pennyrouter 0.2.2 → 0.2.7

package/README.md

@@ -11,6 +11,7 @@ status checks, and uninstall metadata.
 ```bash
 npx pennyrouter install
 npx pennyrouter install --make-default
+npx pennyrouter update
 npx pennyrouter auth anthropic
 npx pennyrouter install --harness claude-code,cline,opencode,codex,windsurf,zed,codegpt,aider
 npx pennyrouter disable
@@ -26,9 +27,10 @@ With no `--harness` flag, the interactive installer shows Claude Code and Codex.
 tools start checked. The additional legacy integrations remain available through an explicit
 `--harness <id>` selection or `--all`.
 
-When Claude Code is selected, the installer also offers an optional Claude Pro/Max
-subscription-auth step. Users can skip it during install and enable it later with
-`@penny auth` or `npx pennyrouter auth anthropic`.
+When Claude Code is selected, the installer offers Claude subscription authorization. If it is
+declined or unavailable, installation requires an Anthropic API key or OpenRouter key. Codex
+uses an existing ChatGPT login; without one, installation requires an OpenAI API key or
+OpenRouter key. PennyRouter-funded provider keys are never an installed-harness fallback.
 
 ## Explicit Penny Commands
 
@@ -60,7 +62,8 @@ does not currently expose equivalent project-independent custom slash commands.
 When Codex is already signed in with ChatGPT, the installer preserves that Codex-managed
 login and configures PennyRouter as an OpenAI-authenticated Responses proxy. Codex continues
 to own and refresh the OpenAI credentials; PennyRouter stores only its existing `pr-` account
-key in the managed provider block. API-key Codex installs continue to use PennyRouter credits.
+key in the managed provider block. API-key Codex installs use the user's encrypted OpenAI or
+OpenRouter key.
 
 To point Codex directly at a PennyRouter gateway running on localhost port 8400:
 
@@ -77,6 +80,39 @@ the gateway must be redeployed or fixed before retrying. This check is about Pen
 compatibility, not a demand that the user upgrade a Claude Code version that already emits a
 supported request shape.
 
+## Updating
+
+To pick up a new CLI version without repeating the install interview:
+
+```bash
+npx pennyrouter update
+npx pennyrouter update --dry-run
+npx pennyrouter update --harness claude-code
+```
+
+`update` refreshes only the files generated from the CLI's own constants: the managed `penny`
+runtime and launcher, the `/penny` Claude skill, the Claude settings overlay and statusline, the
+Codex provider profile, and the model labels and context-window settings in managed tool configs.
+Older installs are migrated forward, so retired model labels are replaced with the current ones.
+
+It never touches credentials and never re-runs browser authorization. Upstream provider tokens
+(Claude subscription, Anthropic, OpenAI, OpenRouter) are held encrypted at the gateway, and the
+existing `pr-` account key and gateway URL are read back from the local config, so the command is
+non-interactive and prompts for nothing.
+
+Per-tool choices are preserved rather than re-asked. Bare-command routing is read from the
+uninstall manifest, so a Penny-only install keeps bare `claude` and `codex` fully native and an
+install that opted into global routing keeps it. Subscription auth mode is likewise carried
+forward. Use `install` instead when the intent is to change those choices.
+
+Because the managed tool config is rewritten only for tools whose bare command already routes
+through PennyRouter, a Penny-only install leaves files such as `~/.claude/settings.json`
+untouched and needs no session shutdown. Updating a tool that owns global routing requires
+closing its running sessions, or passing `--allow-running-harnesses`. Unrelated keys and user
+settings inside managed config files are preserved, and re-running `update` is idempotent.
+
+Restart Claude Code or Codex afterwards to pick up the refreshed configuration.
+
 ## Supported Tools
 
 - Claude Code
@@ -95,13 +131,13 @@ named-model choices PIN the trunk to that exact model — you pick the model, Pe
 the bill via its side machinery (cache/compaction/swallowed background calls) without switching the
 model you chose. "Penny Custom" is the dynamic option: PennyRouter cost-routes each turn.
 
-- Penny Opus: pins `anthropic/claude-opus-4-8`
-- Penny Sonnet: pins `anthropic/claude-sonnet-4-6`
-- Penny Haiku: pins `anthropic/claude-haiku-4-5-20251001`
-- Penny Fable: pins `anthropic/claude-fable-5`
+- Opus 5 (PennyRouter): pins `anthropic/claude-opus-5`
+- Sonnet 5 (PennyRouter): pins `anthropic/claude-sonnet-5`
+- Haiku 4.5 (PennyRouter): pins `anthropic/claude-haiku-4-5-20251001`
+- Fable 5 (PennyRouter): pins `anthropic/claude-fable-5`
 - Penny Custom: `pennyrouter/auto` — dynamic routing on the bundle/profile saved in the user's account
 
-## Claude Pro/Max Subscription Auth
+## Claude Subscription Auth
 
 When installing PennyRouter for Claude Code, the interactive installer offers to route
 Anthropic-native Claude turns through the user's own Claude subscription token. To force this
@@ -109,9 +145,12 @@ in non-interactive installs:
 
 ```bash
 npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
+npx pennyrouter install --harness claude-code --anthropic-api-key <key>
+npx pennyrouter install --harness codex --openai-api-key <key>
+npx pennyrouter install --openrouter-api-key <key>
 ```
 
-If Claude Code is already logged in to a Pro/Max subscription, use Claude Code's token setup
+If Claude Code is already logged in to a Claude subscription, use Claude Code's token setup
 flow:
 
 ```bash
@@ -139,6 +178,11 @@ PennyRouter `pr-` bearer in its settings; the gateway retrieves and forwards the
 with the required OAuth beta header and does not deduct PennyRouter credit for successfully
 served Anthropic-subscription calls.
 
