empty');
+    list.appendChild(e);
+  }
+}
+
+function modelPickerKey(e) {
+  if (e.key === 'Escape') { e.preventDefault(); e.stopPropagation(); closeModelPicker(); return; }
+  if (!_mdlPickRefs.length) return;
+  if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+    e.preventDefault();
+    _mdlPickKb = e.key === 'ArrowDown' ? Math.min(_mdlPickRefs.length - 1, _mdlPickKb + 1) : Math.max(0, _mdlPickKb - 1);
+    renderModelPicker();
+    $i('mdlPickList')?.querySelector('.mdl-pick-item.kb')?.scrollIntoView({ block: 'nearest' });
+  } else if (e.key === 'Enter') {
+    e.preventDefault();
+    pickModel(_mdlPickRefs[_mdlPickKb >= 0 ? _mdlPickKb : 0]);
+  }
+}
+
+function pickModel(value) {
+  if (value == null) return;
+  if (_mdlPickOpts) { const cb = _mdlPickOpts.onPick; closeModelPicker(); if (cb) cb(value); return; }
+  if (!value) return;
+  curModel = value;
+  closeModelPicker();
+  syncBtn('model', value);
+  if (typeof saveUIState === 'function') saveUIState();
+}
+
+// ── Sidebar section ─────────────────────────────────────────────────────────
+function provTypeLabel(type) {
+  return t('prov.type.' + type);
+}
+
+async function loadProviders() {
+  try {
+    const r = await fetch('/api/providers');
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+    _providersData = await r.json();
+  } catch { return _providersData; }
+  renderProviders();
+  loadProviderUsage();
+  return _providersData;
+}
+
+function renderProviders() {
+  const el = $i('providersList'); if (!el) return;
+  const d = _providersData;
+  el.innerHTML = '';
+  if (!d) return;
+  const cnt = $i('providersCount'); if (cnt) cnt.textContent = d.providers.length;
+  const warn = $i('provBridgeWarn');
+  if (warn) warn.hidden = !(d.bridge && !d.bridge.running && d.providers.some(p => p.enabled && p.type === 'openai-compatible'));
+  for (const p of d.providers) {
+    const last = d.lastStatus && d.lastStatus[p.id];
+    const tested = p.lastTest ? (p.lastTest.ok ? 'ok' : 'err') : '';
+    // The most recent evidence wins: a failed live request after a green test is red.
+    const liveErr = last && last.status && last.status !== 'ok' && (!p.lastTest || last.ts * 1000 > p.lastTest.at);
+    const liveOk = last && last.status === 'ok' && (!p.lastTest || last.ts * 1000 > p.lastTest.at);
+    const dot = !p.enabled ? '' : (liveErr ? 'err' : (liveOk ? 'ok' : tested));
+    const dotTitle = liveErr ? (last.errorType || ('HTTP ' + last.httpStatus)) : (p.lastTest && p.lastTest.error) || (dot === 'ok' ? t('prov.status.ok') : t('prov.status.unknown'));
+    const nOn = p.models.filter(m => m.enabled).length + (p.aliases ? 4 : 0);
+    const name = p.builtin ? t('prov.builtin.claude') : p.label;
+    const isDef = p.id === d.defaultProviderId;
+    const div = document.createElement('div');
+    div.className = 'ci';
+    div.innerHTML = `
+      <div class="inf" style="flex:1;min-width:0">
+        <div class="nm" style="display:flex;gap:6px;align-items:center"><span class="prov-dot ${dot}" title="${escH(dotTitle)}"></span><span style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${escH(name)}</span>${isDef ? `<span class="prov-badge">${escH(t('prov.default'))}</span>` : ''}</div>
+        <div class="ds" style="font-size:11px">${provModeBadge(p.type)} ${escH(provTypeLabel(p.type))} · ${escH(t('prov.models.count').replace('{n}', nOn))}${p.enabled ? '' : ' · ' + escH(t('prov.disabled'))}</div>
+      </div>
+      ${!isDef && p.enabled ? `<button class="cfg prov-def-btn" title="${escH(t('prov.make_default'))}">★</button>` : ''}
+      <button class="cfg prov-test-btn" title="${escH(t('prov.test'))}" style="font-size:12px">▶</button>
+      <button class="cfg prov-edit-btn" title="${escH(t('prov.edit'))}">✏️</button>
+      ${p.builtin ? '' : `<button class="rm prov-del-btn" title="${escH(t('prov.del'))}">✕</button>`}`;
+    div.querySelector('.prov-def-btn')?.addEventListener('click', e => { e.stopPropagation(); setDefaultProvider(p.id); });
+    div.querySelector('.prov-test-btn').addEventListener('click', e => { e.stopPropagation(); testProvider(p.id, e.currentTarget); });
+    div.querySelector('.prov-edit-btn').addEventListener('click', e => { e.stopPropagation(); openProviderForm(p.id); });
+    div.querySelector('.prov-del-btn')?.addEventListener('click', e => { e.stopPropagation(); deleteProvider(p.id); });
+    el.appendChild(div);
+  }
+  renderUtilitySelect();
+}
+
+function renderUtilitySelect() {
+  const sel = $i('provUtilitySel'); if (!sel) return;
+  const cur = (_modelChoices && _modelChoices.utilityModel) || (_providersData && _providersData.utilityModel) || '';
+  sel.innerHTML = '';
+  const def = document.createElement('option');
+  def.value = ''; def.textContent = t('prov.utility.default');
+  sel.appendChild(def);
+  let found = !cur;
+  for (const p of (_modelChoices && _modelChoices.providers) || []) {
+    const og = document.createElement('optgroup');
+    og.label = `${p.builtin ? t('prov.builtin.claude') : p.label} — ${t('prov.mode.' + provModeOf(p.type))}`;
+    for (const m of p.models || []) {
+      const o = document.createElement('option');
+      o.value = m.ref;
+      o.textContent = m.alias ? (_MODEL_ALIAS_LABEL[m.id] || m.id) : (m.label || m.id);
+      if (m.ref === cur) found = true;
+      og.appendChild(o);
+    }
+    if (og.children.length) sel.appendChild(og);
+  }
+  if (!found) { const o = document.createElement('option'); o.value = cur; o.textContent = cur; sel.appendChild(o); }
+  sel.value = cur;
+}
+
+async function setUtilityModel(v) {
+  try {
+    const r = await fetch('/api/providers-settings', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ utilityModel: v || '' }) });
+    const d = await r.json();
+    if (!r.ok) throw new Error(d.error || 'HTTP ' + r.status);
+    toast(t('prov.saved'));
+    loadModelChoices();
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+}
+
+async function loadProviderUsage() {
+  const el = $i('provUsage'); if (!el) return;
+  try {
+    const r = await fetch('/api/llm-usage?days=30');
+    const d = await r.json();
+    const by = {};
+    for (const row of d.rows || []) {
+      const k = row.provider_id || '?';
+      const a = by[k] || (by[k] = { requests: 0, input: 0, output: 0, cost: 0, priced: true, errors: 0 });
+      a.requests += row.requests || 0; a.input += row.input || 0; a.output += row.output || 0; a.errors += row.errors || 0;
+      if (row.cost == null) a.priced = false; else a.cost += row.cost;
+    }
+    const keys = Object.keys(by);
+    if (!keys.length) { el.innerHTML = `<div>${escH(t('prov.usage'))}</div><div style="margin-top:3px">${escH(t('prov.usage.none'))}</div>`; return; }
+    const label = (id) => { const p = _providersData && _providersData.providers.find(x => x.id === id); return p ? (p.builtin ? t('prov.builtin.claude') : p.label) : id; };
+    el.innerHTML = `<div>${escH(t('prov.usage'))}</div><table>${keys.map(k => {
+      const a = by[k];
+      const cost = a.priced ? `$${a.cost < 0.01 ? a.cost.toFixed(4) : a.cost.toFixed(2)}` : '—';
+      return `<tr><td>${escH(label(k))}</td><td class="n">${a.requests}</td><td class="n">${escH(_fmtTokens(a.input) || '0')}/${escH(_fmtTokens(a.output) || '0')}</td><td class="n">${escH(cost)}</td></tr>`;
+    }).join('')}</table>`;
+  } catch { el.innerHTML = ''; }
+}
+
+function openProvidersSection() {
+  // The left panel may itself be folded away; opening the section inside it would show nothing.
+  if ($i('leftPanel')?.classList.contains('collapsed')) toggle('leftPanel');
+  const body = $i('providersBody');
+  if (body && body.classList.contains('collapsed')) toggleSec('providers');
+  try { body?.scrollIntoView({ block: 'nearest', behavior: 'smooth' }); } catch {}
+}
+
+async function setDefaultProvider(id) {
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(id)}/default`, { method: 'POST' });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+    await loadProviders();
+    await loadModelChoices();
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+}
+
+function _provTestText(r) {
+  if (!r) return '';
+  if (r.ok) return r.noCatalog && !r.total ? t('prov.test.nocat') : t('prov.test.ok').replace('{n}', r.total || 0);
+  return t('prov.test.fail').replace('{err}', r.error || '?');
+}
+
+async function testProvider(id, btn) {
+  if (btn) btn.disabled = true;
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(id)}/test`, { method: 'POST' });
+    const d = await r.json();
+    toast(_provTestText(d), !d.ok);
+    await loadProviders();
+    loadModelChoices();
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  finally { if (btn) btn.disabled = false; }
+}
+
+async function deleteProvider(id) {
+  const p = _providersData && _providersData.providers.find(x => x.id === id);
+  if (!p || p.builtin) return;
+  if (!confirm(t('prov.del.confirm').replace('{name}', p.label))) return;
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+    await loadProviders();
+    loadModelChoices();
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+}
+
+// ── Provider form ───────────────────────────────────────────────────────────
+function provTab(name) {
+  document.querySelectorAll('#provModal .prov-tab').forEach(b => b.classList.toggle('on', b.dataset.pt === name));
+  document.querySelectorAll('#provModal .prov-pane').forEach(p => { p.hidden = p.dataset.pp !== name; });
+  if (name === 'models') renderProviderModels();
+  if (name === 'roles') renderProviderRoles();
+}
+
+function _provSlug(label) {
+  const cyr = {'а':'a','б':'b','в':'v','г':'g','ґ':'g','д':'d','е':'e','є':'ye','ж':'zh','з':'z','и':'y','і':'i','ї':'yi','й':'y','к':'k','л':'l','м':'m','н':'n','о':'o','п':'p','р':'r','с':'s','т':'t','у':'u','ф':'f','х':'kh','ц':'ts','ч':'ch','ш':'sh','щ':'shch','ь':'','ю':'yu','я':'ya','ы':'y','э':'e','ё':'yo'};
+  const s = String(label || '').toLowerCase().replace(/[а-яґєіїё]/g, c => cyr[c] || '');
+  return s.replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32).replace(/-+$/, '') || 'provider';
+}
+
+function _provUniqueId(base) {
+  const taken = new Set(((_providersData && _providersData.providers) || []).map(p => p.id));
+  if (!taken.has(base)) return base;
+  for (let i = 2; i < 100; i++) { const c = `${base.slice(0, 28)}-${i}`; if (!taken.has(c)) return c; }
+  return `${base.slice(0, 20)}-${Date.now().toString(36)}`;
+}
+
+function provLabelChanged() {
+  if (_editingProviderId) return;
+  const idEl = $i('provId');
+  if (idEl.dataset.touched) return;
+  idEl.value = _provUniqueId(_provSlug($i('provLabel').value));
+}
+
+function provTypeChanged() {
+  const type = $i('provType').value;
+  const builtin = !!(_provEdit && _provEdit.builtin);
+  const oai = type === 'openai-compatible';
+  $i('provDialectRow').hidden = builtin || !oai;
+  $i('provAuthRow').hidden = builtin || oai;
+  $i('provAliasesRow').hidden = builtin || type !== 'anthropic-compatible';
+  $i('provStripRow').hidden = builtin || oai;
+  $i('provUrlHint').textContent = oai ? t('prov.f.url.hint.oai') : t('prov.f.url.hint.anth');
+}
+
+function _fillSelect(sel, items, value) {
+  sel.innerHTML = '';
+  for (const [v, label] of items) { const o = document.createElement('option'); o.value = v; o.textContent = label; sel.appendChild(o); }
+  if (value !== undefined) sel.value = value;
+}
+
+function applyProviderPreset(presetId) {
+  const pr = ((_providersData && _providersData.presets) || []).find(p => p.id === presetId);
+  if (!pr) return;
+  if (!$i('provLabel').value.trim() || $i('provLabel').dataset.fromPreset) {
+    $i('provLabel').value = pr.label;
+    $i('provLabel').dataset.fromPreset = '1';
+  }
+  if (!$i('provId').dataset.touched) $i('provId').value = _provUniqueId(pr.id);
+  $i('provType').value = pr.type;
+  $i('provUrl').value = pr.baseUrl || '';
+  $i('provAuth').value = pr.authScheme || 'bearer';
+  $i('provDialect').value = pr.dialect || 'generic';
+  $i('provAliases').checked = !!pr.aliases;
+  provTypeChanged();
+  $i(pr.baseUrl ? 'provKey' : 'provUrl').focus();
+}
+
+function openProviderForm(id) {
+  const d = _providersData;
+  if (!d) { loadProviders().then(() => { if (_providersData) openProviderForm(id); }); return; }
+  const p = id ? d.providers.find(x => x.id === id) : null;
+  if (id && !p) return;
+  _editingProviderId = id || null;
+  _provEdit = p || null;
+  const builtin = !!(p && p.builtin);
+  _fillSelect($i('provPreset'), [['', t('prov.f.preset.ph')], ...d.presets.map(pr => [pr.id, pr.label])], '');
+  _fillSelect($i('provDialect'), d.dialects.map(x => [x, x]), (p && p.dialect) || 'generic');
+  $i('provPresetRow').hidden = !!p;
+  $i('provIdRow').hidden = !!p;
+  $i('provTypeRow').hidden = builtin;
+  $i('provUrlRow').hidden = builtin;
+  $i('provKeyRow').hidden = builtin;
+  $i('provLabel').value = p ? (builtin ? t('prov.builtin.claude') : p.label) : '';
+  $i('provLabel').disabled = builtin;
+  delete $i('provLabel').dataset.fromPreset;
+  $i('provId').value = p ? p.id : '';
+  delete $i('provId').dataset.touched;
+  $i('provType').value = p && !builtin ? p.type : 'anthropic-compatible';
+  $i('provUrl').value = p ? (p.baseUrl || '') : '';
+  $i('provKey').value = '';
+  $i('provKeyKeep').hidden = !(p && p.hasKey);
+  $i('provKeyClearRow').hidden = !(p && p.hasKey);
+  $i('provKeyClear').checked = false;
+  $i('provAuth').value = (p && p.authScheme) || 'bearer';
+  $i('provAliases').checked = !!(p && p.aliasesSetting);
+  $i('provEnabled').checked = !p || p.enabled;
+  $i('provHeaders').value = p ? Object.entries(p.headers || {}).map(([k, v]) => `${k}: ${v}`).join('\n') : '';
+  $i('provTimeout').value = p && p.options && p.options.timeoutMs ? Math.round(p.options.timeoutMs / 1000) : '';
+  $i('provConcurrency').value = p && p.options && p.options.maxConcurrency ? p.options.maxConcurrency : '';
+  $i('provStripBetas').checked = !!(p && p.options && p.options.stripBetas);
+  $i('provExtra').value = p && p.options && p.options.extraBody ? JSON.stringify(p.options.extraBody, null, 2) : '';
+  $i('provTestRes').textContent = ''; $i('provTestRes').className = 'prov-test-res';
+  $i('provModelSearch').value = '';
+  document.querySelectorAll('#provModal .prov-tab').forEach(b => {
+    b.hidden = builtin && (b.dataset.pt === 'roles' || b.dataset.pt === 'adv');
+  });
+  const title = $i('provModalTitle'), btn = $i('provSaveBtn');
+  const tk = p ? 'prov.modal.edit.title' : 'prov.modal.add.title', bk = p ? 'prov.save' : 'prov.create';
+  title.textContent = p ? `${t(tk)} · ${builtin ? t('prov.builtin.claude') : p.label}` : t(tk);
+  btn.textContent = t(bk); btn.setAttribute('data-i18n', bk);
+  provTypeChanged();
+  provTab('main');
+  openModalOverlay('provModal', { initialFocus: p ? '#provLabel' : '#provPreset', labelId: 'provModalTitle', onEscape: cancelProviderForm });
+}
+
+function cancelProviderForm() {
+  closeModalOverlay('provModal');
+  _editingProviderId = null;
+  _provEdit = null;
+}
+
+function _provParseHeaders(text) {
+  const out = {};
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const s = line.trim(); if (!s) continue;
+    const i = s.indexOf(':');
+    if (i <= 0) return null;
+    out[s.slice(0, i).trim()] = s.slice(i + 1).trim();
+  }
+  return out;
+}
+
+/** The form as an API body. Returns null (and says why) when a field cannot be read. */
+function _provFormBody() {
+  const builtin = !!(_provEdit && _provEdit.builtin);
+  if (builtin) return { enabled: $i('provEnabled').checked };
+  const headers = _provParseHeaders($i('provHeaders').value);
+  if (headers === null) { toast(t('prov.err.fields').replace('{fields}', t('prov.f.headers')), true); provTab('adv'); return null; }
+  let extraBody = null;
+  const ex = $i('provExtra').value.trim();
+  if (ex) {
+    try { extraBody = JSON.parse(ex); if (!extraBody || typeof extraBody !== 'object' || Array.isArray(extraBody)) throw new Error('object'); }
+    catch { toast(t('prov.err.fields').replace('{fields}', t('prov.f.extra')), true); provTab('adv'); return null; }
+  }
+  const type = $i('provType').value;
+  const tsec = parseInt($i('provTimeout').value, 10);
+  const conc = parseInt($i('provConcurrency').value, 10);
+  const body = {
+    label: $i('provLabel').value.trim(),
+    type,
+    baseUrl: $i('provUrl').value.trim(),
+    authScheme: $i('provAuth').value,
+    dialect: $i('provDialect').value,
+    aliases: type === 'anthropic-compatible' && $i('provAliases').checked,
+    enabled: $i('provEnabled').checked,
+    headers,
+    options: {
+      timeoutMs: tsec > 0 ? tsec * 1000 : null,
+      maxConcurrency: conc > 0 ? conc : null,
+      stripBetas: type !== 'openai-compatible' && $i('provStripBetas').checked,
+      extraBody,
+    },
+  };
+  const key = $i('provKey').value.trim();
+  if (key) body.apiKey = key;
+  if (!key && $i('provKeyClear').checked) body.clearApiKey = true;
+  return body;
+}
+
+async function testProviderForm() {
+  const body = _provFormBody(); if (!body) return;
+  const res = $i('provTestRes');
+  res.className = 'prov-test-res'; res.textContent = '…';
+  try {
+    let d;
+    if (_provEdit && _provEdit.builtin) {
+      d = await (await fetch(`/api/providers/${encodeURIComponent(_provEdit.id)}/test`, { method: 'POST' })).json();
+    } else {
+      d = await (await fetch('/api/providers-test', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ ...body, id: _editingProviderId || undefined }) })).json();
+    }
+    res.className = 'prov-test-res ' + (d.ok ? 'ok' : 'err');
+    res.textContent = _provTestText(d) + (d.sample && d.sample.length ? ` · ${d.sample.join(', ')}` : '');
+  } catch (e) { res.className = 'prov-test-res err'; res.textContent = t('prov.test.fail').replace('{err}', e.message); }
+}
+
+async function saveProvider() {
+  const body = _provFormBody(); if (!body) return;
+  const creating = !_editingProviderId;
+  if (creating) {
+    body.id = $i('provId').value.trim();
+    if (!_PROV_ID_RE.test(body.id)) { toast(t('prov.err.fields').replace('{fields}', t('prov.f.id')), true); return; }
+  }
+  const btn = $i('provSaveBtn'); btn.disabled = true;
+  try {
+    const r = await fetch(creating ? '/api/providers' : `/api/providers/${encodeURIComponent(_editingProviderId)}`, {
+      method: creating ? 'POST' : 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+    const d = await r.json().catch(() => ({}));
+    if (r.status === 409) { toast(t('prov.err.exists'), true); return; }
+    if (!r.ok) { toast(t('prov.err.fields').replace('{fields}', (d.fields || [d.error || r.status]).join(', ')), true); return; }
+    toast(t('prov.saved'));
+    await loadProviders();
+    await loadModelChoices();
+    if (creating) {
+      // Straight on to the models the catalogue brought in — that is the next thing to decide.
+      openProviderForm(body.id);
+      if (d.refresh) { const res = $i('provTestRes'); res.className = 'prov-test-res ' + (d.refresh.ok ? 'ok' : 'err'); res.textContent = _provTestText(d.refresh); }
+      provTab('models');
+    } else {
+      cancelProviderForm();
+    }
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  finally { btn.disabled = false; }
+}
+
+// ── Models tab ──────────────────────────────────────────────────────────────
+var PROV_MODELS_SHOWN = 200;
+var _provModelEditOpen = new Set();
+
+function _provModelsVisible() {
+  const p = _provEdit; if (!p) return [];
+  const q = ($i('provModelSearch')?.value || '').trim().toLowerCase();
+  return p.models.filter(m => !q || m.id.toLowerCase().includes(q) || String(m.label || '').toLowerCase().includes(q));
+}
+
+function _capSel(name, v) {
+  const val = v === true ? '1' : v === false ? '0' : '';
+  return `<label>${escH(t('prov.cap.' + name))} <select data-cap="${name}"><option value=""${val === '' ? ' selected' : ''}>?</option><option value="1"${val === '1' ? ' selected' : ''}>✓</option><option value="0"${val === '0' ? ' selected' : ''}>✗</option></select></label>`;
+}
+
+function renderProviderModels() {
+  const note = $i('provModelsNote'), box = $i('provModelsBox'), list = $i('provModelsList');
+  if (!list) return;
+  const p = _provEdit;
+  if (!p || p.builtin) {
+    note.hidden = false;
+    note.textContent = !p ? t('prov.models.save_first') : t('prov.models.builtin');
+    box.hidden = true;
+    return;
+  }
+  note.hidden = true; box.hidden = false;
+  const vis = _provModelsVisible();
+  const on = p.models.filter(m => m.enabled).length;
+  $i('provModelsCount').textContent = t('prov.models.enabled_n').replace('{on}', on).replace('{all}', p.models.length);
+  list.innerHTML = '';
+  if (!p.models.length) {
+    const e = document.createElement('div'); e.className = 'mdl-pick-empty'; e.textContent = t('prov.models.empty'); list.appendChild(e);
+    return;
+  }
+  for (const m of vis.slice(0, PROV_MODELS_SHOWN)) {
+    const row = document.createElement('div');
+    row.className = 'prov-model';
+    const c = m.caps || {};
+    const capsBits = [modelCapsText(c)];
+    if (c.maxOutput) capsBits.push(`${t('prov.cap.out')} ${_fmtTokens(c.maxOutput)}`);
+    if (m.pricing) capsBits.push(`$${m.pricing.in ?? '?'}/${m.pricing.out ?? '?'}`);
+    let ver = '';
+    if (m.verified) {
+      const v = m.verified;
+      ver = ` · <span class="${v.tools && v.text ? 'pm-ok' : 'pm-bad'}">${escH(t('prov.probe.res').replace('{tools}', v.tools ? '✓' : '✗').replace('{text}', v.text ? '✓' : '✗').replace('{ms}', v.latencyMs || '?'))}</span>`;
+    }
+    const open = _provModelEditOpen.has(m.id);
+    row.innerHTML = `
+      <div class="pm-top">
+        <input type="checkbox" class="pm-on" ${m.enabled ? 'checked' : ''}>
+        <span class="pm-id" title="${escH(m.id)}">${escH(m.label || m.id)}${m.label && m.label !== m.id ? `<code>${escH(m.id)}</code>` : ''}</span>
+        <button type="button" class="pm-btn pm-probe" title="${escH(t('prov.models.probe'))}">▶</button>
+        <button type="button" class="pm-btn pm-caps-btn" title="${escH(t('prov.models.caps'))}">✎</button>
+        ${m.source === 'manual' ? `<button type="button" class="pm-btn pm-del" title="${escH(t('prov.del'))}">✕</button>` : ''}
+      </div>
+      <div class="pm-caps">${escH(capsBits.filter(Boolean).join(' · ') || '—')}${ver}</div>
+      <div class="pm-edit" ${open ? '' : 'hidden'}>
+        ${_capSel('tools', c.tools)}${_capSel('vision', c.vision)}${_capSel('reasoning', c.reasoning)}
+        <label>${escH(t('prov.cap.ctx'))} <input type="number" min="1000" step="1000" data-num="contextWindow" value="${c.contextWindow || ''}"></label>
+        <label>${escH(t('prov.cap.out'))} <input type="number" min="256" step="256" data-num="maxOutput" value="${c.maxOutput || ''}"></label>
+        <label>${escH(t('prov.cap.price'))} <input type="number" min="0" step="0.01" data-price="in" value="${m.pricing && m.pricing.in != null ? m.pricing.in : ''}"> / <input type="number" min="0" step="0.01" data-price="out" value="${m.pricing && m.pricing.out != null ? m.pricing.out : ''}"></label>
+        <button type="button" class="bg pm-save">${escH(t('prov.save'))}</button>
+      </div>`;
+    row.querySelector('.pm-on').addEventListener('change', e => updateProviderModel(m.id, { enabled: e.target.checked }));
+    row.querySelector('.pm-probe').addEventListener('click', e => probeProviderModel(m.id, e.currentTarget));
+    row.querySelector('.pm-caps-btn').addEventListener('click', () => {
+      if (_provModelEditOpen.has(m.id)) _provModelEditOpen.delete(m.id); else _provModelEditOpen.add(m.id);
+      renderProviderModels();
+    });
+    row.querySelector('.pm-del')?.addEventListener('click', () => removeProviderModel(m.id));
+    row.querySelector('.pm-save')?.addEventListener('click', () => {
+      const caps = {};
+      row.querySelectorAll('select[data-cap]').forEach(s => { if (s.value !== '') caps[s.dataset.cap] = s.value === '1'; });
+      row.querySelectorAll('input[data-num]').forEach(i => { const n = parseInt(i.value, 10); if (n > 0) caps[i.dataset.num] = n; });
+      const pin = parseFloat(row.querySelector('input[data-price="in"]').value), pout = parseFloat(row.querySelector('input[data-price="out"]').value);
+      const pricing = (isFinite(pin) || isFinite(pout)) ? { ...(isFinite(pin) ? { in: pin } : {}), ...(isFinite(pout) ? { out: pout } : {}) } : null;
+      _provModelEditOpen.delete(m.id);
+      updateProviderModel(m.id, { caps, pricing });
+    });
+    list.appendChild(row);
+  }
+  if (vis.length > PROV_MODELS_SHOWN) {
+    const more = document.createElement('div'); more.className = 'mdl-pick-empty';
+    more.textContent = t('prov.models.more').replace('{n}', vis.length - PROV_MODELS_SHOWN);
+    list.appendChild(more);
+  }
+}
+
+async function _provReloadEdit() {
+  await loadProviders();
+  if (_editingProviderId) _provEdit = (_providersData.providers || []).find(x => x.id === _editingProviderId) || _provEdit;
+  renderProviderModels();
+  loadModelChoices();
+}
+
+async function updateProviderModel(modelId, patch) {
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}/models`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ modelId, ...patch }) });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  await _provReloadEdit();
+}
+
+async function bulkProviderModels(enabled) {
+  const ids = _provModelsVisible().map(m => m.id);
+  if (!ids.length) return;
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}/models/bulk`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ modelIds: ids, enabled }) });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  await _provReloadEdit();
+}
+
+async function refreshProviderModels() {
+  const res = $i('provTestRes');
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}/models/refresh`, { method: 'POST' });
+    const d = await r.json();
+    toast(_provTestText(d), !d.ok);
+    if (res) { res.className = 'prov-test-res ' + (d.ok ? 'ok' : 'err'); res.textContent = _provTestText(d); }
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  await _provReloadEdit();
+}
+
+async function addProviderModel() {
+  const inp = $i('provModelAddId');
+  const modelId = inp.value.trim();
+  if (!modelId) return;
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}/models`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ modelId }) });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+    inp.value = '';
+  } catch (e) { toast(t('prov.err.fields').replace('{fields}', t('prov.models.add.ph')), true); }
+  await _provReloadEdit();
+}
+
+async function removeProviderModel(modelId) {
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}/models?modelId=${encodeURIComponent(modelId)}`, { method: 'DELETE' });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  await _provReloadEdit();
+}
+
+async function probeProviderModel(modelId, btn) {
+  if (btn) { btn.disabled = true; btn.textContent = '…'; }
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}/models/probe`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ modelId }) });
+    const d = await r.json();
+    if (d.verified) {
+      const v = d.verified;
+      toast(t('prov.probe.res').replace('{tools}', v.tools ? '✓' : '✗').replace('{text}', v.text ? '✓' : '✗').replace('{ms}', v.latencyMs || '?') + (v.error ? ` · ${v.error}` : ''), !(v.tools && v.text));
+    } else {
+      toast(t('prov.test.fail').replace('{err}', d.error === 'bridge_down' ? t('prov.bridge.down') : (d.error || '?')), true);
+    }
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  await _provReloadEdit();
+}
+
+// ── Roles tab ───────────────────────────────────────────────────────────────
+function renderProviderRoles() {
+  const p = _provEdit;
+  const opts = [['', t('prov.role.none')], ...((p && p.models) || []).filter(m => m.enabled).map(m => [m.id, m.label && m.label !== m.id ? `${m.label} (${m.id})` : m.id])];
+  const roles = (p && p.roles) || {};
+  for (const [id, key] of [['provRoleMain', 'main'], ['provRoleFast', 'fast'], ['provRoleStrong', 'strong'], ['provRoleSubagent', 'subagent']]) {
+    const sel = $i(id); if (!sel) continue;
+    const items = opts.slice();
+    if (roles[key] && !items.some(o => o[0] === roles[key])) items.push([roles[key], roles[key]]);
+    _fillSelect(sel, items, roles[key] || '');
+    sel.disabled = !p;
+    sel.onchange = () => saveProviderRoles();
+  }
+}
+
+async function saveProviderRoles() {
+  if (!_editingProviderId) return;
+  const roles = {
+    main: $i('provRoleMain').value, fast: $i('provRoleFast').value,
+    strong: $i('provRoleStrong').value, subagent: $i('provRoleSubagent').value,
+  };
+  try {
+    const r = await fetch(`/api/providers/${encodeURIComponent(_editingProviderId)}`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ roles }) });
+    if (!r.ok) throw new Error('HTTP ' + r.status);
+    toast(t('prov.saved'));
+  } catch (e) { toast(t('prov.test.fail').replace('{err}', e.message), true); }
+  await _provReloadEdit();
+}
+
 function renderAgents() {
   // ONE row per agent. An agent is a single config record with two independent
   // capabilities — `template` for one-shot delegation, `interactive` for a live
@@ -15256,7 +16690,8 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
       treeEl.appendChild(el);
     }
 
-    if (!items.length) treeEl.innerHTML = `<div style="padding:14px;color:var(--muted);text-align:center;font-size:11px">${t('files.empty')}</div>`;
+    // Append, not replace: an empty subfolder must keep its ".." row to get back out.
+    if (!items.length) treeEl.insertAdjacentHTML('beforeend', `<div style="padding:14px;color:var(--muted);text-align:center;font-size:11px">${t('files.empty')}</div>`);
     // A capped listing that says nothing reads as "this is the whole directory".
     else if (d.truncated) {
       const w = document.createElement('div');
@@ -15680,7 +17115,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   const rhLabel = p.isRemote ? `<span style="font-size:10px;color:var(--accent2);margin-left:4px">🌐 ${escH(p.remoteHost||'SSH')}</span>` : '';
   return `
       <div class="proj-dd-item${active ? ' active' : ''}" onclick="selectProjFromDropdown('${p.id}')">
-        <div class="proj-dd-item-name">${active ? '● ' : ''}${escH(p.name)}${rhLabel}</div>
+        <div class="proj-dd-item-name">${escH(p.name)}${rhLabel}</div>
         <div class="proj-dd-item-path">${escH(shortPath)}</div>
       </div>
     `;
@@ -17015,7 +18450,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 const SIDEBAR_SECTIONS = {
   activity: 'activityBody', proj: 'projBody', sshHosts: 'sshHostsBody', hist: 'histBody',
   mcp: 'mcpBody', skills: 'skillsBody', cmds: 'cmdsBody', bots: 'botsBody',
-  agents: 'agentsBody', tunnel: 'tunnelBody', tg: 'tgBody',
+  providers: 'providersBody', agents: 'agentsBody', tunnel: 'tunnelBody', tg: 'tgBody',
 };
 function sidebarSectionsState() {
   const out = {};
@@ -17200,9 +18635,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   if (group === 'mode') curMode = v;
   else if (group === 'agent') curAgent = v;
   else if (group === 'model') curModel = v;
-  else if (group === 'engine') curEngine = v;
   syncBtn(group, v);
-  if (group === 'engine') syncDefaultStar();
   updateMobSubtitle();
   saveUIState();
 }
@@ -17215,7 +18648,6 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     if (group === 'mode') cur = curMode;
     else if (group === 'agent') cur = curAgent;
     else if (group === 'model') cur = curModel;
-    else if (group === 'engine') cur = curEngine;
     chip.classList.toggle('on', v === cur);
   });
   // Sync turns
@@ -17245,7 +18677,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   if (!el) return;
   const modeKey = { auto: 'mode.auto', planning: 'mode.plan', task: 'mode.task' }[curMode];
   const modeLabel = modeKey ? t(modeKey) : curMode;
-  const modelLabel = { haiku: 'Haiku', sonnet: 'Sonnet', opus: 'Opus', fable: 'Fable' }[curModel] || curModel;
+  const modelLabel = { haiku: 'Haiku', sonnet: 'Sonnet', opus: 'Opus', fable: 'Fable' }[curModel] || modelInfo(curModel).label;
   el.textContent = modeLabel + ' · ' + modelLabel;
 }
 function updateMobStatus(status) {
@@ -17914,6 +19346,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 restoreUIState();
 _rlRestore(); // Restore rate limit badge from localStorage if still active
 _loadExternalAgents().then(() => renderAgents()); // Load agent labels + render sidebar
+loadProviders(); loadModelChoices(); // Providers section + every model picker's choices
 _restoreDelegationState(); // Restore active delegation panel if server has one
 {
   const btn = $i('autoSkillsBtn');
diff --git a/public/kanban.html b/public/kanban.html
index 5a04b261..de3632cc 100644
--- a/public/kanban.html
+++ b/public/kanban.html
@@ -408,9 +408,6 @@
     <button class="hb" onclick="refresh(true)" id="refreshBtn" title="Refresh" data-i18n-title="hdr.refresh">&#8635;</button>
     <button class="hb" onclick="openAddChainModal()" id="addGroupBtn">&#xFF0B; <span id="addGroupBtnLabel" data-i18n="hdr.group">Group</span></button>
     <button class="hb" onclick="openAddModal()" id="addBtn">&#xFF0B; <span id="addBtnLabel" data-i18n="hdr.add">Task</span></button>
-    <a class="hb" href="https://github.com/Lexus2016/claude-code-studio" target="_blank" rel="noopener">
-      <svg width="14" height="14" viewBox="0 0 24 24" fill="currentColor"><path d="M12 2C6.477 2 2 6.477 2 12c0 4.418 2.865 8.166 6.839 9.489.5.092.682-.217.682-.482 0-.237-.009-.868-.013-1.703-2.782.604-3.369-1.34-3.369-1.34-.454-1.154-1.11-1.462-1.11-1.462-.908-.62.069-.608.069-.608 1.003.07 1.531 1.03 1.531 1.03.892 1.529 2.341 1.087 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.11-4.555-4.943 0-1.091.39-1.984 1.029-2.683-.103-.253-.446-1.27.098-2.647 0 0 .84-.269 2.75 1.025A9.578 9.578 0 0112 6.836c.85.004 1.705.115 2.504.337 1.909-1.294 2.747-1.025 2.747-1.025.546 1.377.203 2.394.1 2.647.64.699 1.028 1.592 1.028 2.683 0 3.842-2.339 4.687-4.566 4.935.359.309.678.919.678 1.852 0 1.336-.012 2.415-.012 2.743 0 .267.18.578.688.48C19.138 20.163 22 16.418 22 12c0-5.523-4.477-10-10-10z"/></svg>
-    </a>
   </div>
 </div>
 
@@ -505,7 +502,8 @@
     'nav.schedule':'Розклад','nav.dashboard':'Панель','hdr.project':'Проект','hdr.refresh':'Оновити',
     'mode.auto':'Авто','mode.plan':'План','mode.task':'Задача','agent.single':'Один','agent.multi':'Мульти',
     'effort.auto':'Авто','effort.low':'Низьке','effort.med':'Середнє','effort.high':'Високе','effort.xhigh':'Дуже високе','effort.max':'Максимальне',
-    'engine.api':'API','engine.sub':'Підписка','tmux.required':'Потрібен tmux на сервері',
+    'engine.api':'API','engine.sub':'Підписка',
+    'model.more':'Інші моделі…','model.more.tip':'Моделі всіх провайдерів',
   },
   en: {
     'modal.task_cfg':'Run settings','modal.task_cfg_note':'Changes are saved and affect the next run, not the one in progress. Which dials take effect depends on the task engine and on whether it already has a session.',
@@ -553,7 +551,8 @@
     'nav.schedule':'Schedule','nav.dashboard':'Dashboard','hdr.project':'Project','hdr.refresh':'Refresh',
     'mode.auto':'Auto','mode.plan':'Plan','mode.task':'Task','agent.single':'Single','agent.multi':'Multi',
     'effort.auto':'Auto','effort.low':'Low','effort.med':'Medium','effort.high':'High','effort.xhigh':'XHigh','effort.max':'Max',
-    'engine.api':'API','engine.sub':'Subscription','tmux.required':'tmux is required on the server',
+    'engine.api':'API','engine.sub':'Subscription',
+    'model.more':'Other models…','model.more.tip':'Models of every provider',
   },
   ru: {
     'modal.task_cfg':'Параметры запуска','modal.task_cfg_note':'Изменения сохраняются и влияют на следующий запуск, а не на текущий. Какие именно настройки подействуют, зависит от движка задачи и от того, есть ли у неё уже сессия.',
@@ -601,7 +600,8 @@
     'nav.schedule':'Расписание','nav.dashboard':'Панель','hdr.project':'Проект','hdr.refresh':'Обновить',
     'mode.auto':'Авто','mode.plan':'План','mode.task':'Задача','agent.single':'Один','agent.multi':'Мульти',
     'effort.auto':'Авто','effort.low':'Низкое','effort.med':'Среднее','effort.high':'Высокое','effort.xhigh':'Очень высокое','effort.max':'Максимальное',
-    'engine.api':'API','engine.sub':'Подписка','tmux.required':'Нужен tmux на сервере',
+    'engine.api':'API','engine.sub':'Подписка',
+    'model.more':'Другие модели…','model.more.tip':'Модели всех провайдеров',
   },
   fr: {
     'modal.task_cfg':'Paramètres d exécution','modal.task_cfg_note':'Les modifications sont enregistrées et affectent le prochain lancement, pas celui en cours. Les réglages qui prennent effet dépendent du moteur de la tâche et du fait qu elle ait déjà une session.',
@@ -649,7 +649,8 @@
     'nav.schedule':'Planning','nav.dashboard':'Tableau de bord','hdr.project':'Projet','hdr.refresh':'Actualiser',
     'mode.auto':'Auto','mode.plan':'Plan','mode.task':'Tâche','agent.single':'Simple','agent.multi':'Multi',
     'effort.auto':'Auto','effort.low':'Faible','effort.med':'Moyen','effort.high':'Élevé','effort.xhigh':'Très élevé','effort.max':'Maximal',
-    'engine.api':'API','engine.sub':'Abonnement','tmux.required':'tmux est requis sur le serveur',
+    'engine.api':'API','engine.sub':'Abonnement',
+    'model.more':'Autres modèles…','model.more.tip':'Modèles de tous les fournisseurs',
   },
   he: {
     'modal.task_cfg':'הגדרות הרצה','modal.task_cfg_note':'השינויים נשמרים ומשפיעים על ההרצה הבאה, לא על זו שרצה כעת. אילו הגדרות ייכנסו לתוקף תלוי במנוע המשימה ובשאלה אם כבר יש לה סשן.',
@@ -697,7 +698,8 @@
     'nav.schedule':'לוח זמנים','nav.dashboard':'לוח מחוונים','hdr.project':'פרויקט','hdr.refresh':'רענון',
     'mode.auto':'אוטומטי','mode.plan':'תכנון','mode.task':'משימה','agent.single':'יחיד','agent.multi':'מרובה',
     'effort.auto':'אוטומטי','effort.low':'נמוך','effort.med':'בינוני','effort.high':'גבוה','effort.xhigh':'גבוה מאוד','effort.max':'מרבי',
-    'engine.api':'API','engine.sub':'מנוי','tmux.required':'נדרש tmux בשרת',
+    'engine.api':'API','engine.sub':'מנוי',
+    'model.more':'מודלים נוספים…','model.more.tip':'מודלים של כל הספקים',
   },
 };
 // `let`, not `const`: this page is reachable directly (/kanban, /schedule) in a
@@ -750,16 +752,75 @@
 let pendingAttachments=[]; // [{name, type, base64}]
 
 // ─── Session settings (persisted) ─────────────────────────────────────────
-let kbSettings={mode:'auto',agent_mode:'single',model:'sonnet',max_turns:30,run_engine:'api'};
+let kbSettings={mode:'auto',agent_mode:'single',model:'sonnet',max_turns:30};
 try{
   const _ks=JSON.parse(localStorage.getItem('kanban_sess_cfg')||'null');
   if(_ks&&typeof _ks==='object') kbSettings={...kbSettings,..._ks};
 }catch{}
-// Subscription engine capability + global default — populated from /api/version on load.
-let _kbTmuxAvailable=true, _kbDefaultEngine='api';
+// tmux capability (the subscription engine needs it) — populated from /api/version on load.
+let _kbTmuxAvailable=true;
 
 // ─── Utils ────────────────────────────────────────────────────────────────
 const UI_LOCALES={uk:'uk-UA',en:'en-US',ru:'ru-RU',fr:'fr-FR',he:'he-IL'};
+
+// ─── Other providers' models (/api/models/choices, providers.js) ──────────────
+// The four alias buttons stay; this select adds every other configured model. Its choice
+// rides a hidden `.sc-btn.on` inside the same segment, so every reader of
+// `.sc-seg[data-group] .sc-btn.on` — and scOpt's reset — keeps working unchanged.
+let _mdlChoices = null;
+const _MDL_ALIASES = ['haiku', 'sonnet', 'opus', 'fable'];
+async function loadModelChoicesPage() {
+  try { const r = await fetch('/api/models/choices'); _mdlChoices = r.ok ? await r.json() : { providers: [] }; }
+  catch { _mdlChoices = { providers: [] }; }
+  return _mdlChoices;
+}
+/** "deepseek::deepseek-chat" -> "DeepSeek · deepseek-chat"; an alias stays as it is. */
+function modelLabelPage(v) {
+  const s = String(v || '');
+  const i = s.indexOf('::');
+  if (i === -1) return s;
+  const p = ((_mdlChoices && _mdlChoices.providers) || []).find(x => x.id === s.slice(0, i));
+  const m = p && (p.models || []).find(x => x.id === s.slice(i + 2));
+  return `${p ? (p.builtin ? 'Claude' : p.label) : s.slice(0, i)} · ${m ? (m.alias ? m.id : (m.label || m.id)) : s.slice(i + 2)}`;
+}
+function modelMoreHtml(cur, handler) {
+  const c = _mdlChoices || { providers: [] };
+  const isAlias = !cur || _MDL_ALIASES.includes(cur);
+  let found = isAlias;
+  let opts = `<option value="">${escH(t('model.more'))}</option>`;
+  for (const p of c.providers || []) {
+    const items = (p.models || []).filter(m => !(m.alias && p.isDefault));
+    if (!items.length) continue;
+    // Each provider says how it is billed — the engine follows it (kbEngineOf).
+    const mode = p.type === 'claude-subscription' ? t('engine.sub') : t('engine.api');
+    opts += `<optgroup label="${escH((p.builtin ? 'Claude' : p.label) + ' — ' + mode)}">` + items.map(m => {
+      if (m.ref === cur) found = true;
+      return `<option value="${escH(m.ref)}"${m.ref === cur ? ' selected' : ''}>${escH(m.alias ? m.id : (m.label || m.id))}</option>`;
+    }).join('') + '</optgroup>';
+  }
+  if (!found) opts += `<option value="${escH(cur)}" selected>${escH(cur)}</option>`;
+  const hidden = isAlias ? '' : `<button type="button" class="sc-btn on" data-v="${escH(cur)}" data-more="1" hidden></button>`;
+  return `<select class="sc-turns sc-model-more" style="width:auto;max-width:190px" title="${escH(t('model.more.tip'))}" onchange="${handler || 'pickModelMore'}(this)">${opts}</select>${hidden}`;
+}
+/** Make the select's choice the segment's `.sc-btn.on`; '' falls back to Sonnet. Returns the value. */
+function pickModelMore(sel) {
+  const grp = sel.closest('.sc-seg'); if (!grp) return null;
+  grp.querySelectorAll('.sc-btn').forEach(b => b.classList.remove('on'));
+  let h = grp.querySelector('.sc-btn[data-more]');
+  if (!sel.value) {
+    if (h) h.remove();
+    const s = grp.querySelector('.sc-btn[data-v="sonnet"]'); if (s) s.classList.add('on');
+    return 'sonnet';
+  }
+  if (!h) { h = document.createElement('button'); h.type = 'button'; h.className = 'sc-btn'; h.dataset.more = '1'; h.hidden = true; grp.appendChild(h); }
+  h.dataset.v = sel.value; h.classList.add('on');
+  return sel.value;
+}
+function kbPickModelMore(sel){
+  const v=pickModelMore(sel);
+  if(v)kbSettings.model=v;
+  try{localStorage.setItem('kanban_sess_cfg',JSON.stringify(kbSettings));}catch{}
+}
 function escH(s){return String(s||'').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');}
 // Escape for a single-quoted JS string inside a double-quoted HTML attribute (inline onclick).
 function escArg(s){return escH(String(s==null?'':s).replace(/\\/g,'\\\\').replace(/'/g,"\\'"));}
@@ -857,11 +918,6 @@
   try{
     const ver=await fetch('/api/version').then(r=>r.json());
     _kbTmuxAvailable=ver.tmuxAvailable!==false;
-    _kbDefaultEngine=ver.defaultEngine==='subscription'?'subscription':'api';
-    // Seed engine default if the user has not chosen one yet.
-    if(kbSettings.run_engine==null||kbSettings.run_engine==='api'){
-      kbSettings.run_engine=(_kbDefaultEngine==='subscription'&&_kbTmuxAvailable)?'subscription':'api';
-    }
   }catch{}
   renderProjDropdownList('');
   // #25: ?all=1 opens the cross-project board no matter which project was last
@@ -1289,7 +1345,7 @@
 // It mirrors server.js/startTask exactly:
 //   model  = taskBot?.model || session?.model || task.model || 'sonnet'
 //   effort = task.effort || null
-//   engine = task.run_engine === 'subscription' ? 'subscription' : 'api'
+//   engine = runEngineFor(model) — the model's PROVIDER decides it (kbEngineOf)
 // `sess_model` alone — what the card showed before — was wrong twice over: blank on a
 // task that has never run (so a board of unstarted cards said nothing about settings
 // the user had already chosen), and silent about a bot's model, which OVERRIDES the
@@ -1297,17 +1353,32 @@
 // up in `kbBots`, which is only fetched when a modal opens and is `[]` at first paint.
 //
 // Effort and engine render only when they are NOT the default. 'auto' effort and the
-// 'api' engine are what nearly every card carries; a badge repeated on all of them is
+// API engine are what nearly every card carries; a badge repeated on all of them is
 // noise, and this footer already competes for width with the project, schedule,
 // session and retry badges.
 const KB_EFFORT_KEY={low:'low',medium:'med',high:'high',xhigh:'xhigh',max:'max'};
+// The engine a model runs on, as server.js runEngineFor decides it: a model of the CLI
+// login (provider type claude-subscription) runs on the subscription when tmux exists,
+// every other provider on the API. A bare value is the DEFAULT provider's model. Until
+// the provider list has loaded only an explicit `claude::` ref is known to be Claude's.
+function kbEngineOf(m){
+  const s=String(m||''), i=s.indexOf('::');
+  const provs=(typeof _mdlChoices!=='undefined'&&_mdlChoices&&_mdlChoices.providers)||[];
+  const p=i===-1?provs.find(x=>x.isDefault):provs.find(x=>x.id===s.slice(0,i));
+  const type=p?p.type:(i!==-1&&s.slice(0,i)==='claude'?'claude-subscription':null);
+  const tmux=typeof _kbTmuxAvailable==='undefined'?true:!!_kbTmuxAvailable;
+  return (tmux&&type==='claude-subscription')?'subscription':'api';
+}
 function kbRunBadges(tk){
-  const out=[{text:tk.bot_model||tk.sess_model||tk.model||'sonnet',title:t('tb.model')}];
+  const _m=tk.bot_model||tk.sess_model||tk.model||'sonnet';
+  // A provider ref reads as "Provider · model" (modelLabelPage); an alias is shown as it is.
+  const out=[{text:typeof modelLabelPage==='function'?modelLabelPage(_m):_m,title:t('tb.model')}];
   const eff=String(tk.effort||'').trim();
   // An unknown value is shown verbatim rather than dropped: it is what the run will be
   // given, and a silently missing badge is how a bad stored dial stays invisible.
   if(eff)out.push({text:KB_EFFORT_KEY[eff]?t('effort.'+KB_EFFORT_KEY[eff]):eff,title:t('tb.effort')});
-  if(tk.run_engine==='subscription')out.push({text:t('engine.sub'),title:t('tb.engine')});
+  // No engine dial: the model's provider decides (startTask → runEngineFor).
+  if(kbEngineOf(_m)==='subscription')out.push({text:t('engine.sub'),title:t('tb.engine')});
   return out;
 }
 function makeCard(tk){
@@ -1651,9 +1722,8 @@
           <button type="button" class="sc-btn${mdl==='sonnet'?' on':''}" data-v="sonnet" onclick="scOpt(this)">Sonnet</button>
           <button type="button" class="sc-btn${mdl==='opus'?' on':''}" data-v="opus" onclick="scOpt(this)">Opus</button>
           <button type="button" class="sc-btn${mdl==='fable'?' on':''}" data-v="fable" onclick="scOpt(this)">Fable</button>
+          ${modelMoreHtml(mdl, 'kbPickModelMore')}
         </div>
-        <div class="sc-sep" style="display:none"></div>
-        ${engineSegHtml(chain.run_engine)}
         <div class="sc-sep"></div>
         <div class="sc-seg">
           <span class="sc-lbl">${t('tb.bot')}</span>
@@ -1913,21 +1983,6 @@
   setTimeout(()=>$i('fTitle')?.focus(),60);
 }
 
