@timo972/cc-router 0.11.0 → 0.12.0-rc.0

package/CHANGELOG.md

@@ -10,6 +10,18 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- `cc-router cli claude` and `cc-router cli codex` toggle Claude Code / Codex
+  CLI routing without stopping the proxy: `start`, `stop`, `resume` (same as
+  start), and `status`. `cc-router cli` shows both. Short aliases
+  `cc-router claude` / `cc-router codex` still work. `configure --remove` now
+  also works with `configure codex --remove`. `stop --full` / `revert` and
+  `client disconnect` strip the Codex managed block as well as Claude Code
+  settings.
+- Dashboard `[c]` / `[x]` toggle Claude Code / Codex CLI routing without
+  stopping the proxy (`[c]` still sets the Claude model default while MODELS
+  is focused).
+- Status dashboard `rst` column shows Codex banked usage-limit reset count
+  (`0` = none available); Claude cells are `—`.
 - Automatic upstream failover and retry on both providers. A 429 or 5xx
   received before any response byte is relayed no longer passes straight
   through to the client: the router applies the existing cooldown/affinity

package/README.md

@@ -220,7 +220,17 @@ cc-router configure codex    (Re)write ~/.codex/config.toml for Codex CLI
 cc-router configure codex --model openai/gpt-5-codex
 cc-router configure models --claude-model claude-sonnet-4-6 --openai-model gpt-5-codex
 cc-router configure --show   Show current Claude Code proxy settings
-cc-router configure --remove Remove cc-router settings (same as revert without stopping)
+cc-router configure --remove Remove cc-router settings from Claude Code (proxy stays up)
+cc-router configure codex --remove  Remove the Codex managed block (proxy stays up)
+
+cc-router cli                Show whether Claude Code and Codex are routing through the proxy
+cc-router cli claude start   Point Claude Code at the running proxy
+cc-router cli claude stop    Restore Claude Code to native Anthropic auth (proxy stays up)
+cc-router cli claude resume  Same as cli claude start
+cc-router cli codex start    Point Codex CLI at the running proxy
+cc-router cli codex stop     Restore Codex CLI to native OpenAI auth (proxy stays up)
+cc-router cli codex resume   Same as cli codex start
+cc-router claude … / cc-router codex …   Hidden shortcuts for the same commands
 
 cc-router client connect <url>       Connect Claude Code to a remote CC-Router
 cc-router client connect --desktop   Also configure Claude Desktop interception
@@ -502,6 +512,24 @@ mitmproxy's local mode is *process-scoped* — it only intercepts traffic from t
 
 ---
 
+## Toggle Claude Code or Codex while the proxy stays up
+
+`cc-router start` / `stop` control the proxy process. To send only one CLI back to native auth (or point it at the proxy again) without tearing the router down:
+
+```bash
+cc-router cli                 # Claude Code + Codex routing state
+cc-router cli claude stop     # Claude Code → native Anthropic auth
+cc-router cli claude resume   # Claude Code → running proxy (alias of start)
+cc-router cli codex start     # Codex CLI → running proxy
+cc-router cli codex stop      # Codex CLI → native OpenAI auth
+```
+
+`cc-router claude …` and `cc-router codex …` are shortcuts for the same commands. `cli` is the grouping — not `provider`, which already means the Anthropic/OpenAI account pool. `cc-router client` remains remote client-mode (connect this machine to another CC-Router).
+
+These rewrite `~/.claude/settings.json` or the managed block in `~/.codex/config.toml`. The proxy keeps listening. Restart any already-running Claude Code or Codex process so it picks up the new config. From `cc-router status`, `[c]` / `[x]` do the same toggles.
+
+---
+
 ## Reverting to normal Claude Code
 
 To stop using cc-router and go back to normal Claude Code authentication:
@@ -529,7 +557,7 @@ cc-router status
   Claude 2/2 healthy  OpenAI 1/1 healthy  ·  cross-route ready
   endpoints /v1/messages /v1/responses /v1/models /cc-router/accounts
   routing claude=claude-sonnet-4-6 aliases[sonnet]  openai=gpt-5-codex aliases[codex]
-  models [m] list/select  change [c] Claude [o] OpenAI
+  cli Claude on Codex off [c]/[x]  ·  models [m] then [c]/[o] defaults
 
