@workweave/router 0.2.2 → 0.2.3

package/install.sh

@@ -34,7 +34,7 @@
 # Usage:
 #   npx @workweave/router                                  # interactive picker (Claude Code, Codex, opencode)
 #   npx @workweave/router --claude                         # skip the picker, target Claude Code
-#   npx @workweave/router --codex                          # skip the picker, target the OpenAI Codex CLI
+#   npx @workweave/router --codex                          # skip the picker, target Codex
 #   npx @workweave/router --opencode                       # skip the picker, target opencode
 #   npx @workweave/router --pi                              # skip the picker, target pi
 #   npx @workweave/router --scope project                  # commit-with-team install
@@ -533,13 +533,20 @@ TOML
   chmod 600 "$config_file"
 }
 
-# write_opencode_config merges a managed `provider.weave` entry into opencode's
-# opencode.json (anthropic-compatible — the router speaks the Anthropic
-# Messages API natively, so opencode's bundled @ai-sdk/anthropic provider
-# works unmodified). Re-running rewrites the block in-place via jq; uninstall
-# strips it the same way. We also set `model` at the top level so a fresh
-# `opencode` invocation picks the router by default; if the user has set
-# their own model already, we leave it alone.
+# write_opencode_config merges TWO managed providers into opencode's
+# opencode.json plus the bundled Codex-subscription plugin:
+#   - provider.weave        : Anthropic-shaped (@ai-sdk/anthropic) — the router
+#                             speaks the Anthropic Messages API natively, so the
+#                             bundled provider works unmodified. The default.
+#   - provider.weave-codex  : OpenAI-shaped (@ai-sdk/openai, Responses wire) —
+#                             lets a caller's own ChatGPT (Codex) subscription
+#                             pay for their opencode turns. Dormant until the
+#                             user runs `opencode auth login` → ChatGPT and the
+#                             weave-codex plugin's loader injects the bearer.
+# The plugin (src bundled at $script_dir/opencode-weave/src/index.ts) is dropped
+# into $opencode_dir/.weave/ and registered via opencode.json's `plugin` array
+# by absolute path — scope-independent (no reliance on an auto-load dir).
+# Re-running rewrites both blocks in-place via jq; uninstall strips them.
 #
 # Usage: write_opencode_config <config_file_path> <base_url> <api_key> [user_email] [user_name]
 write_opencode_config() {
@@ -601,24 +608,101 @@ write_opencode_config() {
     }
   ')"
 