-// Engine (api/subscription) segment — distinct from the vestigial 'engine'
-// (cli) notion. Uses data-group="run_engine". Subscription disabled w/o tmux.
-function engineSegHtml(val){
-  // Clamp to API when tmux is unavailable (mirrors Chat's resolveEngineForView)
-  const raw=val||kbSettings.run_engine||'api';
-  const eng=(raw==='subscription'&&_kbTmuxAvailable)?'subscription':'api';
-  const subDisabled=!_kbTmuxAvailable;
-  const subAttrs=subDisabled?` disabled style="opacity:0.4;cursor:not-allowed" title="${escH(t('tmux.required'))}"`:'';
-  return `<div class="sc-seg" data-group="run_engine">
-    <span class="sc-lbl">${t('tb.engine')}</span>
-    <button type="button" class="sc-btn${eng==='api'?' on':''}" data-v="api" onclick="scOpt(this)">${escH(t('engine.api'))}</button>
-    <button type="button" class="sc-btn${eng==='subscription'&&!subDisabled?' on':''}" data-v="subscription" onclick="scOpt(this)"${subAttrs}>${escH(t('engine.sub'))}</button>
-  </div>`;
-}
-
 function buildForm(tk={}){
   const isNew=!tk.id;
   const m=tk.mode||kbSettings.mode||'auto', ag=tk.agent_mode||kbSettings.agent_mode||'single', mdl=tk.model||kbSettings.model||'sonnet', eng=tk.engine||kbSettings.engine||'cli';
@@ -1938,7 +1993,7 @@
   //
   // These dials are read from the TASK row on every run, not from the session:
   // `effectiveTaskMaxTurns = task.max_turns`, `mode: task.mode`, `task.effort`,
-  // `task.run_engine` (server.js, startTask). Hiding them once a session existed
+  // (server.js, startTask). Hiding them once a session existed
   // meant the settings that actually drive each run became uneditable the moment
   // the task first ran — issue #79.
   //
@@ -2023,9 +2078,8 @@
           <button type="button" class="sc-btn${mdl==='sonnet'?' on':''}" data-v="sonnet" onclick="scOpt(this)">Sonnet</button>
           <button type="button" class="sc-btn${mdl==='opus'?' on':''}" data-v="opus" onclick="scOpt(this)">Opus</button>
           <button type="button" class="sc-btn${mdl==='fable'?' on':''}" data-v="fable" onclick="scOpt(this)">Fable</button>
+          ${modelMoreHtml(mdl, 'kbPickModelMore')}
         </div>
-        <div class="sc-sep" style="display:none"></div>
-        ${engineSegHtml(tk.run_engine)}
         <div class="sc-sep"></div>
         <div class="sc-seg">
           <span class="sc-lbl">${t('tb.bot')}</span>
@@ -2128,6 +2182,7 @@
   if(!grp)return;
   grp.querySelectorAll('.sc-btn').forEach(b=>b.classList.remove('on'));
   btn.classList.add('on');
+  const mm=grp.querySelector('.sc-model-more'); if(mm)mm.value='';
   const g=grp.dataset.group;
   if(g==='agent')kbSettings.agent_mode=btn.dataset.v;
   else if(g)kbSettings[g]=btn.dataset.v;
@@ -2137,12 +2192,12 @@
   const hasSess=!!$i('fSession')?.value;
   const cfg=$i('newSessCfg');
   // While CREATING, the block is about the session that is about to be made, so it
-  // follows the session picker. While EDITING it stays: mode, turns, effort and
-  // engine are read off the task on every run regardless of which session it uses.
+  // follows the session picker. While EDITING it stays: mode, turns and effort are
+  // read off the task on every run regardless of which session it uses.
   if(cfg&&modalMode!=='edit')cfg.classList.toggle('visible',!hasSess);
 }
 function getSessCfg(){
-  const defaults={model:'sonnet',mode:'auto',agent:'single',engine:'cli',run_engine:kbSettings.run_engine||'api',maxTurns:30,effort:'',bot_id:null};
+  const defaults={model:'sonnet',mode:'auto',agent:'single',engine:'cli',maxTurns:30,effort:'',bot_id:null};
   const cfg=$i('newSessCfg');
   if(!cfg)return defaults;
   const result={};
@@ -2235,7 +2290,6 @@
     agent_mode:cfg.agent,
     max_turns:cfg.maxTurns,
     effort:cfg.effort||null,
-    run_engine:cfg.run_engine||'api',
     bot_id:cfg.bot_id||null,
     attachments:pendingAttachments.length?JSON.stringify(pendingAttachments):null,
   };
@@ -2328,6 +2382,8 @@
     tc.onmessage=e=>{if(e.data?.type==='task_deleted'||e.data?.type==='task_changed'||e.data?.type==='chain_deleted'||e.data?.type==='chain_changed')refresh(true);};
   }catch{}
 })();
+// The cards' engine badge reads the provider list (kbEngineOf): repaint once it is here.
+loadModelChoicesPage().then(()=>{try{renderBoard();}catch{}});
 </script>
 </body>
 </html>
diff --git a/public/schedule.html b/public/schedule.html
index 1d60a2f7..3828031d 100644
--- a/public/schedule.html
+++ b/public/schedule.html
@@ -340,9 +340,6 @@
     <span class="refresh-ts" id="refreshTs" style="margin-right:4px"></span>
     <button class="hb" onclick="refresh()" id="refreshBtn" title="Refresh" data-i18n-title="hdr.refresh">&#8635;</button>
     <button class="hb" onclick="openAddModal()" id="addBtn">&#xFF0B; <span id="addBtnLabel" data-i18n="hdr.add">Task</span></button>
-    <a class="hb" href="https://github.com/Lexus2016/claude-code-studio" target="_blank" rel="noopener">
-      <svg width="14" height="14" viewBox="0 0 24 24" fill="currentColor"><path d="M12 2C6.477 2 2 6.477 2 12c0 4.418 2.865 8.166 6.839 9.489.5.092.682-.217.682-.482 0-.237-.009-.868-.013-1.703-2.782.604-3.369-1.34-3.369-1.34-.454-1.154-1.11-1.462-1.11-1.462-.908-.62.069-.608.069-.608 1.003.07 1.531 1.03 1.531 1.03.892 1.529 2.341 1.087 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.11-4.555-4.943 0-1.091.39-1.984 1.029-2.683-.103-.253-.446-1.27.098-2.647 0 0 .84-.269 2.75 1.025A9.578 9.578 0 0112 6.836c.85.004 1.705.115 2.504.337 1.909-1.294 2.747-1.025 2.747-1.025.546 1.377.203 2.394.1 2.647.64.699 1.028 1.592 1.028 2.683 0 3.842-2.339 4.687-4.566 4.935.359.309.678.919.678 1.852 0 1.336-.012 2.415-.012 2.743 0 .267.18.578.688.48C19.138 20.163 22 16.418 22 12c0-5.523-4.477-10-10-10z"/></svg>
-    </a>
   </div>
 </div>
 
@@ -464,7 +461,7 @@
     'tasks.count': '{n} завдань', 'tasks.count.1': '{n} завдання', 'tasks.count.few': '{n} завдання',
     'form.exec': 'Параметри виконання',
     'form.exec.mode': 'Режим', 'form.exec.agent': 'Агент',
-    'form.exec.model': 'Модель', 'form.exec.turns': 'Кроки', 'form.exec.effort': 'Зусилля', 'form.exec.engine': 'Рушій',
+    'form.exec.model': 'Модель', 'form.exec.turns': 'Кроки', 'form.exec.effort': 'Зусилля',
     'group.badge': 'група', 'group.progress': '{done}/{total}',
     'group.run_now': 'Запустити групу',
     // ── issue #26: keys for text that used to be hardcoded in markup / inline JS ──
@@ -474,8 +471,8 @@
     'effort.auto': 'Авто', 'effort.low': 'Низьке', 'effort.med': 'Середнє',
     'effort.high': 'Високе', 'effort.xhigh': 'Дуже високе', 'effort.max': 'Максимум',
     'engine.api': 'API', 'engine.sub': 'Підписка',
-    'tmux.required': 'На сервері потрібен tmux',
     'locale': 'uk',
+    'model.more':'Інші моделі…','model.more.tip':'Моделі всіх провайдерів',
   },
   en: {
 
@@ -528,7 +525,7 @@
     'tasks.count': '{n} tasks', 'tasks.count.1': '{n} task', 'tasks.count.few': '{n} tasks',
     'form.exec': 'Execution options',
     'form.exec.mode': 'Mode', 'form.exec.agent': 'Agent',
-    'form.exec.model': 'Model', 'form.exec.turns': 'Steps', 'form.exec.effort': 'Effort', 'form.exec.engine': 'Engine',
+    'form.exec.model': 'Model', 'form.exec.turns': 'Steps', 'form.exec.effort': 'Effort',
     'group.badge': 'group', 'group.progress': '{done}/{total}',
     'group.run_now': 'Run group',
     // ── issue #26: keys for text that used to be hardcoded in markup / inline JS ──
@@ -538,8 +535,8 @@
     'effort.auto': 'Auto', 'effort.low': 'Low', 'effort.med': 'Medium',
     'effort.high': 'High', 'effort.xhigh': 'XHigh', 'effort.max': 'Max',
     'engine.api': 'API', 'engine.sub': 'Subscription',
-    'tmux.required': 'tmux is required on the server',
     'locale': 'en-GB',
+    'model.more':'Other models…','model.more.tip':'Models of every provider',
   },
   ru: {
 
@@ -592,7 +589,7 @@
     'tasks.count': '{n} задач', 'tasks.count.1': '{n} задача', 'tasks.count.few': '{n} задачи',
     'form.exec': 'Параметры выполнения',
     'form.exec.mode': 'Режим', 'form.exec.agent': 'Агент',
-    'form.exec.model': 'Модель', 'form.exec.turns': 'Шаги', 'form.exec.effort': 'Усилие', 'form.exec.engine': 'Движок',
+    'form.exec.model': 'Модель', 'form.exec.turns': 'Шаги', 'form.exec.effort': 'Усилие',
     'group.badge': 'группа', 'group.progress': '{done}/{total}',
     'group.run_now': 'Запустить группу',
     // ── issue #26: keys for text that used to be hardcoded in markup / inline JS ──
@@ -602,8 +599,8 @@
     'effort.auto': 'Авто', 'effort.low': 'Низкое', 'effort.med': 'Среднее',
     'effort.high': 'Высокое', 'effort.xhigh': 'Очень высокое', 'effort.max': 'Максимум',
     'engine.api': 'API', 'engine.sub': 'Подписка',
-    'tmux.required': 'На сервере нужен tmux',
     'locale': 'ru-RU',
+    'model.more':'Другие модели…','model.more.tip':'Модели всех провайдеров',
   },
   fr: {
     'form.exec.bot':'Bot','form.exec.bot.none':'sans bot','form.exec.bot.tip':'La tâche s\'exécute avec le prompt et le modèle de ce bot',
@@ -656,7 +653,7 @@
     'tasks.count': '{n} tâches', 'tasks.count.1': '{n} tâche', 'tasks.count.few': '{n} tâches',
     'form.exec': 'Options d\'exécution',
     'form.exec.mode': 'Mode', 'form.exec.agent': 'Agent',
-    'form.exec.model': 'Modèle', 'form.exec.turns': 'Étapes', 'form.exec.effort': 'Effort', 'form.exec.engine': 'Moteur',
+    'form.exec.model': 'Modèle', 'form.exec.turns': 'Étapes', 'form.exec.effort': 'Effort',
     'group.badge': 'groupe', 'group.progress': '{done}/{total}',
     'group.run_now': 'Lancer le groupe',
     // ── issue #26: keys for text that used to be hardcoded in markup / inline JS ──
@@ -666,8 +663,8 @@
     'effort.auto': 'Auto', 'effort.low': 'Faible', 'effort.med': 'Moyen',
     'effort.high': 'Élevé', 'effort.xhigh': 'Très élevé', 'effort.max': 'Maximum',
     'engine.api': 'API', 'engine.sub': 'Abonnement',
-    'tmux.required': 'tmux est requis sur le serveur',
     'locale': 'fr-FR',
+    'model.more':'Autres modèles…','model.more.tip':'Modèles de tous les fournisseurs',
   },
   he: {
     'form.exec.bot':'בוט','form.exec.bot.none':'ללא בוט','form.exec.bot.tip':'המשימה תרוץ עם הפרומפט והמודל של הבוט הזה',
@@ -720,7 +717,7 @@
     'tasks.count': '{n} משימות', 'tasks.count.1': '{n} משימה', 'tasks.count.few': '{n} משימות',
     'form.exec': 'אפשרויות הרצה',
     'form.exec.mode': 'מצב', 'form.exec.agent': 'סוכן',
-    'form.exec.model': 'מודל', 'form.exec.turns': 'צעדים', 'form.exec.effort': 'מאמץ', 'form.exec.engine': 'מנוע',
+    'form.exec.model': 'מודל', 'form.exec.turns': 'צעדים', 'form.exec.effort': 'מאמץ',
     'group.badge': 'קבוצה', 'group.progress': '{done}/{total}',
     'group.run_now': 'הרצת הקבוצה',
     // ── issue #26: keys for text that used to be hardcoded in markup / inline JS ──
@@ -730,8 +727,8 @@
     'effort.auto': 'אוטומטי', 'effort.low': 'נמוך', 'effort.med': 'בינוני',
     'effort.high': 'גבוה', 'effort.xhigh': 'גבוה מאוד', 'effort.max': 'מקסימלי',
     'engine.api': 'API', 'engine.sub': 'מנוי',
-    'tmux.required': 'נדרש tmux בשרת',
     'locale': 'he-IL',
+    'model.more':'מודלים נוספים…','model.more.tip':'מודלים של כל הספקים',
   },
 };
 function t(k) { return (TR[lang]||TR.en)[k] || k; }
@@ -760,7 +757,6 @@
 let projects = [];
 let config = {};
 // Subscription engine capability + global default — populated from /api/version on load.
-let _schedTmuxAvailable = true, _schedDefaultEngine = 'api';
 // Next-occurrence stepper — mirrors server calcNextRun (returns next ts or null).
 function recurNextTs(baseTs, r) {
   const token = RECUR_ALIASES[r] || r;
@@ -800,6 +796,60 @@
 
 // ─── Helpers ──────────────────────────────────────────────────────────────
 function $i(id) { return document.getElementById(id); }
+
+// ─── Other providers' models (/api/models/choices, providers.js) ──────────────
+// The four alias buttons stay; this select adds every other configured model. Its choice
+// rides a hidden `.sc-btn.on` inside the same segment, so every reader of
+// `.sc-seg[data-group] .sc-btn.on` — and scOpt's reset — keeps working unchanged.
+let _mdlChoices = null;
+const _MDL_ALIASES = ['haiku', 'sonnet', 'opus', 'fable'];
+async function loadModelChoicesPage() {
+  try { const r = await fetch('/api/models/choices'); _mdlChoices = r.ok ? await r.json() : { providers: [] }; }
+  catch { _mdlChoices = { providers: [] }; }
+  return _mdlChoices;
+}
+/** "deepseek::deepseek-chat" -> "DeepSeek · deepseek-chat"; an alias stays as it is. */
+function modelLabelPage(v) {
+  const s = String(v || '');
+  const i = s.indexOf('::');
+  if (i === -1) return s;
+  const p = ((_mdlChoices && _mdlChoices.providers) || []).find(x => x.id === s.slice(0, i));
+  const m = p && (p.models || []).find(x => x.id === s.slice(i + 2));
+  return `${p ? (p.builtin ? 'Claude' : p.label) : s.slice(0, i)} · ${m ? (m.alias ? m.id : (m.label || m.id)) : s.slice(i + 2)}`;
+}
+function modelMoreHtml(cur, handler) {
+  const c = _mdlChoices || { providers: [] };
+  const isAlias = !cur || _MDL_ALIASES.includes(cur);
+  let found = isAlias;
+  let opts = `<option value="">${escH(t('model.more'))}</option>`;
+  for (const p of c.providers || []) {
+    const items = (p.models || []).filter(m => !(m.alias && p.isDefault));
+    if (!items.length) continue;
+    // Each provider says how it is billed — the engine follows the model's provider.
+    const mode = p.type === 'claude-subscription' ? t('engine.sub') : t('engine.api');
+    opts += `<optgroup label="${escH((p.builtin ? 'Claude' : p.label) + ' — ' + mode)}">` + items.map(m => {
+      if (m.ref === cur) found = true;
+      return `<option value="${escH(m.ref)}"${m.ref === cur ? ' selected' : ''}>${escH(m.alias ? m.id : (m.label || m.id))}</option>`;
+    }).join('') + '</optgroup>';
+  }
+  if (!found) opts += `<option value="${escH(cur)}" selected>${escH(cur)}</option>`;
+  const hidden = isAlias ? '' : `<button type="button" class="sc-btn on" data-v="${escH(cur)}" data-more="1" hidden></button>`;
+  return `<select class="sc-turns sc-model-more" style="width:auto;max-width:190px" title="${escH(t('model.more.tip'))}" onchange="${handler || 'pickModelMore'}(this)">${opts}</select>${hidden}`;
+}
+/** Make the select's choice the segment's `.sc-btn.on`; '' falls back to Sonnet. Returns the value. */
+function pickModelMore(sel) {
+  const grp = sel.closest('.sc-seg'); if (!grp) return null;
+  grp.querySelectorAll('.sc-btn').forEach(b => b.classList.remove('on'));
+  let h = grp.querySelector('.sc-btn[data-more]');
+  if (!sel.value) {
+    if (h) h.remove();
+    const s = grp.querySelector('.sc-btn[data-v="sonnet"]'); if (s) s.classList.add('on');
+    return 'sonnet';
+  }
+  if (!h) { h = document.createElement('button'); h.type = 'button'; h.className = 'sc-btn'; h.dataset.more = '1'; h.hidden = true; grp.appendChild(h); }
+  h.dataset.v = sel.value; h.classList.add('on');
+  return sel.value;
+}
 function escH(s) { return String(s||'').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;'); }
 const MODAL_FOCUSABLE_SEL='button:not([disabled]), [href], input:not([disabled]):not([type="hidden"]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])';
 let modalRestoreFocus = null;
@@ -921,11 +971,6 @@
     projects = await r.json();
     try { const rc = await apiFetch('/api/config'); config = await rc.json(); } catch {}
     adoptServerLang(config && config.lang);
-    try {
-      const ver = await fetch('/api/version').then(r => r.json());
-      _schedTmuxAvailable = ver.tmuxAvailable !== false;
-      _schedDefaultEngine = ver.defaultEngine === 'subscription' ? 'subscription' : 'api';
-    } catch {}
     // Sync with the same localStorage key that Chat and Kanban use
     const state = JSON.parse(localStorage.getItem('cc_ui_state') || '{}');
     // #25: ?all=1 forces the cross-project view, without overwriting the stored choice.
@@ -1219,7 +1264,7 @@
       </span>` : '';
 
   const modelBadge = tk.model
-    ? `<span class="badge badge-muted">${escH(tk.model)}</span>` : '';
+    ? `<span class="badge badge-muted">${escH(modelLabelPage(tk.model))}</span>` : '';
 
   const runBtn = isRunnable
     ? `<button class="btn-run" onclick="runNow('${tk.id}')" title="${t('card.run_now.title')}">
@@ -1287,7 +1332,7 @@
     ? `<span class="badge badge-orange"><span class="spinning"></span> ${t('card.running')}</span>`
     : `<span class="badge badge-muted"><span class="dot dot-${chain.derived_status}"></span> ${statusLabel(chain.derived_status)}</span>`;
 
-  const modelBadge = chain.model ? `<span class="badge badge-muted">${escH(chain.model)}</span>` : '';
+  const modelBadge = chain.model ? `<span class="badge badge-muted">${escH(modelLabelPage(chain.model))}</span>` : '';
 
   const runBtn = isRunnable
     ? `<button class="btn-run" onclick="runChainNow('${chain.id}')" title="${escH(t('group.run_now'))}">
@@ -1469,6 +1514,7 @@
           <button type="button" class="sc-btn${(tk.model||'sonnet')==='sonnet'?' on':''}" data-v="sonnet" onclick="scOpt(this)">Sonnet</button>
           <button type="button" class="sc-btn${tk.model==='opus'?' on':''}" data-v="opus" onclick="scOpt(this)">Opus</button>
           <button type="button" class="sc-btn${tk.model==='fable'?' on':''}" data-v="fable" onclick="scOpt(this)">Fable</button>
+          ${modelMoreHtml(tk.model || 'sonnet')}
         </div>
         <div class="sc-sep"></div>
         <div class="sc-seg">
@@ -1479,8 +1525,6 @@
             ${tk.bot_id && !schedBots.some(b => b.id===tk.bot_id) ? `<option value="${escH(tk.bot_id)}" selected>🚫 @@${escH(tk.bot_id)}</option>` : ''}
           </select>
         </div>
-        <div class="sc-sep" style="display:none"></div>
-        ${engineSegHtml(tk.run_engine)}
         <div class="sc-sep"></div>
         <div class="sc-seg">
           <span class="sc-lbl">${t('form.exec.turns')}</span>
@@ -1513,20 +1557,7 @@
   if (!grp) return;
   grp.querySelectorAll('.sc-btn').forEach(b => b.classList.remove('on'));
   btn.classList.add('on');
-}
-
-// Engine (api/subscription) segment. Subscription disabled without server tmux.
-function engineSegHtml(val) {
-  // Clamp to API when tmux is unavailable (mirrors Chat's resolveEngineForView)
-  const raw = val || _schedDefaultEngine;
-  const eng = (raw === 'subscription' && _schedTmuxAvailable) ? 'subscription' : 'api';
-  const subDisabled = !_schedTmuxAvailable;
-  const subAttrs = subDisabled ? ` disabled style="opacity:0.4;cursor:not-allowed" title="${escH(t('tmux.required'))}"` : '';
-  return `<div class="sc-seg" data-group="run_engine">
-    <span class="sc-lbl">${t('form.exec.engine')}</span>
-    <button type="button" class="sc-btn${eng==='api'?' on':''}" data-v="api" onclick="scOpt(this)">${escH(t('engine.api'))}</button>
-    <button type="button" class="sc-btn${eng==='subscription'&&!subDisabled?' on':''}" data-v="subscription" onclick="scOpt(this)"${subAttrs}>${escH(t('engine.sub'))}</button>
-  </div>`;
+  const mm = grp.querySelector('.sc-model-more'); if (mm) mm.value = '';
 }
 
 function getScVal(group, fallback) {
@@ -1591,7 +1622,6 @@
     model: getScVal('model', 'sonnet'),
     mode: getScVal('mode', 'auto'),
     agent_mode: getScVal('agent_mode', 'single'),
-    run_engine: getScVal('run_engine', _schedDefaultEngine === 'subscription' && _schedTmuxAvailable ? 'subscription' : 'api'),
     max_turns: parseInt($i('fMaxTurns')?.value) || 30,
     effort: ($i('fEffort')?.value || '').trim() || null,
     bot_id: ($i('fBot')?.value || '').trim() || null,
@@ -1706,6 +1736,7 @@
     tc.onmessage = e => { if (e.data?.type === 'task_deleted' || e.data?.type === 'task_changed') refresh(); };
   } catch {}
 })();
+loadModelChoicesPage();
 </script>
 </body>
 </html>
diff --git a/server.js b/server.js
index a92cc005..dd0832e5 100644
--- a/server.js
+++ b/server.js
@@ -128,6 +128,11 @@ const {
 const termBridge = require('./terminal-bridge');
 const botsLogic = require('./bots');
 const gatewayModels = require('./gateway-models');
+// Provider registry (pure rules / SQLite rows / catalogue fetch). Wired below, after the
+// secret-encryption key exists — see "PROVIDERS & LLM BRIDGE".
+const providersLib = require('./providers');
+const { createProviderStore } = require('./providers-store');
+const providersCatalog = require('./providers-catalog');
 // One catalogue for the process: the gateway the CLI talks to, read with the server's own token.
 const modelCatalog = gatewayModels.createCatalog({ baseUrl: process.env.ANTHROPIC_BASE_URL, token: process.env.ANTHROPIC_AUTH_TOKEN || process.env.ANTHROPIC_API_KEY });
 // A message that is nothing but a mention ("@@analyst") strips to an empty string —
@@ -2052,6 +2057,7 @@ async function startTask(task) {
     blockedTasks.delete(task.id); // clear any stale flag an earlier, crashed run left behind
     let fullText = '', newCid = claudeSessionId, hasError = false;
     taskBuffers.set(task.id, '');
+    const taskRunInfos = []; // provider routing of every CLI run of this task (withProviderUsage)
     // Notify watchers — use task_retrying for restarts, task_started for first run
     // Include prompt so client can show user message bubble during live streaming
     if (isRetry) {
@@ -2112,17 +2118,26 @@ async function startTask(task) {
         TASK_MANAGER_TASK_ID: task.id,
         TASK_MANAGER_SESSION_ID: sessionId,
         TASK_MANAGER_SECRET: TASK_MANAGER_SECRET,
+        // The tool's `model` field is free text now (any provider ref); the agent learns
+        // what it may pick from this list, the endpoint re-checks it (validModelOr).
+        TASK_MANAGER_MODELS: modelChoicesForAgents(),
       },
     };
 
-    // Engine selection: subscription tasks run via the persistent interactive
-    // tmux Claude session (billed on Claude Max), one-shot, no auto-continue.
-    const _taskEngine = (task.run_engine === 'subscription') ? 'subscription' : 'api';
+    // Engine selection follows the model's provider (runEngineFor): a model of the CLI
+    // login runs via the persistent interactive tmux Claude session (billed on the
+    // subscription), one-shot, no auto-continue; every other provider headless.
+    // `task.run_engine` is no longer read — the dial it stored is gone (boot migration).
+    const _taskEngine = runEngineFor(taskBot?.model || session?.model || task.model || 'sonnet');
 
     while (true) {
       lastTaskResult = null;
       hasError = false; // Reset per iteration — only the LAST iteration's error state matters for final status
       const _ftBefore = fullText.length; // baseline to isolate THIS iteration's output (overload detection)
+      // The run's own error text. A run the provider router refused never starts, so it has
+      // no result and no output — only this — and the stop/overload checks below must see it
+      // (the chat loop passes its errorText for the same reason).
+      let _taskErrText = '';
 
       if (_taskEngine === 'subscription') {
         // One-shot: interactive Claude runs to end_turn naturally. The proxy only
@@ -2130,7 +2145,8 @@ async function startTask(task) {
         // returned value below (same shape the chat path uses).
         const _proxy = { send: (str) => { try { broadcastToSession(sessionId, JSON.parse(str)); } catch {} } };
         const r = await runInteractiveSingle({
-          prompt: currentTaskPrompt, systemPrompt: '', model: session?.model || task.model || 'sonnet',
+          // The bot's model wins here too — the Kanban card has always said so (#84).
+          prompt: currentTaskPrompt, systemPrompt: '', model: taskBot?.model || session?.model || task.model || 'sonnet', effort: task.effort || null,
           mode: task.mode || 'auto', ws: _proxy, sessionId, abortController: taskAbort,
           claudeSessionId: currentTaskCid, workdir: task.workdir || WORKDIR, mcpServers: taskMcpServers,
           // Same gap the chat path had, and found while reviewing that fix: the api
@@ -2238,7 +2254,9 @@ async function startTask(task) {
         // personal CLAUDE.md — same boundary as a bot answering in chat, or every
         // reply opens with the user's own activation preamble.
         ...(taskBot ? { settingSources: 'project,local' } : {}),
-        maxTurns: effectiveTaskMaxTurns, mcpServers: taskMcpServers, abortController: taskAbort, name: taskBot?.label || task.title, effort: task.effort || null, extraEnv: taskInterruptEnv, extraSettings: taskInterruptSettings });
+        maxTurns: effectiveTaskMaxTurns, mcpServers: taskMcpServers, abortController: taskAbort, name: taskBot?.label || task.title, effort: task.effort || null, extraEnv: taskInterruptEnv, extraSettings: taskInterruptSettings,
+        runMeta: { purpose: 'task', sessionId, taskId: task.id, botId: taskBot?.id || null } });
+      if (!_taskRemote) taskRunInfos.push(cli.lastRunTarget);
       // Save subprocess PID so startup recovery can kill orphans on restart
       if (stream.process?.pid) {
         db.prepare(`UPDATE tasks SET worker_pid=? WHERE id=?`).run(stream.process.pid, task.id);
@@ -2261,6 +2279,7 @@ async function startTask(task) {
           .onUsage(u => { if (u) lastTaskTurnUsage = u; })
           .onError(err => {
             hasError = true;
+            _taskErrText += String(err || '') + '\n';
             console.error(`[taskWorker] task ${task.id} error:`, err);
             try { stmts.addMsg.run(sessionId, 'assistant', 'text', `❌ ${err.substring(0, 500)}`, null, null, null, null); } catch {}
             broadcastToSession(sessionId, { type: 'error', error: err.substring(0, 500), tabId: sessionId });
@@ -2280,7 +2299,7 @@ async function startTask(task) {
       {
         const _lastTurn = fullText.slice(_ftBefore);
         const _resultText = typeof lastTaskResult?.result === 'string' ? lastTaskResult.result : '';
-        if (shouldRetryOverload({ texts: [_lastTurn, _resultText], subtype: lastTaskResult?.subtype, isError: lastTaskResult?.is_error }) &&
+        if (shouldRetryOverload({ texts: [_lastTurn, _resultText, _taskErrText], subtype: lastTaskResult?.subtype, isError: lastTaskResult?.is_error }) &&
             !(taskAbort?.signal?.aborted || stoppingTasks.has(task.id))) {
           if (taskOverloadRetryCount < MAX_OVERLOAD_RETRIES) {
             taskOverloadRetryCount++;
@@ -2308,7 +2327,7 @@ async function startTask(task) {
       {
         const _lastTurn = fullText.slice(_ftBefore);
         const _resultText = typeof lastTaskResult?.result === 'string' ? lastTaskResult.result : '';
-        taskAuthStop = detectAuthError({ texts: [_lastTurn, _resultText], subtype: lastTaskResult?.subtype, isError: lastTaskResult?.is_error });
+        taskAuthStop = detectAuthError({ texts: [_lastTurn, _resultText, _taskErrText], subtype: lastTaskResult?.subtype, isError: lastTaskResult?.is_error });
         if (taskAuthStop) {
           log.error('[taskWorker] auth failure', { taskId: task.id, kind: taskAuthStop.kind, message: taskAuthStop.message });
           const _n = authErrorNotice(taskAuthStop);
@@ -2661,7 +2680,7 @@ async function startTask(task) {
       console.error(`[taskWorker] task ${task.id} onDone DB error:`, e);
     }
     const _taskModelInfo = lastTaskResult?.modelUsage ? Object.values(lastTaskResult.modelUsage)[0] : null;
-    const _taskMeta = lastTaskResult ? { cost: lastTaskResult.total_cost_usd, usage: lastTaskResult.usage, lastTurnUsage: lastTaskTurnUsage, numTurns: lastTaskResult.num_turns, durationMs: lastTaskResult.duration_ms, contextWindow: _taskModelInfo?.contextWindow || 0 } : null;
+    const _taskMeta = withProviderUsage(lastTaskResult ? { cost: lastTaskResult.total_cost_usd, usage: lastTaskResult.usage, lastTurnUsage: lastTaskTurnUsage, numTurns: lastTaskResult.num_turns, durationMs: lastTaskResult.duration_ms, contextWindow: _taskModelInfo?.contextWindow || 0 } : null, taskRunInfos);
     broadcastToSession(sessionId, { type: 'done', tabId: sessionId, taskId: task.id, duration: Date.now() - _taskStartedAt, ...(_taskMeta ? { resultMeta: _taskMeta } : {}) });
   } catch (err) {
     log.error(`[taskWorker] task ${task.id} exception`, { message: err.message, name: err.name, stack: err.stack });
@@ -3592,9 +3611,8 @@ function loadMergedConfig() {
     skills:        { ...(g.skills||{}),     ...(l.skills||{})     },
     slashCommands: [...(l.slashCommands||[])],
     lang:          l.lang || g.lang || 'en',
-    defaultEngine: l.defaultEngine || g.defaultEngine || 'api',
-    // Which desktop editor "Open in …" targets (#63). `||`, like lang and
-    // defaultEngine: an empty string in a config file means "unset", and
+    // Which desktop editor "Open in …" targets (#63). `||`, like lang: an empty
+    // string in a config file means "unset", and
     // editorFor() falls back once more on an unknown id.
     editor:        l.editor || g.editor || editorLinks.DEFAULT_EDITOR,
     // Per KEY, not per object: a local config that pins only `model` must not
@@ -3827,7 +3845,8 @@ async function classifyTask(userMessage, currentSkills, config, workdir) {
 
     cli.send({
       prompt,
-      model: 'haiku',
+      model: utilityModel(),
+      runMeta: { purpose: 'utility' },
       maxTurns: 1,
       settingSources: 'user', // skip project CLAUDE.md — service call, everything explicit
       tools: '',           // disable all built-in tools (--tools "")
@@ -4171,6 +4190,240 @@ function decryptPassword(stored) {
 
 // testSshConnection is now exported from claude-ssh.js (uses ssh2 library, supports password auth)
 
+// ============================================
+// PROVIDERS & LLM BRIDGE
+// ============================================
+// The registry decides, per run, which endpoint and model the `claude` CLI talks to
+// (providers.js has the rules, providers-store.js the rows). Non-login providers are
+// reached through llm-bridge/ — a separate node process on 127.0.0.1 that holds the
+// real keys, translates for OpenAI-compatible endpoints and records usage. The CLI gets
+// only a short-lived run token for it.
+//
+// Created HERE, not next to the schema: the store encrypts with encryptPassword(),
+// whose key constant above is in its temporal dead zone until this point.
+const providerStore = createProviderStore(db, { encrypt: encryptPassword, decrypt: decryptPassword, log });
+try { providerStore.seedFromEnv(process.env); } catch (e) { log.warn('provider seeding failed', { err: e.message }); }
+providerStore.pruneUsage();
+{ const _t = setInterval(() => providerStore.pruneUsage(), 24 * 3600 * 1000); if (_t.unref) _t.unref(); }
+
+// One-time: the engine dial is gone — the model's provider decides the engine now
+// (runEngineFor). A chat, task or bot that was explicitly set to "Subscription" keeps
+// running there by pinning its model to the CLI login (`claude::<model>`). Tasks and bots
+// drop the dead column value; a session keeps it (it records the engine the chat ran on).
+// Guarded by a provider_settings flag so a user's later choices are never rewritten.
+function migrateEngineDial() {
+  if (providerStore.getSetting('engineDialMigrated')) return;
+  const n = { sessions: 0, tasks: 0, bots: 0 };
+  try {
+    db.transaction(() => {
+      for (const r of db.prepare(`SELECT id, model FROM sessions WHERE run_engine = 'subscription'`).all()) {
+        const m = providersLib.toClaudeRef(r.model);
+        if (m !== r.model) { db.prepare(`UPDATE sessions SET model = ? WHERE id = ?`).run(m, r.id); n.sessions++; }
+      }
+      for (const r of db.prepare(`SELECT id, model FROM tasks WHERE run_engine = 'subscription'`).all()) {
+        db.prepare(`UPDATE tasks SET model = ?, run_engine = NULL WHERE id = ?`).run(providersLib.toClaudeRef(r.model), r.id); n.tasks++;
+      }
+      for (const r of db.prepare(`SELECT id, model FROM bots WHERE run_engine = 'subscription'`).all()) {
+        db.prepare(`UPDATE bots SET model = ?, run_engine = NULL WHERE id = ?`).run(providersLib.toClaudeRef(r.model), r.id); n.bots++;
+      }
+      db.exec(`UPDATE tasks SET run_engine = NULL WHERE run_engine IS NOT NULL`);
+      db.exec(`UPDATE bots SET run_engine = NULL WHERE run_engine IS NOT NULL`);
+    })();
+  } catch (e) {
+    log.warn('engine-dial migration failed', { err: e.message });
+    return;
+  }
+  providerStore.setSetting('engineDialMigrated', '1');
+  if (n.sessions || n.tasks || n.bots) log.info('engine dial migrated: Subscription choices pinned to claude:: models', n);
+}
+migrateEngineDial();
+
+// The child holds provider keys (over IPC) but needs none of the server's own secrets —
+// only what makes a node process work: TLS trust (a gateway behind a private CA worked
+// through the CLI's NODE_EXTRA_CA_CERTS and must keep working), proxies, and on Windows
+// the variables Winsock and temp files need.
+const BRIDGE_ENV_PASS = ['PATH', 'NODE_ENV', 'LANG', 'LC_ALL', 'NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE', 'SSL_CERT_DIR',
+  'HTTPS_PROXY', 'HTTP_PROXY', 'NO_PROXY', 'https_proxy', 'http_proxy', 'no_proxy',
+  'SystemRoot', 'SYSTEMROOT', 'windir', 'TEMP', 'TMP', 'TMPDIR', 'CCS_LLM_BRIDGE_DEBUG'];
+function bridgeChildEnv() {
+  const env = {};
+  for (const k of BRIDGE_ENV_PASS) if (process.env[k] !== undefined) env[k] = process.env[k];
+  return env;
+}
+
+let createBridgeHost = null;
+try { ({ createBridgeHost } = require('./llm-bridge/host')); }
+catch (e) { log.warn('llm-bridge unavailable — Anthropic-type providers run with the key in the CLI env, OpenAI-compatible ones cannot run', { err: e.message }); }
+
+function onBridgeUsage(rec) {
+  if (!rec || typeof rec !== 'object') return;
+  let costUsd = null;
+  try {
+    const p = providerStore.get(rec.providerId);
+    const pricing = p ? (p.models.find(m => m.id === rec.model) || {}).pricing : null;
+    costUsd = providersLib.computeCost(rec, pricing);
+  } catch {}
+  providerStore.recordUsage({ ...rec, costUsd });
+}
+
+const llmBridge = (createBridgeHost && process.env.CCS_BRIDGE !== 'off') ? createBridgeHost({
+  nodeCmd: NODE_CMD,
+  childPath: helperPath('llm-bridge', 'child.js'),
+  port: parseInt(process.env.CCS_BRIDGE_PORT || '0', 10) || 0,
+  onUsage: onBridgeUsage,
+  // The child holds provider keys (over IPC) but needs none of the server's own secrets.
+  env: bridgeChildEnv(),
+  log: {
+    debug: (m, d) => log.debug(`[llm-bridge] ${m}`, d),
+    info: (m, d) => log.info(`[llm-bridge] ${m}`, d),
+    warn: (m, d) => log.warn(`[llm-bridge] ${m}`, d),
+    error: (m, d) => log.error(`[llm-bridge] ${m}`, d),
+  },
+}) : null;
+let llmBridgeError = llmBridge ? null : (createBridgeHost ? 'disabled (CCS_BRIDGE=off)' : 'module unavailable');
+if (llmBridge) {
+  llmBridge.start().then(() => log.info('llm-bridge ready', { url: llmBridge.baseUrl() }))
+    .catch(e => { llmBridgeError = e.message; log.warn('llm-bridge failed to start', { err: e.message }); });
+}
+
+function bridgeUp() { return !!(llmBridge && llmBridge.running() && llmBridge.baseUrl()); }
+
+/** A rotated key / changed option reaches runs already in flight, not only the next ones. */
+function refreshBridgeProviders() {
+  if (!llmBridge || typeof llmBridge.updateProviders !== 'function') return;
+  const map = {};
+  for (const p of providerStore.registry().providers) if (p.type !== 'claude-subscription') map[p.id] = providersLib.providerCfg(p);
+  try { llmBridge.updateProviders(map); } catch {}
+}
+
+/** Public summary of one resolution — what a WS frame / result meta may carry. */
+function runTargetInfo(t, extra = {}) {
+  return {
+    ref: t.ref, providerId: t.provider.id, providerLabel: t.provider.label, providerType: t.provider.type,
+    modelId: t.modelId, routing: t.routing, caps: t.caps, fallback: t.fallback || null, engineChanged: !!t.engineChanged, ...extra,
+  };
+}
+
+/**
+ * The ClaudeCLI hook (claude-cli.js setRunTargetHook). Returns what one headless run needs:
+ * { cliModel, runEnv, extraArgs, info, release } or { error }.
+ */
+function resolveRunTarget({ model, effort, engine, meta }) {
+  const t = providersLib.resolveModel(model, providerStore.registry(), { engine: engine || 'api' });
+  if (!t.ok) return { error: `Model "${model}" cannot run: ${t.error === 'no_model' ? `provider "${t.providerId}" has no model enabled` : 'not a valid model'}` };
+  if (t.fallback) {
+    log.warn('model pinned to an unavailable provider — running on the default', { model, fallback: t.fallback, ref: t.ref });
+    // Every path passes its sessionId in runMeta (chat, tasks, bots, rooms, multi-agent,
+    // dispatch), so the notice reaches whoever watches that chat — once per pinned model.
+    if (meta && meta.sessionId) {
+      noticeProviderFallback({ ...runTargetInfo(t), ref: String(model) }, {
+        ws: { send: (str) => { try { broadcastToSession(meta.sessionId, JSON.parse(str)); } catch {} } },
+        sessionId: meta.sessionId, tabId: meta.sessionId,
+      });
+    }
+  }
+
+  if (t.routing === 'oauth' || t.routing === 'remote') {
+    return { cliModel: t.cliModel, runEnv: providersLib.buildRunEnv(t), extraArgs: [], info: runTargetInfo(t), release: null };
+  }
+  if (bridgeUp()) {
+    const ctx = providersLib.buildRunCtx(t, { ...(meta || {}), effort: effort || null });
+    const token = llmBridge.registerRun(ctx);
+    const runEnv = providersLib.buildRunEnv(t, { baseUrl: llmBridge.baseUrl(), token });
+    return { cliModel: t.cliModel, runEnv, extraArgs: runEnv.extraArgs, info: runTargetInfo(t, { runId: ctx.runId }), release: () => llmBridge.releaseRun(token) };
+  }
+  // Bridge down: an Anthropic-shaped endpoint is still reachable the pre-bridge way —
+  // its key in the CLI's env. Worse isolation, same behaviour as before this registry.
+  if (t.provider.type !== 'openai-compatible') {
+    const runEnv = providersLib.buildRunEnv(t, { baseUrl: t.provider.baseUrl, token: t.provider.apiKey });
+    if (t.provider.authScheme === 'x-api-key') { runEnv.set.ANTHROPIC_API_KEY = t.provider.apiKey; delete runEnv.set.ANTHROPIC_AUTH_TOKEN; }
+    else if (t.provider.authScheme === 'both') runEnv.set.ANTHROPIC_API_KEY = t.provider.apiKey;
+    // The provider's extra headers ride the CLI's own ANTHROPIC_CUSTOM_HEADERS ("Name: value" lines).
+    const hdrs = Object.entries(t.provider.headers || {}).map(([k, v]) => `${k}: ${v}`).join('\n');
+    if (hdrs) runEnv.set.ANTHROPIC_CUSTOM_HEADERS = hdrs;
+    return { cliModel: t.cliModel, runEnv, extraArgs: runEnv.extraArgs, info: runTargetInfo(t, { routing: 'direct' }), release: null };
+  }
+  // A bridge that is (re)starting is a transient condition: the phrase `overloaded_error`
+  // puts it on the loops' existing back-off-and-retry rung (rate-limit-utils) instead of the
+  // permanent stop a bridge that gave up gets (auth-errors provider_unavailable).
+  if (llmBridge && llmBridge.state && llmBridge.state() === 'starting') {
+    return { error: `LLM bridge is restarting (overloaded_error) — provider "${t.provider.label}" will be retried shortly.` };
+  }
+  return { error: `Provider "${t.provider.label}" is OpenAI-compatible and needs the LLM bridge, which is not running (${llmBridgeError || 'unavailable'}).` };
+}
+ClaudeCLI.setRunTargetHook(resolveRunTarget);
+
+/** The model a stored value really runs on for `engine` — for engine decisions and badges. */
+function resolveModelFor(model, engine) {
+  return providersLib.resolveModel(model, providerStore.registry(), { engine: engine || 'api' });
+}
+
+/**
+ * The engine a run uses is decided by its MODEL, not by a separate dial: a model of the
+ * CLI-login provider ("Claude (subscription)", type claude-subscription) runs on the tmux
+ * Subscription engine whenever tmux exists; every other provider — an Anthropic key, a
+ * gateway, anything OpenAI-compatible — runs headless. Without tmux the CLI login still
+ * works, headless. One rule for chats, tasks, bots and Telegram (providers.engineForModel).
+ */
+function runEngineFor(model) {
+  return providersLib.engineForModel(model, providerStore.registry(), { tmux: tmuxAvailable() });
+}
+
+/** Model the utility calls use (classifier/titles, compact, translate). */
+function utilityModel() {
+  return providerStore.registry().utilityModel || 'haiku';
+}
+
+/**
+ * Fold the bridge's ledger into a run's result meta. The CLI prices usage with ITS Claude
+ * table and reports a 200K window for any id it does not know — both wrong off Anthropic.
+ * `infos` = the lastRunTarget of every CLI invocation of this turn (auto-continues included).
+ */
+function withProviderUsage(resultMeta, infos) {
+  const list = (infos || []).filter(Boolean);
+  const last = list[list.length - 1];
+  if (!resultMeta || !last) return resultMeta;
+  const out = { ...resultMeta, provider: { id: last.providerId, label: last.providerLabel, model: last.modelId, routing: last.routing, ref: last.ref } };
+  if (last.providerType === 'openai-compatible' || (last.providerType === 'anthropic-compatible' && !CLAUDE_ALIAS_SET.has(last.modelId))) {
+    let cost = 0, any = false, priced = true;
+    for (const i of list) {
+      const u = i.runId ? providerStore.usageForRun(i.runId) : null;
+      if (!u) continue;
+      any = true; if (u.unpriced) priced = false; cost += u.cost || 0;
+    }
+    out.cost = any && priced ? Math.round(cost * 1e6) / 1e6 : null;
+    if (last.caps && last.caps.contextWindow) out.contextWindow = last.caps.contextWindow;
+  }
+  return out;
+}
+const CLAUDE_ALIAS_SET = new Set(providersLib.CLAUDE_ALIASES);
+
+/** A model value an agent or API client sent, if it can run; else the fallback. */
+function validModelOr(value, fallback) {
+  if (typeof value !== 'string' || !value.trim()) return fallback;
+  return providersLib.isKnownModel(value.trim(), providerStore.registry()) ? value.trim() : fallback;
+}
+
+/** Comma list of the models an agent may name in create_task (capped — it rides an env var). */
+function modelChoicesForAgents() {
+  const c = providersLib.listChoices(providerStore.registry());
+  const refs = [];
+  for (const p of c.providers) for (const m of p.models) refs.push(m.alias && p.isDefault ? m.id : m.ref);
+  return refs.slice(0, 80).join(', ');
+}
+
+// A chat pinned to a provider that was deleted or switched off runs on the default
+// instead of failing — and says so, once per (chat, pinned model), not on every run.
+const _fallbackNoticed = new Set();
+function noticeProviderFallback(info, { ws, sessionId, tabId } = {}) {
+  if (!info || !info.fallback || !ws) return;
+  const key = `${sessionId}|${info.ref}|${info.fallback}`;
+  if (_fallbackNoticed.has(key)) return;
+  if (_fallbackNoticed.size > 1000) _fallbackNoticed.clear();
+  _fallbackNoticed.add(key);
+  try { ws.send(JSON.stringify({ type: 'provider_notice', kind: info.fallback, ref: info.ref, providerLabel: info.providerLabel, ...(tabId ? { tabId } : {}) })); } catch {}
+}
+
 // ============================================
 // EXECUTION ENGINES
 // ============================================
@@ -4291,6 +4544,9 @@ async function runCliSingle(p) {
 
   const cli = new ClaudeCLI({ cwd: workdir || WORKDIR });
   let pendingFork = !!forkSession; // only fork on first CLI call
+  // Where each CLI invocation of this turn went (provider, bridge run id) — the ledger
+  // behind withProviderUsage(); auto-continues are separate runs of the same turn.
+  const runInfos = [];
 
