@workweave/router 0.2.3 → 0.2.4

package/cc-statusline.sh

@@ -181,7 +181,8 @@ prices='{
     "qwen/qwen3.7-plus":                0.0004,
     "xiaomi/mimo-v2.5-pro":             0.001,
     "z-ai/glm-5":                       0.0006,
-    "z-ai/glm-5.1":                     0.00105
+    "z-ai/glm-5.1":                     0.00105,
+    "z-ai/glm-5.2":                     0.0014
   },
   "output": {
     "claude-fable-5":                   0.05,
@@ -236,7 +237,8 @@ prices='{
     "qwen/qwen3.7-plus":                0.0016,
     "xiaomi/mimo-v2.5-pro":             0.003,
     "z-ai/glm-5":                       0.00208,
-    "z-ai/glm-5.1":                     0.0035
+    "z-ai/glm-5.1":                     0.0035,
+    "z-ai/glm-5.2":                     0.0044
   }
 }'
 # END_GENERATED_PRICES

package/install.sh

@@ -533,20 +533,26 @@ TOML
   chmod 600 "$config_file"
 }
 
-# write_opencode_config merges TWO managed providers into opencode's
-# opencode.json plus the bundled Codex-subscription plugin:
-#   - provider.weave        : Anthropic-shaped (@ai-sdk/anthropic) — the router
-#                             speaks the Anthropic Messages API natively, so the
-#                             bundled provider works unmodified. The default.
-#   - provider.weave-codex  : OpenAI-shaped (@ai-sdk/openai, Responses wire) —
-#                             lets a caller's own ChatGPT (Codex) subscription
-#                             pay for their opencode turns. Dormant until the
-#                             user runs `opencode auth login` → ChatGPT and the
-#                             weave-codex plugin's loader injects the bearer.
+# write_opencode_config merges the managed Weave provider(s) into opencode's
+# opencode.json plus the bundled subscription plugin:
+#   - provider.weave        : OpenAI/Responses-shaped (@ai-sdk/openai → /v1/responses).
+#                             The single request provider. The router routes every
+#                             turn across all models the caller's subscriptions +
+#                             Weave key can pay for, and bills the plan matching the
+#                             model it served. The default.
+#   - provider.weave-claude : login-only storage for a Claude (Pro/Max) subscription
+#                             (no models, never serves requests). Written only when
+#                             the bundled plugin is present, since the Claude login
+#                             method lives in the plugin. The `weave` loader reads
+#                             this slot and attaches the Claude sub.
 # The plugin (src bundled at $script_dir/opencode-weave/src/index.ts) is dropped
 # into $opencode_dir/.weave/ and registered via opencode.json's `plugin` array
-# by absolute path — scope-independent (no reliance on an auto-load dir).
-# Re-running rewrites both blocks in-place via jq; uninstall strips them.
+# by absolute path — scope-independent (no reliance on an auto-load dir). It owns
+# both the ChatGPT (on `weave`) and Claude (on `weave-claude`) logins and attaches
+# whichever subscriptions are connected to every request via the router's
+# dedicated X-Weave-*-Subscription headers. Re-running rewrites the blocks
+# in-place via jq (and strips the legacy `weave-codex` provider); uninstall
+# strips them.
 #
 # Usage: write_opencode_config <config_file_path> <base_url> <api_key> [user_email] [user_name]
 write_opencode_config() {
@@ -573,61 +579,52 @@ write_opencode_config() {
 
   # Headline models we surface in opencode's picker. The router re-routes
   # each request anyway, so this list is mostly UX — what shows up when the
-  # user runs /models inside opencode. Keep it short and Anthropic-shaped
-  # so the bundled @ai-sdk/anthropic provider can request them.
+  # user runs /models inside opencode. We list a mix of GPT + Claude so the
+  # picker reflects that the router spans families; whichever model serves the
+  # turn, its matching subscription (if connected) pays.
   #
-  # apiKey is set to the router key as well as planted in headers. opencode's
-  # @ai-sdk/anthropic provider treats apiKey as required at config-parse time
-  # and otherwise falls back to ANTHROPIC_API_KEY from the environment;
-  # without this, a user who's never had an Anthropic key in their shell hits
-  # a startup error before the router ever sees a request. The router itself
-  # ignores the value (auth runs off X-Weave-Router-Key); apiKey here is just
-  # a placeholder that satisfies the SDK's "is auth configured" check.
-  # baseURL KEEPS its /v1 here — do NOT align it with the pi block, which is
-  # root. opencode's @ai-sdk/anthropic (Vercel) appends only /messages to
-  # baseURL (its default is api.anthropic.com/v1), so /v1 yields the correct
-  # /v1/messages. Dropping it would hit /messages and 404. (pi uses the official
-  # @anthropic-ai/sdk, which appends /v1/messages to a root baseURL — opposite
-  # convention.) Verified by install/pi-router/test/opencode_smoke.sh.
+  # npm is @ai-sdk/openai and baseURL KEEPS its /v1 here: opencode's
+  # @ai-sdk/openai provider appends /responses, yielding the router's
+  # /v1/responses surface (the canonical inbound — the router translates to
+  # Anthropic/OSS as it routes, and ships verbatim to the Codex backend for GPT
+  # turns). apiKey is the router key as a parse-time placeholder; the router
+  # authenticates off X-Weave-Router-Key (planted in headers) and the plugin's
+  # loader attaches subscriptions via the dedicated X-Weave-*-Subscription
+  # headers, so the apiKey value is never used upstream.
   local block
   block="$(jq -n \
     --arg url "$block_url/v1" \
     --arg key "$block_key" \
     --argjson headers "$headers_json" '
     {
-      npm: "@ai-sdk/anthropic",
+      npm: "@ai-sdk/openai",
       name: "Weave Router",
       options: { apiKey: $key, baseURL: $url, headers: $headers },
       models: {
-        "claude-fable-5":    { name: "Claude Fable 5 (via Weave Router)" },
-        "claude-opus-4-8":   { name: "Claude Opus 4.8 (via Weave Router)" },
-        "claude-opus-4-7":   { name: "Claude Opus 4.7 (via Weave Router)" },
         "claude-sonnet-4-6": { name: "Claude Sonnet 4.6 (via Weave Router)" },
-        "claude-haiku-4-5":  { name: "Claude Haiku 4.5 (via Weave Router)" }
+        "claude-opus-4-8":   { name: "Claude Opus 4.8 (via Weave Router)" },
+        "claude-haiku-4-5":  { name: "Claude Haiku 4.5 (via Weave Router)" },
+        "gpt-5.5":           { name: "GPT-5.5 (via Weave Router)" },
+        "gpt-5.4":           { name: "GPT-5.4 (via Weave Router)" }
       }
     }
   ')"
 