+  # The OpenAI-shaped Codex-subscription provider. Reuses the same X-Weave-*
+  # header triplet (router key + identity) — the plugin's loader adds only the
+  # dynamic subscription Authorization + ChatGPT-Account-Id on top. baseURL
+  # KEEPS /v1: opencode's @ai-sdk/openai provider appends /responses, yielding
+  # the router's /v1/responses Codex passthrough. apiKey is the router key as a
+  # parse-time placeholder (the loader overrides it once a subscription is
+  # linked), mirroring the weave block above.
+  local codex_block
+  codex_block="$(jq -n \
+    --arg url "$block_url/v1" \
+    --arg key "$block_key" \
+    --argjson headers "$headers_json" '
+    {
+      npm: "@ai-sdk/openai",
+      name: "Weave Router (Codex subscription)",
+      options: { apiKey: $key, baseURL: $url, headers: $headers },
+      models: {
+        "gpt-5.5": { name: "GPT-5.5 — Codex subscription (via Weave Router)" },
+        "gpt-5.4": { name: "GPT-5.4 — Codex subscription (via Weave Router)" }
+      }
+    }
+  ')"
+
+  # Drop the Codex-subscription plugin next to the config and capture the
+  # absolute path we'll register in opencode.json's `plugin` array (so it loads
+  # regardless of scope). $config_file's dir is the already-created
+  # opencode_dir, so the `cd … && pwd` canonicalization is safe — uninstall.sh
+  # must canonicalize identically so the array entry matches on removal.
+  #
+  # Only register the path when the bundled source is actually present and
+  # copied: registering a path with no file on disk makes opencode fail to load
+  # a missing plugin. The plugin holds no secrets (router key lives in the
+  # config; ChatGPT tokens live in opencode's own auth store), so 644 is fine.
+  # Source is bundled alongside install.sh by the npm prepack
+  # (scripts/copy-installer.js), same as commands/ + pi-router/.
+  local plugin_dir plugin_spec plugin_src plugin_arg=""
+  plugin_dir="$(cd "$(dirname "$config_file")" && pwd)/.weave"
+  plugin_spec="$plugin_dir/opencode-weave.ts"
+  plugin_src="$script_dir/opencode-weave/src/index.ts"
+  if [ -f "$plugin_src" ]; then
+    mkdir -p "$plugin_dir"
+    cp "$plugin_src" "$plugin_spec"
+    chmod 644 "$plugin_spec"
+    plugin_arg="$plugin_spec"
+  else
+    warn "opencode Codex plugin source not found at $plugin_src — skipping the weave-codex plugin registration. (Use a packaged 'npx @workweave/router' install.)"
+  fi
+
   # Merge into any existing opencode.json. We always overwrite provider.weave
-  # so re-install reflects the latest key/identity, but we leave the rest of
-  # the file (other providers, mcp, agent settings) untouched. Top-level
-  # `model` is only set when the user hasn't already picked one.
+  # so re-install reflects the latest key/identity, but we leave the rest of the
+  # file (other providers, mcp, agent settings) untouched. Top-level `model` is
+  # only set when the user hasn't already picked one.
+  #
+  # The weave-codex provider AND its plugin entry are written together only when
+  # the bundled plugin was present and copied ($plugin non-empty). Codex
+  # subscription auth depends on that plugin, so registering the provider
+  # without it (e.g. the `curl | sh` path, which carries no plugin source)
+  # would leave a non-working provider — instead we omit it (and strip any
+  # stale one from a prior install).
   local merged
   if [ -f "$config_file" ]; then
-    merged="$(jq --argjson block "$block" '
+    merged="$(jq \
+      --argjson block "$block" \
+      --argjson codex "$codex_block" \
+      --arg plugin "$plugin_arg" \
+      --arg pluginspec "$plugin_spec" '
       .provider = ((.provider // {}) | .weave = $block)
+      | (if $plugin != "" then .provider["weave-codex"] = $codex else .provider |= del(."weave-codex") end)
+      # Register the managed plugin path when we installed it; otherwise strip a
+      # stale entry left by a prior install (the provider was just removed, so a
+      # lingering plugin reference would be dead weight).
+      | (if $plugin != ""
