clauderipple 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.5.0 — 2026-09-24
+
+Linux, and four fixes from the first outside contributions.
+
+### Added
+
+- **Linux** (#28, #33, #34, by @grapefruit0205). `install`, `status`, `restart` and
+  `uninstall` work where there is a systemd user session: the router runs as
+  `~/.config/systemd/user/clauderipple.service`, with no sudo. A health self-exit is
+  restarted after two seconds, and a stop waits out the 90-second drain. Picker mode
+  trusts the local CA in the NSS database Chromium reads (`~/.pki/nssdb`, your user
+  only) and needs `certutil` (`libnss3-tools` / `nss-tools`). Measured by the
+  contributor on Ubuntu 24.04 x64 with Claude Desktop 2.2553.13.
+
+### Fixed
+
+- **`npm test` no longer rewrites your real `~/.claude/settings.json`** (#16, #26, #30).
+  The admin tests isolated the router's home but not the Claude settings path, so a
+  test run pointed `NODE_EXTRA_CA_CERTS` at a temp directory it then deleted, and every
+  Claude Code session on the machine failed until the file was fixed by hand.
+- **A failed install leaves `settings.json` alone** (#27, #31). The proxy settings are
+  now written only after the end-to-end probe passes, and `picker on` checks the
+  router is answering before it points Claude Desktop at it.
+- **Anthropic-compatible providers keep the conversation after a tool call** (#29, #32).
+  Claude Code's `thread: continue` carries only the new messages; the router stripped
+  the field and forwarded that delta, so the model got orphan tool results and no task.
+  It is now refused as for the translated providers, and the CLI resends the full turn.
+- **`picker on` and `status` from a PowerShell 7 terminal on Windows** (#35). Windows
+  PowerShell inherited PowerShell 7's module path and lost the `Cert:` drive: `picker on`
+  stopped at "Cannot find drive 'Cert'" and `status` called a trusted CA untrusted.
+  Every `powershell.exe` we start now drops the inherited `PSModulePath`. Reproduced
+  and checked in a Windows 11 VM.
+
 ## 0.4.1 — 2026-09-24
 
 ### Fixed

package/README.ko.md

@@ -19,6 +19,7 @@
   <a href="LICENSE"><img alt="GPL-3.0" src="https://img.shields.io/badge/license-GPL--3.0-blue"></a>
   <img alt="macOS" src="https://img.shields.io/badge/macOS-arm64%20%7C%20x64-black">
   <img alt="Windows" src="https://img.shields.io/badge/Windows-arm64%20%7C%20x64-0078D4">
+  <img alt="Linux" src="https://img.shields.io/badge/Linux-x64%20(systemd)-FCC624">
   <img alt="Node" src="https://img.shields.io/badge/node-24%2B-success">
   <a href="README.md"><img alt="English" src="https://img.shields.io/badge/docs-English-blue"></a>
 </p>
@@ -73,8 +74,10 @@ Claude에 돈을 내고 있다면 3P는 선택지가 아닙니다. 낸 돈의
 
 ### 클로드 데스크톱 앱에서 GPT를 쓸 수 있나요?
 
-됩니다. ClaudeRipple을 설치하고 Claude 모델 이름 하나를 GPT 모델에 매핑하면, Code 탭이 GPT로 답합니다.
-모델 피커에는 GPT의 실제 이름이 뜹니다. 앱 자체는 고치지도 않고, 다른 모드로 바꾸지도 않습니다.
+됩니다. **Code 탭**과 그 서브에이전트에서 됩니다. ClaudeRipple을 설치하고 ChatGPT Plus나 Pro 구독으로
+로그인하면, GPT(챗GPT의 GPT-6 Sol·Luna·Astra, GPT-5.6 Terra 등)가 모델 피커에 실제 이름으로 뜨고, 고른 추론 강도
+그대로 답합니다. 앱 자체는 고치지도 않고, 다른 모드로 바꾸지도 않습니다. 일반 **채팅** 탭은 Claude 그대로입니다.
+채팅까지 바꾸려면 앱 전체를 게이트웨이 모드로 돌려야 해서 어떤 도구도 못 합니다([1P냐 3P냐](#1p냐-3p냐--이-프로젝트가-존재하는-이유) 참고).
 
 ### Claude Code(터미널)에서 GPT를 쓰려면요?
 
@@ -109,43 +112,96 @@ ChatGPT 구독으로 GPT를 쓰고, OpenRouter나 직접 API 키로 DeepSeek·Ki
 ### 윈도우에서도 되나요?
 
 됩니다. macOS와 Windows, arm64와 x64 모두. 설치·대시보드·재시작·제거를 Windows 11 arm64에서 실측했고,
-x64 런타임은 에뮬레이션으로 확인했습니다.
+x64 런타임은 에뮬레이션으로 확인했습니다. systemd 사용자 세션이 있는 Linux에서도 됩니다. 설치, 라우터를 거친
+Code 탭 요청, 스트리밍 응답 도중의 재시작, 제거를 Ubuntu 24.04 x64와 Claude Desktop 2.2553.13에서
+실측했습니다. 피커 모드도 됩니다. `cli.extraModels`의 모델이 Code 탭 피커에 Claude 모델과 나란히 뜹니다.
 
 ### 제 코드가 다른 데로 가나요?
 
 가지 않습니다. 프록시는 내 컴퓨터에서 돕니다. 요청은 설정한 프로바이더로만 가고, 자격증명은
 홈 디렉터리에만 저장됩니다. [개인정보](#개인정보) 절을 보세요.
 
+### Claude 계정이 정지(밴)되지 않나요? 약관 위반 아닌가요?
+
+ClaudeRipple이 Claude에 하는 일은 작고 확인할 수 있습니다. Claude로 가는 요청은 Claude Code가 보낸 그대로
+한 바이트도 바꾸지 않고 나가고, GPT 등 다른 프로바이더로 보낸 요청은 Anthropic에 아예 가지 않습니다. 앱을 고치는
+방식이 아니라, Claude Code가 회사 네트워크용으로 문서화해 둔 프록시·인증서 설정(`HTTPS_PROXY`,
+`NODE_EXTRA_CA_CERTS` — 공식 문서 [Enterprise network configuration](https://code.claude.com/docs/en/corporate-proxy))을 씁니다. 계정 정지 사례로 알려진 것은 반대 방향, 즉 Claude 구독 로그인을 **다른 프로그램**에서
+쓰는 경우입니다. ClaudeRipple에도 그런 선택 기능이 하나 있습니다. Codex 안에서 Claude를 구독 로그인으로 쓰는
+것인데, 이는 Anthropic 약관의 적용을 받습니다. Anthropic API 키로 쓰면 이 문제가 없습니다. Claude 구독 여러 개를
+돌려 쓰는 것도 같은 약관 아래 각자 판단할 일입니다. 계정을 어떻게 다룰지는 Anthropic만 정할 수 있으니, 여기 적은
+내용은 보장이 아닙니다.
+
+### ChatGPT 계정을 여러 개 쓸 수 있나요?
+
+됩니다. `clauderipple login`을 할 때마다(또는 대시보드의 **+ ChatGPT 계정 추가**) 계정이 하나씩 늘어납니다.
+한 계정이 한도에 걸리면 같은 요청을 다음 계정이 이어받고, 한도가 찬 계정은 풀릴 때까지 쉽니다. 대화는 답한 계정에
+고정되어 프롬프트 캐시를 지킵니다. Claude Desktop Code 탭, Claude Code, Codex 앱·CLI의 GPT에 모두 적용됩니다.
+
+### Codex에서 Claude를 쓸 수 있나요?
+
+됩니다. `clauderipple codex on`을 하면 ClaudeRipple이 프로바이더로 추가되고, Codex 앱과 CLI의 모델 목록에
+Claude 모델이 이름 그대로 뜹니다. Claude Code 로그인이나 Anthropic API 키로 답합니다.
+[Codex 앱과 Codex CLI](#codex-앱과-codex-cli) 절을 보세요.
+
+### Claude Code 안에서는 GPT 성능이 떨어지지 않나요?
+
+Claude Code의 시스템 프롬프트와 도구 설명은 Claude에 맞춰 쓰여 있어서, 다른 모델은 남에게 맞춘 지시를 읽는 셈이고
+자기 전용 앱에서와 조금 다르게 굴 수 있습니다. ClaudeRipple은 모델마다 자기 이름과 추론 강도를 알려 주고, 벤더가
+거부할 도구 스키마를 고쳐 넘기며, 프로바이더별로 지시문을 덧붙일 수 있게 합니다. 흔한 구성은 Claude를 메인으로 두고
+GPT나 DeepSeek을 서브에이전트로 쓰는 것입니다.
+
+### CC Switch, opencodex, claude-code-router와 뭐가 다른가요?
+
+[비교표](#네-개-대신-하나)를 보세요. 요약하면 ClaudeRipple은 앱이 Claude에 로그인된 채로 Claude
+**데스크톱 앱**의 Code 탭에 들어가고, 다른 모델을 피커에 실제 이름으로 보여 줍니다. CC Switch도 데스크톱 앱에
+들어가지만, 앱의 게이트웨이(3P) 모드를 켜는 방식입니다.
+
+### 무료인가요?
+
+무료입니다. GPL-3.0 오픈소스입니다. 이미 쓰고 있는 구독이나 API 키 비용만 듭니다.
+
 ## 네 개 대신 하나
 
-비슷한 도구들은 터미널용입니다. Claude Code CLI나 Codex CLI가 다른 모델을 쓰게는 해 주지만, Claude **데스크톱 앱**에는
-닿지 못하고, 다른 모델로 바꾸는 순간 Claude 구독 쪽 기능(claude.ai 채팅, Remote Control, 클라우드 세션)을 잃습니다.
+비슷한 도구들은 Claude Code CLI나 Codex CLI가 다른 모델을 쓰게는 해 주지만, Claude **데스크톱 앱**에는 닿지 못하거나
+게이트웨이(3P) 모드로만 닿고, 다른 모델로 바꾸는 순간 Claude 구독 쪽 기능(claude.ai 채팅, Remote Control, 클라우드 세션)을 잃습니다.
 ClaudeRipple은 데스크톱 앱·터미널·Codex를 메뉴 막대 앱 하나로 다루고, 두 구독을 나란히 쓰며, Claude Code 하네스를
 그대로 둡니다. 스킬·훅·MCP 서버·`CLAUDE.md`·서브에이전트·claude.ai 커넥터가 전부 살아 있는 채로 두뇌만 바뀝니다.
 