-  # The OpenAI-shaped Codex-subscription provider. Reuses the same X-Weave-*
-  # header triplet (router key + identity) — the plugin's loader adds only the
-  # dynamic subscription Authorization + ChatGPT-Account-Id on top. baseURL
-  # KEEPS /v1: opencode's @ai-sdk/openai provider appends /responses, yielding
-  # the router's /v1/responses Codex passthrough. apiKey is the router key as a
-  # parse-time placeholder (the loader overrides it once a subscription is
-  # linked), mirroring the weave block above.
-  local codex_block
-  codex_block="$(jq -n \
+  # Login-only storage provider for a Claude (Pro/Max) subscription. It serves
+  # no requests (no models), so its npm/baseURL are inert — opencode just needs
+  # it registered so the plugin's Claude login method has a home and `opencode
+  # auth login` lists it. The `weave` loader reads this slot off disk and
+  # attaches the Claude sub. Reuses the same router key + identity headers.
+  local claude_block
+  claude_block="$(jq -n \
     --arg url "$block_url/v1" \
     --arg key "$block_key" \
     --argjson headers "$headers_json" '
     {
       npm: "@ai-sdk/openai",
-      name: "Weave Router (Codex subscription)",
+      name: "Weave Router — Claude plan",
       options: { apiKey: $key, baseURL: $url, headers: $headers },
-      models: {
-        "gpt-5.5": { name: "GPT-5.5 — Codex subscription (via Weave Router)" },
-        "gpt-5.4": { name: "GPT-5.4 — Codex subscription (via Weave Router)" }
-      }
+      models: {}
     }
   ')"
 
@@ -653,7 +650,7 @@ write_opencode_config() {
     chmod 644 "$plugin_spec"
     plugin_arg="$plugin_spec"
   else
-    warn "opencode Codex plugin source not found at $plugin_src — skipping the weave-codex plugin registration. (Use a packaged 'npx @workweave/router' install.)"
+    warn "opencode subscription plugin source not found at $plugin_src — skipping the Claude login + subscription routing. (Use a packaged 'npx @workweave/router' install.)"
   fi
 
   # Merge into any existing opencode.json. We always overwrite provider.weave
@@ -661,21 +658,23 @@ write_opencode_config() {
   # file (other providers, mcp, agent settings) untouched. Top-level `model` is
   # only set when the user hasn't already picked one.
   #
-  # The weave-codex provider AND its plugin entry are written together only when
-  # the bundled plugin was present and copied ($plugin non-empty). Codex
-  # subscription auth depends on that plugin, so registering the provider
-  # without it (e.g. the `curl | sh` path, which carries no plugin source)
-  # would leave a non-working provider — instead we omit it (and strip any
-  # stale one from a prior install).
+  # The weave-claude login provider AND the plugin entry are written together
+  # only when the bundled plugin was present and copied ($plugin non-empty): the
+  # Claude login method lives in the plugin, so registering the provider without
+  # it (e.g. the `curl | sh` path, which carries no plugin source) would leave a
+  # non-working login — instead we omit it (and strip any stale one). The legacy
+  # `weave-codex` provider is always stripped: the single Responses `weave`
+  # provider supersedes it.
   local merged
   if [ -f "$config_file" ]; then
     merged="$(jq \
       --argjson block "$block" \
-      --argjson codex "$codex_block" \
+      --argjson claude "$claude_block" \
       --arg plugin "$plugin_arg" \
       --arg pluginspec "$plugin_spec" '
       .provider = ((.provider // {}) | .weave = $block)
-      | (if $plugin != "" then .provider["weave-codex"] = $codex else .provider |= del(."weave-codex") end)
+      | (.provider |= del(."weave-codex"))
+      | (if $plugin != "" then .provider["weave-claude"] = $claude else .provider |= del(."weave-claude") end)
       # Register the managed plugin path when we installed it; otherwise strip a
       # stale entry left by a prior install (the provider was just removed, so a
       # lingering plugin reference would be dead weight).
@@ -686,23 +685,24 @@ write_opencode_config() {
                    else . end)
          end)
       | (if (.model // "") == "" then .model = "weave/claude-sonnet-4-6" else . end)
-      # If we just stripped weave-codex (plugin-less re-install) but the default
-      # model still points at it, reset to the Anthropic weave model so opencode
-      # does not boot with a model whose provider no longer exists.
-      | (if $plugin == "" and (.model // "" | tostring | startswith("weave-codex/")) then .model = "weave/claude-sonnet-4-6" else . end)
+      # Reset the default model if it points at a provider we just removed: the
+      # retired weave-codex, or weave-claude on a plugin-less re-install (it has
+      # no models anyway). Otherwise opencode boots with a dangling model.
+      | (if (.model // "" | tostring | startswith("weave-codex/")) then .model = "weave/claude-sonnet-4-6" else . end)
+      | (if $plugin == "" and (.model // "" | tostring | startswith("weave-claude/")) then .model = "weave/claude-sonnet-4-6" else . end)
       | (.["$schema"] //= "https://opencode.ai/config.json")
     ' "$config_file")"
   else
     merged="$(jq -n \
       --argjson block "$block" \
-      --argjson codex "$codex_block" \
+      --argjson claude "$claude_block" \
       --arg plugin "$plugin_arg" '
       {
         "$schema": "https://opencode.ai/config.json",
         model: "weave/claude-sonnet-4-6",
         provider: { weave: $block }
       }
-      | (if $plugin != "" then .provider["weave-codex"] = $codex | .plugin = [$plugin] else . end)
+      | (if $plugin != "" then .provider["weave-claude"] = $claude | .plugin = [$plugin] else . end)
     ')"
   fi
   printf '%s\n' "$merged" >"$config_file"
@@ -1543,8 +1543,8 @@ toggle_opencode() {
     model="$(jq -r '.model // empty' "$f" 2>/dev/null || true)"
     if [ "$(jq -r '((.provider // {}) | has("weave"))' "$f" 2>/dev/null || true)" = "true" ]; then has_weave="true"; fi
   fi
-  # Either managed provider counts as router-on: the Anthropic-shaped `weave/…`
-  # default or a caller-selected `weave-codex/…` Codex-subscription model.
+  # A managed model counts as router-on: the Responses-shaped `weave/…` default,
+  # or a legacy `weave-codex/…` model parked by a pre-upgrade install.
   case "$model" in weave/* | weave-codex/*) on="true" ;; esac
 