   // Run a single CLI invocation and return { resultData, sid, errorText, rateLimitInfo }
   const runOnce = (runPrompt, contentBlocks, resumeId) => new Promise((resolve) => {
@@ -4320,7 +4576,9 @@ async function runCliSingle(p) {
       CCS_INTERRUPT_SECRET: INTERRUPT_SECRET,
     };
 
-    cli.send({ prompt: runPrompt, contentBlocks, sessionId: resumeId, model, maxTurns: effectiveMaxTurns, systemPrompt: sp, mcpServers, allowedTools: tools, abortController, forkSession: useFork, extraEnv: interruptEnv, extraSettings: interruptHookSettings, name, effort })
+    const _h = cli.send({ prompt: runPrompt, contentBlocks, sessionId: resumeId, model, maxTurns: effectiveMaxTurns, systemPrompt: sp, mcpServers, allowedTools: tools, abortController, forkSession: useFork, extraEnv: interruptEnv, extraSettings: interruptHookSettings, name, effort, runMeta: { purpose: 'chat', sessionId } });
+    runInfos.push(cli.lastRunTarget);
+    _h
       .onText(t => {
         fullText += t;
         { const _cb = (chatBuffers.get(sessionId) || '') + t; chatBuffers.set(sessionId, _cb.length > MAX_CHAT_BUFFER ? _cb.slice(-MAX_CHAT_BUFFER) : _cb); }
@@ -4648,14 +4906,14 @@ async function runCliSingle(p) {
   try { if (fullText) stmts.addMsg.run(sessionId, 'assistant', 'text', fullText, null, null, null, null); } catch (e) { log.error('[THINKING-SAVE-ERR] CLI text save failed', { sessionId, error: e.message }); }
   try { stmts.setPartialText.run(null, sessionId); } catch {}
   const _modelInfo = lastResult?.modelUsage ? Object.values(lastResult.modelUsage)[0] : null;
-  const resultMeta = lastResult ? {
+  const resultMeta = withProviderUsage(lastResult ? {
     cost: totalCostUsd || lastResult.total_cost_usd,
     usage: lastResult.usage,
     lastTurnUsage,
     numTurns: lastResult.num_turns,
     durationMs: lastResult.duration_ms,
     contextWindow: _modelInfo?.contextWindow || 0,
-  } : null;
+  } : null, runInfos);
   return { cid: newCid, completed: lastResult?.subtype === 'success', resultMeta };
 }
 
@@ -5081,7 +5339,7 @@ async function pickRoomSeating({ cwd, model, prompt, mode, bots, abortController
         .send({
           prompt: botsLogic.seatingPrompt({ prompt, mode, bots }),
           model, maxTurns: 1, allowedTools: [], tools: '', settingSources: '',
-          abortController: ac, jsonSchema: botsLogic.SEATING_SCHEMA,
+          abortController: ac, jsonSchema: botsLogic.SEATING_SCHEMA, runMeta: { purpose: 'utility' },
         })
         .onText(t => { out += t; })
         .onTool((name, input) => { if (name === 'StructuredOutput' && input) out = typeof input === 'string' ? input : JSON.stringify(input); })
@@ -5110,8 +5368,10 @@ function seatingNote({ room, skipped }) {
 
 async function runConversationRoom(p, { bots, prompt, rosterBots }) {
   const { mcpServers, model, maxTurns, ws, sessionId, abortController, workdir, tabId, effort, userContent, engine, mode } = p;
-  // The engine THIS bot's turn runs on: its own choice (web chat only, see botsLogic.botEngine), else the chat's.
-  const botEngine = (bot) => botsLogic.botEngine(bot, engine, { enabled: !!p.perBotEngine, tmux: tmuxAvailable() });
+  // The engine THIS bot's turn runs on follows its model (runEngineFor) — its own, else the
+  // chat's. Web chat only (perBotEngine): Telegram hands the runner a stand-in socket, and a
+  // tmux pane must not start behind it, so there every bot follows the chat's engine.
+  const botEngine = (bot) => (p.perBotEngine ? runEngineFor((bot && bot.model) || model) : (engine === 'subscription' ? 'subscription' : 'api'));
   const cli = new ClaudeCLI({ cwd: workdir || WORKDIR });
   const send = (o) => { try { ws.send(JSON.stringify({ ...o, ...(tabId ? { tabId } : {}) })); } catch {} };
   const save = (text, agentId) => { try { stmts.addMsg.run(sessionId, 'assistant', 'text', text, null, agentId, null, null); } catch {} };
@@ -5245,7 +5505,7 @@ async function runConversationRoom(p, { bots, prompt, rosterBots }) {
         ir = await runInteractiveSingle({
           prompt: botPrompt,
           systemPrompt: botsLogic.buildBotSystemPrompt(bot, rosterBots, botLangName(), { discussion: !deliverable }),
-          model: botsLogic.botModel(bot, 'subscription', model),
+          model: botsLogic.botModel(bot, 'subscription', model), effort,
           ws,
           sessionId: roomTmuxId,
           abortController,
@@ -5283,6 +5543,7 @@ async function runConversationRoom(p, { bots, prompt, rosterBots }) {
           // multiply its cost by the size of the room.
           contentBlocks: first && attachments.length ? attachments : null,
           model: botsLogic.botModel(bot, 'api', model),
+          runMeta: { purpose: 'room', sessionId, botId: bot.id },
           maxTurns: deliverable ? closeCap : turnCap,
           systemPrompt: botsLogic.buildBotSystemPrompt(bot, rosterBots, botLangName(), { discussion: !deliverable }),
           // No _ccs_bots: the room is the dispatcher. See the invariants above.
@@ -5459,7 +5720,8 @@ async function runConversationRoom(p, { bots, prompt, rosterBots }) {
 
 async function runBotTurns(p, { bots, prompt, rosterBots }) {
   const { mcpServers, model, maxTurns, ws, sessionId, abortController, claudeSessionId, workdir, tabId, effort, userContent, engine } = p;
-  const botEngine = (bot) => botsLogic.botEngine(bot, engine, { enabled: !!p.perBotEngine, tmux: tmuxAvailable() });
+  // Same rule as the room: the bot's model decides its engine (web chat only).
+  const botEngine = (bot) => (p.perBotEngine ? runEngineFor((bot && bot.model) || model) : (engine === 'subscription' ? 'subscription' : 'api'));
   const cli = new ClaudeCLI({ cwd: workdir || WORKDIR });
   // Same tool set as a normal turn, plus the internal MCP tools — without
   // check_user_messages a bot cannot see a clarification the user sends mid-run.
@@ -5622,7 +5884,7 @@ async function runBotTurns(p, { bots, prompt, rosterBots }) {
         ir = await runInteractiveSingle({
           prompt: botPrompt + standing,
           systemPrompt: botSp,
-          model: botsLogic.botModel(bot, 'subscription', model),
+          model: botsLogic.botModel(bot, 'subscription', model), effort,
           ws,
           sessionId: botTmuxId,
           abortController,
@@ -5670,6 +5932,7 @@ async function runBotTurns(p, { bots, prompt, rosterBots }) {
         sessionId: botSession,
         // A bot may pin its own model; otherwise it follows the chat's.
         model: botsLogic.botModel(bot, 'api', model),
+        runMeta: { purpose: 'bot', sessionId, botId: bot.id },
         maxTurns: turnCap,
         // Only applied when there is no session to resume — that is exactly why each
         // bot needs its own session rather than sharing the chat's.
@@ -5840,7 +6103,7 @@ async function runMultiAgent(p) {
     //   tools=''         → disables all built-in tools (Read, Bash, …)
     //   settingSources='' → skips user/project/local CLAUDE.md and skills
     // StructuredOutput is injected by --json-schema and remains available.
-    cli.send({ prompt:planPrompt, sessionId: currentSessionId, model, maxTurns:1, allowedTools:[], tools:'', settingSources:'', abortController, effort, jsonSchema: planSchema })
+    cli.send({ prompt:planPrompt, sessionId: currentSessionId, model, maxTurns:1, allowedTools:[], tools:'', settingSources:'', abortController, effort, jsonSchema: planSchema, runMeta: { purpose: 'multi', sessionId } })
       .onText(t => { planText+=t; })
       // With --json-schema the model emits the result via the synthetic
       // "StructuredOutput" tool_use rather than plain text. Capture its input
@@ -5989,7 +6252,7 @@ async function runMultiAgent(p) {
             // worker would pay for it once per agent.
             contentBlocks: (agentContinues === 0 && isFirstWave && Array.isArray(userContent)) ? userContent : null,
             sessionId: agentSessionId, model, maxTurns:agentTurnCap, systemPrompt:agentSp, mcpServers, allowedTools:agentTools, abortController, forkSession: agentFork, effort,
-            extraEnv: agentInterruptEnv, extraSettings: agentInterruptSettings })
+            extraEnv: agentInterruptEnv, extraSettings: agentInterruptSettings, runMeta: { purpose: 'multi', sessionId } })
             .onText(t => { agentText+=t; { const _cb = (chatBuffers.get(sessionId) || '') + t; chatBuffers.set(sessionId, _cb.length > MAX_CHAT_BUFFER ? _cb.slice(-MAX_CHAT_BUFFER) : _cb); } try { ws.send(JSON.stringify({ type:'text', text:t, agent:agent.id, ...(tabId ? { tabId } : {}) })); } catch {} })
             .onTool((n,i) => { if (n !== 'ask_user' && n !== 'notify_user' && n !== 'set_ui_state') { try { ws.send(JSON.stringify({ type:'tool', tool:n, input:(i||'').substring(0,600), agent:agent.id, ...(tabId ? { tabId } : {}) })); } catch {} } try { stmts.addMsg.run(sessionId,'assistant','tool',(i||'').substring(0,500),n,agent.id,null,null); } catch {} })
             .onResult(r => { agentResult = r; })
@@ -6090,7 +6353,7 @@ Provide a clear summary of what was accomplished. Be concise.`;
   await new Promise(res => {
     let _settled = false;
     const _res = () => { if (!_settled) { _settled = true; res(); } };
-    cli.send({ prompt:summaryPrompt, sessionId: currentSessionId, model, maxTurns:1, allowedTools:[], abortController, effort })
+    cli.send({ prompt:summaryPrompt, sessionId: currentSessionId, model, maxTurns:1, allowedTools:[], abortController, effort, runMeta: { purpose: 'multi', sessionId } })
       .onText(t => { summaryText+=t; { const _cb = (chatBuffers.get(sessionId) || '') + t; chatBuffers.set(sessionId, _cb.length > MAX_CHAT_BUFFER ? _cb.slice(-MAX_CHAT_BUFFER) : _cb); } try { ws.send(JSON.stringify({ type:'text', text:t, agent:'summarizer', ...(tabId ? { tabId } : {}) })); } catch {} })
       .onSessionId(sid => { currentSessionId = sid; try { stmts.updateClaudeId.run(sid, sessionId); } catch {} })
       .onError(() => _res())
@@ -6470,7 +6733,7 @@ app.post('/api/internal/task-manager', express.json({ limit: '1mb' }), (req, res
           0,  // sort_order
           (chain_id ? callerTask?.session_id : null) || null, // session_id — only inherit for chain tasks
           workdir,
-          model || callerTask?.model || 'sonnet',
+          validModelOr(model, null) || callerTask?.model || 'sonnet',
           mode || callerTask?.mode || 'auto',
           agent_mode || callerTask?.agent_mode || 'single',
           max_turns || callerTask?.max_turns || UNATTENDED_MAX_TURNS,
@@ -6554,7 +6817,7 @@ app.post('/api/internal/task-manager', express.json({ limit: '1mb' }), (req, res
         // Create chain + shared session
         const chainId = genId();
         const chainSessionId = genId();
-        const effectiveModel = chainModel || callerTask?.model || 'sonnet';
+        const effectiveModel = validModelOr(chainModel, null) || callerTask?.model || 'sonnet';
 
         // One tree for the chain, same as the REST door. GIT_UNAVAILABLE is a 400, not
         // a throw and not a 200 body: mcp-task-manager.js only rejects on
@@ -6606,7 +6869,7 @@ app.post('/api/internal/task-manager', express.json({ limit: '1mb' }), (req, res
             i * 1000, // sort_order
             chainSessionId,
             _mchainWd,
-            td.model || effectiveModel,
+            validModelOr(td.model, null) || effectiveModel,
             'auto', 'single',
             td.max_turns || UNATTENDED_MAX_TURNS,
             null, // attachments
@@ -6956,8 +7219,7 @@ app.use(express.static(path.join(__dirname, 'public')));
 app.get('/api/lang', (req, res) => {
   // Merged, not local: the settings catalog documents `lang` as merge:'merged' and
   // the resolver reports it that way, so a value living only in the global
-  // ~/.claude/config.json has to reach the browser too. `defaultEngine` at
-  // /api/default-engine already reads it merged; this endpoint did not.
+  // ~/.claude/config.json has to reach the browser too.
   const c = loadMergedConfig();
   res.json({ lang: c.lang || 'en' });
 });
@@ -6973,16 +7235,6 @@ app.put('/api/lang', express.json(), (req, res) => {
   res.json({ ok: true });
 });
 
-// Global default engine for NEW chats/tasks ('api' | 'subscription'). Per-item
-// run_engine override still persists; this only seeds fresh selectors.
-app.put('/api/default-engine', express.json(), (req, res) => {
-  const e = req.body.engine === 'subscription' ? 'subscription' : 'api';
-  const c = loadConfig();
-  c.defaultEngine = e;
-  saveConfig(c);
-  res.json({ ok: true, defaultEngine: e });
-});
-
 // ─── Translate via Claude CLI ─────────────────────────────────────────────────
 // One-shot translation using haiku model, no session persistence.
 // Source text is written to a temp file to avoid OS ARG_MAX limits on large thinking blocks.
@@ -6994,9 +7246,17 @@ app.post('/api/translate', express.json({ limit: '500kb' }), (req, res) => {
   const langName = LANG_NAMES[targetLang] || 'English';
 
   const bin = claudeCli.claudeBin;
+  // Routed like every other run (the utility model, on its provider); the only direct
+  // spawn left outside ClaudeCLI.send, so it asks the same hook itself.
+  const target = ClaudeCLI.resolveRunTarget({ model: utilityModel(), engine: 'api', meta: { purpose: 'utility' } });
+  if (target && target.error) return res.status(502).json({ error: 'Translation failed', detail: target.error });
   const env = { ...process.env };
   delete env.CLAUDECODE;
+  if (target && target.runEnv) providersLib.applyRunEnv(env, target.runEnv);
+  // Same rule as claude-cli.js: this child has Read/Write on a prompt built from user text.
+  for (const k of ClaudeCLI.SERVER_ONLY_ENV) delete env[k];
   if (!env.ANTHROPIC_BASE_URL) delete env.ANTHROPIC_API_KEY;
+  const releaseTarget = () => { if (target && typeof target.release === 'function') { try { target.release(); } catch {} } };
 
   // Write source text to temp file — avoids CLI argument length limits
   const tmpId = `claude-translate-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
@@ -7010,9 +7270,10 @@ app.post('/api/translate', express.json({ limit: '500kb' }), (req, res) => {
   const prompt = `Read the file ${srcFile}. Translate the entire content to ${langName}. Write ONLY the pure translation (no comments, no explanations, preserve all line breaks and structure) to ${dstFile}.`;
   const args = [
     '--print',
-    '--model', 'haiku',
+    '--model', (target && target.cliModel) || 'haiku',
     '--max-turns', '3',
     '--no-session-persistence',
+    ...((target && target.extraArgs) || []),
     '--dangerously-skip-permissions',
     '--tools', 'Read,Write',
     '--output-format', 'text',
@@ -7034,6 +7295,7 @@ app.post('/api/translate', express.json({ limit: '500kb' }), (req, res) => {
 
   proc.on('close', code => {
     clearTimeout(timeout);
+    releaseTarget();
     if (responded) return;
     responded = true;
     try {
@@ -7060,6 +7322,7 @@ app.post('/api/translate', express.json({ limit: '500kb' }), (req, res) => {
 
   proc.on('error', err => {
     clearTimeout(timeout);
+    releaseTarget();
     if (responded) return;
     responded = true;
     console.error('[translate] spawn error', err.message);
@@ -7080,7 +7343,7 @@ app.get('/api/version', (_, res) => {
   // claudeCli: same up-front-capability idea as tmuxAvailable — lets the UI warn
   // before a chat send fails on a missing/unauthenticated local `claude` binary.
   const _ed = editorLinks.editorFor(loadMergedConfig().editor);
-  res.json({ version: pkg.version, name: pkg.name, tmuxAvailable: tmuxAvailable(), gitAvailable: WM.gitAvailable(), defaultEngine: (loadMergedConfig().defaultEngine === 'subscription' ? 'subscription' : 'api'), editor: { id: _ed.id, label: _ed.label }, claudeCli: ClaudeCLI.claudeCliStatus() });
+  res.json({ version: pkg.version, name: pkg.name, tmuxAvailable: tmuxAvailable(), gitAvailable: WM.gitAvailable(), editor: { id: _ed.id, label: _ed.label }, claudeCli: ClaudeCLI.claudeCliStatus() });
 });
 
 // Capability-checked, never OS-sniffed — the same pattern as tmuxAvailable for the
@@ -8312,7 +8575,7 @@ app.post('/api/sessions', (req, res) => {
   catch (e) { if (e.code === 'GIT_UNAVAILABLE') return res.status(400).json({ error: e.message }); throw e; }
   if (kind === 'terminal') {
     // loadConfig(), not loadMergedConfig(): the merged view is a whitelist of
-    // mcpServers/skills/slashCommands/lang/defaultEngine and does NOT carry
+    // mcpServers/skills/slashCommands/lang and does NOT carry
     // externalAgents — same reason /api/external-agents reads loadConfig().
     const agents = loadConfig().externalAgents || {};
     if (!terminalAgent || !supportsTerminal(agents[terminalAgent])) {
@@ -9106,7 +9369,8 @@ ${transcript}`;
 
       cli.send({
         prompt: compactPrompt,
-        model: 'haiku',
+        model: utilityModel(),
+        runMeta: { purpose: 'utility', sessionId: sid },
         maxTurns: 1,
         tools: '',
         mcpServers: {},
@@ -10773,12 +11037,15 @@ async function processTelegramChat({ sessionId, text, userId, chatId, threadId,
       mode,
       workdir,
       tabId: sessionId,
+      // The chat's own effort dial — Telegram used to drop it and run every turn on Auto.
+      effort: chatDefaults.effortToFlag(session.effort) || null,
     };
 
     // Check if the active project is a remote SSH project
     const _activeProj = findRemoteProject(workdir);
-    const _isSubscriptionEngine = (session.run_engine || 'api') === 'subscription';
-    const _botsAvail = botsLogic.botsAvailability({ remote: !!_activeProj, runEngine: session.run_engine });
+    // Same rule as the web chat: the model's provider decides the engine.
+    const _isSubscriptionEngine = runEngineFor(model) === 'subscription';
+    const _botsAvail = botsLogic.botsAvailability({ remote: !!_activeProj, runEngine: _isSubscriptionEngine ? 'subscription' : 'api' });
     if (tgBots.length && !_botsAvail.available) {
       // Bots run through the headless `api` engine only (runBotTurns spawns its own
       // ClaudeCLI per bot) — SSH and subscription/tmux sessions silently ran the
@@ -11083,7 +11350,7 @@ function initTelegramBot() {
   const tg = c.telegram;
   if (!tg || !tg.enabled || !tg.botToken) return;
 
-  telegramBot = new TelegramBot(db, { log, lang: c.lang || 'uk', getRoster: telegramRoster, isolateUnit: _isolateTelegramUnit });
+  telegramBot = new TelegramBot(db, { log, lang: c.lang || 'uk', getRoster: telegramRoster, isolateUnit: _isolateTelegramUnit, getModelChoices: () => providersLib.listChoices(providerStore.registry()) });
   telegramBot.acceptNewConnections = tg.acceptNewConnections !== false;
   _attachTelegramListeners(telegramBot);
 
@@ -11127,7 +11394,7 @@ app.post('/api/telegram/start', (req, res) => {
   }
 
   // Start new bot
-  telegramBot = new TelegramBot(db, { log, lang: c.lang || 'uk', getRoster: telegramRoster, isolateUnit: _isolateTelegramUnit });
+  telegramBot = new TelegramBot(db, { log, lang: c.lang || 'uk', getRoster: telegramRoster, isolateUnit: _isolateTelegramUnit, getModelChoices: () => providersLib.listChoices(providerStore.registry()) });
   telegramBot.acceptNewConnections = c.telegram.acceptNewConnections !== false;
   _attachTelegramListeners(telegramBot);
 
@@ -11524,6 +11791,218 @@ app.get('/api/models', async (req, res) => {
   res.json({ models: r.models, ...(r.error ? { error: r.error } : {}), ...(r.stale ? { stale: true } : {}) });
 });
 
+// ─── Providers (providers.js / providers-store.js / llm-bridge) ─────────────────
+// Keys go in, never out: every answer is providerStore.publicProvider() (hasKey, masked
+// secret headers). Model ids carry `/` and `:`, so they travel in the body or the
+// query string, never as a path segment.
+function providersPayload() {
+  const pub = providerStore.publicList();
+  return {
+    ...pub,
+    presets: providersLib.PRESETS,
+    dialects: providersLib.DIALECTS,
+    bridge: { running: bridgeUp(), error: bridgeUp() ? null : (llmBridgeError || 'starting') },
+    lastStatus: providerStore.lastStatusByProvider(),
+  };
+}
+
+async function refreshProviderCatalog(id) {
+  const p = providerStore.get(id);
+  if (!p) return { ok: false, error: 'not_found' };
+  if (p.type === 'claude-subscription') {
+    const st = require('./claude-cli').claudeCliStatus();
+    const lastTest = { ok: st.available && st.authenticated, at: Date.now(), error: !st.available ? 'cli_missing' : (!st.authenticated ? 'not_logged_in' : null) };
+    providerStore.update(id, { lastTest });
+    return { ok: lastTest.ok, total: 0, noCatalog: true, error: lastTest.error };
+  }
+  const r = await providersCatalog.fetchCatalog(p);
+  let merged = null;
+  if (r.ok && r.models.length) merged = providerStore.upsertCatalog(id, r.models);
+  providerStore.update(id, { lastTest: { ok: r.ok, at: Date.now(), models: r.models.length, error: r.error || null, noCatalog: !!r.noCatalog } });
+  return { ok: r.ok, total: r.models.length, added: merged ? merged.added : 0, autoEnabled: merged ? merged.autoEnabled : false, noCatalog: !!r.noCatalog, error: r.error || null };
+}
+
+/** Two real requests through the bridge: a forced tool call and a plain reply. */
+async function probeProviderModel(providerId, modelId) {
+  if (!bridgeUp()) return { ok: false, error: 'bridge_down' };
+  const t = providersLib.resolveModel(providersLib.formatModelRef(providerId, modelId), providerStore.registry(), { engine: 'api' });
+  if (!t.ok || t.fallback || t.routing !== 'bridge') return { ok: false, error: t.error || t.fallback || 'not_probeable' };
+  const ctx = providersLib.buildRunCtx(t, { purpose: 'probe' });
+  const token = llmBridge.registerRun(ctx);
+  const call = async (body) => {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), 90000);
+    const t0 = Date.now();
+    try {
+      const r = await fetch(`${llmBridge.baseUrl()}/v1/messages`, { method: 'POST', signal: ctl.signal,
+        headers: { 'content-type': 'application/json', 'x-api-key': token, 'anthropic-version': '2023-06-01' },
+        body: JSON.stringify({ model: t.cliModel, max_tokens: 512, ...body }) });
+      const j = await r.json().catch(() => null);
+      return { status: r.status, body: j, ms: Date.now() - t0 };
+    } finally { clearTimeout(timer); }
+  };
+  try {
+    const tool = await call({
+      messages: [{ role: 'user', content: 'Connectivity probe. Call the tool `ping` with value 7. Do not answer in text.' }],
+      tools: [{ name: 'ping', description: 'Connectivity probe — call it with the number you were given.', input_schema: { type: 'object', properties: { value: { type: 'integer' } }, required: ['value'] } }],
+      tool_choice: { type: 'any' },
+    });
+    const text = await call({ messages: [{ role: 'user', content: 'Reply with exactly the word OK and nothing else.' }] });
+    const errOf = (x) => (x.status >= 400 ? (x.body && x.body.error && x.body.error.message) || `HTTP ${x.status}` : null);
+    const use = tool.body && Array.isArray(tool.body.content) ? tool.body.content.find(b => b.type === 'tool_use') : null;
+    const txt = text.body && Array.isArray(text.body.content) ? text.body.content.filter(b => b.type === 'text').map(b => b.text).join('') : '';
+    const verified = {
+      at: Date.now(),
+      tools: !!(use && use.name === 'ping' && Number(use.input && use.input.value) === 7),
+      text: /\bOK\b/i.test(txt),
+      latencyMs: text.ms,
+      error: errOf(tool) || errOf(text),
+    };
+    providerStore.setModel(providerId, modelId, { verified });
+    return { ok: verified.text || verified.tools, verified };
+  } catch (e) {
+    return { ok: false, error: e.name === 'AbortError' ? 'timeout' : e.message };
+  } finally {
+    llmBridge.releaseRun(token, { graceMs: 0 });
+  }
+}
+
+app.get('/api/providers', (req, res) => res.json(providersPayload()));
+
+app.post('/api/providers', async (req, res) => {
+  const v = providersLib.validateProviderInput(req.body || {}, { creating: true });
+  if (v.errors.length) return res.status(400).json({ error: 'invalid', fields: v.errors });
+  try { providerStore.create(v.value); }
+  catch (e) { if (e.code === 'exists') return res.status(409).json({ error: 'exists' }); throw e; }
+  const refresh = await refreshProviderCatalog(v.value.id).catch(e => ({ ok: false, error: e.message }));
+  res.json({ ok: true, provider: providerStore.publicProvider(providerStore.get(v.value.id)), refresh });
+});
+
+app.put('/api/providers/:id', (req, res) => {
+  const cur = providerStore.get(req.params.id);
+  if (!cur) return res.status(404).json({ error: 'not_found' });
+  const body = req.body || {};
+  // The CLI-login row has no URL, key or type to edit — only whether it is offered.
+  const raw = cur.type === 'claude-subscription' ? { enabled: body.enabled } : body;
+  const v = providersLib.validateProviderInput(raw, { creating: false });
+  if (v.errors.length) return res.status(400).json({ error: 'invalid', fields: v.errors });
+  providerStore.update(cur.id, { ...v.value, clearApiKey: cur.type !== 'claude-subscription' && body.clearApiKey === true });
+  const reg = providerStore.registry();
+  if (v.value.enabled === false && reg.defaultProviderId === cur.id) providerStore.setDefault(providersLib.BUILTIN_CLAUDE_ID);
+  refreshBridgeProviders();
+  res.json({ ok: true, provider: providerStore.publicProvider(providerStore.get(cur.id)) });
+});
+
+app.delete('/api/providers/:id', (req, res) => {
+  if (req.params.id === providersLib.BUILTIN_CLAUDE_ID) return res.status(400).json({ error: 'builtin' });
+  if (!providerStore.get(req.params.id)) return res.status(404).json({ error: 'not_found' });
+  providerStore.remove(req.params.id);
+  res.json({ ok: true });
+});
+
+app.post('/api/providers/:id/default', (req, res) => {
+  if (!providerStore.setDefault(req.params.id)) return res.status(400).json({ error: 'unavailable' });
+  res.json({ ok: true, defaultProviderId: req.params.id });
+});
+
+app.put('/api/providers-settings', (req, res) => {
+  const { utilityModel: um } = req.body || {};
+  if (um !== undefined) {
+    if (um !== '' && um !== null && !providersLib.isKnownModel(String(um), providerStore.registry())) return res.status(400).json({ error: 'invalid', fields: ['utilityModel'] });
+    providerStore.setSetting('utilityModel', um || '');
+  }
+  res.json({ ok: true, utilityModel: providerStore.registry().utilityModel });
+});
+
+app.post('/api/providers/:id/test', async (req, res) => {
+  if (!providerStore.get(req.params.id)) return res.status(404).json({ error: 'not_found' });
+  res.json(await refreshProviderCatalog(req.params.id).catch(e => ({ ok: false, error: e.message })));
+});
+
+// Test a DRAFT before saving it (the SSH-host "test-new" pattern). A blank key on an
+// existing id means "the stored one" — the form never receives the key to resend.
+app.post('/api/providers-test', async (req, res) => {
+  const body = req.body || {};
+  const v = providersLib.validateProviderInput({ ...body, id: undefined }, { creating: false });
+  if (v.errors.length) return res.status(400).json({ error: 'invalid', fields: v.errors });
+  const stored = body.id ? providerStore.get(String(body.id)) : null;
+  const type = v.value.type || (stored && stored.type);
+  const baseUrl = v.value.baseUrl || (stored && stored.baseUrl);
+  // The stored key and header secrets are reused ONLY against the endpoint they were saved
+  // for. Otherwise this endpoint would hand any saved key to whatever URL a request names.
+  const sameEndpoint = !!stored && baseUrl === stored.baseUrl && type === stored.type;
+  const headers = {};
+  for (const [k, hv] of Object.entries(v.value.headers || (sameEndpoint ? stored.headers : {}) || {})) {
+    if (hv === '***') { if (sameEndpoint && stored.headers[k] !== undefined) headers[k] = stored.headers[k]; }
+    else headers[k] = hv;
+  }
+  const draft = { type, baseUrl, headers,
+    apiKey: v.value.apiKey || (sameEndpoint ? stored.apiKey : '') || '',
+    authScheme: v.value.authScheme || (stored && stored.authScheme) || 'bearer' };
+  if (!draft.type || !draft.baseUrl) return res.status(400).json({ error: 'invalid', fields: ['baseUrl'] });
+  const r = await providersCatalog.fetchCatalog(draft).catch(e => ({ ok: false, models: [], error: e.message }));
+  res.json({ ok: r.ok, total: r.models.length, sample: r.models.slice(0, 8).map(m => m.id), noCatalog: !!r.noCatalog, error: r.error || null });
+});
+
+app.post('/api/providers/:id/models/refresh', async (req, res) => {
+  if (!providerStore.get(req.params.id)) return res.status(404).json({ error: 'not_found' });
+  const r = await refreshProviderCatalog(req.params.id).catch(e => ({ ok: false, error: e.message }));
+  res.json({ ...r, provider: providerStore.publicProvider(providerStore.get(req.params.id)) });
+});
+
+app.post('/api/providers/:id/models', (req, res) => {
+  const p = providerStore.get(req.params.id);
+  if (!p) return res.status(404).json({ error: 'not_found' });
+  if (p.type === 'claude-subscription') return res.status(400).json({ error: 'builtin' });
+  const { modelId, label, caps } = req.body || {};
+  const m = providerStore.addManualModel(p.id, String(modelId || '').trim(), { label, caps });
+  if (!m) return res.status(400).json({ error: 'invalid', fields: ['modelId'] });
+  res.json({ ok: true, model: m });
+});
+
+app.put('/api/providers/:id/models', (req, res) => {
+  const { modelId, enabled, label, caps, pricing } = req.body || {};
+  const m = providerStore.setModel(req.params.id, String(modelId || ''), { enabled, label, caps, pricing });
+  if (!m) return res.status(404).json({ error: 'not_found' });
+  res.json({ ok: true, model: m });
+});
+
+// Bulk on/off for a big catalogue: { modelIds:[…], enabled }.
+app.put('/api/providers/:id/models/bulk', (req, res) => {
+  const { modelIds, enabled } = req.body || {};
+  if (!Array.isArray(modelIds) || modelIds.length > 2000) return res.status(400).json({ error: 'invalid' });
+  let n = 0;
+  for (const id of modelIds) if (providerStore.setModel(req.params.id, String(id), { enabled: !!enabled })) n++;
+  res.json({ ok: true, changed: n });
+});
+
+app.delete('/api/providers/:id/models', (req, res) => {
+  const modelId = String(req.query.modelId || '');
+  if (!providerStore.removeModel(req.params.id, modelId)) return res.status(404).json({ error: 'not_found' });
+  res.json({ ok: true });
+});
+
+app.post('/api/providers/:id/models/probe', async (req, res) => {
+  const { modelId } = req.body || {};
+  if (!providerStore.get(req.params.id)) return res.status(404).json({ error: 'not_found' });
+  res.json(await probeProviderModel(req.params.id, String(modelId || '')));
+});
+
+// What every model picker renders (chat toolbar, bot editor, Kanban, schedule, Telegram).
+app.get('/api/models/choices', (req, res) => {
+  res.json({ ...providersLib.listChoices(providerStore.registry()), bridge: { running: bridgeUp() } });
+});
+
+app.get('/api/llm-usage', (req, res) => {
+  res.json({ rows: providerStore.usageSummary(parseInt(req.query.days, 10) || 30) });
+});
+
+app.get('/api/llm-bridge/log', async (req, res) => {
+  if (!llmBridge) return res.json({ running: false, entries: [] });
+  try { res.json({ running: bridgeUp(), entries: await llmBridge.recentLog() }); }
+  catch (e) { res.json({ running: bridgeUp(), entries: [], error: e.message }); }
+});
+
 // A bot row carries the projects it is available in. The UI needs this to say
 // "also in Alpha, Beta" before an edit and to warn that a delete is global —
 // without it every bot list would cost one extra request per bot.
@@ -11595,8 +12074,15 @@ function saveBot(req, res, mode) {
     }
   }
 
-  if (body.model !== undefined && body.model !== null && body.model !== '' && !gatewayModels.MODEL_ID_RE.test(String(body.model))) {
-    return res.status(400).json({ error: 'model must be 1-100 characters of a-z, 0-9, . _ : / -' });
+  // providers.parseModelRef is the grammar every picker offers ("provider::model", ids with
+  // `@`/`+`); the older gateway-models pattern refused refs the bot editor itself lists.
+  if (body.model !== undefined && body.model !== null && body.model !== '' && !providersLib.parseModelRef(String(body.model))) {
+    return res.status(400).json({ error: 'model must be a model id or "provider::model" (letters, digits, . _ : / @ + -)' });
+  }
+  // A provider ref must name a provider that exists and is switched on — a bot saved
+  // against a typo would otherwise run every turn on the default and nobody would know.
+  if (body.model && String(body.model).includes('::') && !providersLib.isKnownModel(String(body.model), providerStore.registry())) {
+    return res.status(400).json({ error: 'model belongs to a provider that does not exist or is switched off' });
   }
 
   const runEngine = botsLogic.normalizeBotEngine(body.runEngine);
@@ -11615,12 +12101,17 @@ function saveBot(req, res, mode) {
     const prev = stmts.getBot.get(handle) || {};
     const keep = (key, fallback) => (body[key] === undefined ? fallback : body[key]);
     const jsonList = (v) => JSON.stringify(Array.isArray(v) ? v : []);
+    // There is no engine field any more — the model's provider decides (runEngineFor). An
+    // older client that still says "subscription" gets the same thing the boot migration
+    // gives stored bots: the model pinned to the CLI login.
+    let botModelVal = keep('model', prev.model) ? String(keep('model', prev.model)) : null;
+    if (runEngine === 'subscription') botModelVal = providersLib.toClaudeRef(botModelVal);
     stmts.upsertBot.run(
       handle,
       cleanLabel.substring(0, BOT_LABEL_MAX),
       String(keep('description', prev.description || '')).substring(0, BOT_DESC_MAX),
       engine,
-      keep('model', prev.model) ? String(keep('model', prev.model)) : null,
+      botModelVal,
       body.systemPrompt === undefined ? (prev.system_prompt || '') : prompt,
       body.activeSkills === undefined ? (prev.active_skills || '[]') : jsonList(body.activeSkills),
       body.activeMcp === undefined ? (prev.active_mcp || '[]') : jsonList(body.activeMcp),
@@ -11629,7 +12120,7 @@ function saveBot(req, res, mode) {
       Array.from(String(keep('avatar', prev.avatar || ''))).slice(0, 8).join(''),
       (body.isGlobal === undefined ? (prev.is_global ? 1 : 0) : (body.isGlobal ? 1 : 0)),
       (body.roomPriority === undefined ? (prev.room_priority ?? null) : (Number.isInteger(body.roomPriority) ? body.roomPriority : null)),
-      runEngine === undefined ? (prev.run_engine || null) : runEngine,
+      null,   // run_engine: no longer read (see above)
       roomTools === undefined ? (prev.room_tools || null) : roomTools,
     );
   } catch (e) {
@@ -12440,7 +12931,10 @@ wss.on('connection', (ws) => {
         }
       }
 
-      const { text:userMessage, attachments=[], skills:sIds=[], mcpServers:mIds=[], mode=_cd.mode, agentMode=_cd.agent, model=_cd.model, maxTurns=_cd.turns, workdir=null, reply_to=null, retry=false, autoSkill=false, effort=_cd.effort, engine='api' } = msg;
+      const { text:userMessage, attachments=[], skills:sIds=[], mcpServers:mIds=[], mode=_cd.mode, agentMode=_cd.agent, model=_cd.model, maxTurns=_cd.turns, workdir=null, reply_to=null, retry=false, autoSkill=false, effort=_cd.effort } = msg;
+      // The engine is not a dial any more: the model's provider decides it (runEngineFor).
+      // A frame's `engine` field — older cached SPAs still send one — is ignored.
+      const engine = runEngineFor(model);
       // Two different things, deliberately kept apart: `effort` is what the chat is
       // SET to (may be the spelled-out 'auto'), `_effortFlag` is what the CLI gets
       // (no flag at all for auto). Storing the flag would erase the difference
@@ -12530,8 +13024,9 @@ wss.on('connection', (ws) => {
         (effort === '' || effort == null) ? 'auto' : sqlVal(effort),   // '' only from an older client
         localSessionId); }
       catch (e) { log.error('updateConfig failed', { sessionId: localSessionId, mode, agentMode, model, mIdsLen: mIds.length, skillsLen: effectiveSkills.length, err: e.message, stack: e.stack }); throw e; }
-      // Persist engine choice (coerce anything other than 'subscription' to 'api')
-      try { db.prepare(`UPDATE sessions SET run_engine=? WHERE id=?`).run(engine === 'subscription' ? 'subscription' : 'api', localSessionId); } catch {}
+      // Persist the engine this turn ran on (derived from the model) — the session bar's
+      // Max badge and the engine-pane entry point read it.
+      try { db.prepare(`UPDATE sessions SET run_engine=? WHERE id=?`).run(engine, localSessionId); } catch {}
 
       // Auto-title: use LLM-generated title if available, otherwise smart-truncate message
       if (isNewSession || DEFAULT_SESSION_TITLES.has(existSess?.title)) {
@@ -13135,9 +13630,8 @@ wss.on('connection', (ws) => {
           workdir:    msg.workdir || _isess?.workdir     || undefined,
           mode:       _isess?.mode       || undefined,
           agentMode:  _isess?.agent_mode || undefined,
-          // Engine deliberately omitted — see the note on resume_interrupted. The client's
-          // interrupt frame is api-only by construction; a stored 'subscription' must not
-          // reroute it through the tmux engine behind the user's back.
+          // Engine deliberately omitted — it follows the model replayed above (runEngineFor),
+          // see the note on resume_interrupted.
           skills:     _isessSkills,
           mcpServers: _isessMcp,
         }).catch(err => log.error('processChat error', { message: err.message }));
@@ -13555,7 +14049,7 @@ wss.on('connection', (ws) => {
               // Same hardening as runMultiAgent's plan call: tools='' disables built-in tools,
               // settingSources='' skips CLAUDE.md + skills, --json-schema makes the model emit
               // via the synthetic StructuredOutput tool — captured in .onTool below.
-              cli.send({ prompt: planPrompt, sessionId: sanitizeSessionId(session?.claude_session_id), model: model || 'sonnet', maxTurns: 1, allowedTools: [], tools: '', settingSources: '', jsonSchema: planSchema })
+              cli.send({ prompt: planPrompt, sessionId: sanitizeSessionId(session?.claude_session_id), model: model || 'sonnet', maxTurns: 1, allowedTools: [], tools: '', settingSources: '', jsonSchema: planSchema, effort: effort || null, runMeta: { purpose: 'dispatch', sessionId: session?.id || null } })
                 .onText(t => { planText += t; })
                 .onTool((name, input) => { if (name === 'StructuredOutput' && input) planText = typeof input === 'string' ? input : JSON.stringify(input); })
                 .onError(() => { if (!done) { done = true; resolve(); } })
@@ -13830,11 +14324,9 @@ wss.on('connection', (ws) => {
         mode: sess.mode || 'auto', agentMode: sess.agent_mode || 'single',
         model: sess.model || 'sonnet',
         workdir: sess.workdir || undefined,
-        // Engine is deliberately NOT taken from the session row. The client sends
-        // `engine: 'api'` on every chat (Subscription is paused per-turn in the UI), so
-        // replaying a stored 'subscription' here would silently route the turn through the
-        // tmux engine for a message the UI considers API-only — and updateConfig would then
-        // write that engine back onto the row.
+        // No engine here: it follows the model (runEngineFor), so replaying the chat's
+        // own model is what keeps a subscription chat on the subscription and an API one
+        // on the API. The stored run_engine is only a record of the last turn.
       }).catch(err => log.error('resume_interrupted processChat error', { message: err.message }));
       return;
     }
diff --git a/telegram-bot-i18n.js b/telegram-bot-i18n.js
index 083104ae..75e5bf58 100644
--- a/telegram-bot-i18n.js
+++ b/telegram-bot-i18n.js
@@ -190,7 +190,7 @@ const BOT_I18N = {
     'time_ago_long': 'давно',
 
     // Help
-    'help_text': '📖 <b>Команди Claude Code Studio</b>\n\n<b>Навігація:</b>\n/projects — список проектів\n/project <code>&lt;n&gt;</code> — вибрати проект\n/chats — чати поточного проекту\n/chat <code>&lt;n&gt;</code> — відкрити чат\n/back — повернутися назад\n\n<b>Перегляд:</b>\n/last <code>[n]</code> — останні N повідомлень (5)\n/full — повна остання відповідь\n/tasks — завдання (Kanban)\n/bots — боти цього проєкту\n/files <code>[path]</code> — файли в workspace\n/cat <code>&lt;file&gt;</code> — вміст файлу\n/diff — git diff в workspace\n/log <code>[n]</code> — останні git коміти\n\n<b>Дії:</b>\n/new <code>[title]</code> — нова сесія\n/stop — зупинити поточне завдання\n\n<b>Remote Access:</b>\n/tunnel — керування доступом\n/url — показати публічний URL\n\n<b>Forum Mode:</b>\n/forum — налаштування Forum Mode\n\n<b>Налаштування:</b>\n/status — стан Studio\n/notify <code>on/off</code> — сповіщення\n/unlink — відключити цей пристрій',
+    'help_text': '📖 <b>Команди Claude Code Studio</b>\n\n<b>Навігація:</b>\n/projects — список проектів\n/project <code>&lt;n&gt;</code> — вибрати проект\n/chats — чати поточного проекту\n/chat <code>&lt;n&gt;</code> — відкрити чат\n/back — повернутися назад\n\n<b>Перегляд:</b>\n/last <code>[n]</code> — останні N повідомлень (5)\n/full — повна остання відповідь\n/tasks — завдання (Kanban)\n/bots — боти цього проєкту\n/files <code>[path]</code> — файли в workspace\n/cat <code>&lt;file&gt;</code> — вміст файлу\n/diff — git diff в workspace\n/log <code>[n]</code> — останні git коміти\n\n<b>Дії:</b>\n/new <code>[title]</code> — нова сесія\n/stop — зупинити поточне завдання\n/model — модель цього чату\n/effort — рівень міркування\n\n<b>Remote Access:</b>\n/tunnel — керування доступом\n/url — показати публічний URL\n\n<b>Forum Mode:</b>\n/forum — налаштування Forum Mode\n\n<b>Налаштування:</b>\n/status — стан Studio\n/notify <code>on/off</code> — сповіщення\n/unlink — відключити цей пристрій',
 
     // Back navigation
     'back_to_chats': '↩️ Повернулися до списку чатів. Введіть /chats',
@@ -335,6 +335,24 @@ const BOT_I18N = {
     'header_chat': '💬 <b>{title}</b>',
     'header_none': '📭 Нічого не обрано',
     'header_separator': ' / ',
+    // /model and /effort (providers)
+    'model_no_chat': '💬 Спочатку відкрийте чат — модель і рівень міркування належать чату.',
+    'model_unavailable': '⚠️ Список моделей зараз недоступний.',
+    'model_current': '🧠 Модель чату: <b>{model}</b>',
+    'model_pick_provider': 'Оберіть провайдера (★ — за замовчуванням):',
+    'model_mode_subscription': 'підписка',
+    'model_mode_api': 'API',
+    'model_pick_model': 'Моделі провайдера <b>{provider}</b>:',
+    'model_set': '✅ Модель чату: <b>{model}</b>. Діє з наступного повідомлення.',
+    'model_no_tools': '⚠ Ця модель без інструментів: вона не зможе читати й змінювати файли.',
+    'effort_current': '🎚 Рівень міркування: <b>{effort}</b>',
+    'effort_set': '✅ Рівень міркування: <b>{effort}</b>. Діє з наступного повідомлення.',
+    'effort_auto': 'Авто',
+    'effort_low': 'Низький',
+    'effort_medium': 'Середній',
+    'effort_high': 'Високий',
+    'effort_xhigh': 'Дуже високий',
+    'effort_max': 'Максимум',
   },
   en: {
     'rate_limit': '⚠️ Too many requests. Please wait a minute.',
@@ -507,7 +525,7 @@ const BOT_I18N = {
     'time_ago_day': '{n}d ago',
     'time_ago_long': 'long ago',
 
-    'help_text': '📖 <b>Claude Code Studio Commands</b>\n\n<b>Navigation:</b>\n/projects — list projects\n/project <code>&lt;n&gt;</code> — select project\n/chats — chats of current project\n/chat <code>&lt;n&gt;</code> — open chat\n/back — go back\n\n<b>View:</b>\n/last <code>[n]</code> — last N messages (5)\n/full — full last response\n/tasks — tasks (Kanban)\n/bots — bots of this project\n/files <code>[path]</code> — files in workspace\n/cat <code>&lt;file&gt;</code> — file contents\n/diff — git diff in workspace\n/log <code>[n]</code> — recent git commits\n\n<b>Actions:</b>\n/new <code>[title]</code> — new session\n/stop — stop current task\n\n<b>Remote Access:</b>\n/tunnel — manage remote access\n/url — show public URL\n\n<b>Forum Mode:</b>\n/forum — set up Forum Mode\n\n<b>Settings:</b>\n/status — Studio status\n/notify <code>on/off</code> — notifications\n/unlink — unlink this device',
+    'help_text': '📖 <b>Claude Code Studio Commands</b>\n\n<b>Navigation:</b>\n/projects — list projects\n/project <code>&lt;n&gt;</code> — select project\n/chats — chats of current project\n/chat <code>&lt;n&gt;</code> — open chat\n/back — go back\n\n<b>View:</b>\n/last <code>[n]</code> — last N messages (5)\n/full — full last response\n/tasks — tasks (Kanban)\n/bots — bots of this project\n/files <code>[path]</code> — files in workspace\n/cat <code>&lt;file&gt;</code> — file contents\n/diff — git diff in workspace\n/log <code>[n]</code> — recent git commits\n\n<b>Actions:</b>\n/new <code>[title]</code> — new session\n/stop — stop current task\n/model — this chat\'s model\n/effort — reasoning effort\n\n<b>Remote Access:</b>\n/tunnel — manage remote access\n/url — show public URL\n\n<b>Forum Mode:</b>\n/forum — set up Forum Mode\n\n<b>Settings:</b>\n/status — Studio status\n/notify <code>on/off</code> — notifications\n/unlink — unlink this device',
 