-| | ClaudeRipple | claude-code-router | Claude Desktop 게이트웨이(3P) 모드 |
-|---|---|---|---|
-| 게이트웨이(3P) 모드 **없이** Claude **Desktop** Code 탭 | ✅ | ❌ | ❌ (정의상 불가) |
-| claude.ai 채팅·Remote Control·클라우드 세션·커넥터 유지 | ✅ | ❌ | ❌ |
-| Claude 구독과 GPT 구독 나란히 | ✅ | ❌ | ❌ |
-| Desktop 피커에 실제 모델 이름 | ✅ | ❌ | 일부 |
-| ChatGPT 계정 여러 개, 한도 차면 자동 전환 (Desktop·Codex) | ✅ | ❌ | ❌ |
-| 터미널 `claude` CLI | ✅ | ✅ | ✅ |
-| Codex **앱**·Codex CLI → Claude | ✅ | ❌ | ❌ |
-| 번역 프로바이더의 프롬프트 캐시 | **94~99 %** 실측 | 제각각 | 해당 없음 |
-| 서브에이전트를 실제 모델 이름으로 표시 | ✅ | ❌ | ❌ |
-| 터미널 없이 쓰는 설정 GUI | ✅ | ❌ | ❌ |
-| 런타임 내장, 서명·공증된 앱 | ✅ | ❌ | – |
+| | ClaudeRipple | CC Switch (2026-09-24 확인) | opencodex / openclaude (2026-09-16 확인) | claude-code-router | Claude Desktop 게이트웨이(3P) 모드 |
+|---|---|---|---|---|---|
+| 게이트웨이(3P) 모드 **없이** Claude **Desktop** Code 탭 | ✅ | ❌ ² | ❌ ¹ | ❌ | ❌ (정의상 불가) |
+| claude.ai 채팅·Remote Control·클라우드 세션·커넥터 유지 | ✅ | ❌ | ❌ | ❌ | ❌ |
+| Claude 구독과 GPT 구독 나란히 | ✅ | ❌ 한 번에 프로바이더 하나 | ❌ 전부 아니면 전무 | ❌ | ❌ |
+| Desktop 피커에 실제 모델 이름 | ✅ | ❌ `claude-*` 역할 이름 ² | ❌ | ❌ | 일부 |
+| ChatGPT 계정 여러 개, 한도 차면 자동 전환 (Desktop·Codex) | ✅ | ❌ 수동 전환 ³ | ✅ | ❌ | ❌ |
+| 터미널 `claude` CLI | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Codex **앱**·Codex CLI → Claude | ✅ | ✅ | ✅ | ❌ | ❌ |
+| 번역 프로바이더의 프롬프트 캐시 | **94~99 %** 실측 | 미측정 | 미측정 | 제각각 | 해당 없음 |
+| 서브에이전트를 실제 모델 이름으로 표시 | ✅ | ❌ | ❌ | ❌ | ❌ |
+| 터미널 없이 쓰는 설정 GUI | ✅ | ✅ | ❌ | ❌ | ❌ |
+| 런타임 내장, 서명·공증된 앱 | ✅ | ✅ | ❌ | ❌ | – |
+
+¹ opencodex는 README에 Claude Desktop 데모를 걸어 두었지만, 저장소에도 문서 사이트에도 설치 절차가 없었습니다
+(2026-09-16 확인). 당시 데스크톱 앱으로 들어가는 공개된 경로는 공식 게이트웨이 설정, 즉 마지막 칸뿐이었습니다.
+
+² CC Switch는 데스크톱 앱의 서드파티 프로필(`Claude-3p/claude_desktop_config.json`, `"inferenceProvider": "gateway"`)을
+써서 들어갑니다. 즉 마지막 칸과 같은 경로입니다. 로컬 게이트웨이를 거치면 피커에는 `claude-sonnet-*`·`claude-opus-*`·
+`claude-haiku-*` 역할 이름만 보입니다([CC Switch 매뉴얼](https://github.com/farion1231/cc-switch/blob/main/docs/user-manual/en/2-providers/2.6-claude-desktop.md)).
+CC Switch는 이 표보다 많은 도구(Gemini CLI, OpenCode 등)를 다루고, MCP 서버와 스킬을 도구 사이에 동기화합니다.
+
+³ ChatGPT 계정은 프로바이더 카드마다 하나씩 묶이고, 공식 ChatGPT 카드는 페일오버 대상에서 빠집니다(v3.20.0 릴리스 노트).
 
 데스크톱 앱의 "서드파티 추론" 설정은 앱 전체를 다른 모드로 바꿔 버립니다. claude.ai 채팅, Remote Control,
-클라우드 세션을 잃습니다. `ANTHROPIC_BASE_URL`을 바꿔치기하는 도구들은 데스크톱 앱에 아예 닿지 못합니다.
+클라우드 세션을 잃습니다. `ANTHROPIC_BASE_URL`을 바꿔치기하는 도구들은 데스크톱 앱에 닿지 못하고, 닿는 도구는 바로 그
+설정을 씁니다.
 ClaudeRipple은 Claude Code 프로세스만 신뢰하는 작은 HTTPS 프록시입니다. 매핑한 모델 요청만 프로바이더로 가고,
 나머지는 Anthropic으로 바이트 그대로 지나갑니다.
 