   case "$mode" in
@@ -1588,10 +1588,10 @@ toggle_opencode() {
           | "weave/" + .
         ' "$f" 2>/dev/null || echo "weave/claude-sonnet-4-6")"
       fi
-      # Never restore a weave-codex model whose provider is no longer
-      # registered (e.g. a plugin-less re-install stripped it after `off`
-      # parked a weave-codex/… model). Fall back to the Anthropic weave default
-      # so `on` can't leave opencode pointing at a missing provider.
+      # Never restore a legacy weave-codex model whose provider is no longer
+      # registered (every current install strips weave-codex). Fall back to the
+      # `weave` default so `on` can't leave opencode pointing at a missing
+      # provider.
       case "$restore_model" in
         weave-codex/*)
           if [ "$(jq -r '((.provider // {}) | has("weave-codex"))' "$f" 2>/dev/null || true)" != "true" ]; then
@@ -1849,13 +1849,14 @@ if [ "$target" = "opencode" ]; then
   printf "\n"
   printf "%s✓%s %s%sWeave Router installed for opencode.%s\n" \
     "$C_GREEN" "$C_RESET" "$C_BOLD" "$C_BRAND" "$C_RESET"
-  # Surface the optional Codex-subscription path only when this run actually
-  # registered the weave-codex provider. Gate on the provider's presence in the
-  # written config (authoritative) rather than a plugin file on disk — a
-  # leftover plugin from a prior install can outlive a plugin-less re-install
-  # that stripped the provider, which would make these instructions misleading.
-  if jq -e '(.provider // {}) | has("weave-codex")' "$opencode_config_file" >/dev/null 2>&1; then
-    info "To pay for opencode turns with your own ChatGPT (Codex) subscription: run ${C_BOLD}opencode auth login${C_RESET} → ${C_BOLD}ChatGPT Pro/Plus${C_RESET}, then pick a ${C_BOLD}weave-codex${C_RESET} model."
+  # Surface the optional subscription-routing path only when this run actually
+  # registered the weave-claude login provider (which is written together with
+  # the plugin). Gate on its presence in the written config (authoritative)
+  # rather than a plugin file on disk — a leftover plugin from a prior install
+  # can outlive a plugin-less re-install that stripped the provider, which would
+  # make these instructions misleading.
+  if jq -e '(.provider // {}) | has("weave-claude")' "$opencode_config_file" >/dev/null 2>&1; then
+    info "Optional: connect your AI plans so they pay for the matching turns. Run ${C_BOLD}opencode auth login${C_RESET} → ${C_BOLD}Weave Router${C_RESET} for ${C_BOLD}ChatGPT Pro/Plus${C_RESET} (GPT/Codex turns) and/or ${C_BOLD}Weave Router — Claude plan${C_RESET} for ${C_BOLD}Claude Pro/Max${C_RESET} (Claude turns). The router still routes every turn; your Weave key pays for the rest."
   fi
   if [ -n "$install_dir" ]; then
     # --dir installs land outside opencode's discovery roots, so the caller
@@ -2120,7 +2121,8 @@ prices='{
     "qwen/qwen3.7-plus":                0.0004,
     "xiaomi/mimo-v2.5-pro":             0.001,
     "z-ai/glm-5":                       0.0006,
-    "z-ai/glm-5.1":                     0.00105
+    "z-ai/glm-5.1":                     0.00105,
+    "z-ai/glm-5.2":                     0.0014
   },
   "output": {
     "claude-fable-5":                   0.05,
@@ -2175,7 +2177,8 @@ prices='{
     "qwen/qwen3.7-plus":                0.0016,
     "xiaomi/mimo-v2.5-pro":             0.003,
     "z-ai/glm-5":                       0.00208,
-    "z-ai/glm-5.1":                     0.0035
+    "z-ai/glm-5.1":                     0.0035,
+    "z-ai/glm-5.2":                     0.0044
   }
 }'
 # END_GENERATED_PRICES

package/opencode-weave/README.md

@@ -1,59 +1,78 @@
-# opencode Weave Codex plugin
+# opencode Weave subscription plugin
 
-Lets a caller's own **ChatGPT (Codex) subscription** pay for their **opencode**
-turns, routed through the Weave Router. Bundled into `@workweave/router`; the
-installer (`--codex` / `--opencode`) drops `src/index.ts` into the user's
-opencode plugins dir and writes a matching `weave-codex` provider block into
-`opencode.json`.
+Lets a caller's own **AI subscriptions** pay for their **opencode** turns, routed
+through the Weave Router. A subscription is a **credential scoped to the model
+family it can pay for**, not a provider you pick: you connect your ChatGPT
+(Codex) and/or Claude (Pro/Max) plan once, the router routes every turn to the
+best model, and bills the plan that matches the model it served — ChatGPT pays
+for GPT/Codex turns, Claude pays for Claude turns, your Weave key pays for
+everything else.
+
+Bundled into `@workweave/router`; the installer (`--codex` / `--opencode`) drops
+`src/index.ts` into the user's opencode plugins dir and writes a single
+Responses-format `weave` provider (plus a login-only `weave-claude` provider)
+into `opencode.json`.
 
 ## Why a plugin (config alone can't do it)
 
 opencode removed built-in subscription auth in 1.3.0 and binds OAuth to its own
-first-party providers — its bundled `openai/codex.ts` plugin hardcodes the
-upstream to `chatgpt.com` and binds provider id `openai`, so a custom router
-provider can't reuse it. And a subscription needs the caller's OAuth token in
-`Authorization`, which expires hourly — a static `options.headers` string can't
-refresh it.
-
-This plugin re-implements the same ChatGPT OAuth + refresh against a **custom**
-provider id (`weave-codex`) and, crucially, **leaves the request URL on the
-Weave Router** instead of rewriting it to `chatgpt.com`.
+first-party providers, so a custom router provider can't reuse it. And
+subscription tokens expire hourly — a static `options.headers` string can't
+refresh them, nor carry two subscriptions whose tokens rotate independently.
 