+On a transient subscription 429/529, the gateway retries the same subscription once. If it
+still fails, it can fall back only to credentials owned by that user: Anthropic API then
+OpenRouter for Claude, or OpenAI API then OpenRouter for Codex. If no such credential is
+configured, the provider error is returned; PennyRouter never changes the payer to itself.
+
 PennyRouter also sets `disableClaudeAiConnectors: true` while its custom gateway is installed.
 Claude Code cannot load claude.ai organization connectors when gateway authentication takes
 precedence, and otherwise displays a persistent warning about that state. Making the disablement
@@ -168,6 +212,9 @@ directory, and records an uninstall manifest.
 `disable` temporarily removes PennyRouter from selected tools while retaining a local
 PennyRouter-managed snapshot for `enable`.
 
+`update` rewrites those same managed files for the installed version without re-authorizing,
+and without changing bare-command routing or stored credentials.
+
 It does not delete PennyRouter accounts, credits, or remote API keys.
 
 ## License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.2.2",
+  "version": "0.2.7",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -24,6 +24,7 @@ import {
   probeClaudeCodeGateway,
   sleep,
   storeAnthropicToken,
+  storeUpstreamCredential,
 } from "./session.js";
 import {
   backupFile,
@@ -60,6 +61,16 @@ const HARNESS_BY_ID = {
 
 const SUPPORTED_HARNESS_IDS = Object.keys(HARNESS_BY_ID).join(",");
 const DEFAULT_INSTALL_HARNESS_IDS = ["claude-code", "codex"];
+const CLAUDE_PROVIDER_OPTIONS = [
+  { id: "subscription", name: "Claude subscription" },
+  { id: "anthropic-api", name: "Anthropic API key" },
+  { id: "openrouter", name: "OpenRouter API key" },
+];
+const CODEX_PROVIDER_OPTIONS = [
+  { id: "subscription", name: "ChatGPT subscription" },
+  { id: "openai-api", name: "OpenAI API key" },
+  { id: "openrouter", name: "OpenRouter API key" },
+];
 
 export async function main(argv = process.argv.slice(2)) {
   const { command, flags } = parseArgs(argv);
@@ -74,6 +85,11 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "update") {
+    await update(flags);
+    return;
+  }
+
   if (command === "auth") {
     await authProvider(flags);
     return;
@@ -129,6 +145,12 @@ function parseArgs(argv) {
     else if (arg.startsWith("--token=")) flags.token = arg.slice("--token=".length);
     else if (arg === "--token-command") flags.tokenCommand = rest[++i] || "";
     else if (arg.startsWith("--token-command=")) flags.tokenCommand = arg.slice("--token-command=".length);
+    else if (arg === "--anthropic-api-key") flags.anthropicApiKey = rest[++i] || "";
+    else if (arg.startsWith("--anthropic-api-key=")) flags.anthropicApiKey = arg.slice("--anthropic-api-key=".length);
+    else if (arg === "--openai-api-key") flags.openaiApiKey = rest[++i] || "";
+    else if (arg.startsWith("--openai-api-key=")) flags.openaiApiKey = arg.slice("--openai-api-key=".length);
+    else if (arg === "--openrouter-api-key") flags.openrouterApiKey = rest[++i] || "";
+    else if (arg.startsWith("--openrouter-api-key=")) flags.openrouterApiKey = arg.slice("--openrouter-api-key=".length);
     else if (arg === "--harness") flags.harness = rest[++i] || "";
     else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
     else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
@@ -389,7 +411,7 @@ async function install(flags) {
     }
     if (flags.gatewayBaseUrl) console.log(`Serving gateway: ${flags.gatewayBaseUrl}`);
     if (selected.some((harness) => harness.id === "claude-code")) {
-      console.log("Claude Code subscription auth prompt would be shown unless skipped.");
+      console.log("Claude Code provider picker would be shown unless providers were supplied by flags or environment.");
     }
     console.log("Dry run only. No files changed.");
     return;
@@ -411,17 +433,24 @@ async function install(flags) {
   console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
   console.log("");
 
-  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(flags, selected);
+  const claudeProviders = await selectClaudeFundingProviders(flags, selected);
+  const codexProviders = await selectCodexFundingProviders(flags, selected);
+  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
+    flags, selected, claudeProviders.has("subscription"));
+  const funding = await configureUserFunding(
+    flags, selected, claudeAnthropicAuth, claudeProviders, codexProviders);
   const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
 