 ## 할 수 있는 것
 
-- **Claude Desktop과 Claude Code에서 어떤 모델이든.** ChatGPT Plus/Pro 구독으로 GPT-5.6 Terra / Sol / Luna와
-  GPT-6 Astra를, 아니면 DeepSeek·Kimi·GLM·MiniMax·Qwen·Grok·Mistral·Groq·Together·Fireworks·OpenRouter(400+ 모델)·
+- **Claude Desktop과 Claude Code에서 어떤 모델이든.** ChatGPT Plus/Pro 구독으로 GPT-6 Sol / Luna / Astra와
+  GPT-5.6 Terra / Sol / Luna를(OpenAI가 새 모델을 내면 그날 바로 뜹니다), 아니면 DeepSeek·Kimi·GLM·MiniMax·Qwen·Grok·Mistral·Groq·Together·Fireworks·OpenRouter(400+ 모델)·
   로컬 Ollama / LM Studio를. 피커에 실제 이름으로 띄우거나, Claude 이름에 매핑해서.
 - **Codex 앱과 Codex CLI에서 Claude를.** Codex가 프로바이더로 인식하는 로컬 OpenAI 호환 엔드포인트. Claude 모델이
   Codex 자체 모델 목록에 뜹니다. 현재 Claude Code 로그인이나 Anthropic API 키를 씁니다.
@@ -184,6 +240,17 @@ curl -fsSL https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts/ins
 irm https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts/install.ps1 | iex
 ```
 
+**Linux** (systemd가 있는 데스크톱 세션)
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts/install.sh | sh
+```
+
+라우터는 사용자 단위 systemd 서비스로 돕니다. 상태는 `systemctl --user status clauderipple`, 출력은
+`journalctl --user -u clauderipple`로 봅니다. 피커 모드는 Chromium이 읽는 NSS 데이터베이스
+(`~/.pki/nssdb`, 내 사용자에게만, sudo 없이)에 로컬 CA를 등록하므로 `certutil`이 필요합니다.
+`clauderipple picker on` 전에 `sudo apt install libnss3-tools`(Fedora는 `sudo dnf install nss-tools`)를 실행하세요.
+
 준비물은 없습니다. 이미 Node 24 이상이 있으면 그것을 쓰고, 없으면 공식 빌드를 `~/.clauderipple/runtime`에
 내려받습니다. 내려받은 파일은 nodejs.org가 공개한 체크섬과 대조합니다. 그다음 설치까지 마칩니다. 로컬 인증서,
 `~/.claude/settings.json` 두 줄, 컴퓨터를 켤 때 함께 뜨는 백그라운드 라우터. 관리자 권한도, 암호 입력도 필요
@@ -222,11 +289,12 @@ clauderipple restart
 
 선택 사항, Desktop 피커에 실제 이름을 띄우려면: **클라이언트 → Claude Desktop → 모델 피커 → 켜기**. 그다음 Claude
 Desktop을 완전히 종료했다가 다시 엽니다. 로컬 인증서를 사용자 범위로만 신뢰시키는데, 이때 macOS는 로그인 암호를
-묻고 Windows는 지문이 적힌 확인 창을 띄웁니다. ClaudeRipple은 암호를 보지 않으며, 양쪽 다 관리자 권한이 필요
-없습니다.
+묻고 Windows는 지문이 적힌 확인 창을 띄웁니다. Linux는 묻지 않고 NSS 데이터베이스에 등록합니다. ClaudeRipple은
+암호를 보지 않으며, 어느 플랫폼도 관리자 권한이 필요 없습니다.
 
 > **Claude Desktop은 창을 닫아도 종료되지 않습니다.** 그 상태로 다시 열면 이전 인스턴스를 재사용해서 새 설정을
-> 읽지 않습니다. 제대로 종료하십시오(macOS는 ⌘Q, Windows는 트레이 아이콘 또는 작업 관리자). 안 그러면 피커가
+> 읽지 않습니다. 제대로 종료하십시오(macOS는 ⌘Q, Windows는 트레이 아이콘 또는 작업 관리자, Linux는 Ctrl+Q 또는
+> 트레이 아이콘. `pgrep -f claude-desktop`이 아무것도 출력하지 않을 때까지). 안 그러면 피커가
 > 아무 말 없이 그대로입니다.
 
 <details>
@@ -321,7 +389,7 @@ Anthropic API 키로 갑니다. 구독 로그인 재사용은 Anthropic 약관
 
 | 프로바이더 | 종류 | 인증 | 모델 목록 | 비고 |
 |---|---|---|---|---|
-| ChatGPT 구독 | Codex 백엔드 | 로그인 여러 개, 한도 차면 자동 전환(Codex 로그인도 재사용) | Terra, Sol, Luna, Astra | 추론 강도 low…max(Luna는 ultra), 프롬프트 캐시 94~99 % |
+| ChatGPT 구독 | Codex 백엔드 | 로그인 여러 개, 한도 차면 자동 전환(Codex 로그인도 재사용) | 구독에서 자동으로 읽음(GPT-6 Sol·Luna·Astra, GPT-5.6 …) | 추론 강도 low…max(Luna는 ultra), 프롬프트 캐시 94~99 % |
 | OpenRouter | Anthropic 호환 | API 키 | 400+, 자동 검색 | 모델별 추론 강도 지원을 API에서 읽음 |
 | DeepSeek, Kimi, Z.ai GLM, MiniMax, Qwen(국제/중국) | Anthropic 호환 | API 키 | 프리셋 | 벤더 공식 문서로 확인 |
 | xAI Grok, Mistral, Groq, Together, Fireworks | OpenAI 호환 | API 키 | 자동 검색 | 번역(Chat Completions / Responses) |
@@ -365,6 +433,9 @@ Codex 앱 / CLI ──/v1/responses──▶ ClaudeRipple 입구 ──▶ Claud
 - **Windows 지원은 이제 막 들어갔습니다(2026-09-14).** 설치·설정·라우터·로그인·피커·실제 GPT 호출까지 x64
   실기에서 확인했고, 크래시 복구는 arm64에서 확인했습니다. 창은 아직 Windows 기본 제목 표시줄을 씁니다.
   Windows 빌드는 서명되지 않았습니다(위 설치 항목 참고).
+- **Linux 지원도 이제 막 들어갔습니다(2026-09-24).** 기여자가 Ubuntu 24.04 x64에서 설치·Code 탭 요청·스트리밍
+  도중 재시작·피커 모드·제거를 실측해 보내 주었습니다. systemd 사용자 세션이 필요하고, 다른 배포판과 arm64는
+  확인하지 않았습니다.
 - ChatGPT, OpenRouter, Codex 안의 Claude는 실제 계정으로 검증했습니다. 나머지 프리셋은 벤더 공식 문서를 따릅니다.
 - 피커에 추가한 모델은 다음 세션부터 쓸 수 있습니다.
 - Claude Code와 Codex는 통신 규약을 자주 바꿉니다. 클라이언트 업데이트가 번역을 깨뜨리면 ClaudeRipple이 따라잡을 때까지

package/README.md

@@ -20,6 +20,7 @@
   <a href="LICENSE"><img alt="GPL-3.0" src="https://img.shields.io/badge/license-GPL--3.0-blue"></a>
   <img alt="macOS" src="https://img.shields.io/badge/macOS-arm64%20%7C%20x64-black">
   <img alt="Windows" src="https://img.shields.io/badge/Windows-arm64%20%7C%20x64-0078D4">
+  <img alt="Linux" src="https://img.shields.io/badge/Linux-x64%20(systemd)-FCC624">
   <img alt="Node" src="https://img.shields.io/badge/node-24%2B-success">
   <a href="README.ko.md"><img alt="한국어" src="https://img.shields.io/badge/docs-한국어-red"></a>
 </p>
@@ -80,9 +81,12 @@ the model.
 
 ### Can I use GPT in the Claude Desktop app?
 
-Yes. Install ClaudeRipple, map a Claude model name to a GPT model, and the Code tab
-answers with GPT under its real name in the model picker. The app itself is not
-modified and not switched into any other mode.
+Yes — in the **Code tab** and its subagents. Install ClaudeRipple, sign in with a
+ChatGPT Plus or Pro subscription, and GPT (GPT-6 Sol, Luna, Astra, GPT-5.6 Terra and
+the rest) shows up under its real name in the model picker, with the reasoning effort
+you pick. The app itself is not modified and not switched into any other mode. The
+general **chat** tab stays Claude: no tool can route it without turning the whole app
+into gateway mode (see [1P, not 3P](#1p-not-3p-the-difference-this-whole-project-exists-for)).
 
 ### How do I use GPT in Claude Code?
 
@@ -122,47 +126,115 @@ through OpenRouter or a direct API key. Claude models keep working as they are.
 ### Does it work on Windows?
 
 Yes, on Windows and macOS, arm64 and x64. Install, dashboard, restart and uninstall are
-measured on Windows 11 arm64; the x64 runtime is measured under emulation.
+measured on Windows 11 arm64; the x64 runtime is measured under emulation. Linux works too
+where there is a systemd user session: install, a Code-tab request through the router, a
+restart in the middle of a streaming answer and uninstall are measured on Ubuntu 24.04 x64
+with Claude Desktop 2.2553.13, and so is picker mode: models from `cli.extraModels` show
+in the Code-tab picker next to Claude's own.
 
 ### Is my code sent anywhere else?
 
 No. The proxy runs on your own machine. Requests go to the provider you configured and
 nowhere else, and credentials stay in your home directory. See [Privacy](#privacy).
 
+### Will my Claude account get banned? Is this against Anthropic's terms?
+
+What ClaudeRipple does with Claude is small and checkable: a request that stays on Claude
+leaves your machine byte for byte as Claude Code sent it, and a request routed to GPT or
+another provider never reaches Anthropic at all. It works through the proxy and
+certificate settings Claude Code documents for corporate networks (`HTTPS_PROXY`,
+`NODE_EXTRA_CA_CERTS` — [Enterprise network configuration](https://code.claude.com/docs/en/corporate-proxy)),
+not by patching the app. The reports of banned accounts are about
+the opposite direction — a Claude subscription login used from **another** program.
+ClaudeRipple has one optional feature of that kind: Claude inside Codex using your
+subscription login. That use is subject to Anthropic's terms; an Anthropic API key avoids
+the question. Rotating several Claude subscriptions is likewise your call under those
+terms. Only Anthropic can say how an account is treated, so nothing here is a promise.
+
+### Can I use several ChatGPT accounts?
+
+Yes. Each `clauderipple login` (or **+ Add ChatGPT account** in the dashboard) adds one.
+When an account hits its usage limit, the same request moves to the next account and the
+spent one rests until its window resets; a conversation stays on the account that
+answered, to keep its prompt cache. This applies to the Claude Desktop Code tab, Claude
+Code, and GPT in the Codex app and CLI.
+
+### Can I use Claude inside Codex?
+
+Yes. `clauderipple codex on` adds ClaudeRipple as a provider, and Claude models appear in
+the Codex app's and CLI's model list under their own names. They answer through your
+Claude Code login or an Anthropic API key. See [Codex app and Codex CLI](#codex-app-and-codex-cli).
+
+### Does GPT do worse inside Claude Code?
+
+Claude Code's system prompt and tool descriptions are written for Claude, so another model
+reads instructions tuned for someone else, and it may behave a little differently than in
+its own client. ClaudeRipple tells each model its own name and effort, reshapes tool
+schemas a vendor would reject, and lets you append instructions per provider. A common
+setup is Claude as the main model with GPT or DeepSeek as subagents.
+
+### How is this different from CC Switch, opencodex or claude-code-router?
+
+See the [comparison table](#one-tool-instead-of-four). In short: ClaudeRipple reaches
+the Claude **Desktop** Code tab while the app stays signed in to Claude, and shows other
+models in its picker under their real names. CC Switch also reaches the desktop app, but
+by turning on its gateway (3P) mode.
+
+### Is it free?
+
+Yes. ClaudeRipple is open source under GPL-3.0. You pay only for the subscriptions or API
+keys you already use.
+
 ## One tool instead of four
 
-Similar tools are built for the terminal. They let the Claude Code CLI or Codex CLI
-use other models, but they cannot reach the Claude **desktop app**, and the moment
-you switch models you lose the Claude-subscription side (claude.ai chat, Remote
-Control, cloud sessions). ClaudeRipple covers the desktop app, the terminal and
+Similar tools let the Claude Code CLI or Codex CLI use other models, but they either
+cannot reach the Claude **desktop app** or reach it only through its gateway (3P) mode,
+and the moment you switch models you lose the Claude-subscription side (claude.ai chat,
+Remote Control, cloud sessions). ClaudeRipple covers the desktop app, the terminal and
 Codex from one menu-bar app, runs both subscriptions side by side, and keeps the
 Claude Code harness intact: your skills, hooks, MCP servers, `CLAUDE.md`, subagents
 and claude.ai connectors keep working while another model does the thinking.
 
-| | ClaudeRipple | claude-code-router | Claude Desktop gateway (3P) mode |
-|---|---|---|---|
-| Claude **Desktop** Code tab **without** gateway (3P) mode | ✅ | ❌ | ❌ by definition |
-| Keeps claude.ai chat, Remote Control, cloud sessions, connectors | ✅ | ❌ | ❌ |
-| Claude and GPT subscriptions side by side | ✅ | ❌ | ❌ |
-| Real model names in the Desktop picker | ✅ | ❌ | partial |
-| Several ChatGPT accounts, switching when one runs out (Desktop and Codex) | ✅ | ❌ | ❌ |
-| Terminal `claude` CLI | ✅ | ✅ | ✅ |
-| Codex **app** and Codex CLI → Claude | ✅ | ❌ | ❌ |
-| Prompt cache on translated providers | **94–99 %** measured | varies | n/a |
-| Subagents named by real model in the task panel | ✅ | ❌ | ❌ |
-| Settings GUI, no terminal needed | ✅ | ❌ | ❌ |
-| Signed, notarized app with its own runtime | ✅ | ❌ | – |
+| | ClaudeRipple | CC Switch (checked 2026-09-24) | opencodex / openclaude (checked 2026-09-16) | claude-code-router | Claude Desktop gateway (3P) mode |
+|---|---|---|---|---|---|
+| Claude **Desktop** Code tab **without** gateway (3P) mode | ✅ | ❌ ² | ❌ ¹ | ❌ | ❌ by definition |
+| Keeps claude.ai chat, Remote Control, cloud sessions, connectors | ✅ | ❌ | ❌ | ❌ | ❌ |
+| Claude and GPT subscriptions side by side | ✅ | ❌ one provider at a time | ❌ all-or-nothing | ❌ | ❌ |
+| Real model names in the Desktop picker | ✅ | ❌ `claude-*` role names ² | ❌ | ❌ | partial |
+| Several ChatGPT accounts, switching when one runs out (Desktop and Codex) | ✅ | ❌ switched by hand ³ | ✅ | ❌ | ❌ |
+| Terminal `claude` CLI | ✅ | ✅ | ✅ | ✅ | ✅ |
+| Codex **app** and Codex CLI → Claude | ✅ | ✅ | ✅ | ❌ | ❌ |
+| Prompt cache on translated providers | **94–99 %** measured | not measured | not measured | varies | n/a |
+| Subagents named by real model in the task panel | ✅ | ❌ | ❌ | ❌ | ❌ |
+| Settings GUI, no terminal needed | ✅ | ✅ | ❌ | ❌ | ❌ |
+| Signed, notarized app with its own runtime | ✅ | ✅ | ❌ | ❌ | – |
+
+¹ opencodex's README showed Claude Desktop in a demo but published no setup steps for it,
+in the repository or on its documentation site (checked 2026-09-16). At the time the only
+public way into the desktop app was the official gateway setting — the last column.
+
+² CC Switch reaches Claude Desktop by writing the app's third-party profile
+(`Claude-3p/claude_desktop_config.json`, `"inferenceProvider": "gateway"`), which is the
+last column. Through its local gateway the picker shows only `claude-sonnet-*`,
+`claude-opus-*` and `claude-haiku-*` role names ([its manual](https://github.com/farion1231/cc-switch/blob/main/docs/user-manual/en/2-providers/2.6-claude-desktop.md)).
+CC Switch manages more tools than this table covers (Gemini CLI, OpenCode and others) and
+syncs MCP servers and skills across them.
+
+³ Each ChatGPT account is bound to its own provider card, and official ChatGPT cards are
+kept out of the failover queue (v3.20.0 release notes).
 
 The desktop app's own "third-party inference" setting flips the whole app into another
 mode: you lose claude.ai chat, Remote Control and cloud sessions. Tools that replace
-`ANTHROPIC_BASE_URL` never reach the desktop app at all. ClaudeRipple instead is a
+`ANTHROPIC_BASE_URL` never reach the desktop app, and the ones that do reach it write
+that same setting. ClaudeRipple instead is a
 tiny HTTPS proxy that only the Claude Code process trusts: requests for the models
 you map go to your provider, everything else goes to Anthropic byte for byte.
 
 ## What you get
 
-- **Any model in Claude Desktop and Claude Code.** GPT-5.6 Terra / Sol / Luna and
-  GPT-6 Astra through your ChatGPT Plus/Pro subscription, or DeepSeek, Kimi, GLM,
+- **Any model in Claude Desktop and Claude Code.** GPT-6 Sol / Luna / Astra and
+  GPT-5.6 Terra / Sol / Luna through your ChatGPT Plus/Pro subscription (new models
+  appear the day OpenAI serves them), or DeepSeek, Kimi, GLM,
   MiniMax, Qwen, Grok, Mistral, Groq, Together, Fireworks, OpenRouter (400+ models)
   and local Ollama / LM Studio. Under their real names in the picker, or mapped onto
   a Claude name.
@@ -214,6 +286,17 @@ curl -fsSL https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts/ins
 irm https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts/install.ps1 | iex
 ```
 