 ## Wire shape it produces
 
-Matches the router's `/v1/responses` Codex passthrough:
+opencode talks to one Responses-format `weave` provider; the plugin's loader
+attaches whichever subscriptions are connected to **every** request via the
+router's dedicated headers:
 
 | | |
 |---|---|
 | `POST {router}/v1/responses` | Responses wire format (opencode's default for an `@ai-sdk/openai` provider) |
-| `Authorization: Bearer <ChatGPT JWT>` | the caller's subscription, refreshed on expiry |
-| `ChatGPT-Account-Id: <id>` | paired account id (required by the Codex backend) |
-| `X-Weave-Router-Key: rk_…` | from `opencode.json` `options.headers` — the router authenticates off this, leaving `Authorization` free for the JWT |
-| `originator`, `session-id` | from the plugin's `chat.headers` hook (Codex backend session continuity) |
+| `X-Weave-OpenAI-Subscription: <ChatGPT JWT>` | pays GPT/Codex turns, refreshed on expiry |
+| `X-Weave-OpenAI-Account-ID: <id>` | paired account id (required by the Codex backend) |
+| `X-Weave-Anthropic-Subscription: <sk-ant-oat token>` | pays Claude turns, refreshed on expiry |
+| `X-Weave-Router-Key: rk_…` | from `opencode.json` `options.headers` — the router authenticates off this |
+
+The router routes the turn across every model the caller's subs + key can pay
+for and resolves the subscription matching the chosen provider, so a sub is
+never billed for a turn outside its family.
+
+## Two storage slots, one request provider
+
+opencode stores one credential per provider id and the loader's `getAuth()` is
+scoped to its own provider, so the two logins live in two slots:
+
+- **`weave`** — the request provider. Owns the **ChatGPT** login and the loader
+  that attaches both subscriptions. Connecting ChatGPT activates sub-routing.
+- **`weave-claude`** — login-only (no models, serves no requests). Owns the
+  **Claude** login. Its token is read from opencode's on-disk auth store by the
+  `weave` loader (the SDK exposes no get-by-id).
 
-The router detects the inbound Codex bearer and serves the turn on the caller's
-own plan at the subscription fee.
+With neither connected, `weave` is a plain router provider (your Weave key pays)
+— the loader simply doesn't run. Connecting ChatGPT is what turns on
+subscription routing; the Claude sub then rides along when present.
 
-## Division of responsibility
+## Login
 
-- **Installer** writes the router key + identity headers (`X-Weave-Router-Key`,
-  `X-App`, `X-Weave-User-Email`) into `opencode.json` `options.headers`.
-- **This plugin** manages only the dynamic, secret, refreshable subscription
-  credential (the `Authorization` bearer + `ChatGPT-Account-Id`) via the auth
-  `loader`, and the login flow via auth `methods` (browser PKCE + headless
-  device code). Tokens are stored in opencode's own auth store under the
-  `weave-codex` provider id.
+`opencode auth login` → **Weave Router** → *ChatGPT Pro/Plus* (browser or
+headless device code) and/or **Weave Router — Claude plan** → *Claude Pro/Max*
+(browser; paste the `code#state` shown after authorizing).
 
-## Env overrides
+## Env overrides (self-host + tests)
 
-- `WEAVE_CODEX_OAUTH_ISSUER` — override the OpenAI auth issuer (self-hosted
-  OpenAI auth proxies; also used by the capture tests).
+- `WEAVE_CODEX_OAUTH_ISSUER` — OpenAI auth issuer.
+- `WEAVE_ANTHROPIC_OAUTH_AUTHORIZE` / `WEAVE_ANTHROPIC_OAUTH_TOKEN` — Anthropic
+  OAuth authorize host / token endpoint.
+- `WEAVE_OPENCODE_AUTH_FILE` — path to opencode's `auth.json` (the `weave`
+  loader reads the `weave-claude` slot from here; defaults to
+  `$XDG_DATA_HOME/opencode/auth.json`).
 
 ## Verification
 
-Capture-tested end-to-end against a local server standing in for the router
-(opencode 1.17.9, real ChatGPT login): the inject path forwards the real JWT +
-account-id in Responses format to `/v1/responses`, and the refresh path detects
-an expired token, refreshes against the issuer, rotates + persists the tokens,
-and injects the refreshed bearer. Typechecks under `strict` against
-`@opencode-ai/plugin`.
+`bun test test/` (run under bun, opencode's own runtime) covers: dual-sub
+injection via the dedicated headers with the router key preserved and
+`Authorization` left clean; ChatGPT-only graceful degradation; expired Claude
+token refresh + persist + rotated injection; the loader staying inert without
+oauth; and the Claude login hook's canonical OAuth flow + `code#state` exchange.
+Typechecks under `strict` against `@opencode-ai/plugin`.

package/opencode-weave/src/index.ts

@@ -1,42 +1,80 @@
 /**
- * @workweave/router — use a caller's ChatGPT (Codex) subscription for their
- * opencode turns, routed through the Weave Router.
+ * @workweave/router — let a caller's own AI subscriptions pay for their opencode
+ * turns, routed through the Weave Router.
  *
- * opencode removed built-in subscription auth in 1.3.0 and binds OAuth to its
- * own first-party providers (the bundled `openai/codex.ts` plugin hardcodes the
- * upstream to chatgpt.com and binds provider "openai"), so a custom router
- * provider can't reuse it. This plugin re-implements the same ChatGPT OAuth +
- * refresh against a CUSTOM provider id (`weave-codex`) and, crucially, leaves
- * the request URL pointed at the Weave Router instead of chatgpt.com.
+ * Model: a subscription is a CREDENTIAL scoped to the model family it can pay
+ * for, not a provider you pick to force a model. You connect your ChatGPT
+ * (Codex) and/or Claude (Pro/Max) plan once; the Weave Router routes every turn
+ * to the best model and bills the plan that matches the model it served — and
+ * only that. ChatGPT plan pays for GPT/Codex turns, Claude plan pays for Claude
+ * turns, your Weave key pays for everything else. No manual provider-picking.
  *
- * Wire shape produced (matches the router's /v1/responses Codex passthrough):
- *   - POST {router}/v1/responses                       (Responses wire format)
- *   - Authorization: Bearer <ChatGPT JWT>              (the caller's subscription)
- *   - ChatGPT-Account-Id: <account id>                 (paired, required by Codex backend)
- *   - X-Weave-Router-Key: rk_...                       (from config options.headers)
+ * opencode talks to one Responses-format `weave` provider; this plugin attaches
+ * BOTH subscriptions to every request via the router's dedicated headers:
+ *   - POST {router}/v1/responses                          (Responses wire format)
+ *   - X-Weave-OpenAI-Subscription: <ChatGPT JWT>          (pays GPT/Codex turns)
+ *   - X-Weave-OpenAI-Account-ID:   <account id>           (paired, Codex backend)
+ *   - X-Weave-Anthropic-Subscription: <sk-ant-oat token>  (pays Claude turns)
+ *   - X-Weave-Router-Key: rk_...                          (from config options.headers)
  *
- * The router authenticates off X-Weave-Router-Key (so Authorization is free for
- * the subscription JWT), detects the inbound Codex bearer, and serves the turn
- * on the caller's own plan at the subscription fee. The router key + identity
- * headers (X-App, X-Weave-User-Email) live in opencode.json `options.headers`
- * written by the installer; this plugin manages only the dynamic, refreshable
- * subscription credential.
+ * The router authenticates off X-Weave-Router-Key, routes the turn across all
+ * models the caller's subs + key can pay for, and resolves the matching
+ * subscription per the chosen provider (so the ChatGPT plan can never be billed
+ * for a Claude/OSS turn, and vice-versa).
+ *
+ * opencode stores one credential per provider id and the loader's getAuth() is
+ * scoped to its own provider, so the two logins live in two slots:
+ *   - provider `weave`        : the request provider; owns the ChatGPT login and
+ *                               the loader that injects both subs.
+ *   - provider `weave-claude`  : login-only; owns the Claude login. Its token is
+ *                               read from opencode's on-disk auth store by the
+ *                               `weave` loader (the SDK has no get-by-id).
+ * Connecting ChatGPT activates sub-routing; the Claude sub then rides along when
+ * present. With neither connected, `weave` is a plain router provider (your
+ * Weave key pays) — the loader simply doesn't run.
  */
 
