ai-cc-router 0.1.3 → 0.1.5

package/dist/cli/cmd-configure.js

@@ -1,5 +1,6 @@
 import chalk from "chalk";
 import { writeClaudeSettings, removeClaudeSettings, readClaudeProxySettings } from "../utils/claude-config.js";
+import { readConfig, writeConfig, generateProxySecret } from "../config/manager.js";
 import { PROXY_PORT, CLAUDE_SETTINGS_PATH } from "../config/paths.js";
 export function registerConfigure(program) {
     program
@@ -8,6 +9,9 @@ export function registerConfigure(program) {
         .option("--remove", "Remove cc-router settings from ~/.claude/settings.json")
         .option("--port <port>", "Proxy port to configure", String(PROXY_PORT))
         .option("--show", "Show current Claude Code proxy settings")
+        .option("--generate-password", "Generate a new proxy secret and sync Claude Code settings")
+        .option("--set-password <secret>", "Set a specific proxy secret and sync Claude Code settings")
+        .option("--remove-password", "Remove proxy password protection (open access)")
         .action((opts) => {
         if (opts.show) {
             const current = readClaudeProxySettings();
@@ -20,6 +24,9 @@ export function registerConfigure(program) {
                 console.log(chalk.yellow("  Claude Code is NOT configured to use cc-router."));
                 console.log(chalk.gray(`  Run: cc-router configure`));
             }
+            const { proxySecret } = readConfig();
+            const pwStatus = proxySecret ? chalk.green("yes") : chalk.gray("no");
+            console.log(`    Password protected:  ${pwStatus}`);
             return;
         }
         if (opts.remove) {
@@ -28,10 +35,45 @@ export function registerConfigure(program) {
             console.log(chalk.gray("  Claude Code will use its default authentication on next launch."));
             return;
         }
+        if (opts.generatePassword) {
+            const secret = generateProxySecret();
+            writeConfig({ ...readConfig(), proxySecret: secret });
+            const { baseUrl } = readClaudeProxySettings();
+            writeClaudeSettings(parseInt(opts.port, 10), baseUrl);
+            console.log(chalk.green("✓ Proxy password set."));
+            console.log("  " + chalk.bold.yellow("Save this — it will not be shown again:"));
+            console.log("  " + chalk.bold(secret));
+            console.log(chalk.gray("  Restart cc-router for the change to take effect."));
+            return;
+        }
+        if (opts.setPassword !== undefined) {
+            const secret = opts.setPassword.trim();
+            if (!secret) {
+                console.error(chalk.red("Secret cannot be empty."));
+                process.exit(1);
+            }
+            writeConfig({ ...readConfig(), proxySecret: secret });
+            const { baseUrl } = readClaudeProxySettings();
+            writeClaudeSettings(parseInt(opts.port, 10), baseUrl);
+            console.log(chalk.green("✓ Proxy password updated."));
+            console.log(chalk.gray("  Restart cc-router for the change to take effect."));
+            return;
+        }
+        if (opts.removePassword) {
+            const cfg = readConfig();
+            delete cfg.proxySecret;
+            writeConfig(cfg);
+            const { baseUrl } = readClaudeProxySettings();
+            writeClaudeSettings(parseInt(opts.port, 10), baseUrl);
+            console.log(chalk.green("✓ Proxy password removed. Access is now open."));
+            console.log(chalk.gray("  Restart cc-router for the change to take effect."));
+            return;
+        }
         const port = parseInt(opts.port, 10);
         writeClaudeSettings(port);
+        const { proxySecret } = readConfig();
         console.log(chalk.green(`✓ Updated ${CLAUDE_SETTINGS_PATH}`));
         console.log(chalk.gray(`  ANTHROPIC_BASE_URL  = http://localhost:${port}`));
-        console.log(chalk.gray(`  ANTHROPIC_AUTH_TOKEN = proxy-managed`));
+        console.log(chalk.gray(`  ANTHROPIC_AUTH_TOKEN = ${proxySecret ? chalk.green("(secret configured)") : "proxy-managed"}`));
     });
 }

