pennyrouter 0.1.7 → 0.1.9

package/README.md

@@ -22,6 +22,10 @@ npx pennyrouter status
 With no `--harness` flag, the interactive installer shows a checkbox list. Tools with
 detected configs start checked; press Enter to accept or type tool IDs to toggle them.
 
+When Claude Code is selected, the installer also offers an optional Claude Pro/Max
+subscription-auth step. Users can skip it during install and enable it later with
+`@penny auth` or `npx pennyrouter auth anthropic`.
+
 ## Supported Tools
 
 - Claude Code
@@ -47,8 +51,31 @@ model you chose. "Penny Custom" is the dynamic option: PennyRouter cost-routes e
 
 ## Claude Pro/Max Subscription Auth
 
-After installing PennyRouter for Claude Code, users with an Anthropic OAuth login can route
-Anthropic-native Claude turns through their own Claude subscription token:
+When installing PennyRouter for Claude Code, the interactive installer offers to route
+Anthropic-native Claude turns through the user's own Claude subscription token. To force this
+in non-interactive installs:
+
+```bash
+npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
+```
+
+If Claude Code is already logged in to a Pro/Max subscription, use Claude Code's token setup
+flow:
+
+```bash
+claude setup-token
+ANTHROPIC_AUTH_TOKEN=<token> npx pennyrouter auth anthropic
+```
+
+Other token sources are supported:
+
+```bash
+npx pennyrouter auth anthropic --token <token>
+npx pennyrouter auth anthropic --token-command '<command that prints the token>'
+```
+
+If the separate Anthropic `ant` CLI is installed and logged in, PennyRouter can use it as a
+convenience fallback:
 
 ```bash
 ant auth login
@@ -60,8 +87,8 @@ The command updates Claude Code so `x-api-key` carries the PennyRouter key and
 bearer token to Anthropic with the required OAuth beta header and does not deduct
 PennyRouter credit for those Anthropic-native upstream calls.
 
-`ant auth print-credentials` refreshes the access token before the CLI stores it. If the
-stored token expires during a long-running session, rerun `npx pennyrouter auth anthropic`.
+If the stored token expires during a long-running session, refresh the token source and rerun
+`npx pennyrouter auth anthropic`.
 
 ## Agent Flow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -94,10 +94,14 @@ function parseArgs(argv) {
     else if (arg === "--dry-run") flags.dryRun = true;
     else if (arg === "--no-browser") flags.noBrowser = true;
     else if (arg === "--existing-account") flags.existingAccount = true;
+    else if (arg === "--anthropic-auth") flags.anthropicAuth = true;
+    else if (arg === "--no-anthropic-auth") flags.noAnthropicAuth = true;
     else if (arg === "--penny-key") flags.pennyKey = rest[++i] || "";
     else if (arg.startsWith("--penny-key=")) flags.pennyKey = arg.slice("--penny-key=".length);
     else if (arg === "--token") flags.token = rest[++i] || "";
     else if (arg.startsWith("--token=")) flags.token = arg.slice("--token=".length);
+    else if (arg === "--token-command") flags.tokenCommand = rest[++i] || "";
+    else if (arg.startsWith("--token-command=")) flags.tokenCommand = arg.slice("--token-command=".length);
     else if (arg === "--harness") flags.harness = rest[++i] || "";
     else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
     else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
@@ -136,10 +140,11 @@ async function authProvider(flags) {
     );
   }
 
-  const token = flags.token || readAnthropicOAuthToken();
+  const tokenResult = readAnthropicOAuthToken(flags);
+  const token = tokenResult.token;
   if (!token) {
     throw new Error(
-      "No Anthropic OAuth token found. Run `ant auth login`, then retry `pennyrouter auth anthropic`.",
+      "No Anthropic OAuth token found. Run `claude setup-token` and pass it with `--token`, set ANTHROPIC_AUTH_TOKEN, or pass `--token-command <cmd>`.",
     );
   }
 
@@ -154,24 +159,51 @@ async function authProvider(flags) {
   upsertManifestRecord(manifest, {
     ...record,
     anthropic_oauth: true,
-    token_source: flags.token ? "flag" : "ant",
+    token_source: tokenResult.source,
   });
   await saveManifest(manifest);
 
   console.log("Configured Claude Code for PennyRouter + Anthropic OAuth.");
   console.log("Anthropic-native Claude turns will use your Claude subscription token upstream.");
-  console.log("If Claude auth expires, run `pennyrouter auth anthropic` again.");