 import type { Hooks, Plugin, PluginInput } from "@opencode-ai/plugin"
+import { readFile } from "node:fs/promises"
+import { homedir } from "node:os"
+import { join } from "node:path"
 
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+// ---- ChatGPT (Codex) OAuth -------------------------------------------------
+const CHATGPT_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
 // Overridable for self-hosted OpenAI auth proxies and for tests (mirrors the
 // bundled codex plugin's `options.issuer`).
-const ISSUER = process.env.WEAVE_CODEX_OAUTH_ISSUER ?? "https://auth.openai.com"
+const CHATGPT_ISSUER = process.env.WEAVE_CODEX_OAUTH_ISSUER ?? "https://auth.openai.com"
 const OAUTH_PORT = 1455
 const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000
-// Provider id this plugin owns. Must match the provider block the installer
-// writes into opencode.json. Deliberately NOT "openai" — that id is claimed by
-// opencode's bundled codex plugin, which rewrites the upstream to chatgpt.com.
-const PROVIDER_ID = "weave-codex"
+
+// ---- Claude (Anthropic) OAuth ----------------------------------------------
+// Canonical Claude Pro/Max OAuth (the same flow Claude Code uses): a manual
+// code-paste browser flow. Authorize on claude.ai, exchange/refresh on the
+// console token endpoint. The access token is an sk-ant-oat… subscription
+// bearer; the router applies the Bearer + oauth beta header on the upstream leg.
+const ANTHROPIC_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
+const ANTHROPIC_AUTHORIZE_BASE = process.env.WEAVE_ANTHROPIC_OAUTH_AUTHORIZE ?? "https://claude.ai"
+const ANTHROPIC_TOKEN_URL = process.env.WEAVE_ANTHROPIC_OAUTH_TOKEN ?? "https://console.anthropic.com/v1/oauth/token"
+const ANTHROPIC_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback"
+const ANTHROPIC_SCOPE = "org:create_api_key user:profile user:inference"
+
+// Provider ids this plugin owns. `weave` is the request provider the installer
+// writes into opencode.json; `weave-claude` is login-only storage for the Claude
+// subscription. Deliberately NOT "openai"/"anthropic" — those ids are claimed by
+// opencode's bundled provider plugins, which rewrite the upstream off the router.
+const PROVIDER_ID = "weave"
+const ANTHROPIC_PROVIDER_ID = "weave-claude"
+
+// Dedicated router subscription headers. Must match the constants in
+// internal/server/middleware/auth.go so the router stashes each sub and resolves
+// it per the routed provider.
+const HEADER_OPENAI_SUB = "X-Weave-OpenAI-Subscription"
+const HEADER_OPENAI_ACCOUNT_ID = "X-Weave-OpenAI-Account-ID"
+const HEADER_ANTHROPIC_SUB = "X-Weave-Anthropic-Subscription"
+
 // Placeholder so the @ai-sdk/openai provider considers auth configured; the
-// loader's fetch overwrites Authorization with the real subscription bearer.
+// loader's fetch carries the real subscriptions in the dedicated headers and the
+// router authenticates off X-Weave-Router-Key, so this value is never used.
 const DUMMY_KEY = "weave-router-oauth"
 const USER_AGENT = "weave-router-opencode"
 
@@ -111,7 +149,7 @@ interface TokenResponse {
 function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string): string {
   const params = new URLSearchParams({
     response_type: "code",
-    client_id: CLIENT_ID,
+    client_id: CHATGPT_CLIENT_ID,
     redirect_uri: redirectUri,
     scope: "openid profile email offline_access",
     code_challenge: pkce.challenge,
@@ -121,18 +159,18 @@ function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string):
     state,
     originator: "codex_cli_ts",
   })
-  return `${ISSUER}/oauth/authorize?${params.toString()}`
+  return `${CHATGPT_ISSUER}/oauth/authorize?${params.toString()}`
 }
 
 async function exchangeCodeForTokens(code: string, redirectUri: string, pkce: PkceCodes): Promise<TokenResponse> {
-  const response = await fetch(`${ISSUER}/oauth/token`, {
+  const response = await fetch(`${CHATGPT_ISSUER}/oauth/token`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "authorization_code",
       code,
       redirect_uri: redirectUri,
-      client_id: CLIENT_ID,
+      client_id: CHATGPT_CLIENT_ID,
       code_verifier: pkce.verifier,
     }).toString(),
   })
@@ -141,20 +179,120 @@ async function exchangeCodeForTokens(code: string, redirectUri: string, pkce: Pk
 }
 
 async function refreshAccessToken(refreshToken: string): Promise<TokenResponse> {
-  const response = await fetch(`${ISSUER}/oauth/token`, {
+  const response = await fetch(`${CHATGPT_ISSUER}/oauth/token`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
-      client_id: CLIENT_ID,
+      client_id: CHATGPT_CLIENT_ID,
     }).toString(),
   })
   if (!response.ok) throw new Error(`Token refresh failed: ${response.status}`)
   return response.json() as Promise<TokenResponse>
 }
 