+**Linux** (a desktop session with systemd)
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts/install.sh | sh
+```
+
+The router runs as a per-user systemd service: `systemctl --user status clauderipple`, and
+`journalctl --user -u clauderipple` for what it printed. Picker mode trusts the local CA in the
+NSS database Chromium reads (`~/.pki/nssdb`, your user only, no sudo), which takes `certutil`:
+run `sudo apt install libnss3-tools` (Fedora: `sudo dnf install nss-tools`) before `clauderipple picker on`.
+
 That is the whole prerequisite list. The script uses a Node 24+ you already have, and
 downloads the official build into `~/.clauderipple/runtime` when you have none,
 verifying it against the checksum nodejs.org publishes. Then it sets ClaudeRipple up:
@@ -255,12 +338,13 @@ clauderipple restart
 Optional, for real names in the Desktop picker: **Clients → Claude Desktop → Model
 picker → on**, then quit and reopen Claude Desktop. To trust the local certificate
 for your user only, macOS asks for your login password and Windows shows a
-confirmation dialog with the fingerprint — ClaudeRipple never sees a password, and
-neither platform needs administrator rights.
+confirmation dialog with the fingerprint; Linux adds it to your NSS database without asking.
+ClaudeRipple never sees a password, and no platform needs administrator rights.
 
 > **Closing Claude Desktop's window is not enough.** It keeps running, and the next
 > launch reuses it without reading the new setting. Quit it properly (macOS: ⌘Q;
-> Windows: the tray icon, or Task Manager) or the picker will silently not change.
+> Windows: the tray icon, or Task Manager; Linux: Ctrl+Q or the tray icon, until
+> `pgrep -f claude-desktop` prints nothing) or the picker will silently not change.
 
 <details>
 <summary>From source (Node 24)</summary>
@@ -368,7 +452,7 @@ provider you configured is available the same way.
 
 | Provider | Kind | Auth | Model list | Notes |
 |---|---|---|---|---|
-| ChatGPT subscription | Codex backend | several sign-ins, switching when one runs out (Codex login reused too) | Terra, Sol, Luna, Astra | effort low…max (Luna: ultra), prompt cache 94–99 % |
+| ChatGPT subscription | Codex backend | several sign-ins, switching when one runs out (Codex login reused too) | read from your subscription (GPT-6 Sol, Luna, Astra, GPT-5.6 …) | effort low…max (Luna: ultra), prompt cache 94–99 % |
 | OpenRouter | Anthropic-compatible | API key | 400+, discovered | per-model effort support read from the API |
 | DeepSeek, Kimi, Z.ai GLM, MiniMax, Qwen (intl / cn) | Anthropic-compatible | API key | preset | verified against vendor docs |
 | xAI Grok, Mistral, Groq, Together, Fireworks | OpenAI-compatible | API key | discovered | translated (Chat Completions / Responses) |
@@ -417,6 +501,9 @@ In daily use by the author, but young. Expect rough edges:
   in, the picker and a live GPT call are verified on x64 hardware; crash recovery
   on arm64. The window still has the stock Windows title bar. Windows builds are
   unsigned; see the note under Install.
+- **Linux support is new (2026-09-24)**, contributed with measurements on Ubuntu
+  24.04 x64 (install, a Code-tab request, restart mid-stream, picker mode, uninstall).
+  It needs a systemd user session; other distributions and arm64 are untested.
 - ChatGPT, OpenRouter and Claude-in-Codex are verified with live accounts; the
   other presets follow the vendors' official documentation.
 - A model added to the picker is usable from the next session.