  MODELS  [m/r] refresh  [↑/↓] select  [c] Claude default  [o] OpenAI default
   current claude=claude-sonnet-4-6  openai=gpt-5-codex
@@ -561,7 +589,8 @@ The dashboard is also a control surface. In local mode it controls the local pro
 | `w` / `s` | Change selected Claude account weekly/session cap |
 | `d` | Delete selected Claude account |
 | `m` / `r` | Load or refresh discovered provider models |
-| `c` | Set selected `anthropic/*` model as Claude default |
+| `c` | Toggle Claude Code routing (or set Claude model default when MODELS is focused) |
+| `x` | Toggle Codex CLI routing (proxy stays up) |
 | `o` | Set selected `openai/*` model as OpenAI default |
 
 List and change models without waiting for a package update:

package/dist/cli/cmd-accounts.js

@@ -1,15 +1,17 @@
 import chalk from "chalk";
-import { loadAccounts, loadOpenAIAccounts, accountsFileExists, upsertAccountRecord, removeAccountRecordById, renameAccountRecordById, readConfig, serialize } from "../config/manager.js";
+import { loadAccounts, loadOpenAIAccounts, loadXaiAccounts, accountsFileExists, upsertAccountRecord, removeAccountRecordById, renameAccountRecordById, readConfig, serialize } from "../config/manager.js";
 import { saveAccounts } from "../proxy/token-refresher.js";
 import { formatExpiry, redactToken } from "../utils/token-extractor.js";
 import { PROXY_PORT } from "../config/paths.js";
 import { createOpenAIAccountRecord } from "../providers/openai/account-record.js";
 import { loginOpenAIWithDeviceCode } from "../providers/openai/device-oauth.js";
+import { importGrokCliAuth } from "../providers/xai/import-auth.js";
+import { loginXaiWithDeviceCode } from "../providers/xai/device-oauth.js";
 import { isValidAccountId } from "../proxy/account-rename.js";
 export function registerAccounts(program) {
     const accounts = program
         .command("accounts")
-        .description("Manage Claude Max accounts in the token pool");
+        .description("Manage Claude Max, ChatGPT/Codex, and Grok accounts");
     // ── accounts list ────────────────────────────────────────────────────────
     accounts
         .command("list")
@@ -24,12 +26,13 @@ export function registerAccounts(program) {
         }
         const stored = loadAccounts();
         const openAIStored = loadOpenAIAccounts();
-        if (stored.length === 0 && openAIStored.length === 0) {
+        const xaiStored = loadXaiAccounts();
+        if (stored.length === 0 && openAIStored.length === 0 && xaiStored.length === 0) {
             console.log(chalk.yellow("accounts.json is empty. Run: cc-router setup"));
             return;
         }
         if (opts.json) {
-            console.log(JSON.stringify(liveStats ?? buildStoredAccountsJson(stored, openAIStored), null, 2));
+            console.log(JSON.stringify(liveStats ?? buildStoredAccountsJson(stored, openAIStored, xaiStored), null, 2));
             return;
         }
         // The count has to describe the rows printed below it. Taking it from
@@ -37,13 +40,15 @@ export function registerAccounts(program) {
         // header claimed four accounts above six rows.
         console.log(chalk.bold(liveStats
             ? `\n  Accounts (${liveStats.length} in the running proxy)\n`
-            : `\n  Accounts (${stored.length + openAIStored.length} configured)\n`));
+            : `\n  Accounts (${stored.length + openAIStored.length + xaiStored.length} configured)\n`));
         if (liveStats) {
             console.log(chalk.green("  ● Proxy is running — showing live stats\n"));
             for (const s of liveStats) {
                 const provider = s.provider === "openai_subscription"
                     ? chalk.cyan("openai".padEnd(9))
-                    : chalk.gray("claude".padEnd(9));
+                    : s.provider === "xai_subscription"
+                        ? chalk.magenta("grok".padEnd(9))
+                        : chalk.gray("claude".padEnd(9));
                 const status = s.healthy
                     ? chalk.green("✓ healthy")
                     : chalk.red("✗ unhealthy");
@@ -63,7 +68,7 @@ export function registerAccounts(program) {
             // here is how an account can be routing live while its refresh token