-// ---- Browser OAuth loopback server (PKCE) --------------------------------
+// ---- Claude (Anthropic) OAuth helpers --------------------------------------
+
+interface AnthropicTokens {
+  access: string
+  refresh: string
+  expires: number
+}
+
+function buildAnthropicAuthorizeUrl(pkce: PkceCodes): string {
+  const url = new URL(`${ANTHROPIC_AUTHORIZE_BASE}/oauth/authorize`)
+  url.searchParams.set("code", "true")
+  url.searchParams.set("client_id", ANTHROPIC_CLIENT_ID)
+  url.searchParams.set("response_type", "code")
+  url.searchParams.set("redirect_uri", ANTHROPIC_REDIRECT_URI)
+  url.searchParams.set("scope", ANTHROPIC_SCOPE)
+  url.searchParams.set("code_challenge", pkce.challenge)
+  url.searchParams.set("code_challenge_method", "S256")
+  // Claude Code reuses the PKCE verifier as the state value; the manual code is
+  // returned to the user as "<code>#<state>".
+  url.searchParams.set("state", pkce.verifier)
+  return url.toString()
+}
+
+async function exchangeAnthropicCode(code: string, verifier: string): Promise<AnthropicTokens> {
+  // The manual flow returns "<code>#<state>"; without the separator the state
+  // would be undefined and the server would 4xx with an opaque error.
+  if (!code.includes("#")) {
+    throw new Error(`Expected the pasted code in "code#state" format; got: ${code.trim().slice(0, 24)}…`)
+  }
+  const [authCode, state] = code.trim().split("#")
+  const response = await fetch(ANTHROPIC_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code: authCode,
+      state,
+      client_id: ANTHROPIC_CLIENT_ID,
+      redirect_uri: ANTHROPIC_REDIRECT_URI,
+      code_verifier: verifier,
+    }),
+  })
+  if (!response.ok) throw new Error(`Anthropic token exchange failed: ${response.status}`)
+  const json = (await response.json()) as { access_token: string; refresh_token: string; expires_in?: number }
+  return { access: json.access_token, refresh: json.refresh_token, expires: Date.now() + (json.expires_in ?? 3600) * 1000 }
+}
+
+async function refreshAnthropicToken(refreshToken: string): Promise<AnthropicTokens> {
+  const response = await fetch(ANTHROPIC_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: ANTHROPIC_CLIENT_ID,
+    }),
+  })
+  if (!response.ok) throw new Error(`Anthropic token refresh failed: ${response.status}`)
+  const json = (await response.json()) as { access_token: string; refresh_token?: string; expires_in?: number }
+  return {
+    access: json.access_token,
+    // OAuth 2.0 lets the issuer omit a new refresh_token on refresh; keep the
+    // existing one in that case rather than clearing it.
+    refresh: json.refresh_token ?? refreshToken,
+    expires: Date.now() + (json.expires_in ?? 3600) * 1000,
+  }
+}
+
+// ---- opencode auth-store reader (cross-provider) ---------------------------
+// The `weave` loader's getAuth() is scoped to `weave`, and the SDK exposes no
+// get-by-id, so the Claude credential stored under `weave-claude` is read from
+// opencode's on-disk auth store directly. Path mirrors opencode's Global.Path
+// (XDG data home + /opencode/auth.json); overridable for tests.
+
+interface StoredOAuth {
+  type: string
+  access?: string
+  refresh?: string
+  expires?: number
+  accountId?: string
+}
+
+function opencodeAuthFile(): string {
+  const override = process.env.WEAVE_OPENCODE_AUTH_FILE
+  if (override) return override
+  const dataHome = process.env.XDG_DATA_HOME || join(homedir(), ".local", "share")
+  return join(dataHome, "opencode", "auth.json")
+}
+
+async function readStoredOAuth(providerID: string): Promise<StoredOAuth | undefined> {
+  try {
+    const raw = await readFile(opencodeAuthFile(), "utf8")
+    const entry = (JSON.parse(raw) as Record<string, StoredOAuth>)[providerID]
+    if (entry && entry.type === "oauth") return entry
+  } catch {
+    // No store yet / unreadable / not logged in — no Claude sub to attach.
+  }
+  return undefined
+}
+
+// ---- Browser OAuth loopback server (PKCE, ChatGPT) -------------------------
 
 function escapeHtml(s: string): string {
   return s.replace(/[&<>"']/g, (c) =>
@@ -162,12 +300,12 @@ function escapeHtml(s: string): string {
   )
 }
 
-const HTML_SUCCESS = `<!doctype html><html><head><title>Weave Router — Codex authorized</title></head>
+const HTML_SUCCESS = `<!doctype html><html><head><title>Weave Router — authorized</title></head>
 <body style="font-family:system-ui;background:#131010;color:#f1ecec;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
 <div style="text-align:center"><h1>Authorization successful</h1><p>You can close this window and return to opencode.</p>
 <script>setTimeout(()=>window.close(),2000)</script></div></body></html>`
 
-const renderOAuthError = (error: string) => `<!doctype html><html><head><title>Weave Router — Codex authorization failed</title></head>
+const renderOAuthError = (error: string) => `<!doctype html><html><head><title>Weave Router — authorization failed</title></head>
 <body style="font-family:system-ui;background:#131010;color:#f1ecec;display:flex;justify-content:center;align-items:center;height:100vh;margin:0">
 <div style="text-align:center"><h1 style="color:#fc533a">Authorization failed</h1>
 <div style="color:#ff917b;font-family:monospace;margin-top:1rem;padding:1rem;background:#3c140d;border-radius:.5rem">${escapeHtml(error)}</div></div></body></html>`
@@ -259,7 +397,7 @@ function waitForOAuthCallback(pkce: PkceCodes, state: string): Promise<TokenResp
   })
 }
 
-// ---- Plugin --------------------------------------------------------------
+// ---- Request provider: `weave` (Responses, both subs) ----------------------
 
 export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> => {
   return {
@@ -269,69 +407,112 @@ export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> =>
         const auth = await getAuth()
         if (auth.type !== "oauth") return {}
 