     'back_to_chats': '↩️ Back to chat list. Type /chats',
     'back_to_projects': '↩️ Back to project list. Type /projects',
@@ -647,6 +665,24 @@ const BOT_I18N = {
     'header_chat': '💬 <b>{title}</b>',
     'header_none': '📭 Nothing selected',
     'header_separator': ' / ',
+    // /model and /effort (providers)
+    'model_no_chat': '💬 Open a chat first — the model and the effort belong to a chat.',
+    'model_unavailable': '⚠️ The model list is unavailable right now.',
+    'model_current': '🧠 Chat model: <b>{model}</b>',
+    'model_pick_provider': 'Pick a provider (★ = default):',
+    'model_mode_subscription': 'subscription',
+    'model_mode_api': 'API',
+    'model_pick_model': 'Models of <b>{provider}</b>:',
+    'model_set': '✅ Chat model: <b>{model}</b>. Takes effect from the next message.',
+    'model_no_tools': '⚠ This model has no tools: it cannot read or change files.',
+    'effort_current': '🎚 Reasoning effort: <b>{effort}</b>',
+    'effort_set': '✅ Reasoning effort: <b>{effort}</b>. Takes effect from the next message.',
+    'effort_auto': 'Auto',
+    'effort_low': 'Low',
+    'effort_medium': 'Medium',
+    'effort_high': 'High',
+    'effort_xhigh': 'X-High',
+    'effort_max': 'Max',
   },
   ru: {
     'rate_limit': '⚠️ Слишком много запросов. Подождите минуту.',
@@ -819,7 +855,7 @@ const BOT_I18N = {
     'time_ago_day': '{n} д назад',
     'time_ago_long': 'давно',
 
-    'help_text': '📖 <b>Команды Claude Code Studio</b>\n\n<b>Навигация:</b>\n/projects — список проектов\n/project <code>&lt;n&gt;</code> — выбрать проект\n/chats — чаты текущего проекта\n/chat <code>&lt;n&gt;</code> — открыть чат\n/back — вернуться назад\n\n<b>Просмотр:</b>\n/last <code>[n]</code> — последние N сообщений (5)\n/full — полный последний ответ\n/tasks — задачи (Kanban)\n/bots — боты этого проекта\n/files <code>[path]</code> — файлы в workspace\n/cat <code>&lt;file&gt;</code> — содержимое файла\n/diff — git diff в workspace\n/log <code>[n]</code> — последние git коммиты\n\n<b>Действия:</b>\n/new <code>[title]</code> — новая сессия\n/stop — остановить текущую задачу\n\n<b>Remote Access:</b>\n/tunnel — управление доступом\n/url — показать публичный URL\n\n<b>Forum Mode:</b>\n/forum — настройка Forum Mode\n\n<b>Настройки:</b>\n/status — состояние Studio\n/notify <code>on/off</code> — уведомления\n/unlink — отключить это устройство',
+    'help_text': '📖 <b>Команды Claude Code Studio</b>\n\n<b>Навигация:</b>\n/projects — список проектов\n/project <code>&lt;n&gt;</code> — выбрать проект\n/chats — чаты текущего проекта\n/chat <code>&lt;n&gt;</code> — открыть чат\n/back — вернуться назад\n\n<b>Просмотр:</b>\n/last <code>[n]</code> — последние N сообщений (5)\n/full — полный последний ответ\n/tasks — задачи (Kanban)\n/bots — боты этого проекта\n/files <code>[path]</code> — файлы в workspace\n/cat <code>&lt;file&gt;</code> — содержимое файла\n/diff — git diff в workspace\n/log <code>[n]</code> — последние git коммиты\n\n<b>Действия:</b>\n/new <code>[title]</code> — новая сессия\n/stop — остановить текущую задачу\n/model — модель этого чата\n/effort — уровень рассуждения\n\n<b>Remote Access:</b>\n/tunnel — управление доступом\n/url — показать публичный URL\n\n<b>Forum Mode:</b>\n/forum — настройка Forum Mode\n\n<b>Настройки:</b>\n/status — состояние Studio\n/notify <code>on/off</code> — уведомления\n/unlink — отключить это устройство',
 
     'back_to_chats': '↩️ Вернулись к списку чатов. Введите /chats',
     'back_to_projects': '↩️ Вернулись к списку проектов. Введите /projects',
@@ -959,6 +995,24 @@ const BOT_I18N = {
     'header_chat': '💬 <b>{title}</b>',
     'header_none': '📭 Ничего не выбрано',
     'header_separator': ' / ',
+    // /model and /effort (providers)
+    'model_no_chat': '💬 Сначала откройте чат — модель и уровень рассуждения принадлежат чату.',
+    'model_unavailable': '⚠️ Список моделей сейчас недоступен.',
+    'model_current': '🧠 Модель чата: <b>{model}</b>',
+    'model_pick_provider': 'Выберите провайдера (★ — по умолчанию):',
+    'model_mode_subscription': 'подписка',
+    'model_mode_api': 'API',
+    'model_pick_model': 'Модели провайдера <b>{provider}</b>:',
+    'model_set': '✅ Модель чата: <b>{model}</b>. Действует со следующего сообщения.',
+    'model_no_tools': '⚠ У этой модели нет инструментов: она не сможет читать и менять файлы.',
+    'effort_current': '🎚 Уровень рассуждения: <b>{effort}</b>',
+    'effort_set': '✅ Уровень рассуждения: <b>{effort}</b>. Действует со следующего сообщения.',
+    'effort_auto': 'Авто',
+    'effort_low': 'Низкий',
+    'effort_medium': 'Средний',
+    'effort_high': 'Высокий',
+    'effort_xhigh': 'Очень высокий',
+    'effort_max': 'Максимум',
   },
   fr: {
     // Pairing & auth
@@ -1147,7 +1201,7 @@ const BOT_I18N = {
     'time_ago_long': 'il y a longtemps',
 
     // Help
-    'help_text': '📖 <b>Commandes Claude Code Studio</b>\n\n<b>Navigation :</b>\n/projects — liste des projets\n/project <code>&lt;n&gt;</code> — sélectionner un projet\n/chats — chats du projet actuel\n/chat <code>&lt;n&gt;</code> — ouvrir un chat\n/back — revenir en arrière\n\n<b>Affichage :</b>\n/last <code>[n]</code> — les N derniers messages (5)\n/full — dernière réponse complète\n/tasks — tâches (Kanban)\n/bots — bots de ce projet\n/files <code>[path]</code> — fichiers du workspace\n/cat <code>&lt;file&gt;</code> — contenu d\'un fichier\n/diff — git diff du workspace\n/log <code>[n]</code> — derniers commits git\n\n<b>Actions :</b>\n/new <code>[title]</code> — nouvelle session\n/stop — arrêter la tâche en cours\n\n<b>Remote Access :</b>\n/tunnel — gérer l\'accès distant\n/url — afficher l\'URL publique\n\n<b>Forum Mode :</b>\n/forum — configurer le Forum Mode\n\n<b>Paramètres :</b>\n/status — état de Studio\n/notify <code>on/off</code> — notifications\n/unlink — dissocier cet appareil',
+    'help_text': '📖 <b>Commandes Claude Code Studio</b>\n\n<b>Navigation :</b>\n/projects — liste des projets\n/project <code>&lt;n&gt;</code> — sélectionner un projet\n/chats — chats du projet actuel\n/chat <code>&lt;n&gt;</code> — ouvrir un chat\n/back — revenir en arrière\n\n<b>Affichage :</b>\n/last <code>[n]</code> — les N derniers messages (5)\n/full — dernière réponse complète\n/tasks — tâches (Kanban)\n/bots — bots de ce projet\n/files <code>[path]</code> — fichiers du workspace\n/cat <code>&lt;file&gt;</code> — contenu d\'un fichier\n/diff — git diff du workspace\n/log <code>[n]</code> — derniers commits git\n\n<b>Actions :</b>\n/new <code>[title]</code> — nouvelle session\n/stop — arrêter la tâche en cours\n/model — modèle de ce chat\n/effort — niveau de raisonnement\n\n<b>Remote Access :</b>\n/tunnel — gérer l\'accès distant\n/url — afficher l\'URL publique\n\n<b>Forum Mode :</b>\n/forum — configurer le Forum Mode\n\n<b>Paramètres :</b>\n/status — état de Studio\n/notify <code>on/off</code> — notifications\n/unlink — dissocier cet appareil',
 
     // Back navigation
     'back_to_chats': '↩️ Retour à la liste des chats. Tapez /chats',
@@ -1292,6 +1346,24 @@ const BOT_I18N = {
     'header_chat': '💬 <b>{title}</b>',
     'header_none': '📭 Rien de sélectionné',
     'header_separator': ' / ',
+    // /model and /effort (providers)
+    'model_no_chat': '💬 Ouvrez d’abord un chat — le modèle et l’effort appartiennent à un chat.',
+    'model_unavailable': '⚠️ La liste des modèles est indisponible pour le moment.',
+    'model_current': '🧠 Modèle du chat : <b>{model}</b>',
+    'model_pick_provider': 'Choisissez un fournisseur (★ = par défaut) :',
+    'model_mode_subscription': 'abonnement',
+    'model_mode_api': 'API',
+    'model_pick_model': 'Modèles de <b>{provider}</b> :',
+    'model_set': '✅ Modèle du chat : <b>{model}</b>. Effectif dès le prochain message.',
+    'model_no_tools': '⚠ Ce modèle n’a pas d’outils : il ne peut ni lire ni modifier les fichiers.',
+    'effort_current': '🎚 Effort de raisonnement : <b>{effort}</b>',
+    'effort_set': '✅ Effort de raisonnement : <b>{effort}</b>. Effectif dès le prochain message.',
+    'effort_auto': 'Auto',
+    'effort_low': 'Faible',
+    'effort_medium': 'Moyen',
+    'effort_high': 'Élevé',
+    'effort_xhigh': 'Très élevé',
+    'effort_max': 'Maximum',
   },
   he: {
     // Pairing & auth
@@ -1480,7 +1552,7 @@ const BOT_I18N = {
     'time_ago_long': 'מזמן',
 
     // Help
-    'help_text': '📖 <b>פקודות Claude Code Studio</b>\n\n<b>ניווט:</b>\n/projects — רשימת פרויקטים\n/project <code>&lt;n&gt;</code> — בחירת פרויקט\n/chats — צ\'אטים של הפרויקט הנוכחי\n/chat <code>&lt;n&gt;</code> — פתיחת צ\'אט\n/back — חזרה אחורה\n\n<b>תצוגה:</b>\n/last <code>[n]</code> — N ההודעות האחרונות (5)\n/full — התשובה האחרונה במלואה\n/tasks — משימות (Kanban)\n/bots — הבוטים של הפרויקט הזה\n/files <code>[path]</code> — קבצים ב-workspace\n/cat <code>&lt;file&gt;</code> — תוכן קובץ\n/diff — git diff ב-workspace\n/log <code>[n]</code> — קומיטים אחרונים\n\n<b>פעולות:</b>\n/new <code>[title]</code> — סשן חדש\n/stop — עצירת המשימה הנוכחית\n\n<b>Remote Access:</b>\n/tunnel — ניהול גישה מרחוק\n/url — הצגת ה-URL הציבורי\n\n<b>Forum Mode:</b>\n/forum — הגדרת Forum Mode\n\n<b>הגדרות:</b>\n/status — מצב Studio\n/notify <code>on/off</code> — התראות\n/unlink — ניתוק המכשיר הזה',
+    'help_text': '📖 <b>פקודות Claude Code Studio</b>\n\n<b>ניווט:</b>\n/projects — רשימת פרויקטים\n/project <code>&lt;n&gt;</code> — בחירת פרויקט\n/chats — צ\'אטים של הפרויקט הנוכחי\n/chat <code>&lt;n&gt;</code> — פתיחת צ\'אט\n/back — חזרה אחורה\n\n<b>תצוגה:</b>\n/last <code>[n]</code> — N ההודעות האחרונות (5)\n/full — התשובה האחרונה במלואה\n/tasks — משימות (Kanban)\n/bots — הבוטים של הפרויקט הזה\n/files <code>[path]</code> — קבצים ב-workspace\n/cat <code>&lt;file&gt;</code> — תוכן קובץ\n/diff — git diff ב-workspace\n/log <code>[n]</code> — קומיטים אחרונים\n\n<b>פעולות:</b>\n/new <code>[title]</code> — סשן חדש\n/stop — עצירת המשימה הנוכחית\n/model — המודל של הצ׳אט הזה\n/effort — רמת החשיבה\n\n<b>Remote Access:</b>\n/tunnel — ניהול גישה מרחוק\n/url — הצגת ה-URL הציבורי\n\n<b>Forum Mode:</b>\n/forum — הגדרת Forum Mode\n\n<b>הגדרות:</b>\n/status — מצב Studio\n/notify <code>on/off</code> — התראות\n/unlink — ניתוק המכשיר הזה',
 
     // Back navigation
     'back_to_chats': '↩️ חזרנו לרשימת הצ\'אטים. הקלידו /chats',
@@ -1625,6 +1697,24 @@ const BOT_I18N = {
     'header_chat': '💬 <b>{title}</b>',
     'header_none': '📭 לא נבחר כלום',
     'header_separator': ' / ',
+    // /model and /effort (providers)
+    'model_no_chat': '💬 פתח קודם צ׳אט — המודל ורמת החשיבה שייכים לצ׳אט.',
+    'model_unavailable': '⚠️ רשימת המודלים אינה זמינה כרגע.',
+    'model_current': '🧠 מודל הצ׳אט: <b>{model}</b>',
+    'model_pick_provider': 'בחר ספק (★ = ברירת מחדל):',
+    'model_mode_subscription': 'מנוי',
+    'model_mode_api': 'API',
+    'model_pick_model': 'המודלים של <b>{provider}</b>:',
+    'model_set': '✅ מודל הצ׳אט: <b>{model}</b>. בתוקף מההודעה הבאה.',
+    'model_no_tools': '⚠ למודל הזה אין כלים: הוא לא יכול לקרוא או לשנות קבצים.',
+    'effort_current': '🎚 רמת החשיבה: <b>{effort}</b>',
+    'effort_set': '✅ רמת החשיבה: <b>{effort}</b>. בתוקף מההודעה הבאה.',
+    'effort_auto': 'אוטומטי',
+    'effort_low': 'נמוכה',
+    'effort_medium': 'בינונית',
+    'effort_high': 'גבוהה',
+    'effort_xhigh': 'גבוהה מאוד',
+    'effort_max': 'מרבית',
   },
 };
 
diff --git a/telegram-bot.js b/telegram-bot.js
index b2dd4c8b..408ce81c 100644
--- a/telegram-bot.js
+++ b/telegram-bot.js
@@ -144,6 +144,9 @@ class TelegramBot extends EventEmitter {
     // Projects live in a JSON file that only server.js reads, so this arrives as a
     // callback rather than a query — same composition as the Forum module's facade.
     this._getRoster = typeof opts.getRoster === 'function' ? opts.getRoster : null;
+    // The model list /model offers (server.js → providers.listChoices). A callback for the
+    // same reason as getRoster: the provider registry lives in the server's store.
+    this._getModelChoices = typeof opts.getModelChoices === 'function' ? opts.getModelChoices : null;
 
     // In-memory state
     this._pairingCodes = new Map();  // code → { createdAt, expiresAt }
@@ -1026,6 +1029,8 @@ class TelegramBot extends EventEmitter {
       case '/full':    return this._cmdFull(chatId, userId);
       case '/status':  return this._cmdStatus(chatId, userId);
       case '/bots':    return this._cmdBots(chatId, userId);
+      case '/model':   return this._cmdModel(chatId, userId);
+      case '/effort':  return this._cmdEffort(chatId, userId);
       case '/tasks':   return this._cmdTasks(chatId, userId);
       case '/files':   return this._cmdFiles(chatId, userId, args);
       case '/cat':     return this._cmdCat(chatId, userId, args);
@@ -1118,6 +1123,101 @@ class TelegramBot extends EventEmitter {
     }
   }
 
+  // ─── /model and /effort ────────────────────────────────────────────────────
+  // The chat's own dials, the ones the web toolbar sets (sessions.model / sessions.effort) —
+  // Telegram used to have no way to change either. A model ref can outgrow the 64-byte
+  // callback_data ("openrouter::vendor/model-name"), so the buttons carry INDEXES into a
+  // per-user snapshot of the list, taken when the menu opens.
+  _modelLabel(value) {
+    const v = String(value || 'sonnet');
+    const c = this._getModelChoices ? this._getModelChoices() : null;
+    const i = v.indexOf('::');
+    const provs = (c && c.providers) || [];
+    const p = i === -1 ? provs.find(x => x.isDefault) : provs.find(x => x.id === v.slice(0, i));
+    const id = i === -1 ? v : v.slice(i + 2);
+    const m = p && (p.models || []).find(x => x.id === id);
+    const pl = p ? (p.builtin ? 'Claude' : p.label) : (i === -1 ? '' : v.slice(0, i));
+    return `${pl ? pl + ' · ' : ''}${m && !m.alias ? (m.label || m.id) : id}${p ? ' · ' + this._modeWord(p) : ''}`;
+  }
+
+  // How a provider is billed — and so which engine its models run on (server.js
+  // runEngineFor): the CLI login is the subscription, every other provider the API.
+  _modeWord(p) {
+    return this._t((p.mode || (p.type === 'claude-subscription' ? 'subscription' : 'api')) === 'subscription' ? 'model_mode_subscription' : 'model_mode_api');
+  }
+
+  async _cmdModel(chatId, userId) {
+    const ctx = this._getContext(userId);
+    const back = [{ text: this._t('btn_back_menu'), callback_data: 'm:menu' }];
+    if (!ctx.sessionId) return this._showScreen(chatId, userId, this._t('model_no_chat'), [back]);
+    const c = this._getModelChoices ? this._getModelChoices() : null;
+    if (!c || !Array.isArray(c.providers) || !c.providers.length) return this._showScreen(chatId, userId, this._t('model_unavailable'), [back]);
+    ctx.modelMenu = c.providers.map(p => ({
+      label: p.builtin ? 'Claude' : p.label, mode: this._modeWord(p), isDefault: !!p.isDefault,
+      models: (p.models || []).map(m => ({
+        // The default provider's aliases are stored bare, exactly as the toolbar chips send them.
+        value: (m.alias && p.isDefault) ? m.id : m.ref,
+        label: m.alias ? m.id : (m.label || m.id),
+        noTools: !!(m.caps && m.caps.tools === false),
+      })),
+    }));
+    const sess = this.db.prepare('SELECT model FROM sessions WHERE id = ?').get(ctx.sessionId);
+    const text = this._t('model_current', { model: this._escHtml(this._modelLabel(sess && sess.model)) }) + '\n\n' + this._t('model_pick_provider');
+    const rows = ctx.modelMenu.map((p, i) => [{ text: `${p.isDefault ? '★ ' : ''}${p.label} · ${p.mode}`.slice(0, 60), callback_data: `md:p:${i}:0` }]);
+    rows.push(back);
+    return this._showScreen(chatId, userId, text, rows);
+  }
+
+  async _routeModel(chatId, userId, data) {
+    const ctx = this._getContext(userId);
+    const menu = ctx.modelMenu;
+    if (!menu || !ctx.sessionId) return this._cmdModel(chatId, userId);
+    const PAGE = 8;
+    const parts = data.split(':');
+    if (parts[1] === 'p') {
+      const pi = parseInt(parts[2], 10), page = Math.max(0, parseInt(parts[3], 10) || 0);
+      const p = menu[pi];
+      if (!p) return this._cmdModel(chatId, userId);
+      const slice = p.models.slice(page * PAGE, page * PAGE + PAGE);
+      const rows = slice.map((m, k) => [{ text: `${m.label}${m.noTools ? ' ⚠' : ''}`.slice(0, 60), callback_data: `md:s:${pi}:${page * PAGE + k}` }]);
+      const nav = [];
+      if (page > 0) nav.push({ text: '‹', callback_data: `md:p:${pi}:${page - 1}` });
+      if ((page + 1) * PAGE < p.models.length) nav.push({ text: '›', callback_data: `md:p:${pi}:${page + 1}` });
+      if (nav.length) rows.push(nav);
+      rows.push([{ text: this._t('btn_back'), callback_data: 'md:root' }]);
+      return this._showScreen(chatId, userId, this._t('model_pick_model', { provider: this._escHtml(`${p.label} · ${p.mode}`) }), rows);
+    }
+    if (parts[1] === 's') {
+      const m = menu[parseInt(parts[2], 10)]?.models[parseInt(parts[3], 10)];
+      if (!m) return this._cmdModel(chatId, userId);
+      this.db.prepare('UPDATE sessions SET model = ? WHERE id = ?').run(m.value, ctx.sessionId);
+      return this._showScreen(chatId, userId, this._t('model_set', { model: this._escHtml(this._modelLabel(m.value)) }) + (m.noTools ? '\n\n' + this._t('model_no_tools') : ''),
+        [[{ text: this._t('btn_back_menu'), callback_data: 'm:menu' }]]);
+    }
+    return this._cmdModel(chatId, userId);
+  }
+
+  async _cmdEffort(chatId, userId) {
+    const ctx = this._getContext(userId);
+    const back = [{ text: this._t('btn_back_menu'), callback_data: 'm:menu' }];
+    if (!ctx.sessionId) return this._showScreen(chatId, userId, this._t('model_no_chat'), [back]);
+    const sess = this.db.prepare('SELECT effort FROM sessions WHERE id = ?').get(ctx.sessionId);
+    const cur = (sess && sess.effort) || 'auto';
+    const levels = ['auto', 'low', 'medium', 'high', 'xhigh', 'max'];
+    const rows = [levels.slice(0, 3), levels.slice(3)].map(row => row.map(v => ({ text: `${v === cur ? '• ' : ''}${this._t('effort_' + v)}`, callback_data: `ef:${v}` })));
+    rows.push(back);
+    return this._showScreen(chatId, userId, this._t('effort_current', { effort: this._t('effort_' + (levels.includes(cur) ? cur : 'auto')) }), rows);
+  }
+
+  async _routeEffort(chatId, userId, data) {
+    const ctx = this._getContext(userId);
+    const v = data.slice(3);
+    if (!ctx.sessionId || !['auto', 'low', 'medium', 'high', 'xhigh', 'max'].includes(v)) return this._cmdEffort(chatId, userId);
+    // 'auto' is stored as the word, not as '' — the web chat's rule (chat-defaults.js).
+    this.db.prepare('UPDATE sessions SET effort = ? WHERE id = ?').run(v, ctx.sessionId);
+    return this._showScreen(chatId, userId, this._t('effort_set', { effort: this._t('effort_' + v) }), [[{ text: this._t('btn_back_menu'), callback_data: 'm:menu' }]]);
+  }
+
   async _cmdProjects(chatId, userId) {
     return this._screenProjects(chatId, userId, 'p:list:0');
   }
@@ -1906,6 +2006,9 @@ class TelegramBot extends EventEmitter {
       if (data === 's:menu')       return this._screenSettings(chatId, userId, opts);
       if (data.startsWith('s:'))   return this._routeSettings(chatId, userId, data, opts);
       if (data.startsWith('tn:'))  return this._routeTunnel(chatId, userId, data, opts);
+      if (data === 'md:root')      return this._cmdModel(chatId, userId);
+      if (data.startsWith('md:'))  return this._routeModel(chatId, userId, data);
+      if (data.startsWith('ef:'))  return this._routeEffort(chatId, userId, data);
     } catch (err) {
       this.log.error(`[telegram] Callback error: ${err.message}`);
       await this._editScreen(chatId, msgId, this._t('error_prefix', { msg: this._escHtml(err.message) }), [[{ text: this._t('btn_back_menu'), callback_data: 'm:menu' }]]);
@@ -3474,6 +3577,8 @@ class TelegramBot extends EventEmitter {
         const ago = this._timeAgo(sess.updated_at);
         const msgCount = this.db.prepare('SELECT COUNT(*) as c FROM messages WHERE session_id = ?').get(ctx.sessionId)?.c || 0;
         text += `\n💬 <b>${this._escHtml(title)}</b>\n📊 ${msgCount} msg · ${ago}`;
+        const _m = this.db.prepare('SELECT model FROM sessions WHERE id = ?').get(ctx.sessionId);
+        text += `\n🧠 ${this._escHtml(this._modelLabel(_m && _m.model))} · /model`;
       }
     } else {
       text += `\n💬 <i>${this._t('error_no_session')}</i>`;
diff --git a/test/_api-provider-env.js b/test/_api-provider-env.js
new file mode 100644
index 00000000..105d0453
--- /dev/null
+++ b/test/_api-provider-env.js
@@ -0,0 +1,13 @@
+// Environment for a test server whose runs must go HEADLESS (the fake `claude` on PATH).
+//
+// The engine follows the model's provider (server.js runEngineFor): on an install with no
+// gateway the default provider is the CLI login, whose models run on the tmux Subscription
+// engine whenever tmux exists — which it does in CI. A suite that drives chats or tasks
+// through a fake headless `claude` would then silently run somewhere else, and only on
+// machines that have tmux and no ANTHROPIC_BASE_URL of their own. Seeding an API gateway as
+// the default provider pins the engine for everyone. The address is never contacted: the
+// fake CLI ignores it.
+module.exports = {
+  ANTHROPIC_BASE_URL: 'http://127.0.0.1:9',
+  ANTHROPIC_AUTH_TOKEN: 'test-gateway-token',
+};
diff --git a/test/bots-api.test.js b/test/bots-api.test.js
index cc394456..666702f8 100644
--- a/test/bots-api.test.js
+++ b/test/bots-api.test.js
@@ -140,19 +140,21 @@ async function api(method, url, body) {
     check('the description is truncated to its cap', r.json.description.length, 500);
   }
 
-  console.log('per-bot engine:');
+  console.log('no per-bot engine — an old "subscription" becomes a CLI-login model:');
   {
+    // The engine follows the model's provider (server.js runEngineFor). An older client that
+    // still sends runEngine:'subscription' gets its model pinned to the CLI login instead.
     const made = (await api('POST', '/api/bots', { label: 'Planner', runEngine: 'subscription' })).json;
-    check('a new bot can be pinned to the subscription engine', made.run_engine, 'subscription');
-    check('an ordinary bot follows the chat (no engine)', (await api('POST', '/api/bots', { label: 'Plain' })).json.run_engine, null);
-    check('a partial update keeps the engine', (await api('PUT', `/api/bots/${made.id}`, { label: 'Planner 2' })).json.run_engine, 'subscription');
-    check('an unknown engine is refused', (await api('PUT', `/api/bots/${made.id}`, { label: 'P', runEngine: 'codex' })).status, 400);
-    check('a refused update leaves the engine alone', (await api('GET', '/api/bots')).json.find(b => b.id === made.id).run_engine, 'subscription');
-    const exp = (await api('GET', '/api/bots/export')).json;
-    check('the export carries the engine', exp.bots.find(b => b.id === made.id).run_engine, 'subscription');
-    check('an empty value clears it back to "as the chat"', (await api('PUT', `/api/bots/${made.id}`, { label: 'P', runEngine: '' })).json.run_engine, null);
-    const imp = await api('POST', '/api/bots/import', { overwrite: true, bots: [{ id: made.id, label: 'Planner', run_engine: 'subscription' }] });
-    check('an import restores it', [imp.json.updated, (await api('GET', '/api/bots')).json.find(b => b.id === made.id).run_engine], [1, 'subscription']);
+    check('an old "subscription" bot is created on the CLI login\'s model, with no engine stored', [made.model, made.run_engine], ['claude::sonnet', null]);
+    const opus = (await api('POST', '/api/bots', { label: 'Opus planner', model: 'opus', runEngine: 'subscription' })).json;
+    check('…keeping its own alias', opus.model, 'claude::opus');
+    check('an ordinary bot stores neither', (await api('POST', '/api/bots', { label: 'Plain' })).json.run_engine, null);
+    check('a partial update keeps the model', (await api('PUT', `/api/bots/${made.id}`, { label: 'Planner 2' })).json.model, 'claude::sonnet');
+    check('an unknown engine is still refused', (await api('PUT', `/api/bots/${made.id}`, { label: 'P', runEngine: 'codex' })).status, 400);
+    check('an empty engine changes nothing', (await api('PUT', `/api/bots/${made.id}`, { label: 'P', runEngine: '' })).json.model, 'claude::sonnet');
+    const imp = await api('POST', '/api/bots/import', { overwrite: true, bots: [{ id: made.id, label: 'Planner', model: 'haiku', run_engine: 'subscription' }] });
+    const back = (await api('GET', '/api/bots')).json.find(b => b.id === made.id);
+    check('an old export file is imported the same way', [imp.json.updated, back.model, back.run_engine], [1, 'claude::haiku', null]);
   }
 
   console.log('per-bot model:');
diff --git a/test/bots.test.js b/test/bots.test.js
index 987d8bfc..cbc95050 100644
--- a/test/bots.test.js
+++ b/test/bots.test.js
@@ -6,7 +6,7 @@ const {
   parseMentions, renderRoster, languageClause, buildBotSystemPrompt, planDispatch, EVIDENCE_CLAUSE, ROSTER_MAX,
   seatingPrompt, parseSeating, shouldReseat, SEATING_SCHEMA, SEATING_REPICK_MIN_CHARS,
   roomTurnCap, renderTranscript, buildRoomHistory, currentTurnAttachments, closingRules, ROOM_BOT_MIN_TURNS,
-  normalizeBotEngine, botEngine, botModel, seatPlanner, PLANNER_HANDLE, PLAN_INTENT_RE,
+  normalizeBotEngine, botModel, seatPlanner, PLANNER_HANDLE, PLAN_INTENT_RE,
   stripReportFormat, normalizeRoomTools, roomToolScope, ROOM_TOOL_SCOPES,
 } = require('../bots');
 
@@ -915,18 +915,14 @@ check('empty / null mean "as the chat"', [normalizeBotEngine(''), normalizeBotEn
 check('an absent field stays absent (a partial edit keeps the stored value)', normalizeBotEngine(undefined), undefined);
 check('api and subscription are kept', [normalizeBotEngine('api'), normalizeBotEngine('subscription')], ['api', 'subscription']);
 check('anything else is invalid', [normalizeBotEngine('codex'), normalizeBotEngine('SUBSCRIPTION'), normalizeBotEngine(1)], [false, false, false]);
-const ON = { enabled: true, tmux: true };
-check('a bot with no choice follows the chat', [botEngine({}, 'api', ON), botEngine({ run_engine: null }, 'subscription', ON)], ['api', 'subscription']);
-check('the planner on subscription stays on it in an api chat', botEngine({ run_engine: 'subscription' }, 'api', ON), 'subscription');
-check('a bot pinned to api stays on api in a subscription chat', botEngine({ run_engine: 'api' }, 'subscription', ON), 'api');
-check('the override is ignored where the caller did not enable it (Telegram)', botEngine({ run_engine: 'subscription' }, 'api', { enabled: false, tmux: true }), 'api');
-check('the override is ignored by default', botEngine({ run_engine: 'subscription' }, 'api'), 'api');
-check('without tmux a subscription bot follows the chat instead of failing every turn', botEngine({ run_engine: 'subscription' }, 'api', { enabled: true, tmux: false }), 'api');
-check('an unknown stored value follows the chat', botEngine({ run_engine: 'codex' }, 'subscription', ON), 'subscription');
-check('an unknown chat engine counts as api', botEngine({}, undefined, ON), 'api');
 {
   const plan = planBotImport({ incoming: [{ label: 'Planner', run_engine: 'subscription' }, { label: 'Other', runEngine: 'api' }, { label: 'Bad', run_engine: 'codex' }, { label: 'None' }], live: [], reserved: [] });
-  check('import carries the engine, in either spelling', plan.create.map(b => b.run_engine), ['subscription', 'api', null, null]);
+  // The engine follows the model now: a file that says "subscription" pins that bot's model
+  // to the CLI login (claude::), in either spelling, and no engine is stored.
+  check('an old "subscription" bot is imported onto the CLI login\'s model', plan.create.map(b => b.model), ['claude::sonnet', null, null, null]);
+  check('no engine is stored any more', plan.create.map(b => b.run_engine), [null, null, null, null]);
+  const p2 = planBotImport({ incoming: [{ label: 'Opus planner', model: 'opus', runEngine: 'subscription' }, { label: 'Gw', model: 'kilo::gpt-x', run_engine: 'subscription' }], live: [], reserved: [] });
+  check('its own alias is kept, a ref of another provider is left alone', p2.create.map(b => b.model), ['claude::opus', 'kilo::gpt-x']);
 }
 
 console.log('per-bot model:');
diff --git a/test/config-resolve.test.js b/test/config-resolve.test.js
index e0f9d1f4..2171d917 100644
--- a/test/config-resolve.test.js
+++ b/test/config-resolve.test.js
@@ -69,13 +69,13 @@ console.log('env-backed settings — process env beats .env beats the default:')
 // server.js:2308-2347 loadConfig()       → local > default, global never opened
 console.log('\nconfig.json-backed settings — local overrides global, on the merged chain only:');
 {
-  const merged = resolve('defaultEngine', {
-    localConfig: { defaultEngine: 'subscription' },
-    globalConfig: { defaultEngine: 'api' },
+  const merged = resolve('editor', {
+    localConfig: { editor: 'cursor' },
+    globalConfig: { editor: 'vscodium' },
   });
-  check('local config.json wins on the merged chain', merged.effective, 'subscription');
+  check('local config.json wins on the merged chain', merged.effective, 'cursor');
   check('candidate order is local, global, default', srcOrder(merged), ['config-local', 'config-global', 'default']);
-  check('the global value is shown, not hidden', merged.sources[1].value, 'api');
+  check('the global value is shown, not hidden', merged.sources[1].value, 'vscodium');
   check('the global value is not marked ignored', merged.sources[1].ignored, false);
 
   const globalOnly = resolve('lang', { globalConfig: { lang: 'fr' } });
@@ -100,7 +100,7 @@ console.log('\nconfig.json-backed settings — local overrides global, on the me
 }
 
 // ── 2b. `||` vs `??` — the UI must report the value the server actually runs on ─
-// loadMergedConfig() resolves lang and defaultEngine with `||` and
+// loadMergedConfig() resolves lang and editor with `||` and
 // recentProjectsCount with `??`. That difference is invisible until a config file
 // carries a falsy value: with `||` an empty string is SKIPPED and the next source
 // down is what the server uses, so reporting `""` as effective would point the
@@ -118,9 +118,9 @@ console.log('\nfalsy config values follow the operator loadMergedConfig() actual
   check('two empty files fall through to the built-in default', both.effective, 'en');
   check('and both are flagged', both.ignoredSources, ['config-local', 'config-global']);
 
-  const engine = resolve('defaultEngine', { localConfig: { defaultEngine: '' } });
-  check('defaultEngine behaves the same way', engine.effective, 'api');
-  check('crediting the default', engine.effectiveSource, 'default');
+  const editor = resolve('editor', { localConfig: { editor: '' } });
+  check('editor behaves the same way', editor.effective, 'vscode');
+  check('crediting the default', editor.effectiveSource, 'default');
 
   // Positive control: the flag must not swallow real values. Only falsy ones.
   const real = resolve('lang', { localConfig: { lang: 'he' }, globalConfig: { lang: 'fr' } });
@@ -306,7 +306,7 @@ console.log('\nreset removes the key from the file the form owns:');
     resolve('PORT', { processEnv: { PORT: '4100' } }).resettable, false);
   check('an untouched setting is not resettable', resolve('PORT', {}).resettable, false);
   check('a local config.json value is resettable',
-    resolve('defaultEngine', { localConfig: { defaultEngine: 'subscription' } }).resettable, true);
+    resolve('editor', { localConfig: { editor: 'cursor' } }).resettable, true);
   check('a value that only the global file defines is not ours to reset',
     resolve('lang', { globalConfig: { lang: 'fr' } }).resettable, false);
   check('a secret is never resettable',
@@ -360,7 +360,7 @@ console.log('\nlive server: /api/config/resolved + /api/config/setting');
   fs.writeFileSync(path.join(tmp, '.env'),
     `ANTHROPIC_API_KEY=${RAW_SECRET}\nMAX_TASK_WORKERS=7\nCLAUDE_HARD_CAP_MS=1234567\n`);
   fs.writeFileSync(path.join(tmp, 'config.json'),
-    JSON.stringify({ mcpServers: {}, skills: {}, defaultEngine: 'subscription' }, null, 2));
+    JSON.stringify({ mcpServers: {}, skills: {}, editor: 'cursor' }, null, 2));
 
   // Other agents hold 3990-3999 in this workspace; pick high and poll, never kill.
   const PORT = 3907 + (process.pid % 40);
@@ -437,7 +437,9 @@ console.log('\nlive server: /api/config/resolved + /api/config/setting');
       by('CLAUDE_HARD_CAP_MS').effectiveSource, 'dotenv');
     check('and its value comes through', by('CLAUDE_HARD_CAP_MS').effective, '1234567');
     check('and it is not marked shadowed', by('CLAUDE_HARD_CAP_MS').shadowedDotenv, false);
-    check('the local config.json value wins for defaultEngine', by('defaultEngine').effective, 'subscription');
+    check('the local config.json value wins for editor', by('editor').effective, 'cursor');
+    // The engine is decided by the model's provider now — there is no setting to default it.
+    check('there is no defaultEngine setting any more', by('defaultEngine'), undefined);
 
     // Write path: a config-backed setting round-trips into config.json.
     const w = await get('/api/config/setting', {
@@ -491,15 +493,15 @@ console.log('\nlive server: /api/config/resolved + /api/config/setting');
     // default, so name the value the resolver must now report.
     check('and the resolver reports the catalogued default, not some other number',
       JSON.parse(del.body).setting.effective, R.getSetting('terminal.maxLive').def);
-    check('a sibling key in config.json survived the reset', confAfter.defaultEngine, 'subscription');
+    check('a sibling key in config.json survived the reset', confAfter.editor, 'cursor');
 
     // A key that loadConfig() does NOT re-seed disappears from the file outright.
-    const delEngine = await get('/api/config/setting?key=defaultEngine', { method: 'DELETE', headers: auth });
+    const delEngine = await get('/api/config/setting?key=editor', { method: 'DELETE', headers: auth });
     check('resetting an unseeded key is accepted', JSON.parse(delEngine.body).ok, true);
     check('and it is gone from config.json',
-      'defaultEngine' in JSON.parse(fs.readFileSync(path.join(tmp, 'config.json'), 'utf8')), false);
+      'editor' in JSON.parse(fs.readFileSync(path.join(tmp, 'config.json'), 'utf8')), false);
     check('the resolver reports the built-in default for it',
-      JSON.parse(delEngine.body).setting.effective, 'api');
+      JSON.parse(delEngine.body).setting.effective, 'vscode');
 
     const delEnv = await get('/api/config/setting?key=SESSION_TTL_DAYS', { method: 'DELETE', headers: auth });
     check('the .env reset is accepted', JSON.parse(delEnv.body).ok, true);
diff --git a/test/fixtures/llm-bridge/claude-2.1.281-request.json b/test/fixtures/llm-bridge/claude-2.1.281-request.json
new file mode 100644
index 00000000..82be9efd
--- /dev/null
+++ b/test/fixtures/llm-bridge/claude-2.1.281-request.json
@@ -0,0 +1,223 @@
+{
+  "captured": "claude CLI 2.1.281",
+  "note": "Real request body captured by test/llm-bridge-contract.test.js (CCS_CONTRACT_CAPTURE=1). Paths, ids and env details replaced by placeholders; long system/tool texts trimmed.",
+  "headers": {
+    "anthropic-version": "2023-06-01",
+    "anthropic-beta": "claude-code-20250219,interleaved-thinking-2025-05-14,mid-conversation-system-2026-04-07,effort-2025-11-24",
+    "content-type": "application/json",
+    "accept": "application/json",
+    "x-app": "cli",
+    "x-claude-code-session-id": "SESSION_ID",
+    "url": "/v1/messages?beta=true"
+  },
+  "body": {
+    "model": "fake-model",
+    "messages": [
+      {
+        "role": "user",
+        "content": "Update note.txt: replace \"original line\" with \"changed by the bridge\"."
+      },
+      {
+        "role": "system",
+        "content": "# Environment\nYou have been invoked in the following environment: \n - Primary working directory: /WORKDIR\n - Is a git repository: false\n - Platform: PLATFORM\n - Shell: SHELL\n - OS Version: OS_VERSION\n\nYou are powered by the model fake-model.\n\n<total_tokens>N tokens left</total_tokens>\n\nToday's date is YYYY-MM-DD."
+      },
+      {
+        "role": "assistant",
+        "content": [
+          {
+            "type": "thinking",
+            "thinking": "I should look at the file first.",
+            "signature": "ccsb1:eyJwIjoiZmFrZSJ9"
+          },
+          {
+            "type": "text",
+            "text": "Reading the file."
+          },
+          {
+            "type": "tool_use",
+            "id": "call_read_1",
+            "name": "Read",
+            "input": {
+              "file_path": "/WORKDIR/note.txt"
+            }
+          }
+        ]
+      },
+      {
+        "role": "user",
+        "content": [
+          {
+            "tool_use_id": "call_read_1",
+            "type": "tool_result",
+            "content": "1\toriginal line\n2\t"
+          }
+        ]
+      },
+      {
+        "role": "system",
+        "content": "<total_tokens>N tokens left</total_tokens>"
+      },
+      {
+        "role": "assistant",
+        "content": [
+          {
+            "type": "thinking",
+            "thinking": "Now change it.",
+            "signature": "ccsb1:eyJwIjoiZmFrZSJ9"
+          },
+          {
+            "type": "tool_use",
+            "id": "call_edit_1",
+            "name": "Edit",
+            "input": {
+              "replace_all": false,
+              "file_path": "/WORKDIR/note.txt",
+              "old_string": "original line",
+              "new_string": "changed by the bridge"
+            }
+          }
+        ]
+      },
+      {
+        "role": "user",
+        "content": [
+          {
+            "tool_use_id": "call_edit_1",
+            "type": "tool_result",
+            "content": "The file /WORKDIR/note.txt has been updated successfully. (file state is current in your context — no need to Read it back)",
+            "cache_control": {
+              "type": "ephemeral"
+            }
+          }
+        ]
+      },
+      {
+        "role": "system",
+        "content": "<total_tokens>N tokens left</total_tokens>"
+      }
+    ],
+    "system": [
+      {
+        "type": "text",
+        "text": "x-anthropic-billing-header: cc_version=2.1.281.1c5; cc_entrypoint=sdk-cli;"
+      },
+      {
+        "type": "text",
+        "text": "You are a Claude agent, built on Anthropic's Claude Agent SDK.",
+        "cache_control": {
+          "type": "ephemeral"
+        }
+      },
+      {
+        "type": "text",
+        "text": "\nYou are an interactive agent that helps users with software engineering tasks.\n\nIMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, ex…[5094 more chars trimmed from the fixture]",
+        "cache_control": {
+          "type": "ephemeral"
+        }
+      }
+    ],
+    "tools": [
+      {
+        "name": "Edit",
+        "description": "Performs exact string replacement in a file.\n\n- You must Read the file in this conversation before editing, or the call will fail.\n- `old_string` must match the file exactly, including indentation, an…[160 more chars trimmed from the fixture]",
+        "input_schema": {
+          "$schema": "https://json-schema.org/draft/2020-12/schema",
+          "type": "object",
+          "properties": {
+            "file_path": {
+              "description": "The absolute path to the file to modify",
+              "type": "string"
+            },
+            "old_string": {
+              "description": "The text to replace",
+              "type": "string"
+            },
+            "new_string": {
+              "description": "The text to replace it with (must be different from old_string)",
+              "type": "string"
+            },
+            "replace_all": {
+              "description": "Replace all occurrences of old_string (default false)",
+              "default": false,
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "file_path",
+            "old_string",
+            "new_string"
+          ],
+          "additionalProperties": false
+        }
+      },
+      {
+        "name": "Read",
+        "description": "Reads a file from the local filesystem.\n\n- `file_path` must be an absolute path.\n- Reads up to 2000 lines by default.\n- When you already know which part of the file you need, only read that part. This…[590 more chars trimmed from the fixture]",
+        "input_schema": {
+          "$schema": "https://json-schema.org/draft/2020-12/schema",
+          "type": "object",
+          "properties": {
+            "file_path": {
+              "description": "The absolute path to the file to read",
+              "type": "string"
+            },
+            "offset": {
+              "description": "The line number to start reading from. Only provide if the file is too large to read at once",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            },
+            "limit": {
+              "description": "The number of lines to read. Only provide if the file is too large to read at once.",
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "maximum": 9007199254740991
+            },
+            "pages": {
+              "description": "Page range for PDF files (e.g., \"1-5\", \"3\", \"10-20\"). Only applicable to PDF files. Maximum 20 pages per request.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "file_path"
+          ],
+          "additionalProperties": false
+        }
+      },
+      {
+        "name": "Write",
+        "description": "Writes a file to the local filesystem, overwriting if one exists.\n\nWhen to use: creating a new file, or fully replacing one you've already Read. Overwriting an existing file you haven't Read will fail…[40 more chars trimmed from the fixture]",
+        "input_schema": {
+          "$schema": "https://json-schema.org/draft/2020-12/schema",
+          "type": "object",
+          "properties": {
+            "file_path": {
+              "description": "The absolute path to the file to write (must be absolute, not relative)",
+              "type": "string"
+            },
+            "content": {
+              "description": "The content to write to the file",
+              "type": "string"
+            }
+          },
+          "required": [
+            "file_path",
+            "content"
+          ],
+          "additionalProperties": false
+        }
+      }
+    ],
+    "metadata": {
+      "user_id": "{\"device_id\":\"DEVICE_ID\",\"account_uuid\":\"\",\"session_id\":\"SESSION_ID\"}"
+    },
+    "max_tokens": 32000,
+    "thinking": {
+      "type": "adaptive"
+    },
+    "output_config": {
+      "effort": "high"
+    },
+    "stream": true
+  }
+}
diff --git a/test/fixtures/llm-bridge/exit-child.js b/test/fixtures/llm-bridge/exit-child.js
new file mode 100644
index 00000000..e07c1723
--- /dev/null
+++ b/test/fixtures/llm-bridge/exit-child.js
@@ -0,0 +1,5 @@
+// A bridge "child" that can never start: used by test/llm-bridge-host.test.js to drive the
+// host's restart backoff into its give-up rule.
+'use strict';
+process.stderr.write('[error] exit-child: refusing to start\n');
+process.exit(7);
diff --git a/test/interrupt-idle-config.test.js b/test/interrupt-idle-config.test.js
index bbed82d0..061690fd 100644
--- a/test/interrupt-idle-config.test.js
+++ b/test/interrupt-idle-config.test.js
@@ -86,7 +86,7 @@ const SQLVAL_SRC = block('function sqlVal(v) {', 'sqlVal');
 
 // A fully configured session — the kind a user actually loses.
 const CONFIGURED = {
-  id: 'S1', model: 'opus', mode: 'plan', agent_mode: 'multi',
+  id: 'S1', model: 'claude::opus', mode: 'plan', agent_mode: 'multi',
   workdir: '/srv/some/project', active_skills: '["research","writing"]',
   active_mcp: '["context7","tavily"]', run_engine: 'subscription',
 };
@@ -128,7 +128,10 @@ function runInterrupt(msg, { busy = false } = {}) {
 // with defaults and written straight back onto the row.
 const DESTRUCTURE = pick(/const \{ text:userMessage, attachments=\[\][\s\S]*?\} = msg;/, 'processChat destructure');
 const WRITEBACK = pick(/try \{ stmts\.updateConfig\.run\(JSON\.stringify\(mIds\)[\s\S]*?catch \(e\) \{[\s\S]*?throw e; \}/, 'updateConfig call');
-const ENGINE_WRITE = pick(/db\.prepare\(`UPDATE sessions SET run_engine=\? WHERE id=\?`\)\.run\(engine === 'subscription' \? 'subscription' : 'api', localSessionId\);/, 'run_engine write');
+// There is no engine dial: the engine is derived from the model (runEngineFor) and the
+// derived value is what gets recorded on the row.
+const ENGINE_DERIVE = pick(/const engine = runEngineFor\(model\);/, 'engine derivation');
+const ENGINE_WRITE = pick(/db\.prepare\(`UPDATE sessions SET run_engine=\? WHERE id=\?`\)\.run\(engine, localSessionId\);/, 'run_engine write');
 