             // exists nowhere on disk — one restart from having to authenticate it
             // again.
-            const { unpersisted, unloaded } = accountDrift(liveStats.map(s => s.id), [...stored.map(a => a.id), ...openAIStored.map(a => a.id)]);
+            const { unpersisted, unloaded } = accountDrift(liveStats.map(s => s.id), [...stored.map(a => a.id), ...openAIStored.map(a => a.id), ...xaiStored.map(a => a.id)]);
             if (unpersisted.length > 0) {
                 console.log(chalk.red(`\n  ⚠ Not in accounts.json: ${unpersisted.join(", ")}`));
                 console.log(chalk.gray("    These live only in the running proxy. Restarting it loses their\n"
@@ -96,6 +101,15 @@ export function registerAccounts(program) {
                     `  ${redactToken(a.accessToken).padEnd(26)}` +
                     `  expires: ${exp}`);
             }
+            for (const a of xaiStored) {
+                const exp = a.expiresAt > Date.now()
+                    ? chalk.yellow(formatExpiry(a.expiresAt))
+                    : chalk.red("EXPIRED");
+                console.log(`  ${chalk.bold(a.id.padEnd(24))}` +
+                    `  ${chalk.magenta("grok".padEnd(10))}` +
+                    `  ${redactToken(a.accessToken).padEnd(26)}` +
+                    `  expires: ${exp}`);
+            }
         }
         console.log();
     });
@@ -192,6 +206,59 @@ export function registerAccounts(program) {
         console.log(chalk.green(`\n✓ OpenAI account "${record.id}" saved via device login.\n`));
         printAddOutcome(mode);
     });
+    // ── accounts add-grok ────────────────────────────────────────────────────
+    accounts
+        .command("add-grok")
+        .description("Import the Grok CLI login from ~/.grok/auth.json")
+        .action(async () => {
+        const { input } = await import("@inquirer/prompts");
+        let imported;
+        try {
+            imported = importGrokCliAuth();
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.log(chalk.red(`\n✗ ${message}\n`));
+            console.log(chalk.gray("  Or sign in here: cc-router accounts login-grok\n"));
+            process.exit(1);
+        }
+        const id = await input({
+            message: "Grok account ID:",
+            default: imported.id,
+            validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
+        });
+        const record = { ...imported, id };
+        upsertAccountRecord(record);
+        console.log(chalk.green(`\n✓ Grok account "${record.id}" imported from ~/.grok.\n`));
+        printAddOutcome("stored");
+    });
+    // ── accounts login-grok ──────────────────────────────────────────────────
+    accounts
+        .command("login-grok")
+        .description("Sign in to a Grok / xAI account with device code")
+        .action(async () => {
+        const { input } = await import("@inquirer/prompts");
+        const accountId = await input({
+            message: "Grok account ID:",
+            default: loadXaiAccounts().length === 0 ? "grok" : `grok-${loadXaiAccounts().length + 1}`,
+            validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
+        });
+        console.log(chalk.cyan("\nGrok device login"));
+        console.log(chalk.gray("Approve the login in your browser. No local callback server is used.\n"));
+        const record = await loginXaiWithDeviceCode({
+            accountId,
+            onDeviceCode: (code) => {
+                console.log(chalk.bold("1. Open this URL:"));
+                console.log(`   ${chalk.cyan(code.verificationUrl)}`);
+                console.log(chalk.bold("2. Enter this code if the page does not fill it in:"));
+                console.log(`   ${chalk.cyan(code.userCode)}\n`);
+                console.log(chalk.gray("Waiting for authorization..."));
+            },
+        });
+        upsertAccountRecord(record);
+        console.log(chalk.green(`\n✓ Grok account "${record.id}" saved via device login.\n`));
+        printAddOutcome("stored");
+    });
     // ── accounts remove ───────────────────────────────────────────────────────
     accounts
         .command("remove <id>")
@@ -203,7 +270,8 @@ export function registerAccounts(program) {
         }