-        // Coalesce concurrent refreshes (opencode fires parallel turns).
-        let refreshPromise: Promise<{ access: string; accountId: string | undefined }> | undefined
+        // Coalesce concurrent refreshes (opencode fires parallel turns), one
+        // in-flight promise per subscription.
+        let chatgptRefresh: Promise<{ access: string; accountId: string | undefined }> | undefined
+        let anthropicRefresh: Promise<string | undefined> | undefined
+
+        // Resolve the ChatGPT (Codex) sub from this provider's own slot,
+        // refreshing + persisting the rotated token on (or just before) expiry.
+        async function resolveChatGPT(): Promise<{ access: string; accountId?: string } | undefined> {
+          const current = (await getAuth()) as StoredOAuth
+          if (current.type !== "oauth") return undefined
+          // Use a still-valid access token regardless of whether a refresh token
+          // is present (a partial store could lack it). Only an expired/absent
+          // access needs a refresh — and that needs the refresh token.
+          if (current.access && (current.expires ?? 0) >= Date.now()) {
+            return { access: current.access, accountId: current.accountId }
+          }
+          // Access is expired/absent: a refresh is the only way forward, so
+          // without a refresh token there's no usable credential.
+          if (!current.refresh) return undefined
+          if (!chatgptRefresh) {
+            chatgptRefresh = refreshAccessToken(current.refresh)
+              .then(async (tokens) => {
+                const accountId = extractAccountId(tokens) || current.accountId
+                await input.client.auth.set({
+                  path: { id: PROVIDER_ID },
+                  body: {
+                    type: "oauth",
+                    refresh: tokens.refresh_token || current.refresh!,
+                    access: tokens.access_token,
+                    expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+                    ...(accountId && { accountId }),
+                  },
+                })
+                return { access: tokens.access_token, accountId }
+              })
+              .finally(() => {
+                chatgptRefresh = undefined
+              })
+          }
+          return chatgptRefresh
+        }
+
+        // Resolve the Claude sub from the `weave-claude` slot (read off disk),
+        // refreshing + persisting the rotated token via the auth store. Returns
+        // undefined when Claude isn't connected.
+        async function resolveAnthropic(): Promise<string | undefined> {
+          const current = await readStoredOAuth(ANTHROPIC_PROVIDER_ID)
+          if (!current) return undefined
+          if (current.access && (current.expires ?? 0) >= Date.now()) return current.access
+          // Access is expired/absent: only a refresh can produce a live token,
+          // so without a refresh token there's no usable credential to inject —
+          // returning the stale token would have the router treat a dead Claude
+          // sub as present instead of falling back to the Weave key. (Mirrors
+          // resolveChatGPT.)
+          if (!current.refresh) return undefined
+          if (!anthropicRefresh) {
+            anthropicRefresh = refreshAnthropicToken(current.refresh)
+              .then(async (tokens) => {
+                await input.client.auth.set({
+                  path: { id: ANTHROPIC_PROVIDER_ID },
+                  body: { type: "oauth", refresh: tokens.refresh, access: tokens.access, expires: tokens.expires },
+                })
+                return tokens.access
+              })
+              // A failed Claude refresh must not fail the turn — fall back to the
+              // (possibly stale) token; an expired Claude turn the router can't
+              // bill to the plan falls through to the Weave key on its end.
+              .catch(() => current.access)
+              .finally(() => {
+                anthropicRefresh = undefined
+              })
+          }
+          return anthropicRefresh
+        }
 
         return {
           apiKey: DUMMY_KEY,
           async fetch(requestInput: RequestInfo | URL, init?: RequestInit) {
-            const currentAuth = (await getAuth()) as {
-              type: string
-              access: string
-              refresh: string
-              expires: number
-              accountId?: string
-            }
-            if (currentAuth.type !== "oauth") return fetch(requestInput, init)
-
-            // Refresh the access token on (or just before) expiry and persist
-            // the rotated refresh token back into opencode's auth store.
-            if (!currentAuth.access || currentAuth.expires < Date.now()) {
-              if (!refreshPromise) {
-                refreshPromise = refreshAccessToken(currentAuth.refresh)
-                  .then(async (tokens) => {
-                    const accountId = extractAccountId(tokens) || currentAuth.accountId
-                    await input.client.auth.set({
-                      path: { id: PROVIDER_ID },
-                      body: {
-                        type: "oauth",
-                        // OAuth 2.0 lets the issuer omit a new refresh_token on
-                        // refresh (the existing one stays valid). Keep the
-                        // stored one in that case rather than clearing it.
-                        refresh: tokens.refresh_token || currentAuth.refresh,
-                        access: tokens.access_token,
-                        expires: Date.now() + (tokens.expires_in ?? 3600) * 1000,
-                        ...(accountId && { accountId }),
-                      },
-                    })
-                    return { access: tokens.access_token, accountId }
-                  })
-                  .finally(() => {
-                    refreshPromise = undefined
-                  })
-              }
-              const refreshed = await refreshPromise
-              currentAuth.access = refreshed.access
-              currentAuth.accountId = refreshed.accountId
-            }
-
-            // Preserve the configured headers (X-Weave-Router-Key, X-App, ...
-            // from opencode.json options.headers), then overwrite Authorization
-            // with the caller's subscription bearer + the paired account id.
+            // Preserve the configured headers (X-Weave-Router-Key, X-App, …) and
+            // attach each connected subscription via its dedicated router header.
+            // Authorization is left as the @ai-sdk placeholder; the router authes
+            // off X-Weave-Router-Key and resolves the matching sub per the routed
+            // model, so neither sub rides in Authorization.
             const headers = new Headers(init?.headers as HeadersInit | undefined)
-            headers.set("authorization", `Bearer ${currentAuth.access}`)
-            if (currentAuth.accountId) headers.set("ChatGPT-Account-Id", currentAuth.accountId)
 