package/dist/cli/cmd-setup.js

@@ -1,12 +1,15 @@
 import { select, input, confirm, password } from "@inquirer/prompts";
+import { execFile, spawn } from "child_process";
+import { promisify } from "util";
 import chalk from "chalk";
 import { detectPlatform, isMacos } from "../utils/platform.js";
 import { extractFromKeychain, extractFromCredentialsFile, formatExpiry, redactToken, } from "../utils/token-extractor.js";
 import { validateToken } from "../utils/token-validator.js";
-import { writeClaudeSettings } from "../utils/claude-config.js";
-import { saveAccounts, } from "../proxy/token-refresher.js";
-import { loadAccounts, accountsFileExists } from "../config/manager.js";
+import { writeClaudeSettings, readClaudeProxySettings } from "../utils/claude-config.js";
+import { saveAccounts } from "../proxy/token-refresher.js";
+import { loadAccounts, accountsFileExists, readConfig, writeConfig, generateProxySecret } from "../config/manager.js";
 import { PROXY_PORT } from "../config/paths.js";
+const execFileAsync = promisify(execFile);
 // ─── Public registration ──────────────────────────────────────────────────────
 export function registerSetup(program) {
     program
@@ -19,7 +22,6 @@ export function registerSetup(program) {
 }
 // ─── Shared single-account setup (also used by `accounts add`) ───────────────
 export async function setupSingleAccount(index) {
-    const platform = detectPlatform();
     const choices = [];
     if (isMacos()) {
         choices.push({ name: "Extract automatically from macOS Keychain  (recommended)", value: "keychain" });
@@ -70,14 +72,12 @@ export async function setupSingleAccount(index) {
     }
     if (!tokens)
         return null;
-    // Ask for account ID
     const defaultId = `max-account-${index}`;
     const accountId = await input({
         message: "Account ID (press Enter to accept default):",
         default: defaultId,
         validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
     });
-    // Validate tokens against Anthropic API
     process.stdout.write(chalk.gray("  Validating tokens against Anthropic... "));
     const validation = await validateToken(tokens.accessToken);
     if (validation.valid) {
@@ -87,10 +87,7 @@ export async function setupSingleAccount(index) {
         console.log(chalk.red("✗ Invalid"));
         console.log(chalk.yellow(`  Reason: ${validation.reason}`));
         console.log(chalk.gray("  The token will be saved but may not work until refreshed."));
-        const keepAnyway = await confirm({
-            message: "Save this account anyway?",
-            default: false,
-        });
+        const keepAnyway = await confirm({ message: "Save this account anyway?", default: false });
         if (!keepAnyway)
             return null;
     }
@@ -112,7 +109,6 @@ async function runSetupWizard({ addMode }) {
     const hasExisting = accountsFileExists();
     printBanner();
     console.log(chalk.gray(`Platform: ${platform}\n`));
-    // If accounts already exist and we're not in add-mode, ask what to do
     if (hasExisting && !addMode) {
         const existing = loadAccounts();
         console.log(chalk.yellow(`  Found ${existing.length} existing account(s).\n`));
@@ -138,9 +134,7 @@ async function runSetupWizard({ addMode }) {
                 return;
             }
         }
-        // If 'add', we'll merge below
     }
-    // Guide for multi-account setup
     if (!addMode && isMacos()) {
         console.log(chalk.cyan("  Tip: to add multiple accounts, you need to:"));
         console.log(chalk.gray("  1. Log in to Claude Code with account 1 (already done if you use CC normally)"));
@@ -160,14 +154,14 @@ async function runSetupWizard({ addMode }) {
     for (let i = 0; i < numAccounts; i++) {
         const label = numAccounts > 1 ? `${i + 1}/${numAccounts}` : "";
         console.log(chalk.bold(`\n${"━".repeat(40)}\n  Account ${label}\n${"━".repeat(40)}\n`));
-        // If on macOS and this isn't the first account, remind user to switch accounts
         if (i > 0 && isMacos()) {
             console.log(chalk.yellow(`  Before extracting account ${i + 1}:\n` +
                 `  1. Run: ${chalk.white("claude logout")}\n` +
                 `  2. Run: ${chalk.white("claude login")}  (log in with your next Max account)\n`));
             await confirm({ message: "Ready?", default: true });
         }
-        const account = await setupSingleAccount(i + 1 + (hasExisting ? loadAccounts().length : 0));
+        const existingCount = hasExisting ? loadAccounts().length : 0;
+        const account = await setupSingleAccount(i + 1 + existingCount);
         if (account) {
             newAccounts.push(account);
             console.log(chalk.green(`\n  ✓ Account "${account.id}" ready.\n`));
@@ -180,25 +174,281 @@ async function runSetupWizard({ addMode }) {
         console.log(chalk.red("\n✗ No accounts configured. Run cc-router setup again.\n"));
         return;
     }
-    // Merge with existing accounts (by ID — new entries win on conflict)
-    const existing = hasExisting && !addMode ? [] : (hasExisting ? loadAccounts() : []);
-    const existingIds = new Set(existing.map(a => a.id));
+    // Merge: existing accounts minus any overwritten by ID, plus new ones
+    const existingAccounts = (hasExisting && !addMode) ? [] : (hasExisting ? loadAccounts() : []);
     const merged = [
-        ...existing.filter(a => !newAccounts.some(n => n.id === a.id)),
+        ...existingAccounts.filter(a => !newAccounts.some(n => n.id === a.id)),
         ...newAccounts,
     ];
-    console.log(chalk.bold(`\n${"━".repeat(40)}\n  Saving configuration\n${"━".repeat(40)}\n`));
-    // Save accounts.json (atomic write)
+    console.log(chalk.bold(`\n${"━".repeat(40)}\n  Saving\n${"━".repeat(40)}\n`));
     saveAccounts(merged);
-    console.log(chalk.green(`  ✓ Saved ${merged.length} account(s) to ~/.cc-router/accounts.json`));
-    // Write ~/.claude/settings.json
-    writeClaudeSettings(PROXY_PORT);
-    console.log(chalk.green(`  ✓ Updated ~/.claude/settings.json`));
-    console.log(chalk.gray(`      ANTHROPIC_BASE_URL = http://localhost:${PROXY_PORT}`));
-    console.log(chalk.gray(`      ANTHROPIC_AUTH_TOKEN = proxy-managed`));
-    printNextSteps(merged.length);
+    console.log(chalk.green(`  ✓ ${merged.length} account(s) saved to ~/.cc-router/accounts.json`));
+    // ─── Post-setup interactive flow ─────────────────────────────────────────
+    await runPostSetupFlow(merged.length);
 }
-// ─── Helpers ──────────────────────────────────────────────────────────────────
+// ─── Post-setup interactive flow ─────────────────────────────────────────────
+async function runPostSetupFlow(accountCount) {
+    console.log(chalk.bold(`\n${"━".repeat(40)}\n  Configure this machine\n${"━".repeat(40)}\n`));
+    // 1. Configure Claude Code on this machine
+    const currentSettings = readClaudeProxySettings();
+    const alreadyConfigured = currentSettings.baseUrl?.includes("localhost");
+    const configureLocal = await confirm({
+        message: alreadyConfigured
+            ? `Claude Code is already pointing to ${currentSettings.baseUrl}. Reconfigure?`
+            : "Configure Claude Code on this machine to use the proxy?",
+        default: true,
+    });
+    if (configureLocal) {
+        // Ask if this is a local proxy or a remote one
+        const proxyLocation = await select({
+            message: "Where will cc-router run?",
+            choices: [
+                { name: `On this machine  (localhost:${PROXY_PORT})`, value: "local" },
+                { name: "On another machine / VPS  (I'll enter the address)", value: "remote" },
+            ],
+        });
+        let proxyHost = `http://localhost:${PROXY_PORT}`;
+        if (proxyLocation === "remote") {
+            const remoteHost = await input({
+                message: "Proxy URL (e.g. http://192.168.1.50:3456 or https://cc-router.example.com):",
+                validate: (v) => {
+                    try {
+                        new URL(v);
+                        return true;
+                    }
+                    catch {
+                        return "Enter a valid URL (http:// or https://)";
+                    }
+                },
+            });
+            proxyHost = remoteHost.replace(/\/$/, ""); // strip trailing slash
+        }
+        const port = proxyLocation === "local"
+            ? PROXY_PORT
+            : parseInt(new URL(proxyHost).port || "80", 10);
+        // ── Password setup for remote proxy ───────────────────────────────────────
+        if (proxyLocation === "remote") {
+            const pwChoice = await select({
+                message: "Set a proxy password? (strongly recommended for internet-exposed proxies)",
+                choices: [
+                    { name: "Generate automatically  (recommended)", value: "generate" },
+                    { name: "Enter my own password", value: "manual" },
+                    { name: "Skip — no password protection", value: "skip" },
+                ],
+            });
+            let chosenSecret;
+            if (pwChoice === "generate") {
+                chosenSecret = generateProxySecret();
+                writeConfig({ ...readConfig(), proxySecret: chosenSecret });
+            }
+            else if (pwChoice === "manual") {
+                const raw = await password({
+                    message: "Enter proxy password:",
+                    validate: (v) => v.trim().length >= 8 || "Minimum 8 characters",
+                });
+                chosenSecret = raw.trim();
+                writeConfig({ ...readConfig(), proxySecret: chosenSecret });
+            }
+            writeClaudeSettings(port, proxyHost);
+            if (chosenSecret) {
+                console.log(chalk.yellow("\n  *** Save this password — you cannot recover it later ***"));
+                console.log("      " + chalk.bold(chosenSecret));
+                console.log(chalk.gray("  Claude Code has been configured to use it automatically."));
+                console.log(chalk.gray("  Other machines: cc-router configure --set-password <value>"));
+            }
+            else {
+                console.log(chalk.green(`\n  ✓ ~/.claude/settings.json updated`));
+                console.log(chalk.gray(`      ANTHROPIC_BASE_URL  = ${proxyHost}`));
+                console.log(chalk.gray(`      ANTHROPIC_AUTH_TOKEN = proxy-managed`));
+            }
+            console.log(chalk.cyan(`\n  On the remote machine, start cc-router with:`));
+            console.log(chalk.white(`    HOST=0.0.0.0 cc-router start`));
+            console.log(chalk.cyan(`  Or as a service:`));
+            console.log(chalk.white(`    cc-router service install\n`));
+            // Nothing more to do on this machine
+            printDone(accountCount);
+            return;
+        }
+        writeClaudeSettings(port, proxyHost);
+        console.log(chalk.green(`\n  ✓ ~/.claude/settings.json updated`));
+        console.log(chalk.gray(`      ANTHROPIC_BASE_URL  = ${proxyHost}`));
+        console.log(chalk.gray(`      ANTHROPIC_AUTH_TOKEN = proxy-managed`));
+    }
+    // 2. Only ask about starting the proxy if it's local
+    console.log(chalk.bold(`\n${"━".repeat(40)}\n  Start the proxy\n${"━".repeat(40)}\n`));
+    // Check if it's already running
+    const alreadyRunning = await isProxyRunning();
+    if (alreadyRunning) {
+        console.log(chalk.green(`  ✓ Proxy is already running on http://localhost:${PROXY_PORT}`));
+        printDone(accountCount);
+        return;
+    }
+    const startChoice = await select({
+        message: "How do you want to run the proxy?",
+        choices: [
+            { name: "Install as system service  (auto-start on boot — recommended)", value: "service" },
+            { name: "Start in background now  (current session only, via PM2)", value: "daemon" },
+            { name: "Start in foreground now  (this terminal, Ctrl+C to stop)", value: "foreground" },
+            { name: "I'll start it manually later", value: "skip" },
+        ],
+    });
+    if (startChoice === "service") {
+        await installService();
+    }
+    else if (startChoice === "daemon") {
+        await startDaemon();
+    }
+    else if (startChoice === "foreground") {
+        printDone(accountCount);
+        console.log(chalk.cyan("\nStarting proxy in foreground...\n"));
+        // Launch start as child — it blocks until Ctrl+C
+        await startForeground();
+        return; // startForeground never returns normally
+    }
+    printDone(accountCount);
+}
+// ─── Proxy launch helpers ─────────────────────────────────────────────────────
+async function isProxyRunning() {
+    try {
+        const res = await fetch(`http://localhost:${PROXY_PORT}/cc-router/health`, {
+            signal: AbortSignal.timeout(800),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function installService() {
+    console.log(chalk.cyan("\n  Installing as system service via PM2..."));
+    try {
+        // Ensure PM2 is installed
+        await execFileAsync("pm2", ["--version"]).catch(async () => {
+            console.log(chalk.gray("  Installing PM2..."));
+            await execFileAsync("npm", ["install", "-g", "pm2"]);
+        });
+        const { fileURLToPath } = await import("url");
+        const { dirname, join } = await import("path");
+        const __dirname = dirname(fileURLToPath(import.meta.url));
+        const cliEntry = join(__dirname, "index.js");
+        // Start in PM2