+  console.log("If Claude auth expires, refresh the token source and run `pennyrouter auth anthropic` again.");
   console.log(`Config: ${record.config_path}`);
 }
 
-function readAnthropicOAuthToken() {
-  if (process.env.ANTHROPIC_AUTH_TOKEN) return process.env.ANTHROPIC_AUTH_TOKEN.trim();
+function readAnthropicOAuthToken(flags = {}) {
+  if (flags.token) return { token: normalizeAnthropicToken(flags.token), source: "flag" };
+  if (flags.tokenCommand) {
+    const result = spawnSync(flags.tokenCommand, {
+      encoding: "utf8",
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status === 0) {
+      return { token: normalizeAnthropicToken(result.stdout), source: "token-command" };
+    }
+    return { token: "", source: "token-command" };
+  }
+  if (process.env.ANTHROPIC_AUTH_TOKEN) {
+    return { token: normalizeAnthropicToken(process.env.ANTHROPIC_AUTH_TOKEN), source: "env" };
+  }
   const result = spawnSync("ant", ["auth", "print-credentials", "--access-token"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
   });
-  if (result.status !== 0) return "";
-  return String(result.stdout || "").trim();
+  if (result.status !== 0) return { token: "", source: "none" };
+  return { token: normalizeAnthropicToken(result.stdout), source: "ant" };
+}
+
+function normalizeAnthropicToken(value) {
+  let text = String(value || "").trim();
+  if (!text) return "";
+  const line = text.split(/\r?\n/).map((part) => part.trim()).find(Boolean) || "";
+  text = line.replace(/^export\s+/, "");
+  const match = text.match(/^ANTHROPIC_AUTH_TOKEN=(.*)$/);
+  if (match) text = match[1].trim();
+  if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+    text = text.slice(1, -1);
+  }
+  return text.trim();
 }
 
 async function install(flags) {
@@ -189,6 +221,9 @@ async function install(flags) {
       console.log(`Will install on ${harness.name}${installNoteForHarness(harness.id)}.`);
     }
     if (flags.gatewayBaseUrl) console.log(`Serving gateway: ${flags.gatewayBaseUrl}`);
+    if (selected.some((harness) => harness.id === "claude-code")) {
+      console.log("Claude Code subscription auth prompt would be shown unless skipped.");
+    }
     console.log("Dry run only. No files changed.");
     return;
   }
@@ -213,19 +248,32 @@ async function install(flags) {
   console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
   console.log("");
 
+  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(flags, selected);
+
   const manifest = await loadManifest();
   const records = [];
   const failures = [];
   for (const harness of selected) {
     await runHarnessJob(failures, harness.id, "install", async () => {
       const plan = await harness.planInstall();
-      const record = await harness.install({
-        apiKey: claim.api_key,
-        // An explicit --local / --gateway-base-url overrides the URL the server hands back
-        // (which points at prod) — so a --local install serves through the local gateway.
-        gatewayBaseUrl: flags.gatewayBaseUrl || claim.gateway_base_url,
-        plan,
-      });
+      const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
+      const record = harness.id === "claude-code" && claudeAnthropicAuth
+        ? await harness.installAnthropicOAuth({
+          pennyKey: claim.api_key,
+          anthropicAuthToken: claudeAnthropicAuth.token,
+          gatewayBaseUrl,
+        })
+        : await harness.install({
+          apiKey: claim.api_key,
+          // An explicit --local / --gateway-base-url overrides the URL the server hands back
+          // (which points at prod) — so a --local install serves through the local gateway.
+          gatewayBaseUrl,
+          plan,
+        });
+      if (harness.id === "claude-code" && claudeAnthropicAuth) {
+        record.anthropic_oauth = true;
+        record.token_source = claudeAnthropicAuth.source;
+      }
       records.push(record);
       upsertManifestRecord(manifest, record);
       await saveManifest(manifest);
@@ -243,6 +291,56 @@ async function install(flags) {
   reportFailures(failures);
 }
 
+async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
+  if (!selected.some((harness) => harness.id === "claude-code")) return null;
+  if (flags.noAnthropicAuth) return null;
+
+  if (flags.token || flags.tokenCommand || process.env.ANTHROPIC_AUTH_TOKEN) {
+    const tokenResult = readAnthropicOAuthToken(flags);
+    if (tokenResult.token) return tokenResult;