+           then .plugin = ((.plugin // []) | if index($plugin) then . else . + [$plugin] end)
+           else (if (.plugin | type) == "array"
+                   then (.plugin -= [$pluginspec]) | (if (.plugin | length) == 0 then del(.plugin) else . end)
+                   else . end)
+         end)
       | (if (.model // "") == "" then .model = "weave/claude-sonnet-4-6" else . end)
+      # If we just stripped weave-codex (plugin-less re-install) but the default
+      # model still points at it, reset to the Anthropic weave model so opencode
+      # does not boot with a model whose provider no longer exists.
+      | (if $plugin == "" and (.model // "" | tostring | startswith("weave-codex/")) then .model = "weave/claude-sonnet-4-6" else . end)
       | (.["$schema"] //= "https://opencode.ai/config.json")
     ' "$config_file")"
   else
-    merged="$(jq -n --argjson block "$block" '
+    merged="$(jq -n \
+      --argjson block "$block" \
+      --argjson codex "$codex_block" \
+      --arg plugin "$plugin_arg" '
       {
         "$schema": "https://opencode.ai/config.json",
         model: "weave/claude-sonnet-4-6",
         provider: { weave: $block }
       }
+      | (if $plugin != "" then .provider["weave-codex"] = $codex | .plugin = [$plugin] else . end)
     ')"
   fi
   printf '%s\n' "$merged" >"$config_file"
@@ -800,11 +884,11 @@ for arg in "$@"; do
     # also gives us a chance to fail closed on 404 HTML pages before
     # handing the content to bash.
     if ! uninstall_body="$(curl -fsSL --max-time 30 "$url" 2>/dev/null)"; then
-      err "failed to fetch uninstall.sh from $url"
+      err "Failed to fetch uninstall.sh from $url."
       exit 1
     fi
     if [ -z "$uninstall_body" ] || [ "${uninstall_body:0:2}" != "#!" ]; then
-      err "fetched content from $url doesn't look like a bash script"
+      err "Fetched content from $url doesn't look like a bash script."
       exit 1
     fi
     exec bash -c "$uninstall_body" weave-uninstall "${cleaned_args[@]+"${cleaned_args[@]}"}"
@@ -817,12 +901,12 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --scope)
       scope="${2:-}"; shift 2
-      [ "$scope" = "user" ] || [ "$scope" = "project" ] || { err "--scope must be 'user' or 'project'"; exit 2; }
+      [ "$scope" = "user" ] || [ "$scope" = "project" ] || { err "--scope must be 'user' or 'project'."; exit 2; }
       scope_explicit="true"
       ;;
     --base-url)
       base_url="${2:-}"; shift 2
-      [ -n "$base_url" ] || { err "--base-url requires a value"; exit 2; }
+      [ -n "$base_url" ] || { err "--base-url requires a value."; exit 2; }
       ;;
     --local)
       # Shorthand for local dev: localhost:8080 (matches `wv mr` / `make dev` default PORT).
@@ -837,7 +921,7 @@ while [ $# -gt 0 ]; do
       ;;
     --dir)
       install_dir="${2:-}"; shift 2
-      [ -n "$install_dir" ] || { err "--dir requires a path"; exit 2; }
+      [ -n "$install_dir" ] || { err "--dir requires a path."; exit 2; }
       ;;
     --codex)
       target="codex"; target_explicit="true"; shift
@@ -863,7 +947,7 @@ while [ $# -gt 0 ]; do
       usage 0
       ;;
     *)
-      err "unknown flag: $1"; usage 2
+      err "Unknown flag: $1."; usage 2
       ;;
   esac
 done
@@ -874,7 +958,7 @@ done
 if [ "$mode" != "install" ]; then
   non_interactive="true"
   if [ "$target_explicit" != "true" ]; then
-    err "'$mode' requires an explicit client: --claude, --codex, or --opencode"
+    err "'$mode' requires an explicit client: --claude, --codex, or --opencode."
     exit 2
   fi
 fi
@@ -883,7 +967,7 @@ fi
 # structural models.json/settings.json merge, reversed by the uninstaller
 # rather than a single env/key line we can park and restore.
 if [ "$mode" != "install" ] && [ "$target" = "pi" ]; then
-  err "toggle verbs (off/on/status) aren't supported for --pi. Use 'npx @workweave/router --uninstall --pi' to remove, or re-run the installer to refresh."
+  err "Toggle verbs (off/on/status) aren't supported for --pi. Use 'npx @workweave/router --uninstall --pi' to remove, or re-run the installer to refresh."
   exit 2
 fi
 