 // Feed one dispatched message through processChat's own config-persisting path.
 function persistConfigFor(dispatchedMsg) {
@@ -141,11 +144,14 @@ function persistConfigFor(dispatchedMsg) {
   const sandbox = {
     msg: dispatchedMsg, stmts, db, JSON, Buffer, Object, Array, Number,
     localSessionId: 'S1', log: { error() {} }, chatDefaults, _cd,
+    // server.js runEngineFor with a gateway as the default provider: `claude::` is the CLI login.
+    runEngineFor: (m) => (/^claude::/.test(String(m || '')) ? 'subscription' : 'api'),
   };
   vm.createContext(sandbox);
   vm.runInContext(`
     ${SQLVAL_SRC}
     ${DESTRUCTURE}
+    ${ENGINE_DERIVE}
     const effectiveSkills = sIds;   // autoSkill off: processChat uses sIds verbatim
     ${WRITEBACK}
     ${ENGINE_WRITE}
@@ -164,27 +170,25 @@ console.log('an idle interrupt must leave the session row exactly as it found it
 
   persistConfigFor(dispatched[0]);
   const after = snapshot('S1');
-  const drop = ({ run_engine, ...rest }) => rest;   // run_engine: see the note below
   // The whole bug in one line. Old behaviour produced
   //   { model:'sonnet', mode:'auto', agent_mode:'single', workdir:null,
   //     active_skills:'[]', active_mcp:'[]' }
-  check('the session row is byte-identical after the turn persists its config', drop(after), drop(before));
+  // run_engine included: it follows the model now, and the model is replayed.
+  check('the session row is byte-identical after the turn persists its config', after, before);
   // ...and the same assertions field by field, so a failure names what was lost.
-  check('model survived', after.model, 'opus');
+  check('model survived', after.model, 'claude::opus');
   check('mode survived', after.mode, 'plan');
   check('agent_mode survived', after.agent_mode, 'multi');
   check('workdir survived — the turn did NOT silently move to the global WORKDIR', after.workdir, '/srv/some/project');
   check('skills survived', after.active_skills, '["research","writing"]');
   check('MCP servers survived', after.active_mcp, '["context7","tavily"]');
 
-  // run_engine is the ONE field the rebuild deliberately does NOT replay, and the assertion
-  // is here so that stays a decision rather than an oversight. The SPA sends `engine: 'api'`
-  // on every chat (Subscription is a per-turn toggle), so feeding a stored 'subscription'
-  // back in would route this turn through the tmux engine behind the user's back. The
-  // documented cost: an idle interrupt on a subscription session leaves the row on 'api'.
+  // The engine is not replayed as a field — it has no dial any more. It follows the model,
+  // which IS replayed, so a subscription chat stays on the subscription after the interrupt
+  // (the old trade-off, "an idle interrupt resets the row to api", is gone).
   check('engine is deliberately omitted from the rebuilt turn', 'engine' in dispatched[0], false);
-  check('...which resets run_engine to api — the accepted trade-off, not a leftover wipe',
-    after.run_engine, 'api');
+  check('...and run_engine survives anyway, because it follows the replayed model',
+    after.run_engine, 'subscription');
   check('...and the omission is documented where the next reader will look',
     /Engine deliberately omitted/.test(INTERRUPT), true);
 }
@@ -262,7 +266,7 @@ console.log('\nthe idle branch is entered only when the session really is idle:'
   check('...with the user text', busy.pending?.[0].content, 'wait, use TypeScript');
   check('...and confirms to the client', busy.sent.some(f => f.type === 'interrupt_queued'), true);
   check('the busy path left the config alone too — including the engine', snapshot('S1'), {
-    model: 'opus', mode: 'plan', agent_mode: 'multi', workdir: '/srv/some/project',
+    model: 'claude::opus', mode: 'plan', agent_mode: 'multi', workdir: '/srv/some/project',
     active_skills: '["research","writing"]', active_mcp: '["context7","tavily"]', run_engine: 'subscription' });
   // hasRunningTask is load-bearing: a Kanban worker is NOT in activeTasks, so without it a
   // clarification sent to a running task becomes a fresh turn on the same session.
diff --git a/test/kanban-run-badges.test.js b/test/kanban-run-badges.test.js
index 3ce430e4..404df74f 100644
--- a/test/kanban-run-badges.test.js
+++ b/test/kanban-run-badges.test.js
@@ -46,13 +46,19 @@ function lift(names) {
   // translation is deliberate: it lets every assertion below name the i18n key the
   // badge asked for, so a key that does not exist in the dictionaries shows up here
   // as a wrong string rather than as a card rendering `effort.med` to a user.
-  const sandbox = { t: k => k };
+  // The provider list the page fetched (/api/models/choices): a gateway is the default,
+  // `claude` is the CLI login. kbEngineOf reads it as `_mdlChoices`, like the real page.
+  const sandbox = { t: k => k, _kbTmuxAvailable: true, _mdlChoices: { providers: [
+    { id: 'claude', type: 'claude-subscription', builtin: true, isDefault: false, models: [] },
+    { id: 'kilo', type: 'anthropic-compatible', isDefault: true, models: [] },
+  ] } };
   vm.createContext(sandbox);
-  vm.runInContext(parts.join('\n') + '\nthis.__api={kbRunBadges,KB_EFFORT_KEY};', sandbox);
-  return sandbox.__api;
+  vm.runInContext(parts.join('\n') + '\nthis.__api={kbRunBadges,KB_EFFORT_KEY,kbEngineOf};', sandbox);
+  return sandbox;
 }
 
-const { kbRunBadges, KB_EFFORT_KEY } = lift(['const KB_EFFORT_KEY=', 'kbRunBadges']);
+const SANDBOX = lift(['const KB_EFFORT_KEY=', 'kbEngineOf', 'kbRunBadges']);
+const { kbRunBadges, KB_EFFORT_KEY } = SANDBOX.__api;
 // Array.from, not .map: the helper builds its array inside the vm realm, so its
 // prototype is a different object and deepStrictEqual rejects it while printing two
 // identical-looking values. Copying into a host array is what makes a failure here
@@ -90,19 +96,25 @@ check('an unknown effort is shown verbatim, not dropped', texts({ model: 'sonnet
 check('the map covers exactly the five values the modal offers',
   Object.keys(KB_EFFORT_KEY).sort(), ['high', 'low', 'max', 'medium', 'xhigh']);
 
-// ── 3. Engine renders only for `subscription` ───────────────────────────────
+// ── 3. Engine: no dial — the model's provider decides, and only subscription is shown ──
 console.log('\nengine badge:');
-check('the api engine is the default and adds no badge', texts({ model: 'sonnet', run_engine: 'api' }), ['sonnet']);
-check('an unset engine adds no badge', texts({ model: 'sonnet', run_engine: null }), ['sonnet']);
-check('subscription is announced', texts({ model: 'sonnet', run_engine: 'subscription' }), ['sonnet', 'engine.sub']);
+check('a model of the default (API) provider adds no badge', texts({ model: 'sonnet' }), ['sonnet']);
+check('a stored run_engine is ignored — the dial is gone', texts({ model: 'sonnet', run_engine: 'subscription' }), ['sonnet']);
+check('a model of the CLI login is announced as the subscription', texts({ model: 'claude::opus' }).slice(-1), ['engine.sub']);
 check('all three together, in order',
-  texts({ model: 'opus', effort: 'high', run_engine: 'subscription' }),
-  ['opus', 'effort.high', 'engine.sub']);
+  texts({ model: 'claude::opus', effort: 'high' }).slice(1), ['effort.high', 'engine.sub']);
+check('a bot\'s model decides, not the task row\'s', texts({ model: 'claude::opus', bot_model: 'kilo::gpt-x' }).includes('engine.sub'), false);
+SANDBOX._kbTmuxAvailable = false;
+check('without tmux the CLI login runs headless, so no badge', texts({ model: 'claude::opus' }).includes('engine.sub'), false);
+SANDBOX._kbTmuxAvailable = true;
+SANDBOX._mdlChoices = null;
+check('before the provider list loads, an explicit claude:: ref is still known', texts({ model: 'claude::opus' }).includes('engine.sub'), true);
+check('…and a bare alias is not guessed', texts({ model: 'sonnet' }), ['sonnet']);
 
 // ── 4. Every badge carries a title, and it is a real i18n key ───────────────
 console.log('\ntitles:');
 check('titles name the toolbar labels',
-  titles({ model: 'opus', effort: 'high', run_engine: 'subscription' }),
+  titles({ model: 'claude::opus', effort: 'high' }),
   ['tb.model', 'tb.effort', 'tb.engine']);
 // Those keys have to exist in all five dictionaries or the tooltip renders the key.
 // i18n-completeness.test.js owns parity between languages; this only pins that the
@@ -119,8 +131,9 @@ console.log('\nthe card and the runner agree:');
 check('startTask still resolves model as bot -> session -> task -> sonnet',
   /model:\s*taskBot\?\.model\s*\|\|\s*session\?\.model\s*\|\|\s*task\.model\s*\|\|\s*'sonnet'/.test(SERVER), true);
 check('startTask still reads effort off the TASK row', /effort:\s*task\.effort\s*\|\|\s*null/.test(SERVER), true);
-check('startTask still treats any non-subscription run_engine as api',
-  /task\.run_engine === 'subscription'\)\s*\?\s*'subscription'\s*:\s*'api'/.test(SERVER), true);
+check('startTask derives the engine from the same model chain (runEngineFor)',
+  /_taskEngine = runEngineFor\(taskBot\?\.model\s*\|\|\s*session\?\.model\s*\|\|\s*task\.model\s*\|\|\s*'sonnet'\)/.test(SERVER), true);
+check('and no longer reads task.run_engine', /_taskEngine[^\n]*task\.run_engine/.test(SERVER), false);
 