         const anthropicAccounts = loadAccounts();
         const openAIAccounts = loadOpenAIAccounts();
-        const { ids: existingIds, openAIIds } = mergeAccountInventory(anthropicAccounts.map(a => a.id), openAIAccounts.map(a => a.id), await fetchLiveStats());
+        const xaiAccounts = loadXaiAccounts();
+        const { ids: existingIds, openAIIds } = mergeAccountInventory(anthropicAccounts.map(a => a.id), openAIAccounts.map(a => a.id), await fetchLiveStats(), xaiAccounts.map(a => a.id));
         if (!existingIds.includes(id)) {
             console.log(chalk.red(`✗ Account "${id}" not found.`));
             console.log(chalk.gray(`  Available: ${existingIds.join(", ")}`));
@@ -227,7 +295,7 @@ export function registerAccounts(program) {
             console.log(chalk.red(`✗ Could not remove "${id}": ${message}`));
             process.exit(1);
         }
-        const remaining = loadAccounts().length + loadOpenAIAccounts().length;
+        const remaining = loadAccounts().length + loadOpenAIAccounts().length + loadXaiAccounts().length;
         const providerLabel = isOpenAI ? "OpenAI account" : "Account";
         console.log(chalk.green(`✓ Removed ${providerLabel} "${id}". ${remaining} account(s) remaining.`));
         if (remaining === 0) {
@@ -247,7 +315,7 @@ export function registerAccounts(program) {
             console.log(chalk.gray("  1-64 characters: alphanumeric start, then letters, digits, dots, underscores, or dashes."));
             process.exit(1);
         }
-        const { ids: existingIds } = mergeAccountInventory(loadAccounts().map(a => a.id), loadOpenAIAccounts().map(a => a.id), await fetchLiveStats());
+        const { ids: existingIds } = mergeAccountInventory(loadAccounts().map(a => a.id), loadOpenAIAccounts().map(a => a.id), await fetchLiveStats(), loadXaiAccounts().map(a => a.id));
         if (!existingIds.includes(id)) {
             console.log(chalk.red(`✗ Account "${id}" not found.`));
             console.log(chalk.gray(`  Available: ${existingIds.join(", ")}`));
@@ -292,7 +360,7 @@ function printAddOutcome(mode) {
  * (see `removeAccountRuntimeAware`), so validating an id against disk alone
  * rejected accounts that existed and were perfectly removable.
  */
-export function mergeAccountInventory(storedAnthropicIds, storedOpenAIIds, live) {
+export function mergeAccountInventory(storedAnthropicIds, storedOpenAIIds, live, storedXaiIds = []) {
     const openAIIds = new Set(storedOpenAIIds);
     for (const account of live ?? []) {
         if (account.provider === "openai_subscription")
@@ -302,6 +370,7 @@ export function mergeAccountInventory(storedAnthropicIds, storedOpenAIIds, live)
         ids: [...new Set([
                 ...storedAnthropicIds,
                 ...storedOpenAIIds,
+                ...storedXaiIds,
                 ...(live ?? []).map(account => account.id),
             ])],
         openAIIds,
@@ -323,7 +392,7 @@ export function accountDrift(liveIds, storedIds) {
         unloaded: storedIds.filter(id => !live.has(id)),
     };
 }
-export function buildStoredAccountsJson(anthropicAccounts, openAIAccounts) {
+export function buildStoredAccountsJson(anthropicAccounts, openAIAccounts, xaiAccounts = []) {
     return [
         ...anthropicAccounts.map(a => ({
             id: a.id,
@@ -338,6 +407,12 @@ export function buildStoredAccountsJson(anthropicAccounts, openAIAccounts) {
             enabled: a.enabled !== false,
             expiresAt: a.expiresAt,
         })),
+        ...xaiAccounts.map(a => ({
+            id: a.id,
+            provider: "xai_subscription",
+            enabled: a.enabled !== false,
+            expiresAt: a.expiresAt,
+        })),
     ];
 }
 /** Return false only when no running proxy can be reached; HTTP errors remain authoritative. */
@@ -498,7 +573,10 @@ async function fetchLiveStats() {
         if (!res.ok)
             return null;
         const data = await res.json();
-        return data.accounts;
+        if (!Array.isArray(data.accounts))
+            return null;
+        const { mergeGrokIntoHealth } = await import("../providers/xai/overview.js");
+        return mergeGrokIntoHealth(data).accounts;
     }
     catch {
         return null;

package/dist/cli/cmd-cli-targets.js

@@ -0,0 +1,177 @@
+import chalk from "chalk";
+import { readConfig } from "../config/manager.js";
+import { PROXY_PORT } from "../config/paths.js";
+import { isProxyRunning } from "../daemon/pid.js";
+import { readClaudeRouting, readCodexRouting, setClaudeRouting, setCodexRouting, } from "../utils/cli-routing.js";
+function configuredPort() {
+    return readConfig().runPreferences?.port ?? PROXY_PORT;
+}
+function parsePort(opts) {
+    return opts.port ? parseInt(opts.port, 10) : configuredPort();
+}
+async function warnIfProxyDown(port) {
+    if (readConfig().client?.remoteUrl)
+        return;
+    if (await isProxyRunning(port))
+        return;
+    console.log(chalk.yellow(`  Proxy is not running on port ${port}.`));
+    console.log(chalk.gray("  Start it with: cc-router start"));
+}
+function printRestartHint(cliName) {
+    console.log(chalk.gray(`  Restart any running ${cliName} process to pick this up.`));
+}
+function printClaudeStatus(opts = {}) {
+    const current = readClaudeRouting();
+    if (opts.json) {
+        console.log(JSON.stringify(current, null, 2));
+        return;
+    }
+    if (current.enabled) {
+        console.log(chalk.green("  Claude Code is routing through cc-router"));
+        console.log(`    ANTHROPIC_BASE_URL  = ${chalk.cyan(current.baseUrl)}`);
+        if (current.model)
+            console.log(`    model               = ${current.model}`);
+    }
+    else {
+        console.log(chalk.yellow("  Claude Code is using native Anthropic auth"));
+        console.log(chalk.gray("  Enable with: cc-router cli claude start"));
+    }
+}
+function printCodexStatus(opts = {}) {
+    const current = readCodexRouting();
+    if (opts.json) {
+        console.log(JSON.stringify(current, null, 2));
+        return;
+    }
+    if (current.enabled) {
+        console.log(chalk.green("  Codex CLI is routing through cc-router"));
+        if (current.baseUrl)
+            console.log(`    base_url       = ${chalk.cyan(current.baseUrl)}`);
+        console.log(`    model_provider = ${current.modelProvider ?? "cc-router"}`);
+        if (current.model)
+            console.log(`    model          = ${current.model}`);
+    }
+    else {
+        console.log(chalk.yellow("  Codex CLI is using native OpenAI auth"));
+        console.log(chalk.gray("  Enable with: cc-router cli codex start"));
+    }
+}
+function printBothStatus(opts = {}) {
+    if (opts.json) {
+        console.log(JSON.stringify({
+            claude: readClaudeRouting(),
+            codex: readCodexRouting(),
+        }, null, 2));
+        return;
+    }
+    printClaudeStatus();
+    console.log("");
+    printCodexStatus();
+}
+async function enableClaude(opts) {
+    const port = parsePort(opts);
+    const result = setClaudeRouting(true, { port, model: opts.model });
+    console.log(chalk.green(`✓ Claude Code → ${result.baseUrl ?? "proxy"}`));
+    if (opts.model)
+        console.log(chalk.gray(`  model = ${opts.model}`));
+    printRestartHint("Claude Code");
+    await warnIfProxyDown(port);
+}
+function disableClaude() {
+    const result = setClaudeRouting(false);
+    if (!result.changed) {
+        console.log(chalk.gray("  Claude Code is already using native Anthropic auth."));
+        return;
+    }
+    console.log(chalk.green("✓ Claude Code → native Anthropic auth"));
+    printRestartHint("Claude Code");
+}
+async function enableCodex(opts) {
+    const port = parsePort(opts);
+    const result = setCodexRouting(true, { port, model: opts.model });
+    console.log(chalk.green(`✓ Codex CLI → ${result.baseUrl ?? "proxy"}`));
+    if (result.path)
+        console.log(chalk.gray(`  config = ${result.path}`));
+    if (opts.model)
+        console.log(chalk.gray(`  model  = ${opts.model}`));
+    printRestartHint("Codex");
+    await warnIfProxyDown(port);
+}
+function disableCodex() {
+    const result = setCodexRouting(false);
+    if (!result.changed) {
+        console.log(chalk.gray("  Codex CLI is already using native OpenAI auth."));
+        return;
+    }
+    console.log(chalk.green("✓ Codex CLI → native OpenAI auth"));
+    if (result.path)
+        console.log(chalk.gray(`  removed managed block from ${result.path}`));
+    printRestartHint("Codex");
+}
+function registerTargetCommands(parent, spec) {
+    const startOpts = (command) => command
+        .option("--port <port>", "Proxy port to point at")
+        .option("--model <model>", "Optional default model for this CLI");
+    startOpts(parent
+        .command("start")
+        .description(spec.startDescription)).action(async (opts) => {
+        await spec.enable(opts);
+    });
+    parent
+        .command("stop")
+        .description(spec.stopDescription)
+        .action(() => {
+        spec.disable();
+    });
+    startOpts(parent
+        .command("resume")
+        .description(spec.resumeDescription)).action(async (opts) => {
+        await spec.enable(opts);
+    });
+    parent
+        .command("status", { isDefault: true })
+        .description(spec.statusDescription)
+        .option("--json", "Output current routing state as JSON")
+        .action((opts) => {
+        spec.status(opts);
+    });
+}
+const CLAUDE_SPEC = {
+    startDescription: "Point Claude Code at the running proxy",
+    stopDescription: "Restore Claude Code to native Anthropic auth (proxy keeps running)",
+    resumeDescription: "Re-enable Claude Code routing (same as start)",
+    statusDescription: "Show whether Claude Code is routing through the proxy",
+    enable: enableClaude,
+    disable: disableClaude,
+    status: printClaudeStatus,
+};
+const CODEX_SPEC = {
+    startDescription: "Point Codex CLI at the running proxy",
+    stopDescription: "Restore Codex CLI to native OpenAI auth (proxy keeps running)",
+    resumeDescription: "Re-enable Codex CLI routing (same as start)",
+    statusDescription: "Show whether Codex CLI is routing through the proxy",
+    enable: enableCodex,
+    disable: disableCodex,
+    status: printCodexStatus,
+};
+function registerClaudeAndCodex(parent) {
+    registerTargetCommands(parent.command("claude").description("Claude Code routing"), CLAUDE_SPEC);
+    registerTargetCommands(parent.command("codex").description("Codex CLI routing"), CODEX_SPEC);
+}
+export function registerCliTargets(program) {
+    const cli = program
+        .command("cli")
+        .description("Enable or disable Claude Code / Codex routing without stopping the proxy");
+    cli
+        .command("status", { isDefault: true })
+        .description("Show routing state for Claude Code and Codex CLI")
+        .option("--json", "Output current routing state as JSON")
+        .action((opts) => {
+        printBothStatus(opts);
+    });
+    registerClaudeAndCodex(cli);
+    // Short aliases for on-the-fly use. Hidden so top-level help stays
+    // `start`/`stop` = proxy and `cli` = per-CLI routing.
+    registerTargetCommands(program.command("claude", { hidden: true }).description("Alias of cc-router cli claude"), CLAUDE_SPEC);
+    registerTargetCommands(program.command("codex", { hidden: true }).description("Alias of cc-router cli codex"), CODEX_SPEC);
+}