@@ -914,7 +998,7 @@ if [ "$target_explicit" = "false" ] && [ "$non_interactive" = "false" ] && [ -r
     2|codex|x|X)      target="codex" ;;
     3|opencode|o|O)   target="opencode" ;;
     4|pi|p|P)         target="pi" ;;
-    *) err "invalid choice: $target_choice"; exit 2 ;;
+    *) err "Invalid choice: $target_choice."; exit 2 ;;
   esac
 fi
 
@@ -970,7 +1054,7 @@ if [ -z "$install_dir" ] && [ "$scope_explicit" = "false" ] && [ "$non_interacti
   case "${scope_choice:-1}" in
     1|""|user|u|U)    scope="user" ;;
     2|project|p|P)    scope="project" ;;
-    *) err "invalid choice: $scope_choice"; exit 2 ;;
+    *) err "Invalid choice: $scope_choice."; exit 2 ;;
   esac
 
   # For project scope, ask which directory rather than silently assuming CWD.
@@ -987,7 +1071,7 @@ if [ -z "$install_dir" ] && [ "$scope_explicit" = "false" ] && [ "$non_interacti
       "~/"*)  project_dir="$HOME/${project_dir#~/}" ;;
     esac
     if [ ! -d "$project_dir" ]; then
-      err "directory does not exist: $project_dir"
+      err "Directory does not exist: $project_dir."
       exit 1
     fi
     project_dir="$(cd "$project_dir" && pwd)"
@@ -1324,7 +1408,7 @@ toggle_claude() {
                       | (if (.env // {} | length) == 0 then del(.env) else . end)' "$settings_file")"
         printf '%s\n' "$merged" >"$settings_file"
       fi
-      ok "Claude Code is now ${C_BOLD}off${C_RESET} (direct to Anthropic). Restart Claude Code for it to take effect."
+      ok "Claude Code is ${C_BOLD}off${C_RESET} (direct to Anthropic). Restart Claude Code for it to take effect."
       ;;
     on)
       if [ "$parked_present" != "true" ]; then
@@ -1348,7 +1432,7 @@ toggle_claude() {
                             | (if (.env // {} | length) == 0 then del(.env) else . end)' "$local_settings_file")"
               printf '%s\n' "$merged" >"$local_settings_file"
               chmod 600 "$local_settings_file"
-              ok "Claude Code is now ${C_BOLD}on${C_RESET} (routing through the Weave Router). Restart Claude Code for it to take effect."
+              ok "Claude Code is ${C_BOLD}on${C_RESET} (routing through the Weave Router). Restart Claude Code for it to take effect."
             else
               warn "Claude Code is off and the parked router key is missing (its sidecar was deleted). Re-run the installer to restore the router key — leaving the current direct-to-Anthropic setup in place so requests don't fail auth."
             fi
@@ -1387,7 +1471,7 @@ toggle_claude() {
       printf '%s\n' "$merged" >"$active"
       [ "$proj" = "true" ] && chmod 600 "$active"
       rm -f "$parked"
-      ok "Claude Code is now ${C_BOLD}on${C_RESET} (routing through the Weave Router). Restart Claude Code for it to take effect."
+      ok "Claude Code is ${C_BOLD}on${C_RESET} (routing through the Weave Router). Restart Claude Code for it to take effect."
       ;;
   esac
 }
@@ -1425,7 +1509,7 @@ toggle_codex() {
         {print}
       ' "$f" >"$tmp" && mv "$tmp" "$f"
       chmod 600 "$f"
-      ok "Codex is now ${C_BOLD}off${C_RESET} (default provider). Takes effect on your next 'codex' run."
+      ok "Codex is ${C_BOLD}off${C_RESET} (default provider). Takes effect on your next 'codex' run."
       ;;
     on)
       if [ "$state" = "absent" ]; then warn "No managed Weave block in $f. Run the installer to set up Codex."; return 0; fi
@@ -1440,7 +1524,7 @@ toggle_codex() {
         {print}
       ' "$f" >"$tmp" && mv "$tmp" "$f"
       chmod 600 "$f"
-      ok "Codex is now ${C_BOLD}on${C_RESET} (routing through the Weave Router). Takes effect on your next 'codex' run."
+      ok "Codex is ${C_BOLD}on${C_RESET} (routing through the Weave Router). Takes effect on your next 'codex' run."
       ;;
   esac
 }
@@ -1459,7 +1543,9 @@ toggle_opencode() {
     model="$(jq -r '.model // empty' "$f" 2>/dev/null || true)"
     if [ "$(jq -r '((.provider // {}) | has("weave"))' "$f" 2>/dev/null || true)" = "true" ]; then has_weave="true"; fi
   fi
-  case "$model" in weave/*) on="true" ;; esac
+  # Either managed provider counts as router-on: the Anthropic-shaped `weave/…`
+  # default or a caller-selected `weave-codex/…` Codex-subscription model.
+  case "$model" in weave/* | weave-codex/*) on="true" ;; esac
 