 // getTasks has to actually ship bot_model, or the first branch of the chain is dead
 // weight and every bot-assigned card quietly falls back to the session's model.
diff --git a/test/kanban-schedule.test.js b/test/kanban-schedule.test.js
index 44d7ad91..4ba3e2c7 100644
--- a/test/kanban-schedule.test.js
+++ b/test/kanban-schedule.test.js
@@ -169,7 +169,9 @@ console.log('\nwhich task dials each run path actually receives:');
   // The subscription path is the mirror image.
   check('subscription run receives mode', has(sub, 'mode'), true);
   check('subscription run does NOT receive maxTurns', has(sub, 'maxTurns'), false);
-  check('subscription run does NOT receive effort', has(sub, 'effort'), false);
+  // Effort used to be dropped on this engine; `--effort` is a spawn flag of the
+  // interactive CLI too, so claude-interactive.js now passes it (providers work).
+  check('subscription run receives effort', has(sub, 'effort'), true);
   // agent_mode reaches neither: it is read only when the session is first created.
   check('neither run path receives agentMode', has(api, 'agentMode') || has(sub, 'agentMode'), false);
 }
diff --git a/test/llm-bridge-contract.test.js b/test/llm-bridge-contract.test.js
new file mode 100644
index 00000000..9fa90366
--- /dev/null
+++ b/test/llm-bridge-contract.test.js
@@ -0,0 +1,280 @@
+// END-TO-END contract of the LLM bridge with the REAL `claude` CLI.
+//
+// A fake OpenAI-compatible provider scripts one agent turn — (a) Read a file, (b) Edit it,
+// (c) a final text — and answers any side request the CLI makes with a short text. The CLI
+// talks to the bridge (spawned as a real child by createBridgeHost) through a recording proxy,
+// so both sides of the translation are visible: what Claude Code sent, and what the provider got.
+//
+// Isolation: HOME and CLAUDE_CONFIG_DIR are fresh temp dirs — the real ~/.claude is never read
+// or written — and ANTHROPIC_API_KEY / CLAUDECODE are removed from the child env.
+//
+// Self-skips (exit 0) when no `claude` binary is found: PATH, then ~/.local/bin/claude, or
+// CCS_CONTRACT_CLAUDE_BIN. CCS_CONTRACT_CAPTURE=1 also rewrites
+// test/fixtures/llm-bridge/claude-<version>-request.json from the captured main request.
+//
+// Run: node test/llm-bridge-contract.test.js
+'use strict';
+const assert = require('assert');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+const { spawn, execFileSync } = require('child_process');
+const { createBridgeHost } = require('../llm-bridge/host');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+
+function findClaude() {
+  if (process.env.CCS_CONTRACT_CLAUDE_BIN) return fs.existsSync(process.env.CCS_CONTRACT_CLAUDE_BIN) ? process.env.CCS_CONTRACT_CLAUDE_BIN : null;
+  for (const dir of String(process.env.PATH || '').split(path.delimiter)) {
+    if (!dir) continue;
+    const p = path.join(dir, process.platform === 'win32' ? 'claude.exe' : 'claude');
+    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* next */ }
+  }
+  const local = path.join(os.homedir(), '.local', 'bin', 'claude');
+  try { fs.accessSync(local, fs.constants.X_OK); return local; } catch { return null; }
+}
+
+const CLAUDE = findClaude();
+if (!CLAUDE) { console.log('skipped: claude CLI not found (PATH, ~/.local/bin/claude, CCS_CONTRACT_CLAUDE_BIN)'); process.exit(0); }
+let version = 'unknown';
+try { version = (execFileSync(CLAUDE, ['--version'], { encoding: 'utf8', timeout: 20000 }).match(/\d+\.\d+\.\d+/) || ['unknown'])[0]; } catch { /* keep unknown */ }
+console.log(`claude CLI ${version} at ${CLAUDE}`);
+
+const TOTAL_TIMEOUT_MS = 120000;
+const hardStop = setTimeout(() => { console.error('FAIL contract test exceeded 120 s'); process.exit(1); }, TOTAL_TIMEOUT_MS + 10000);
+hardStop.unref();
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-llm-bridge-contract-'));
+const WORK = path.join(tmp, 'work');
+const HOME = path.join(tmp, 'home');
+const CFG = path.join(tmp, 'config');
+for (const d of [WORK, HOME, CFG]) fs.mkdirSync(d, { recursive: true });
+const TARGET = path.join(WORK, 'note.txt');
+fs.writeFileSync(TARGET, 'original line\n');
+
+const PROVIDER_KEY = 'sk-fake-provider-key-000';
+
+// ------------------------------------------------------------ fake provider --
+const upstreamSeen = [];
+function sseChunk(res, obj) { res.write(`data: ${JSON.stringify(obj)}\n\n`); }
+function streamReply(res, model, { reasoning, text, toolCalls }, promptTokens) {
+  res.writeHead(200, { 'content-type': 'text/event-stream' });
+  const base = { id: 'chatcmpl-fake', object: 'chat.completion.chunk', model };
+  if (reasoning) sseChunk(res, { ...base, choices: [{ index: 0, delta: { role: 'assistant', reasoning_content: reasoning } }] });
+  if (text) {
+    sseChunk(res, { ...base, choices: [{ index: 0, delta: { content: text.slice(0, 4) } }] });
+    sseChunk(res, { ...base, choices: [{ index: 0, delta: { content: text.slice(4) } }] });
+  }
+  (toolCalls || []).forEach((tc, i) => {
+    const args = JSON.stringify(tc.args);
+    sseChunk(res, { ...base, choices: [{ index: 0, delta: { tool_calls: [{ index: i, id: tc.id, type: 'function', function: { name: tc.name, arguments: '' } }] } }] });
+    sseChunk(res, { ...base, choices: [{ index: 0, delta: { tool_calls: [{ index: i, function: { arguments: args.slice(0, 10) } }] } }] });
+    sseChunk(res, { ...base, choices: [{ index: 0, delta: { tool_calls: [{ index: i, function: { arguments: args.slice(10) } }] } }] });
+  });
+  sseChunk(res, { ...base, choices: [{ index: 0, delta: {}, finish_reason: toolCalls && toolCalls.length ? 'tool_calls' : 'stop' }] });
+  sseChunk(res, { ...base, choices: [], usage: { prompt_tokens: promptTokens, completion_tokens: 12, prompt_tokens_details: { cached_tokens: 0 }, completion_tokens_details: { reasoning_tokens: reasoning ? 5 : 0 } } });
+  res.write('data: [DONE]\n\n');
+  res.end();
+}
+
+const upstream = http.createServer((req, res) => {
+  const chunks = [];
+  req.on('data', (c) => chunks.push(c));
+  req.on('end', () => {
+    let body = null;
+    try { body = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { /* keep null */ }
+    upstreamSeen.push({ url: req.url, headers: req.headers, body });
+    if (!body || req.url !== '/v1/chat/completions') { res.writeHead(404, { 'content-type': 'application/json' }); res.end('{"error":{"message":"no such route"}}'); return; }
+    const names = (body.tools || []).map((t) => t.function && t.function.name);
+    const promptTokens = Math.ceil(JSON.stringify(body.messages).length / 4);
+    const mainLoop = names.includes('Read') && names.includes('Edit');
+    if (!mainLoop) { streamReply(res, body.model, { text: 'Side reply.' }, promptTokens); return; }
+    const toolMsgs = body.messages.filter((m) => m.role === 'tool').length;
+    if (toolMsgs === 0) {
+      streamReply(res, body.model, { reasoning: 'I should look at the file first.', text: 'Reading the file.', toolCalls: [{ id: 'call_read_1', name: 'Read', args: { file_path: TARGET } }] }, promptTokens);
+    } else if (toolMsgs === 1) {
+      streamReply(res, body.model, { reasoning: 'Now change it.', toolCalls: [{ id: 'call_edit_1', name: 'Edit', args: { file_path: TARGET, old_string: 'original line', new_string: 'changed by the bridge' } }] }, promptTokens);
+    } else {
+      streamReply(res, body.model, { text: 'Done: the file now says it was changed by the bridge.' }, promptTokens);
+    }
+  });
+});
+
+// --------------------------------------------- recording proxy (CLI -> bridge) --
+const cliSeen = [];
+let bridgePort = 0;
+const proxy = http.createServer((req, res) => {
+  const chunks = [];
+  req.on('data', (c) => chunks.push(c));
+  req.on('end', () => {
+    const raw = Buffer.concat(chunks);
+    let body = null;
+    try { body = JSON.parse(raw.toString('utf8')); } catch { /* keep null */ }
+    cliSeen.push({ method: req.method, url: req.url, headers: { ...req.headers }, body });
+    const up = http.request({ host: '127.0.0.1', port: bridgePort, method: req.method, path: req.url, headers: { ...req.headers, host: `127.0.0.1:${bridgePort}` } }, (r) => {
+      res.writeHead(r.statusCode, r.headers);
+      r.pipe(res);
+    });
+    up.on('error', () => { if (!res.headersSent) res.writeHead(502); res.end(); });
+    res.on('close', () => up.destroy());
+    up.end(raw);
+  });
+});
+
+const listen = (srv) => new Promise((r) => srv.listen(0, '127.0.0.1', () => r(srv.address().port)));
+
+// ------------------------------------------------- fixture capture (sanitised) --
+function sanitize(obj) {
+  const reps = [[tmp, '/TMP'], [WORK, '/WORKDIR'], [HOME, '/HOME'], [CFG, '/CLAUDE_CONFIG_DIR'], [os.homedir(), '/HOME'], [os.userInfo().username, 'user']];
+  reps.sort((a, b) => b[0].length - a[0].length);
+  let s = JSON.stringify(obj);
+  for (const [from, to] of reps) if (from && from.length > 3) s = s.split(from).join(to);
+  const o = JSON.parse(s);
+  const cut = (t, n) => (typeof t === 'string' && t.length > n ? `${t.slice(0, n)}…[${t.length - n} more chars trimmed from the fixture]` : t);
+  if (Array.isArray(o.system)) o.system = o.system.map((b) => ({ ...b, text: cut(b.text, 400) }));
+  if (Array.isArray(o.tools)) o.tools = o.tools.map((t) => ({ ...t, description: cut(t.description, 200) }));
+  if (o.metadata && typeof o.metadata.user_id === 'string') o.metadata.user_id = JSON.stringify({ device_id: 'DEVICE_ID', account_uuid: '', session_id: 'SESSION_ID' });
+  for (const m of o.messages || []) {
+    if (m.role === 'system' && typeof m.content === 'string') {
+      m.content = m.content.replace(/(OS Version: )[^\n]*/g, '$1OS_VERSION').replace(/(Platform: )[^\n]*/g, '$1PLATFORM').replace(/(Shell: )[^\n]*/g, '$1SHELL')
+        .replace(/\d{4}-\d{2}-\d{2}/g, 'YYYY-MM-DD').replace(/<total_tokens>\d+/g, '<total_tokens>N');
+    }
+  }
+  return o;
+}
+
+(async () => {
+  const upPort = await listen(upstream);
+  const proxyPort = await listen(proxy);
+  const usage = [];
+  const logs = [];
+  const host = createBridgeHost({ onUsage: (r) => usage.push(r), log: { debug() {}, info: (m) => logs.push(m), warn: (m) => logs.push(m), error: (m) => logs.push(m) } });
+  let cli = null;
+  try {
+    await host.start();
+    bridgePort = Number(new URL(host.baseUrl()).port);
+    const caps = { tools: true, vision: true, reasoning: true, pdf: false, contextWindow: 128000, maxOutput: 16000 };
+    const token = host.registerRun({
+      runId: 'run-contract', purpose: 'chat', sessionId: 'sess-1', taskId: null, botId: null,
+      provider: { id: 'fake', label: 'Fake Provider', type: 'openai-compatible', baseUrl: `http://127.0.0.1:${upPort}/v1`, apiKey: PROVIDER_KEY, authScheme: 'bearer', headers: {}, dialect: 'generic', options: {} },
+      model: 'fake-model',
+      models: { 'fake-model': caps, 'fake-fast': { ...caps, reasoning: false } },
+      modelMap: { 'fake-fast': 'fake-fast', haiku: 'fake-fast' },
+      fallbackModel: 'fake-fast',
+      effort: 'high',
+    });
+
+    const env = { ...process.env };
+    for (const k of Object.keys(env)) if (/^(ANTHROPIC_|CLAUDE_CODE_|CLAUDECODE)/.test(k)) delete env[k];
+    Object.assign(env, {
+      HOME, CLAUDE_CONFIG_DIR: CFG, USERPROFILE: HOME,
+      ANTHROPIC_BASE_URL: `http://127.0.0.1:${proxyPort}`,
+      ANTHROPIC_AUTH_TOKEN: token,
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+      CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: '1',
+      CLAUDE_CODE_MAX_CONTEXT_TOKENS: '128000',
+      CLAUDE_CODE_ALWAYS_ENABLE_EFFORT: '1',
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: 'fake-fast',
+    });
+    const args = ['-p', 'Update note.txt: replace "original line" with "changed by the bridge".',
+      '--output-format', 'stream-json', '--verbose', '--model', 'fake-model', '--dangerously-skip-permissions',
+      '--tools', 'Read,Edit,Write', '--max-turns', '8', '--effort', 'high'];
+    const out = await new Promise((resolve) => {
+      let stdout = '';
+      let stderr = '';
+      cli = spawn(CLAUDE, args, { cwd: WORK, env, stdio: ['ignore', 'pipe', 'pipe'] });
+      const timer = setTimeout(() => { try { cli.kill('SIGKILL'); } catch { /* gone */ } }, TOTAL_TIMEOUT_MS - 10000);
+      cli.stdout.on('data', (c) => { stdout += c; });
+      cli.stderr.on('data', (c) => { stderr += c; });
+      cli.on('close', (code) => { clearTimeout(timer); resolve({ code, stdout, stderr }); });
+    });
+    await new Promise((r) => setTimeout(r, 300)); // let the last usage record cross IPC
+
+    const lines = out.stdout.split('\n').filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+    const result = lines.find((l) => l.type === 'result');
+    if (!result) console.error(`  (cli exit ${out.code}) stderr: ${out.stderr.slice(-2000)}\n  stdout tail: ${out.stdout.slice(-2000)}`);
+
+    console.log('the CLI run:');
+    check('the run ended with result subtype success', result && result.subtype, 'success');
+    check('the file was edited as scripted', fs.readFileSync(TARGET, 'utf8'), 'changed by the bridge\n');
+    check('the final text came through', !!(result && /changed by the bridge/.test(result.result || '')), true);
+
+    console.log('what the provider received:');
+    const chats = upstreamSeen.filter((r) => r.url === '/v1/chat/completions' && r.body);
+    const main = chats.filter((r) => (r.body.tools || []).some((t) => t.function.name === 'Read'));
+    check('three main-loop calls reached the provider', main.length, 3);
+    check('every call went to <baseUrl>/chat/completions', upstreamSeen.every((r) => r.url === '/v1/chat/completions'), true);
+    check('the provider got its own key, never the run token', upstreamSeen.every((r) => r.headers.authorization === `Bearer ${PROVIDER_KEY}` && !JSON.stringify(r.headers).includes(token)), true);
+    const first = main[0] && main[0].body;
+    check('a system message comes first', first && first.messages[0].role, 'system');
+    check('the system text is Claude Code\'s, minus the billing header', !!(first && /Claude/.test(first.messages[0].content) && !/x-anthropic-billing-header/.test(first.messages[0].content)), true);
+    check('the tools arrived as OpenAI functions', first && first.tools.map((t) => t.type + ':' + t.function.name).sort(), ['function:Edit', 'function:Read', 'function:Write']);
+    check('tool schemas lost $schema (basic sanitize)', !!(first && first.tools.every((t) => !('$schema' in t.function.parameters))), true);
+    check('reasoning_effort is the run\'s effort (high)', main.map((r) => r.body.reasoning_effort), ['high', 'high', 'high']);
+    check('max_tokens was clamped to the model cap', first && first.max_tokens, 16000);
+    check('the upstream call streamed with usage', first && [first.stream, first.stream_options && first.stream_options.include_usage], [true, true]);
+    const second = main[1] && main[1].body;
+    const toolMsg = second && second.messages.find((m) => m.role === 'tool');
+    check('the Read result came back as a role:tool message', !!(toolMsg && toolMsg.tool_call_id === 'call_read_1' && /original line/.test(toolMsg.content)), true);
+    const asst = second && second.messages.find((m) => m.role === 'assistant');
+    check('the assistant turn carries the tool call', asst && asst.tool_calls && asst.tool_calls.map((t) => [t.id, t.function.name]), [['call_read_1', 'Read']]);
+    check('no Anthropic-only field leaked upstream', main.every((r) => !['thinking', 'output_config', 'context_management', 'metadata', 'system'].some((k) => k in r.body)), true);
+
+    console.log('what the CLI sent and got back:');
+    const cliMain = cliSeen.filter((r) => r.body && Array.isArray(r.body.tools) && r.body.tools.some((t) => t.name === 'Read'));
+    check('the CLI called POST /v1/messages', cliMain.every((r) => r.method === 'POST' && r.url.split('?')[0] === '/v1/messages'), true);
+    const sid = cliMain[0] && cliMain[0].headers['x-claude-code-session-id'];
+    check('the CLI sends x-claude-code-session-id', typeof sid === 'string' && sid.length > 8, true);
+    check('the CLI authenticates with the run token only', cliMain.every((r) => r.headers.authorization === `Bearer ${token}` && !r.headers['x-api-key']), true);
+
+    console.log('usage records:');
+    const msgRequests = cliSeen.filter((r) => r.url.split('?')[0].endsWith('/v1/messages')).length;
+    check('one usage record per /v1/messages request', usage.length, msgRequests);
+    const u = usage.find((r) => r.requestedModel === 'fake-model');
+    check('a record names run, provider, model and the CLI session', u && [u.runId, u.purpose, u.providerId, u.model, u.cliSessionId, u.status, u.stream], ['run-contract', 'chat', 'fake', 'fake-model', sid, 'ok', true]);
+    check('a record carries real token counts', !!(u && u.inputTokens > 0 && u.outputTokens === 12 && u.latencyMs >= 0), true);
+    check('reasoning tokens are recorded', usage.some((r) => r.reasoningTokens === 5), true);
+
+    // observations for the integration (printed, not asserted)
+    const paths = [...new Set(cliSeen.map((r) => `${r.method} ${r.url}`))];
+    const models = [...new Set(cliSeen.map((r) => r.body && r.body.model).filter(Boolean))];
+    const betas = [...new Set(cliSeen.map((r) => r.headers['anthropic-beta']).filter(Boolean))];
+    console.log(`  info endpoints called: ${paths.join(', ')}`);
+    console.log(`  info models requested: ${models.join(', ')}`);
+    console.log(`  info anthropic-beta: ${betas.join(' | ')}`);
+    if (cliMain[0]) {
+      const b = cliMain[0].body;
+      console.log(`  info main request: max_tokens=${b.max_tokens} thinking=${JSON.stringify(b.thinking)} output_config=${JSON.stringify(b.output_config)} keys=${Object.keys(b).join(',')}`);
+    }
+
+    if (process.env.CCS_CONTRACT_CAPTURE && cliMain.length) {
+      const last = cliMain[cliMain.length - 1];
+      const fixture = { captured: `claude CLI ${version}`, note: 'Real request body captured by test/llm-bridge-contract.test.js (CCS_CONTRACT_CAPTURE=1). Paths, ids and env details replaced by placeholders; long system/tool texts trimmed.', headers: {}, body: sanitize(last.body) };
+      for (const k of ['anthropic-version', 'anthropic-beta', 'content-type', 'accept', 'x-app']) if (last.headers[k]) fixture.headers[k] = last.headers[k];
+      if (last.headers['x-claude-code-session-id']) fixture.headers['x-claude-code-session-id'] = 'SESSION_ID';
+      fixture.headers.url = last.url;
+      const dir = path.join(__dirname, 'fixtures', 'llm-bridge');
+      fs.mkdirSync(dir, { recursive: true });
+      const file = path.join(dir, `claude-${version}-request.json`);
+      fs.writeFileSync(file, `${JSON.stringify(fixture, null, 2)}\n`);
+      console.log(`  info captured ${path.relative(path.join(__dirname, '..'), file)}`);
+    }
+  } catch (e) {
+    fail++;
+    console.error(`  FAIL harness error: ${(e && e.stack) || e}`);
+    if (logs.length) console.error(logs.slice(-20).join('\n'));
+  } finally {
+    if (cli && cli.exitCode === null) { try { cli.kill('SIGKILL'); } catch { /* gone */ } }
+    await host.stop().catch(() => {});
+    upstream.close();
+    proxy.close();
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+  console.log(`\n${pass} passed, ${fail} failed`);
+  process.exit(fail ? 1 : 0);
+})();
diff --git a/test/llm-bridge-host.test.js b/test/llm-bridge-host.test.js
new file mode 100644
index 00000000..f1105591
--- /dev/null
+++ b/test/llm-bridge-host.test.js
@@ -0,0 +1,161 @@
+// createBridgeHost supervising the REAL bridge child (llm-bridge/child.js) over IPC:
+// registerRun -> an immediate request authenticates (no IPC race), usage/log over IPC,
+// SIGKILL -> restarted on the SAME port with the runs re-registered, releaseRun grace,
+// updateProviders, stop(), inProcess mode, the give-up rule, and the child's own rules
+// (lookup of unknown tokens, exit when the IPC channel goes away, survives malformed input).
+//
+// Run: node test/llm-bridge-host.test.js
+'use strict';
+const assert = require('assert');
+const http = require('http');
+const path = require('path');
+const { spawn } = require('child_process');
+const { createBridgeHost } = require('../llm-bridge/host');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function until(fn, ms = 8000) { const t = Date.now(); while (Date.now() - t < ms) { if (await fn()) return true; await sleep(25); } return false; }
+const alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };
+
+function call(baseUrl, token, body, { path: p = '/v1/messages', raw } = {}) {
+  return new Promise((resolve) => {
+    const u = new URL(baseUrl);
+    const req = http.request({ host: u.hostname, port: u.port, method: 'POST', path: p, headers: { 'content-type': 'application/json', 'x-api-key': token } }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const text = Buffer.concat(chunks).toString('utf8'); let json = null; try { json = JSON.parse(text); } catch { /* sse */ } resolve({ status: res.statusCode, json, text }); });
+    });
+    req.on('error', (e) => resolve({ status: 0, error: e.code }));
+    req.end(raw !== undefined ? raw : JSON.stringify(body));
+  });
+}
+const msg = (text = 'hi') => ({ model: 'm1', max_tokens: 100, messages: [{ role: 'user', content: text }] });
+
+(async () => {
+  // fake OpenAI-compatible provider that echoes which key it was called with
+  const keys = [];
+  const upstream = http.createServer((req, res) => {
+    req.resume();
+    req.on('end', () => {
+      keys.push(req.headers.authorization);
+      res.writeHead(200, { 'content-type': 'text/event-stream' });
+      res.write(`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: 'pong' }, finish_reason: 'stop' }], usage: { prompt_tokens: 5, completion_tokens: 1 } })}\n\n`);
+      res.end('data: [DONE]\n\n');
+    });
+  });
+  await new Promise((r) => upstream.listen(0, '127.0.0.1', r));
+  const provider = (key = 'sk-one') => ({ id: 'prov', label: 'Prov', type: 'openai-compatible', baseUrl: `http://127.0.0.1:${upstream.address().port}/v1`, apiKey: key, authScheme: 'bearer', headers: {}, dialect: 'generic', options: {} });
+  const runCtx = (runId) => ({ runId, purpose: 'chat', sessionId: 's', taskId: null, botId: null, provider: provider(), model: 'm1', models: { m1: { tools: true } }, modelMap: {}, fallbackModel: 'm1', effort: null });
+
+  console.log('child mode:');
+  const usage = [];
+  const logs = [];
+  const log = { debug: () => {}, info: (m) => logs.push(`info ${m}`), warn: (m) => logs.push(`warn ${m}`), error: (m) => logs.push(`error ${m}`) };
+  const host = createBridgeHost({ onUsage: (r) => usage.push(r), log, backoffMs: [200] });
+  check('not running before start()', [host.running(), host.baseUrl()], [false, null]);
+  await host.start();
+  const base = host.baseUrl();
+  const pid1 = host.pid();
+  check('start() resolves once the child listens on 127.0.0.1', [host.running(), /^http:\/\/127\.0\.0\.1:\d+$/.test(base), alive(pid1)], [true, true, true]);
+
+  const tokens = Array.from({ length: 20 }, (_, i) => host.registerRun(runCtx(`run-${i}`)));
+  check('tokens are ccsr_ + 48 hex, unique', [tokens.every((t) => /^ccsr_[0-9a-f]{48}$/.test(t)), new Set(tokens).size], [true, 20]);
+  // fired in the same tick as registerRun — before the `run` IPC message can have been handled
+  const immediate = await Promise.all(tokens.map((t) => call(base, t, msg())));
+  check('a request right after registerRun authenticates (20/20, no race)', immediate.map((r) => r.status), tokens.map(() => 200));
+  check('the translated answer came back', immediate[0].json.content[0].text, 'pong');
+  check('usage records cross IPC to onUsage', await until(() => usage.length === 20), true);
+  check('…with the run metadata', [usage.map((u) => u.runId).sort()[0], usage[0].providerId, usage[0].status], ['run-0', 'prov', 'ok']);
+  const rl = await host.recentLog();
+  check('recentLog() is proxied from the child', [rl.length, rl[0].route], [20, 'messages']);
+  check('an unknown token is still a 401', (await call(base, 'ccsr_' + 'f'.repeat(48), msg())).status, 401);
+  check('child stderr lines reach the host log', logs.length >= 0, true);
+
+  console.log('malformed input never crashes the child:');
+  await call(base, tokens[0], null, { raw: '{broken' });
+  await call(base, tokens[0], { messages: 'nope' });
+  await call(base, tokens[0], { model: 'm1', messages: [{ role: 'user', content: [{ type: 'image', source: null }, null, 5, { type: 'tool_result' }] }] });
+  check('the same child is still serving', [host.pid(), (await call(base, tokens[0], msg())).status], [pid1, 200]);
+
+  console.log('updateProviders:');
+  keys.length = 0;
+  host.updateProviders({ prov: provider('sk-two') });
+  await sleep(50);
+  await call(base, tokens[1], msg());
+  check('live runs use the refreshed key', keys, ['Bearer sk-two']);
+
+  console.log('crash -> restart on the same port:');
+  process.kill(pid1, 'SIGKILL');
+  check('the host notices and restarts', await until(() => host.running() && host.pid() && host.pid() !== pid1), true);
+  check('same port', host.baseUrl(), base);
+  check('the old child is gone', alive(pid1), false);
+  check('a token registered before the crash still works (runs re-sent)', (await call(base, tokens[2], msg())).status, 200);
+  check('…including the refreshed key', keys[keys.length - 1], 'Bearer sk-two');
+  check('the crash was logged', logs.some((l) => /warn .*exited unexpectedly/.test(l)), true);
+
+  console.log('releaseRun:');
+  host.releaseRun(tokens[3], { graceMs: 300 });
+  check('still valid during the grace period', (await call(base, tokens[3], msg())).status, 200);
+  await sleep(450);
+  check('rejected after it', (await call(base, tokens[3], msg())).status, 401);
+  host.releaseRun(tokens[4], { graceMs: 0 });
+  await sleep(100);
+  check('graceMs 0 releases at once', (await call(base, tokens[4], msg())).status, 401);
+
+  console.log('stop():');
+  const pid2 = host.pid();
+  await host.stop();
+  check('not running, no baseUrl, child exited', [host.running(), host.baseUrl(), await until(() => !alive(pid2), 3000)], [false, null, true]);
+  check('the port is closed', (await call(base, tokens[5], msg())).error, 'ECONNREFUSED');
+
+  console.log('inProcess mode:');
+  const u2 = [];
+  const ip = createBridgeHost({ inProcess: true, onUsage: (r) => u2.push(r) });
+  await ip.start();
+  const t2 = ip.registerRun(runCtx('inproc'));
+  const r2 = await call(ip.baseUrl(), t2, msg());
+  check('same API, no child', [ip.running(), ip.pid(), r2.status, r2.json.content[0].text], [true, null, 200, 'pong']);
+  check('usage and recentLog work in-process', [u2.length, (await ip.recentLog()).length], [1, 1]);
+  ip.releaseRun(t2, { graceMs: 0 });
+  check('release works in-process', (await call(ip.baseUrl(), t2, msg())).status, 401);
+  await ip.stop();
+  check('stopped', ip.running(), false);
+
+  console.log('give up after 5 failed starts:');
+  const glogs = [];
+  const bad = createBridgeHost({ childPath: path.join(__dirname, 'fixtures', 'llm-bridge', 'exit-child.js'), backoffMs: [20], log: { warn: (m) => glogs.push(m), info() {}, error() {}, debug() {} } });
+  let rejected = false;
+  try { await bad.start(); } catch { rejected = true; }
+  check('start() rejects when the child cannot start', rejected, true);
+  check('…the host retries in the background, then gives up with a warning', await until(() => glogs.some((l) => /giving up/.test(l)), 10000), true);
+  check('…and reports itself down', [bad.running(), bad.baseUrl()], [false, null]);
+  await bad.stop();
+
+  console.log('the child on its own:');
+  {
+    const c = spawn(process.execPath, [path.join(__dirname, '..', 'llm-bridge', 'child.js')], { stdio: ['ignore', 'pipe', 'pipe', 'ipc'] });
+    const lookups = [];
+    const ready = new Promise((r) => c.on('message', (m) => {
+      if (m.t === 'ready') r(m.port);
+      if (m.t === 'lookup') { lookups.push(m.token); c.send({ t: 'lookup-reply', id: m.id, ctx: m.token.endsWith('a'.repeat(8)) ? { ...runCtx('looked-up'), token: m.token } : null }); }
+    }));
+    c.send({ t: 'init', port: 0, host: '127.0.0.1', runs: [], options: {} });
+    const port = await ready;
+    const cbase = `http://127.0.0.1:${port}`;
+    const known = 'ccsr_' + '0'.repeat(40) + 'a'.repeat(8);
+    check('an unknown well-formed token is looked up from the host, then served', [(await call(cbase, known, msg())).status, lookups], [200, [known]]);
+    check('…and cached (no second lookup)', [(await call(cbase, known, msg())).status, lookups.length], [200, 1]);
+    check('a lookup answered null -> 401', (await call(cbase, 'ccsr_' + '1'.repeat(48), msg())).status, 401);
+    check('a malformed token is refused without asking the host', [(await call(cbase, 'garbage', msg())).status, lookups.length], [401, 2]);
+    c.disconnect();
+    check('the child exits when the IPC channel disconnects (parent died)', await until(() => c.exitCode !== null, 4000), true);
+  }
+
+  upstream.close();
+  console.log(`\n${pass} passed, ${fail} failed`);
+  process.exit(fail ? 1 : 0);
+})().catch((e) => { console.error(e); process.exit(1); });
diff --git a/test/llm-bridge-server.test.js b/test/llm-bridge-server.test.js
new file mode 100644
index 00000000..41ab9351
--- /dev/null
+++ b/test/llm-bridge-server.test.js
@@ -0,0 +1,335 @@
+// The LLM bridge's HTTP server against fake upstream providers (Anthropic passthrough and
+// OpenAI-compatible translate): auth, byte-identical passthrough + usage tap + credential swap,
+// the error mapping table, retry-before-first-byte (and never after), keep-alive pings, client
+// abort propagation, per-provider concurrency, count_tokens, /v1/models, /health, usage records.
+// Everything on 127.0.0.1 ephemeral ports; the ping interval and retry delay are injected so
+// the suite runs in seconds.
+//
+// Run: node test/llm-bridge-server.test.js
+'use strict';
+const assert = require('assert');
+const http = require('http');
+const { createBridgeServer } = require('../llm-bridge/server');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function until(fn, ms = 3000) { const t = Date.now(); while (Date.now() - t < ms) { if (await fn()) return true; await sleep(15); } return false; }
+
+// ------------------------------------------------------------- fake upstream --
+function fakeUpstream() {
+  const u = { seen: [], handler: null, active: 0, maxActive: 0 };
+  u.server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (c) => chunks.push(c));
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks).toString('utf8');
+      let body = null;
+      try { body = JSON.parse(raw); } catch { /* keep null */ }
+      const rec = { method: req.method, url: req.url, headers: req.headers, body, raw, closedEarly: false };
+      u.seen.push(rec);
+      u.active++; u.maxActive = Math.max(u.maxActive, u.active);
+      res.on('close', () => { u.active--; if (!res.writableFinished) rec.closedEarly = true; });
+      try { u.handler(req, res, rec, u.seen.length); } catch (e) { res.writeHead(500); res.end(String(e)); }
+    });
+  });
+  u.reset = (h) => { u.seen = []; u.maxActive = 0; u.handler = h; };
+  return u;
+}
+const sse = (res, events, { end = true } = {}) => {
+  res.writeHead(200, { 'content-type': 'text/event-stream' });
+  for (const e of events) res.write(typeof e === 'string' ? e : `data: ${JSON.stringify(e)}\n\n`);
+  if (end) res.end();
+};
+const jsonRes = (res, status, obj, headers = {}) => { res.writeHead(status, { 'content-type': 'application/json', ...headers }); res.end(typeof obj === 'string' ? obj : JSON.stringify(obj)); };
+const oaText = (text, usage = { prompt_tokens: 30, completion_tokens: 4 }) => [
+  { choices: [{ index: 0, delta: { role: 'assistant', content: text } }] },
+  { choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] },
+  { choices: [], usage }, 'data: [DONE]\n\n',
+];
+
+// ---------------------------------------------------------------- client --
+function call(port, { path = '/v1/messages', method = 'POST', headers = {}, body, token = 'tok-openai', auth = 'x-api-key', raw } = {}) {
+  return new Promise((resolve, reject) => {
+    const h = { 'content-type': 'application/json', ...headers };
+    if (token && auth === 'x-api-key') h['x-api-key'] = token;
+    if (token && auth === 'bearer') h.authorization = `Bearer ${token}`;
+    const req = http.request({ host: '127.0.0.1', port, method, path, headers: h }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* sse or empty */ }
+        resolve({ status: res.statusCode, headers: res.headers, text, json });
+      });
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+    if (raw !== undefined) req.end(raw); else if (body !== undefined) req.end(JSON.stringify(body)); else req.end();
+  });
+}
+function events(text) {
+  const out = [];
+  for (const block of text.split('\n\n')) {
+    const ev = /^event: (.*)$/m.exec(block);
+    const data = /^data: (.*)$/m.exec(block);
+    if (ev && data) out.push([ev[1], JSON.parse(data[1])]);
+  }
+  return out;
+}
+const msg = (extra = {}) => ({ model: 'm1', max_tokens: 1000, messages: [{ role: 'user', content: 'hello there' }], ...extra });
+
+(async () => {
+  const up = fakeUpstream();
+  await new Promise((r) => up.server.listen(0, '127.0.0.1', r));
+  const upBase = `http://127.0.0.1:${up.server.address().port}`;
+  const deadPort = await new Promise((r) => { const s = http.createServer(); s.listen(0, '127.0.0.1', () => { const p = s.address().port; s.close(() => r(p)); }); });
+
+  const caps = { tools: true, vision: true, reasoning: true, pdf: false, contextWindow: 65536, maxOutput: 8192 };
+  const provider = (over = {}) => ({ id: 'p1', label: 'Acme', type: 'openai-compatible', baseUrl: `${upBase}/v1`, apiKey: 'sk-provider', authScheme: 'bearer', headers: { 'X-Extra': 'yes' }, dialect: 'generic', options: {}, ...over });
+  const runs = new Map();
+  const ctx = (token, prov, over = {}) => runs.set(token, { token, runId: `run-${token}`, purpose: 'task', sessionId: 's1', taskId: 't1', botId: null, provider: prov, model: 'm1', models: { m1: caps }, modelMap: {}, fallbackModel: 'm1', effort: null, ...over });
+  ctx('tok-openai', provider());
+  ctx('tok-anthropic', provider({ id: 'anth', type: 'anthropic', baseUrl: upBase, apiKey: 'sk-ant-real', authScheme: 'x-api-key', headers: {} }),
+    { model: 'claude-sonnet-5', models: { 'claude-haiku-4-5-20251001': { ...caps, maxOutput: 4096 } }, modelMap: { 'claude-haiku-4-5': 'claude-haiku-4-5-20251001' } });
+  ctx('tok-strip', provider({ id: 'anth2', type: 'anthropic-compatible', baseUrl: `${upBase}/anthropic/v1`, apiKey: 'sk-compat', authScheme: 'both', headers: {}, options: { stripBetas: true } }));
+  ctx('tok-dead', provider({ id: 'dead', baseUrl: `http://127.0.0.1:${deadPort}/v1` }));
+  ctx('tok-idle', provider({ id: 'idle', options: { timeoutMs: 300 } }));
+  ctx('tok-one', provider({ id: 'one', options: { maxConcurrency: 1 } }));
+
+  const usage = [];
+  const srv = createBridgeServer({ getRun: (t) => runs.get(t) || null, onUsage: (r) => usage.push(r), pingIntervalMs: 100, retryDelayMs: () => 20 });
+  const { port } = await srv.listen(0, '127.0.0.1');
+  check('listen() resolves the ephemeral port on 127.0.0.1', [port > 0, srv.address().address], [true, '127.0.0.1']);
+  check('listen() refuses a non-loopback host', await createBridgeServer({ getRun: () => null }).listen(0, '0.0.0.0').then(() => 'listened', (e) => /non-loopback/.test(e.message)), true);
+
+  console.log('surface:');
+  check('/health needs no auth', (await call(port, { path: '/health', method: 'GET', token: null })).json, { ok: true });
+  const unk = await call(port, { body: msg(), token: 'nope' });
+  check('unknown token -> 401 Anthropic-shaped', [unk.status, unk.json.type, unk.json.error.type], [401, 'error', 'authentication_error']);
+  check('no token -> 401', (await call(port, { body: msg(), token: null })).status, 401);
+  check('unknown path -> 404 Anthropic-shaped', [(await call(port, { path: '/v1/complete', body: {} })).json.error.type], ['not_found_error']);
+  const models = await call(port, { path: '/v1/models', method: 'GET' });
+  check('/v1/models lists the run\'s models', models.json, { data: [{ type: 'model', id: 'm1', display_name: 'm1', created_at: '2025-01-01T00:00:00Z' }], has_more: false, first_id: 'm1', last_id: 'm1' });
+  check('/v1/models/<id>', (await call(port, { path: '/v1/models/m1', method: 'GET' })).json.id, 'm1');
+  up.reset((req, res) => sse(res, oaText('hi')));
+  check('Bearer auth and a path prefix + query are accepted', (await call(port, { path: '/some/prefix/v1/messages?beta=true', body: msg(), auth: 'bearer' })).status, 200);
+  check('invalid JSON -> 400', (await call(port, { raw: '{nope' })).json.error.type, 'invalid_request_error');
+  const badRole = await call(port, { body: msg({ messages: [{ role: 'tool', content: 'x' }] }) });
+  check('an untranslatable body -> 400 naming the problem', [badRole.status, /messages\.0\.role/.test(badRole.json.error.message)], [400, true]);
+  {
+    const small = createBridgeServer({ getRun: (t) => runs.get(t) || null, maxBodyBytes: 1000 });
+    const s = await small.listen(0);
+    const big = await call(s.port, { body: msg({ messages: [{ role: 'user', content: 'x'.repeat(5000) }] }) });
+    check('body over the limit -> 413 request_too_large', [big.status, big.json.error.type], [413, 'request_too_large']);
+    await small.close();
+  }
+
+  console.log('translate: stream, non-stream, what went upstream:');
+  up.reset((req, res) => sse(res, [
+    { choices: [{ index: 0, delta: { reasoning_content: 'hmm' } }] },
+    { choices: [{ index: 0, delta: { content: 'Hello' } }] },
+    { choices: [{ index: 0, delta: { tool_calls: [{ index: 0, id: 'call_1', function: { name: 'Read', arguments: '{"file_path":"/a"}' } }] } }] },
+    { choices: [{ index: 0, delta: {}, finish_reason: 'tool_calls' }] },
+    { choices: [], usage: { prompt_tokens: 1000, completion_tokens: 50, prompt_tokens_details: { cached_tokens: 600 }, completion_tokens_details: { reasoning_tokens: 9 } } },
+    'data: [DONE]\n\n',
+  ]));
+  usage.length = 0;
+  const s1 = await call(port, { body: msg({ stream: true, thinking: { type: 'adaptive' }, tools: [{ name: 'Read', input_schema: { type: 'object' } }] }), headers: { 'x-claude-code-session-id': 'cli-sess-1', 'anthropic-beta': 'x' } });
+  const ev = events(s1.text);
+  check('stream: 200 text/event-stream', [s1.status, /text\/event-stream/.test(s1.headers['content-type'])], [200, true]);
+  check('stream: event sequence', ev.map((e) => e[0] === 'content_block_start' ? `start:${e[1].content_block.type}` : e[0]).filter((n) => n !== 'content_block_delta'),
+    ['message_start', 'ping', 'start:thinking', 'content_block_stop', 'start:text', 'content_block_stop', 'start:tool_use', 'content_block_stop', 'message_delta', 'message_stop']);
+  check('stream: usage in message_delta', ev.find((e) => e[0] === 'message_delta')[1].usage, { input_tokens: 400, output_tokens: 50, cache_read_input_tokens: 600, cache_creation_input_tokens: 0 });
+  const seen = up.seen[0];
+  check('upstream URL and credentials (provider key, extra header, never the run token)', [seen.url, seen.headers.authorization, seen.headers['x-extra'], JSON.stringify(seen.headers).includes('tok-openai')], ['/v1/chat/completions', 'Bearer sk-provider', 'yes', false]);
+  check('upstream body is OpenAI-shaped and streamed', [seen.body.model, seen.body.stream, seen.body.messages[0], seen.body.max_tokens], ['m1', true, { role: 'user', content: 'hello there' }, 1000]);
+  check('anthropic-beta is not forwarded in translate mode', 'anthropic-beta' in seen.headers, false);
+  const rec = usage[0];
+  check('usage record: every field', {
+    ...rec, ts: typeof rec.ts, latencyMs: typeof rec.latencyMs, firstByteMs: typeof rec.firstByteMs,
+  }, {
+    ts: 'number', runId: 'run-tok-openai', purpose: 'task', sessionId: 's1', taskId: 't1', botId: null, providerId: 'p1', model: 'm1', requestedModel: 'm1',
+    inputTokens: 400, outputTokens: 50, cacheReadTokens: 600, cacheWriteTokens: 0, reasoningTokens: 9, latencyMs: 'number', firstByteMs: 'number', stream: true,
+    status: 'ok', httpStatus: 200, errorType: null, cliSessionId: 'cli-sess-1',
+  });
+  const ns = await call(port, { body: msg({ thinking: { type: 'adaptive' } }) });
+  check('non-stream client: Anthropic Message JSON from the same stream', [ns.status, ns.json.type, ns.json.content.map((b) => b.type), ns.json.stop_reason], [200, 'message', ['thinking', 'text', 'tool_use'], 'tool_use']);
+  up.reset((req, res) => jsonRes(res, 200, { id: 'x', choices: [{ message: { role: 'assistant', content: 'plain json' }, finish_reason: 'stop' }], usage: { prompt_tokens: 3, completion_tokens: 2 } }));
+  const js = await call(port, { body: msg({ stream: true }) });
+  check('an upstream that answers JSON despite stream:true still translates', events(js.text).filter((e) => e[0] === 'content_block_delta').map((e) => e[1].delta.text), ['plain json']);
+
+  console.log('error mapping (translate):');
+  const table = [
+    ['context overflow', 400, { error: { code: 'context_length_exceeded', message: "This model's maximum context length is 65536 tokens. However, you requested 70000 tokens." } }, {}, 400, 'invalid_request_error', 'provider "Acme": prompt is too long: 70000 tokens > 65536 maximum'],
+    ['401', 401, { error: { message: 'Incorrect API key provided' } }, {}, 401, 'authentication_error', 'provider "Acme": invalid api key (Incorrect API key provided)'],
+    ['403', 403, { error: { message: 'region blocked' } }, {}, 403, 'permission_error', 'provider "Acme": region blocked'],
+    ['402', 402, { error: { message: 'Payment required' } }, {}, 400, 'invalid_request_error', 'provider "Acme": Your credit balance is too low (insufficient_quota): Payment required'],
+    ['insufficient balance', 400, { error: { message: 'Insufficient Balance' } }, {}, 400, 'invalid_request_error', 'provider "Acme": Your credit balance is too low (insufficient_quota): Insufficient Balance'],
+    ['404', 404, { error: { message: 'model not found' } }, {}, 404, 'not_found_error', 'provider "Acme": model not found'],
+    ['413', 413, { error: { message: 'too big' } }, {}, 413, 'request_too_large', 'provider "Acme": too big'],
+    ['429', 429, { error: { message: 'slow down' } }, { 'retry-after': '7' }, 429, 'rate_limit_error', 'provider "Acme": slow down'],
+    ['422', 422, { detail: 'bad field' }, {}, 400, 'invalid_request_error', 'provider "Acme": bad field'],
+    ['500', 500, { error: { message: 'boom' } }, {}, 500, 'api_error', 'provider "Acme": boom'],
+    ['502 (after retries)', 502, { error: { message: 'bad gateway' } }, {}, 502, 'api_error', 'provider "Acme": bad gateway'],
+    ['503 (after retries)', 503, { error: { message: 'busy' } }, {}, 529, 'overloaded_error', 'provider "Acme": busy'],
+    ['529', 529, { error: { message: 'Overloaded' } }, {}, 529, 'overloaded_error', 'provider "Acme": Overloaded'],
+  ];
+  for (const [name, st, body, hdrs, wantStatus, wantType, wantMsg] of table) {
+    up.reset((req, res) => jsonRes(res, st, body, hdrs));
+    const r = await call(port, { body: msg({ stream: true }) });
+    check(`${name} -> ${wantStatus} ${wantType}`, [r.status, r.json && r.json.error.type, r.json && r.json.error.message], [wantStatus, wantType, wantMsg]);
+    if (st === 429) check('429 keeps retry-after', r.headers['retry-after'], '7');
+  }
+  up.reset((req, res) => jsonRes(res, 503, { error: { message: 'busy' } }));
+  await call(port, { body: msg() });
+  check('503 is retried twice before it is reported (3 upstream calls)', up.seen.length, 3);
+  up.reset((req, res) => jsonRes(res, 400, { error: { message: 'bad' } }));
+  await call(port, { body: msg() });
+  check('a 400 is never retried', up.seen.length, 1);
+  const dead = await call(port, { body: msg({ stream: true }), token: 'tok-dead' });
+  check('transport failure -> 529 overloaded "upstream unreachable"', [dead.status, dead.json.error.type, /provider "Acme": upstream unreachable: ECONNREFUSED/.test(dead.json.error.message)], [529, 'overloaded_error', true]);
+
+  console.log('retries only before the first client byte:');
+  up.reset((req, res, rec, n) => (n === 1 ? jsonRes(res, 503, { error: { message: 'warming up' } }) : sse(res, oaText('second try'))));
+  const rr = await call(port, { body: msg({ stream: true }) });
+  check('503 then 200 -> the client only sees the 200', [rr.status, up.seen.length, events(rr.text).some((e) => e[0] === 'content_block_delta' && e[1].delta.text === 'second try')], [200, 2, true]);
+  up.reset((req, res, rec, n) => { if (n === 1) { req.socket.destroy(); return; } sse(res, oaText('after reset')); });
+  check('a connection reset before headers is retried', [(await call(port, { body: msg() })).json.content[0].text, up.seen.length], ['after reset', 2]);
+  up.reset((req, res) => { sse(res, [{ choices: [{ index: 0, delta: { content: 'partial' } }] }], { end: false }); setTimeout(() => res.socket.destroy(), 50); });
+  usage.length = 0;
+  const cut = await call(port, { body: msg({ stream: true }) });
+  const cutEv = events(cut.text);
+  check('a failure after headers is NOT retried', up.seen.length, 1);
+  check('…the client gets an error event (block closed, no message_stop)', [cutEv[cutEv.length - 1][0], cutEv[cutEv.length - 1][1].error.type, cutEv.some((e) => e[0] === 'message_stop'), cutEv.filter((e) => e[0] === 'content_block_start').length === cutEv.filter((e) => e[0] === 'content_block_stop').length], ['error', 'overloaded_error', false, true]);
+  check('…and the usage record says error', [usage[0].status, usage[0].errorType], ['error', 'overloaded_error']);
+  up.reset((req, res) => sse(res, [{ choices: [{ index: 0, delta: { content: 'x' } }] }, { error: { message: 'Overloaded', code: 529 } }]));
+  const mid = events((await call(port, { body: msg({ stream: true }) })).text);
+  check('a mid-stream {"error"} chunk -> event: error with the mapped type', [mid[mid.length - 1][1].error.type, mid.some((e) => e[0] === 'message_stop')], ['overloaded_error', false]);
+  up.reset((req, res) => sse(res, [{ error: { message: 'rate limited', code: 429 } }]));
+  const midNs = await call(port, { body: msg() });
+  check('…for a non-stream client it is a real HTTP status', [midNs.status, midNs.json.error.type], [429, 'rate_limit_error']);
+  up.reset((req, res) => { res.writeHead(200, { 'content-type': 'text/event-stream' }); res.end(); });
+  const empty = await call(port, { body: msg() });
+  check('an empty 200 -> 529 (retryable), not a blank answer', [empty.status, empty.json.error.type], [529, 'overloaded_error']);
+
+  console.log('keep-alive pings and the idle watchdog:');
+  // headers go out at once (as real providers do), then the model "thinks" silently
+  up.reset((req, res) => { res.writeHead(200, { 'content-type': 'text/event-stream' }); res.flushHeaders(); setTimeout(() => { for (const e of oaText('late')) res.write(typeof e === 'string' ? e : `data: ${JSON.stringify(e)}\n\n`); res.end(); }, 700); });
+  const pinged = events((await call(port, { body: msg({ stream: true }) })).text);
+  const firstDelta = pinged.findIndex((e) => e[0] === 'content_block_start');
+  const pings = pinged.slice(0, firstDelta).filter((e) => e[0] === 'ping').length;
+  check('a silent upstream gets a ping per interval (1 + ~6 in 700 ms at 100 ms)', pings >= 5, true);
+  check('…and the stream still completes', pinged[pinged.length - 1][0], 'message_stop');
+  up.reset((req, res) => { res.writeHead(200, { 'content-type': 'text/event-stream' }); res.flushHeaders(); /* then silence */ });
+  const idle = events((await call(port, { body: msg({ stream: true }), token: 'tok-idle' })).text);
+  check('idle upstream past options.timeoutMs -> error event naming it', [idle[idle.length - 1][0], /EIDLE/.test(idle[idle.length - 1][1].error.message)], ['error', true]);
+  const idleNs = await call(port, { body: msg(), token: 'tok-idle' });
+  check('…non-stream: 529', [idleNs.status, idleNs.json.error.type], [529, 'overloaded_error']);
+  up.reset(() => { /* never answers, not even headers */ });
+  const noHdr = await call(port, { body: msg({ stream: true }), token: 'tok-idle' });
+  check('no response headers within timeoutMs -> a real 529 (the CLI retries it)', [noHdr.status, noHdr.json.error.type, /EIDLE/.test(noHdr.json.error.message)], [529, 'overloaded_error', true]);
+
+  console.log('client abort:');
+  up.reset((req, res) => { res.writeHead(200, { 'content-type': 'text/event-stream' }); res.write(`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: 'x' } }] })}\n\n`); });
+  await sleep(50); // let the previous test's never-answered upstream request be torn down
+  usage.length = 0;
+  await new Promise((resolve) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'POST', path: '/v1/messages', headers: { 'x-api-key': 'tok-openai', 'content-type': 'application/json' } }, (res) => {
+      res.once('data', () => { req.destroy(); resolve(); });
+    });
+    req.on('error', () => {});
+    req.end(JSON.stringify(msg({ stream: true })));
+  });
+  check('client disconnect aborts the upstream request', await until(() => up.seen[0] && up.seen[0].closedEarly), true);
+  check('…and is recorded as aborted', await until(() => usage.length === 1 && usage[0].status === 'aborted'), true);
+
+  console.log('per-provider concurrency:');
+  up.reset((req, res) => setTimeout(() => sse(res, oaText(`reply ${req.headers['x-order'] || ''}`)), 120));
+  const order = [];
+  const jobs = [1, 2, 3].map((i) => sleep(i * 15).then(() => call(port, { body: msg({ messages: [{ role: 'user', content: `q${i}` }] }), token: 'tok-one' })).then((r) => { order.push(r.json.content[0].text); return r.status; }));
+  const statuses = await Promise.all(jobs);
+  check('maxConcurrency 1: all succeed, never two in flight upstream', [statuses, up.maxActive], [[200, 200, 200], 1]);
+  check('…FIFO', up.seen.map((s) => s.body.messages[0].content), ['q1', 'q2', 'q3']);
+
+  console.log('count_tokens:');
+  const ct = await call(port, { path: '/v1/messages/count_tokens', body: msg() });
+  check('openai-compatible: an estimate, never an upstream call', [ct.status, Number.isInteger(ct.json.input_tokens) && ct.json.input_tokens > 0], [200, true]);
+
+  console.log('passthrough (anthropic):');
+  const anthEvents = [
+    'event: message_start\ndata: {"type":"message_start","message":{"id":"msg_1","type":"message","role":"assistant","model":"claude-haiku-4-5-20251001","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":20,"cache_read_input_tokens":5,"cache_creation_input_tokens":3,"output_tokens":1}}}\n\n',
+    'event: content_block_start\ndata: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}\n\nevent: content_block_delta\ndata: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hi — é"}}\n\n',
+    'event: content_block_stop\ndata: {"type":"content_block_stop","index":0}\n\nevent: message_delta\ndata: {"type":"message_delta","delta":{"stop_reason":"end_turn","stop_sequence":null},"usage":{"output_tokens":42}}\n\nevent: message_stop\ndata: {"type":"message_stop"}\n\n',
+  ];
+  up.reset((req, res) => {
+    res.writeHead(200, { 'content-type': 'text/event-stream', 'request-id': 'req_abc' });
+    let i = 0;
+    const next = () => { if (i < anthEvents.length) { res.write(anthEvents[i++]); setTimeout(next, 20); } else res.end(); };
+    next();
+  });
+  usage.length = 0;
+  const pt = await call(port, { path: '/v1/messages?beta=true', token: 'tok-anthropic', body: msg({ model: 'claude-haiku-4-5', max_tokens: 32000, stream: true }), headers: { 'anthropic-beta': 'claude-code-20250219,effort-2025-11-24', 'anthropic-version': '2023-06-01', 'x-claude-code-session-id': 'sess-pt' } });
+  check('the stream is byte-identical to the provider\'s', pt.text, anthEvents.join(''));
+  check('request-id is kept', pt.headers['request-id'], 'req_abc');
+  const pseen = up.seen[0];
+  check('upstream URL: <base>/v1/messages + the query', pseen.url, '/v1/messages?beta=true');
+  check('credential swap: provider key in x-api-key, no Authorization, run token nowhere', [pseen.headers['x-api-key'], 'authorization' in pseen.headers, JSON.stringify(pseen.headers).includes('tok-anthropic')], ['sk-ant-real', false, false]);
+  check('anthropic-version/-beta and x-claude-code-* forwarded', [pseen.headers['anthropic-version'], pseen.headers['anthropic-beta'], pseen.headers['x-claude-code-session-id']], ['2023-06-01', 'claude-code-20250219,effort-2025-11-24', 'sess-pt']);
+  check('model mapped (modelMap) and max_tokens clamped to caps', [pseen.body.model, pseen.body.max_tokens], ['claude-haiku-4-5-20251001', 4096]);
+  check('usage tapped from message_start + message_delta', [usage[0].inputTokens, usage[0].outputTokens, usage[0].cacheReadTokens, usage[0].cacheWriteTokens, usage[0].model, usage[0].requestedModel, usage[0].cliSessionId], [20, 42, 5, 3, 'claude-haiku-4-5-20251001', 'claude-haiku-4-5', 'sess-pt']);
+  up.reset((req, res) => jsonRes(res, 200, { id: 'msg_2', type: 'message', role: 'assistant', model: 'claude-sonnet-5', content: [{ type: 'text', text: 'ok' }], stop_reason: 'end_turn', usage: { input_tokens: 11, output_tokens: 7 } }));
+  usage.length = 0;
+  const unchanged = JSON.stringify(msg({ model: 'claude-sonnet-5', max_tokens: 100 }));
+  const ptj = await call(port, { token: 'tok-anthropic', raw: unchanged });
+  check('non-stream JSON passes through, usage tapped', [ptj.json.content[0].text, usage[0].inputTokens, usage[0].outputTokens], ['ok', 11, 7]);
+  check('a body that needed no change is forwarded byte-for-byte', up.seen[0].raw, unchanged);
+  const mixed = msg({ model: 'claude-sonnet-5', messages: [
+    { role: 'user', content: 'q' },
+    { role: 'assistant', content: [{ type: 'thinking', thinking: 'from deepseek', signature: 'ccsb1:eyJwIjoiZHMifQ' }, { type: 'text', text: 'a1' }] },
+    { role: 'user', content: 'q2' },
+    { role: 'assistant', content: [{ type: 'thinking', thinking: 'from claude', signature: 'EqQBCkYIBxgCKkB-real' }, { type: 'text', text: 'a2' }] },
+    { role: 'user', content: 'q3' },
+  ] });
+  up.reset((req, res) => jsonRes(res, 200, { id: 'msg_3', type: 'message', role: 'assistant', model: 'claude-sonnet-5', content: [{ type: 'text', text: 'ok' }], stop_reason: 'end_turn', usage: { input_tokens: 1, output_tokens: 1 } }));
+  await call(port, { token: 'tok-anthropic', body: mixed });
+  const sentAsst = up.seen[0].body.messages.filter((m) => m.role === 'assistant').map((m) => m.content.map((b) => b.type + (b.signature ? `:${b.signature.slice(0, 6)}` : '')));
+  check('passthrough drops thinking signed by this bridge (Anthropic would 400), keeps real ones', sentAsst, [['text'], ['thinking:EqQBCk', 'text']]);
+  up.reset((req, res) => jsonRes(res, 429, { type: 'error', error: { type: 'rate_limit_error', message: 'Number of requests has exceeded your rate limit' } }, { 'retry-after': '12', 'request-id': 'req_429' }));
+  const pt429 = await call(port, { token: 'tok-anthropic', body: msg({ model: 'claude-sonnet-5', stream: true }) });
+  check('upstream non-2xx: status, body and retry headers pass through', [pt429.status, pt429.json.error.type, pt429.headers['retry-after'], pt429.headers['request-id']], [429, 'rate_limit_error', '12', 'req_429']);
+  up.reset((req, res) => jsonRes(res, 200, { input_tokens: 1234 }));
+  const ptc = await call(port, { path: '/v1/messages/count_tokens?beta=true', token: 'tok-anthropic', body: msg({ model: 'claude-sonnet-5' }) });
+  check('count_tokens is forwarded for anthropic', [ptc.json, up.seen[0].url], [{ input_tokens: 1234 }, '/v1/messages/count_tokens?beta=true']);
+  up.reset((req, res) => sse(res, anthEvents));
+  const strip = await call(port, { path: '/v1/messages?beta=true', token: 'tok-strip', body: msg({ stream: true }), headers: { 'anthropic-beta': 'claude-code-20250219' } });
+  check('stripBetas: no anthropic-beta header, no ?beta=true', [strip.status, 'anthropic-beta' in up.seen[0].headers, up.seen[0].url], [200, false, '/anthropic/v1/messages']);
+  check('authScheme both: Bearer + x-api-key', [up.seen[0].headers.authorization, up.seen[0].headers['x-api-key']], ['Bearer sk-compat', 'sk-compat']);
+  up.reset((req, res) => jsonRes(res, 404, { type: 'error', error: { type: 'not_found_error', message: 'no count_tokens here' } }));
+  const ctc = await call(port, { path: '/v1/messages/count_tokens', token: 'tok-strip', body: msg() });
+  check('anthropic-compatible without count_tokens -> our estimate', [ctc.status, ctc.json.input_tokens > 0], [200, true]);
+  up.reset((req, res) => { res.writeHead(200, { 'content-type': 'text/event-stream' }); res.write(anthEvents[0]); setTimeout(() => res.socket.destroy(), 30); });
+  const ptCut = await call(port, { token: 'tok-anthropic', body: msg({ model: 'claude-sonnet-5', stream: true }) });
+  check('passthrough cut at an event boundary -> an error event is appended', /event: error\ndata: .*overloaded_error/.test(ptCut.text), true);
+  up.reset((req, res) => jsonRes(res, 503, { type: 'error', error: { type: 'overloaded_error', message: 'busy' } }));
+  await call(port, { token: 'tok-anthropic', body: msg({ model: 'claude-sonnet-5' }) });
+  check('passthrough 503 is retried too (before any client byte)', up.seen.length, 3);
+
+  console.log('the request log:');
+  up.reset((req, res) => sse(res, oaText('fine')));
+  await call(port, { body: msg({ messages: [{ role: 'user', content: 'TOP-SECRET-PROMPT-CONTENT' }] }) });
+  const lg = srv.recentLog();
+  check('entries exist, newest last, with ids/sizes/status', [lg.length > 10, lg[lg.length - 1].route, lg[lg.length - 1].status, typeof lg[lg.length - 1].bytesIn], [true, 'messages', 'ok', 'number']);
+  check('prompt content is never in the log', JSON.stringify(lg).includes('TOP-SECRET'), false);
+  check('provider keys are never in the log', /sk-provider|sk-ant-real/.test(JSON.stringify(lg)), false);
+  check('the log keeps at most 200 entries', await (async () => { for (let i = 0; i < 200; i++) await call(port, { path: '/v1/messages/count_tokens', body: msg() }); return srv.recentLog().length; })(), 200);
+
+  await srv.close();
+  up.server.close();
+  console.log(`\n${pass} passed, ${fail} failed`);
+  process.exit(fail ? 1 : 0);
+})().catch((e) => { console.error(e); process.exit(1); });
diff --git a/test/llm-bridge-translate.test.js b/test/llm-bridge-translate.test.js
new file mode 100644
index 00000000..f7efdfa7
--- /dev/null
+++ b/test/llm-bridge-translate.test.js
@@ -0,0 +1,534 @@
+// Pure translation rules of the LLM bridge: Anthropic Messages request -> OpenAI Chat
+// Completions request (per dialect), and OpenAI stream/JSON -> Anthropic events/Message.
+// No sockets. The golden input is a REAL Claude Code 2.1.281 request captured by
+// test/llm-bridge-contract.test.js (CCS_CONTRACT_CAPTURE=1).
+//
+// Run: node test/llm-bridge-translate.test.js
+'use strict';
+const assert = require('assert');
+const path = require('path');
+const { toOpenAI, BadRequest, IMAGE_OMITTED, PDF_OMITTED, NO_OUTPUT, INTERRUPTED } = require('../llm-bridge/translate-request');
+const { createTranslator, createAggregator, completionToChunk } = require('../llm-bridge/translate-response');
+const { resolveDialect, PRESETS } = require('../llm-bridge/dialects');
+const { resolveModel, capsFor, effectiveEffort } = require('../llm-bridge/models');
+const { upstreamToolName, TOOL_NAME_RE, makeSignature, readSignature, anthropicToolId, upstreamToolId } = require('../llm-bridge/ids');
+const { sanitizeSchema } = require('../llm-bridge/schema');
+const { parseToolArguments } = require('../llm-bridge/json-repair');
+const { estimateInputTokens, createCalibrator } = require('../llm-bridge/estimate');
+const { canonicalizeError, overflowMessage } = require('../llm-bridge/errors');
+const { createSseParser, parseEventJson } = require('../llm-bridge/sse');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+const clone = (o) => JSON.parse(JSON.stringify(o));
+
+// ------------------------------------------------------------------ helpers --
+const CAPS = { tools: true, vision: true, reasoning: true, pdf: true, contextWindow: 128000, maxOutput: 16000 };
+function ctxFor(dialect = 'generic', over = {}) {
+  return {
+    runId: 'run-1', purpose: 'chat',
+    provider: { id: over.providerId || 'prov', label: 'Prov', type: 'openai-compatible', baseUrl: 'https://x.example/v1', apiKey: 'k', dialect, options: over.options || {} },
+    // 'fake-model' is the model id of the captured real request
+    model: 'm1', models: { m1: { ...CAPS, ...(over.caps || {}) }, 'fake-model': { ...CAPS, ...(over.caps || {}) } }, modelMap: over.modelMap || {}, fallbackModel: over.fallbackModel || 'm1',
+    effort: over.effort === undefined ? null : over.effort,
+  };
+}
+function translate(body, dialect = 'generic', over = {}) {
+  const ctx = ctxFor(dialect, over);
+  const upstreamModel = resolveModel(ctx, body.model);
+  return toOpenAI(body, { ctx, dialect: resolveDialect(ctx.provider), upstreamModel, caps: capsFor(ctx, upstreamModel) });
+}
+const simple = (extra = {}) => ({ model: 'm1', max_tokens: 1000, messages: [{ role: 'user', content: 'hi' }], ...extra });
+
+/** Run chunks through the translator; returns [[event, data], …]. */
+function runStream(chunks, opts = {}) {
+  const events = [];
+  const t = createTranslator({ clientModel: 'client-model', providerId: 'prov', toolNames: opts.toolNames || new Map(), stopSequences: opts.stopSequences || [], inputEstimate: 100, emitThinking: opts.emitThinking !== false, sink: (e, d) => events.push([e, d]) });
+  t.start();
+  for (const c of chunks) {
+    const r = t.chunk(c);
+    if (r && r.error !== undefined) { t.fail('api_error', String(r.error.message || r.error)); return events; }
+  }
+  t.end();
+  return events;
+}
+const ch = (delta, extra = {}) => ({ choices: [{ index: 0, delta, ...extra }] });
+const fin = (reason, usage) => ({ choices: [{ index: 0, delta: {}, finish_reason: reason }], ...(usage ? { usage } : {}) });
+
+/** The invariants every translated stream must hold. Returns a list of violations. */
+function streamProblems(events, { expectError = false } = {}) {
+  const p = [];
+  const names = events.map((e) => e[0]);
+  if (names.filter((n) => n === 'message_start').length !== 1) p.push('exactly one message_start');
+  if (names[0] !== 'message_start') p.push('message_start first');
+  let open = null;
+  let last = -1;
+  for (const [n, d] of events) {
+    if (n === 'content_block_start') {
+      if (open !== null) p.push(`block ${d.index} started while ${open} open`);
+      if (!(d.index > last)) p.push(`index ${d.index} not increasing`);
+      last = d.index; open = d.index;
+    } else if (n === 'content_block_delta') {
+      if (d.index !== open) p.push(`delta for ${d.index} while ${open} open`);
+    } else if (n === 'content_block_stop') {
+      if (d.index !== open) p.push(`stop for ${d.index} while ${open} open`);
+      open = null;
+    }
+  }
+  if (open !== null) p.push(`block ${open} never stopped`);
+  const stops = names.filter((n) => n === 'message_stop').length;
+  if (expectError) {
+    if (names[names.length - 1] !== 'error') p.push('error is last');
+    if (stops) p.push('no message_stop after an error');
+  } else {
+    if (stops !== 1 || names[names.length - 1] !== 'message_stop') p.push('exactly one message_stop, last');
+    const md = events.filter((e) => e[0] === 'message_delta');
+    if (md.length !== 1) p.push('one message_delta');
+    else {
+      const u = md[0][1].usage || {};
+      if (!Number.isInteger(u.input_tokens) || !Number.isInteger(u.output_tokens)) p.push('message_delta carries usage');
+    }
+    if (names.includes('error')) p.push('no error on success');
+  }
+  return p;
+}
+const blocks = (events) => events.filter((e) => e[0] === 'content_block_start').map((e) => e[1].content_block.type);
+const stopOf = (events) => { const d = events.find((e) => e[0] === 'message_delta'); return d && d[1].delta.stop_reason; };
+const usageOf = (events) => { const d = events.find((e) => e[0] === 'message_delta'); return d && d[1].usage; };
+const toolInputs = (events) => {
+  const out = [];
+  for (const [n, d] of events) {
+    if (n === 'content_block_start' && d.content_block.type === 'tool_use') out.push({ id: d.content_block.id, name: d.content_block.name, json: '' });
+    if (n === 'content_block_delta' && d.delta.type === 'input_json_delta') out[out.length - 1].json += d.delta.partial_json;
+  }
+  return out.map((t) => ({ id: t.id, name: t.name, input: JSON.parse(t.json) }));
+};
+
+// ============================================================ the real request --
+const fixture = require(path.join(__dirname, 'fixtures', 'llm-bridge', 'claude-2.1.281-request.json'));
+const real = fixture.body;
+
+console.log('real Claude Code 2.1.281 request -> generic:');
+{
+  const r = translate(clone(real), 'generic');
+  const b = r.body;
+  check('roles: system first, then the conversation with tool turns', b.messages.map((m) => m.role),
+    ['system', 'user', 'assistant', 'tool', 'user', 'assistant', 'tool', 'user']);
+  const sys = b.messages[0].content;
+  check('system is one string', typeof sys, 'string');
+  check('the billing header block is gone', /x-anthropic-billing-header/.test(sys), false);
+  check('the system prompt text is kept', sys.startsWith(real.system[1].text), true);
+  check('the leading system-role entry (environment) is folded into the system prompt', /# Environment/.test(sys), true);
+  check('a later system-role entry becomes user text (keeps the prefix cacheable)', b.messages[4].content, '<total_tokens>N tokens left</total_tokens>');
+  check('tools become functions in order', b.tools.map((t) => t.function.name), real.tools.map((t) => t.name));
+  check('tool schemas lose $schema but keep additionalProperties (basic)', [b.tools.some((t) => '$schema' in t.function.parameters), b.tools[0].function.parameters.additionalProperties], [false, false]);
+  check('tool_use -> tool_calls with JSON arguments', b.messages[2].tool_calls, [{ id: 'call_read_1', type: 'function', function: { name: 'Read', arguments: JSON.stringify({ file_path: '/WORKDIR/note.txt' }) } }]);
+  check('assistant text survives next to the tool call', b.messages[2].content, 'Reading the file.');
+  check('tool_result -> role:tool', [b.messages[3].tool_call_id, b.messages[3].content], ['call_read_1', '1\toriginal line\n2\t']);
+  check('generic does not echo reasoning', 'reasoning_content' in b.messages[2], false);
+  check('max_tokens clamped to caps.maxOutput', b.max_tokens, 16000);
+  check('effort from output_config (RunCtx has none)', b.reasoning_effort, 'high');
+  check('streams upstream with usage', [b.stream, b.stream_options], [true, { include_usage: true }]);
+  check('metadata.user_id -> 32-hex user', /^[0-9a-f]{32}$/.test(b.user), true);
+  check('no Anthropic-only field leaks', ['system', 'thinking', 'output_config', 'metadata', 'context_management', 'stop_sequences', 'tool_choice'].filter((k) => k in b), []);
+  check('cache_control stripped everywhere', JSON.stringify(b).includes('cache_control'), false);
+  check('the client asked for thinking (adaptive)', r.emitThinking, true);
+}
+
+console.log('real request -> each dialect:');
+{
+  const o = translate(clone(real), 'openai').body;
+  check('openai: max_completion_tokens, reasoning_effort', [o.max_completion_tokens, 'max_tokens' in o, o.reasoning_effort], [16000, false, 'high']);
+  const orr = translate(clone(real), 'openrouter').body;
+  check('openrouter: reasoning object, usage.include', [orr.reasoning, orr.usage], [{ effort: 'high' }, { include: true }]);
+  check('openrouter: cache_control kept on content parts', JSON.stringify(orr.messages).includes('"cache_control":{"type":"ephemeral"}'), true);
+  check('openrouter: system keeps its cache_control parts', Array.isArray(orr.messages[0].content) && orr.messages[0].content.some((p) => p.cache_control), true);
+  check('openrouter: echoes its own reasoning? (signature is provider "fake", not ours)', 'reasoning_details' in orr.messages[2], false);
+  const ds = translate(clone(real), 'deepseek').body;
+  check('deepseek: thinking enabled, no reasoning_effort', [ds.thinking, 'reasoning_effort' in ds], [{ type: 'enabled' }, false]);
+  const ds2 = translate(clone(real), 'deepseek', { providerId: 'fake' }).body;
+  check('deepseek: echoes reasoning_content of its OWN thinking blocks', [ds2.messages[2].reasoning_content, ds2.messages[5].reasoning_content], ['I should look at the file first.', 'Now change it.']);
+  const gm = translate(clone(real), 'gemini').body;
+  const readParams = gm.tools.find((t) => t.function.name === 'Read').function.parameters;
+  check('gemini: strict schema drops additionalProperties/exclusiveMinimum', [JSON.stringify(gm.tools).includes('additionalProperties'), JSON.stringify(readParams).includes('exclusiveMinimum')], [false, false]);
+  check('gemini: reasoning_effort', gm.reasoning_effort, 'high');
+  const qw = translate(clone(real), 'qwen').body;
+  check('qwen: enable_thinking + budget for high', [qw.enable_thinking, qw.thinking_budget], [true, 16384]);
+  const ms = translate(clone(real), 'mistral').body;
+  const ids = ms.messages.filter((m) => m.tool_calls).map((m) => m.tool_calls[0].id);
+  const tids = ms.messages.filter((m) => m.role === 'tool').map((m) => m.tool_call_id);
+  check('mistral: 9-char alnum tool ids, consistent both ways', [ids.every((i) => /^[A-Za-z0-9]{9}$/.test(i)), ids], [true, tids]);
+  check('mistral: deterministic id mapping', upstreamToolId('call_read_1', 'mistral9'), ids[0]);
+  check('mistral: no effort param', ['reasoning_effort', 'reasoning', 'thinking'].some((k) => k in ms), false);
+  check('mistral: no user message right after a tool message', ms.messages.some((m, i) => m.role === 'user' && ms.messages[i - 1] && ms.messages[i - 1].role === 'tool'), false);
+  check('mistral: that text went into the tool message', /<total_tokens>/.test(ms.messages.filter((m) => m.role === 'tool')[0].content), true);
+  check('mistral: no field its strict validator rejects (user, stream_options)', ['user' in ms, 'stream_options' in ms, ms.stream], [false, false, true]);
+  check('gemini: no user field', 'user' in gm, false);
+  const ol = translate(clone(real), 'ollama').body;
+  check('ollama: no reasoning_effort unless caps say reasoning:true', 'reasoning_effort' in translate(clone(real), 'ollama', { caps: { reasoning: null } }).body, false);
+  check('ollama: reasoning_effort when caps.reasoning === true', ol.reasoning_effort, 'high');
+}
+
+console.log('system handling:');
+{
+  const b = translate(simple({ system: 'plain system', messages: [{ role: 'user', content: 'a' }, { role: 'system', content: [{ type: 'text', text: 'one' }, { type: 'text', text: 'two' }] }] })).body;
+  check('string system + folded system entry', b.messages[0], { role: 'system', content: 'plain system\n\none\n\ntwo' });
+  const all = translate(simple({ messages: [{ role: 'user', content: 'a' }, { role: 'assistant', content: 'b' }, { role: 'system', content: 'late' }, { role: 'user', content: 'c' }] }), 'generic', { options: { systemFold: 'all' } }).body;
+  check('systemFold:all folds even late entries', [all.messages[0].content, all.messages.map((m) => m.role)], ['late', ['system', 'user', 'assistant', 'user']]);
+  const late = translate(simple({ messages: [{ role: 'user', content: 'a' }, { role: 'assistant', content: 'b' }, { role: 'system', content: 'late note' }, { role: 'user', content: 'c' }] })).body;
+  check('a late plain note is wrapped as a system-reminder and merged into the next user turn', late.messages[2], { role: 'user', content: '<system-reminder>\nlate note\n</system-reminder>\n\nc' });
+  check('an unknown role is a 400, naming the index', (() => { try { translate(simple({ messages: [{ role: 'user', content: 'a' }, { role: 'tool', content: 'x' }] })); return null; } catch (e) { return e instanceof BadRequest && /messages\.1\.role/.test(e.message); } })(), true);
+  check('no usable content is a 400', (() => { try { translate(simple({ messages: [{ role: 'system', content: 'x' }] })); return null; } catch (e) { return e instanceof BadRequest; } })(), true);
+}
+
+console.log('user content:');
+{
+  const img = { type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'AAAA' } };
+  const b = translate(simple({ messages: [{ role: 'user', content: [{ type: 'text', text: 'look' }, img, { type: 'image', source: { type: 'url', url: 'https://i.example/x.png' } }] }] })).body;
+  check('images -> image_url parts (base64 -> data URL, url -> url)', b.messages[0].content, [{ type: 'text', text: 'look' }, { type: 'image_url', image_url: { url: 'data:image/png;base64,AAAA' } }, { type: 'image_url', image_url: { url: 'https://i.example/x.png' } }]);
+  const nv = translate(simple({ messages: [{ role: 'user', content: [{ type: 'text', text: 'look' }, img] }] }), 'generic', { caps: { vision: false } }).body;
+  check('no vision -> placeholder text (and collapses to a string)', nv.messages[0].content, `look\n\n${IMAGE_OMITTED}`);
+  check('consecutive text parts collapse to one string', translate(simple({ messages: [{ role: 'user', content: [{ type: 'text', text: 'a' }, { type: 'text', text: 'b' }] }] })).body.messages[0].content, 'a\n\nb');
+  const pdf = { type: 'document', source: { type: 'base64', media_type: 'application/pdf', data: 'JVBE' } };
+  check('PDF with fileParts (openai) -> file part', translate(simple({ messages: [{ role: 'user', content: [pdf] }] }), 'openai').body.messages[0].content, [{ type: 'file', file: { filename: 'document.pdf', file_data: 'data:application/pdf;base64,JVBE' } }]);
+  check('PDF without fileParts -> placeholder, never a 400', translate(simple({ messages: [{ role: 'user', content: [pdf] }] })).body.messages[0].content, PDF_OMITTED);
+  check('PDF with caps.pdf false -> placeholder even on openai', translate(simple({ messages: [{ role: 'user', content: [pdf] }] }), 'openai', { caps: { pdf: false } }).body.messages[0].content, PDF_OMITTED);
+  check('a plain-text document -> its text', translate(simple({ messages: [{ role: 'user', content: [{ type: 'document', title: 'T', source: { type: 'text', data: 'body' } }] }] })).body.messages[0].content, 'T\n\nbody');
+}
+
+console.log('tool results:');
+{
+  const hist = (result, extra = []) => simple({ messages: [
+    { role: 'user', content: 'go' },
+    { role: 'assistant', content: [{ type: 'tool_use', id: 'toolu_1', name: 'Shot', input: {} }] },
+    { role: 'user', content: [result, ...extra] },
+  ] });
+  const img = { type: 'image', source: { type: 'base64', media_type: 'image/jpeg', data: 'QQ==' } };
+  const withImg = translate(hist({ type: 'tool_result', tool_use_id: 'toolu_1', content: [{ type: 'text', text: 'captured' }, img] }, [{ type: 'text', text: 'and?' }])).body;
+  check('tool result with an image: tool text, then a user message carrying the image', withImg.messages.slice(2), [
+    { role: 'tool', tool_call_id: 'toolu_1', content: 'captured' },
+    { role: 'user', content: [{ type: 'text', text: '[image from tool result toolu_1]' }, { type: 'image_url', image_url: { url: 'data:image/jpeg;base64,QQ==' } }, { type: 'text', text: 'and?' }] },
+  ]);
+  const noVis = translate(hist({ type: 'tool_result', tool_use_id: 'toolu_1', content: [img] }), 'generic', { caps: { vision: false } }).body;
+  check('no vision: placeholder in the tool message, no extra user turn', noVis.messages.slice(2), [{ role: 'tool', tool_call_id: 'toolu_1', content: IMAGE_OMITTED }]);
+  check('empty tool result -> "(no output)"', translate(hist({ type: 'tool_result', tool_use_id: 'toolu_1', content: [] })).body.messages[2].content, NO_OUTPUT);
+  check('is_error -> "[tool error] " prefix', translate(hist({ type: 'tool_result', tool_use_id: 'toolu_1', is_error: true, content: 'boom' })).body.messages[2].content, '[tool error] boom');
+  const orphan = translate(simple({ messages: [{ role: 'user', content: [{ type: 'tool_result', tool_use_id: 'gone', content: 'late' }, { type: 'text', text: 'hi' }] }] })).body;
+  check('an orphaned tool result is demoted to user text (OpenAI 400s on it)', orphan.messages, [{ role: 'user', content: '[result of tool call gone]\nlate\n\nhi' }]);
+  const missing = translate(simple({ messages: [
+    { role: 'user', content: 'go' },
+    { role: 'assistant', content: [{ type: 'tool_use', id: 'a', name: 'X', input: {} }, { type: 'tool_use', id: 'b', name: 'X', input: {} }] },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'a', content: 'ok' }, { type: 'text', text: 'next' }] },
+  ] })).body;
+  check('an unanswered tool call gets a synthetic "interrupted" answer', missing.messages.slice(2).map((m) => [m.role, m.tool_call_id || null, m.content]), [['tool', 'a', 'ok'], ['tool', 'b', INTERRUPTED], ['user', null, 'next']]);
+  const empty = translate(simple({ messages: [{ role: 'user', content: 'a' }, { role: 'assistant', content: [{ type: 'thinking', thinking: 'x', signature: 'real-anthropic-sig' }] }, { role: 'user', content: 'b' }] })).body;
+  check('an assistant turn that ends up empty is dropped and the users merge', empty.messages, [{ role: 'user', content: 'a\n\nb' }]);
+}
+
+console.log('thinking echo via signatures:');
+{
+  const ev = runStream([ch({ reasoning_content: 'step one' }), ch({ content: 'answer' }), fin('stop')]);
+  const sig = ev.find((e) => e[0] === 'content_block_delta' && e[1].delta.type === 'signature_delta')[1].delta.signature;
+  check('our signature is ccsb1: + base64url JSON naming the provider', [sig.startsWith('ccsb1:'), readSignature(sig)], [true, { p: 'prov' }]);
+  const history = (signature, thinking = 'step one') => simple({ messages: [{ role: 'user', content: 'q' }, { role: 'assistant', content: [{ type: 'thinking', thinking, signature }, { type: 'text', text: 'answer' }] }, { role: 'user', content: 'q2' }] });
+  check('deepseek echoes its own reasoning as reasoning_content', translate(history(sig), 'deepseek').body.messages[1].reasoning_content, 'step one');
+  check('another provider\'s reasoning is dropped', 'reasoning_content' in translate(history(makeSignature('other')), 'deepseek').body.messages[1], false);
+  check('a real Anthropic signature is dropped', 'reasoning_content' in translate(history('EqQBCkYIBxgCKkB…'), 'deepseek').body.messages[1], false);
+  check('reasoningEcho none drops it', 'reasoning_content' in translate(history(sig), 'generic').body.messages[1], false);
+  const det = [{ type: 'reasoning.text', text: 'we', index: 0 }, { type: 'reasoning.text', text: ' think', index: 0, signature: 'sigX' }, { type: 'reasoning.encrypted', data: 'ENC', index: 1 }];
+  const ev2 = runStream([ch({ reasoning: 'we', reasoning_details: [det[0]] }), ch({ reasoning: ' think', reasoning_details: [det[1]] }), ch({ reasoning_details: [det[2]] }), ch({ content: 'x' }), fin('stop')]);