-            // NOTE: unlike opencode's bundled codex plugin we deliberately do
-            // NOT rewrite the URL — the request stays on the Weave Router, which
-            // forwards it to the Codex backend on the caller's plan.
+            // Resolve both subs independently and never let one failure (e.g. a
+            // failed ChatGPT token refresh) drop the other or fail the turn — a
+            // Claude-routed turn must still get its sub when the ChatGPT refresh
+            // is down, and vice-versa. Each resolver already persists rotations.
+            const [chatgpt, anthropic] = await Promise.all([
+              resolveChatGPT().catch(() => undefined),
+              resolveAnthropic().catch(() => undefined),
+            ])
+            if (chatgpt?.access) {
+              headers.set(HEADER_OPENAI_SUB, chatgpt.access)
+              if (chatgpt.accountId) headers.set(HEADER_OPENAI_ACCOUNT_ID, chatgpt.accountId)
+            }
+            if (anthropic) headers.set(HEADER_ANTHROPIC_SUB, anthropic)
+
             return fetch(requestInput, { ...init, headers })
           },
         }
       },
       methods: [
         {
-          label: "ChatGPT Pro/Plus (browser)",
+          label: "ChatGPT Pro/Plus — pays for GPT/Codex turns (browser)",
           type: "oauth",
           authorize: async () => {
             const { redirectUri } = await startOAuthServer()
@@ -357,13 +538,13 @@ export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> =>
           },
         },
         {
-          label: "ChatGPT Pro/Plus (headless device code)",
+          label: "ChatGPT Pro/Plus — pays for GPT/Codex turns (headless device code)",
           type: "oauth",
           authorize: async () => {
-            const deviceResponse = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+            const deviceResponse = await fetch(`${CHATGPT_ISSUER}/api/accounts/deviceauth/usercode`, {
               method: "POST",
               headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT },
-              body: JSON.stringify({ client_id: CLIENT_ID }),
+              body: JSON.stringify({ client_id: CHATGPT_CLIENT_ID }),
             })
             if (!deviceResponse.ok) throw new Error("Failed to initiate device authorization")
             const deviceData = (await deviceResponse.json()) as {
@@ -373,13 +554,13 @@ export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> =>
             }
             const interval = Math.max(parseInt(deviceData.interval) || 5, 1) * 1000
             return {
-              url: `${ISSUER}/codex/device`,
+              url: `${CHATGPT_ISSUER}/codex/device`,
               instructions: `Enter code: ${deviceData.user_code}`,
               method: "auto" as const,
               async callback() {
                 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))
                 while (true) {
-                  const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
+                  const response = await fetch(`${CHATGPT_ISSUER}/api/accounts/deviceauth/token`, {
                     method: "POST",
                     headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT },
                     body: JSON.stringify({
@@ -389,14 +570,14 @@ export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> =>
                   })
                   if (response.ok) {
                     const data = (await response.json()) as { authorization_code: string; code_verifier: string }
-                    const tokenResponse = await fetch(`${ISSUER}/oauth/token`, {
+                    const tokenResponse = await fetch(`${CHATGPT_ISSUER}/oauth/token`, {
                       method: "POST",
                       headers: { "Content-Type": "application/x-www-form-urlencoded" },
                       body: new URLSearchParams({
                         grant_type: "authorization_code",
                         code: data.authorization_code,
-                        redirect_uri: `${ISSUER}/deviceauth/callback`,
-                        client_id: CLIENT_ID,
+                        redirect_uri: `${CHATGPT_ISSUER}/deviceauth/callback`,
+                        client_id: CHATGPT_CLIENT_ID,
                         code_verifier: data.code_verifier,
                       }).toString(),
                     })
@@ -419,9 +600,9 @@ export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> =>
         },
       ],
     },
-    // The Codex backend (which the router forwards to) keys session continuity
-    // off these headers; mirror opencode's bundled codex plugin. Scoped to our
-    // provider so other providers are untouched.
+    // The Codex backend (which the router forwards GPT turns to) keys session
+    // continuity off these headers; mirror opencode's bundled codex plugin.
+    // Scoped to our provider so other providers are untouched.
     "chat.headers": async (hookInput, output) => {
       if (hookInput.model.providerID !== PROVIDER_ID) return
       output.headers["originator"] = "codex_cli_ts"
@@ -435,4 +616,40 @@ export const WeaveCodex: Plugin = async (input: PluginInput): Promise<Hooks> =>
   }
 }
 
+// ---- Login-only provider: `weave-claude` (Claude Pro/Max) ------------------
+// A second auth hook so the Claude subscription gets its own storage slot
+// (opencode keys credentials by provider id). It serves no requests — the
+// `weave` loader reads this slot and attaches the token — so it needs no loader.
+
+export const WeaveClaude: Plugin = async (_input: PluginInput): Promise<Hooks> => {
+  return {
+    auth: {
+      provider: ANTHROPIC_PROVIDER_ID,
+      methods: [
+        {
+          label: "Claude Pro/Max — pays for Claude turns (browser)",
+          type: "oauth",
+          authorize: async () => {
+            const pkce = await generatePKCE()
+            return {
+              url: buildAnthropicAuthorizeUrl(pkce),
+              instructions: "Sign in with your Claude account, then paste the code shown (looks like `code#state`).",
+              method: "code" as const,
+              callback: async (code: string) => {
+                const tokens = await exchangeAnthropicCode(code, pkce.verifier)
+                return {
+                  type: "success" as const,
+                  refresh: tokens.refresh,
+                  access: tokens.access,
+                  expires: tokens.expires,
+                }
+              },
+            }
+          },
+        },
+      ],
+    },
+  }
+}
+
 export default WeaveCodex

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workweave/router",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "One-command installer that points Claude Code, Codex, opencode, or pi at the Weave Router. For pi it also ships the routing extension, loaded via pi.extensions.",
   "bin": {
     "weave-router": "bin.js"

package/uninstall.sh

@@ -164,19 +164,21 @@ if [ "$target" = "opencode" ]; then
     opencode_plugin="$opencode_dir/.weave/opencode-weave.ts"
   fi
   if [ -f "$opencode_config_file" ]; then
-    # Strip both managed providers (`weave`, `weave-codex`), the managed plugin
+    # Strip every managed provider (`weave`, the login-only `weave-claude`, and
+    # the legacy `weave-codex` from pre-upgrade installs), the managed plugin
     # entry from the `plugin` array, and any router-pointing top-level model
-    # (both the `weave/` and `weave-codex/` provider prefixes — otherwise a
-    # `weave-codex/...` default survives and points at the deleted provider).
-    # Other providers, user-set models that don't reference the router, other
-    # plugins, and any unrelated keys are preserved.
+    # (the `weave/`, `weave-claude/`, and `weave-codex/` prefixes — otherwise a
+    # default survives and points at a deleted provider). Other providers,
+    # user-set models that don't reference the router, other plugins, and any
+    # unrelated keys are preserved.
     cleaned="$(jq --arg plugin "$opencode_plugin" '
       (if .provider.weave then del(.provider.weave) else . end)
+      | (if .provider["weave-claude"] then del(.provider["weave-claude"]) else . end)
       | (if .provider["weave-codex"] then del(.provider["weave-codex"]) else . end)
       | (if (.provider // {}) == {} then del(.provider) else . end)
       | (if (.plugin | type) == "array" then .plugin -= [$plugin] else . end)
       | (if (.plugin | type) == "array" and (.plugin | length) == 0 then del(.plugin) else . end)
-      | (if (.model // "" | tostring | (startswith("weave/") or startswith("weave-codex/"))) then del(.model) else . end)
+      | (if (.model // "" | tostring | (startswith("weave/") or startswith("weave-claude/") or startswith("weave-codex/"))) then del(.model) else . end)
     ' "$opencode_config_file")"
     printf '%s\n' "$cleaned" >"$opencode_config_file"
 
@@ -193,9 +195,9 @@ if [ "$target" = "opencode" ]; then
     info "No opencode config at $opencode_config_file (already uninstalled?)"
   fi
 
-  # Drop the bundled Codex-subscription plugin (no secrets; the config holds the
-  # key, opencode's own auth store holds the ChatGPT tokens). Remove the .weave/
-  # dir only if it's left empty so we don't clobber an unrelated user dir.
+  # Drop the bundled subscription plugin (no secrets; the config holds the key,
+  # opencode's own auth store holds the ChatGPT/Claude tokens). Remove the
+  # .weave/ dir only if it's left empty so we don't clobber an unrelated user dir.
   if [ -f "$opencode_plugin" ]; then
     refuse_if_symlink "$opencode_plugin"
     rm -f "$opencode_plugin"