+  for (const credential of funding.credentials) {
+    await storeUpstreamCredential({
+      gatewayBaseUrl,
+      apiKey: claim.api_key,
+      provider: credential.provider,
+      token: credential.token,
+    });
+  }
+
   if (selected.some((harness) => harness.id === "claude-code")) {
-    if (claudeAnthropicAuth) {
-      await storeAnthropicToken({
-        gatewayBaseUrl,
-        apiKey: claim.api_key,
-        token: claudeAnthropicAuth.token,
-      });
-    }
     console.log("Verifying modern Claude Code compatibility before changing local settings...");
     await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: claim.api_key });
     console.log("");
@@ -455,7 +484,7 @@ async function install(flags) {
       }
 
       const codexSubscriptionAuth = harness.id === "codex"
-        ? await detectCodexChatgptAuth()
+        ? funding.codexSubscriptionAuth
         : false;
       const claudeSubscriptionAuth = harness.id === "claude-code"
         && Boolean(claudeAnthropicAuth || existingRecord?.anthropic_token_stored);
@@ -503,6 +532,12 @@ async function install(flags) {
         record.anthropic_token_stored = true;
         record.token_source = claudeAnthropicAuth?.source || existingRecord?.token_source || "stored";
       }
+      if (harness.id === "claude-code" && funding.claudeCredentialProvider) {
+        record.user_funded_provider = funding.claudeCredentialProvider;
+      }
+      if (harness.id === "codex" && funding.codexCredentialProvider) {
+        record.user_funded_provider = funding.codexCredentialProvider;
+      }
       if (harness.id === "codex") record.openai_subscription_auth = codexSubscriptionAuth;
       records.push(record);
       upsertManifestRecord(manifest, record);
@@ -541,6 +576,143 @@ async function install(flags) {
   reportFailures(failures);
 }
 
+// Refresh the managed local files to this package version WITHOUT re-running any of the
+// account/credential flow. Everything an update needs is already on disk: the pr- key and
+// gateway URL live in the penny config (and, for older installs, in the harness config the
+// installer wrote), and the upstream provider tokens live server-side, encrypted against the
+// account. So no browser claim, no provider checkboxes, no token prompts — this command is
+// non-interactive by construction and never touches a credential.
+//
+// What it DOES rewrite is everything regenerated from code constants, which is exactly what
+// goes stale on a version bump: the copied runtime + `penny` shim, the /penny skill, the
+// Claude launch settings overlay, the Codex provider profile, and the model labels +
+// context-window env in the harness configs.
+//
+// Per-user choices are read back from the manifest, never re-asked: `default_routing` decides
+// whether the bare `claude`/`codex` command keeps pointing at the gateway, and
+// `anthropic_token_stored`/`openai_subscription_auth` decide which auth shape gets rewritten.
+// Re-deriving either from prompt defaults would silently flip a --penny-only user into
+// default routing, or drop subscription auth from a working install.
+async function update(flags) {
+  const manifest = await loadManifest();
+  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
+  const records = manifest.installations || [];
+
+  const requested = parseHarnessList(flags.harness);
+  const targets = records.filter((record) => {
+    if (record.disabled) return false;
+    if (flags.all || requested.length === 0) return true;
+    return requested.includes(record.harness);
+  });
+
+  if (records.length === 0) {
+    throw new Error("No PennyRouter installation found. Run `npx pennyrouter install` first.");
+  }
+  if (targets.length === 0) {
+    console.log("No enabled PennyRouter installations matched. Nothing to update.");
+    return;
+  }
+
+  const launchConfig = await loadPennyConfig();
+  const globalAuth = await readClaudeCodeGatewayAuth();
+  const apiKey = flags.pennyKey || launchConfig.api_key || globalAuth.apiKey;
+  const gatewayBaseUrl = flags.gatewayBaseUrl
+    || launchConfig.gateway_base_url
+    || globalAuth.gatewayBaseUrl
+    || process.env.PENNYROUTER_GATEWAY_BASE_URL
+    || "https://api.pennyrouter.com";
+
+  if (!apiKey) {
+    throw new Error(
+      "Could not find your PennyRouter key in the local config. Pass `--penny-key pr-...`, "
+      + "or run `npx pennyrouter install` to re-authorize.",
+    );
+  }
+
+  console.log("PennyRouter update");
+  console.log("");
+  console.log(`Key ${maskKey(apiKey)} · gateway ${gatewayBaseUrl}`);
+  console.log("Subscription and API keys are left untouched.");
+  console.log("");
+
+  if (flags.dryRun) {
+    for (const record of targets) {
+      const routing = record.default_routing === false ? "penny command only" : "default routing";
+      console.log(`Will refresh ${record.harness} (${routing}).`);
+    }
+    console.log("Will refresh the penny runtime and shim.");
+    console.log("Dry run only. No files changed.");
+    return;
+  }
+
+  const failures = [];
+  let runtimeResult = null;
+  if (targets.some((record) => ["claude-code", "codex"].includes(record.harness))
+      && process.platform !== "win32") {
+    runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
+  }
+
+  for (const record of targets) {
+    const harness = HARNESS_BY_ID[record.harness];
+    if (!harness) continue;
+
+    await runHarnessJob(failures, record.harness, "update", async () => {
+      const supportsPennyCommand = ["claude-code", "codex"].includes(record.harness)
+        && process.platform !== "win32";
+      // An update rewrites the harness's own config only when that config is ours to
+      // rewrite — i.e. the bare command still routes through the gateway. In penny-only
+      // mode the harness config belongs to the user and we touch just the launch profile.
+      const ownsGlobalRouting = !record.launch_available || record.default_routing !== false;
+      if (ownsGlobalRouting) assertNoRunningHarness(record.harness, flags);
+
+      const claudeSubscriptionAuth = record.harness === "claude-code"
+        && Boolean(record.anthropic_token_stored);
+      const codexSubscriptionAuth = record.harness === "codex"
+        ? await detectCodexChatgptAuth()
+        : false;
+
+      if (supportsPennyCommand) {
+        await configurePennyHarness(record.harness, {
+          apiKey,
+          gatewayBaseUrl,
+          subscriptionAuth: record.harness === "claude-code"
+            ? claudeSubscriptionAuth
+            : codexSubscriptionAuth,
+          models: record.harness === "claude-code" ? CLAUDE_CODE_MODELS : null,
+        });
+      }
+
+      let next = record;
+      if (ownsGlobalRouting) {
+        const plan = await harness.planInstall();
+        // Pass the existing record through so install-time state the harness stashed
+        // (previous_model_provider, claude_ai_connectors_before) survives the rewrite
+        // and a later uninstall still restores the user's original values.
+        const installed = record.harness === "claude-code" && claudeSubscriptionAuth
+          ? await harness.installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord: record })
+          : await harness.install({ apiKey, gatewayBaseUrl, plan, existingRecord: record });
+        next = { ...record, ...installed, installed_at: record.installed_at };
+      }
+
+      next.updated_at = new Date().toISOString();
+      if (record.harness === "codex") next.openai_subscription_auth = codexSubscriptionAuth;
+      upsertManifestRecord(manifest, next);
+      await saveManifest(manifest);
+      console.log(`Updated ${record.harness}.`);
+    });
+  }
+
+  await saveManifest(manifest);
+  console.log("");
+  if (runtimeResult && !runtimeResult.available) {
+    console.log("Add ~/.local/bin to PATH before using the `penny` command.");
+  } else if (runtimeResult?.changed) {
+    console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
+  }
+  console.log("Restart any running Claude Code or Codex sessions to pick up the update.");
+  reportFailures(failures);
+}
+
 async function chooseDefaultRouting(flags, selected, manifest) {
   const out = new Map();
   const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
@@ -589,8 +761,13 @@ async function chooseDefaultRouting(flags, selected, manifest) {
         }
         console.log("");
         const bare = launchable.map((item) => item.id === "claude-code" ? "claude" : "codex");
-        const label = bare.length === 1 ? bare[0] : `${bare.slice(0, -1).join(", ")} and ${bare.at(-1)}`;
-        newInstallChoice = await confirm(`Also route ${color(label, "bold")} through PennyRouter by default?`);
+        const quoted = bare.map((command) => `'${command}'`);
+        const label = quoted.length === 1
+          ? quoted[0]
+          : `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`;
+        newInstallChoice = await confirm(
+          `Set ${label} to automatically load PennyRouter with every session?`,
+        );
       }
     }
     out.set(harness.id, newInstallChoice);
@@ -598,9 +775,54 @@ async function chooseDefaultRouting(flags, selected, manifest) {
   return out;
 }
 
-async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
+async function selectClaudeFundingProviders(flags, selected) {
+  if (!selected.some((harness) => harness.id === "claude-code")) return new Set();
+
+  const supplied = new Set();
+  if (!flags.noAnthropicAuth && (flags.anthropicAuth || flags.token || flags.tokenCommand
+      || process.env.ANTHROPIC_AUTH_TOKEN)) supplied.add("subscription");
+  if (flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY) supplied.add("anthropic-api");
+  if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+
+  // Explicit flags are the automation selector. Interactive installs always default to the
+  // subscription alone; environment keys are used if the user checks their provider.
+  const explicit = flags.anthropicAuth || flags.noAnthropicAuth || flags.token
+    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey;
+  if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
+
+  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, or an OpenRouter API key to run Claude Code.");
+  console.log("Choose one or more providers. PennyRouter will try them in order when available.");
+  return promptFundingProviderCheckboxes(
+    CLAUDE_PROVIDER_OPTIONS,
+    "Which providers should PennyRouter use for Claude Code?",
+    new Set(["subscription"]),
+  );
+}
+
+async function selectCodexFundingProviders(flags, selected) {
+  if (!selected.some((harness) => harness.id === "codex")) return new Set();
+
+  const supplied = new Set();
+  if (flags.openaiApiKey || process.env.OPENAI_API_KEY) supplied.add("openai-api");
+  if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+  const hasChatgptLogin = await detectCodexChatgptAuth();
+  if (hasChatgptLogin) supplied.add("subscription");
+
+  const explicit = flags.openaiApiKey || flags.openrouterApiKey;
+  if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
+
+  console.log("PennyRouter can use your ChatGPT subscription, an OpenAI API key, or an OpenRouter API key to run Codex.");
+  console.log("Choose one or more providers. PennyRouter will try them in order when available.");
+  return promptFundingProviderCheckboxes(
+    CODEX_PROVIDER_OPTIONS,
+    "Which providers should PennyRouter use for Codex?",
+    new Set(["subscription"]),
+  );
+}
+
+async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true) {
   if (!selected.some((harness) => harness.id === "claude-code")) return null;
-  if (flags.noAnthropicAuth) return null;
+  if (!enabled || flags.noAnthropicAuth) return null;
 
   if (flags.token || flags.tokenCommand || process.env.ANTHROPIC_AUTH_TOKEN) {
     const tokenResult = readAnthropicOAuthToken(flags);
@@ -616,19 +838,6 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
     return null;
   }
 