+        await execFileAsync("pm2", [
+            "start", cliEntry,
+            "--name", "cc-router",
+            "--interpreter", process.execPath,
+            "--max-memory-restart", "500M",
+            "--", "start",
+        ]).catch(async (err) => {
+            // Already registered — restart instead
+            if (err.message?.includes("already")) {
+                await execFileAsync("pm2", ["restart", "cc-router"]);
+            }
+            else {
+                throw err;
+            }
+        });
+        await execFileAsync("pm2", ["save"]);
+        console.log(chalk.green("  ✓ cc-router registered in PM2 and saved"));
+        // Generate startup hook
+        try {
+            const { stdout, stderr } = await execFileAsync("pm2", ["startup"]);
+            const combined = stdout + stderr;
+            const sudoMatch = combined.match(/sudo\s+\S.+/);
+            if (sudoMatch) {
+                console.log(chalk.yellow("\n  Run this command to complete auto-start setup:"));
+                console.log(chalk.white(`    ${sudoMatch[0]}`));
+                console.log(chalk.gray("  Then run: pm2 save"));
+            }
+            else {
+                console.log(chalk.green("  ✓ Auto-start on boot configured"));
+            }
+        }
+        catch (err) {
+            const combined = (err.stdout ?? "") +
+                (err.stderr ?? "");
+            const sudoMatch = combined.match(/sudo\s+\S.+/);
+            if (sudoMatch) {
+                console.log(chalk.yellow("\n  Run this command to complete auto-start setup:"));
+                console.log(chalk.white(`    ${sudoMatch[0]}`));
+                console.log(chalk.gray("  Then run: pm2 save"));
+            }
+        }
+        // Wait a moment and confirm it started
+        await new Promise(r => setTimeout(r, 1500));
+        const running = await isProxyRunning();
+        if (running) {
+            console.log(chalk.green(`  ✓ Proxy is running on http://localhost:${PROXY_PORT}`));
+        }
+        else {
+            console.log(chalk.yellow("  ⚠ Service registered but proxy not yet responding — it may still be starting."));
+            console.log(chalk.gray("    Check: cc-router service status"));
+        }
+    }
+    catch (err) {
+        console.log(chalk.red(`  ✗ Service install failed: ${err.message}`));
+        console.log(chalk.gray("  Try manually: cc-router service install"));
+    }
+}
+async function startDaemon() {
+    console.log(chalk.cyan("\n  Starting in background via PM2..."));
+    try {
+        const { fileURLToPath } = await import("url");
+        const { dirname, join } = await import("path");
+        const __dirname = dirname(fileURLToPath(import.meta.url));
+        const cliEntry = join(__dirname, "index.js");
+        await execFileAsync("pm2", [
+            "start", cliEntry,
+            "--name", "cc-router",
+            "--interpreter", process.execPath,
+            "--max-memory-restart", "500M",
+            "--", "start",
+        ]).catch(async (err) => {
+            if (err.message?.includes("already")) {
+                await execFileAsync("pm2", ["restart", "cc-router"]);
+            }
+            else {
+                throw err;
+            }
+        });
+        await new Promise(r => setTimeout(r, 1500));
+        const running = await isProxyRunning();
+        if (running) {
+            console.log(chalk.green(`  ✓ Proxy running in background on http://localhost:${PROXY_PORT}`));
+            console.log(chalk.gray("    Logs: pm2 logs cc-router  |  Stop: cc-router stop"));
+        }
+        else {
+            console.log(chalk.yellow("  ⚠ PM2 registered but proxy not yet responding."));
+            console.log(chalk.gray("    Check: pm2 logs cc-router"));
+        }
+    }
+    catch (err) {
+        console.log(chalk.red(`  ✗ Failed to start via PM2: ${err.message}`));
+        console.log(chalk.gray("  PM2 not installed? Run: npm install -g pm2"));
+        console.log(chalk.gray("  Or start manually: cc-router start"));
+    }
+}
+async function startForeground() {
+    const { fileURLToPath } = await import("url");
+    const { dirname, join } = await import("path");
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    const cliEntry = join(__dirname, "index.js");
+    const child = spawn(process.execPath, [cliEntry, "start"], { stdio: "inherit" });
+    await new Promise((resolve) => {
+        child.on("close", resolve);
+        child.on("error", (err) => {
+            console.error(chalk.red(`  ✗ ${err.message}`));
+            resolve();
+        });
+    });
+}
+// ─── Done banner ──────────────────────────────────────────────────────────────
+function printDone(accountCount) {
+    console.log(chalk.bold(`\n${"━".repeat(40)}\n  All done — ${accountCount} account(s) ready\n${"━".repeat(40)}\n`));
+    console.log(`  Dashboard:         ${chalk.cyan("cc-router status")}`);
+    console.log(`  Add more accounts: ${chalk.cyan("cc-router setup --add")}`);
+    console.log(`  Stop & revert:     ${chalk.cyan("cc-router revert")}\n`);
+}
+// ─── Manual token input ───────────────────────────────────────────────────────
 async function promptManualTokens() {
     console.log(chalk.gray("\n  You can find your tokens by running:\n" +
         "    macOS:         security find-generic-password -s 'Claude Code-credentials' -w\n" +
@@ -217,16 +467,13 @@ async function promptManualTokens() {
             ? true
             : "Must start with sk-ant-ort01-",
     });
-    // expiresAt is optional — default to 8h from now
     const useDefaultExpiry = await confirm({
         message: "Use default expiry (8 hours from now)?",
         default: true,
     });
     const expiresAt = useDefaultExpiry
         ? Date.now() + 8 * 60 * 60 * 1000
-        : new Date(await input({
-            message: "Paste expiresAt (ISO date or ms timestamp):",
-        })).getTime();
+        : new Date(await input({ message: "Paste expiresAt (ISO date or ms timestamp):" })).getTime();
     return {
         accessToken,
         refreshToken,
@@ -239,10 +486,3 @@ function printBanner() {
         "║  CC-Router — Setup                       ║\n" +
         "╚══════════════════════════════════════════╝\n"));
 }
-function printNextSteps(accountCount) {
-    console.log(chalk.bold(`\n${"━".repeat(40)}\n  Done — ${accountCount} account(s) configured\n${"━".repeat(40)}\n`));
-    console.log(`  Start proxy:       ${chalk.cyan("cc-router start")}`);
-    console.log(`  Auto-start:        ${chalk.cyan("cc-router service install")}`);
-    console.log(`  Live dashboard:    ${chalk.cyan("cc-router status")}`);
-    console.log(`  Add more accounts: ${chalk.cyan("cc-router setup --add")}\n`);
-}