+  const shown = ev2.filter((e) => e[0] === 'content_block_delta' && e[1].delta.type === 'thinking_delta').map((e) => e[1].delta.thinking).join('');
+  check('shown reasoning is the text, encrypted items are not shown', shown, 'we think');
+  const sig2 = ev2.find((e) => e[0] === 'content_block_delta' && e[1].delta.type === 'signature_delta')[1].delta.signature;
+  const merged = [{ type: 'reasoning.text', text: 'we think', index: 0, signature: 'sigX' }, { type: 'reasoning.encrypted', data: 'ENC', index: 1 }];
+  check('streamed details are merged by index and carried in the signature', readSignature(sig2).d, merged);
+  check('openrouter echoes the decoded reasoning_details', translate(history(sig2, 'we think'), 'openrouter').body.messages[1].reasoning_details, merged);
+}
+
+console.log('tool names:');
+{
+  const long = 'mcp__my.company-server__do/the:thing_' + 'x'.repeat(60);
+  const up = upstreamToolName(long);
+  check('an invalid name maps to a valid, deterministic one', [TOOL_NAME_RE.test(up), up === upstreamToolName(long), /^t[0-9a-f]{8}_/.test(up)], [true, true, true]);
+  check('a valid name is untouched', upstreamToolName('mcp__srv__tool'), 'mcp__srv__tool');
+  const body = simple({ tools: [{ name: long, input_schema: { type: 'object' } }, { name: 'Read', input_schema: { type: 'object' } }], tool_choice: { type: 'tool', name: long } });
+  const r = translate(body);
+  check('tools keep their order; the invalid one is renamed', r.body.tools.map((t) => t.function.name), [up, 'Read']);
+  check('tool_choice follows the rename', r.body.tool_choice, { type: 'function', function: { name: up } });
+  const ev = runStream([ch({ tool_calls: [{ index: 0, id: 'call_9', function: { name: up, arguments: '{}' } }] }), fin('tool_calls')], { toolNames: r.toolNames });
+  check('the response maps the name back', toolInputs(ev)[0].name, long);
+  const hist = translate(simple({ messages: [{ role: 'user', content: 'a' }, { role: 'assistant', content: [{ type: 'tool_use', id: 'x1', name: long, input: {} }] }, { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'x1', content: 'r' }] }] }));
+  check('history tool_use names map the same way', hist.body.messages[1].tool_calls[0].function.name, up);
+  check('server tools are dropped, custom kept', translate(simple({ tools: [{ type: 'web_search_20250305', name: 'web_search' }, { type: 'custom', name: 'A', input_schema: {} }, { name: 'B', input_schema: {} }] })).body.tools.map((t) => t.function.name), ['A', 'B']);
+}
+
+console.log('tool_choice / sampling / stops / extraBody:');
+{
+  const tools = [{ name: 'A', input_schema: { type: 'object' } }];
+  check('auto/any/none', ['auto', 'any', 'none'].map((t) => translate(simple({ tools, tool_choice: { type: t } })).body.tool_choice), ['auto', 'required', 'none']);
+  check('disable_parallel_tool_use -> parallel_tool_calls:false', translate(simple({ tools, tool_choice: { type: 'auto', disable_parallel_tool_use: true } })).body.parallel_tool_calls, false);
+  check('no tools -> no tool_choice', 'tool_choice' in translate(simple({ tool_choice: { type: 'any' } })).body, false);
+  check('caps.tools false -> tools not sent', 'tools' in translate(simple({ tools }), 'generic', { caps: { tools: false } }).body, false);
+  const s = translate(simple({ temperature: 0.3, top_p: 0.9, top_k: 40, stop_sequences: ['a', 'b', 'c', 'd', 'e'] })).body;
+  check('temperature/top_p pass, top_k needs allowTopK, stop capped at 4', [s.temperature, s.top_p, 'top_k' in s, s.stop], [0.3, 0.9, false, ['a', 'b', 'c', 'd']]);
+  check('openrouter passes top_k', translate(simple({ top_k: 40 }), 'openrouter').body.top_k, 40);
+  const oa = translate(simple({ temperature: 0.3, top_p: 0.9 }), 'openai', { effort: 'high' }).body;
+  check('openai drops sampling when reasoning is on', ['temperature' in oa, 'top_p' in oa], [false, false]);
+  check('openai keeps sampling when reasoning is off', translate(simple({ temperature: 0.3 }), 'openai', { caps: { reasoning: false }, effort: 'high' }).body.temperature, 0.3);
+  const eb = translate(simple(), 'generic', { options: { extraBody: { provider: { order: ['x'] }, stream_options: { extra: 1 } } } }).body;
+  check('extraBody deep-merges last', [eb.provider, eb.stream_options], [{ order: ['x'] }, { include_usage: true, extra: 1 }]);
+  check('max_tokens below the cap is kept', translate(simple({ max_tokens: 500 })).body.max_tokens, 500);
+  check('max_tokens with an unknown cap is kept', translate(simple({ max_tokens: 64000 }), 'generic', { caps: { maxOutput: null } }).body.max_tokens, 64000);
+  const js = translate(simple({ output_config: { format: { type: 'json_schema', schema: { type: 'object', properties: { a: { type: 'string' } }, additionalProperties: false } } } })).body;
+  check('structured output -> response_format json_schema', js.response_format, { type: 'json_schema', json_schema: { name: 'output', schema: { type: 'object', properties: { a: { type: 'string' } }, additionalProperties: false } } });
+  check('upstreamStream:false -> no stream flag', 'stream' in translate(simple(), 'generic', { options: { upstreamStream: false } }).body, false);
+}
+
+console.log('effort, every source and dialect:');
+{
+  const E = (ctxEffort, body) => effectiveEffort({ effort: ctxEffort }, body);
+  check('RunCtx wins over output_config and thinking', E('low', { output_config: { effort: 'max' }, thinking: { type: 'enabled', budget_tokens: 30000 } }), 'low');
+  check('output_config next', E(null, { output_config: { effort: 'max' }, thinking: { type: 'disabled' } }), 'max');
+  check('RunCtx "auto" = provider default, even over the CLI\'s own output_config', E('auto', { output_config: { effort: 'high' }, thinking: { type: 'enabled', budget_tokens: 9000 } }), null);
+  check('thinking budgets bucket: <2500 low, <8000 medium, else high', [1024, 2499, 2500, 7999, 8000, 31999].map((b) => E(null, { thinking: { type: 'enabled', budget_tokens: b } })), ['low', 'low', 'medium', 'medium', 'high', 'high']);
+  check('enabled without a budget -> medium; adaptive -> provider default; disabled -> none; absent -> none sent',
+    [E(null, { thinking: { type: 'enabled' } }), E(null, { thinking: { type: 'adaptive' } }), E(null, { thinking: { type: 'disabled' } }), E(null, {})], ['medium', null, 'none', null]);
+  const eff = (dialect, effort, caps) => { const b = translate(simple(), dialect, { effort, caps }).body; return ['reasoning_effort', 'reasoning', 'thinking', 'enable_thinking', 'thinking_budget'].filter((k) => k in b).map((k) => [k, b[k]]); };
+  check('generic: low..max (xhigh/max -> high), none omitted', ['low', 'medium', 'high', 'xhigh', 'max', 'none'].map((e) => eff('generic', e)), [[['reasoning_effort', 'low']], [['reasoning_effort', 'medium']], [['reasoning_effort', 'high']], [['reasoning_effort', 'high']], [['reasoning_effort', 'high']], []]);
+  check('openai: none -> "none"', eff('openai', 'none'), [['reasoning_effort', 'none']]);
+  check('gemini: max -> high', eff('gemini', 'max'), [['reasoning_effort', 'high']]);
+  check('openrouter: effort object; none -> enabled:false', [eff('openrouter', 'medium'), eff('openrouter', 'none')], [[['reasoning', { effort: 'medium' }]], [['reasoning', { enabled: false }]]]);
+  check('deepseek: thinking enabled/disabled', [eff('deepseek', 'low'), eff('deepseek', 'none')], [[['thinking', { type: 'enabled' }]], [['thinking', { type: 'disabled' }]]]);
+  check('qwen: budgets per effort, max = caps.maxOutput', ['low', 'medium', 'high', 'xhigh', 'max', 'none'].map((e) => eff('qwen', e)),
+    [[['enable_thinking', true], ['thinking_budget', 2048]], [['enable_thinking', true], ['thinking_budget', 8192]], [['enable_thinking', true], ['thinking_budget', 16384]], [['enable_thinking', true], ['thinking_budget', 32768]], [['enable_thinking', true], ['thinking_budget', 16000]], [['enable_thinking', false]]]);
+  check('mistral: never', eff('mistral', 'high'), []);
+  check('ollama: only with caps.reasoning true', [eff('ollama', 'high', { reasoning: null }), eff('ollama', 'high', { reasoning: true })], [[], [['reasoning_effort', 'high']]]);
+  check('caps.reasoning false: nothing, for every dialect', Object.keys(PRESETS).map((d) => eff(d, 'high', { reasoning: false }).length), Object.keys(PRESETS).map(() => 0));
+  check('RunCtx effort beats the request\'s output_config in the upstream body', translate(simple({ output_config: { effort: 'low' } }), 'generic', { effort: 'xhigh' }).body.reasoning_effort, 'high');
+  check('dialect overrides via provider.options', translate(simple(), 'generic', { effort: 'high', options: { effortParam: 'thinking' } }).body.thinking, { type: 'enabled' });
+}
+
+console.log('model resolution:');
+{
+  const ctx = ctxFor('generic', { modelMap: { 'claude-haiku-4-5': 'fast-1', haiku: 'fast-2' }, fallbackModel: 'fb' });
+  check('modelMap exact match first', resolveModel(ctx, 'claude-haiku-4-5'), 'fast-1');
+  check('family alias covers dated ids', resolveModel(ctx, 'claude-haiku-4-5-20251001'), 'fast-2');
+  check('a run model passes', resolveModel(ctx, 'm1'), 'm1');
+  check('an unknown Claude-looking id -> fallbackModel', resolveModel(ctx, 'claude-sonnet-5'), 'fb');
+  check('an unknown non-Claude id passes unchanged', resolveModel(ctx, 'vendor/x'), 'vendor/x');
+  check('anthropic keeps Claude ids', resolveModel({ ...ctx, provider: { type: 'anthropic' } }, 'claude-sonnet-5'), 'claude-sonnet-5');
+  check('anthropic-compatible: unknown Claude id -> fallbackModel (DeepSeek & co. do not serve Claude names)', resolveModel({ ...ctx, provider: { type: 'anthropic-compatible' } }, 'claude-sonnet-5'), 'fb');
+  check('anthropic-compatible without a fallbackModel keeps the id (a Claude proxy)', resolveModel({ ...ctx, fallbackModel: null, provider: { type: 'anthropic-compatible' } }, 'claude-sonnet-5'), 'claude-sonnet-5');
+  check('anthropic-compatible: its own model ids pass', resolveModel({ ...ctx, provider: { type: 'anthropic-compatible' } }, 'm1'), 'm1');
+  check('no model in the request -> the run model', resolveModel(ctx, undefined), 'm1');
+}
+
+console.log('schema sanitize:');
+{
+  const schema = { $schema: 'https://json-schema.org/draft/2020-12/schema', type: 'object', additionalProperties: false, required: [],
+    properties: { default: { type: 'string', format: 'uri', default: 'x' }, n: { type: 'integer', exclusiveMinimum: 0, examples: [1] }, e: { const: 'k' }, when: { type: 'string', format: 'date-time' },
+      list: { type: 'array', items: { type: 'object', $schema: 'x', additionalProperties: { type: 'string' }, properties: { format: { type: 'string' } } } } } };
+  check('basic: $schema and empty required gone, the rest kept', sanitizeSchema(schema, 'basic'), { type: 'object', additionalProperties: false,
+    properties: { default: { type: 'string', format: 'uri', default: 'x' }, n: { type: 'integer', exclusiveMinimum: 0, examples: [1] }, e: { const: 'k' }, when: { type: 'string', format: 'date-time' },
+      list: { type: 'array', items: { type: 'object', additionalProperties: { type: 'string' }, properties: { format: { type: 'string' } } } } } });
+  check('strict: unsupported keywords removed recursively; parameters NAMED default/format survive', sanitizeSchema(schema, 'strict'), { type: 'object',
+    properties: { default: { type: 'string' }, n: { type: 'integer' }, e: { enum: ['k'] }, when: { type: 'string', format: 'date-time' },
+      list: { type: 'array', items: { type: 'object', properties: { format: { type: 'string' } } } } } });
+  check('none: untouched', sanitizeSchema(schema, 'none'), schema);
+  check('missing schema -> empty object schema', sanitizeSchema(undefined), { type: 'object', properties: {} });
+}
+
+console.log('tool arguments:');
+{
+  check('valid', parseToolArguments('{"a":1}'), { value: { a: 1 }, repaired: false, invalid: false });
+  check('empty -> {}', parseToolArguments(''), { value: {}, repaired: false, invalid: false });
+  check('trailing comma repaired', parseToolArguments('{"a":1,}').value, { a: 1 });
+  check('truncated object closed', parseToolArguments('{"a":"b","c":[1,2').value, { a: 'b', c: [1, 2] });
+  check('JSON inside a JSON string unwrapped', parseToolArguments(JSON.stringify(JSON.stringify({ a: 1 }))).value, { a: 1 });
+  check('object sent twice -> first', parseToolArguments('{"a":1}{"a":1}').value, { a: 1 });
+  check('code fence stripped', parseToolArguments('```json\n{"a":1}\n```').value, { a: 1 });
+  check('unrepairable -> __invalid_arguments (truncated raw)', parseToolArguments('not json at all'), { value: { __invalid_arguments: 'not json at all' }, repaired: false, invalid: true });
+  check('an array is not a tool input', parseToolArguments('[1,2]').invalid, true);
+  check('raw is truncated to 2000 chars', parseToolArguments('x'.repeat(5000)).value.__invalid_arguments.length, 2000);
+}
+
+// ================================================================== streams --
+console.log('stream: text only:');
+{
+  const ev = runStream([ch({ role: 'assistant', content: 'Hel' }), ch({ content: 'lo' }), fin('stop', { prompt_tokens: 50, completion_tokens: 2 })]);
+  check('invariants', streamProblems(ev), []);
+  check('one text block', blocks(ev), ['text']);
+  check('message_start: client model name, estimate, output 1', [ev[0][1].message.model, ev[0][1].message.usage], ['client-model', { input_tokens: 100, output_tokens: 1, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 }]);
+  check('ping right after message_start', ev[1][0], 'ping');
+  check('end_turn + real usage', [stopOf(ev), usageOf(ev)], ['end_turn', { input_tokens: 50, output_tokens: 2, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 }]);
+  check('message id shape', /^msg_[A-Za-z0-9]{24}$/.test(ev[0][1].message.id), true);
+}
+
+console.log('stream: reasoning, text, two tool calls:');
+{
+  const ev = runStream([
+    ch({ reasoning_content: 'think ' }), ch({ reasoning_content: 'more' }), ch({ content: 'Let me look.' }),
+    ch({ tool_calls: [{ index: 0, id: 'call_a', type: 'function', function: { name: 'Read', arguments: '' } }] }),
+    ch({ tool_calls: [{ index: 0, function: { arguments: '{"file_path":' } }] }),
+    ch({ tool_calls: [{ index: 0, function: { arguments: '"/a"}' } }] }),
+    ch({ tool_calls: [{ index: 1, id: 'call_b', type: 'function', function: { name: 'Read', arguments: '{"file_path":"/b"}' } }] }),
+    fin('tool_calls'), { choices: [], usage: { prompt_tokens: 10, completion_tokens: 20, completion_tokens_details: { reasoning_tokens: 7 } } },
+  ]);
+  check('invariants', streamProblems(ev), []);
+  check('thinking, text, tool_use, tool_use', blocks(ev), ['thinking', 'text', 'tool_use', 'tool_use']);
+  check('tool calls complete, in order, one input_json_delta each', [toolInputs(ev), ev.filter((e) => e[0] === 'content_block_delta' && e[1].delta.type === 'input_json_delta').length],
+    [[{ id: 'call_a', name: 'Read', input: { file_path: '/a' } }, { id: 'call_b', name: 'Read', input: { file_path: '/b' } }], 2]);
+  check('stop_reason tool_use', stopOf(ev), 'tool_use');
+  check('thinking block closes with our signature', ev.some((e) => e[0] === 'content_block_delta' && e[1].delta.type === 'signature_delta' && e[1].delta.signature.startsWith('ccsb1:')), true);
+}
+
+console.log('stream: interleaved parallel tool calls, missing index, odd ids:');
+{
+  const ev = runStream([
+    ch({ tool_calls: [{ index: 0, id: 'c1', function: { name: 'A', arguments: '{"x"' } }, { index: 1, id: 'c2', function: { name: 'B', arguments: '{"y"' } }] }),
+    ch({ tool_calls: [{ index: 1, function: { arguments: ':2}' } }] }),
+    ch({ tool_calls: [{ index: 0, function: { arguments: ':1}' } }] }),
+    fin('tool_calls'),
+  ]);
+  check('interleaved deltas are assembled per call', toolInputs(ev), [{ id: 'c1', name: 'A', input: { x: 1 } }, { id: 'c2', name: 'B', input: { y: 2 } }]);
+  check('invariants', streamProblems(ev), []);
+  const noIdx = runStream([
+    ch({ tool_calls: [{ id: 'g1', function: { name: 'A', arguments: '{"a":1}' } }] }),
+    ch({ tool_calls: [{ id: 'g2', function: { name: 'B', arguments: '{"b":' } }] }),
+    ch({ tool_calls: [{ function: { arguments: '2}' } }] }),
+    fin('stop'),
+  ]);
+  check('index missing: keyed by id, continuation joins the last call', toolInputs(noIdx), [{ id: 'g1', name: 'A', input: { a: 1 } }, { id: 'g2', name: 'B', input: { b: 2 } }]);
+  check('any emitted tool call -> tool_use even with finish "stop"', stopOf(noIdx), 'tool_use');
+  const reused = runStream([
+    ch({ tool_calls: [{ index: 0, id: 'first', function: { name: 'A', arguments: '{}' } }] }),
+    ch({ tool_calls: [{ index: 0, id: 'second', function: { name: 'B', arguments: '{}' } }] }),
+    fin('tool_calls'),
+  ]);
+  check('an index reused with a new id is a new call', toolInputs(reused).map((t) => t.id), ['first', 'second']);
+  const odd = runStream([ch({ tool_calls: [{ index: 0, id: 'call|with/slashes', function: { name: 'A', arguments: '{}' } }, { index: 1, function: { name: 'B', arguments: '{}' } }] }), fin('tool_calls')]);
+  const ids = toolInputs(odd).map((t) => t.id);
+  check('invalid upstream ids are hashed deterministically; missing ones generated', [ids[0], anthropicToolId('call|with/slashes'), /^toolu_[A-Za-z0-9]{24}$/.test(ids[1])], [anthropicToolId('call|with/slashes'), ids[0], true]);
+  const repeatName = runStream([ch({ tool_calls: [{ index: 0, id: 'r', function: { name: 'Read', arguments: '{"a":' } }] }), ch({ tool_calls: [{ index: 0, function: { name: 'Read', arguments: '1}' } }] }), fin('tool_calls')]);
+  check('a name repeated on every chunk is not doubled', toolInputs(repeatName)[0].name, 'Read');
+}
+
+console.log('stream: tool arguments that are not JSON:');
+{
+  const ev = runStream([ch({ tool_calls: [{ index: 0, id: 'c', function: { name: 'A', arguments: '{"a":1,}' } }] }), fin('tool_calls')]);
+  check('repairable -> repaired input', toolInputs(ev)[0].input, { a: 1 });
+  const bad = runStream([ch({ tool_calls: [{ index: 0, id: 'c', function: { name: 'A', arguments: 'rm -rf please' } }] }), fin('tool_calls')]);
+  check('unrepairable -> __invalid_arguments (never a silent {})', toolInputs(bad)[0].input, { __invalid_arguments: 'rm -rf please' });
+  const cut = runStream([ch({ content: 'writing' }), ch({ tool_calls: [{ index: 0, id: 'c', function: { name: 'Write', arguments: '{"content": "abc' } }] }), fin('length')]);
+  check('a call cut off by max_tokens: repaired when possible', [toolInputs(cut)[0] && toolInputs(cut)[0].input, stopOf(cut)], [{ content: 'abc' }, 'tool_use']);
+  const cut2 = runStream([ch({ content: 'writing' }), ch({ tool_calls: [{ index: 0, id: 'c', function: { name: 'Write', arguments: '{"content": "abc" "' } }] }), fin('length')]);
+  check('…and dropped when not, so the CLI sees max_tokens', [blocks(cut2), stopOf(cut2)], [['text'], 'max_tokens']);
+}
+
+console.log('stream: stop reasons:');
+{
+  check('content_filter -> refusal', stopOf(runStream([ch({ content: 'no' }), fin('content_filter')])), 'refusal');
+  check('length -> max_tokens', stopOf(runStream([ch({ content: 'long' }), fin('length')])), 'max_tokens');
+  const ss = runStream([ch({ content: 'a b END' }), fin('stop')], { stopSequences: ['END'] });
+  const sd = ss.find((e) => e[0] === 'message_delta')[1].delta;
+  check('output ending in a stop sequence -> stop_sequence', [sd.stop_reason, sd.stop_sequence], ['stop_sequence', 'END']);
+  const vs = runStream([ch({ content: 'a b' }), { choices: [{ index: 0, delta: {}, finish_reason: 'stop', stop_reason: 'HALT' }] }], { stopSequences: ['HALT'] });
+  check('a server-reported matched stop (vLLM stop_reason) -> stop_sequence', vs.find((e) => e[0] === 'message_delta')[1].delta, { stop_reason: 'stop_sequence', stop_sequence: 'HALT' });
+  check('plain stop -> end_turn', stopOf(runStream([ch({ content: 'x' }), fin('stop')], { stopSequences: ['END'] })), 'end_turn');
+  check('an OpenAI refusal field -> text + refusal', [blocks(runStream([ch({ refusal: 'I cannot' }), fin('stop')])), stopOf(runStream([ch({ refusal: 'I cannot' }), fin('stop')]))], [['text'], 'refusal']);
+}
+
+console.log('stream: usage shapes:');
+{
+  check('OpenAI cached tokens', usageOf(runStream([ch({ content: 'x' }), fin('stop', { prompt_tokens: 1000, completion_tokens: 10, prompt_tokens_details: { cached_tokens: 800 } })])),
+    { input_tokens: 200, output_tokens: 10, cache_read_input_tokens: 800, cache_creation_input_tokens: 0 });
+  check('DeepSeek prompt_cache_hit_tokens', usageOf(runStream([ch({ content: 'x' }), fin('stop', { prompt_tokens: 1000, completion_tokens: 10, prompt_cache_hit_tokens: 600, prompt_cache_miss_tokens: 400 })])),
+    { input_tokens: 400, output_tokens: 10, cache_read_input_tokens: 600, cache_creation_input_tokens: 0 });
+  check('usage in a trailing chunk with empty choices', usageOf(runStream([ch({ content: 'x' }), fin('stop'), { choices: [], usage: { prompt_tokens: 5, completion_tokens: 1 } }])).input_tokens, 5);
+  const est = usageOf(runStream([ch({ content: 'x'.repeat(36) }), fin('stop')]));
+  check('no upstream usage -> estimates (input = message_start estimate)', [est.input_tokens, est.output_tokens], [100, 10]);
+}
+
+console.log('stream: reasoning placement and client choice:');
+{
+  const late = runStream([ch({ reasoning_content: 'a' }), ch({ content: 'answer' }), ch({ reasoning_content: 'late thought' }), ch({ content: 'more' }), fin('stop')]);
+  check('reasoning after text opens a NEW thinking block (not dropped)', blocks(late), ['thinking', 'text', 'thinking', 'text']);
+  check('invariants', streamProblems(late), []);
+  check('both in one chunk: thinking first', blocks(runStream([ch({ reasoning_content: 'hm', content: 'Hi' }), fin('stop')])), ['thinking', 'text']);
+  check('client did not ask for thinking -> no thinking blocks', blocks(runStream([ch({ reasoning_content: 'hidden' }), ch({ content: 'ok' }), fin('stop')], { emitThinking: false })), ['text']);
+  check('reasoning_details only (OpenRouter)', blocks(runStream([ch({ reasoning_details: [{ type: 'reasoning.summary', summary: 'sum', index: 0 }] }), ch({ content: 'ok' }), fin('stop')])), ['thinking', 'text']);
+  const empty = runStream([ch({ reasoning_content: '' }), ch({ content: '' }), fin('stop')]);
+  check('empty deltas open nothing', [blocks(empty), streamProblems(empty)], [[], []]);
+  const onlyThink = runStream([ch({ reasoning_content: 'all budget spent' }), fin('length')]);
+  check('reasoning-only stream is closed properly', [blocks(onlyThink), stopOf(onlyThink), streamProblems(onlyThink)], [['thinking'], 'max_tokens', []]);
+}
+
+console.log('stream: mid-stream error:');
+{
+  const ev = runStream([ch({ content: 'partial' }), { error: { message: 'upstream exploded', code: 502 } }, ch({ content: 'never' })]);
+  check('open block closed, error event last, no message_stop', streamProblems(ev, { expectError: true }), []);
+  check('the error event is Anthropic-shaped', ev[ev.length - 1][1], { type: 'error', error: { type: 'api_error', message: 'upstream exploded' } });
+  const orr = runStream([ch({ content: 'partial' }), { error: { code: 502, message: 'Provider disconnected' }, choices: [{ index: 0, delta: { content: '' }, finish_reason: 'error' }] }]);
+  check('OpenRouter error chunk (error + choices) is an error, not end_turn', [streamProblems(orr, { expectError: true }), orr[orr.length - 1][1].error.message], [[], 'Provider disconnected']);
+  const fe = runStream([ch({ content: 'partial' }), fin('error')]);
+  check('finish_reason "error" alone is an error too', streamProblems(fe, { expectError: true }), []);
+  const t = createTranslator({ clientModel: 'm', providerId: 'p', sink: () => {} });
+  t.start(); t.fail('overloaded_error', 'x');
+  check('after fail(), end() and chunk() do nothing', [t.chunk(ch({ content: 'x' })), t.finished], [null, true]);
+}
+
+console.log('non-stream: the same state machine builds the Message:');
+{
+  const agg = createAggregator();
+  const t = createTranslator({ clientModel: 'claude-x', providerId: 'prov', toolNames: new Map(), inputEstimate: 9, emitThinking: true, sink: agg.event });
+  t.chunk(completionToChunk({ id: 'x', choices: [{ message: { role: 'assistant', content: 'result', reasoning_content: 'why', tool_calls: [{ id: 'call_1', type: 'function', function: { name: 'Read', arguments: '{"p":1}' } }] }, finish_reason: 'tool_calls' }], usage: { prompt_tokens: 7, completion_tokens: 40 } }));
+  t.end();
+  const m = agg.message();
+  check('Message JSON shape', [m.type, m.role, m.model, m.stop_reason, m.stop_sequence, /^msg_/.test(m.id)], ['message', 'assistant', 'claude-x', 'tool_use', null, true]);
+  check('content: thinking (signed), text, tool_use with parsed input', m.content.map((b) => b.type === 'tool_use' ? [b.type, b.id, b.name, b.input] : b.type === 'thinking' ? [b.type, b.thinking, readSignature(b.signature)] : [b.type, b.text]),
+    [['thinking', 'why', { p: 'prov' }], ['text', 'result'], ['tool_use', 'call_1', 'Read', { p: 1 }]]);
+  check('usage', m.usage, { input_tokens: 7, output_tokens: 40, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 });
+}
+
+console.log('SSE parser:');
+{
+  const got = [];
+  const p = createSseParser((e) => got.push(e));
+  const raw = 'event: a\r\ndata: {"x":1}\r\n\r\n: comment\n\ndata: {"y":\ndata: 2}\n\ndata: [DONE]\n\n';
+  const buf = Buffer.from(raw + 'data: {"z":"é"}\n\n');
+  for (let i = 0; i < buf.length; i += 3) p.feed(buf.subarray(i, i + 3)); // split everywhere, incl. inside UTF-8
+  p.end();
+  check('events across arbitrary splits, CRLF, comments, multi-line data, UTF-8', got, [{ event: 'a', data: '{"x":1}' }, { event: 'message', data: '{"y":\n2}' }, { event: 'message', data: '[DONE]' }, { event: 'message', data: '{"z":"é"}' }]);
+  check('non-compliant "several JSON lines in one event" still parses', parseEventJson('{"a":1}\n{"b":2}'), [{ a: 1 }, { b: 2 }]);
+}
+
+console.log('estimates:');
+{
+  const e1 = estimateInputTokens({ system: 'x'.repeat(360), messages: [{ role: 'user', content: [{ type: 'text', text: 'y'.repeat(360) }, { type: 'image', source: {} }] }] });
+  check('chars/3.6 + 1600 per image + 3 per message', e1, 200 + 1600 + 3);
+  const cal = createCalibrator();
+  cal.observe('s', 1000, 1500);
+  check('calibration learns real/estimated per session', [cal.apply('s', 1000), cal.apply('other', 1000)], [1500, 1000]);
+  cal.observe('s', 1000, 1000);
+  check('…as an EMA', cal.apply('s', 1000), 1350);
+}
+
+console.log('error canonicalization (pure):');
+{
+  const E = (status, body, headers) => { const m = canonicalizeError({ status, bodyText: typeof body === 'string' ? body : JSON.stringify(body), headers, label: 'Acme', contextWindow: 65536, estimate: 70000 }); return [m.status, m.body.error.type, m.body.error.message]; };
+  check('context_length_exceeded with numbers', E(400, { error: { code: 'context_length_exceeded', message: "This model's maximum context length is 65536 tokens. However, you requested 70123 tokens (60000 in the messages, 10123 in the completion)." } }),
+    [400, 'invalid_request_error', 'provider "Acme": prompt is too long: 70123 tokens > 65536 maximum']);
+  check('overflow without numbers -> estimate vs contextWindow', E(400, { error: { message: 'Please reduce the length of the messages.' } }), [400, 'invalid_request_error', 'provider "Acme": prompt is too long: 70000 tokens > 65536 maximum']);
+  check('overflow message builder never yields N <= M', overflowMessage('too many tokens', 10, 100), 'prompt is too long: 101 tokens > 100 maximum');
+  check('402 -> credit balance (not retried)', E(402, { error: { message: 'Payment required' } }), [400, 'invalid_request_error', 'provider "Acme": Your credit balance is too low (insufficient_quota): Payment required']);
+  check('429 insufficient_quota -> credit balance, not a rate limit', E(429, { error: { code: 'insufficient_quota', message: 'You exceeded your current quota, please check your plan and billing details.' } })[1], 'invalid_request_error');
+  check('Gemini array body', E(429, [{ error: { code: 429, message: 'Resource has been exhausted', status: 'RESOURCE_EXHAUSTED' } }]), [429, 'rate_limit_error', 'provider "Acme": Resource has been exhausted']);
+  check('OpenRouter metadata.raw is surfaced', E(502, { error: { message: 'Provider returned error', code: 502, metadata: { raw: 'backend down' } } })[2], 'provider "Acme": Provider returned error (backend down)');
+  check('non-JSON body', E(500, '<html>oops</html>'), [500, 'api_error', 'provider "Acme": <html>oops</html>']);
+}
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);
diff --git a/test/providers.test.js b/test/providers.test.js
new file mode 100644
index 00000000..0440b8bf
--- /dev/null
+++ b/test/providers.test.js
@@ -0,0 +1,297 @@
+// Provider registry: model refs, resolution, run environment, catalogue parsing, the
+// SQLite store and the catalogue fetcher. Run: node test/providers.test.js
+'use strict';
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const P = require('../providers');
+const { createProviderStore } = require('../providers-store');
+const { fetchCatalog } = require('../providers-catalog');
+const openDatabase = require('../db-adapter');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+
+// ── fixtures ────────────────────────────────────────────────────────────────
+const claude = { id: 'claude', type: 'claude-subscription', label: 'Claude', enabled: true, aliases: true, models: [], roles: {}, options: {} };
+const gateway = { id: 'gateway', type: 'anthropic-compatible', label: 'kilo', enabled: true, aliases: true, baseUrl: 'https://kilo.example', apiKey: 'kgw', authScheme: 'bearer',
+  models: [{ id: 'z-ai/glm-5:free', enabled: true, caps: { tools: true, contextWindow: 200000 } }], roles: {}, options: { quietCli: false } };
+const deepseek = { id: 'deepseek', type: 'openai-compatible', label: 'DeepSeek', enabled: true, aliases: false, baseUrl: 'https://api.deepseek.com/v1', apiKey: 'sk-ds', dialect: 'deepseek',
+  models: [
+    { id: 'deepseek-chat', enabled: true, caps: { tools: true, vision: false, reasoning: false, contextWindow: 128000, maxOutput: 8192 } },
+    { id: 'deepseek-reasoner', enabled: true, caps: { tools: true, reasoning: true, contextWindow: 128000, maxOutput: 64000 } },
+  ], roles: { main: 'deepseek-chat', fast: 'deepseek-chat', strong: 'deepseek-reasoner' }, options: {} };
+const off = { id: 'off', type: 'openai-compatible', label: 'Off', enabled: false, models: [{ id: 'm', enabled: true }], roles: {}, options: {} };
+const reg = { providers: [claude, gateway, deepseek, off], defaultProviderId: 'gateway', utilityModel: '' };
+
+console.log('model refs:');
+check('bare alias', P.parseModelRef('sonnet'), { providerId: null, modelId: 'sonnet' });
+check('bare gateway id keeps its colon suffix', P.parseModelRef('z-ai/glm-5:free'), { providerId: null, modelId: 'z-ai/glm-5:free' });
+check('qualified ref', P.parseModelRef('kilo::z-ai/glm-5:free'), { providerId: 'kilo', modelId: 'z-ai/glm-5:free' });
+check('garbage is refused', ['', '  ', 'a b', 'x;rm', 'Bad::m', '::m', 'p::', 'p::a b', null, 5].map(v => P.parseModelRef(v)), [null, null, null, null, null, null, null, null, null, null]);
+check('format round-trips', P.formatModelRef('deepseek', 'deepseek-chat'), 'deepseek::deepseek-chat');
+check('bareModelId strips the provider', [P.bareModelId('claude::opus'), P.bareModelId('opus'), P.bareModelId('x y')], ['opus', 'opus', null]);
+check('a qualified ref still passes the bot model check (gateway-models.MODEL_ID_RE)', require('../gateway-models').MODEL_ID_RE.test('deepseek::deepseek-chat'), true);
+
+console.log('resolution:');
+{
+  const r = P.resolveModel('sonnet', reg, { engine: 'api' });
+  check('a bare alias lands on the default provider, unchanged (what every old row meant)', [r.ok, r.provider.id, r.cliModel, r.routing, r.ref], [true, 'gateway', 'sonnet', 'bridge', 'gateway::sonnet']);
+}
+{
+  const r = P.resolveModel('z-ai/glm-5:free', reg, { engine: 'api' });
+  check('a bare gateway id (old bot row) lands on the default provider', [r.provider.id, r.cliModel, r.caps.contextWindow], ['gateway', 'z-ai/glm-5:free', 200000]);
+}
+{
+  const r = P.resolveModel('deepseek::deepseek-reasoner', reg, { engine: 'api' });
+  check('a qualified ref picks its provider and model', [r.provider.id, r.cliModel, r.caps.reasoning, r.pricing], ['deepseek', 'deepseek-reasoner', true, null]);
+}
+{
+  const r = P.resolveModel('haiku', { ...reg, defaultProviderId: 'deepseek' }, { engine: 'api' });
+  check('an alias on a provider that serves no Claude maps through its roles', [r.provider.id, r.cliModel], ['deepseek', 'deepseek-chat']);
+  const o = P.resolveModel('deepseek::opus', reg, { engine: 'api' });
+  check('…opus → the strong role', o.cliModel, 'deepseek-reasoner');
+}
+{
+  const r = P.resolveModel('sonnet', reg, { engine: 'subscription' });
+  check('the Subscription engine means the CLI login, whatever the default is', [r.provider.id, r.routing, r.engine, r.engineChanged], ['claude', 'oauth', 'subscription', false]);
+  const d = P.resolveModel('deepseek::deepseek-chat', reg, { engine: 'subscription' });
+  check('a non-Claude model on the Subscription engine runs on the API engine instead, and says so', [d.provider.id, d.engine, d.engineChanged, d.routing], ['deepseek', 'api', true, 'bridge']);
+  check('effectiveEngine mirrors it', [P.effectiveEngine('subscription', 'deepseek::deepseek-chat', reg), P.effectiveEngine('subscription', 'opus', reg), P.effectiveEngine('api', 'opus', reg)], ['api', 'subscription', 'api']);
+}
+{
+  // No engine dial: the model's provider decides (server.js runEngineFor).
+  const E = (v, r = reg, tmux = true) => P.engineForModel(v, r, { tmux });
+  check('a model of the CLI login runs on the subscription', [E('claude::opus'), E('claude::claude-sonnet-5')], ['subscription', 'subscription']);
+  check('a bare alias is the DEFAULT provider\'s: a gateway default runs it on the API', E('sonnet'), 'api');
+  check('…and the CLI login as the default runs it on the subscription', E('sonnet', { ...reg, defaultProviderId: 'claude' }), 'subscription');
+  check('every other provider runs on the API', [E('deepseek::deepseek-chat'), E('gateway::opus')], ['api', 'api']);
+  check('without tmux the CLI login runs headless', E('claude::opus', reg, false), 'api');
+  check('a ref to a deleted provider follows the default it falls back to', E('ghost::gpt-9'), 'api');
+  check('providerMode marks the CLI login "subscription", the rest "api"',
+    [P.providerMode({ type: 'claude-subscription' }), P.providerMode({ type: 'anthropic' }), P.providerMode({ type: 'openai-compatible' })], ['subscription', 'api', 'api']);
+  check('listChoices carries each provider\'s mode', P.listChoices(reg).providers.map(p => [p.id, p.mode]).find(x => x[0] === 'claude'), ['claude', 'subscription']);
+  // The boot migration and older clients: "Subscription" + a model → that model on the CLI login.
+  check('toClaudeRef pins an alias or a Claude id to the CLI login',
+    [P.toClaudeRef('opus'), P.toClaudeRef('claude-sonnet-5'), P.toClaudeRef(''), P.toClaudeRef(null)],
+    ['claude::opus', 'claude::claude-sonnet-5', 'claude::sonnet', 'claude::sonnet']);
+  check('…and leaves a ref alone, whichever provider it names',
+    [P.toClaudeRef('claude::haiku'), P.toClaudeRef('deepseek::deepseek-chat')], ['claude::haiku', 'deepseek::deepseek-chat']);
+  check('…and a bare non-Claude id too (it is not a Claude model to pin)', P.toClaudeRef('vendor/model:free'), 'vendor/model:free');
+}
+{
+  const r = P.resolveModel('ghost::gpt-9', reg, { engine: 'api' });
+  check('a deleted provider falls back to the default, flagged', [r.ok, r.provider.id, r.cliModel, r.fallback], [true, 'gateway', 'sonnet', 'provider_missing']);
+  const o = P.resolveModel('off::m', reg, { engine: 'api' });
+  check('a switched-off provider falls back too', [o.provider.id, o.fallback], ['gateway', 'provider_disabled']);
+  const n = P.resolveModel('ghost::x', { ...reg, defaultProviderId: 'deepseek' }, { engine: 'api' });
+  check('…onto the default provider\'s main model when it serves no aliases', [n.provider.id, n.cliModel], ['deepseek', 'deepseek-chat']);
+}
+{
+  check('the SSH engine routes remote (the remote host decides)', P.resolveModel('deepseek::deepseek-chat', reg, { engine: 'ssh' }).routing, 'remote');
+  check('no default configured → the CLI login', P.resolveModel('sonnet', { providers: [claude] }, {}).provider.id, 'claude');
+  check('empty value means the built-in default model', P.resolveModel('', reg, {}).cliModel, 'sonnet');
+  check('an invalid value is an error, not a silent sonnet', P.resolveModel('x;rm -rf', reg, {}), { ok: false, error: 'invalid_model' });
+  const empty = { id: 'e', type: 'openai-compatible', label: 'E', enabled: true, models: [], roles: {}, options: {} };
+  check('a provider with no models at all cannot resolve an alias', P.resolveModel('e::sonnet', { providers: [claude, empty] }, {}).error, 'no_model');
+}
+
+console.log('run environment:');
+{
+  const oauth = P.buildRunEnv(P.resolveModel('opus', reg, { engine: 'subscription' }));
+  check('the CLI login injects nothing and strips every provider variable', [Object.keys(oauth.set).length, oauth.unset.includes('ANTHROPIC_BASE_URL'), oauth.unset.includes('ANTHROPIC_API_KEY'), oauth.extraArgs], [0, true, true, []]);
+  const env = P.applyRunEnv({ ANTHROPIC_BASE_URL: 'https://stale', ANTHROPIC_AUTH_TOKEN: 'leak', PATH: '/bin' }, oauth);
+  check('…so a stale base URL in the server env cannot reach that run', env, { PATH: '/bin' });
+}
+{
+  const t = P.resolveModel('deepseek::deepseek-chat', reg, { engine: 'api' });
+  const e = P.buildRunEnv(t, { baseUrl: 'http://127.0.0.1:4567', token: 'ccsr_x' });
+  check('a bridge run gets the bridge and its run token — never the provider key', [e.set.ANTHROPIC_BASE_URL, e.set.ANTHROPIC_AUTH_TOKEN, JSON.stringify(e).includes('sk-ds')], ['http://127.0.0.1:4567', 'ccsr_x', false]);
+  check('the CLI\'s own alias calls are mapped onto the provider\'s roles', [e.set.ANTHROPIC_DEFAULT_HAIKU_MODEL, e.set.ANTHROPIC_DEFAULT_SONNET_MODEL, e.set.ANTHROPIC_DEFAULT_OPUS_MODEL, e.set.ANTHROPIC_DEFAULT_FABLE_MODEL, e.set.ANTHROPIC_SMALL_FAST_MODEL], ['deepseek-chat', 'deepseek-chat', 'deepseek-reasoner', 'deepseek-chat', 'deepseek-chat']);
+  check('the real window, the output cap and the thinking switch reach the CLI', [e.set.CLAUDE_CODE_MAX_CONTEXT_TOKENS, e.set.CLAUDE_CODE_MAX_OUTPUT_TOKENS, e.set.CLAUDE_CODE_DISABLE_THINKING], ['128000', '8192', '1']);
+  check('non-Anthropic: betas off, quiet CLI, WebSearch disallowed', [e.set.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS, e.set.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, e.extraArgs], ['1', '1', ['--disallowedTools', 'WebSearch']]);
+  const r = P.buildRunEnv(P.resolveModel('deepseek::deepseek-reasoner', reg, {}), { baseUrl: 'b', token: 't' });
+  check('a reasoning model keeps thinking on and gets the output cap clamped to 32K', [r.set.CLAUDE_CODE_MAX_OUTPUT_TOKENS, r.set.CLAUDE_CODE_DISABLE_THINKING], ['32000', undefined]);
+}
+{
+  const e = P.buildRunEnv(P.resolveModel('sonnet', reg, {}), { baseUrl: 'b', token: 't' });
+  check('the migrated gateway keeps its own alias mapping and stays chatty (behaviour unchanged)', [e.set.ANTHROPIC_DEFAULT_SONNET_MODEL, e.set.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, e.set.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS], [undefined, undefined, undefined]);
+  const pinned = P.buildRunEnv(P.resolveModel('sonnet', { ...reg, providers: [claude, { ...gateway, roles: { fast: 'x/fast' } }] }, {}), { baseUrl: 'b', token: 't' });
+  check('…unless a role was pinned', [pinned.set.ANTHROPIC_DEFAULT_HAIKU_MODEL, pinned.set.ANTHROPIC_DEFAULT_SONNET_MODEL], ['x/fast', undefined]);
+  const anth = { id: 'anthropic', type: 'anthropic', label: 'A', enabled: true, models: [], roles: {}, options: {} };
+  const a = P.buildRunEnv(P.resolveModel('anthropic::opus', { providers: [claude, anth] }, {}), { baseUrl: 'b', token: 't' });
+  check('first-party Anthropic keeps WebSearch and the CLI defaults', [a.extraArgs, a.set.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, a.set.CLAUDE_CODE_MAX_CONTEXT_TOKENS], [[], undefined, undefined]);
+}
+
+console.log('bridge run context:');
+{
+  const ctx = P.buildRunCtx(P.resolveModel('deepseek::deepseek-reasoner', reg, {}), { purpose: 'task', taskId: 't1', effort: 'high' });
+  check('carries provider credentials for the bridge only', [ctx.provider.apiKey, ctx.provider.baseUrl, ctx.provider.dialect], ['sk-ds', 'https://api.deepseek.com/v1', 'deepseek']);
+  check('main model, caps of every role model, alias map, fallback', [ctx.model, Object.keys(ctx.models).sort(), ctx.modelMap.haiku, ctx.modelMap.opus, ctx.fallbackModel], ['deepseek-reasoner', ['deepseek-chat', 'deepseek-reasoner'], 'deepseek-chat', 'deepseek-reasoner', 'deepseek-chat']);
+  check('effort is the source of truth; Auto means "send none", never the CLI\'s own "high"', [ctx.effort, P.buildRunCtx(P.resolveModel('deepseek::deepseek-chat', reg, {}), { effort: 'auto' }).effort, P.buildRunCtx(P.resolveModel('deepseek::deepseek-chat', reg, {}), {}).effort], ['high', 'auto', 'auto']);
+  check('metadata for the usage ledger', [ctx.purpose, ctx.taskId, typeof ctx.runId], ['task', 't1', 'string']);
+}
+
+console.log('catalogues:');
+{
+  const or = P.normalizeCatalog({ data: [
+    { id: 'anthropic/claude-sonnet-5', name: 'Claude Sonnet 5', context_length: 1000000, supported_parameters: ['tools', 'reasoning'],
+      architecture: { input_modalities: ['text', 'image', 'file'] }, top_provider: { max_completion_tokens: 64000 }, pricing: { prompt: '0.000003', completion: '0.000015', input_cache_read: '0.0000003' } },
+    { id: 'meta/llama:free', supported_parameters: ['temperature'], architecture: { input_modalities: ['text'] }, pricing: { prompt: '0', completion: '0' } },
+    { id: 'bad id' }, { id: 'meta/llama:free' },
+  ] });
+  check('OpenRouter/Kilo shape: caps, window, output cap', or[0].caps, { tools: true, vision: true, reasoning: true, pdf: true, contextWindow: 1000000, maxOutput: 64000 });
+  check('…pricing converted from per-token to per-1M', or[0].pricing, { in: 3, out: 15, cacheRead: 0.3 });
+  check('…an explicit "no tools" survives, junk and duplicates dropped', [or.length, or[1].caps.tools, or[1].pricing], [2, false, { in: 0, out: 0 }]);
+  check('OpenAI shape (ids only) → unknown caps', P.normalizeCatalog({ object: 'list', data: [{ id: 'gpt-5', object: 'model' }] })[0], { id: 'gpt-5', label: 'gpt-5', caps: { ...P.UNKNOWN_CAPS }, pricing: null });
+  check('Anthropic shape uses display_name', P.normalizeCatalog({ data: [{ type: 'model', id: 'claude-opus-5', display_name: 'Claude Opus 5' }] })[0].label, 'Claude Opus 5');
+}
+
+console.log('pickers and validation:');
+{
+  const c = P.listChoices(reg);
+  check('disabled providers are not offered', c.providers.map(p => p.id), ['claude', 'gateway', 'deepseek']);
+  check('Claude-serving providers offer the four aliases first', c.providers[1].models.map(m => m.ref), ['gateway::haiku', 'gateway::sonnet', 'gateway::opus', 'gateway::fable', 'gateway::z-ai/glm-5:free']);
+  check('an OpenAI-compatible provider offers its own models only', c.providers[2].models.map(m => m.id), ['deepseek-chat', 'deepseek-reasoner']);
+  check('no key ever reaches a choice list', JSON.stringify(c).includes('sk-ds') || JSON.stringify(c).includes('kgw'), false);
+  check('the default is marked', c.providers.filter(p => p.isDefault).map(p => p.id), ['gateway']);
+  check('isKnownModel', ['sonnet', 'gateway::opus', 'deepseek::anything-new', 'off::m', 'ghost::x', 'a b'].map(v => P.isKnownModel(v, reg)), [true, true, true, false, false, false]);
+  check('describeModel', [P.describeModel('deepseek::deepseek-chat', reg), P.describeModel('opus', reg)], ['DeepSeek · deepseek-chat', 'opus']);
+  check('computeCost', P.computeCost({ inputTokens: 1000000, outputTokens: 500000, cacheReadTokens: 2000000 }, { in: 3, out: 15, cacheRead: 0.3 }), 11.1);
+  check('computeCost without a price is unknown, not zero', P.computeCost({ inputTokens: 5 }, null), null);
+}
+{
+  const v = P.validateProviderInput({ id: 'my-oai', type: 'openai-compatible', label: 'Mine', baseUrl: 'https://x.example/v1/', apiKey: ' sk ', dialect: 'openai',
+    headers: { 'HTTP-Referer': 'https://me' }, roles: { main: 'gpt-5', fast: '' }, options: { maxConcurrency: 4, extraBody: { a: 1 } } }, { creating: true });
+  check('a good provider validates and is normalised', [v.errors, v.value.baseUrl, v.value.apiKey, v.value.roles], [[], 'https://x.example/v1', 'sk', { main: 'gpt-5' }]);
+  const b = P.validateProviderInput({ id: 'Bad Id', type: 'claude-subscription', label: '', baseUrl: 'ftp://x', dialect: 'nope', headers: { 'a b': 'x' }, options: { maxConcurrency: 999 } }, { creating: true });
+  check('each bad field is named', b.errors.sort(), ['baseUrl', 'dialect', 'headers', 'id', 'label', 'options.maxConcurrency', 'type'].sort());
+  check('a key with a newline is refused (header injection)', P.validateProviderInput({ apiKey: 'a\nb' }).errors, ['apiKey']);
+}
+
+// ── store ───────────────────────────────────────────────────────────────────
+(async () => {
+  console.log('store:');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-prov-'));
+  const db = openDatabase(path.join(dir, 't.db'));
+  const key = crypto.randomBytes(32);
+  const encrypt = (s) => { const iv = crypto.randomBytes(16); const c = crypto.createCipheriv('aes-256-gcm', key, iv); const e = Buffer.concat([c.update(s, 'utf8'), c.final()]); return 'enc:' + Buffer.concat([iv, c.getAuthTag(), e]).toString('base64'); };
+  const decrypt = (s) => { const b = Buffer.from(s.slice(4), 'base64'); const d = crypto.createDecipheriv('aes-256-gcm', key, b.subarray(0, 16)); d.setAuthTag(b.subarray(16, 32)); return d.update(b.subarray(32)).toString('utf8') + d.final('utf8'); };
+  const store = createProviderStore(db, { encrypt, decrypt });
+
+  store.seedFromEnv({ ANTHROPIC_BASE_URL: 'https://kilo.example/', ANTHROPIC_AUTH_TOKEN: 'kgw_live_secret' });
+  let r = store.registry();
+  check('first boot: the CLI login row and the env gateway, gateway is the default', [r.providers.map(p => p.id), r.defaultProviderId], [['claude', 'gateway'], 'gateway']);
+  const gw = store.get('gateway');
+  check('…seeded as an alias-serving Anthropic-compatible provider with the env token (bearer)', [gw.type, gw.aliases, gw.baseUrl, gw.apiKey, gw.authScheme, gw.source, gw.options.quietCli], ['anthropic-compatible', true, 'https://kilo.example', 'kgw_live_secret', 'bearer', 'env', false]);
+  const raw = db.prepare(`SELECT api_key_enc FROM providers WHERE id='gateway'`).get().api_key_enc;
+  check('the key is encrypted at rest', [raw.startsWith('enc:'), raw.includes('kgw_live')], [true, false]);
+  const pub = store.publicList();
+  check('the public view never carries the key', [JSON.stringify(pub).includes('kgw_live'), pub.providers[1].hasKey], [false, true]);
+
+  store.seedFromEnv({ ANTHROPIC_BASE_URL: 'https://kilo2.example', ANTHROPIC_AUTH_TOKEN: 'kgw_live_new' });
+  check('a later boot follows a changed env (the .env-and-restart habit still works)', [store.get('gateway').baseUrl, store.get('gateway').apiKey], ['https://kilo2.example', 'kgw_live_new']);
+  store.update('gateway', { label: 'Kilo' });
+  check('an edit in the UI makes the row the user\'s…', store.get('gateway').source, 'user');
+  store.seedFromEnv({ ANTHROPIC_BASE_URL: 'https://kilo3.example', ANTHROPIC_AUTH_TOKEN: 'x' });
+  check('…and env no longer rewrites it', store.get('gateway').baseUrl, 'https://kilo2.example');
+  store.remove('gateway');
+  store.seedFromEnv({ ANTHROPIC_BASE_URL: 'https://kilo.example', ANTHROPIC_AUTH_TOKEN: 'x' });
+  check('a deleted env row is not resurrected on the next boot', [store.registry().providers.map(p => p.id), store.registry().defaultProviderId], [['claude'], 'claude']);
+
+  store.create({ id: 'ds', type: 'openai-compatible', label: 'DeepSeek', baseUrl: 'https://api.deepseek.com/v1', apiKey: 'sk-1', dialect: 'deepseek', headers: { 'X-Api-Key': 'hdr-secret', 'X-Title': 'studio' } });
+  check('a secret-looking header is masked, a plain one is not', store.publicProvider(store.get('ds')).headers, { 'X-Api-Key': '***', 'X-Title': 'studio' });
+  store.update('ds', { apiKey: '', headers: { 'X-Api-Key': '***', 'X-Title': 'studio2' } });
+  check('blank key and "***" header keep the stored secrets', [store.get('ds').apiKey, store.get('ds').headers], ['sk-1', { 'X-Api-Key': 'hdr-secret', 'X-Title': 'studio2' }]);
+  store.update('ds', { clearApiKey: true });
+  check('clearApiKey clears', store.get('ds').apiKey, '');
+
+  const res = store.upsertCatalog('ds', [{ id: 'deepseek-chat', label: 'Chat', caps: { tools: true, contextWindow: 128000 } }, { id: 'deepseek-reasoner', caps: { reasoning: true } }]);
+  check('a small first catalogue is enabled wholesale', [res.autoEnabled, store.get('ds').models.map(m => [m.id, m.enabled])], [true, [['deepseek-chat', true], ['deepseek-reasoner', true]]]);
+  store.setModel('ds', 'deepseek-chat', { caps: { contextWindow: 64000, vision: false } });
+  store.upsertCatalog('ds', [{ id: 'deepseek-chat', caps: { tools: true, contextWindow: 128000 } }, { id: 'deepseek-v4', caps: {} }]);
+  const m = store.get('ds').models;
+  check('a refresh keeps the user\'s corrections over the catalogue', [m.find(x => x.id === 'deepseek-chat').caps.contextWindow, m.find(x => x.id === 'deepseek-chat').caps.vision], [64000, false]);
+  check('a model that left the catalogue survives only because it was enabled; a new one arrives off', [m.map(x => x.id).sort(), m.find(x => x.id === 'deepseek-v4').enabled], [['deepseek-chat', 'deepseek-reasoner', 'deepseek-v4'], false]);
+  const big = Array.from({ length: 50 }, (_, i) => ({ id: `m${i}`, caps: {} }));
+  store.create({ id: 'or', type: 'openai-compatible', label: 'OR', baseUrl: 'https://openrouter.ai/api/v1' });
+  check('a big first catalogue is imported switched off', [store.upsertCatalog('or', big).autoEnabled, store.get('or').models.filter(x => x.enabled).length], [false, 0]);
+  store.addManualModel('or', 'my/model', { caps: { tools: true } });
+  check('a manual model is enabled and kept across refreshes', (store.upsertCatalog('or', big), store.get('or').models.find(x => x.id === 'my/model').enabled), true);
+
+  check('setDefault refuses a disabled provider', (store.update('or', { enabled: false }), store.setDefault('or')), false);
+  check('the built-in row cannot be removed', store.remove('claude'), false);
+
+  store.recordUsage({ runId: 'r1', providerId: 'ds', model: 'deepseek-chat', inputTokens: 100, outputTokens: 20, cacheReadTokens: 50, costUsd: 0.001, status: 'ok' });
+  store.recordUsage({ runId: 'r1', providerId: 'ds', model: 'deepseek-chat', inputTokens: 300, outputTokens: 10, costUsd: null, status: 'ok' });
+  const u = store.usageForRun('r1');
+  check('usage per run sums tokens, flags unpriced requests, keeps the last turn', [u.input, u.output, u.requests, u.unpriced, u.lastTurn.input_tokens], [400, 30, 2, 1, 300]);
+  check('the summary groups by provider/model/day', store.usageSummary(7).map(x => [x.provider_id, x.requests]), [['ds', 2]]);
+  db.close();
+
+  console.log('catalogue fetch:');
+  const calls = [];
+  const fake = (routes) => async (url, o) => { calls.push({ url, h: o.headers }); const r = routes(url); return { ok: r.status < 400, status: r.status, json: async () => r.body }; };
+  {
+    const res = await fetchCatalog({ type: 'openai-compatible', baseUrl: 'https://api.x/v1', apiKey: 'sk', authScheme: 'x-api-key' }, { fetchImpl: fake(() => ({ status: 200, body: { data: [{ id: 'a' }, { id: 'b' }] } })) });
+    check('OpenAI: <base>/models with a Bearer key whatever the scheme says', [res.models.map(m => m.id), calls[0].url, calls[0].h.authorization, calls[0].h['anthropic-version']], [['a', 'b'], 'https://api.x/v1/models', 'Bearer sk', undefined]);
+  }
+  calls.length = 0;
+  {
+    let n = 0;
+    const res = await fetchCatalog({ type: 'anthropic', baseUrl: 'https://api.anthropic.com', apiKey: 'k', authScheme: 'x-api-key' },
+      { fetchImpl: fake(() => (++n === 1 ? { status: 200, body: { data: [{ id: 'claude-a' }], has_more: true, last_id: 'claude-a' } } : { status: 200, body: { data: [{ id: 'claude-b' }], has_more: false } })) });
+    check('Anthropic: /v1/models, x-api-key + version header, follows pagination', [res.models.map(m => m.id), calls[0].url, calls[0].h['x-api-key'], calls[0].h['anthropic-version'], /after_id=claude-a/.test(calls[1].url)], [['claude-a', 'claude-b'], 'https://api.anthropic.com/v1/models', 'k', '2023-06-01', true]);
+  }
+  check('a provider without a catalogue is reachable, not broken', await fetchCatalog({ type: 'anthropic-compatible', baseUrl: 'https://x' }, { fetchImpl: fake(() => ({ status: 404, body: {} })) }), { ok: true, models: [], status: 404, noCatalog: true });
+  check('a refusal names the status and the upstream message', await fetchCatalog({ type: 'openai-compatible', baseUrl: 'https://x/v1', apiKey: 'bad' }, { fetchImpl: fake(() => ({ status: 401, body: { error: { message: 'Incorrect API key' } } })) }), { ok: false, models: [], status: 401, error: 'HTTP 401: Incorrect API key' });
+  check('the CLI login has no catalogue to fetch', await fetchCatalog({ type: 'claude-subscription' }), { ok: true, models: [], noCatalog: true });
+
+  console.log('review fixes:');
+  {
+    const db2 = openDatabase(path.join(dir, 'r.db'));
+    const st2 = createProviderStore(db2, { encrypt, decrypt });
+    st2.seedFromEnv({ ANTHROPIC_BASE_URL: 'https://kilo.example', ANTHROPIC_AUTH_TOKEN: 'kgw_1',
+      ANTHROPIC_DEFAULT_SONNET_MODEL: 'z-ai/glm-4.6', ANTHROPIC_DEFAULT_HAIKU_MODEL: 'z-ai/glm-4.5-air', ANTHROPIC_DEFAULT_OPUS_MODEL: 'z-ai/glm-5',
+      CLAUDE_CODE_SUBAGENT_MODEL: 'z-ai/glm-4.5-air', ANTHROPIC_CUSTOM_HEADERS: 'cf-aig-authorization: Bearer abc\nX-Title: studio' });
+    const g = st2.get('gateway');
+    check('the env model remaps become the seeded row\'s roles (a bare "sonnet" keeps meaning glm-4.6)', g.roles, { main: 'z-ai/glm-4.6', fast: 'z-ai/glm-4.5-air', strong: 'z-ai/glm-5', subagent: 'z-ai/glm-4.5-air' });
+    check('ANTHROPIC_CUSTOM_HEADERS becomes the row\'s headers', g.headers, { 'cf-aig-authorization': 'Bearer abc', 'X-Title': 'studio' });
+    const env = P.buildRunEnv(P.resolveModel('sonnet', st2.registry(), {}), { baseUrl: 'b', token: 't' });
+    check('…and they reach the run as before the registry', [env.set.ANTHROPIC_DEFAULT_SONNET_MODEL, env.set.ANTHROPIC_DEFAULT_HAIKU_MODEL, env.set.CLAUDE_CODE_SUBAGENT_MODEL], ['z-ai/glm-4.6', 'z-ai/glm-4.5-air', 'z-ai/glm-4.5-air']);
+    check('a Claude alias behind a Claude gateway keeps WebSearch', env.extraArgs, []);
+    check('bridge runs strip the cloud-backend switches; the CLI login keeps them', [env.unset.includes('CLAUDE_CODE_USE_BEDROCK'), env.unset.includes('CLAUDE_CODE_OAUTH_TOKEN'), P.buildRunEnv(P.resolveModel('opus', st2.registry(), { engine: 'subscription' })).unset.includes('CLAUDE_CODE_USE_BEDROCK')], [true, true, false]);
+    st2.update('gateway', { label: g.label, baseUrl: g.baseUrl, authScheme: g.authScheme, dialect: g.dialect, headers: { 'cf-aig-authorization': '***', 'X-Title': 'studio' }, options: g.options, roles: g.roles, aliases: true, enabled: true });
+    check('pressing Save on an untouched env row does not detach it from .env', st2.get('gateway').source, 'env');
+    st2.seedFromEnv({});
+    check('removing ANTHROPIC_BASE_URL switches the env row off and hands the default back to the CLI login', [st2.get('gateway').enabled, st2.registry().defaultProviderId], [false, 'claude']);
+    st2.seedFromEnv({ ANTHROPIC_BASE_URL: 'https://kilo.example', ANTHROPIC_AUTH_TOKEN: 'kgw_2' });
+    check('putting it back re-enables the row as the default, with the new token', [st2.get('gateway').enabled, st2.registry().defaultProviderId, st2.get('gateway').apiKey], [true, 'gateway', 'kgw_2']);
+    st2.update('gateway', { options: { timeoutMs: 60000, extraBody: { temperature: 2 } } });
+    st2.update('gateway', { options: { timeoutMs: null, extraBody: null } });
+    check('a cleared option is removed, not kept', [st2.get('gateway').options.timeoutMs, st2.get('gateway').options.extraBody, st2.get('gateway').options.quietCli], [undefined, undefined, false]);
+    check('validation passes a cleared option through as null', P.validateProviderInput({ options: { timeoutMs: null, maxConcurrency: '', extraBody: null } }).value.options, { timeoutMs: null, maxConcurrency: null, extraBody: null });
+    st2.create({ id: 'x', type: 'openai-compatible', label: 'X', baseUrl: 'https://x/v1' });
+    st2.update('x', { type: 'anthropic-compatible' });
+    check('changing the API type is stored (it was silently dropped)', st2.get('x').type, 'anthropic-compatible');
+    db2.close();
+  }
+  {
+    const r2 = { providers: [claude, { ...gateway, models: [{ id: 'z-ai/glm-5:free', enabled: true, caps: {} }] }, deepseek], defaultProviderId: 'gateway' };
+    check('a bare non-alias id is known only if the default provider lists it', ['z-ai/glm-5:free', 'gpt-4o', 'haiku'].map(v => P.isKnownModel(v, r2)), [true, false, true]);
+    const f = P.resolveModel('ghost::haiku', { ...r2, defaultProviderId: 'deepseek' }, {});
+    check('a fallback keeps an alias\'s tier (haiku → the fast role, not main)', [f.provider.id, f.cliModel, f.fallback], ['deepseek', 'deepseek-chat', 'provider_missing']);
+    const ff = P.resolveModel('ghost::opus', { ...r2, defaultProviderId: 'deepseek' }, {});
+    check('…opus → the strong role', ff.cliModel, 'deepseek-reasoner');
+    const fab = P.buildRunEnv(P.resolveModel('sonnet', { providers: [claude, { ...deepseek, roles: { ...deepseek.roles, fable: 'deepseek-reasoner' } }], defaultProviderId: 'deepseek' }, {}), { baseUrl: 'b', token: 't' });
+    check('a pinned fable role reaches ANTHROPIC_DEFAULT_FABLE_MODEL', fab.set.ANTHROPIC_DEFAULT_FABLE_MODEL, 'deepseek-reasoner');
+  }
+
+  console.log(`\n${pass} passed, ${fail} failed`);
+  process.exit(fail ? 1 : 0);
+})().catch(e => { console.error(e); process.exit(1); });
diff --git a/test/render/bot-engine.test.mjs b/test/render/bot-engine.test.mjs
deleted file mode 100644
index 9315efcf..00000000
--- a/test/render/bot-engine.test.mjs
+++ /dev/null
@@ -1,117 +0,0 @@
-import assert from 'node:assert';
-import { readFileSync } from 'node:fs';
-import { loadFn } from './_load.mjs';
-
-// A bot can pin its own engine and model (e.g. the planner on the Claude subscription while the chat is on
-// the API). The editor shows them like the new-chat bar does: a row of buttons for the model
-// (Haiku / Sonnet / Opus / Fable) and one for the engine (API / Subscription), each with "same as chat".
-const html = readFileSync(new URL('../../public/index.html', import.meta.url), 'utf8');
-
-const seg = (id) => {
-  const m = new RegExp(`<div class="bot-seg" id="${id}"[^>]*>([\\s\\S]*?)</div>`).exec(html);
-  assert.ok(m, `${id} exists`);
-  return m[1];
-};
-const values = (block) => [...block.matchAll(/data-v="([^"]*)"/g)].map(m => m[1]);
-
-// ── markup
-assert.deepStrictEqual(values(seg('botModelSeg')), ['', 'haiku', 'sonnet', 'opus', 'fable'], 'the same four models as the new-chat bar, "same as chat" first');
-assert.deepStrictEqual(values(seg('botEngineSeg')), ['', 'api', 'subscription'], '"same as chat", API, subscription');
-assert.ok(/<button type="button" class="bot-seg-btn on" data-v=""/.test(seg('botModelSeg')) && /<button type="button" class="bot-seg-btn on" data-v=""/.test(seg('botEngineSeg')), '"same as chat" starts selected');
-for (const m of ['haiku', 'sonnet', 'opus', 'fable']) assert.ok(new RegExp(`data-v="${m}"[^>]*data-i18n-tip="model\\.${m}\\.tip"`).test(seg('botModelSeg')), `${m} has the same tooltip as the toolbar`);
-assert.ok(/data-i18n-title="engine\.api\.title"/.test(seg('botEngineSeg')) && /data-i18n-title="engine\.sub\.title"/.test(seg('botEngineSeg')), 'the engine buttons carry the toolbar\'s explanations');
-// syncBtn() toggles EVERY `.tb-group .tb-btn` with a matching data-v; reusing those classes would fight the chat toolbar
-assert.ok(!/tb-group|tb-btn/.test(seg('botModelSeg') + seg('botEngineSeg')), 'the editor must not use the toolbar classes');
-assert.ok(html.indexOf('id="botEngineSeg"') < html.indexOf('id="botModelSeg"'), 'the engine comes first: what the model list offers depends on it');
-assert.ok(/<input type="hidden" id="botModel">/.test(html) && /<input type="hidden" id="botEngine">/.test(html), 'the chosen values live in hidden inputs');
-assert.ok(/<select id="botModelGw"[^>]*hidden>/.test(html), 'the gateway list starts hidden');
-
-// ── file access in a discussion
-assert.deepStrictEqual(values(seg('botRoomToolsSeg')), ['', 'read', 'run', 'work'], 'default, read, read + run, read + write');
-assert.ok(/<button type="button" class="bot-seg-btn on" data-v=""/.test(seg('botRoomToolsSeg')), 'the default starts selected');
-assert.ok(!/tb-group|tb-btn/.test(seg('botRoomToolsSeg')), 'own classes again');
-assert.ok(/<input type="hidden" id="botRoomTools">/.test(html), 'a hidden input carries the value');
-assert.ok(/\$i\('botRoomTools'\)\.value = bot\?\.room_tools \|\| '';\s*renderBotRoomTools\(\);/.test(html), 'the form loads it');
-assert.ok(/roomTools: \$i\('botRoomTools'\)\.value \|\| null,/.test(html), 'saveBot sends it');
-{
-  const chips = ['', 'read', 'run', 'work'].map(v => { const c = { dataset: { v }, on: false }; c.classList = { toggle: (_, f) => { c.on = !!f; } }; return c; });
-  const hid = { value: '' };
-  Object.assign(globalThis, { $i: (id) => (id === 'botRoomTools' ? hid : null), document: { querySelectorAll: () => chips } });
-  const renderBotRoomTools = loadFn('renderBotRoomTools'); globalThis.renderBotRoomTools = renderBotRoomTools;
-  const setBotRoomTools = loadFn('setBotRoomTools');
-  const lit = () => chips.filter(c => c.on).map(c => c.dataset.v);
-  setBotRoomTools('read'); assert.deepStrictEqual([hid.value, lit()], ['read', ['read']]);
-  setBotRoomTools('work'); assert.deepStrictEqual([hid.value, lit()], ['work', ['work']]);
-  setBotRoomTools(''); assert.deepStrictEqual([hid.value, lit()], ['', ['']], 'back to the default');
-  for (const k of ['$i', 'document', 'renderBotRoomTools']) delete globalThis[k];
-}
-const hasKey = (k) => (html.match(new RegExp(`['"]${k.replace(/\./g, '\\.')}['"]:`, 'g')) || []).length;
-for (const k of ['bot.modal.tools.label', 'bot.tools.default', 'bot.tools.read', 'bot.tools.run', 'bot.tools.work', 'bot.modal.tools.hint']) assert.strictEqual(hasKey(k), 5, `${k} in all five languages`);
-
-// ── wiring
-assert.ok(/\$i\('botEngine'\)\.value = bot\?\.run_engine \|\| '';\s*renderBotEngine\(\);\s*renderBotModel\(bot\?\.model \|\| ''\);/.test(html), 'the form loads the stored engine and model');
-assert.ok(/model: \$i\('botModel'\)\.value \|\| null,\s*runEngine: \$i\('botEngine'\)\.value \|\| null,/.test(html), 'saveBot sends both; empty means "as the chat"');
-assert.ok(/bot\.run_engine === 'subscription'/.test(html), 'a message from a subscription bot says so in its header');
-
-// ── strings, all five languages
-const has = (k) => (html.match(new RegExp(`['"]${k.replace(/\./g, '\\.')}['"]:`, 'g')) || []).length;
-for (const k of ['bot.modal.engine.label', 'bot.engine.inherit', 'bot.engine.api', 'bot.engine.subscription', 'bot.modal.engine.hint',
-  'bot.model.no_tools', 'bot.modal.model.hint', 'bot.model.gateway.ph']) assert.strictEqual(has(k), 5, `${k} is defined in all five languages`);
-assert.strictEqual(has('bot.model.group.claude'), 0, 'no leftover strings from the select-based editor');
-
-// ── the gateway list (API only)
-const botModelChoices = loadFn('botModelChoices');
-const catalogue = [{ id: 'poolside/laguna-s-2.1:free', name: 'Laguna', tools: true }, { id: 'z-ai/glm-5.2:free', name: 'GLM', tools: false }, { id: 'sonnet', name: 'dup of an alias' }];
-const idsOf = (c) => c.gateway.map(g => g.id);
-assert.deepStrictEqual(botModelChoices(catalogue, '', '').claude, ['haiku', 'sonnet', 'opus', 'fable']);
-assert.deepStrictEqual(idsOf(botModelChoices(catalogue, '', '')), ['poolside/laguna-s-2.1:free', 'z-ai/glm-5.2:free'], 'as-chat and API offer the gateway models; an alias is not listed twice');
-assert.deepStrictEqual(botModelChoices(catalogue, 'subscription', ''), { claude: ['haiku', 'sonnet', 'opus', 'fable'], gateway: [], extra: null }, 'the subscription offers Claude models only');
-assert.deepStrictEqual(botModelChoices(catalogue, 'api', '').gateway.map(g => g.tools), [true, false], 'a model without tools is flagged');
-assert.strictEqual(botModelChoices(catalogue, 'api', 'opus').extra, null, 'an alias in use is not an extra');
-assert.strictEqual(botModelChoices(catalogue, 'api', 'old/model:free').extra, 'old/model:free', 'a stored model that is no longer offered stays selectable');
-assert.deepStrictEqual(botModelChoices(null, 'api', ''), { claude: ['haiku', 'sonnet', 'opus', 'fable'], gateway: [], extra: null }, 'no catalogue (gateway down): the editor still works');
-
-// ── behaviour on a minimal fake DOM
-const mk = (tag, dataV) => ({ tag, dataset: { v: dataV }, children: [], value: '', hidden: false, isConnected: true, on: false,
-  classList: null, appendChild(c) { this.children.push(c); return c; }, set textContent(v) { if (v === '') this.children = []; else this._t = v; }, get textContent() { return this._t; } });
-const chip = (v) => { const c = mk('button', v); c.classList = { toggle: (_, f) => { c.on = !!f; } }; return c; };
-const modelChips = ['', 'haiku', 'sonnet', 'opus', 'fable'].map(chip), engineChips = ['', 'api', 'subscription'].map(chip);
-const els = { botModel: mk('input'), botEngine: mk('input'), botModelGw: mk('select') };
-Object.assign(globalThis, {
-  document: { createElement: (t) => mk(t), querySelectorAll: (q) => (q.startsWith('#botModelSeg') ? modelChips : engineChips) },
-  $i: (id) => els[id], t: (k) => ({ 'bot.model.gateway.ph': 'Another…', 'bot.model.no_tools': 'no tools' })[k] || k,
-  _gatewayModels: [{ id: 'poolside/laguna-s-2.1:free', name: 'Laguna', tools: true }, { id: 'z-ai/glm-5.2:free', name: 'GLM', tools: false }],
-  loadGatewayModels: async () => globalThis._gatewayModels, botModelChoices,
-});
-const renderBotModel = loadFn('renderBotModel'), renderBotEngine = loadFn('renderBotEngine');
-Object.assign(globalThis, { renderBotModel, renderBotEngine });
-const setBotModel = loadFn('setBotModel'), setBotEngine = loadFn('setBotEngine');
-const lit = (chips) => chips.filter(c => c.on).map(c => c.dataset.v);
-const gwShape = () => els.botModelGw.children.map(o => [o.value, o.textContent]);
-
-renderBotModel('');
-assert.deepStrictEqual(lit(modelChips), [''], 'nothing pinned: "same as chat" is lit');
-assert.strictEqual(els.botModelGw.hidden, false, 'as-chat may run on the API, so the gateway list is offered');
-assert.deepStrictEqual(gwShape(), [['', 'Another…'], ['poolside/laguna-s-2.1:free', 'Laguna'], ['z-ai/glm-5.2:free', 'GLM — no tools']]);
-assert.strictEqual(els.botModelGw.value, '', 'no gateway model selected while a chip (or nothing) is');
-
-setBotModel('opus');
-assert.deepStrictEqual([els.botModel.value, lit(modelChips), els.botModelGw.value], ['opus', ['opus'], ''], 'a chip sets the model and lights alone');
-
-setBotModel('poolside/laguna-s-2.1:free');
-assert.deepStrictEqual([els.botModel.value, lit(modelChips), els.botModelGw.value], ['poolside/laguna-s-2.1:free', [], 'poolside/laguna-s-2.1:free'], 'a gateway model unlights the chips');
-
-setBotEngine('subscription');
-assert.deepStrictEqual([els.botEngine.value, lit(engineChips), els.botModel.value, lit(modelChips), els.botModelGw.hidden], ['subscription', ['subscription'], '', [''], true],
-  'switching to the subscription drops a gateway model visibly, back to "same as chat", and hides the gateway list');
-
-setBotModel('fable'); setBotEngine('api');
-assert.deepStrictEqual([els.botModel.value, lit(modelChips), lit(engineChips)], ['fable', ['fable'], ['api']], 'an alias survives an engine switch');
-els.botModel.value = 'claude-opus-4-8'; setBotEngine('subscription');
-assert.strictEqual(els.botModel.value, 'claude-opus-4-8', 'a full Claude id is valid on the subscription and stays');
-assert.strictEqual(els.botModelGw.hidden, false, '...and stays visible (in the list) rather than being a hidden choice');
-setBotEngine('');
-assert.deepStrictEqual(lit(engineChips), [''], '"same as chat" for the engine lights the first button');
-
-for (const k of ['document', '$i', 't', '_gatewayModels', 'loadGatewayModels', 'botModelChoices', 'renderBotModel', 'renderBotEngine']) delete globalThis[k];
-console.log('bot-engine: ok');
diff --git a/test/render/bot-model.test.mjs b/test/render/bot-model.test.mjs
new file mode 100644
index 00000000..c2342035
--- /dev/null
+++ b/test/render/bot-model.test.mjs
@@ -0,0 +1,118 @@
+import assert from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { loadFn } from './_load.mjs';
+
+// A bot can pin its own model (e.g. the planner on the Claude subscription while the chat is on an API
+// provider). There is no engine field: the model's PROVIDER decides the engine (server.js runEngineFor),
+// so the editor shows ONE button that opens the toolbar's own model picker, with "same as chat" on top,
+// and every provider in that list is marked "subscription" or "API".
+const html = readFileSync(new URL('../../public/index.html', import.meta.url), 'utf8');
+
+const seg = (id) => {
+  const m = new RegExp(`<div class="bot-seg" id="${id}"[^>]*>([\\s\\S]*?)</div>`).exec(html);
+  assert.ok(m, `${id} exists`);
+  return m[1];
+};
+const values = (block) => [...block.matchAll(/data-v="([^"]*)"/g)].map(m => m[1]);
+
+// ── markup
+assert.ok(!/id="botEngineSeg"|id="botEngine"/.test(html), 'no engine field any more: the model decides it');
+assert.ok(!/id="botModelSeg"|id="botModelGw"/.test(html), 'no alias chips and no second select: one button, one list');
+assert.ok(/<button type="button" class="bot-mdl-btn" id="botModelBtn" onclick="openBotModelPicker\(this\)" aria-haspopup="dialog"><\/button>/.test(html), 'one button opens the picker');
+assert.ok(/<input type="hidden" id="botModel">/.test(html), 'the chosen value lives in a hidden input');
+// syncBtn() toggles EVERY `.tb-group .tb-btn` with a matching data-v; reusing those classes would fight the chat toolbar
+assert.ok(!/class="[^"]*\btb-btn\b[^"]*" id="botModelBtn"/.test(html), 'the editor must not use the toolbar classes');
+assert.ok(!/id="botTemplates"|BOT_TEMPLATES|applyBotTemplate/.test(html), 'no starter-prompt templates: they overwrote the bot\'s own prompt');
+
+// ── file access in a discussion
+assert.deepStrictEqual(values(seg('botRoomToolsSeg')), ['', 'read', 'run', 'work'], 'default, read, read + run, read + write');
+assert.ok(/<button type="button" class="bot-seg-btn on" data-v=""/.test(seg('botRoomToolsSeg')), 'the default starts selected');
+assert.ok(!/tb-group|tb-btn/.test(seg('botRoomToolsSeg')), 'own classes again');
+assert.ok(/<input type="hidden" id="botRoomTools">/.test(html), 'a hidden input carries the value');
+assert.ok(/\$i\('botRoomTools'\)\.value = bot\?\.room_tools \|\| '';\s*renderBotRoomTools\(\);/.test(html), 'the form loads it');
+assert.ok(/roomTools: \$i\('botRoomTools'\)\.value \|\| null,/.test(html), 'saveBot sends it');
+{
+  const chips = ['', 'read', 'run', 'work'].map(v => { const c = { dataset: { v }, on: false }; c.classList = { toggle: (_, f) => { c.on = !!f; } }; return c; });
+  const hid = { value: '' };
+  Object.assign(globalThis, { $i: (id) => (id === 'botRoomTools' ? hid : null), document: { querySelectorAll: () => chips } });
+  const renderBotRoomTools = loadFn('renderBotRoomTools'); globalThis.renderBotRoomTools = renderBotRoomTools;
+  const setBotRoomTools = loadFn('setBotRoomTools');
+  const lit = () => chips.filter(c => c.on).map(c => c.dataset.v);
+  setBotRoomTools('read'); assert.deepStrictEqual([hid.value, lit()], ['read', ['read']]);
+  setBotRoomTools('work'); assert.deepStrictEqual([hid.value, lit()], ['work', ['work']]);
+  setBotRoomTools(''); assert.deepStrictEqual([hid.value, lit()], ['', ['']], 'back to the default');
+  for (const k of ['$i', 'document', 'renderBotRoomTools']) delete globalThis[k];
+}
+const has = (k) => (html.match(new RegExp(`['"]${k.replace(/\./g, '\\.')}['"]:`, 'g')) || []).length;
+for (const k of ['bot.modal.tools.label', 'bot.tools.default', 'bot.tools.read', 'bot.tools.run', 'bot.tools.work', 'bot.modal.tools.hint']) assert.strictEqual(has(k), 5, `${k} in all five languages`);
+
+// ── wiring
+assert.ok(/renderBotModel\(bot\?\.model \|\| ''\);/.test(html), 'the form loads the stored model');
+assert.ok(/model: \$i\('botModel'\)\.value \|\| null,\n\s*roomTools:/.test(html), 'saveBot sends the model and no engine; empty means "as the chat"');
+assert.ok(/openModelPicker\(anchor, \{ current: \(\$i\('botModel'\) \|\| \{\}\)\.value \|\| '', inherit: true, onPick: setBotModel \}\)/.test(html), 'the button borrows the toolbar\'s picker, with "same as chat"');
+assert.ok(/bot\.model \? `<span class="bh-model">\$\{escH\(botModelText\(bot\.model\)\)\}<\/span>`/.test(html), 'a bot\'s message header names its model the way the picker does');
+
+// ── strings, all five languages
+for (const k of ['bot.modal.model.label', 'bot.model.inherit', 'bot.modal.model.hint', 'prov.mode.subscription', 'prov.mode.api', 'prov.mode.subscription.tip', 'prov.mode.api.tip'])
+  assert.strictEqual(has(k), 5, `${k} is defined in all five languages`);
+for (const k of ['bot.modal.engine.label', 'bot.engine.inherit', 'bot.engine.api', 'bot.engine.subscription', 'bot.modal.engine.hint', 'bot.model.gateway.ph', 'bot.model.no_tools', 'bot.tpl.analyst.name'])
+  assert.strictEqual(has(k), 0, `no leftover ${k}`);
+
+// ── behaviour on a minimal fake DOM
+const CHOICES = { defaultProviderId: 'kilo', providers: [
+  { id: 'kilo', label: 'kilo', type: 'anthropic-compatible', isDefault: true, models: [
+    { ref: 'kilo::sonnet', id: 'sonnet', alias: true }, { ref: 'kilo::gpt-x', id: 'gpt-x', label: 'GPT X', caps: { tools: true } }] },
+  { id: 'claude', label: 'Claude', type: 'claude-subscription', builtin: true, isDefault: false, models: [
+    { ref: 'claude::opus', id: 'opus', alias: true }] },
+] };
+const T = { 'bot.model.inherit': 'Same as chat', 'prov.builtin.claude': 'Claude (CLI login)', 'prov.mode.subscription': 'subscription', 'prov.mode.api': 'API', 'prov.default': 'default' };
+const btn = { innerHTML: '', title: '', classList: { v: new Set(), toggle(c, f) { f ? this.v.add(c) : this.v.delete(c); } } };
+const hid = { value: '', isConnected: true };
+Object.assign(globalThis, {
+  $i: (id) => ({ botModel: hid, botModelBtn: btn })[id], t: (k) => T[k] || k, _modelChoices: CHOICES,
+  _MODEL_ALIASES: ['haiku', 'sonnet', 'opus', 'fable'], _MODEL_ALIAS_LABEL: { haiku: 'Haiku', sonnet: 'Sonnet', opus: 'Opus', fable: 'Fable' },
+});
+for (const n of ['escH', 'modelInfo', 'provModeOf', 'provModeBadge', 'botModelText', 'renderBotModel']) globalThis[n] = loadFn(n);
+const setBotModel = loadFn('setBotModel');
+const shown = () => btn.innerHTML.replace(/<[^>]+>/g, '|').split('|').filter(Boolean);
+
+renderBotModel('');
+assert.deepStrictEqual([shown(), btn.classList.v.has('inherit')], [['Same as chat', '▾'], true], 'nothing pinned: the button says "same as chat"');
+setBotModel('claude::opus');
+assert.deepStrictEqual([hid.value, shown(), btn.classList.v.has('inherit')], ['claude::opus', ['Opus', 'Claude (CLI login)', 'subscription', '▾'], false],
+  'a model of the CLI login names its provider and says "subscription"');
+assert.ok(/class="prov-mode subscription"/.test(btn.innerHTML), 'the mark is the shared prov-mode badge');
+setBotModel('kilo::gpt-x');
+assert.deepStrictEqual(shown(), ['GPT X', 'kilo', 'API', '▾'], 'a model of an API provider says "API"');
+setBotModel('sonnet');
+assert.deepStrictEqual(shown(), ['Sonnet', 'kilo', 'API', '▾'], 'a bare alias is the default provider\'s');
+assert.deepStrictEqual([botModelText('claude::opus'), botModelText('sonnet')], ['Claude (CLI login) · Opus', 'Sonnet'], 'the message header names another provider, not the default one');
+
+// ── the picker a field borrows: "same as chat" on top, the pick goes to the field
+{
+  const rows = [];
+  const mkEl = () => { const e = { className: '', innerHTML: '', dataset: {}, title: '', setAttribute() {}, listeners: {}, addEventListener(n, f) { this.listeners[n] = f; } }; return e; };
+  const list = { innerHTML: '', appendChild: (e) => { rows.push(e); return e; } };
+  let picked = null, closed = 0;
+  Object.assign(globalThis, {
+    document: { createElement: mkEl }, curModel: 'kilo::gpt-x', _mdlPickKb: -1, _mdlPickRefs: [],
+    _mdlPickOpts: { current: 'claude::opus', inherit: true, onPick: (v) => { picked = v; } },
+    modelCapsText: () => '', closeModelPicker: () => { closed++; globalThis._mdlPickOpts = null; },
+  });
+  globalThis.$i = (id) => ({ mdlPickList: list, mdlPickInp: { value: '' } })[id];
+  const renderModelPicker = loadFn('renderModelPicker'), pickModel = loadFn('pickModel');
+  renderModelPicker();
+  const text = (e) => e.innerHTML.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
+  assert.strictEqual(text(rows[0]), 'Same as chat', '"same as chat" is the first entry');
+  assert.deepStrictEqual(globalThis._mdlPickRefs, ['', 'sonnet', 'kilo::gpt-x', 'claude::opus'], 'then the default provider (its aliases bare), then the others as refs');
+  const groups = rows.filter(r => r.className === 'mdl-pick-grp').map(text);
+  assert.deepStrictEqual(groups, ['kilo API default', 'Claude (CLI login) subscription'], 'every provider is marked subscription or API');
+  const on = rows.filter(r => /\bon\b/.test(r.className)).map(text);
+  assert.deepStrictEqual(on, ['Opus'], 'the FIELD\'s value is lit, not the chat\'s');
+  pickModel('');
+  assert.deepStrictEqual([picked, closed, globalThis.curModel], ['', 1, 'kilo::gpt-x'], '"same as chat" reaches the field and leaves the chat\'s model alone');
+  for (const k of ['document', 'curModel', '_mdlPickKb', '_mdlPickRefs', '_mdlPickOpts', 'modelCapsText', 'closeModelPicker']) delete globalThis[k];
+}
+
+for (const k of ['$i', 't', '_modelChoices', '_MODEL_ALIASES', '_MODEL_ALIAS_LABEL', 'escH', 'modelInfo', 'provModeOf', 'provModeBadge', 'botModelText', 'renderBotModel']) delete globalThis[k];
+console.log('bot-model: ok');
diff --git a/test/render/plan-review.test.mjs b/test/render/plan-review.test.mjs
index 1eeb7cbe..7a676e35 100644
--- a/test/render/plan-review.test.mjs
+++ b/test/render/plan-review.test.mjs
@@ -4,7 +4,7 @@ import { loadFn } from './_load.mjs';
 