-  if (!flags.anthropicAuth) {
-    console.log("Claude Code subscription auth");
-    console.log("PennyRouter can use your Claude Pro/Max subscription for Anthropic Claude calls.");
-    console.log("PennyRouter still handles routing, optimization, and @penny commands.");
-    console.log("");
-    const ok = await confirm("Enable Claude Pro/Max subscription auth for Claude Code?");
-    if (!ok) {
-      console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
-      console.log("");
-      return null;
-    }
-  }
-
   const tokenResult = readAnthropicOAuthToken({ tokenCommand: flags.tokenCommand });
   if (tokenResult.token) return tokenResult;
 
@@ -659,6 +868,114 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
   return { token, source: "prompt" };
 }
 
+async function configureUserFunding(flags, selected, claudeAnthropicAuth,
+                                    claudeProviders = new Set(), codexProviders = new Set()) {
+  const wantsClaude = selected.some((harness) => harness.id === "claude-code");
+  const wantsCodex = selected.some((harness) => harness.id === "codex");
+  const interactive = !flags.yes && input.isTTY && output.isTTY;
+  const credentials = [];
+
+  let anthropicApiKey = String(
+    flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY || "",
+  ).trim();
+  let openaiApiKey = String(
+    flags.openaiApiKey || process.env.OPENAI_API_KEY || "",
+  ).trim();
+  let openrouterApiKey = String(
+    flags.openrouterApiKey || process.env.OPENROUTER_API_KEY || "",
+  ).trim();
+  const codexSubscriptionAuth = wantsCodex && codexProviders.has("subscription")
+    ? await detectCodexChatgptAuth()
+    : false;
+
+  if (wantsClaude && claudeProviders.has("anthropic-api") && !anthropicApiKey) {
+    if (!interactive) throw new Error("Anthropic API was selected, but no key was provided.");
+    anthropicApiKey = (await promptSecretish("Anthropic API key: ")).trim();
+  }
+  if (wantsClaude && claudeProviders.has("openrouter") && !openrouterApiKey) {
+    if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
+    openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+  }
+  if (wantsCodex && codexProviders.has("subscription") && !codexSubscriptionAuth) {
+    throw new Error(
+      "ChatGPT subscription was selected, but Codex is not logged in. Run `codex login`, or select an API-key provider.",
+    );
+  }
+  if (wantsCodex && codexProviders.has("openai-api") && !openaiApiKey) {
+    if (!interactive) throw new Error("OpenAI API was selected, but no key was provided.");
+    openaiApiKey = (await promptSecretish("OpenAI API key: ")).trim();
+  }
+  if (wantsCodex && codexProviders.has("openrouter") && !openrouterApiKey) {
+    if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
+    openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+  }
+
+  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey) {
+    if (!interactive) {
+      throw new Error(
+        "Claude Code requires a Claude subscription, --anthropic-api-key (or ANTHROPIC_API_KEY), "
+        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
+      );
+    }
+    console.log("Claude Code needs a user-funded provider. PennyRouter will never fall back to its own API keys.");
+    anthropicApiKey = (await promptSecretish(
+      "Anthropic API key (leave blank to use OpenRouter): ",
+    )).trim();
+    if (!anthropicApiKey) {
+      openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+    }
+    if (!anthropicApiKey && !openrouterApiKey) {
+      throw new Error("Claude Code installation cancelled: no subscription or API key was provided.");
+    }
+    console.log("");
+  }
+
+  if (wantsCodex && !codexSubscriptionAuth && !openaiApiKey && !openrouterApiKey) {
+    if (!interactive) {
+      throw new Error(
+        "Codex requires ChatGPT login, --openai-api-key (or OPENAI_API_KEY), "
+        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
+      );
+    }
+    console.log("Codex is not logged into ChatGPT and needs a user-funded provider.");
+    console.log("PennyRouter will never fall back to its own API keys.");
+    openaiApiKey = (await promptSecretish(
+      "OpenAI API key (leave blank to use OpenRouter): ",
+    )).trim();
+    if (!openaiApiKey) {
+      openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+    }
+    if (!openaiApiKey && !openrouterApiKey) {
+      throw new Error("Codex installation cancelled: no subscription or API key was provided.");
+    }
+    console.log("");
+  }
+
+  if (claudeAnthropicAuth) {
+    credentials.push({ provider: "anthropic_oauth", token: claudeAnthropicAuth.token });
+  }
+  if (wantsClaude && anthropicApiKey) {
+    credentials.push({ provider: "anthropic_api", token: anthropicApiKey });
+  }
+  if (wantsCodex && openaiApiKey) {
+    credentials.push({ provider: "openai_api", token: openaiApiKey });
+  }
+  if ((wantsClaude || wantsCodex) && openrouterApiKey) {
+    credentials.push({ provider: "openrouter", token: openrouterApiKey });
+  }
+
+  return {
+    credentials,
+    codexSubscriptionAuth,
+    claudeCredentialProvider: claudeAnthropicAuth
+      ? "claude-subscription"
+      : anthropicApiKey ? "anthropic-api" : openrouterApiKey ? "openrouter" : null,
+    codexCredentialProvider: codexSubscriptionAuth
+      ? "chatgpt-subscription"
+      : openaiApiKey ? "openai-api" : openrouterApiKey ? "openrouter" : null,
+  };
+}
+
 async function disable(flags) {
   const manifest = await loadManifest();
   if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
@@ -1080,6 +1397,72 @@ async function promptHarnessCheckboxesByText(harnesses, selectedIds) {
   }
 }
 
