clauderipple 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # Changelog
 
+## 0.3.0 — 2026-09-23
+
+Everything on `main` since 0.2.0. The account rotation that issue #8 asked for
+was on `main` from 2026-09-20 while the README already described it, but no
+release carried it. A user looking for the setting in 0.2.0 could not find it.
+
+### Added
+
+- **Claude subscription account rotation.** A native Anthropic provider can opt in
+  with `accountPool: true` and use the current Claude Code/Desktop login followed by
+  every OAuth account added through ClaudeRipple. Conversations stay on the account
+  that answered to preserve the prompt cache; before any response reaches the client,
+  429, 401 and transient upstream failures can move the same turn to the next account.
+  Stored grants refresh independently with single-flight and compare-and-swap safety,
+  rejected accounts are isolated until re-login, and the dashboard can rename or
+  remove them without exposing a token or upstream account id. Existing single-account
+  OAuth grants migrate to the private `~/.clauderipple/claude-accounts.json` file on
+  the first pool write. This applies to native Claude Desktop/Claude Code Messages;
+  the translated OpenAI ingress for Codex picks one highest-priority available login
+  per request but deliberately does not rotate accounts.
+- **ChatGPT subscription web search.** When `webSearch` explicitly names a
+  ChatGPT provider, Claude Code's separate search request uses the subscription's
+  Codex hosted-search tool instead of silently consuming Anthropic quota. The
+  adapter requires a reported search and URL citations, preserves allowed-domain
+  filters, and refuses unsupported blocked-domain filters.
+- **New ChatGPT models appear without an update.** The model list is read from
+  the Codex catalogue the subscription serves, not from a list in the code, so
+  GPT-6 Sol and GPT-6 Luna showed up the day they shipped. If the catalogue
+  cannot be read, a built-in list is used instead. Newly found models are
+  offered unticked. Claude Opus 5.5 is in the Claude list.
+- **Credential pools and route fallbacks.** A provider can hold several keys. A
+  rate-limited or refused key rests until its cooldown ends, and the turn moves
+  to the next key before the client sees the failure. A model slot can name
+  fallback providers for when the primary has nothing usable left. The
+  dashboard shows which credential is resting, and until when.
+- **OpenCode Go and OpenCode Zen presets.** One OpenCode Go subscription is one
+  preset covering all three of its endpoints, each with the session header its
+  prompt cache needs. Each model's request format is taken from the vendor's
+  published endpoint table. After a provider is saved, its models are measured
+  for request format and effort levels instead of being assumed.
+- **A ticked model is a subagent.** Every model ticked in the GUI gets a
+  generated agent file. A model that only one provider carries routes there
+  without a hand-written rule. A model no provider carries is refused with a
+  message naming it, instead of being sent to Anthropic and coming back 404.
+- **Web search in a routed session.** It reaches a provider that runs the
+  search tool itself, uses ChatGPT's hosted search when configured, and is
+  refused with a reason where no provider can run it.
+- **Claude Code's own model slots as a setting.**
+
+### Fixed
+
+- **A cut-off stream is retried, not taken as the answer.** An upstream that
+  closed the stream without finishing used to become an empty, successful
+  turn. A subagent then stopped silently, which is how long Muse runs appeared
+  to stall and die. The turn now fails as overloaded, and Claude Code retries it.
+- **The Codex prompt cache holds across turns again.** The conversation is
+  named to the Codex backend, which now keys its cache on that name.
+- **The provider form no longer wipes settings it does not show.** Saving a
+  ChatGPT provider in the GUI dropped fields such as `instructionsAppend`.
+- **The request log shows a request's whole input.** A fully cached Anthropic
+  turn used to read as a 2-token request. The model column no longer shows
+  the agent file's default effort next to the effort that was actually sent.
+- **Routed models keep their own context window,** including across a model
+  switch, and tool names the wire rejects are rewritten and restored.
+- **Screenshots in tool results survive translation.**
+
+- **Remote Control works through the forward proxy.** Claude Code sends its
+  registration, polling and heartbeat requests in HTTPS absolute-form rather
+  than CONNECT. ClaudeRipple now rewrites only the request target, strips proxy
+  headers and relays it over TLS outside model routing. The connection closes
+  after one request so another proxy target cannot leak to the first origin.
+- **Windows reinstall is idempotent without elevation.** An existing scheduled
+  task is reused only when its action, principal, trigger, restart policy,
+  execution limit, instance policy and battery settings all match the intended
+  per-user task. A foreign or stale task is never trusted.
+
 ## 0.2.0 — 2026-09-16
 