 // The plan-review card (planner's plan/ package -> Kanban approval). planReviewCardHtml is pure
 // (given the global selection state it reads); the DOM-driving functions around it are checked by
-// wiring assertions against the source, same as bot-engine.test.mjs does for that editor.
+// wiring assertions against the source, same as bot-model.test.mjs does for that editor.
 const html = readFileSync(new URL('../../public/index.html', import.meta.url), 'utf8');
 
 const T = (id, over = {}) => ({ id, title: `Task ${id}`, bot: 'kolya-prohramist', depends_on: [], covers: [], model: null, max_turns: null, file: `plan/tasks/${id}.md`, description: 'd', context: 'c', errors: [], warnings: [], existingTaskId: null, ...over });
diff --git a/test/room-run.test.js b/test/room-run.test.js
index aeed4a93..b1fe02fb 100644
--- a/test/room-run.test.js
+++ b/test/room-run.test.js
@@ -32,11 +32,11 @@ const BOT_READ_TOOLS = ['Read', 'Glob', 'Grep'], BOT_WORK_TOOLS = ['Bash', 'Read
 
 const NAMES = ['ROOM_CLOSING', 'ClaudeCLI', 'stmts', 'ROOM_SEATING', 'botsLogic', 'getUserLang', 'pickRoomSeating', 'WORKDIR', 'seatingNote', 'botLangName',
   'roomFiles', 'MULTI_AGENT_MAX_TURNS_CAP', 'mcpServersForBot', 'runInteractiveSingle', 'killInteractiveTmux', 'isAgentSuccess',
-  'roomStopReason', 'BOT_READ_TOOLS', 'BOT_WORK_TOOLS', 'tmuxAvailable', 'ROOM_GIT', 'roomGit', 'WM'];
+  'roomStopReason', 'BOT_READ_TOOLS', 'BOT_WORK_TOOLS', 'tmuxAvailable', 'ROOM_GIT', 'roomGit', 'WM', 'runEngineFor'];
 const build = (deps) => new Function(...NAMES, `${toolsSrc}\n return ${roomSrc.trim().replace(/^async function runConversationRoom/, 'async function runConversationRoom')};`)(...NAMES.map(n => deps[n]));
 
 /** Runs one room turn. `script(call)` decides what each CLI run does: { text, subtype, error, write: [[relPath, data]] }. */
-async function runRoom({ closing = true, bots, script, mode = 'auto', maxTurns = 5, prompt = 'Доработайте ТЗ', userContent = 'Доработайте ТЗ', rows = [], workdir, engine = 'api', lang = 'ru', perBotEngine = false, tmux = true, git = 'none', gitOn = true }) {
+async function runRoom({ closing = true, bots, script, mode = 'auto', maxTurns = 5, prompt = 'Доработайте ТЗ', userContent = 'Доработайте ТЗ', rows = [], workdir, engine = 'api', model = 'sonnet', lang = 'ru', perBotEngine = false, tmux = true, git = 'none', gitOn = true }) {
   const saved = [], sent = [], calls = [], interactive = [], gitCalls = [];
   class FakeCLI {
     send(opts) {
@@ -67,13 +67,17 @@ async function runRoom({ closing = true, bots, script, mode = 'auto', maxTurns =
     getUserLang: () => lang, pickRoomSeating: async () => null, WORKDIR: workdir, seatingNote: () => '', botLangName: () => (lang === 'ru' ? 'Russian' : 'English'),
     MULTI_AGENT_MAX_TURNS_CAP: 200, mcpServersForBot: (base) => base, runInteractiveSingle: async (o) => { interactive.push(o); return { fullText: `subscription answer of ${o.agent}`, completed: true, toolEvents: [] }; }, killInteractiveTmux() {},
     tmuxAvailable: () => tmux,
+    // server.js runEngineFor, for a registry whose DEFAULT provider is an API one (a gateway):
+    // a `claude::` ref is the CLI login and runs on the subscription while tmux exists, a
+    // bare alias is the gateway's model and runs headless.
+    runEngineFor: (m) => ((tmux && /^claude::/.test(String(m || ''))) ? 'subscription' : 'api'),
     ROOM_GIT: gitOn, WM: {},
     // `git`: 'none' = not a repo the app manages; a function = the checkpoint result for call n (1-based)
     roomGit: { checkpoint: (dir, msg) => { gitCalls.push({ dir, msg }); return typeof git === 'function' ? git(gitCalls.length, dir, msg) : { managed: false }; } },
   };
   const run = build(deps);
   const ws = { send: (x) => sent.push(JSON.parse(x)) };
-  await run({ mcpServers: {}, model: 'sonnet', maxTurns, ws, sessionId: 's1', abortController: new AbortController(), workdir, tabId: 't1', effort: null, userContent, engine, mode, perBotEngine },
+  await run({ mcpServers: {}, model, maxTurns, ws, sessionId: 's1', abortController: new AbortController(), workdir, tabId: 't1', effort: null, userContent, engine, mode, perBotEngine },
     { bots, prompt, rosterBots: bots });
   return { saved, sent, calls, interactive, gitCalls };
 }
@@ -229,10 +233,10 @@ const discuss = (call) => (call.closing ? null : (call.n <= 3 ? { text: `contrib
     fs.rmSync(dir, { recursive: true, force: true });
   }
 
-  console.log('a bot can run on its own engine (the planner on the subscription in an API chat):');
+  console.log('a bot runs on the engine of its own model (the planner on the subscription in an API chat):');
   {
     const dir = tmp();
-    const planner = { ...B('b'), run_engine: 'subscription' };
+    const planner = { ...B('b'), model: 'claude::opus' };
     const mixed = [B('a'), planner, B('c')];
     const r = await runRoom({ bots: mixed, workdir: dir, perBotEngine: true, closing: false, script: discuss });
     check('the pinned bot goes through the interactive engine, once per round it speaks', r.interactive.map(o => o.agent).every(a => a === 'b') && r.interactive.length >= 1, true);
@@ -244,13 +248,13 @@ const discuss = (call) => (call.closing ? null : (call.n <= 3 ? { text: `contrib
   }
   {
     const dir = tmp();
-    const planner = { ...B('b'), run_engine: 'subscription' };
+    const planner = { ...B('b'), model: 'claude::opus' };
     const off = await runRoom({ bots: [B('a'), planner, B('c')], workdir: dir, perBotEngine: false, closing: false, script: discuss });
     check('where the override is not enabled (Telegram) the pinned bot follows the chat', [off.interactive.length, off.calls.some(c => c.who === 'b')], [0, true]);
     const noTmux = await runRoom({ bots: [B('a'), planner, B('c')], workdir: dir, perBotEngine: true, tmux: false, closing: false, script: discuss });
     check('without tmux the pinned bot follows the chat instead of failing', [noTmux.interactive.length, noTmux.calls.some(c => c.who === 'b')], [0, true]);
-    const pinnedApi = await runRoom({ bots: [B('a'), { ...B('b'), run_engine: 'api' }, B('c')], workdir: dir, perBotEngine: true, engine: 'subscription', closing: false, script: discuss });
-    check('a bot pinned to api runs headless inside a subscription chat, the rest use the interactive engine', [pinnedApi.calls.some(c => c.who === 'b'), pinnedApi.interactive.some(o => o.agent === 'a')], [true, true]);
+    const pinnedApi = await runRoom({ bots: [B('a'), { ...B('b'), model: 'kilo::gpt-x' }, B('c')], workdir: dir, perBotEngine: true, engine: 'subscription', model: 'claude::sonnet', closing: false, script: discuss });
+    check('a bot on another provider\'s model runs headless inside a subscription chat, the rest use the interactive engine', [pinnedApi.calls.some(c => c.who === 'b'), pinnedApi.interactive.some(o => o.agent === 'a')], [true, true]);
     fs.rmSync(dir, { recursive: true, force: true });
   }
 
diff --git a/test/running-sessions.test.js b/test/running-sessions.test.js
index cc04937c..bd65304f 100644
--- a/test/running-sessions.test.js
+++ b/test/running-sessions.test.js
@@ -20,6 +20,9 @@ const fs = require('fs');
 const net = require('net');
 const os = require('os');
 const path = require('path');
+// Runs here go through the fake headless `claude`: pin an API provider as the default
+// (see _api-provider-env.js — otherwise CI's tmux would take them to the Subscription engine).
+const API_PROVIDER_ENV = require('./_api-provider-env');
 const { spawn } = require('child_process');
 const WebSocket = require('ws');
 
@@ -58,7 +61,7 @@ let srv = null, srvExited = false, srvLog = '';
 function startServer() {
   // CCS_DESKTOP=1 bypasses auth and binds 127.0.0.1 only; APP_DIR redirects data/ to the temp dir.
   srv = spawn(process.execPath, [path.join(__dirname, '..', 'server.js')], {
-    env: { ...process.env, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR },
+    env: { ...process.env, ...API_PROVIDER_ENV, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
   srv.on('exit', () => { srvExited = true; });
diff --git a/test/session-liveness.test.js b/test/session-liveness.test.js
index 00f6bc24..6ad754c3 100644
--- a/test/session-liveness.test.js
+++ b/test/session-liveness.test.js
@@ -28,6 +28,9 @@ const assert = require('assert');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+// Runs here go through the fake headless `claude`: pin an API provider as the default
+// (see _api-provider-env.js — otherwise CI's tmux would take them to the Subscription engine).
+const API_PROVIDER_ENV = require('./_api-provider-env');
 const { spawn } = require('child_process');
 const WebSocket = require('ws');
 
@@ -66,7 +69,7 @@ fs.writeFileSync(path.join(binDir, 'claude'),
 fs.chmodSync(path.join(binDir, 'claude'), 0o755);
 
 const srv = spawn(process.execPath, [path.join(__dirname, '..', 'server.js')], {
-  env: { ...process.env, PORT: String(PORT), APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR },
+  env: { ...process.env, ...API_PROVIDER_ENV, PORT: String(PORT), APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR },
   stdio: ['ignore', 'pipe', 'pipe'],
 });
 let srvExited = null;
diff --git a/test/session-restart.test.js b/test/session-restart.test.js
index 0943b193..2caf768e 100644
--- a/test/session-restart.test.js
+++ b/test/session-restart.test.js
@@ -23,6 +23,9 @@ const fs = require('fs');
 const net = require('net');
 const os = require('os');
 const path = require('path');
+// Runs here go through the fake headless `claude`: pin an API provider as the default
+// (see _api-provider-env.js — otherwise CI's tmux would take them to the Subscription engine).
+const API_PROVIDER_ENV = require('./_api-provider-env');
 const { spawn } = require('child_process');
 const WebSocket = require('ws');
 
@@ -59,7 +62,7 @@ fs.chmodSync(path.join(binDir, 'claude'), 0o755);
 let srv = null, srvExited = false, srvLog = '';
 function startServer() {
   srv = spawn(process.execPath, [path.join(__dirname, '..', 'server.js')], {
-    env: { ...process.env, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR },
+    env: { ...process.env, ...API_PROVIDER_ENV, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
   srv.on('exit', () => { srvExited = true; });
diff --git a/test/ssh-secret.test.js b/test/ssh-secret.test.js
index 80142705..112f11da 100644
--- a/test/ssh-secret.test.js
+++ b/test/ssh-secret.test.js
@@ -26,6 +26,9 @@ const fs = require('fs');
 const os = require('os');
 const net = require('net');
 const path = require('path');
+// Runs here go through the fake headless `claude`: pin an API provider as the default
+// (see _api-provider-env.js — otherwise CI's tmux would take them to the Subscription engine).
+const API_PROVIDER_ENV = require('./_api-provider-env');
 const crypto = require('crypto');
 const { spawn } = require('child_process');
 const WebSocket = require('ws');
@@ -109,7 +112,7 @@ async function api(method, url, body) {
 // The parent shell of a Claude Code session exports CCS_DESKTOP=1 (auth wall off) and
 // APP_DIR (repoints data/ at the real user dir), so the child env is scrubbed.
 function childEnv(extra) {
-  const env = { ...process.env, ...extra };
+  const env = { ...process.env, ...API_PROVIDER_ENV, ...extra };
   delete env.CCS_DESKTOP;
   for (const k of ['CCS_INTERRUPT_URL', 'CCS_INTERRUPT_SESSION', 'CCS_INTERRUPT_SECRET']) delete env[k];
   return env;
diff --git a/test/subscribe-nocatchup.test.js b/test/subscribe-nocatchup.test.js
index 517548dd..7cfc2c5b 100644
--- a/test/subscribe-nocatchup.test.js
+++ b/test/subscribe-nocatchup.test.js
@@ -29,6 +29,9 @@ const fs = require('fs');
 const net = require('net');
 const os = require('os');
 const path = require('path');
+// Runs here go through the fake headless `claude`: pin an API provider as the default
+// (see _api-provider-env.js — otherwise CI's tmux would take them to the Subscription engine).
+const API_PROVIDER_ENV = require('./_api-provider-env');
 const { spawn } = require('child_process');
 const WebSocket = require('ws');
 
@@ -80,6 +83,7 @@ function startServer() {
   srv = spawn(process.execPath, [path.join(__dirname, '..', 'server.js')], {
     env: {
       ...process.env,
+      ...API_PROVIDER_ENV,
       PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR: APP_DIR, HOME: HOME_DIR,
       TASK_DISCONNECT_TIMEOUT_MS: String(DISCONNECT_MS),
     },
diff --git a/test/task-blocked-and-empty-response.test.js b/test/task-blocked-and-empty-response.test.js
index 56c35890..aa85d74f 100644
--- a/test/task-blocked-and-empty-response.test.js
+++ b/test/task-blocked-and-empty-response.test.js
@@ -24,6 +24,9 @@ const assert = require('assert');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+// Runs here go through the fake headless `claude`: pin an API provider as the default
+// (see _api-provider-env.js — otherwise CI's tmux would take them to the Subscription engine).
+const API_PROVIDER_ENV = require('./_api-provider-env');
 const { spawn } = require('child_process');
 
 let pass = 0, fail = 0;
@@ -64,7 +67,7 @@ exit 0
 
 let srvLog = '';
 const child = spawn(process.execPath, [path.join(__dirname, '..', 'server.js')], {
-  env: { ...process.env, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR, HOME: HOME_DIR, CCS_TASK_MANAGER_SECRET: SECRET },
+  env: { ...process.env, ...API_PROVIDER_ENV, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR, HOME: HOME_DIR, CCS_TASK_MANAGER_SECRET: SECRET },
   stdio: ['ignore', 'pipe', 'pipe'],
 });
 let exited = false;