+async function promptFundingProviderCheckboxes(providerOptions, title,
+                                                initialIds = new Set(["subscription"])) {
+  const selectedIds = new Set(initialIds);
+  if (!input.isTTY || !output.isTTY) return selectedIds;
+
+  let cursor = 0;
+  let validation = "";
+  const previousRawMode = input.isRaw;
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write("\x1b[?25l");
+
+  const render = () => {
+    output.write("\x1b[2J\x1b[H");
+    output.write("\n\n");
+    output.write(`${color(title, "bold")}\n\n`);
+    providerOptions.forEach((provider, index) => {
+      const pointer = index === cursor ? color(">", "cyan") : " ";
+      const checked = selectedIds.has(provider.id) ? color("x", "green") : " ";
+      const name = index === cursor ? color(provider.name, "cyan") : provider.name;
+      output.write(` ${pointer} [${checked}] ${name}\n`);
+    });
+    output.write("\nSpace to toggle · Enter to continue.\n");
+    if (validation) output.write(`${validation}\n`);
+  };
+  render();
+
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(Boolean(previousRawMode));
+      input.pause();
+      output.write("\x1b[?25h\n");
+    };
+    const onKeypress = (_str, key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new Error("Cancelled."));
+      } else if (key.name === "up" || key.name === "k") {
+        cursor = (cursor - 1 + providerOptions.length) % providerOptions.length;
+        validation = "";
+        render();
+      } else if (key.name === "down" || key.name === "j") {
+        cursor = (cursor + 1) % providerOptions.length;
+        validation = "";
+        render();
+      } else if (key.name === "space") {
+        const id = providerOptions[cursor].id;
+        if (selectedIds.has(id)) selectedIds.delete(id); else selectedIds.add(id);
+        validation = "";
+        render();
+      } else if (key.name === "return" || key.name === "enter") {
+        if (!selectedIds.size) {
+          validation = "Select at least one provider.";
+          render();
+          return;
+        }
+        cleanup();
+        resolve(selectedIds);
+      }
+    };
+    input.on("keypress", onKeypress);
+  });
+}
+
 function orderedHarnessesForPrompt(detectedIds) {
   return DEFAULT_INSTALL_HARNESS_IDS.map((id) => HARNESS_BY_ID[id]).sort((left, right) => {
     const leftDetected = detectedIds.has(left.id);
@@ -1318,18 +1701,28 @@ function printHelp() {
   console.log(`PennyRouter CLI
 
 Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--anthropic-auth|--no-anthropic-auth] [--local[=URL]] [--allow-running-harnesses]
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openrouter-api-key KEY] [--local[=URL]] [--allow-running-harnesses]
+  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL] [--allow-running-harnesses]
   pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL] [--forget]
   pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter uninstall [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--forget-token]
   pennyrouter status
 
+Update refreshes the managed local config and the penny runtime to this package version.
+It reuses your existing key and never re-asks for subscription or API credentials.
+
 Examples:
+  npx pennyrouter update
+  npx pennyrouter update --dry-run
+  npx pennyrouter update --harness claude-code
   npx pennyrouter install
   npx pennyrouter install --make-default
   npx pennyrouter install --penny-only
   npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
+  npx pennyrouter install --harness claude-code --anthropic-api-key <key>
+  npx pennyrouter install --harness codex --openai-api-key <key>
+  npx pennyrouter install --openrouter-api-key <key>
   npx pennyrouter auth anthropic
   npx pennyrouter install --all
   npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes

package/src/harnesses/claude-code.js

@@ -7,22 +7,29 @@ const CONNECTOR_SETTING = "disableClaudeAiConnectors";
 // Values written into Claude Code's four model slots. CC displays a slot's VALUE verbatim in
 // its /model menu AND sends it as the request `model`, so each value is both the menu label
 // and the gateway's routing key. The three concrete Claude slots carry friendly PINNED labels
-// ("Penny Opus/Sonnet/Haiku/Fable") that the gateway maps to that exact model — the user's pick
-// runs on the model they chose, no dynamic tier switching on the trunk (background/utility
-// calls still route cheap, which is where the savings come from). The separate Fable slot is
-// pinned to Fable; the DYNAMIC "Penny Custom" option lets PennyRouter cost-route. Legacy
-// "Penny Speed/Core/Power"
-// installs (dynamic bundles) are still recognized for uninstall (see isPennyRouterModelValue).
+// ("Opus 5/Sonnet 5/Haiku 4.5/Fable 5 (PennyRouter)") that the gateway maps to that exact
+// model — the user's pick runs on the model they chose, no dynamic tier switching on the
+// trunk (background/utility calls still route cheap, which is where the savings come from).
+// Named "<Model> (PennyRouter)" rather than "Penny <Model>" so CC's own generated "Custom ...
+// model" subtext still reads as a real Claude model routed through Penny, not a distinct
+// custom model. The separate Fable slot is pinned to Fable; the DYNAMIC "Penny Custom" option
+// lets PennyRouter cost-route. Legacy "Penny Speed/Core/Power/Opus/Sonnet/Haiku/Fable"
+// installs (dynamic bundles, or the pre-rename pinned labels) are still recognized for
+// uninstall (see isPennyRouterModelValue).
 export const CLAUDE_CODE_MODELS = {
-  haiku: "Penny Haiku",     // -> pinned anthropic/claude-haiku-4-5-20251001
-  sonnet: "Penny Sonnet",   // -> pinned anthropic/claude-sonnet-4-6
-  opus: "Penny Opus",       // -> pinned anthropic/claude-opus-4-8
-  fable: "Penny Fable",     // -> pinned anthropic/claude-fable-5
-  custom: "Penny Custom",   // -> dynamic (PennyRouter cost-routing)
+  haiku: "Haiku 4.5 (PennyRouter)",   // -> pinned anthropic/claude-haiku-4-5-20251001
+  sonnet: "Sonnet 5 (PennyRouter)",   // -> pinned anthropic/claude-sonnet-5
+  opus: "Opus 5 (PennyRouter)",       // -> pinned anthropic/claude-opus-5
+  fable: "Fable 5 (PennyRouter)",     // -> pinned anthropic/claude-fable-5
+  custom: "Penny Custom",             // -> dynamic (PennyRouter cost-routing)
 };
-// Retired dynamic-bundle labels (pre-pinned-trunk). Not written by a fresh install; matched
-// only so uninstall/detect still recognize and clean up an older install.
-const LEGACY_PENNY_LABELS = ["Penny Speed", "Penny Core", "Penny Power"];
+// Retired dynamic-bundle labels (pre-pinned-trunk) and the pre-rename pinned labels. Not
+// written by a fresh install; matched only so uninstall/detect still recognize and clean up
+// an older install.
+const LEGACY_PENNY_LABELS = [
+  "Penny Speed", "Penny Core", "Penny Power",
+  "Penny Opus", "Penny Sonnet", "Penny Haiku", "Penny Fable",
+];
 
 export const claudeCodeHarness = {
   id: "claude-code",
@@ -60,6 +67,10 @@ export const claudeCodeHarness = {
     current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
     current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
     current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
+    // context window from the name and falls back to a conservative 200K default. Tell it
+    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
+    current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
 
     const statusline = await configureClaudeCodeStatusline(current);
 
@@ -82,6 +93,7 @@ export const claudeCodeHarness = {
           "ANTHROPIC_DEFAULT_SONNET_MODEL",
           "ANTHROPIC_DEFAULT_HAIKU_MODEL",
           "ANTHROPIC_DEFAULT_FABLE_MODEL",
+          "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
         ],
       },
     };
@@ -105,6 +117,10 @@ export const claudeCodeHarness = {
     current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
     current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
     current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
+    // context window from the name and falls back to a conservative 200K default. Tell it
+    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
+    current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
 
     const statusline = await configureClaudeCodeStatusline(current);
 
@@ -127,6 +143,7 @@ export const claudeCodeHarness = {
           "ANTHROPIC_DEFAULT_SONNET_MODEL",
           "ANTHROPIC_DEFAULT_HAIKU_MODEL",
           "ANTHROPIC_DEFAULT_FABLE_MODEL",
+          "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
         ],
       },
     };
@@ -146,6 +163,10 @@ export const claudeCodeHarness = {
     current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
     current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
     current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
+    // context window from the name and falls back to a conservative 200K default. Tell it
+    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
+    current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
 
     const statusline = await configureClaudeCodeStatusline(current);
 
@@ -168,6 +189,7 @@ export const claudeCodeHarness = {
           "ANTHROPIC_DEFAULT_SONNET_MODEL",
           "ANTHROPIC_DEFAULT_HAIKU_MODEL",
           "ANTHROPIC_DEFAULT_FABLE_MODEL",
+          "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
         ],
       },
     };
@@ -202,6 +224,7 @@ export const claudeCodeHarness = {
       ]) {
         if (current.env[k] === LEGACY_MODEL_LABEL || isPennyRouterModelValue(current.env[k])) delete current.env[k];
       }
+      delete current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS;
     }
     restoreClaudeAiConnectors(current, record);
     if (current["anthropic.baseURL"] && isPennyRouterValue(current["anthropic.baseURL"])) {