package/dist/config/manager.js

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "fs";
-import { CONFIG_DIR, ACCOUNTS_PATH } from "./paths.js";
+import { randomBytes } from "crypto";
+import { CONFIG_DIR, ACCOUNTS_PATH, CONFIG_PATH } from "./paths.js";
 export function ensureConfigDir() {
     if (!existsSync(CONFIG_DIR)) {
         mkdirSync(CONFIG_DIR, { recursive: true });
@@ -36,6 +37,26 @@ export function writeAccountsAtomic(data) {
 export function loadAccounts() {
     return deserialize(readAccountsRaw());
 }
+export function readConfig() {
+    if (!existsSync(CONFIG_PATH))
+        return {};
+    try {
+        return JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function writeConfig(cfg) {
+    ensureConfigDir();
+    const tmp = CONFIG_PATH + ".tmp";
+    writeFileSync(tmp, JSON.stringify(cfg, null, 2), "utf-8");
+    renameSync(tmp, CONFIG_PATH);
+}
+export function generateProxySecret() {
+    return "cc-rtr-" + randomBytes(16).toString("hex");
+}
+// ─── Accounts ─────────────────────────────────────────────────────────────────
 function deserialize(records) {
     return records.map(a => ({
         id: a.id,

package/dist/config/paths.js

@@ -9,3 +9,6 @@ export const PROXY_PORT = parseInt(process.env["PORT"] ?? "3456", 10);
 export const LITELLM_PORT = 4000;
 // When set, the server forwards to LiteLLM instead of Anthropic directly
 export const LITELLM_URL = process.env["LITELLM_URL"];
+// Proxy-level config (password, future settings) — separate from accounts.json
+export const CONFIG_PATH = process.env["CONFIG_PATH"] ??
+    path.join(CONFIG_DIR, "config.json");

package/dist/proxy/server.js

@@ -1,9 +1,10 @@
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
 import { ServerResponse } from "http";
+import { timingSafeEqual } from "crypto";
 import { TokenPool } from "./token-pool.js";
 import { needsRefresh, refreshAccountToken, saveAccounts, startRefreshLoop } from "./token-refresher.js";
-import { loadAccounts, accountsFileExists, readAccountsFromPath } from "../config/manager.js";
+import { loadAccounts, accountsFileExists, readAccountsFromPath, readConfig } from "../config/manager.js";
 import { logRoute, logError, logStartup } from "./logger.js";
 import { stats } from "./stats.js";
 import { PROXY_PORT, LITELLM_URL } from "../config/paths.js";
@@ -30,6 +31,30 @@ export async function startServer(opts = {}) {
     const pool = new TokenPool(accounts);
     startRefreshLoop(accounts);
     const app = express();
+    // ─── Proxy auth middleware ─────────────────────────────────────────────────
+    // If a proxySecret is configured, all requests must present it as
+    // "Authorization: Bearer <secret>". The /cc-router/health endpoint is
+    // always exempt so monitoring and PM2 healthchecks keep working.
+    const { proxySecret } = readConfig();
+    if (proxySecret) {
+        const secretBuf = Buffer.from(proxySecret, "utf-8");
+        app.use((req, res, next) => {
+            if (req.path === "/cc-router/health")
+                return next();
+            const auth = req.headers["authorization"] ?? "";
+            const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+            const tokenBuf = Buffer.from(token, "utf-8");
+            if (tokenBuf.length !== secretBuf.length ||
+                !timingSafeEqual(tokenBuf, secretBuf)) {
+                res.status(401).json({
+                    type: "error",
+                    error: { type: "authentication_error", message: "Invalid or missing proxy authentication token" },
+                });
+                return;
+            }
+            next();
+        });
+    }
     // ─── Health endpoint (cc-router internal, NOT proxied) ────────────────────
     app.get("/cc-router/health", (_req, res) => {
         res.json({
@@ -41,7 +66,7 @@ export async function startServer(opts = {}) {
             totalErrors: stats.totalErrors,
             totalRefreshes: stats.totalRefreshes,
             accounts: pool.getStats(),
-            recentLogs: stats.getRecentLogs(),
+            recentLogs: stats.getRecentLogs(50),
         });
     });
     // ─── Proxy middleware ──────────────────────────────────────────────────────
@@ -90,42 +115,70 @@ export async function startServer(opts = {}) {
                 if (!account)
                     return;
                 const status = proxyRes.statusCode ?? 0;
+                const durationMs = req._startTime
+                    ? Date.now() - req._startTime
+                    : undefined;
+                // Complete the pending log entry with response info
+                const pendingLog = req._pendingLog ?? {
+                    ts: Date.now(),
+                    accountId: account.id,
+                    model: "-",
+                    type: "route",
+                };
+                pendingLog.statusCode = status;
+                if (durationMs !== undefined)
+                    pendingLog.durationMs = durationMs;
                 if (status === 401) {
                     // Token invalid or expired mid-request.
                     // Forward the 401 to the client (Claude Code will retry on 401).
                     // Schedule a background refresh so the next request succeeds.
                     stats.totalErrors++;
                     account.errorCount++;
+                    pendingLog.type = "error";
+                    pendingLog.details = "token invalid";
                     logError(account.id, 401, "Token invalid — scheduling background refresh");
-                    stats.addLog({ ts: Date.now(), accountId: account.id, model: "-", type: "error", details: "401" });
                     refreshAccountToken(account).then(ok => {
                         if (ok)
                             saveAccounts(pool.getAll());
                     }).catch(console.error);
                 }
-                if (status === 429) {
+                else if (status === 429) {
                     // Rate limited — put account on cooldown for Retry-After seconds.
                     stats.totalErrors++;
                     account.errorCount++;
                     const retryAfter = Number(proxyRes.headers["retry-after"] ?? 60);
+                    pendingLog.type = "error";
+                    pendingLog.details = `rate limited — cooldown ${retryAfter}s`;
                     logError(account.id, 429, `Rate limited — cooldown ${retryAfter}s`);
-                    stats.addLog({ ts: Date.now(), accountId: account.id, model: "-", type: "error", details: "429" });
                     account.busy = true;
                     setTimeout(() => { account.busy = false; }, retryAfter * 1_000);
                 }
-                if (status === 529) {
+                else if (status === 529) {
                     // Anthropic service overloaded — short cooldown on this account.
                     stats.totalErrors++;
                     account.errorCount++;
+                    pendingLog.type = "error";
+                    pendingLog.details = "service overloaded — cooldown 30s";
                     logError(account.id, 529, "Service overloaded — cooldown 30s");
-                    stats.addLog({ ts: Date.now(), accountId: account.id, model: "-", type: "error", details: "529" });
                     account.busy = true;
                     setTimeout(() => { account.busy = false; }, 30_000);
                 }
+                stats.addLog(pendingLog);
             },
             error: (err, _req, res) => {
                 stats.totalErrors++;
                 logError("proxy", 0, err.message);
+                // Complete the pending log entry for connection-level errors
+                const pendingLog = _req._pendingLog;
+                if (pendingLog) {
+                    pendingLog.type = "error";
+                    pendingLog.statusCode = 0;
+                    pendingLog.details = err.message;
+                    if (_req._startTime) {
+                        pendingLog.durationMs = Date.now() - _req._startTime;
+                    }
+                    stats.addLog(pendingLog);
+                }
                 // res may be a Socket (WebSocket upgrade) — only respond on HTTP ServerResponse
                 if (res instanceof ServerResponse && !res.headersSent) {
                     // Match Anthropic's error response format so Claude Code handles it gracefully
@@ -150,8 +203,16 @@ export async function startServer(opts = {}) {
                 saveAccounts(pool.getAll());
         }
         req._ccAccount = account;
+        req._startTime = Date.now();
+        req._pendingLog = {
+            ts: Date.now(),
+            accountId: account.id,
+            model: "-",
+            type: "route",
+            method: req.method,
+            path: req.path,
+        };
         stats.totalRequests++;
-        stats.addLog({ ts: Date.now(), accountId: account.id, model: "?", type: "route" });
         logRoute(account.id, account.requestCount, Math.round((account.tokens.expiresAt - Date.now()) / 60_000));
         next();
     }, proxy);