+  }
+
+  if (flags.yes || !input.isTTY || !output.isTTY) {
+    if (flags.anthropicAuth) {
+      throw new Error(
+        "Claude subscription auth was requested, but no Anthropic bearer token was found. Pass --token, --token-command, or ANTHROPIC_AUTH_TOKEN.",
+      );
+    }
+    return null;
+  }
+
+  if (!flags.anthropicAuth) {
+    console.log("Claude Code subscription auth");
+    console.log("PennyRouter can use your Claude Pro/Max subscription for Anthropic Claude calls.");
+    console.log("PennyRouter still handles routing, optimization, and @penny commands.");
+    console.log("");
+    const ok = await confirm("Enable Claude Pro/Max subscription auth for Claude Code?");
+    if (!ok) {
+      console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
+      console.log("");
+      return null;
+    }
+  }
+
+  const tokenResult = readAnthropicOAuthToken({ tokenCommand: flags.tokenCommand });
+  if (tokenResult.token) return tokenResult;
+
+  console.log("");
+  if (commandExists("claude")) {
+    console.log("Run `claude setup-token` in another terminal, then paste the token here.");
+  } else {
+    console.log("Claude Code was not found on PATH. Paste an Anthropic bearer token, or leave blank to skip.");
+  }
+  const token = normalizeAnthropicToken(await promptSecretish("Anthropic token (blank to skip): "));
+  if (!token) {
+    console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
+    console.log("");
+    return null;
+  }
+  console.log("");
+  return { token, source: "prompt" };
+}
+
 async function disable(flags) {
   const manifest = await loadManifest();
   if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
@@ -489,6 +587,7 @@ async function status() {
     if (record.disabled_snapshot_path) console.log(`  disabled snapshot: ${record.disabled_snapshot_path}`);
     if (record.installed_at) console.log(`  installed: ${record.installed_at}`);
     if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
+    if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
     if (record.manual_required) console.log("  note: finish or remove this integration in the tool UI");
   }
 }
@@ -729,8 +828,57 @@ async function confirm(question) {
   return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
 }
 
+async function promptSecretish(question) {
+  if (!input.isTTY || !output.isTTY) {
+    const rl = createInterface({ input, output });
+    const answer = await rl.question(question);
+    rl.close();
+    return answer.trim();
+  }
+
+  const previousRawMode = input.isRaw;
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write(question);
+
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(Boolean(previousRawMode));
+      input.pause();
+      output.write("\n");
+    };
+    const onKeypress = (str, key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new Error("Cancelled."));
+        return;
+      }
+      if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve(value.trim());
+        return;
+      }
+      if (key.name === "backspace") {
+        value = value.slice(0, -1);
+        return;
+      }
+      if (str) value += str;
+    };
+    input.on("keypress", onKeypress);
+  });
+}
+
+function commandExists(command) {
+  const result = spawnSync(command, ["--version"], { stdio: "ignore" });
+  return result.status === 0;
+}
+
 function installNoteForRecord(record) {
   if (record.manual_required) return " (manual setup shown)";
+  if (record.anthropic_oauth) return " (Claude subscription auth)";
   return installNoteForHarness(record.harness);
 }
 
@@ -752,8 +900,8 @@ function printHelp() {
   console.log(`PennyRouter CLI
 
 Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--existing-account] [--local[=URL]]
-  pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--gateway-base-url URL]
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--existing-account] [--anthropic-auth|--no-anthropic-auth] [--local[=URL]]
+  pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL]
   pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter uninstall [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
@@ -762,6 +910,7 @@ Usage:
 Examples:
   npx pennyrouter install
   npx pennyrouter install --existing-account
+  npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
   npx pennyrouter auth anthropic
   npx pennyrouter install --all
   npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes