pennyrouter 0.1.6 → 0.1.8

package/README.md

@@ -11,6 +11,7 @@ status checks, and uninstall metadata.
 ```bash
 npx pennyrouter install
 npx pennyrouter install --existing-account
+npx pennyrouter auth anthropic
 npx pennyrouter install --harness claude-code,cline,opencode,codex,windsurf,zed,codegpt,aider
 npx pennyrouter disable
 npx pennyrouter enable
@@ -21,6 +22,10 @@ npx pennyrouter status
 With no `--harness` flag, the interactive installer shows a checkbox list. Tools with
 detected configs start checked; press Enter to accept or type tool IDs to toggle them.
 
+When Claude Code is selected, the installer also offers an optional Claude Pro/Max
+subscription-auth step. Users can skip it during install and enable it later with
+`@penny auth` or `npx pennyrouter auth anthropic`.
+
 ## Supported Tools
 
 - Claude Code
@@ -34,12 +39,56 @@ detected configs start checked; press Enter to accept or type tool IDs to toggle
 
 ## Penny Models
 
-Tools that expose a model picker get four curated choices:
+Tools that expose a model picker (e.g. Claude Code `/model`) get four curated choices. The three
+named-model choices PIN the trunk to that exact model — you pick the model, PennyRouter still cuts
+the bill via its side machinery (cache/compaction/swallowed background calls) without switching the
+model you chose. "Penny Custom" is the dynamic option: PennyRouter cost-routes each turn.
+
+- Penny Opus: pins `anthropic/claude-opus-4-8`
+- Penny Sonnet: pins `anthropic/claude-sonnet-4-6`
+- Penny Haiku: pins `anthropic/claude-haiku-4-5-20251001`
+- Penny Custom: `pennyrouter/auto` — dynamic routing on the bundle/profile saved in the user's account
+
+## Claude Pro/Max Subscription Auth
+
+When installing PennyRouter for Claude Code, the interactive installer offers to route
+Anthropic-native Claude turns through the user's own Claude subscription token. To force this
+in non-interactive installs:
+
+```bash
+npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
+```
+
+If Claude Code is already logged in to a Pro/Max subscription, use Claude Code's token setup
+flow:
+
+```bash
+claude setup-token
+ANTHROPIC_AUTH_TOKEN=<token> npx pennyrouter auth anthropic
+```
+
+Other token sources are supported:
+
+```bash
+npx pennyrouter auth anthropic --token <token>
+npx pennyrouter auth anthropic --token-command '<command that prints the token>'
+```
+
+If the separate Anthropic `ant` CLI is installed and logged in, PennyRouter can use it as a
+convenience fallback:
+
+```bash
+ant auth login
+npx pennyrouter auth anthropic
+```
+
+The command updates Claude Code so `x-api-key` carries the PennyRouter key and
+`Authorization: Bearer ...` carries the Anthropic OAuth token. The gateway forwards that
+bearer token to Anthropic with the required OAuth beta header and does not deduct
+PennyRouter credit for those Anthropic-native upstream calls.
 
-- Penny Core: `pennyrouter/penny-core:premium`
-- Penny Speed: `pennyrouter/penny-speed:standard`
-- Penny Power: `pennyrouter/penny-power:premium`
-- Penny Custom: `pennyrouter/auto`, using the bundle/profile saved in the user's PennyRouter account
+If the stored token expires during a long-running session, refresh the token source and rerun
+`npx pennyrouter auth anthropic`.
 
 ## Agent Flow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -3,7 +3,7 @@ import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { aiderHarness } from "./harnesses/aider.js";
-import { claudeCodeHarness } from "./harnesses/claude-code.js";
+import { claudeCodeHarness, readClaudeCodePennyRouterKey } from "./harnesses/claude-code.js";
 import { clineHarness } from "./harnesses/cline.js";
 import { codeGptHarness } from "./harnesses/codegpt.js";
 import { codexHarness } from "./harnesses/codex.js";
@@ -52,6 +52,11 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "auth") {
+    await authProvider(flags);
+    return;
+  }
+
   if (command === "uninstall") {
     await uninstall(flags);
     return;
@@ -79,6 +84,7 @@ function parseArgs(argv) {
   const command = argv[0] && !argv[0].startsWith("-") ? argv[0] : "install";
   const rest = command === argv[0] ? argv.slice(1) : argv;
   const flags = {};
+  flags.args = [];
 
   for (let i = 0; i < rest.length; i += 1) {
     const arg = rest[i];
@@ -88,16 +94,105 @@ function parseArgs(argv) {
     else if (arg === "--dry-run") flags.dryRun = true;
     else if (arg === "--no-browser") flags.noBrowser = true;
     else if (arg === "--existing-account") flags.existingAccount = true;
+    else if (arg === "--anthropic-auth") flags.anthropicAuth = true;
+    else if (arg === "--no-anthropic-auth") flags.noAnthropicAuth = true;
+    else if (arg === "--penny-key") flags.pennyKey = rest[++i] || "";
+    else if (arg.startsWith("--penny-key=")) flags.pennyKey = arg.slice("--penny-key=".length);
+    else if (arg === "--token") flags.token = rest[++i] || "";
+    else if (arg.startsWith("--token=")) flags.token = arg.slice("--token=".length);
+    else if (arg === "--token-command") flags.tokenCommand = rest[++i] || "";
+    else if (arg.startsWith("--token-command=")) flags.tokenCommand = arg.slice("--token-command=".length);
     else if (arg === "--harness") flags.harness = rest[++i] || "";
     else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
     else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
     else if (arg.startsWith("--app-url=")) flags.appUrl = arg.slice("--app-url=".length);
+    else if (arg === "--gateway-base-url") flags.gatewayBaseUrl = rest[++i] || "";
+    else if (arg.startsWith("--gateway-base-url=")) flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
+    // --local: point the installed harness at a locally-running gateway (default
+    // http://localhost:8400), for developing/testing against your own gateway. Auth still goes
+    // to prod (pennyrouter.com) so you get a real key; only the harness's serving URL is local.
+    // `--local=<url>` overrides the port/host.
+    else if (arg === "--local") flags.gatewayBaseUrl = "http://localhost:8400";
+    else if (arg.startsWith("--local=")) flags.gatewayBaseUrl = arg.slice("--local=".length);
+    else if (!arg.startsWith("-")) flags.args.push(arg);
     else throw new Error(`Unknown option "${arg}". Run "pennyrouter help".`);
   }
 
   return { command, flags };
 }
 
+async function authProvider(flags) {
+  const provider = (flags.args[0] || "anthropic").toLowerCase();
+  if (provider !== "anthropic" && provider !== "claude") {
+    throw new Error(`Unknown auth provider "${provider}". Try "pennyrouter auth anthropic".`);
+  }
+
+  if (flags.dryRun) {
+    console.log("Will configure Claude Code for PennyRouter + Anthropic OAuth dual auth.");
+    console.log("Dry run only. No files changed.");
+    return;
+  }
+
+  const pennyKey = flags.pennyKey || await readClaudeCodePennyRouterKey();
+  if (!pennyKey) {
+    throw new Error(
+      "No PennyRouter key found in Claude Code settings. Run `pennyrouter install --harness claude-code` first, or pass `--penny-key pr-...`.",
+    );
+  }
+
+  const tokenResult = readAnthropicOAuthToken(flags);
+  const token = tokenResult.token;
+  if (!token) {
+    throw new Error(
+      "No Anthropic OAuth token found. Run `claude setup-token` and pass it with `--token`, set ANTHROPIC_AUTH_TOKEN, or pass `--token-command <cmd>`.",
+    );
+  }
+
+  const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
+  const record = await claudeCodeHarness.installAnthropicOAuth({
+    pennyKey,
+    anthropicAuthToken: token,
+    gatewayBaseUrl,
+  });
+
+  const manifest = await loadManifest();
+  upsertManifestRecord(manifest, {
+    ...record,
+    anthropic_oauth: true,
+    token_source: tokenResult.source,
+  });
+  await saveManifest(manifest);
+
+  console.log("Configured Claude Code for PennyRouter + Anthropic OAuth.");
+  console.log("Anthropic-native Claude turns will use your Claude subscription token upstream.");
+  console.log("If Claude auth expires, refresh the token source and run `pennyrouter auth anthropic` again.");
+  console.log(`Config: ${record.config_path}`);
+}
+
+function readAnthropicOAuthToken(flags = {}) {
+  if (flags.token) return { token: flags.token.trim(), source: "flag" };
+  if (flags.tokenCommand) {
+    const result = spawnSync(flags.tokenCommand, {
+      encoding: "utf8",
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status === 0) {
+      return { token: String(result.stdout || "").trim(), source: "token-command" };
+    }
+    return { token: "", source: "token-command" };
+  }
+  if (process.env.ANTHROPIC_AUTH_TOKEN) {
+    return { token: process.env.ANTHROPIC_AUTH_TOKEN.trim(), source: "env" };
+  }
+  const result = spawnSync("ant", ["auth", "print-credentials", "--access-token"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.status !== 0) return { token: "", source: "none" };
+  return { token: String(result.stdout || "").trim(), source: "ant" };
+}
+
 async function install(flags) {
   const selected = await selectHarnesses(flags);
   if (selected.length === 0) {
@@ -112,6 +207,10 @@ async function install(flags) {
     for (const harness of selected) {
       console.log(`Will install on ${harness.name}${installNoteForHarness(harness.id)}.`);
     }
+    if (flags.gatewayBaseUrl) console.log(`Serving gateway: ${flags.gatewayBaseUrl}`);
+    if (selected.some((harness) => harness.id === "claude-code")) {
+      console.log("Claude Code subscription auth prompt would be shown unless skipped.");
+    }
     console.log("Dry run only. No files changed.");
     return;
   }
@@ -136,17 +235,32 @@ async function install(flags) {
   console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
   console.log("");
 
+  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(flags, selected);
+
   const manifest = await loadManifest();
   const records = [];
   const failures = [];
   for (const harness of selected) {
     await runHarnessJob(failures, harness.id, "install", async () => {
       const plan = await harness.planInstall();
-      const record = await harness.install({
-        apiKey: claim.api_key,
-        gatewayBaseUrl: claim.gateway_base_url,
-        plan,
-      });
+      const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
+      const record = harness.id === "claude-code" && claudeAnthropicAuth
+        ? await harness.installAnthropicOAuth({
+          pennyKey: claim.api_key,
+          anthropicAuthToken: claudeAnthropicAuth.token,
+          gatewayBaseUrl,
+        })
+        : await harness.install({
+          apiKey: claim.api_key,
+          // An explicit --local / --gateway-base-url overrides the URL the server hands back
+          // (which points at prod) — so a --local install serves through the local gateway.
+          gatewayBaseUrl,
+          plan,
+        });
+      if (harness.id === "claude-code" && claudeAnthropicAuth) {
+        record.anthropic_oauth = true;
+        record.token_source = claudeAnthropicAuth.source;
+      }
       records.push(record);
       upsertManifestRecord(manifest, record);
       await saveManifest(manifest);
@@ -164,6 +278,56 @@ async function install(flags) {
   reportFailures(failures);
 }
 
+async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
+  if (!selected.some((harness) => harness.id === "claude-code")) return null;
+  if (flags.noAnthropicAuth) return null;
+
+  if (flags.token || flags.tokenCommand || process.env.ANTHROPIC_AUTH_TOKEN) {
+    const tokenResult = readAnthropicOAuthToken(flags);
+    if (tokenResult.token) return tokenResult;
+  }
+
+  if (flags.yes || !input.isTTY || !output.isTTY) {
+    if (flags.anthropicAuth) {
+      throw new Error(
+        "Claude subscription auth was requested, but no Anthropic bearer token was found. Pass --token, --token-command, or ANTHROPIC_AUTH_TOKEN.",
+      );
+    }
+    return null;
+  }
+
+  if (!flags.anthropicAuth) {
+    console.log("Claude Code subscription auth");
+    console.log("PennyRouter can use your Claude Pro/Max subscription for Anthropic Claude calls.");
+    console.log("PennyRouter still handles routing, optimization, and @penny commands.");
+    console.log("");
+    const ok = await confirm("Enable Claude Pro/Max subscription auth for Claude Code?");
+    if (!ok) {
+      console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
+      console.log("");
+      return null;
+    }
+  }
+
+  const tokenResult = readAnthropicOAuthToken({ tokenCommand: flags.tokenCommand });
+  if (tokenResult.token) return tokenResult;
+
+  console.log("");
+  if (commandExists("claude")) {
+    console.log("Run `claude setup-token` in another terminal, then paste the token here.");
+  } else {
+    console.log("Claude Code was not found on PATH. Paste an Anthropic bearer token, or leave blank to skip.");
+  }
+  const token = await promptSecretish("Anthropic token (blank to skip): ");
+  if (!token) {
+    console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
+    console.log("");
+    return null;
+  }
+  console.log("");
+  return { token, source: "prompt" };
+}
+
 async function disable(flags) {
   const manifest = await loadManifest();
   if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
@@ -410,6 +574,7 @@ async function status() {
     if (record.disabled_snapshot_path) console.log(`  disabled snapshot: ${record.disabled_snapshot_path}`);
     if (record.installed_at) console.log(`  installed: ${record.installed_at}`);
     if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
+    if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
     if (record.manual_required) console.log("  note: finish or remove this integration in the tool UI");
   }
 }
@@ -650,8 +815,57 @@ async function confirm(question) {
   return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
 }
 
+async function promptSecretish(question) {
+  if (!input.isTTY || !output.isTTY) {
+    const rl = createInterface({ input, output });
+    const answer = await rl.question(question);
+    rl.close();
+    return answer.trim();
+  }
+
+  const previousRawMode = input.isRaw;
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write(question);
+
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(Boolean(previousRawMode));
+      input.pause();
+      output.write("\n");
+    };
+    const onKeypress = (str, key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new Error("Cancelled."));
+        return;
+      }
+      if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve(value.trim());
+        return;
+      }
+      if (key.name === "backspace") {
+        value = value.slice(0, -1);
+        return;
+      }
+      if (str) value += str;
+    };
+    input.on("keypress", onKeypress);
+  });
+}
+
+function commandExists(command) {
+  const result = spawnSync(command, ["--version"], { stdio: "ignore" });
+  return result.status === 0;
+}
+
 function installNoteForRecord(record) {
   if (record.manual_required) return " (manual setup shown)";
+  if (record.anthropic_oauth) return " (Claude subscription auth)";
   return installNoteForHarness(record.harness);
 }
 
@@ -673,7 +887,8 @@ function printHelp() {
   console.log(`PennyRouter CLI
 
 Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--existing-account]
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--existing-account] [--anthropic-auth|--no-anthropic-auth] [--local[=URL]]
+  pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL]
   pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter uninstall [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
@@ -682,6 +897,8 @@ Usage:
 Examples:
   npx pennyrouter install
   npx pennyrouter install --existing-account
+  npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
+  npx pennyrouter auth anthropic
   npx pennyrouter install --all
   npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes
   npx pennyrouter disable

package/src/harnesses/claude-code.js

@@ -2,12 +2,23 @@ import { atomicWrite, backupFile, compactHome, exists, expandHome, readJsonFile
 
 const CONFIG_PATH = "~/.claude/settings.json";
 const LEGACY_MODEL_LABEL = "PennyRouter Bundle";
+// Values written into Claude Code's four model slots. CC displays a slot's VALUE verbatim in
+// its /model menu AND sends it as the request `model`, so each value is both the menu label
+// and the gateway's routing key. The three concrete Claude slots carry friendly PINNED labels
+// ("Penny Opus/Sonnet/Haiku") that the gateway maps to that exact model — the user's pick
+// runs on the model they chose, no dynamic tier switching on the trunk (background/utility
+// calls still route cheap, which is where the savings come from). The Fable slot is the
+// DYNAMIC "Penny Custom" option: let PennyRouter cost-route. Legacy "Penny Speed/Core/Power"
+// installs (dynamic bundles) are still recognized for uninstall (see isPennyRouterModelValue).
 const CLAUDE_CODE_MODELS = {
-  speed: "Penny Speed",
-  core: "Penny Core",
-  power: "Penny Power",
-  custom: "Penny Custom",
+  haiku: "Penny Haiku",     // -> pinned anthropic/claude-haiku-4-5-20251001
+  sonnet: "Penny Sonnet",   // -> pinned anthropic/claude-sonnet-4-6
+  opus: "Penny Opus",       // -> pinned anthropic/claude-opus-4-8
+  custom: "Penny Custom",   // -> dynamic (PennyRouter cost-routing)
 };
+// Retired dynamic-bundle labels (pre-pinned-trunk). Not written by a fresh install; matched
+// only so uninstall/detect still recognize and clean up an older install.
+const LEGACY_PENNY_LABELS = ["Penny Speed", "Penny Core", "Penny Power"];
 
 export const claudeCodeHarness = {
   id: "claude-code",
@@ -40,9 +51,9 @@ export const claudeCodeHarness = {
     delete current.env.ANTHROPIC_API_KEY;
     // Claude Code displays these env values directly in its model picker; the
     // gateway decodes the friendly labels into bundle/profile overrides.
-    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.power;
-    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.core;
-    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.speed;
+    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
     current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.custom;
 
     await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
@@ -66,12 +77,47 @@ export const claudeCodeHarness = {
     };
   },
 
+  async installAnthropicOAuth({ pennyKey, anthropicAuthToken, gatewayBaseUrl }) {
+    const backupPath = await backupFile(CONFIG_PATH, "claude-code-anthropic-auth");
+    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    current.env ||= {};
+    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
+    // Dual-auth mode: x-api-key authenticates the local user to PennyRouter; the
+    // Authorization bearer token is forwarded by the gateway to Anthropic.
+    current.env.ANTHROPIC_API_KEY = pennyKey;
+    current.env.ANTHROPIC_AUTH_TOKEN = anthropicAuthToken;
+    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
+    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.custom;
+
+    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
+    return {
+      harness: "claude-code",
+      config_path: compactHome(expandHome(CONFIG_PATH)),
+      backup_path: backupPath ? compactHome(backupPath) : null,
+      installed_at: new Date().toISOString(),
+      restart: "restart Claude Code",
+      changes: {
+        env_keys: [
+          "ANTHROPIC_BASE_URL",
+          "ANTHROPIC_API_KEY",
+          "ANTHROPIC_AUTH_TOKEN",
+          "ANTHROPIC_DEFAULT_OPUS_MODEL",
+          "ANTHROPIC_DEFAULT_SONNET_MODEL",
+          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+          "ANTHROPIC_DEFAULT_FABLE_MODEL",
+        ],
+      },
+    };
+  },
+
   async uninstall(record) {
     const current = (await readJsonFile(record.config_path, null)) || {};
     if (hasPennyRouterEnv(current.env)) {
       delete current.env.ANTHROPIC_BASE_URL;
       const tok = current.env.ANTHROPIC_AUTH_TOKEN;
-      if (typeof tok === "string" && tok.startsWith("pr-")) {
+      if (typeof tok === "string" && (tok.startsWith("pr-") || record.anthropic_oauth)) {
         delete current.env.ANTHROPIC_AUTH_TOKEN;
       }
       // Legacy installs stored the key under ANTHROPIC_API_KEY.
@@ -126,9 +172,19 @@ function isPennyRouterBaseUrl(value) {
 function isPennyRouterModelValue(value) {
   return (
     isPennyRouterValue(value) ||
-    value === CLAUDE_CODE_MODELS.speed ||
-    value === CLAUDE_CODE_MODELS.core ||
-    value === CLAUDE_CODE_MODELS.power ||
-    value === CLAUDE_CODE_MODELS.custom
+    value === CLAUDE_CODE_MODELS.haiku ||
+    value === CLAUDE_CODE_MODELS.sonnet ||
+    value === CLAUDE_CODE_MODELS.opus ||
+    value === CLAUDE_CODE_MODELS.custom ||
+    LEGACY_PENNY_LABELS.includes(value)
   );
 }
+
+export async function readClaudeCodePennyRouterKey() {
+  const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+  const env = current.env || {};
+  for (const value of [env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN, current["anthropic.apiKey"]]) {
+    if (typeof value === "string" && value.startsWith("pr-")) return value;
+  }
+  return null;
+}