package/dist/proxy/stats.js

@@ -1,4 +1,4 @@
-const MAX_LOG_ENTRIES = 50;
+const MAX_LOG_ENTRIES = 100;
 class ProxyStats {
     totalRequests = 0;
     totalErrors = 0;

package/dist/ui/Dashboard.js

@@ -1,7 +1,8 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
 import { Box, Text, useInput, useApp } from "ink";
 const POLL_INTERVAL_MS = 2_000;
+const LOG_VISIBLE = 20;
 // ─── Dashboard component ──────────────────────────────────────────────────────
 export function Dashboard({ port }) {
     const { exit } = useApp();
@@ -59,9 +60,28 @@ function ErrorScreen({ error, port, retries }) {
 function LiveDashboard({ data, port, lastUpdate }) {
     const healthyCount = data.accounts.filter(a => a.healthy).length;
     const updatedAgo = Math.round((Date.now() - lastUpdate) / 1000);
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, color: "cyan", children: " CC-Router " }), _jsx(Text, { color: "gray", children: "\u00B7 " }), _jsx(Text, { color: "green", children: data.mode }), _jsxs(Text, { color: "gray", children: [" \u2192 ", data.target, "  \u00B7 "] }), _jsxs(Text, { children: ["up ", formatUptime(data.uptime)] }), _jsxs(Text, { color: "gray", children: ["  \u00B7  updated ", updatedAgo, "s ago  \u00B7  [q] quit"] })] }), _jsx(Box, { marginTop: 1 }), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, children: [" ACCOUNTS  ", _jsxs(Text, { color: healthyCount === data.accounts.length ? "green" : "yellow", children: [healthyCount, "/", data.accounts.length, " healthy"] })] }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: data.accounts.map(a => (_jsx(AccountRow, { account: a }, a.id))) })] }), _jsx(Box, { marginTop: 1 }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: " TOTALS  " }), _jsx(Text, { children: "requests " }), _jsx(Text, { color: "cyan", children: data.totalRequests }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "errors " }), _jsx(Text, { color: data.totalErrors > 0 ? "red" : "green", children: data.totalErrors }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "refreshes " }), _jsx(Text, { color: "yellow", children: data.totalRefreshes })] }), _jsx(Box, { marginTop: 1 }), _jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: " RECENT ACTIVITY" }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: data.recentLogs.length === 0
+    const logs = data.recentLogs;
+    // Stable selection: track by timestamp so it survives log rotations
+    const [selectedTs, setSelectedTs] = useState(null);
+    // Derive index from timestamp; default to 0 (newest)
+    const selectedIndex = selectedTs !== null
+        ? Math.max(0, logs.findIndex(l => l.ts === selectedTs))
+        : 0;
+    useInput((_input, key) => {
+        if (key.upArrow) {
+            const next = Math.max(0, selectedIndex - 1);
+            setSelectedTs(logs[next]?.ts ?? null);
+        }
+        if (key.downArrow) {
+            const next = Math.min(logs.length - 1, selectedIndex + 1);
+            setSelectedTs(logs[next]?.ts ?? null);
+        }
+    });
+    const selectedLog = logs[selectedIndex] ?? null;
+    const visibleLogs = logs.slice(0, LOG_VISIBLE);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, color: "cyan", children: " CC-Router " }), _jsx(Text, { color: "gray", children: "\u00B7 " }), _jsx(Text, { color: "green", children: data.mode }), _jsxs(Text, { color: "gray", children: [" \u2192 ", data.target, "  \u00B7 "] }), _jsxs(Text, { children: ["up ", formatUptime(data.uptime)] }), _jsxs(Text, { color: "gray", children: ["  \u00B7  updated ", updatedAgo, "s ago  \u00B7  [\u2191\u2193] navigate  \u00B7  [q] quit"] })] }), _jsx(Box, { marginTop: 1 }), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, children: [" ACCOUNTS  ", _jsxs(Text, { color: healthyCount === data.accounts.length ? "green" : "yellow", children: [healthyCount, "/", data.accounts.length, " healthy"] })] }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: data.accounts.map(a => (_jsx(AccountRow, { account: a }, a.id))) })] }), _jsx(Box, { marginTop: 1 }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: " TOTALS  " }), _jsx(Text, { children: "requests " }), _jsx(Text, { color: "cyan", children: data.totalRequests }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "errors " }), _jsx(Text, { color: data.totalErrors > 0 ? "red" : "green", children: data.totalErrors }), _jsx(Text, { color: "gray", children: "  \u00B7  " }), _jsx(Text, { children: "refreshes " }), _jsx(Text, { color: "yellow", children: data.totalRefreshes })] }), _jsx(Box, { marginTop: 1 }), _jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: " RECENT ACTIVITY" }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: visibleLogs.length === 0
                             ? _jsx(Text, { color: "gray", children: "  No activity yet" })
-                            : data.recentLogs.slice(0, 10).map((log, i) => (_jsx(LogRow, { log: log }, i))) })] })] }));
+                            : visibleLogs.map((log, i) => (_jsx(LogRow, { log: log, selected: i === selectedIndex }, log.ts))) })] }), selectedLog && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1 }), _jsx(DetailPanel, { log: selectedLog })] }))] }));
 }
 // ─── Account row ──────────────────────────────────────────────────────────────
 function AccountRow({ account: a }) {
@@ -76,11 +96,57 @@ function AccountRow({ account: a }) {