package/dist/cli/src/browser.js

@@ -1,6 +1,7 @@
 // Opens a URL in the user's default browser. Shared by the CLI (sign-in commands, `ui`) and the
 // router's admin API (sign-in started from the GUI).
 import { execFileSync } from "node:child_process";
+import { windowsPowerShellEnv } from "./windows-powershell.js";
 /** Returns false if the platform command failed; the caller then shows the URL instead. */
 export function openBrowser(url) {
     try {
@@ -9,10 +10,10 @@ export function openBrowser(url) {
             // at its first parameter and the provider answers "missing_required_parameter" (observed
             // 2026-09-14). Start-Process takes the URL as one argument, quoted PowerShell-style.
             const quoted = `'${url.replace(/'/g, "''")}'`;
-            execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Start-Process ${quoted}`], { stdio: "ignore", windowsHide: true });
+            execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Start-Process ${quoted}`], { env: windowsPowerShellEnv(), stdio: "ignore", windowsHide: true });
         }
         else
-            execFileSync("open", [url], { stdio: "ignore" });
+            execFileSync(process.platform === "linux" ? "xdg-open" : "open", [url], { stdio: "ignore" });
         return true;
     }
     catch {

package/dist/cli/src/claude-auth.js

@@ -19,6 +19,10 @@ const isWindows = process.platform === "win32";
 const BINARY_NAMES = isWindows ? ["claude.exe", "claude.cmd", "claude.bat"] : ["claude"];
 /** Where Claude Desktop caches the CLI it downloads, per platform. */
 export function desktopClaudeCodeDirs() {
+    // Linux: Electron's userData is $XDG_CONFIG_HOME/Claude (seen with Claude Desktop 2.2553.13 on
+    // Ubuntu 24.04: ~/.config/Claude/claude-code/2.1.280/claude, a plain executable).
+    if (process.platform === "linux")
+        return [path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "Claude", "claude-code")];
     if (!isWindows)
         return [path.join(os.homedir(), "Library", "Application Support", "Claude", "claude-code")];
     const roots = [
@@ -29,6 +33,8 @@ export function desktopClaudeCodeDirs() {
 }
 /** Launcher inside one cached version directory. The macOS build nests an .app bundle. */
 function versionBinaries(versionDir) {
+    if (process.platform === "linux")
+        return [path.join(versionDir, "claude")];
     return isWindows
         ? BINARY_NAMES.map((name) => path.join(versionDir, name))
         : [path.join(versionDir, "claude.app", "Contents", "MacOS", "claude")];

package/dist/cli/src/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 // clauderipple — install / uninstall / status / start / stop / restart / logs / config
 //
-// install:   generates the local CA + leaf, writes a starter config, points
-//            ~/.claude/settings.json env at the router, registers the launchd agent,
-//            then probes the whole chain end to end.
+// install:   generates the local CA + leaf, writes a starter config, registers the supervisor
+//            (launchd / Task Scheduler / systemd), probes the whole chain end to end, and only
+//            then points ~/.claude/settings.json env at the router.
 // uninstall: reverses exactly that. Home dir is kept unless --purge.
 import fs from "node:fs";
 import net from "node:net";
@@ -13,10 +13,10 @@ import { execFileSync } from "node:child_process";
 import { ConfigStore, DEFAULTS, homeDir, configPath } from "../../router/src/config.js";
 import { adminPort } from "../../router/src/admin.js";
 import { certsExist, certPaths, generateCerts } from "./certs.js";
-import { applyProxyEnv, currentProxyEnv, removeProxyEnv, settingsPath } from "./settings.js";
-import { agentDefinitionPath, agentState, installAgent, isSupported, isWindows, removeAgent, restartAgent, startAgent, stopAgent, supervisorName } from "./supervisor.js";
+import { applyProxyEnv, checkProxyEnv, currentProxyEnv, removeProxyEnv, settingsPath } from "./settings.js";
+import { agentDefinitionPath, agentState, installAgent, isLinux, isSupported, isWindows, removeAgent, restartAgent, startAgent, stopAgent, supervisorName } from "./supervisor.js";
 import { BUNDLE_ID, removeBundle, writeBundle } from "./bundle.js";
-import { applyAppProxy, caTrusted, currentAppProxy, removeAppProxy, trustCa, untrustCa } from "./picker.js";
+import { applyAppProxy, caTrusted, currentAppProxy, nssDb, removeAppProxy, trustCa, untrustCa } from "./picker.js";
 import { runtime } from "./runtime.js";
 import { codexOff, codexOn } from "./codex.js";
 import { ingressModels } from "../../router/src/ingress/models.js";
@@ -36,14 +36,21 @@ async function pickerOn() {
     const caPem = certPaths(home).caPem;
     if (!fs.existsSync(path.join(home, "ca.key")))
         throw new Error("ca.key missing; run `clauderipple install` first");
+    // With picker mode on, every byte Claude Desktop sends goes through the router (ARCHITECTURE §5):
+    // pointing the app at one that is not answering leaves it a blank page, so check first.
+    const ready = await probe({ host: cfg.listen.host, port: cfg.listen.port, caPem, upstream: cfg.upstream });
+    if (!ready.ok)
+        throw new Error(`the router is not answering (${ready.detail}); picker mode not enabled. Start it with \`clauderipple start\` and try again.`);
     console.log("Picker mode makes Claude Desktop's own claude.ai traffic go through ClaudeRipple so the model picker can list your GPT models.");
     console.log(isWindows
         ? "Step 1/3: trusting the ClaudeRipple CA for your Windows user account. Windows will show a confirmation dialog with the certificate fingerprint — answer Yes. No administrator rights are needed."
-        : "Step 1/3: trusting the ClaudeRipple CA in your login keychain. macOS will ask for your password (ClaudeRipple never sees it).");
+        : isLinux
+            ? `Step 1/3: trusting the ClaudeRipple CA in your NSS database (${nssDb()}), which Chromium and so Claude Desktop reads. Your user only; no password, no sudo.`
+            : "Step 1/3: trusting the ClaudeRipple CA in your login keychain. macOS will ask for your password (ClaudeRipple never sees it).");
     trustCa(caPem);
-    if (!caTrusted())
+    if (!caTrusted(caPem))
         throw new Error("CA is not trusted; picker mode not enabled");
-    console.log(isWindows ? "✓ CA trusted (current user only)" : "✓ CA trusted (login keychain only)");
+    console.log(isWindows || isLinux ? "✓ CA trusted (current user only)" : "✓ CA trusted (login keychain only)");
     const proxyUrl = proxyUrlFor(cfg.listen.port);
     const r = applyAppProxy(proxyUrl);
     console.log(`✓ Claude Desktop config library entry applied (${r.id}${r.replaced ? `, previous entry ${r.replaced} remembered` : ""}): egressProxyUrl=${proxyUrl}`);
@@ -72,7 +79,7 @@ function pickerOff() {
     }
     if (isWindows)
         console.log("Removing the CA: Windows will ask you to confirm once more.");
-    const store = isWindows ? "your user certificate store" : "the login keychain";
+    const store = isWindows ? "your user certificate store" : isLinux ? `your NSS database (${nssDb()})` : "the login keychain";
     console.log(untrustCa(certPaths(home).caPem) ? `✓ CA removed from ${store}` : `✓ CA was not in ${store}`);
     console.log("\nQuit and reopen Claude Desktop to apply.");
 }
@@ -119,7 +126,7 @@ async function install() {
     const home = homeDir();
     const port = Number(opt("port") ?? DEFAULTS.listen.port);
     if (!isSupported)
-        throw new Error(`install supports macOS and Windows; on ${process.platform} run the router manually.`);
+        throw new Error(`install supports macOS, Windows and Linux (systemd); on ${process.platform} run the router manually.`);
     fs.mkdirSync(home, { recursive: true, mode: 0o700 });
     if (!certsExist(home)) {
         generateCerts(home, DEFAULTS.upstream);
@@ -137,10 +144,10 @@ async function install() {
     const proxyUrl = proxyUrlFor(cfg.listen.port);
     const caPath = certPaths(home).caPem;
     const maxCtx = opt("max-context-tokens");
-    const edit = applyProxyEnv({ proxyUrl, caPath, force: flag("force"), ...(maxCtx ? { maxContextTokens: Number(maxCtx) } : {}), models: cfg.cli.models ?? {} });
-    console.log(edit.changed ? `✓ ${settingsPath()} updated (backup: ${edit.backup ?? "none"})` : `✓ ${settingsPath()} already correct`);
-    for (const n of edit.notes)
-        console.log(`  note: ${n}`);
+    // settings.json is written last, after the probe: from that write on, every new Claude Code
+    // session sends everything to this router, so it must not point at one that never came up.
+    // A foreign proxy is still refused here, before anything is registered.
+    checkProxyEnv({ proxyUrl, force: flag("force") });
     // Persist the single execution contract so the GUI, admin API, hooks, and supervisor all use
     // this installation's runtime rather than any Node installation on the user's PATH.
     fs.writeFileSync(path.join(home, "paths.json"), JSON.stringify({
@@ -151,9 +158,9 @@ async function install() {
         hookScript: installedRuntime.hookScript,
         repo: installedRuntime.repo,
     }, null, 2) + "\n");
-    // Windows registers node + the router script directly (schtasks.ts writes its own .cmd launcher);
-    // a macOS source checkout gets a small .app so the agent shows a real name in Login Items.
-    if (installedRuntime.packaged || isWindows) {
+    // Windows and Linux register node + the router script directly (schtasks.ts writes its own .cmd
+    // launcher); a macOS source checkout gets a small .app so the agent shows a real name in Login Items.
+    if (installedRuntime.packaged || isWindows || isLinux) {
         const plist = installAgent({
             program: installedRuntime.node,
             args: [installedRuntime.router],
@@ -161,7 +168,7 @@ async function install() {
             home,
             env: { ...installedRuntime.env, ...(process.env.CLAUDE_SETTINGS_PATH ? { CLAUDE_SETTINGS_PATH: process.env.CLAUDE_SETTINGS_PATH } : {}) },
         });
-        console.log(`✓ ${supervisorName()} registered: ${plist} (shows as "ClaudeRipple" in Login Items)`);
+        console.log(`✓ ${supervisorName()} registered: ${plist}${isLinux ? "" : ' (shows as "ClaudeRipple" in Login Items)'}`);
     }
     else {
         const launcher = writeBundle({ home, node: installedRuntime.node, script: installedRuntime.router, version: VERSION });
@@ -180,10 +187,16 @@ async function install() {
     console.log(started === "failed" ? `✗ could not start the router (${supervisorName()})` : `✓ router ${started === "already-running" ? "already running" : "started"}`);
     const p = await probeWithRetry({ host: cfg.listen.host, port: cfg.listen.port, caPem: caPath, upstream: cfg.upstream });
     console.log(p.ok ? `✓ end-to-end probe passed (${p.detail}, ${p.ms}ms)` : `✗ probe failed: ${p.detail}`);
-    if (!p.ok)
+    if (!p.ok) {
         process.exitCode = 1;
-    else
-        console.log("\nDone. New Claude Desktop Code sessions go through ClaudeRipple. Existing sessions pick up settings.json env changes on their next request.");
+        console.log(`${settingsPath()} was left as it was, so Claude Code does not depend on a router that is not answering. Fix the router, then run install again.`);
+        return;
+    }
+    const edit = applyProxyEnv({ proxyUrl, caPath, force: flag("force"), ...(maxCtx ? { maxContextTokens: Number(maxCtx) } : {}), models: cfg.cli.models ?? {} });
+    console.log(edit.changed ? `✓ ${settingsPath()} updated (backup: ${edit.backup ?? "none"})` : `✓ ${settingsPath()} already correct`);
+    for (const n of edit.notes)
+        console.log(`  note: ${n}`);
+    console.log("\nDone. New Claude Desktop Code sessions go through ClaudeRipple. Existing sessions pick up settings.json env changes on their next request.");
 }
 function uninstall() {
     const home = homeDir();
@@ -238,7 +251,7 @@ async function status() {
     rows.push(["settings.json", env.HTTPS_PROXY === proxyUrl && env.NODE_EXTRA_CA_CERTS === caPath ? "points at ClaudeRipple" : `HTTPS_PROXY=${env.HTTPS_PROXY ?? "-"} NODE_EXTRA_CA_CERTS=${env.NODE_EXTRA_CA_CERTS ?? "-"}`]);
     rows.push([supervisorName(), agentState()]);
     const ap = currentAppProxy();
-    rows.push(["picker mode", cfg.picker?.enabled ? `on · CA ${caTrusted() ? "trusted" : "NOT trusted"} · app proxy ${ap.ours ? ap.egressProxyUrl : "NOT set"}` : `off${ap.ours ? " (app proxy entry still present — run `picker off`)" : ""}`]);
+    rows.push(["picker mode", cfg.picker?.enabled ? `on · CA ${caTrusted(caPath) ? "trusted" : "NOT trusted"} · app proxy ${ap.ours ? ap.egressProxyUrl : "NOT set"}` : `off${ap.ours ? " (app proxy entry still present — run `picker off`)" : ""}`]);
     const p = await probe({ host: cfg.listen.host, port: cfg.listen.port, caPem: caPath, upstream: cfg.upstream });
     rows.push(["probe", `${p.ok ? "ok" : "FAIL"}: ${p.detail} (${p.ms}ms)`]);
     for (const [name, p2] of Object.entries(cfg.providers)) {