   case "$mode" in
     status)
@@ -1482,7 +1568,7 @@ toggle_opencode() {
       printf '%s\n' "$merged" >"$f"
       chmod 600 "$f"
       gitignore_add ".weave-parked.json"
-      ok "opencode is now ${C_BOLD}off${C_RESET} — pick a non-Weave model with /models. Takes effect on your next opencode run."
+      ok "opencode is ${C_BOLD}off${C_RESET} — pick a non-Weave model with /models. Takes effect on your next opencode run."
       ;;
     on)
       if [ "$on" = "true" ]; then ok "opencode is already on — nothing to do."; return 0; fi
@@ -1502,11 +1588,22 @@ toggle_opencode() {
           | "weave/" + .
         ' "$f" 2>/dev/null || echo "weave/claude-sonnet-4-6")"
       fi
+      # Never restore a weave-codex model whose provider is no longer
+      # registered (e.g. a plugin-less re-install stripped it after `off`
+      # parked a weave-codex/… model). Fall back to the Anthropic weave default
+      # so `on` can't leave opencode pointing at a missing provider.
+      case "$restore_model" in
+        weave-codex/*)
+          if [ "$(jq -r '((.provider // {}) | has("weave-codex"))' "$f" 2>/dev/null || true)" != "true" ]; then
+            restore_model="weave/claude-sonnet-4-6"
+          fi
+          ;;
+      esac
       merged="$(jq --arg m "$restore_model" '.model = $m' "$f")"
       printf '%s\n' "$merged" >"$f"
       chmod 600 "$f"
       rm -f "$parked"
-      ok "opencode is now ${C_BOLD}on${C_RESET} (default model $restore_model via the Weave Router). Takes effect on your next opencode run."
+      ok "opencode is ${C_BOLD}on${C_RESET} (default model $restore_model via the Weave Router). Takes effect on your next opencode run."
       ;;
   esac
 }
@@ -1535,19 +1632,19 @@ if [ -n "${WEAVE_ROUTER_KEY:-}" ]; then
     # `set -e` would abort on read returning 1). If /dev/tty isn't available
     # (e.g. CI without a controlling terminal) the user must use --non-interactive.
     if [ ! -r /dev/tty ]; then
-      err "no controlling terminal — set WEAVE_ROUTER_KEY and re-run with --non-interactive."
+      err "No controlling terminal — set WEAVE_ROUTER_KEY and re-run with --non-interactive."
       exit 1
     fi
     # _spin_cleanup (installed globally above) already restores stty echo on
     # any exit path, so we don't need a separate trap here — that would
     # overwrite the spinner cleanup and leak the cursor / child PID on Ctrl-C.
     printf "%sGet your Weave Router API key at %s%s\n" "$C_BRAND" "$base_url" "$C_RESET"
-    printf "%sPaste your key here (rk_...):%s " "$C_DIM" "$C_RESET"
+    printf "%sPaste your key here (rk_…):%s " "$C_DIM" "$C_RESET"
     stty -echo </dev/tty 2>/dev/null || true
     read -r api_key </dev/tty
     stty echo </dev/tty 2>/dev/null || true
     printf "\n"
-    [ -n "$api_key" ] || { err "no key provided"; exit 1; }
+    [ -n "$api_key" ] || { err "No key provided."; exit 1; }
   fi
 
 # ---------- identity (user email + name) ----------
@@ -1716,18 +1813,20 @@ if [ "$target" = "opencode" ]; then
 
   # Project scope: the per-teammate config carries the router key, so it
   # stays out of git. Same reasoning as the Codex path — base URL is shared,
-  # but the key is per-person.
+  # but the key is per-person. The .weave/ plugin dir is per-person too (the
+  # config references it by absolute path), so ignore it alongside.
   if [ "$scope" = "project" ] && [ -z "$install_dir" ] && [ -n "${git_root:-}" ]; then
     gitignore="$git_root/.gitignore"
     refuse_if_symlink "$gitignore"
     for entry in \
-      "opencode.json"
+      "opencode.json" \
+      ".weave/"
     do
       if [ ! -f "$gitignore" ] || ! grep -qxF "$entry" "$gitignore"; then
         printf '%s\n' "$entry" >>"$gitignore"
       fi
     done
-    ok "Updated $gitignore (ignored opencode.json)"
+    ok "Updated $gitignore (ignored opencode.json, .weave/)"
   fi
 