     return (_jsxs(Box, { children: [_jsxs(Text, { color: dotColor, children: [" ", dot, " "] }), _jsx(Text, { children: a.id.slice(0, 22).padEnd(22) }), _jsx(Text, { color: statusColor, children: statusLabel }), _jsx(Text, { color: "gray", children: " req " }), _jsx(Text, { color: "white", children: String(a.requestCount).padStart(5) }), _jsx(Text, { color: "gray", children: "  err " }), _jsx(Text, { color: a.errorCount > 0 ? "red" : "gray", children: String(a.errorCount).padStart(3) }), _jsx(Text, { color: "gray", children: "  expires " }), _jsx(Text, { color: expiryColor, children: expiryLabel.padEnd(10) }), _jsx(Text, { color: "gray", children: "  last " }), _jsx(Text, { color: "gray", children: formatAgo(a.lastUsedMs) })] }));
 }
 // ─── Log row ──────────────────────────────────────────────────────────────────
-function LogRow({ log }) {
+function LogRow({ log, selected }) {
     const time = new Date(log.ts).toLocaleTimeString("en-GB", { hour12: false });
-    const typeColor = log.type === "error" ? "red" : log.type === "refresh" ? "yellow" : "gray";
-    const typeIcon = log.type === "error" ? "✗" : log.type === "refresh" ? "↻" : "→";
-    return (_jsxs(Box, { children: [_jsxs(Text, { color: "gray", children: ["  ", time, "  "] }), _jsxs(Text, { color: typeColor, children: [typeIcon, " "] }), _jsx(Text, { color: "cyan", children: log.accountId.slice(0, 22).padEnd(22) }), _jsxs(Text, { color: typeColor, children: [" ", log.type] }), log.details && _jsxs(Text, { color: "gray", children: ["  ", log.details] })] }));
+    const isError = log.type === "error";
+    const isRefresh = log.type === "refresh";
+    const typeColor = isError ? "red" : isRefresh ? "yellow" : "gray";
+    const typeIcon = isError ? "✗" : isRefresh ? "↻" : "→";
+    const statusColor = log.statusCode === undefined ? undefined
+        : log.statusCode >= 500 ? "red"
+            : log.statusCode >= 400 ? "yellow"
+                : log.statusCode >= 200 ? "green"
+                    : "gray";
+    const bg = selected ? "white" : undefined;
+    const fg = (c) => selected ? "black" : c;
+    return (_jsxs(Box, { children: [_jsxs(Text, { backgroundColor: bg, color: fg(undefined), children: [selected ? "▶" : " ", " ", time, "  "] }), _jsxs(Text, { backgroundColor: bg, color: fg(typeColor), children: [typeIcon, " "] }), _jsx(Text, { backgroundColor: bg, color: fg("cyan"), children: log.accountId.slice(0, 22).padEnd(22) }), log.method && log.path
+                ? _jsxs(Text, { backgroundColor: bg, color: fg("white"), children: [" ", log.method, " ", log.path.padEnd(14)] })
+                : _jsxs(Text, { backgroundColor: bg, color: fg(typeColor), children: [" ", log.type.padEnd(9)] }), log.statusCode !== undefined && (_jsxs(Text, { backgroundColor: bg, color: fg(statusColor), children: [" ", log.statusCode] })), log.durationMs !== undefined && (_jsxs(Text, { backgroundColor: bg, color: fg("gray"), children: [" ", log.durationMs, "ms"] })), log.details && (_jsxs(Text, { backgroundColor: bg, color: fg("gray"), children: ["  ", log.details] }))] }));
+}
+// ─── Detail panel ─────────────────────────────────────────────────────────────
+function DetailPanel({ log }) {
+    const time = new Date(log.ts).toLocaleString("en-GB", {
+        hour12: false,
+        year: "numeric", month: "2-digit", day: "2-digit",
+        hour: "2-digit", minute: "2-digit", second: "2-digit",
+    });
+    const isError = log.type === "error";
+    const statusLabel = log.statusCode === undefined ? "—"
+        : log.statusCode === 0 ? "connection error"
+            : `${log.statusCode} ${httpStatusText(log.statusCode)}`;
+    const statusColor = log.statusCode === undefined ? "gray"
+        : log.statusCode === 0 ? "red"
+            : log.statusCode >= 500 ? "red"
+                : log.statusCode >= 400 ? "yellow"
+                    : "green";
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "single", borderColor: "gray", paddingX: 1, children: [_jsx(Text, { bold: true, color: isError ? "red" : "cyan", children: " DETAILS " }), _jsxs(Box, { marginTop: 1, flexDirection: "column", gap: 0, children: [_jsxs(Box, { gap: 2, children: [_jsx(Field, { label: "Time", value: time }), _jsx(Field, { label: "Account", value: log.accountId })] }), _jsxs(Box, { gap: 2, children: [_jsx(Field, { label: "Method", value: log.method ?? "—" }), _jsx(Field, { label: "Path", value: log.path ?? "—" })] }), _jsxs(Box, { gap: 2, children: [_jsx(FieldColored, { label: "Status", value: statusLabel, color: statusColor }), _jsx(Field, { label: "Duration", value: log.durationMs !== undefined ? `${log.durationMs}ms` : "—" }), _jsx(Field, { label: "Type", value: log.type })] }), log.details && (_jsx(Box, { children: _jsx(Field, { label: "Details", value: log.details }) }))] })] }));
+}
+function Field({ label, value }) {
+    return (_jsxs(Box, { children: [_jsxs(Text, { color: "gray", children: [label, ": "] }), _jsx(Text, { color: "white", children: value })] }));
+}
+function FieldColored({ label, value, color }) {
+    return (_jsxs(Box, { children: [_jsxs(Text, { color: "gray", children: [label, ": "] }), _jsx(Text, { color: color, children: value })] }));
+}
+// ─── HTTP status text ─────────────────────────────────────────────────────────
+function httpStatusText(code) {
+    const map = {
+        200: "OK", 201: "Created", 204: "No Content",
+        400: "Bad Request", 401: "Unauthorized", 403: "Forbidden",
+        404: "Not Found", 429: "Too Many Requests",
+        500: "Internal Server Error", 502: "Bad Gateway",
+        503: "Service Unavailable", 529: "Overloaded",
+    };
+    return map[code] ?? "";
 }
 // ─── Formatters ───────────────────────────────────────────────────────────────
 function formatUptime(seconds) {