package/dist/cli/src/picker.js

@@ -1,6 +1,8 @@
 // `clauderipple picker on|off` — put real model names into Claude Desktop's model picker.
 //
-// on:  1. trust our CA in the login keychain (macOS asks the user for their password; we never see it)
+// on:  1. trust our CA for this user: login keychain (macOS asks for the password; we never see it),
+//         Cert:\CurrentUser\Root (Windows shows a confirmation dialog), or the NSS database Chromium
+//         reads on Linux (~/.pki/nssdb; no prompt, no sudo)
 //      2. point the app itself at the router: Config Library entry {egressProxyUrl} + _meta.json appliedId
 //         (~/Library/Application Support/Claude-3p/configLibrary/ — the app keeps its managed-config
 //         library under the "-3p" userData dir in BOTH deployment modes; read once at start, no MDM needed)
@@ -8,10 +10,11 @@
 //      → the user restarts Claude Desktop.
 // off: reverse all three.
 import { execFileSync } from "node:child_process";
-import crypto from "node:crypto";
+import crypto, { X509Certificate } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { windowsPowerShellEnv } from "./windows-powershell.js";
 export const CA_NAME = "ClaudeRipple local CA";
 function appSupport() {
     // Verified in index.pre.js (AW()): userData + "-3p" regardless of 1P/3P mode. Not the plain "Claude" dir.
@@ -22,6 +25,10 @@ function appSupport() {
     if (process.platform === "win32") {
         return path.join(process.env.LOCALAPPDATA ?? path.join(os.homedir(), "AppData", "Local"), "Claude-3p");
     }
+    // Linux userData is $XDG_CONFIG_HOME/Claude, so the same "-3p" rule gives ~/.config/Claude-3p
+    // (Claude Desktop 2.2553.13's bundle: `${app.getPath("userData")}-3p`, no Linux special case).
+    if (process.platform === "linux")
+        return path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "Claude-3p");
     return path.join(os.homedir(), "Library", "Application Support", "Claude-3p");
 }
 export function configLibraryDir() {
@@ -31,6 +38,84 @@ function loginKeychain() {
     return path.join(os.homedir(), "Library", "Keychains", "login.keychain-db");
 }
 const isWindows = process.platform === "win32";
+const isLinux = process.platform === "linux";
+// ---- Linux: the NSS database ------------------------------------------------------------
+//
+// Chromium on Linux takes locally added roots from the user's NSS database, not from /etc/ssl,
+// and Claude Desktop is Chromium: a CA only in the system bundle would leave the app a blank page
+// behind the router. certutil comes from libnss3-tools, which a desktop install does not always have.
+/** Test-only override; production always uses the database Chromium reads. */
+export function nssDb() {
+    return process.env.CLAUDERIPPLE_NSS_DB ?? path.join(os.homedir(), ".pki", "nssdb");
+}
+/**
+ * The fingerprint is part of the name so a CA from an earlier install is never taken for the
+ * current one: trusting the old one would pass a check by name and still fail every handshake.
+ */
+export function nssNickname(caPem) {
+    return `${CA_NAME} ${new X509Certificate(fs.readFileSync(caPem)).fingerprint256.replace(/:/g, "").slice(0, 24)}`;
+}
+function certutil(args) {
+    return execFileSync("certutil", ["-d", `sql:${nssDb()}`, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+/** Every ClaudeRipple CA in the database, including ones left by an earlier install. */
+function nssOurNicknames() {
+    let out;
+    try {
+        out = certutil(["-L"]);
+    }
+    catch {
+        return [];
+    }
+    // One line per certificate: the nickname, then its trust flags ("C,,") as the last column.
+    return out
+        .split("\n")
+        .map((line) => /^(.*\S)\s+\S*,\S*,\S*\s*$/.exec(line)?.[1])
+        .filter((name) => !!name && name.startsWith(CA_NAME));
+}
+export function nssTrusted(caPem) {
+    try {
+        const name = nssNickname(caPem);
+        const installed = new X509Certificate(certutil(["-L", "-n", name, "-a"]));
+        if (installed.fingerprint256 !== new X509Certificate(fs.readFileSync(caPem)).fingerprint256)
+            return false;
+        // Validated as an SSL CA (-u L): that is the trust a handshake needs, not mere presence.
+        certutil(["-V", "-n", name, "-u", "L"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function nssTrust(caPem) {
+    if (nssTrusted(caPem))
+        return;
+    try {
+        fs.mkdirSync(nssDb(), { recursive: true, mode: 0o700 });
+        if (!fs.existsSync(path.join(nssDb(), "cert9.db")))
+            certutil(["-N", "--empty-password"]);
+        certutil(["-A", "-n", nssNickname(caPem), "-t", "C,,", "-i", caPem]);
+    }
+    catch (e) {
+        if (e.code === "ENOENT") {
+            throw new Error("certutil not found. Install it (Ubuntu/Debian: `sudo apt install libnss3-tools`, Fedora: `sudo dnf install nss-tools`), then run `clauderipple picker on` again");
+        }
+        throw e;
+    }
+}
+/** Removes every ClaudeRipple CA, current or left over from an earlier install. */
+export function nssUntrust() {
+    const names = nssOurNicknames();
+    for (const name of names) {
+        try {
+            certutil(["-D", "-n", name]);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    return names.length > 0;
+}
 /** Single-quoted PowerShell literal; the only escape inside one is a doubled quote. */
 function ps(value) {
     return `'${value.replace(/'/g, "''")}'`;
@@ -45,19 +130,23 @@ function powershell(script, opts = {}) {
     const stdio = opts.stdio ?? "pipe";
     const args = ["-NoProfile", ...(opts.interactive ? [] : ["-NonInteractive"]), "-Command", script];
     return execFileSync("powershell.exe", args, {
+        env: windowsPowerShellEnv(),
         stdio: stdio === "pipe" ? ["ignore", "pipe", "pipe"] : stdio,
         windowsHide: !opts.interactive,
     })?.toString() ?? "";
 }
 /**
- * Both platforms trust the CA for the current user only — never machine-wide, which would need
+ * Every platform trusts the CA for the current user only — never machine-wide, which would need
  * administrator rights and would affect everyone on the box.
  *   macOS   : login keychain, and the OS asks for the account password.
  *   Windows : Cert:\CurrentUser\Root, and the OS shows a confirmation dialog with the fingerprint.
+ *   Linux   : the user's NSS database (see nssDb), with no prompt at all.
  * Measured on Windows 11 (2026-09-14) as a standard user: the import succeeded with no UAC prompt,
  * only that dialog. Removal shows a second confirmation, so `picker off` prompts the user too.
  */
-export function caTrusted() {
+export function caTrusted(caPem) {
+    if (isLinux)
+        return nssTrusted(caPem);
     try {
         if (isWindows) {
             const out = powershell(`@(Get-ChildItem Cert:\\CurrentUser\\Root | Where-Object { $_.Subject -eq 'CN=${CA_NAME}' }).Count`);
@@ -72,7 +161,9 @@ export function caTrusted() {
 }
 /** Adds the CA as a trusted root for the current user. The OS shows its own prompt; we never see a password. */
 export function trustCa(caPem) {
-    if (caTrusted())
+    if (isLinux)
+        return nssTrust(caPem);
+    if (caTrusted(caPem))
         return;
     if (isWindows) {
         // stdio inherit: the confirmation dialog is the OS's, but errors should reach the user's terminal.
@@ -82,7 +173,9 @@ export function trustCa(caPem) {
     execFileSync("security", ["add-trusted-cert", "-r", "trustRoot", "-k", loginKeychain(), caPem], { stdio: "inherit" });
 }
 export function untrustCa(caPem) {
-    if (!caTrusted())
+    if (isLinux)
+        return nssUntrust();
+    if (!caTrusted(caPem))
         return false;
     if (isWindows) {
         try {

package/dist/cli/src/schtasks.js

@@ -16,6 +16,7 @@ import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { windowsPowerShellEnv } from "./windows-powershell.js";
 export const TASK_NAME = "ClaudeRippleRouter";
 export function taskName() {
     return process.env.CLAUDERIPPLE_TASK_NAME ?? TASK_NAME;
@@ -27,6 +28,7 @@ function ps(value) {
 function run(script) {
     try {
         const out = execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            env: windowsPowerShellEnv(),
             stdio: ["ignore", "pipe", "pipe"],
             windowsHide: true,
         }).toString();

package/dist/cli/src/settings.js

@@ -36,15 +36,22 @@ export const MODEL_SLOT_ENV = {
     smallFast: "ANTHROPIC_SMALL_FAST_MODEL",
     subagent: "CLAUDE_CODE_SUBAGENT_MODEL",
 };
+function refuseForeignProxy(existing, proxyUrl, force) {
+    if (existing && existing !== proxyUrl && !force) {
+        throw new Error(`settings.json env.HTTPS_PROXY is already "${existing}". Re-run with --force to replace it, or uninstall the other proxy first.`);
+    }
+}
+/** The refusal `applyProxyEnv` would give, without writing: lets `install` fail before it registers anything. */
+export function checkProxyEnv(opts) {
+    refuseForeignProxy(currentProxyEnv().HTTPS_PROXY, opts.proxyUrl, opts.force);
+}
 export function applyProxyEnv(opts) {
     const file = settingsPath();
     const s = readSettings(file);
     const env = { ...(s.env ?? {}) };
     const notes = [];
     const existing = env.HTTPS_PROXY;
-    if (existing && existing !== opts.proxyUrl && !opts.force) {
-        throw new Error(`settings.json env.HTTPS_PROXY is already "${existing}". Re-run with --force to replace it, or uninstall the other proxy first.`);
-    }
+    refuseForeignProxy(existing, opts.proxyUrl, opts.force);
     if (existing && existing !== opts.proxyUrl)
         notes.push(`replaced HTTPS_PROXY ${existing}`);
     const want = { HTTPS_PROXY: opts.proxyUrl, NODE_EXTRA_CA_CERTS: opts.caPath };

package/dist/cli/src/supervisor.js

@@ -1,32 +1,38 @@
-// One supervisor interface, two implementations: launchd on macOS, Task Scheduler on Windows.
+// One supervisor interface, three implementations: launchd on macOS, Task Scheduler on Windows,
+// a systemd user service on Linux.
 // Everything outside this module talks to the router's lifecycle through here.
 import { execFileSync } from "node:child_process";
 import { ConfigStore, configPath } from "../../router/src/config.js";
 import { adminPort } from "../../router/src/admin.js";
 import * as launchd from "./launchd.js";
 import * as schtasks from "./schtasks.js";
+import * as systemd from "./systemd.js";
+import { windowsPowerShellEnv } from "./windows-powershell.js";
 export const isWindows = process.platform === "win32";
-export const isSupported = isWindows || process.platform === "darwin";
+export const isLinux = process.platform === "linux";
+export const isSupported = isWindows || isLinux || process.platform === "darwin";
 /** What the supervisor is called on this platform, for messages the user reads. */
 export function supervisorName() {
-    return isWindows ? "scheduled task" : "launchd agent";
+    return isWindows ? "scheduled task" : isLinux ? "systemd user service" : "launchd agent";
 }
 export function installAgent(opts) {
-    return isWindows ? schtasks.installAgent(opts) : launchd.installAgent(opts);
+    return isWindows ? schtasks.installAgent(opts) : isLinux ? systemd.installAgent(opts) : launchd.installAgent(opts);
 }
 export function removeAgent() {
-    return isWindows ? schtasks.removeAgent() : launchd.removeAgent();
+    return isWindows ? schtasks.removeAgent() : isLinux ? systemd.removeAgent() : launchd.removeAgent();
 }
 export function agentState() {
-    return isWindows ? schtasks.agentState() : launchd.agentState();
+    return isWindows ? schtasks.agentState() : isLinux ? systemd.agentState() : launchd.agentState();
 }
 export function agentPid() {
-    return isWindows ? schtasks.agentPid() : launchd.agentPid();
+    return isWindows ? schtasks.agentPid() : isLinux ? systemd.agentPid() : launchd.agentPid();
 }
 export function startAgent() {
-    return isWindows ? schtasks.startAgent() : launchd.startAgent();
+    return isWindows ? schtasks.startAgent() : isLinux ? systemd.startAgent() : launchd.startAgent();
 }
 export function stopAgent() {
+    if (isLinux)
+        return systemd.stopAgent();
     if (!isWindows)
         return launchd.stopAgent();
     // Ask the router to drain first: a clean exit also ends the launcher's supervision loop, so the
@@ -38,7 +44,7 @@ export function stopAgent() {
 /** Blocking POST to the router's shutdown endpoint. Returns false if it did not answer. */
 function askShutdown() {
     try {
-        execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Invoke-RestMethod -Method Post -Uri '${adminUrl()}/api/shutdown' -TimeoutSec 10 | Out-Null`], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Invoke-RestMethod -Method Post -Uri '${adminUrl()}/api/shutdown' -TimeoutSec 10 | Out-Null`], { env: windowsPowerShellEnv(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
         return true;
     }
     catch {
@@ -92,9 +98,9 @@ function restartWindows(opts) {
     return schtasks.startAgent() === "failed" ? "failed" : "drained";
 }
 export function restartAgent(opts = {}) {
-    return isWindows ? restartWindows(opts) : launchd.restartAgent(opts);
+    return isWindows ? restartWindows(opts) : isLinux ? systemd.restartAgent(opts) : launchd.restartAgent(opts);
 }
 /** Path to the supervisor's own definition, for status output. */
 export function agentDefinitionPath() {
-    return isWindows ? `Task Scheduler\\${schtasks.taskName()}` : launchd.plistPath();
+    return isWindows ? `Task Scheduler\\${schtasks.taskName()}` : isLinux ? systemd.unitPath() : launchd.plistPath();
 }

package/dist/cli/src/systemd.js

@@ -0,0 +1,126 @@
+// Linux supervisor: a per-user systemd service that keeps the router alive. No sudo, nothing
+// machine-wide. Restart=always + RestartSec=2 is launchd's KeepAlive + ThrottleInterval 2: a
+// self-exit (code 75) is followed by a fresh process two seconds later, and StartLimitIntervalSec=0
+// keeps systemd from giving up on it after a burst of those.
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const HEADER = "[Unit]\nDescription=ClaudeRipple local model router\n";
+/** Test-only override; production always uses clauderipple.service. */
+export function unitName() {
+    const name = process.env.CLAUDERIPPLE_SYSTEMD_UNIT ?? "clauderipple.service";
+    if (!/^[A-Za-z0-9_.-]+\.service$/.test(name))
+        throw new Error(`invalid systemd unit name: ${name}`);
+    return name;
+}
+export function unitPath() {
+    const config = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+    return path.join(config, "systemd", "user", unitName());
+}
+/**
+ * One quoted unit-file word. `%` is a specifier and `$` an environment substitution in ExecStart
+ * (systemd.service(5)), so a path containing either has to be escaped or it runs something else.
+ */
+function quote(value, dollar) {
+    if (/[\r\n\0]/.test(value))
+        throw new Error("newlines and NUL cannot appear in a systemd unit value");
+    let s = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%");
+    if (dollar)
+        s = s.replace(/\$/g, "$$$$");
+    return `"${s}"`;
+}
+export function renderUnit(opts) {
+    if (!path.isAbsolute(opts.program))
+        throw new Error("the service program must be an absolute path");
+    const env = { CLAUDERIPPLE_HOME: opts.home, ...(opts.env ?? {}) };
+    const envLines = Object.entries(env).map(([k, v]) => {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k))
+            throw new Error(`invalid environment name: ${k}`);
+        return `Environment=${quote(`${k}=${v}`, false)}`;
+    });
+    // TimeoutStopSec covers the router's 90s drain on SIGTERM (ARCHITECTURE §5) with room to spare;
+    // KillMode=mixed sends that SIGTERM to the router alone and SIGKILLs only what outlives the budget.
+    return `${HEADER}StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+ExecStart=${[opts.program, ...(opts.args ?? [])].map((a) => quote(a, true)).join(" ")}
+${envLines.join("\n")}
+Restart=always
+RestartSec=2
+KillSignal=SIGTERM
+KillMode=mixed
+TimeoutStopSec=120
+UMask=0077
+
+[Install]
+WantedBy=default.target
+`;
+}
+function systemctl(args) {
+    try {
+        const out = execFileSync("systemctl", ["--user", ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 150_000 });
+        return { ok: true, out };
+    }
+    catch (e) {
+        const err = e;
+        return { ok: false, out: err.stderr?.toString().trim() || err.message || "systemctl failed" };
+    }
+}
+function mustSystemctl(args) {
+    const r = systemctl(args);
+    if (!r.ok)
+        throw new Error(`systemctl --user ${args.join(" ")} failed: ${r.out}`);
+}
+export function installAgent(opts) {
+    // No user manager (an ssh login without lingering, a container) means nothing would ever start
+    // the router: fail here, before any file is written.
+    mustSystemctl(["show-environment"]);
+    const file = unitPath();
+    if (fs.existsSync(file) && !fs.readFileSync(file, "utf8").startsWith(HEADER)) {
+        throw new Error(`${file} exists and is not ClaudeRipple's; refusing to replace it`);
+    }
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, renderUnit(opts), { mode: 0o600 });
+    mustSystemctl(["daemon-reload"]);
+    mustSystemctl(["enable", unitName()]);
+    return file;
+}
+export function removeAgent() {
+    const file = unitPath();
+    if (!fs.existsSync(file))
+        return false;
+    mustSystemctl(["disable", "--now", unitName()]);
+    fs.unlinkSync(file);
+    mustSystemctl(["daemon-reload"]);
+    return true;
+}
+export function agentState() {
+    const r = systemctl(["show", unitName(), "--property=ActiveState", "--value"]);
+    if (r.ok && r.out.trim() === "active")
+        return "running";
+    return fs.existsSync(unitPath()) ? "loaded" : "not-loaded";
+}
+export function agentPid() {
+    const r = systemctl(["show", unitName(), "--property=MainPID", "--value"]);
+    const pid = Number(r.out.trim());
+    return r.ok && Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+/** Idempotent, like launchd's: a running router is left alone (ARCHITECTURE §5, "Start Router"). */
+export function startAgent() {
+    if (agentState() === "running")
+        return "already-running";
+    return systemctl(["start", unitName()]).ok ? "started" : "failed";
+}
+export function stopAgent() {
+    return systemctl(["stop", unitName()]).ok;
+}
+/**
+ * systemd sends the SIGTERM, waits for the process to exit (up to TimeoutStopSec) and then starts
+ * a new one, so the drain is never cut the way `launchctl kickstart -k` cut it.
+ */
+export function restartAgent(opts = {}) {
+    opts.onProgress?.("waiting for in-flight model calls to finish (up to 120s)…");
+    return systemctl(["restart", unitName()]).ok ? "drained" : "failed";
+}

package/dist/cli/src/windows-powershell.js

@@ -0,0 +1,13 @@
+// Environment for every powershell.exe (Windows PowerShell 5.1) the CLI and router start.
+//
+// PowerShell 7 puts its own module directories at the front of PSModulePath. pwsh strips them
+// when it starts powershell.exe itself, but not when another process sits in between: from a pwsh
+// terminal the chain pwsh → node → powershell.exe hands 5.1 the PowerShell 7 copy of
+// Microsoft.PowerShell.Security, which fails to load, and the Cert: drive goes with it.
+// `picker on` then stopped at "Cannot find drive 'Cert'" and `status` read a trusted CA as
+// untrusted (measured on Windows 11 with PowerShell 7.6.6, issue #35). Without the variable,
+// Windows PowerShell rebuilds its own default from the registry.
+/** process.env minus PSModulePath, matched without regard to case as Windows does. */
+export function windowsPowerShellEnv() {
+    return Object.fromEntries(Object.entries(process.env).filter(([k]) => k.toLowerCase() !== "psmodulepath"));
+}

package/dist/router/src/admin.js

@@ -27,6 +27,7 @@ import { codexEnabled, codexHome } from "../../cli/src/codex.js";
 import { openBrowser } from "../../cli/src/browser.js";
 import { caTrusted, currentAppProxy } from "../../cli/src/picker.js";
 import { certPaths } from "../../cli/src/certs.js";
+import { desktopClaudeCodeDirs } from "../../cli/src/claude-auth.js";
 import { syncModelSlots } from "../../cli/src/settings.js";
 import { ClaudeOAuthSession } from "./providers/claude-oauth.js";
 import { readClaudeAuthFile } from "./providers/anthropic-token-file.js";
@@ -153,18 +154,23 @@ function uiRevision() {
         return "0";
     }
 }
+/** Newest CLI the Desktop app has cached, from the same per-platform directories sign-in uses. */
 function cliVersion() {
-    const dir = path.join(os.homedir(), "Library", "Application Support", "Claude", "claude-code");
-    try {
-        const versions = fs
-            .readdirSync(dir)
-            .filter((d) => /^\d+\.\d+\.\d+$/.test(d))
-            .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
-        return versions.length ? versions[versions.length - 1] : "none";
+    let readable = false;
+    const versions = [];
+    for (const dir of desktopClaudeCodeDirs()) {
+        try {
+            versions.push(...fs.readdirSync(dir).filter((d) => /^\d+\.\d+\.\d+$/.test(d)));
+            readable = true;
+        }
+        catch {
+            /* not this platform's layout, or no Desktop app */
+        }
     }
-    catch {
+    if (!readable)
         return "n/a";
-    }
+    versions.sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+    return versions.at(-1) ?? "none";
 }
 function tcpReachable(hostname, port, timeoutMs = 2000) {
     return new Promise((resolveP) => {
@@ -328,7 +334,7 @@ function pickerTrust() {
         return pickerTrustMemo.value;
     let value = { caTrusted: false, appProxy: false };
     try {
-        value = { caTrusted: caTrusted(), appProxy: currentAppProxy().ours };
+        value = { caTrusted: caTrusted(certPaths(homeDir()).caPem), appProxy: currentAppProxy().ours };
     }
     catch {
         // Unknown counts as not ready; the next poll tries again.

package/dist/router/src/proxy.js

@@ -762,6 +762,17 @@ export class Proxy {
                 tag = `CLAUDE ${route.tag} account=${using.ownerId?.slice(0, 8) ?? "current"}`;
             }
             else {
+                // An Anthropic-shaped endpoint keeps no server-side thread either, so a `continue` is refused
+                // here as it is for the translated providers. sanitizeForCompatible used to strip the field
+                // and forward the rest, which is only the delta: DeepSeek (via Bailian) received two orphan
+                // tool_results with no task and answered that none had been given (measured 2026-09-24, CLI
+                // 2.1.280). Refused, the CLI resends the turn with the full history.
+                if (threadDecision(json) === "refuse") {
+                    const out = JSON.stringify(THREAD_UNSUPPORTED);
+                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                    finish("400", out.length, "thread continue refused → CLI resends stateless", false);
+                    return;
+                }
                 const preset = provider.preset ? PRESETS.find((entry) => entry.id === provider.preset) : undefined;
                 const modelEffortLevels = provider.models?.find((entry) => entry.id === route.model)?.effortLevels;
                 compatCaps = resolveCompatibleCaps(preset ? { effortLevels: preset.effortLevels, thinking: preset.thinking, ...(preset.serverTools ? { serverTools: true } : {}) } : undefined, modelEffortLevels === undefined ? provider.caps : { ...provider.caps, effortLevels: modelEffortLevels });

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.4.1";
+export const VERSION = "0.5.0";

package/docs/ARCHITECTURE.md

@@ -493,7 +493,9 @@ chat is out of reach for every approach, ours included.
   turn stateless and keeps the session stateless on that model. Accepting the delta
   instead made the model see an orphan `tool_result`, answer "무엇을 도와드릴까요?", and
   kept `cached_tokens` stuck at the tools prefix. `thread`/`diagnostics` are stripped
-  from `create` requests before forwarding.
+  from `create` requests before forwarding. An `anthropic-compatible` vendor holds no
+  thread either and is refused the same way: forwarding the stripped delta sent DeepSeek
+  (via Bailian) two orphan `tool_result`s and no task (measured 2026-09-24, CLI 2.1.280, #29).
 - **Per-turn billing telemetry.** The first system block is
   `x-anthropic-billing-header: … cch=<hash> …` and the hash changes every turn. Dropped
   from `instructions`, otherwise nothing after it is ever cached. With it dropped and

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clauderipple",
-  "version": "0.4.1",
-  "description": "Use GPT and 400+ other models inside the Claude Desktop app while staying signed in to your Claude subscription — no third-party gateway mode.",
+  "version": "0.5.0",
+  "description": "Use GPT (ChatGPT Plus/Pro), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs out, in Codex too.",
   "license": "GPL-3.0-only",
   "workspaces": [
     "packages/*"
@@ -58,7 +58,11 @@
     "proxy",
     "model-router",
     "ai-coding-assistant",
-    "mcp"
+    "codex-cli",
+    "chatgpt-plus",
+    "claude-code-proxy",
+    "llm-gateway",
+    "gpt-6"
   ],
   "homepage": "https://github.com/PBJ-2/clauderipple",
   "bugs": {