package/dist/cli/cmd-client.js

@@ -3,7 +3,7 @@ import { existsSync } from "fs";
 import { input, confirm } from "@inquirer/prompts";
 import { readConfig, writeConfig } from "../config/manager.js";
 import { writeClaudeSettings, removeClaudeSettings, readClaudeProxySettings } from "../utils/claude-config.js";
-import { codexBaseUrlFromRouterUrl, writeCodexRouterConfigFromClient } from "../utils/codex-config.js";
+import { codexBaseUrlFromRouterUrl, writeCodexRouterConfigFromClient, removeCodexRouterConfig } from "../utils/codex-config.js";
 import { isMacos, isWindows } from "../utils/platform.js";
 import { checkMitmproxyInstalled, isCaCertInstalled, generateCaCert, installCaCert, writeAddonScript, startInterceptor, stopInterceptor, isInterceptorRunning, getProcessName, getNetworkExtensionStatus, openNetworkExtensionSettings, installInterceptorService, uninstallInterceptorService, isInterceptorServiceInstalled, removeCaCert, } from "../interceptor/mitmproxy-manager.js";
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -230,11 +230,12 @@ export function registerClient(program) {
             }
         }
         removeClaudeSettings();
+        removeCodexRouterConfig();
         const current = readConfig();
         delete current.client;
         writeConfig(current);
         console.log(chalk.green("\n✓ Disconnected from CC-Router"));
-        console.log(chalk.gray("  Claude Code will use direct Anthropic connection on next restart.\n"));
+        console.log(chalk.gray("  Claude Code and Codex CLI will use their native auth on next restart.\n"));
     });
     // ── cc-router client status ─────────────────────────────────────────────────
     client

package/dist/cli/cmd-configure.js

@@ -1,6 +1,6 @@
 import chalk from "chalk";
 import { writeClaudeSettings, removeClaudeSettings, readClaudeProxySettings } from "../utils/claude-config.js";
-import { writeCodexRouterConfig } from "../utils/codex-config.js";
+import { writeCodexRouterConfig, removeCodexRouterConfig } from "../utils/codex-config.js";
 import { readConfig, writeConfig, generateProxySecret } from "../config/manager.js";
 import { PROXY_PORT, CLAUDE_SETTINGS_PATH } from "../config/paths.js";
 import { buildModelRoutingUpdate } from "../protocol/model-routing-config.js";
@@ -9,7 +9,7 @@ export function registerConfigure(program) {
         .command("configure")
         .description("Configure Claude Code or Codex to point to the proxy")
         .argument("[target]", "Optional target to configure: codex, models")
-        .option("--remove", "Remove cc-router settings from ~/.claude/settings.json")
+        .option("--remove", "Remove cc-router settings from Claude Code or Codex")
         .option("--port <port>", "Proxy port to configure", String(PROXY_PORT))
         .option("--model <model>", "Default model for the configured target")
         .option("--claude-model <model>", "Default Claude/Anthropic model for router aliases")
@@ -22,10 +22,23 @@ export function registerConfigure(program) {
         .option("--disable-auto-update", "Disable automatic updates for the proxy")
         .action((target, opts) => {
         if (target === "codex") {
+            if (opts.remove) {
+                const result = removeCodexRouterConfig();
+                if (result.removed) {
+                    console.log(chalk.green(`✓ Removed cc-router settings from ${result.path}`));
+                    console.log(chalk.gray("  Codex CLI will use its native OpenAI auth on next launch."));
+                }
+                else {
+                    console.log(chalk.gray(`  No cc-router block in ${result.path}`));
+                }
+                return;
+            }
             const port = parseInt(opts.port, 10);
+            // Local routing has no auth in front of the proxy, so no env_key is
+            // written — Codex would otherwise hard-abort on startup if that env
+            // var isn't set.
             const result = writeCodexRouterConfig({
                 baseUrl: `http://localhost:${port}/v1`,
-                tokenEnvKey: "CC_ROUTER_TOKEN",
                 defaultModel: opts.model,
             });
             console.log(chalk.green(`✓ Updated ${result.path}`));
@@ -34,7 +47,8 @@ export function registerConfigure(program) {
                 console.log(chalk.gray(`    model          = ${opts.model}`));
             console.log(chalk.gray("    model_provider = cc-router"));
             console.log(chalk.gray(`    base_url       = http://localhost:${port}/v1`));
-            console.log(chalk.gray("    env_key        = CC_ROUTER_TOKEN"));
+            if (result.tokenEnvKey)
+                console.log(chalk.gray(`    env_key        = ${result.tokenEnvKey}`));
             return;
         }
         if (target === "models") {

package/dist/cli/cmd-status.js

@@ -52,7 +52,10 @@ async function jsonOutput(port) {
             console.error(chalk.red(`Proxy returned HTTP ${res.status}`));
             process.exit(1);
         }
-        console.log(JSON.stringify(await res.json(), null, 2));
+        const { mergeGrokIntoHealth, loadGrokHealthSnapshotsWithSubscription } = await import("../providers/xai/overview.js");
+        const health = await res.json();
+        const grokSnapshots = await loadGrokHealthSnapshotsWithSubscription();
+        console.log(JSON.stringify(mergeGrokIntoHealth(health, grokSnapshots), null, 2));
     }
     catch {
         console.error(chalk.red(`Cannot connect to proxy at ${healthUrl}`));

package/dist/cli/cmd-stop.js

@@ -1,6 +1,7 @@
 import { confirm } from "@inquirer/prompts";
 import chalk from "chalk";
 import { removeClaudeSettings, readClaudeProxySettings } from "../utils/claude-config.js";
+import { removeCodexRouterConfig, readCodexRouterConfig } from "../utils/codex-config.js";
 import { PROXY_PORT } from "../config/paths.js";
 import { stopDaemon } from "../daemon/launcher.js";
 import { isProxyRunning } from "../daemon/pid.js";
@@ -86,6 +87,23 @@ async function stopProxy(opts) {
             anythingDone = true;
         }
     }
+    // 4. Codex CLI config cleanup
+    const codex = readCodexRouterConfig();
+    if (codex.configured) {
+        let removeCodex = opts.full ?? false;
+        if (!opts.full) {
+            removeCodex = await confirm({
+                message: "Remove proxy settings from Codex CLI? (Codex will use native OpenAI auth)",
+                default: false,
+            });
+        }
+        if (removeCodex) {
+            removeCodexRouterConfig();
+            console.log(chalk.green(`✓ Removed proxy settings from ${codex.path}`));
+            console.log(chalk.gray("  Codex CLI will use its native OpenAI authentication on next launch."));
+            anythingDone = true;
+        }
+    }
     printDone(anythingDone);
 }
 function printDone(anythingDone) {

package/dist/cli/index.js

@@ -12,12 +12,12 @@ import { registerClient } from "./cmd-client.js";
 import { registerTelemetry } from "./cmd-telemetry.js";
 import { registerLogs } from "./cmd-logs.js";
 import { registerModels } from "./cmd-models.js";
+import { registerCliTargets } from "./cmd-cli-targets.js";
 import { getCurrentVersion, checkForUpdate, printUpdateBanner } from "../utils/self-update.js";
 const program = new Command();
 program
     .name("cc-router")
-    .description("Round-robin proxy for Claude Max OAuth tokens.\n" +
-    "Distributes Claude Code requests across multiple Claude Max accounts.")
+    .description("Round-robin proxy for Claude Max and ChatGPT/Codex subscriptions, with a Grok CLI overview.")
     .version(getCurrentVersion())
     .addHelpText("after", `
 Examples:
@@ -29,10 +29,16 @@ Examples:
   $ cc-router status             # Live dashboard with account stats
   $ cc-router models list        # List dynamically discovered provider models
   $ cc-router logs               # View proxy logs (background mode)
-  $ cc-router accounts list      # Show all configured accounts
+  $ cc-router accounts list      # Show Claude, ChatGPT, and Grok accounts
+  $ cc-router accounts add-grok  # Import the Grok CLI login
+  $ cc-router accounts login-grok# Sign in to Grok with device code
   $ cc-router revert             # Restore Claude Code to normal (remove all proxy config)
   $ cc-router docker up          # Full stack: cc-router + LiteLLM in Docker
   $ cc-router client connect <url>   # Route Claude Code through a remote CC-Router
+  $ cc-router cli claude stop        # Point Claude Code at native auth (proxy stays up)
+  $ cc-router cli claude resume      # Point Claude Code back at the running proxy
+  $ cc-router cli codex start        # Point Codex CLI at the running proxy
+  $ cc-router cli                    # Show Claude Code + Codex routing state
 `);
 registerSetup(program);
 registerStart(program);
@@ -42,6 +48,7 @@ registerStatus(program);
 registerModels(program);
 registerAccounts(program);
 registerConfigure(program);
+registerCliTargets(program);
 registerDocker(program);
 registerUpdate(program);
 registerClient(program);