package/dist/utils/claude-config.js

@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
 import { dirname } from "path";
 import { CLAUDE_SETTINGS_PATH } from "../config/paths.js";
+import { readConfig } from "../config/manager.js";
 /**
  * Write ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN into ~/.claude/settings.json.
  *
@@ -9,7 +10,12 @@ import { CLAUDE_SETTINGS_PATH } from "../config/paths.js";
  *   - Do NOT append /v1 to ANTHROPIC_BASE_URL — Claude Code adds it automatically
  *   - Merges with existing settings, preserving all other keys
  */
-export function writeClaudeSettings(port) {
+/**
+ * @param port - proxy port (used only when baseUrl is not provided)
+ * @param baseUrl - full proxy URL e.g. "http://192.168.1.50:3456" or "https://cc-router.example.com"
+ *                  If omitted, defaults to http://localhost:<port>
+ */
+export function writeClaudeSettings(port, baseUrl) {
     const dir = dirname(CLAUDE_SETTINGS_PATH);
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
@@ -23,15 +29,16 @@ export function writeClaudeSettings(port) {
         }
     }
     const existingEnv = existing["env"] ?? {};
+    // ANTHROPIC_BASE_URL: no trailing /v1 — Claude Code appends it automatically
+    const resolvedUrl = baseUrl ?? `http://localhost:${port}`;
     const updated = {
         ...existing,
         env: {
             ...existingEnv,
-            // ANTHROPIC_BASE_URL: no trailing /v1 — Claude Code appends it automatically
-            ANTHROPIC_BASE_URL: `http://localhost:${port}`,
+            ANTHROPIC_BASE_URL: resolvedUrl,
             // ANTHROPIC_AUTH_TOKEN has higher precedence than ANTHROPIC_API_KEY in Claude Code.
-            // The proxy replaces this placeholder with the real OAuth token per request.
-            ANTHROPIC_AUTH_TOKEN: "proxy-managed",
+            // Uses the configured proxy secret if set, otherwise falls back to the open placeholder.
+            ANTHROPIC_AUTH_TOKEN: readConfig().proxySecret ?? "proxy-managed",
         },
     };
     writeFileSync(CLAUDE_SETTINGS_PATH, JSON.stringify(updated, null, 2), "utf-8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-cc-router",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Round-robin proxy for Claude Max OAuth tokens — use multiple Claude Max accounts with Claude Code",
   "type": "module",
   "bin": {