package/src/launch.js

@@ -344,6 +344,10 @@ export function buildPennyInvocation(harness, args, config) {
     if (models.sonnet) env.ANTHROPIC_DEFAULT_SONNET_MODEL = models.sonnet;
     if (models.opus) env.ANTHROPIC_DEFAULT_OPUS_MODEL = models.opus;
     if (models.fable) env.ANTHROPIC_DEFAULT_FABLE_MODEL = models.fable;
+    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
+    // context window from the name and falls back to a conservative 200K default. Tell it
+    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
+    env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
     return {
       command: "claude",
       args: ["--settings", claudeLaunchSettingsPath(), ...args],

package/src/launch.test.js

@@ -73,7 +73,7 @@ async function main() {
       apiKey: "pr-super-secret",
       gatewayBaseUrl: "https://gateway.example/",
       subscriptionAuth: true,
-      models: { haiku: "Penny Haiku", sonnet: "Penny Sonnet", opus: "Penny Opus" },
+      models: { haiku: "Haiku 4.5 (PennyRouter)", sonnet: "Sonnet 5 (PennyRouter)", opus: "Opus 5 (PennyRouter)" },
     });
     await configurePennyHarness("codex", {
       apiKey: "pr-super-secret",
@@ -100,7 +100,7 @@ async function main() {
     assert.ok(!claude.args.includes("--plugin-dir"));
     assert.equal(claude.env.ANTHROPIC_AUTH_TOKEN, "pr-super-secret");
     assert.equal(claude.env.ANTHROPIC_BASE_URL, "https://gateway.example/");
-    assert.equal(claude.env.ANTHROPIC_DEFAULT_OPUS_MODEL, "Penny Opus");
+    assert.equal(claude.env.ANTHROPIC_DEFAULT_OPUS_MODEL, "Opus 5 (PennyRouter)");
 
     const codex = buildPennyInvocation("codex", ["resume", "--last"], config);
     assert.deepEqual(codex.args, ["--profile", "pennyrouter", "resume", "--last"]);

package/src/session.js

@@ -46,10 +46,10 @@ export function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// Encrypt-and-store an Anthropic setup-token against the account server-side, so the
-// pr- key alone unlocks Claude and no token is written to the harness config. The
-// gateway (not the web app) owns this: it holds the pr- key auth and the encryption.
-export async function storeAnthropicToken({ gatewayBaseUrl, apiKey, token }) {
+// Encrypt and store a user-owned upstream credential against the account server-side,
+// so the pr- key alone unlocks the selected harness and the provider secret is never
+// written to harness configuration.
+export async function storeUpstreamCredential({ gatewayBaseUrl, apiKey, provider, token }) {
   const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/upstream-credentials`;
   const response = await fetch(url, {
     method: "POST",
@@ -57,7 +57,7 @@ export async function storeAnthropicToken({ gatewayBaseUrl, apiKey, token }) {
       "content-type": "application/json",
       authorization: `Bearer ${apiKey}`,
     },
-    body: JSON.stringify({ provider: "anthropic", token }),
+    body: JSON.stringify({ provider, token }),
   });
   if (!response.ok) {
     let detail = "";
@@ -66,15 +66,22 @@ export async function storeAnthropicToken({ gatewayBaseUrl, apiKey, token }) {
     } catch {
       // non-JSON body; fall through to status-only message
     }
-    throw new Error(`Storing Claude token failed: HTTP ${response.status}${detail ? ` — ${detail}` : ""}`);
+    throw new Error(`Storing ${provider} credential failed: HTTP ${response.status}${detail ? ` — ${detail}` : ""}`);
   }
   return response.json();
 }
 
+export async function storeAnthropicToken({ gatewayBaseUrl, apiKey, token }) {
+  return storeUpstreamCredential({
+    gatewayBaseUrl, apiKey, provider: "anthropic_oauth", token,
+  });
+}
+
 // Exercise the exact modern Claude Code request feature that has historically broken at
 // proxy boundaries BEFORE changing ~/.claude/settings.json (a user-global redirect). This
-// is intentionally a real, tiny Messages call: a generic /health check cannot prove that
-// Anthropic beta headers survive the gateway's subscription/native relay.
+// is intentionally sent through /v1/messages rather than a generic /health endpoint, so it
+// proves the gateway can parse the modern beta/tool/context-management envelope. The exact
+// one-token install probe is answered locally by compatible gateways and costs nothing.
 export async function probeClaudeCodeGateway({ gatewayBaseUrl, apiKey }) {
   const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/messages?beta=true`;
   const controller = new AbortController();
@@ -90,8 +97,8 @@ export async function probeClaudeCodeGateway({ gatewayBaseUrl, apiKey }) {
         "anthropic-beta": "compact-2026-01-12",
       },
       body: JSON.stringify({
-        model: "Penny Sonnet",
-        max_tokens: 16,
+        model: "Sonnet 5 (PennyRouter)",
+        max_tokens: 1,
         stream: false,
         messages: [{ role: "user", content: "Reply OK." }],
         tools: [{

package/src/session.test.js

@@ -28,6 +28,7 @@ try {
   assert.equal(seen.options.headers.authorization, "Bearer pr-test");
   assert.equal(seen.options.headers["anthropic-beta"], "compact-2026-01-12");
   const body = JSON.parse(seen.options.body);
+  assert.equal(body.max_tokens, 1);
   assert.equal(body.context_management.edits[0].type, "compact_20260112");
   assert.equal(body.tools[0].name, "pennyrouter_install_probe");