 The first release published to npm, and the reason the number moves to 0.2:

package/README.ko.md

@@ -150,7 +150,11 @@ ClaudeRipple은 Claude Code 프로세스만 신뢰하는 작은 HTTPS 프록시
   GPT-6 Astra를, 아니면 DeepSeek·Kimi·GLM·MiniMax·Qwen·Grok·Mistral·Groq·Together·Fireworks·OpenRouter(400+ 모델)·
   로컬 Ollama / LM Studio를. 피커에 실제 이름으로 띄우거나, Claude 이름에 매핑해서.
 - **Codex 앱과 Codex CLI에서 Claude를.** Codex가 프로바이더로 인식하는 로컬 OpenAI 호환 엔드포인트. Claude 모델이
-  Codex 자체 모델 목록에 뜹니다. Claude Code 로그인이나 Anthropic API 키를 씁니다.
+  Codex 자체 모델 목록에 뜹니다. 현재 Claude Code 로그인이나 Anthropic API 키를 씁니다.
+- **프롬프트 캐시를 깨지 않는 Claude 다계정.** 네이티브 Claude 프로바이더에서 계정 자동 전환을 켜고 대시보드로
+  구독 계정을 추가하면, 대화마다 답한 계정에 고정됩니다. 응답이 시작되기 전 한도·인증 거부가 오면 같은 요청을
+  다음 계정으로 넘깁니다. 이 Claude Desktop/Code 원형 경로는 번역을 거치는 Codex 입구와 별개이며, Codex 쪽은
+  사용 가능한 로그인 하나만 골라 쓰고 계정을 자동 전환하지 않습니다.
 - **Claude Code 하네스는 손대지 않습니다.** 스킬, 훅, MCP, `CLAUDE.md`, 서브에이전트, 플랜 모드, 휴대폰 Remote Control.
   아무것도 꺼지지 않습니다.
 - **구조적으로 올바르게.** 프롬프트 캐시 보존(Anthropic 캐시 브레이크포인트, 고정된 OpenAI 프리픽스), Claude Code의
@@ -249,6 +253,45 @@ node packages/cli/src/index.ts ui        # 브라우저에서 로컬 GUI 열기
 같은 라우터, 같은 매핑. `/model gpt-5.6-terra`에 추가한 모델이 나열됩니다. 서브에이전트도 같은 라우팅을 따르고,
 프롬프트에 `[[gpt: sol@xhigh]]` 표식을 넣으면 그 호출만 모델을 바꿉니다. 작업 패널에는 실제 모델 이름이 보입니다.
 
+**이걸 쓰려고 하네스를 따로 짤 필요는 없습니다.** 서브에이전트 슬롯을 라우팅된 모델로 지정하면
+모든 서브에이전트가 그 모델로 돕니다. 에이전트 파일도, 다른 것도 필요 없습니다.
+
+```jsonc
+// 설정 → CLI 모델, 또는 설정 파일의 "cli": { "models": { … } }
+{ "subagent": "gpt-5.6-terra" }   // → CLAUDE_CODE_SUBAGENT_MODEL
+```
+
+**체크한 모델은 곧 이름 붙은 서브에이전트입니다.** 프로바이더 하나만 들고 있는 모델마다 라우터가
+`~/.claude/agents/<이름>.md`를 씁니다(`gpt-5.6-terra` → `gpt-5-6-terra`, `deepseek-v4.1-flash` →
+`deepseek-v4-1-flash`). 그래서 "딥시크한테 시켜"에 필요한 건 모델 체크뿐입니다 — Agent 도구 목록에 뜨고,
+`subagent_type: "deepseek-v4-1-flash"`로 돌고, 작업 패널에 그 이름이 보입니다. 체크를 빼면 파일도 사라집니다.
+라우터는 자기가 쓴 파일만 건드리고(`generated-agents.json`에 기록), 같은 이름으로 직접 쓴 파일이 있으면
+그쪽이 이기므로, 지시를 따로 주고 싶으면 Claude Code 에이전트 파일에 라우터가 아는 `model:`만 적으면 됩니다:
+
+```markdown
+---
+name: reviewer
+description: GPT-5.6 Sol로 독립 리뷰.
+model: gpt-5.6-sol@medium
+---
+너는 이 세션의 리뷰어다. 변경을 직접 검증해서 결론만 보고한다.
+```
+
+호출마다 강도를 바꾸려면 서브에이전트 프롬프트 **첫 줄**에 `[[ripple: gpt-5-6-terra@high]]`처럼 적습니다 —
+에이전트 이름이든 모델 id든 됩니다. 첫 줄이 아닌 곳의 표식은 그냥 글이라 무시합니다(압축 요약에 인용된
+표식이 세션을 엉뚱한 곳으로 보내면 안 되니까요). 라우터가 보낼 곳을 모르는 모델은 어디론가 흘려보내
+알 수 없는 에러로 죽게 두지 않고 이름을 대고 거부합니다(`400 ClaudeRipple: no provider declares "…"`).
+Claude 모델은 언제나 그대로 통과합니다. 생성을 끄려면 `"cli": { "agentFiles": false }`.
+
+Claude Code의 `WebSearch`는 작은 모델에 별도 요청을 보냅니다. ChatGPT로 라우팅한 구성에서 그 요청만
+Anthropic 한도를 쓰지 않게 하려면 `config.json`에서 같은 ChatGPT 프로바이더를 검색 백엔드로 지정합니다:
+
+```jsonc
+{ "webSearch": { "provider": "chatgpt", "model": "gpt-5.6-terra" } }
+```
+
+명시해야만 켜집니다. `webSearch` 설정이 없으면 Claude Code의 기존 검색 경로는 바뀌지 않습니다.
+
 ### Codex 앱과 Codex CLI
 
 ```bash
@@ -275,7 +318,7 @@ Anthropic API 키로 갑니다. 구독 로그인 재사용은 Anthropic 약관
 | DeepSeek, Kimi, Z.ai GLM, MiniMax, Qwen(국제/중국) | Anthropic 호환 | API 키 | 프리셋 | 벤더 공식 문서로 확인 |
 | xAI Grok, Mistral, Groq, Together, Fireworks | OpenAI 호환 | API 키 | 자동 검색 | 번역(Chat Completions / Responses) |
 | Ollama, LM Studio | OpenAI 호환, 로컬 | 없음 | 자동 검색 | |
-| Anthropic | 네이티브 | Claude Code 로그인 또는 API 키 | Claude 모델 | Codex 쪽에서 사용 |
+| Anthropic | 네이티브 | Claude 로그인(복수 가능) 또는 API 키 | Claude 모델 | Claude Desktop/Code는 선택적 대화 고정 자동 전환, Codex는 로그인 하나 선택 |
 | 그 밖의 무엇이든 | 직접 입력 | 자유 | 자동 검색 | Anthropic·OpenAI 호환 엔드포인트라면 무엇이든 |
 
 호환 프로바이더로 가는 요청에서는 Anthropic 전용 필드(서버 측 스레드, 지연 로딩 도구, 컨텍스트 관리, thinking 바인딩)를
@@ -303,8 +346,9 @@ Codex 앱 / CLI ──/v1/responses──▶ ClaudeRipple 입구 ──▶ Claud
 
 ## 개인정보
 
-전부 127.0.0.1에서 돕니다. API 키는 `~/.clauderipple/config.json`(0600)에만 있습니다. 네트워크 목적지는 직접 설정한
-프로바이더뿐입니다. 텔레메트리는 없습니다.
+전부 127.0.0.1에서 돕니다. API 키는 `~/.clauderipple/config.json`, 추가한 Claude OAuth 그랜트는
+`~/.clauderipple/claude-accounts.json`에만 있고 둘 다 권한은 0600입니다. 관리 API와 로그에는 토큰이나 업스트림
+계정 ID를 내보내지 않습니다. 네트워크 목적지는 직접 설정한 프로바이더뿐이며 텔레메트리는 없습니다.
 
 ## 상태: 알파
 

package/README.md

@@ -171,7 +171,13 @@ you map go to your provider, everything else goes to Anthropic byte for byte.
   a Claude name.
 - **Claude in the Codex app and Codex CLI.** A local OpenAI-compatible endpoint that
   Codex treats as a provider; Claude models appear in Codex's own model list. Uses
-  your Claude Code login or an Anthropic API key.
+  your current Claude Code login or an Anthropic API key.
+- **Multiple Claude accounts without breaking the prompt cache.** Opt a native Claude
+  provider into account rotation, add subscriptions from the dashboard, and each
+  conversation stays on the account that answered. Before the response starts, a
+  quota or authentication refusal moves that turn to the next account. This native
+  Claude Desktop/Code path is separate from the translated Codex ingress, which picks
+  one available login and does not rotate accounts.
 - **The full Claude Code harness, untouched.** Skills, hooks, MCP, `CLAUDE.md`,
   subagents, plan mode, Remote Control on your phone: nothing is turned off.
 - **Correct by construction.** Prompt caching preserved (Anthropic cache breakpoints
@@ -282,6 +288,53 @@ Same router, same mapping. `/model gpt-5.6-terra` lists the models you added.
 Subagents follow the routing; a `[[gpt: sol@xhigh]]` marker in a subagent prompt
 overrides the model for that call, and the task panel shows the real model name.
 
+**You do not have to build an agent harness for this.** Point the subagent slot at
+a routed model and every subagent runs on it — no agent file, nothing else:
+
+```jsonc
+// Settings → CLI models, or "cli": { "models": { … } } in the config
+{ "subagent": "gpt-5.6-terra" }   // → CLAUDE_CODE_SUBAGENT_MODEL
+```
+
+**Every model you tick is also a named subagent.** The router writes
+`~/.claude/agents/<name>.md` for each model exactly one provider carries
+(`gpt-5.6-terra` → `gpt-5-6-terra`, `deepseek-v4.1-flash` → `deepseek-v4-1-flash`),
+so "have DeepSeek do it" needs nothing beyond ticking the model: the Agent tool
+lists it, `subagent_type: "deepseek-v4-1-flash"` runs it, and the task panel
+names it. Untick the model and its file goes away. The router only ever touches
+the files it wrote (recorded in `generated-agents.json`); an agent file you wrote
+yourself under the same name wins and is left alone, so a custom brief is still
+just Claude Code's own agent file with a `model:` the router knows:
+
+```markdown
+---
+name: reviewer
+description: Independent review on GPT-5.6 Sol.
+model: gpt-5.6-sol@medium
+---
+You are the reviewer for this session. Verify the change yourself and report
+the conclusion only.
+```
+
+Per-call effort goes on the **first line** of the subagent prompt:
+`[[ripple: gpt-5-6-terra@high]]` — any agent name or model id works there. A
+marker anywhere else is prose and is ignored (a compaction summary that quotes
+one must not re-route the session). A model the router cannot place is refused
+by name (`400 ClaudeRipple: no provider declares "…"`) instead of being sent on
+to fail somewhere less legible; native Claude models always pass through.
+Set `"cli": { "agentFiles": false }` to turn generation off.
+
+Claude Code runs `WebSearch` as a separate small-model request. To keep a
+ChatGPT-routed setup from spending Anthropic quota for that request, select the
+same ChatGPT provider as the search backend in `config.json`:
+
+```jsonc
+{ "webSearch": { "provider": "chatgpt", "model": "gpt-5.6-terra" } }
+```
+
+This is opt-in. With no `webSearch` setting, Claude Code's existing search path
+is unchanged.
+
 ### Codex app and Codex CLI
 
 ```bash
@@ -311,7 +364,7 @@ provider you configured is available the same way.
 | DeepSeek, Kimi, Z.ai GLM, MiniMax, Qwen (intl / cn) | Anthropic-compatible | API key | preset | verified against vendor docs |
 | xAI Grok, Mistral, Groq, Together, Fireworks | OpenAI-compatible | API key | discovered | translated (Chat Completions / Responses) |
 | Ollama, LM Studio | OpenAI-compatible, local | none | discovered | |
-| Anthropic | native | Claude Code login or API key | Claude models | for the Codex side |
+| Anthropic | native | Claude login(s) or API key | Claude models | optional sticky rotation for Claude Desktop/Code; Codex picks one login |
 | Anything else | custom | your choice | discovered | any Anthropic- or OpenAI-compatible endpoint |
 
 Requests to compatible providers are cleaned of Anthropic-only fields
@@ -343,8 +396,9 @@ Details with sources: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
 ## Privacy
 
 Everything runs on 127.0.0.1. API keys live in `~/.clauderipple/config.json`
-(0600). The only network destinations are the providers you configure. There is no
-telemetry.
+and added Claude OAuth grants in `~/.clauderipple/claude-accounts.json` (both
+0600). Admin APIs and logs expose neither tokens nor upstream account ids. The only
+network destinations are the providers you configure. There is no telemetry.
 
 ## Status: alpha
 

package/dist/cli/src/claude-auth.js

@@ -4,7 +4,8 @@ import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { removeClaudeAuthFile, saveClaudeAuthFile } from "../../router/src/providers/anthropic-token-file.js";
+import { saveClaudeAuthFile } from "../../router/src/providers/anthropic-token-file.js";
+import { removeAllClaudeAccounts } from "../../router/src/providers/anthropic-accounts.js";
 function isSetupToken(value) {
     return /^sk-ant-oat01-[A-Za-z0-9._~-]{16,}$/.test(value);
 }
@@ -108,5 +109,5 @@ export function claudeLogin(home, options = {}) {
     saveClaudeAuthFile(home, token);
 }
 export function claudeLogout(home) {
-    return removeClaudeAuthFile(home);
+    return removeAllClaudeAccounts(home);
 }

package/dist/cli/src/codex.js

@@ -119,6 +119,25 @@ function profileBlock() {
 model_provider = "clauderipple"
 ${PROFILE_END}`;
 }
+/** The head of a TOML document, before its first table header — where Codex keeps the default selection. */
+function beforeFirstTable(content) {
+    const at = content.search(/^[ \t]*\[/m);
+    return at < 0 ? [content, ""] : [content.slice(0, at), content.slice(at)];
+}
+/**
+ * Codex writes the model picked from our catalog into config.toml's own head, outside our markers:
+ * `model_provider = "clauderipple"` and the model id. Removing the provider block while that
+ * reference stays makes Codex refuse to start at all — "Model provider `clauderipple` not found",
+ * and no `codex` command runs until it is edited by hand — so `off` drops the dangling pair. The
+ * `model` line is ours to remove only while it names our provider; standing alone it is the user's.
+ */
+function withoutDanglingSelection(content) {
+    const [head, rest] = beforeFirstTable(content);
+    const selectsUs = /^[ \t]*model_provider[ \t]*=[ \t]*(["'])clauderipple\1[ \t]*\r?\n?/m;
+    if (!selectsUs.test(head))
+        return content;
+    return head.replace(selectsUs, "").replace(/^[ \t]*model[ \t]*=[ \t]*(["'])[^\n]*\1[ \t]*\r?\n?/m, "") + rest;
+}
 /** Install provider in config.toml plus selection in the dedicated `clauderipple` profile. */
 export function codexOn(port, home = codexHome(), models = []) {
     fs.mkdirSync(home, { recursive: true, mode: 0o700 });
@@ -143,7 +162,7 @@ export function codexOff(home = codexHome()) {
     const profile = profileFile(home);
     const beforeConfig = fs.existsSync(config) ? fs.readFileSync(config, "utf8") : "";
     const beforeProfile = fs.existsSync(profile) ? fs.readFileSync(profile, "utf8") : "";
-    const nextConfig = withoutOwnedBlock(withoutOwnedBlock(beforeConfig, START, END), CATALOG_START, CATALOG_END);
+    const nextConfig = withoutDanglingSelection(withoutOwnedBlock(withoutOwnedBlock(beforeConfig, START, END), CATALOG_START, CATALOG_END));
     const nextProfile = withoutOwnedBlock(beforeProfile, PROFILE_START, PROFILE_END);
     fs.rmSync(catalogFile(home), { force: true });
     if (nextConfig === beforeConfig && nextProfile === beforeProfile)

package/dist/cli/src/hooks/agent-title.js

@@ -19,7 +19,7 @@ const OUR_PREFIX = /^[^\s·]+(?:·[a-z]+)? · /;
 const CLAUDE_ID = /^claude-(opus|sonnet|haiku|fable)-(\d+(?:-\d+)*?)(?:-\d{8})?$/;
 /** Display names: config's picker names (e.g. "GPT-5.6 Terra" → "Terra"), then a built-in table. */
 function prettyNames() {
-    const out = { "gpt-5.6-terra": "Terra", "gpt-5.6-sol": "Sol", "gpt-5.6-luna": "Luna", "gpt-6-astra": "Astra" };
+    const out = { "gpt-5.6-terra": "Terra", "gpt-5.6-sol": "Sol", "gpt-5.6-luna": "Luna", "gpt-6-astra": "Astra", "gpt-6-sol": "Sol", "gpt-6-luna": "Luna" };
     const home = process.env.CLAUDERIPPLE_HOME ?? path.join(os.homedir(), ".clauderipple");
     try {
         const cfg = JSON.parse(fs.readFileSync(path.join(home, "config.json"), "utf8"));

package/dist/cli/src/index.js

@@ -137,7 +137,7 @@ async function install() {
     const proxyUrl = proxyUrlFor(cfg.listen.port);
     const caPath = certPaths(home).caPem;
     const maxCtx = opt("max-context-tokens");
-    const edit = applyProxyEnv({ proxyUrl, caPath, force: flag("force"), ...(maxCtx ? { maxContextTokens: Number(maxCtx) } : {}) });
+    const edit = applyProxyEnv({ proxyUrl, caPath, force: flag("force"), ...(maxCtx ? { maxContextTokens: Number(maxCtx) } : {}), models: cfg.cli.models ?? {} });
     console.log(edit.changed ? `✓ ${settingsPath()} updated (backup: ${edit.backup ?? "none"})` : `✓ ${settingsPath()} already correct`);
     for (const n of edit.notes)
         console.log(`  note: ${n}`);
@@ -343,7 +343,7 @@ function help() {
   login             sign in to ChatGPT (opens your browser; tokens stay in the home dir)
   logout            forget the ChatGPT login made with "login"
   claude-login      connect a Claude subscription in the browser (--setup-token: via \`claude setup-token\`; --manual: paste the code)
-  claude-logout     remove ClaudeRipple's own Claude subscription credential
+  claude-logout     remove every Claude subscription added to ClaudeRipple
   picker on|off     show your mapped models by name in the Claude Desktop picker (trusts the CA in your login keychain, routes the app through ClaudeRipple)
   codex on|off      add/remove ClaudeRipple's local OpenAI provider and selection profile for Codex CLI
   agent-title on|off|status
@@ -463,11 +463,11 @@ try {
                 await session.submitCode(code);
             }
             await session.result;
-            console.log(`✓ Claude subscription connected. Stored in ${homeDir()}/claude-auth.json; refreshed automatically.`);
+            console.log(`✓ Claude subscription added. Stored privately in ${homeDir()}/claude-accounts.json; refreshed automatically.`);
             break;
         }
         case "claude-logout":
-            console.log(claudeLogout(homeDir()) ? "✓ Claude subscription credential removed" : "no Claude subscription credential stored");
+            console.log(claudeLogout(homeDir()) ? "✓ ClaudeRipple Claude accounts removed" : "no ClaudeRipple Claude accounts stored");
             break;
         case "ui":
             ui();

package/dist/cli/src/schtasks.js

@@ -37,6 +37,26 @@ function run(script) {
         return { ok: false, out: `${err.stdout?.toString() ?? ""}${err.stderr?.toString() ?? ""}`.trim() };
     }
 }
+export function taskDefinitionMatches(value, expected) {
+    if (!value || typeof value !== "object")
+        return false;
+    const task = value;
+    return (task.actionCount === 1 &&
+        task.execute?.toLowerCase() === "powershell.exe" &&
+        task.arguments === expected.arguments &&
+        task.userId?.toLowerCase() === expected.userId.toLowerCase() &&
+        task.runLevel === 0 &&
+        task.logonType === 3 &&
+        task.triggerCount === 1 &&
+        task.triggerType === "MSFT_TaskLogonTrigger" &&
+        task.triggerUserId?.toLowerCase() === expected.userId.toLowerCase() &&
+        task.restartCount === 99 &&
+        task.restartInterval === "PT1M" &&
+        task.executionTimeLimit === "PT0S" &&
+        task.multipleInstances === 2 &&
+        task.allowStartIfOnBatteries === true &&
+        task.dontStopIfGoingOnBatteries === true);
+}
 /**
  * The task runs a PowerShell launcher rather than node directly, for three reasons.
  *
@@ -79,9 +99,31 @@ function writeLauncher(opts) {
 export function installAgent(opts) {
     const launcher = writeLauncher({ program: opts.program, args: opts.args ?? [], home: opts.home, ...(opts.env ? { env: opts.env } : {}) });
     const user = `${os.userInfo().username}`;
+    const actionArgs = `-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "${launcher}"`;
+    // Updating the generated launcher does not require re-registering an otherwise correct task.
+    // Some Windows installations protect an existing per-user task's security descriptor so that
+    // even the same unelevated user gets E_ACCESSDENIED from Register-ScheduledTask -Force. Treat the
+    // verified existing definition as success; never silently accept a same-named foreign task.
+    const existing = run([
+        `$t = Get-ScheduledTask -TaskName ${ps(taskName())} -ErrorAction SilentlyContinue`,
+        `if ($null -eq $t) { 'null'; exit 0 }`,
+        `$a = @($t.Actions); $p = $t.Principal; $tr = @($t.Triggers); $s = $t.Settings`,
+        `[pscustomobject]@{ actionCount = $a.Count; execute = $a[0].Execute; arguments = $a[0].Arguments; userId = $p.UserId; runLevel = [int]$p.RunLevel; logonType = [int]$p.LogonType; triggerCount = $tr.Count; triggerType = $tr[0].CimClass.CimClassName; triggerUserId = $tr[0].UserId; restartCount = $s.RestartCount; restartInterval = [string]$s.RestartInterval; executionTimeLimit = [string]$s.ExecutionTimeLimit; multipleInstances = [int]$s.MultipleInstances; allowStartIfOnBatteries = $s.AllowStartIfOnBatteries; dontStopIfGoingOnBatteries = $s.DontStopIfGoingOnBatteries } | ConvertTo-Json -Compress`,
+    ].join("; "));
+    let definition = null;
+    if (existing.ok) {
+        try {
+            definition = JSON.parse(existing.out);
+        }
+        catch {
+            // A malformed inspection result is not trusted; fall through to registration.
+        }
+    }
+    if (taskDefinitionMatches(definition, { arguments: actionArgs, userId: user }))
+        return launcher;
     const script = [
         `$ErrorActionPreference = 'Stop'`,
-        `$a = New-ScheduledTaskAction -Execute ${ps("powershell.exe")} -Argument ${ps(`-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "${launcher}"`)}`,
+        `$a = New-ScheduledTaskAction -Execute ${ps("powershell.exe")} -Argument ${ps(actionArgs)}`,
         `$t = New-ScheduledTaskTrigger -AtLogOn -User ${ps(user)}`,
         // Limited: the router needs no elevation, and asking for it would put a UAC prompt at every logon.
         `$p = New-ScheduledTaskPrincipal -UserId ${ps(user)} -LogonType Interactive -RunLevel Limited`,

package/dist/cli/src/settings.js

@@ -26,6 +26,16 @@ function write(file, obj) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, JSON.stringify(obj, null, 2) + "\n");
 }
+/**
+ * Claude Code's own model slots, as environment names. These are decided inside the CLI before a
+ * request exists, so routing cannot reach them: `smallFast` in particular is what a `WebSearch`
+ * side request runs on, which is why a routed session searches on Claude quota until it is set.
+ */
+export const MODEL_SLOT_ENV = {
+    main: "ANTHROPIC_MODEL",
+    smallFast: "ANTHROPIC_SMALL_FAST_MODEL",
+    subagent: "CLAUDE_CODE_SUBAGENT_MODEL",
+};
 export function applyProxyEnv(opts) {
     const file = settingsPath();
     const s = readSettings(file);
@@ -40,18 +50,67 @@ export function applyProxyEnv(opts) {
     const want = { HTTPS_PROXY: opts.proxyUrl, NODE_EXTRA_CA_CERTS: opts.caPath };
     if (opts.maxContextTokens)
         want.CLAUDE_CODE_MAX_CONTEXT_TOKENS = String(opts.maxContextTokens);
+    for (const [slot, name] of Object.entries(MODEL_SLOT_ENV)) {
+        const model = opts.models?.[slot];
+        if (model)
+            want[name] = model;
+    }
+    const wroteSlots = [];
     let changed = false;
     for (const [k, v] of Object.entries(want)) {
         if (env[k] !== v) {
             env[k] = v;
             changed = true;
+            const slot = Object.keys(MODEL_SLOT_ENV).find((name) => MODEL_SLOT_ENV[name] === k);
+            if (slot)
+                wroteSlots.push(slot);
+        }
+    }
+    // A slot that was set and is now cleared must go, or the old model keeps answering with nothing
+    // in the config to explain why.
+    //
+    // Which slots count as "now cleared" depends on the caller. `install` owns all three, so anything
+    // it was not given is cleared. The GUI names only the slots it shows a choice for and must leave
+    // the rest as they are — including a value someone put there by hand — so it passes
+    // `preserveUnnamedSlots` and a slot it never mentioned is simply not touched.
+    if (opts.models !== undefined) {
+        const named = new Set(Object.keys(opts.models));
+        for (const [slot, name] of Object.entries(MODEL_SLOT_ENV)) {
+            if (opts.preserveUnnamedSlots && !named.has(slot))
+                continue;
+            if (!opts.models[slot] && env[name] !== undefined) {
+                delete env[name];
+                changed = true;
+                wroteSlots.push(slot);
+                notes.push(`cleared ${name}`);
+            }
         }
     }
     if (!changed)
-        return { changed: false, backup: null, notes };
+        return { changed: false, backup: null, notes, wroteSlots: [] };
     const b = backup(file);
     write(file, { ...s, env });
-    return { changed: true, backup: b, notes };
+    return { changed: true, backup: b, notes, wroteSlots };
+}
+/**
+ * Bring `~/.claude/settings.json` in line with `cli.models` after a GUI save.
+ *
+ * The GUI writes only config.json, and that is by design — the router hot-reloads it on mtime. But
+ * these slots are read by Claude Code *before* a request exists, so they live in the env block and
+ * nothing else writes them. Without this, choosing a slot on the Clients screen saved a value that
+ * did nothing until the next `install`: the screen said DeepSeek while every search, title and
+ * subagent went on running on Haiku (found this way, 2026-09-21).
+ *
+ * The GUI sends an empty string to mean "back to Claude" (`saveModelSlots` records every select,
+ * so a slot set back to the default arrives as `""`). That is a key *present* with a falsy value,
+ * which `applyProxyEnv` reads as "clear this one" and writes no env entry for — not the same thing
+ * as `ANTHROPIC_MODEL: ""`, which would still be a key to Claude Code.
+ *
+ * A slot the GUI does not name at all is left alone, so a save here cannot undo a value someone
+ * set by hand or through `install`.
+ */
+export function syncModelSlots(opts) {
+    return applyProxyEnv({ ...opts, preserveUnnamedSlots: true });
 }
 export function removeProxyEnv(opts) {
     const file = settingsPath();
@@ -71,8 +130,16 @@ export function removeProxyEnv(opts) {
     }
     else if (env.NODE_EXTRA_CA_CERTS)
         notes.push(`left NODE_EXTRA_CA_CERTS=${env.NODE_EXTRA_CA_CERTS} (not ours)`);
+    // Uninstalling must hand the CLI back to Anthropic completely: a model slot still pointing at a
+    // routed model would send every search and subagent somewhere the router no longer serves.
+    for (const name of Object.values(MODEL_SLOT_ENV)) {
+        if (env[name] !== undefined) {
+            delete env[name];
+            changed = true;
+        }
+    }
     if (!changed)
-        return { changed: false, backup: null, notes };
+        return { changed: false, backup: null, notes, wroteSlots: [] };
     const b = backup(file);
     const next = { ...s };
     if (Object.keys(env).length === 0)
@@ -80,7 +147,7 @@ export function removeProxyEnv(opts) {
     else
         next.env = env;
     write(file, next);
-    return { changed: true, backup: b, notes };
+    return { changed: true, backup: b, notes, wroteSlots: [] };
 }
 export function currentProxyEnv() {
     const env = readSettings(settingsPath()).env ?? {};
@@ -123,12 +190,12 @@ export function setAgentTitleHook(enabled, cmd) {
     }
     const changed = JSON.stringify(kept) !== JSON.stringify(list);
     if (!changed)
-        return { changed: false, backup: null, notes };
+        return { changed: false, backup: null, notes, wroteSlots: [] };
     const b = backup(file);
     hooks.PreToolUse = kept;
     s.hooks = hooks;
     write(file, s);
-    return { changed: true, backup: b, notes };
+    return { changed: true, backup: b, notes, wroteSlots: [] };
 }
 export function agentTitleHookEnabled() {
     try {