   # Post-install verification: same probes the Claude/Codex paths run.
@@ -1750,6 +1849,14 @@ if [ "$target" = "opencode" ]; then
   printf "\n"
   printf "%s✓%s %s%sWeave Router installed for opencode.%s\n" \
     "$C_GREEN" "$C_RESET" "$C_BOLD" "$C_BRAND" "$C_RESET"
+  # Surface the optional Codex-subscription path only when this run actually
+  # registered the weave-codex provider. Gate on the provider's presence in the
+  # written config (authoritative) rather than a plugin file on disk — a
+  # leftover plugin from a prior install can outlive a plugin-less re-install
+  # that stripped the provider, which would make these instructions misleading.
+  if jq -e '(.provider // {}) | has("weave-codex")' "$opencode_config_file" >/dev/null 2>&1; then
+    info "To pay for opencode turns with your own ChatGPT (Codex) subscription: run ${C_BOLD}opencode auth login${C_RESET} → ${C_BOLD}ChatGPT Pro/Plus${C_RESET}, then pick a ${C_BOLD}weave-codex${C_RESET} model."
+  fi
   if [ -n "$install_dir" ]; then
     # --dir installs land outside opencode's discovery roots, so the caller
     # has to point opencode at the file explicitly.
@@ -1819,7 +1926,7 @@ if [ "$target" = "pi" ]; then
   # Billing note: pi normally draws on a Claude subscription (OAuth); routing
   # through the router switches to per-token billing on the router deployment
   # key (or BYOK). Surface it at install so the change isn't a surprise.
-  info "pi now bills per token on the Weave Router key, not your Claude subscription."
+  info "pi bills per token on the Weave Router key, not your Claude subscription."
   if [ "$scope" = "project" ] || [ -n "$install_dir" ]; then
     info "Run pi with PI_CODING_AGENT_DIR=$pi_dir pi so it picks up this config."
   fi
@@ -1832,7 +1939,7 @@ fi
 cat > "$statusline_file" << 'STATUSLINE_EOF'
 #!/usr/bin/env bash
 #
-# Claude Code statusline for the Weave router. CC pipes a JSON blob on stdin
+# Claude Code statusline for the Weave Router. CC pipes a JSON blob on stdin
 # whose `transcript_path` points at the JSONL log of the current session and
 # whose `model.display_name` is the user's CC-side model selection. The
 # router rewrites each request's `model` field before forwarding, so
@@ -1998,9 +2105,11 @@ prices='{
     "gpt-5.5-nano":                     0.00015,
     "gpt-5.5-pro":                      0.03,
     "minimax/minimax-m2.7":             0.0003,
+    "minimax/minimax-m3":               0.0003,
     "mistralai/mistral-small-2603":     0.0002,
     "moonshotai/kimi-k2.5":             0.0006,
     "moonshotai/kimi-k2.6":             0.00095,
+    "moonshotai/kimi-k2.7":             0.00095,
     "qwen/qwen3-235b-a22b-2507":        0.0002266,
     "qwen/qwen3-30b-a3b-instruct-2507": 0.00015,
     "qwen/qwen3-coder":                 0.0009,
@@ -2008,6 +2117,7 @@ prices='{
     "qwen/qwen3-next-80b-a3b-instruct": 0.00015,
     "qwen/qwen3.5-flash-02-23":         0.00005,
     "qwen/qwen3.6-35b-a3b":             0.00015,
+    "qwen/qwen3.7-plus":                0.0004,
     "xiaomi/mimo-v2.5-pro":             0.001,
     "z-ai/glm-5":                       0.0006,
     "z-ai/glm-5.1":                     0.00105
@@ -2050,9 +2160,11 @@ prices='{
     "gpt-5.5-nano":                     0.0006,
     "gpt-5.5-pro":                      0.12,
     "minimax/minimax-m2.7":             0.0012,
+    "minimax/minimax-m3":               0.0012,
     "mistralai/mistral-small-2603":     0.0006,
     "moonshotai/kimi-k2.5":             0.003,
     "moonshotai/kimi-k2.6":             0.004,
+    "moonshotai/kimi-k2.7":             0.004,
     "qwen/qwen3-235b-a22b-2507":        0.0009064,
     "qwen/qwen3-30b-a3b-instruct-2507": 0.0006,
     "qwen/qwen3-coder":                 0.0027,
@@ -2060,6 +2172,7 @@ prices='{
     "qwen/qwen3-next-80b-a3b-instruct": 0.0012,
     "qwen/qwen3.5-flash-02-23":         0.00015,
     "qwen/qwen3.6-35b-a3b":             0.00095,
+    "qwen/qwen3.7-plus":                0.0016,
     "xiaomi/mimo-v2.5-pro":             0.003,
     "z-ai/glm-5":                       0.00208,
     "z-ai/glm-5.1":                     0.0035
@@ -2068,6 +2181,8 @@ prices='{
 # END_GENERATED_PRICES
 
 routed=""
+forced="false"
+forced_model=""
 session_savings=""
 tot_in=0
 tot_out=0
@@ -2105,6 +2220,36 @@ if [[ -n "$transcript_path" && -f "$transcript_path" ]]; then
     routed="$(normalize_model "$routed")"
   fi
 
+  # Detect an active /force-model pin from the router's synthetic ack turns —
+  # the only turns stamped message.model == "weave-router". The router emits
+  # one whenever a pin changes state:
+  #   * /force-model              → "force-model applied: <model> (<provider>) …"
+  #   * /unforce-model            → "force-model cleared …"
+  #   * loop / no-progress break  → "… clearing the session pin …" (expires the
+  #                                  pin, including a user-forced one)
+  #   * unrecognized model        → "… isn't a recognized model · keeping
+  #                                  automatic routing" — a NO-OP: the prior
+  #                                  pin, if any, is left untouched
+  # These persist on disk (the ingress stripper only scrubs them from upstream
+  # requests). Classify each weave-router turn newest-first, skip the no-op
+  # "rejected" acks, and let the latest real state change decide: an "applied"
+  # marker means the session is pinned (and names the model); anything else
+  # (cleared / loop-break / no-progress) means automatic routing has resumed.
+  # Restricting to weave-router turns keeps a normal reply that merely quotes
+  # these phrases from flipping the tag. (A silent server-side TTL expiry emits
+  # no turn and so can't be reflected here — the pin TTL outlives a session.)
+  force_state="$("${reverse[@]}" "$transcript_path" 2>/dev/null \
+    | jq -r 'select(.type=="assistant" and .message.model=="weave-router")
+        | ([.message.content[]? | select(.type? == "text") | .text] | join(" ") | gsub("[\n\r]"; " ")) as $t
+        | if ($t | test("force-model applied:")) then "APPLIED " + ($t | capture("force-model applied: (?<m>[^ ]+)").m)
+          elif ($t | test("isn.t a recognized model")) then "REJECTED"
+          else "CLEARED" end' 2>/dev/null \
+    | grep -m1 -v '^REJECTED$' || true)"
+  if [[ "$force_state" == APPLIED\ * ]]; then
+    forced="true"
+    forced_model="${force_state#APPLIED }"
+  fi
+
   # Compute a session running total: savings across every assistant turn
   # whose marker reports a requested ≠ routed swap, plus cumulative token
   # counts across every assistant turn (rerouted or not — total work the
@@ -2207,7 +2352,14 @@ if [[ "$tot_in" -gt 0 || "$tot_out" -gt 0 || "$tot_cache_read" -gt 0 || "$tot_ca
   fi
 fi
 
-if [[ "$routed" == "failure" ]]; then
+if [[ "$forced" == "true" ]]; then
+  # Session is pinned via /force-model. The "← selection · saved $X" clause
+  # describes automatic routing and would be misleading on a manual pin, so
+  # show the pinned model with a [forced] tag instead. forced_model comes from
+  # the marker; fall back to the routed/selected id if parsing came up empty.
+  forced_display="${forced_model:-${routed:-$selected_display}}"
+  printf '%s — %s [forced]%s' "$brand" "$forced_display" "$tokens_clause"
+elif [[ "$routed" == "failure" ]]; then
   # Latest turn was a CC-synthesized error stub — don't claim a routing
   # swap or compute savings against a non-model.
   printf '%s — %s%s' "$brand" "$routed" "$tokens_clause"

package/opencode-weave/README.md

@@ -0,0 +1,59 @@
+# opencode Weave Codex plugin
+
+Lets a caller's own **ChatGPT (Codex) subscription** pay for their **opencode**
+turns, routed through the Weave Router. Bundled into `@workweave/router`; the
+installer (`--codex` / `--opencode`) drops `src/index.ts` into the user's
+opencode plugins dir and writes a matching `weave-codex` provider block into
+`opencode.json`.
+
+## Why a plugin (config alone can't do it)
+
+opencode removed built-in subscription auth in 1.3.0 and binds OAuth to its own
+first-party providers — its bundled `openai/codex.ts` plugin hardcodes the
+upstream to `chatgpt.com` and binds provider id `openai`, so a custom router
+provider can't reuse it. And a subscription needs the caller's OAuth token in
+`Authorization`, which expires hourly — a static `options.headers` string can't
+refresh it.
+
+This plugin re-implements the same ChatGPT OAuth + refresh against a **custom**
+provider id (`weave-codex`) and, crucially, **leaves the request URL on the
+Weave Router** instead of rewriting it to `chatgpt.com`.
+
+## Wire shape it produces
+
+Matches the router's `/v1/responses` Codex passthrough:
+
+| | |
+|---|---|
+| `POST {router}/v1/responses` | Responses wire format (opencode's default for an `@ai-sdk/openai` provider) |
+| `Authorization: Bearer <ChatGPT JWT>` | the caller's subscription, refreshed on expiry |
+| `ChatGPT-Account-Id: <id>` | paired account id (required by the Codex backend) |
+| `X-Weave-Router-Key: rk_…` | from `opencode.json` `options.headers` — the router authenticates off this, leaving `Authorization` free for the JWT |
+| `originator`, `session-id` | from the plugin's `chat.headers` hook (Codex backend session continuity) |
+
+The router detects the inbound Codex bearer and serves the turn on the caller's
+own plan at the subscription fee.
+
+## Division of responsibility
+
+- **Installer** writes the router key + identity headers (`X-Weave-Router-Key`,
+  `X-App`, `X-Weave-User-Email`) into `opencode.json` `options.headers`.
+- **This plugin** manages only the dynamic, secret, refreshable subscription
+  credential (the `Authorization` bearer + `ChatGPT-Account-Id`) via the auth
+  `loader`, and the login flow via auth `methods` (browser PKCE + headless
+  device code). Tokens are stored in opencode's own auth store under the
+  `weave-codex` provider id.
+
+## Env overrides
+
+- `WEAVE_CODEX_OAUTH_ISSUER` — override the OpenAI auth issuer (self-hosted
+  OpenAI auth proxies; also used by the capture tests).
+
+## Verification
+
+Capture-tested end-to-end against a local server standing in for the router
+(opencode 1.17.9, real ChatGPT login): the inject path forwards the real JWT +
+account-id in Responses format to `/v1/responses`, and the refresh path detects
+an expired token, refreshes against the issuer, rotates + persists the tokens,
+and injects the refreshed bearer. Typechecks under `strict` against
+`@opencode-ai/plugin`.

package/opencode-weave/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@workweave/router-opencode-extension",
+  "private": true,
+  "type": "module",
+  "description": "The opencode Codex-subscription auth plugin bundled into @workweave/router. NOT published separately: src/ is copied into the @workweave/router package at prepack and dropped into the user's opencode plugins dir by install.sh (--codex/--opencode). Lets a caller's own ChatGPT (Codex) subscription pay for their opencode turns, routed through the Weave Router. This manifest just marks the sources as ESM and declares the opencode peer dep for local typecheck.",
+  "peerDependencies": {
+    "@opencode-ai/plugin": "*"
+  }
+}